{"record":{"id":"b9cd3b29a0e9f1ae","repo":"abhigyanpatwari/GitNexus","slug":"source-branch-name-must-not-contain-a-backtick","errorCode":null,"errorMessage":"${source}: branch name must not contain a backtick (it would break the generated Markdown).","messagePattern":"(.+?): branch name must not contain a backtick \\(it would break the generated Markdown\\)\\.","errorType":"validation","errorClass":"GitNexusRcError","httpStatus":null,"severity":"error","filePath":"gitnexus/src/cli/analyze-config.ts","lineNumber":189,"sourceCode":"  if (/[~^:?*[\\\\]/.test(trimmed)) {\n    throw new GitNexusRcError(\n      `${source}: branch name contains characters not allowed in a git ref (~ ^ : ? * [ \\\\).`,\n    );\n  }\n  if (trimmed.startsWith('-')) {\n    throw new GitNexusRcError(`${source}: branch name must not start with \"-\".`);\n  }\n  if (trimmed.includes('..')) {\n    throw new GitNexusRcError(`${source}: branch name must not contain \"..\".`);\n  }\n  // Git permits a backtick in a ref, but the branch is embedded inside a\n  // Markdown inline-code span in the generated AGENTS.md/CLAUDE.md regression\n  // example, where a backtick would close the span early and let the rest of\n  // the template render as instruction text. Reject it at this single\n  // chokepoint so all three tiers (CLI flag, .gitnexusrc, auto-detect via\n  // sanitizeDetectedBranch) are covered (#1996 tri-review P1).\n  if (trimmed.includes('`')) {\n    throw new GitNexusRcError(\n      `${source}: branch name must not contain a backtick (it would break the generated Markdown).`,\n    );\n  }\n  return trimmed;\n}\n\n/**\n * Best-effort validation for an auto-detected branch (from git). Never throws —\n * returns `undefined` for anything unusable so the resolver falls back to the\n * next precedence tier.\n */\nexport function sanitizeDetectedBranch(value: string | null | undefined): string | undefined {\n  if (!value) return undefined;\n  try {\n    return validateBranchName(value, 'detected branch');\n  } catch {\n    return undefined;\n  }","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/gitnexus/src/cli/analyze-config.ts#L171-L207","documentation":"Thrown by validateBranchName() when the branch name contains a backtick. Although git allows backticks in refnames, GitNexus embeds the branch inside a Markdown inline-code span in the generated AGENTS.md/CLAUDE.md regression example, where a backtick would close the span early and let the rest of the template render as instruction text — a prompt-injection risk. Rejecting it at this chokepoint covers all three input tiers (CLI flag, .gitnexusrc, auto-detect).","triggerScenarios":"Passing a branch name containing '`', e.g. a name auto-generated from a shell command substitution, or a paste that included a backtick.","commonSituations":"A branch name built from a templating script that wrapped a variable in backticks; copy-pasting from markdown where the name was inside a code span.","solutions":["Remove the backtick from the branch name.","Rename the actual git branch if it contains a backtick, then re-run."],"exampleFix":"# before\ngitnexus analyze --default-branch \"feature/`auth`\"\n\n# after\ngitnexus analyze --default-branch \"feature/auth\"","handlingStrategy":"validation","validationCode":"function assertNoBacktick(name: string): void {\n  if (name.includes('`')) {\n    throw new Error('branch name must not contain a backtick (would break generated Markdown)');\n  }\n}","typeGuard":"function hasNoBacktick(name: string): boolean {\n  return typeof name === 'string' && !name.includes('`');\n}","tryCatchPattern":null,"preventionTips":["Rename the actual git branch if it contains a backtick before configuring it.","Avoid building branch names from shell command substitution templates.","Treat any backtick in agent-adjacent config as a prompt-injection smell."],"tags":["validation","git","branch","markdown-injection","config","security"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}