{"record":{"id":"d1ce40c7adcf82cd","repo":"abhigyanpatwari/GitNexus","slug":"plan-artifact-cannot-be-a-symlink-path","errorCode":null,"errorMessage":"plan artifact cannot be a symlink: {path}","messagePattern":"plan artifact cannot be a symlink: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"eval/workflow_bench/runner_artifacts.py","lineNumber":269,"sourceCode":"        raise ValueError(f\"{phase} changed the evaluated skill fingerprint\")\n\n\ndef snapshot_plan_docs(worktree: Path) -> dict[Path, str]:\n    \"\"\"Hash direct, regular plan artifacts without following links.\"\"\"\n\n    plans = worktree / \"docs\" / \"plans\"\n    if not plans.exists():\n        return {}\n    if plans.is_symlink() or not plans.is_dir():\n        raise ValueError(f\"plan directory must be a real directory: {plans}\")\n\n    snapshot: dict[Path, str] = {}\n    for path in sorted(plans.iterdir()):\n        if path.suffix.lower() not in {\".md\", \".html\"}:\n            continue\n        metadata = path.lstat()\n        if stat.S_ISLNK(metadata.st_mode):\n            raise ValueError(f\"plan artifact cannot be a symlink: {path}\")\n        if not stat.S_ISREG(metadata.st_mode):\n            raise ValueError(f\"plan artifact must be a regular file: {path}\")\n        descriptor = os.open(path, os.O_RDONLY | getattr(os, \"O_NOFOLLOW\", 0))\n        try:\n            opened = os.fstat(descriptor)\n            if not stat.S_ISREG(opened.st_mode) or opened.st_dev != metadata.st_dev or opened.st_ino != metadata.st_ino:\n                raise ValueError(f\"plan artifact changed while opening: {path}\")\n            with os.fdopen(descriptor, \"rb\", closefd=False) as handle:\n                snapshot[path] = hashlib.file_digest(handle, \"sha256\").hexdigest()\n            after = os.fstat(descriptor)\n            if (opened.st_size, opened.st_mtime_ns) != (after.st_size, after.st_mtime_ns):\n                raise ValueError(f\"plan artifact changed while hashing: {path}\")\n        finally:\n            os.close(descriptor)\n    return snapshot\n\n\ndef new_plan_doc(worktree: Path, before: dict[Path, str]) -> Path:","sourceCodeStart":251,"sourceCodeEnd":287,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/runner_artifacts.py#L251-L287","documentation":"Raised by snapshot_plan_docs (runner_artifacts.py:269) when a .md/.html file under docs/plans has S_ISLNK true in its lstat. Plan artifacts must be regular files so their content hash is trustworthy; a symlink could redirect the hash to arbitrary content (e.g. /etc/passwd) and is rejected before opening.","triggerScenarios":"For a .md/.html entry in docs/plans, path.lstat().st_mode is S_ISLNK. The model or a setup step replaced a plan file with a symlink, or the repo commits symlinks into docs/plans.","commonSituations":"A planning phase symlinks docs/plans/foo.md to an existing template; a repo keeps canonical plans in a sibling dir and symlinks them in; a model tries to 'reuse' another plan via a symlink.","solutions":["Find the symlink under docs/plans (find docs/plans -type l) and replace it with a real file (cp -L then rm the link).","Constrain the planning prompt to write regular files only; forbid symlinks in docs/plans.","If the repo intentionally versioned symlinks, restructure to commit real files."],"exampleFix":"# before\nln -s ../templates/plan.md docs/plans/plan.md\n\n# after\ncp ../templates/plan.md docs/plans/plan.md","handlingStrategy":"validation","validationCode":"import stat\nfrom pathlib import Path\n\nplans = Path(worktree) / \"docs\" / \"plans\"\nif plans.is_dir():\n    for p in plans.iterdir():\n        if p.suffix.lower() in {\".md\", \".html\"}:\n            assert not stat.S_ISLNK(p.lstat().st_mode), f\"plan is a symlink: {p}\"\n            assert stat.S_ISREG(p.lstat().st_mode), f\"plan is not regular: {p}\"","typeGuard":"import stat\nfrom pathlib import Path\n\ndef all_plans_are_regular_files(worktree) -> bool:\n    plans = Path(worktree) / \"docs\" / \"plans\"\n    if not plans.is_dir():\n        return True\n    for p in plans.iterdir():\n        if p.suffix.lower() not in {\".md\", \".html\"}:\n            continue\n        mode = p.lstat().st_mode\n        if stat.S_ISLNK(mode) or not stat.S_ISREG(mode):\n            return False\n    return True","tryCatchPattern":null,"preventionTips":["Forbid symlinks in docs/plans in the planning prompt.","Replace any committed symlink with a real file (cp -L)."],"tags":["plan-docs","symlink","integrity"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}