{"record":{"id":"c10aac71a4b723cb","repo":"abhigyanpatwari/GitNexus","slug":"the-mcp-default-repository-is-not-in-the-configure","errorCode":null,"errorMessage":"The MCP default repository is not in the configured allowlist.","messagePattern":"The MCP default repository is not in the configured allowlist\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"gitnexus/src/mcp/repository-policy.ts","lineNumber":456,"sourceCode":"    const byPath = new Map<string, ResolvedRepository>();\n    for (const specifier of raw.allowed) {\n      const result = resolveSpecifier(specifier, registry);\n      if (!result.repo) throw startupResolutionError(result.reason ?? 'invalid');\n      byPath.set(result.repo.pathKey, result.repo);\n    }\n    allowed = [...byPath.values()];\n  }\n\n  let defaultRepo: ResolvedRepository | undefined;\n  if (raw.defaultRepo) {\n    const result = resolveSpecifier(raw.defaultRepo, registry);\n    if (!result.repo) throw startupResolutionError(result.reason ?? 'invalid');\n    defaultRepo = result.repo;\n  }\n\n  const defaultPathKey = defaultRepo?.pathKey;\n  if (defaultPathKey && allowed && !allowed.some((repo) => repo.pathKey === defaultPathKey)) {\n    throw new Error('The MCP default repository is not in the configured allowlist.');\n  }\n\n  return new McpRepositoryPolicy(registry, allowed, defaultRepo);\n}\n","sourceCodeStart":438,"sourceCodeEnd":461,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/52924ef12c2290ceee4612526a828ec4cdf2047f/gitnexus/src/mcp/repository-policy.ts#L438-L461","documentation":"Thrown at policy construction (startup or first policy resolution) when GITNEXUS_MCP_DEFAULT_REPO resolves to a real repository, but that repository's normalized path key is not among the entries resolved from GITNEXUS_MCP_ALLOWED_REPOS. The default must be a member of the allowlist — otherwise the server would auto-select a repo it was configured to exclude. Note a default that fails to resolve at all produces a different startup resolution error first.","triggerScenarios":"GITNEXUS_MCP_ALLOWED_REPOS='/srv/repos/frontend' plus GITNEXUS_MCP_DEFAULT_REPO='/srv/repos/backend' (path key mismatch), or a default given by name whose resolved path differs (symlink, case difference on Windows where paths are lowercased, relative vs absolute path) from every allowlist entry.","commonSituations":"The allowlist is later tightened and the stale default is forgotten. Symlinked or differently-cased repo paths make two textual specifiers point at the same repo without matching path keys. Renaming/moving an indexed repository breaks the allowlist entry but not the default.","solutions":["Make GITNEXUS_MCP_DEFAULT_REPO one of the exact entries in GITNEXUS_MCP_ALLOWED_REPOS (same name or same absolute path).","Remove GITNEXUS_MCP_DEFAULT_REPO if no default is needed.","For path mismatches, use identical absolute paths in both variables; on Windows remember path keys compare lowercased, and resolve symlinks so both sides see the same real path."],"exampleFix":"# before\nGITNEXUS_MCP_ALLOWED_REPOS=/srv/repos/frontend\nGITNEXUS_MCP_DEFAULT_REPO=/srv/repos/backend\n\n# after\nGITNEXUS_MCP_ALLOWED_REPOS=/srv/repos/frontend,/srv/repos/backend\nGITNEXUS_MCP_DEFAULT_REPO=/srv/repos/frontend","handlingStrategy":"validation","validationCode":"// Preflight at startup: default must be one of the allowlist entries\nconst allowed = (process.env.GITNEXUS_MCP_ALLOWED_REPOS ?? '').split(',').map((s) => s.trim()).filter(Boolean);\nconst def = process.env.GITNEXUS_MCP_DEFAULT_REPO?.trim();\nif (allowed.length > 0 && def && !allowed.includes(def)) {\n  throw new Error(`GITNEXUS_MCP_DEFAULT_REPO='${def}' is not in GITNEXUS_MCP_ALLOWED_REPOS`);\n}","typeGuard":"const defaultInAllowlist = (def: string | undefined, allowed: string[]): boolean =>\n  def === undefined || allowed.some((a) => path.resolve(a) === path.resolve(def));","tryCatchPattern":null,"preventionTips":["When editing one of GITNEXUS_MCP_ALLOWED_REPOS / GITNEXUS_MCP_DEFAULT_REPO, always review the other.","Use identical absolute, symlink-resolved paths in both variables; remember Windows path keys are lowercased.","Add a startup preflight check that validates default ∈ allowlist before the server boots."],"tags":["mcp","allowlist","default-repository","configuration","startup"],"backgroundTag":"default-not-in-allowlist","analyzedSha":"52924ef12c2290ceee4612526a828ec4cdf2047f","analyzedAt":"2026-08-20T23:29:22.980Z","contentChangedAt":"2026-08-20T23:29:22.980Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}