{"record":{"id":"f8cd404e72e1eaa8","repo":"abhigyanpatwari/GitNexus","slug":"refusing-unsafe-auto-sync-clone-root-root","errorCode":null,"errorMessage":"Refusing unsafe auto-sync clone root: ${root}","messagePattern":"Refusing unsafe auto-sync clone root: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"gitnexus/src/core/auto-sync/path-security.ts","lineNumber":213,"sourceCode":"  }\n  await Promise.all(\n    [...byRepo.values()].flatMap((group) =>\n      group\n        // The timestamp is the leading fixed-width field, so a descending\n        // string sort is newest-first.\n        .sort((a, b) => (a < b ? 1 : a > b ? -1 : 0))\n        .slice(QUARANTINE_MAX_ENTRIES_PER_REPO)\n        .map(async (entry) => {\n          await fs.rm(path.join(quarantineRoot, entry), { recursive: true, force: true });\n          await fs.rm(path.join(quarantineRoot, `${entry}.README.txt`), { force: true });\n        }),\n    ),\n  );\n}\n\nfunction assertNotDangerousRoot(root: string): void {\n  if (root === path.resolve(getGlobalDir(), 'repos')) return;\n  if (DANGEROUS_ROOTS.has(root)) throw new Error(`Refusing unsafe auto-sync clone root: ${root}`);\n  for (const dangerousRoot of DANGEROUS_PARENT_ROOTS) {\n    const rel = path.relative(dangerousRoot, root);\n    if (rel && !rel.startsWith('..') && !path.isAbsolute(rel)) {\n      throw new Error(`Refusing unsafe auto-sync clone root under ${dangerousRoot}: ${root}`);\n    }\n  }\n  if (path.parse(root).root === root)\n    throw new Error(`Refusing filesystem root as clone root: ${root}`);\n}\n\nfunction assertNotGitNexusInternalRoot(root: string): void {\n  const gitnexusDir = path.resolve(getGlobalDir());\n  const blocked = [\n    path.join(gitnexusDir, 'groups'),\n    path.join(gitnexusDir, 'indexes'),\n    path.join(gitnexusDir, 'quarantine'),\n    path.join(getAutoSyncWatchDir(gitnexusDir), 'quarantine'),\n  ];","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/0d1aed942f0e8b5d3bac27519fff441aceea722d/gitnexus/src/core/auto-sync/path-security.ts#L195-L231","documentation":"Thrown by the auto-sync path-security guard assertNotDangerousRoot (called from resolveConfiguredCloneRoot) when the configured clone root exactly matches an entry in the DANGEROUS_ROOTS blocklist (system-critical directories such as filesystem root, /home, /tmp, /etc, and Windows system roots). It fires before any clone or pull runs, preventing auto-sync from writing repository content directly into an OS-critical directory and clobbering it with repo files.","triggerScenarios":"Thrown at gitnexus/src/core/auto-sync/path-security.ts:213 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set the auto-sync clone root to a dedicated directory outside the DANGEROUS_ROOTS blocklist (e.g. the default <globalDir>/repos)","Point the configuration at an empty, user-owned directory on a data volume","Inspect the auto-sync config (config file or env var) for a typo that resolved the root to a system directory such as / or /home"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0d1aed942f0e8b5d3bac27519fff441aceea722d","analyzedAt":"2026-09-08T00:40:44.970Z","contentChangedAt":"2026-09-08T00:40:44.970Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}