can1357/oh-my-pi · error · Error

Invalid version for cache: "${version}"

Error message

Invalid version for cache: "${version}"

What it means

Cache versions are validated by isValidVersionForCache: non-empty, ≤128 chars, matching /^[a-zA-Z0-9._+-]+$/, and containing no ".." (path-traversal guard). A version like "main..dev", "v1.0.0/", or a git ref with slashes throws this error.

Source

Thrown at packages/coding-agent/src/extensibility/plugins/marketplace/cache.ts:39

// Reject anything that could be used for path traversal or shell injection in
// version strings. Only printable, unambiguous characters are allowed.
const VERSION_RE = /^[a-zA-Z0-9._+-]+$/;

/** Return true when `version` is safe for use as a cache path component. */
export function isValidVersionForCache(version: string): boolean {
	// prevent path-traversal sequences like ".." or "1..2"
	return version.length > 0 && version.length <= 128 && VERSION_RE.test(version) && !version.includes("..");
}

function validateCacheComponents(marketplace: string, pluginName: string, version: string): void {
	if (!isValidNameSegment(marketplace)) {
		throw new Error(`Invalid marketplace name for cache: "${marketplace}"`);
	}
	if (!isValidNameSegment(pluginName)) {
		throw new Error(`Invalid plugin name for cache: "${pluginName}"`);
	}
	if (!isValidVersionForCache(version)) {
		throw new Error(`Invalid version for cache: "${version}"`);
	}
}

/**
 * Return the absolute path for a cached plugin directory.
 * Throws if any component fails validation.
 */
export function getCachedPluginPath(
	cacheDir: string,
	marketplace: string,
	pluginName: string,
	version: string,
): string {
	validateCacheComponents(marketplace, pluginName, version);
	return path.join(cacheDir, `${marketplace}___${pluginName}___${version}`);
}

/**

View on GitHub (pinned to 9690622007)

Solutions

1. Use a sanitized version string (semver like "1.2.3" or a plain commit SHA).
2. Replace slashes in branch names with a safe separator (e.g. "feature-x").
3. Ensure the version is non-empty and ≤128 characters.
4. Sanitize upstream-supplied versions before calling the cache API.

Example fix

// before
getCachedPluginPath(dir, "acme", "my-plugin", "feature/big-refactor");
// after
getCachedPluginPath(dir, "acme", "my-plugin", "a1b2c3d"); // commit SHA

if (!/^[a-zA-Z0-9._+-]+$/.test(version) || version.includes("..") || version.length === 0 || version.length > 128) {
  throw new Error(`Unsafe cache version: ${version}`);
}

function isCacheSafeVersion(v: string): boolean {
  return v.length > 0 && v.length <= 128 && /^[a-zA-Z0-9._+-]+$/.test(v) && !v.includes("..");
}

try {
  const p = getCachedPluginPath(dir, marketplace, pluginName, version);
} catch (err) {
  if (err instanceof Error && err.message.includes("Invalid version")) {
    console.error(`Use a semver tag or commit SHA, not "${version}"`);
  } else throw err;
}

When it happens

Trigger: getCachedPluginPath called with versions containing slashes, spaces, colons, or ".."; passing a branch name like "feature/x" or a full git SHA prefix with illegal characters; empty version string.

Common situations: Using git branch/refs with slashes as the version; raw URLs or ranges (">=1.0.0") as version; string interpolation injecting whitespace.

Related errors

• Invalid marketplace name for cache: "${marketplace}"
• Invalid plugin name for cache: "${pluginName}"
• Invalid path: ${localPath} resolves outside working director
• Destination paths cannot contain parent traversal or NUL byt
• Shared-folder destination escapes its configured root

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/ed5b3b016f87ef4a. Report an issue: GitHub.