{"record":{"id":"d16a3debee5f950d","repo":"abhigyanpatwari/GitNexus","slug":"allowedraw-key-must-not-be-blank","errorCode":null,"errorMessage":"${allowedRaw.key} must not be blank.","messagePattern":"(.+?) must not be blank\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"gitnexus/src/mcp/repository-policy.ts","lineNumber":42,"sourceCode":"function configuredValue(\n  env: NodeJS.ProcessEnv,\n  key: string,\n): { key: string; value: string } | undefined {\n  const value = env[key];\n  return value === undefined ? undefined : { key, value };\n}\n\nfunction parseRepositoryPolicy(env: NodeJS.ProcessEnv): RawRepositoryPolicy {\n  const allowedRaw = configuredValue(env, CANONICAL_ALLOWED);\n  const defaultRaw = configuredValue(env, CANONICAL_DEFAULT);\n\n  let allowed: string[] | undefined;\n  if (allowedRaw) {\n    allowed = allowedRaw.value\n      .split(',')\n      .map((entry) => entry.trim())\n      .filter(Boolean);\n    if (allowed.length === 0) throw new Error(`${allowedRaw.key} must not be blank.`);\n  }\n\n  let defaultRepo: string | undefined;\n  if (defaultRaw) {\n    defaultRepo = defaultRaw.value.trim();\n    if (!defaultRepo) throw new Error(`${defaultRaw.key} must not be blank.`);\n  }\n\n  return { allowed, defaultRepo };\n}\n\nfunction normalizedPath(value: string): string {\n  const resolved = path.resolve(value);\n  return process.platform === 'win32' ? resolved.toLowerCase() : resolved;\n}\n\nfunction isAbsolutePath(value: string): boolean {\n  return path.isAbsolute(value) || path.win32.isAbsolute(value);","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/52924ef12c2290ceee4612526a828ec4cdf2047f/gitnexus/src/mcp/repository-policy.ts#L24-L60","documentation":"Thrown by parseRepositoryPolicy when GITNEXUS_MCP_ALLOWED_REPOS is defined but contains no usable entries. The value is split on commas, each entry trimmed, and empty entries filtered out; if nothing survives, the allowlist variable is effectively blank and the server refuses to start rather than silently allowing nothing (or everything). The message names the exact offending variable key.","triggerScenarios":"Setting GITNEXUS_MCP_ALLOWED_REPOS=',', ' , ', ',,,', or a value made only of whitespace. Note an unset variable is fine; an empty string value also passes this check but yields no restriction only when combined with no default — the blank-comma case is the hard failure.","commonSituations":"A deploy script exports the variable from an empty shell variable: GITNEXUS_MCP_ALLOWED_REPOS=\"$REPOS\" where REPOS is unset-but-quoted becomes ''. More commonly, a YAML/CI env block has a placeholder like 'repo1, ' with the real list never substituted, or a trailing/duplicate commas-only value survives templating.","solutions":["Set the variable to a comma-separated list of repository names or absolute paths with at least one real entry, e.g. GITNEXUS_MCP_ALLOWED_REPOS='frontend,backend'.","If you did not intend an allowlist, remove the variable from the environment instead of leaving a placeholder.","Verify what the process actually sees: print process.env.GITNEXUS_MCP_ALLOWED_REPOS.length and its JSON representation from the server context."],"exampleFix":"# before\nexport GITNEXUS_MCP_ALLOWED_REPOS=\"$REPOS\"   # REPOS unset -> blank\n\n# after\nexport GITNEXUS_MCP_ALLOWED_REPOS=\"frontend,backend\"","handlingStrategy":"validation","validationCode":"const rawAllowed = process.env.GITNEXUS_MCP_ALLOWED_REPOS;\nif (rawAllowed !== undefined) {\n  const entries = rawAllowed.split(',').map((s) => s.trim()).filter(Boolean);\n  if (entries.length === 0) {\n    throw new Error('GITNEXUS_MCP_ALLOWED_REPOS is blank — set a real list or unset it.');\n  }\n}","typeGuard":"const hasValidAllowlistEnv = (v: string | undefined): boolean =>\n  v === undefined || v.split(',').some((s) => s.trim().length > 0);","tryCatchPattern":null,"preventionTips":["In launch scripts use ${VAR:-} carefully: an unset variable exported with quotes becomes an empty value; prefer conditional export.","Add CI checks that fail when an allowlist env resolves to a commas/whitespace-only string.","Log the effective (parsed) configuration at startup so blank lists are visible immediately."],"tags":["mcp","allowlist","environment-variables","validation","configuration"],"backgroundTag":"invalid-env-var-value","analyzedSha":"52924ef12c2290ceee4612526a828ec4cdf2047f","analyzedAt":"2026-08-20T23:29:22.980Z","contentChangedAt":"2026-08-20T23:29:22.980Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}