{"record":{"id":"c446d27edbd99b43","repo":"abhigyanpatwari/GitNexus","slug":"compound-engineering-plugin-entries-must-be-regula","errorCode":null,"errorMessage":"Compound Engineering plugin entries must be regular files: {entry.path}","messagePattern":"Compound Engineering plugin entries must be regular files: (.+?)","errorType":"exception","errorClass":"SandboxError","httpStatus":null,"severity":"error","filePath":"eval/workflow_bench/runtime_mounts.py","lineNumber":333,"sourceCode":"                entries = sorted(scanned, key=lambda entry: entry.name)\n        except OSError as exc:\n            raise SandboxError(f\"Compound Engineering plugin directory is unreadable: {directory}: {exc}\") from exc\n        for entry in entries:\n            relative = relative_dir / entry.name\n            if _is_forbidden_plugin_path(relative):\n                continue\n            try:\n                metadata = entry.stat(follow_symlinks=False)\n            except OSError as exc:\n                raise SandboxError(f\"Compound Engineering plugin entry is unreadable: {entry.path}: {exc}\") from exc\n            if stat.S_ISLNK(metadata.st_mode):\n                raise SandboxError(f\"Compound Engineering plugin entries must not be symlinks: {entry.path}\")\n            if stat.S_ISDIR(metadata.st_mode):\n                yield from walk(Path(entry.path), relative)\n            elif stat.S_ISREG(metadata.st_mode):\n                yield relative, Path(entry.path)\n            else:\n                raise SandboxError(f\"Compound Engineering plugin entries must be regular files: {entry.path}\")\n\n    for name in _ALLOWED_PLUGIN_DIRS:\n        directory = source / name\n        if not directory.exists():\n            continue\n        try:\n            metadata = directory.lstat()\n        except OSError as exc:\n            raise SandboxError(f\"Compound Engineering plugin component is unreadable: {directory}: {exc}\") from exc\n        if stat.S_ISLNK(metadata.st_mode) or not stat.S_ISDIR(metadata.st_mode):\n            raise SandboxError(f\"Compound Engineering plugin component must be a real directory: {directory}\")\n        yield from walk(directory, PurePosixPath(name))\n\n\ndef _bounded_plugin_bytes(path: Path) -> tuple[bytes, bool]:\n    \"\"\"Read one stable regular file without following a last-component symlink.\"\"\"\n\n    try:","sourceCodeStart":315,"sourceCodeEnd":351,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/runtime_mounts.py#L315-L351","documentation":"walk() only yields directories and regular files. Any other file type (FIFO, socket, character/block device) raises this error — special files have no legitimate place in a Claude plugin snapshot and can be used to disrupt or escape the sandbox.","triggerScenarios":"A FIFO, Unix socket, or device node exists under skills/, scripts/, or assets/ — e.g., a leftover mkfifo from debugging, or a maliciously crafted plugin.","commonSituations":"Manual debugging artifact left in the tree; malicious plugin; broken extract that created device nodes (rare).","solutions":["Locate special files: `find <plugin_dir>/{skills,scripts,assets} -type b -o -type c -o -type p -o -type s`.","Remove them, then re-extract the plugin from a trusted source.","Audit the plugin provenance if unexpected special files appear."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import os, stat\nfrom pathlib import Path\n\ndef only_regular_and_dirs(source: Path) -> bool:\n    for name in (\"skills\", \"scripts\", \"assets\"):\n        d = source / name\n        if not d.exists():\n            continue\n        for root, _dirs, files in os.walk(d):\n            for f in files:\n                mode = (Path(root) / f).lstat().st_mode\n                if not (stat.S_ISREG(mode) or stat.S_ISLNK(mode)):\n                    return False\n    return True","typeGuard":null,"tryCatchPattern":"try:\n    list(_plugin_files(source))\nexcept SandboxError as exc:\n    if \"must be regular files\" in str(exc):\n        # locate and remove the FIFO/socket/device, then re-extract\n        ...\n    raise","preventionTips":["Audit plugin trees for special files before snapshotting.","Only build plugins from trusted, scripted generators."],"tags":["ce-plugin","sandbox","filesystem","security"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}