{"record":{"id":"b81dbdac4a64dc26","repo":"abhigyanpatwari/GitNexus","slug":"clone-has-more-than-max-clone-refs-references-r","errorCode":null,"errorMessage":"clone has more than {MAX_CLONE_REFS} references; refusing incomplete sanitization","messagePattern":"clone has more than (.+?) references; refusing incomplete sanitization","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"eval/workflow_bench/oracle_assets.py","lineNumber":363,"sourceCode":"            \"Sanitized benchmark task snapshot\",\n        ],\n        timeout=60,\n        env=deterministic_git_env,\n    )\n    _git_checked(\n        root,\n        [\"update-ref\", \"--no-deref\", \"HEAD\", sanitized_head, original_head],\n        timeout=60,\n    )\n\n    refs_output = _git_checked(\n        root,\n        [\"for-each-ref\", f\"--count={MAX_CLONE_REFS + 1}\", \"--format=%(refname)\"],\n        timeout=60,\n    )\n    refs = refs_output.splitlines() if refs_output else []\n    if len(refs) > MAX_CLONE_REFS:\n        raise ValueError(f\"clone has more than {MAX_CLONE_REFS} references; refusing incomplete sanitization\")\n    if any(not ref.startswith(\"refs/\") or any(character.isspace() for character in ref) for ref in refs):\n        raise ValueError(\"clone contains an unsafe reference name\")\n    for ref in refs:\n        _git_checked(root, [\"update-ref\", \"--no-deref\", \"-d\", ref], timeout=60)\n\n    remote_output = _git_checked(root, [\"remote\"], timeout=60)\n    remotes = remote_output.splitlines() if remote_output else []\n    if len(remotes) > MAX_CLONE_REFS or any(\n        re.fullmatch(r\"[A-Za-z0-9][A-Za-z0-9._/-]{0,255}\", remote) is None or \"..\" in remote for remote in remotes\n    ):\n        raise ValueError(\"clone contains unsafe or unbounded remote metadata\")\n    for remote in remotes:\n        _git_checked(root, [\"remote\", \"remove\", remote], timeout=60)\n\n    _git_checked(\n        root,\n        [\"reflog\", \"expire\", \"--expire=now\", \"--expire-unreachable=now\", \"--all\"],\n        timeout=60,","sourceCodeStart":345,"sourceCodeEnd":381,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/oracle_assets.py#L345-L381","documentation":"After rewriting HEAD to the parentless sanitized commit, the harness enumerates refs with `for-each-ref --count=MAX_CLONE_REFS+1` (MAX_CLONE_REFS=1024). If more than 1024 refs come back, it refuses to delete them in a loop because silent truncation could leave oracle-bearing refs recoverable.","triggerScenarios":"Triggered when the clone has more than 1024 refs (a mirror clone, a fetch that pulled every PR ref, or a repo with extensive tag/branch history).","commonSituations":"`git clone --mirror`; CI clones that fetch all refs/*; large monorepos with thousands of tags; fetching refs/pull/* from GitHub.","solutions":["Clone with a single branch and no tags: `git clone --single-branch --no-tags <url>`.","Drop the origin remote before sanitizing so origin/* refs disappear: `git -C <clone> remote remove origin`.","Prune refs you do not need: `git -C <clone> for-each-ref --format='%(refname)' | xargs -n1 git -C <clone> update-ref -d`."],"exampleFix":"// before\n git clone --mirror <url> <clone>\n// after\n git clone --single-branch --no-tags <url> <clone>\n","handlingStrategy":"validation","validationCode":"from pathlib import Path\nfrom eval.workflow_bench.oracle_assets import MAX_CLONE_REFS\nfrom eval.workflow_bench.process_control import run_checked\n\ndef ref_count_within_bound(clone: Path) -> bool:\n    out = run_checked(\n        [\"git\", \"-C\", str(clone), \"for-each-ref\", f\"--count={MAX_CLONE_REFS+1}\", \"--format=%(refname)\"],\n        timeout=60,\n    ).stdout_tail.strip()\n    return len(out.splitlines()) <= MAX_CLONE_REFS\n","typeGuard":"def is_too_many_refs(exc: BaseException) -> bool:\n    return isinstance(exc, ValueError) and \"more than\" in str(exc) and \"references\" in str(exc)\n","tryCatchPattern":"try:\n    oracle_assets.sanitize_clone_for_hidden_oracles(clone)\nexcept ValueError as exc:\n    quarantine(clone)\n    raise AbortTask(str(exc)) from exc\n","preventionTips":["Prefer --single-branch clones for the benchmark.","Avoid --mirror; it materializes every ref and exceeds the bounded-deletion budget."],"tags":["git","refs","clone","mirror","oracle","sanitization","invariant"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}