{"record":{"id":"e0d3a463d2719ff3","repo":"mastra-ai/mastra","slug":"worker-executionid-must-contain-only-letters-numb","errorCode":null,"errorMessage":"Worker executionId must contain only letters, numbers, dots, underscores, and hyphens.","messagePattern":"Worker executionId must contain only letters, numbers, dots, underscores, and hyphens\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"deployers/sandbox/src/worker.ts","lineNumber":771,"sourceCode":"\nfunction executionPaths(remoteDir: string, executionId: string) {\n  const dir = `${remoteDir}/${RUNTIME_DIR}/${executionId}`;\n  return {\n    executionId,\n    dir,\n    script: `${dir}/launch.sh`,\n    pid: `${dir}/pid`,\n    pidToken: `${dir}/pid-start`,\n    status: `${dir}/status`,\n    stdin: `${dir}/stdin`,\n    stdout: `${dir}/stdout`,\n    stderr: `${dir}/stderr`,\n  };\n}\n\nfunction validateExecutionId(executionId: string): void {\n  if (!executionId || !EXECUTION_ID_PATTERN.test(executionId)) {\n    throw new Error('Worker executionId must contain only letters, numbers, dots, underscores, and hyphens.');\n  }\n}\n\nfunction workerPhaseError(phase: 'upload' | 'install' | 'launch', error: unknown): Error {\n  return new Error(`Worker ${phase} failed: ${errorMessage(error)}`, { cause: error });\n}\n\nfunction errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction sanitizeStatusValue(value: string): string {\n  return value.replace(/[|\\r\\n]/g, ' ').slice(0, 500);\n}\n","sourceCodeStart":753,"sourceCodeEnd":786,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/deployers/sandbox/src/worker.ts#L753-L786","documentation":"The sandbox worker validates its executionId against EXECUTION_ID_PATTERN before running any phase (upload/install/launch). An empty executionId or one containing characters outside [letters, numbers, dots, underscores, hyphens] is rejected because the id is used to build filesystem paths and shell arguments, where unsafe characters could break commands or enable path traversal.","triggerScenarios":"Calling the sandbox worker (or deployer that drives it) with an executionId that is empty, contains slashes, spaces, whitespace, '@', ':', or other special characters not matching the allowed pattern.","commonSituations":"Generating execution ids from user input, URLs, timestamps with separators like '/' or spaces, or passing undefined/empty values when run metadata is missing.","solutions":["Sanitize the executionId before passing it to the worker (strip or replace disallowed characters).","Use a generated id such as a UUID with hyphens or nanoid from an alphabet of letters/digits.","Add a validation check at the call site so invalid ids fail early with a clear message."],"exampleFix":"// before\nrunWorker({ executionId: `${runId}` }); // runId = 'runs/2026/08 29'\n// after\nconst safeId = runId.replace(/[^a-zA-Z0-9._-]/g, '-');\nrunWorker({ executionId: safeId });","handlingStrategy":"validation","validationCode":"const EXECUTION_ID_PATTERN = /^[a-zA-Z0-9._-]+$/;\nif (!executionId || !EXECUTION_ID_PATTERN.test(executionId)) {\n  throw new Error(`Invalid executionId: ${JSON.stringify(executionId)}`);\n}\nrunWorker({ executionId });","typeGuard":"function isValidExecutionId(id: unknown): id is string {\n  return typeof id === 'string' && /^[a-zA-Z0-9._-]+$/.test(id);\n}","tryCatchPattern":"try {\n  await runWorker({ executionId });\n} catch (err) {\n  if ((err as Error).message.includes('executionId must contain')) {\n    console.error('Bad executionId, sanitize and retry:', executionId);\n  }\n  throw err;\n}","preventionTips":["Generate execution ids from a UUID or other [a-zA-Z0-9._-]-safe alphabet.","Sanitize user-derived ids by replacing disallowed characters before use.","Never pass raw URLs, paths, or timestamps with slashes/spaces as ids.","Validate ids at the entry point of your pipeline, before spawning workers."],"tags":["validation","input-sanitization","sandbox"],"backgroundTag":"invalid-identifier-format","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T08:17:16.595Z"}