{"record":{"id":"f514ffbe962e0427","repo":"abhigyanpatwari/GitNexus","slug":"overlay-snapshot-destination-already-exists-dest","errorCode":null,"errorMessage":"overlay snapshot destination already exists: {destination}","messagePattern":"overlay snapshot destination already exists: (.+?)","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"eval/workflow_bench/promotion_apply.py","lineNumber":53,"sourceCode":"            f\"({type(cleanup).__name__}: {cleanup})\"\n        )\n\n\ndef mirror_targets(relative: PurePosixPath) -> list[PurePosixPath]:\n    \"\"\"Every repo path one overlay file lands on: canonical + shipped mirrors.\"\"\"\n    skill = relative.parts[2]\n    rest = PurePosixPath(*relative.parts[3:])\n    targets = [relative]\n    targets += [PurePosixPath(root, skill, rest) for root in MIRROR_SKILL_ROOTS]\n    return targets\n\n\ndef freeze_overlay(overlay: Path, destination: Path) -> str:\n    \"\"\"Copy authorized bytes into a private, read-only benchmark snapshot.\"\"\"\n    digest, payload = candidate_overlay_payload(overlay)\n    destination = destination.expanduser().absolute()\n    if destination.exists() or destination.is_symlink():\n        raise ValueError(f\"overlay snapshot destination already exists: {destination}\")\n    destination.parent.mkdir(parents=True, exist_ok=True)\n    staging = Path(tempfile.mkdtemp(prefix=\".overlay-snapshot-\", dir=destination.parent))\n    try:\n        for relative, content in payload:\n            target = staging / relative\n            target.parent.mkdir(parents=True, exist_ok=True, mode=0o700)\n            descriptor = os.open(target, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o400)\n            try:\n                with os.fdopen(descriptor, \"wb\", closefd=False) as handle:\n                    handle.write(content)\n                    handle.flush()\n                    os.fsync(handle.fileno())\n            finally:\n                os.close(descriptor)\n        for directory in sorted(\n            (path for path in staging.rglob(\"*\") if path.is_dir()),\n            key=lambda path: len(path.parts),\n            reverse=True,","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/promotion_apply.py#L35-L71","documentation":"freeze_overlay writes the authorized overlay payload into a freshly-created, read-only snapshot directory via tempfile.mkdtemp + atomic os.replace. As a transactional safety guard it refuses any pre-existing destination (exists() OR is_symlink()) so it can never clobber or be tricked via a symlink into writing elsewhere.","triggerScenarios":"Calling freeze_overlay(overlay, destination) when destination already exists (file or dir) or is a dangling/present symlink. Re-running a promotion twice, or pointing at a path that another process created.","commonSituations":"Re-running the promotion pipeline without clearing the prior snapshot; CI retry against the same destination; destination is a symlink (possibly attacker-planted) that would redirect the write.","solutions":["Remove the prior destination first (after verifying it is safe) or choose a unique destination name per run.","Audit the destination path: it must not be a symlink and must not pre-exist before freeze_overlay.","If you see a symlink where you expected a directory, treat it as a security incident — do not unlink blindly.","Make the caller idempotent by hashing the overlay into the destination name."],"exampleFix":"// before\nfreeze_overlay(overlay, dest)  # second run blows up\n// after\nif dest.exists() or dest.is_symlink():\n    raise SystemExit(f'refusing to reuse snapshot {dest}')\nfreeze_overlay(overlay, dest.with_name(dest.name + '-' + digest[:12]))","handlingStrategy":"validation","validationCode":"def ensure_fresh_destination(destination: Path) -> None:\n    if destination.exists() or destination.is_symlink():\n        raise SystemExit(f'refusing to overwrite existing snapshot {destination}; remove it first')\n\n# call before freeze_overlay(overlay, destination)","typeGuard":"from pathlib import Path\nimport stat\n\ndef is_safe_unused_destination(p: str | Path) -> bool:\n    path = Path(p)\n    try:\n        meta = path.lstat()\n    except FileNotFoundError:\n        return True\n    # Anything that exists (incl. dangling symlink) is unsafe.\n    return False","tryCatchPattern":"try:\n    freeze_overlay(overlay, destination)\nexcept ValueError as exc:\n    if 'already exists' in str(exc):\n        destination = destination.with_name(destination.name + '-' + secrets.token_hex(4))\n        freeze_overlay(overlay, destination)\n    else:\n        raise","preventionTips":["Encode the overlay digest into the destination name so reruns are idempotent.","Refuse to unlink an unexpected destination — it may be attacker-planted.","Run promotion in a fresh, unique directory per invocation."],"tags":["overlay","promotion","transactional","symlink","filesystem","precondition"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}