garrytan/gstack · error · Error

Unsafe value for ${context}: ${val}

Error message

Unsafe value for ${context}: ${val}

What it means

validateValue() in scripts/host-config-export.ts:30 enforces shell safety on values exported into host config. A value must match PATH_REGEX (`^[a-zA-Z0-9_./${}~-]+$`) or CLI_REGEX (`^[a-z][a-z0-9_-]*$`); otherwise it throws to prevent command injection through the export path.

Source

Thrown at scripts/host-config-export.ts:30

 *
 * All output is shell-safe (single-quoted values, no eval needed).
 */

import { ALL_HOST_CONFIGS, getHostConfig, ALL_HOST_NAMES } from '../hosts/index';
import { validateAllConfigs } from './host-config';
import { RESOLVERS } from './resolvers';
import { execSync } from 'child_process';

const CLI_REGEX = /^[a-z][a-z0-9_-]*$/;
const PATH_REGEX = /^[a-zA-Z0-9_.\/${}~-]+$/;

function shellEscape(s: string): string {
  return "'" + s.replace(/'/g, "'\\''") + "'";
}

function validateValue(val: string, context: string): void {
  if (!PATH_REGEX.test(val) && !CLI_REGEX.test(val)) {
    throw new Error(`Unsafe value for ${context}: ${val}`);
  }
}

const [command, ...args] = process.argv.slice(2);

switch (command) {
  case 'list':
    for (const name of ALL_HOST_NAMES) {
      console.log(name);
    }
    break;

  case 'get': {
    const [hostName, field] = args;
    if (!hostName || !field) {
      console.error('Usage: host-config-export.ts get <host> <field>');
      process.exit(1);
    }

View on GitHub (pinned to 94993f7401)

Solutions

1. Strip shell metacharacters from the value before calling host-config-export
2. Restrict the input to the CLI_REGEX character class for identifiers
3. For paths, ensure only characters in PATH_REGEX are present
4. Quote/escape externally rather than relying on the export to handle hostile input

Example fix

// before
validateValue('foo; rm -rf /', 'name')
// after
validateValue('foo', 'name')

const CLI_RE = /^[a-z][a-z0-9_-]*$/;
const PATH_RE = /^[a-zA-Z0-9_.\/${}~-]+$/;
function isSafeValue(v: string): boolean {
  return CLI_RE.test(v) || PATH_RE.test(v);
}
if (!isSafeValue(val)) {
  throw new Error(`Unsafe value for ${context}: ${val}`);
}

const isSafeValue = (v: string): boolean =>
  /^[a-z][a-z0-9_-]*$/.test(v) || /^[a-zA-Z0-9_.\/${}~-]+$/.test(v);

When it happens

Trigger: Passing a value containing spaces, semicolons, pipes, backticks, or `$(...)`. Untrusted env-derived values flowing into host-config-export. Paths with shell metacharacters.

Common situations: CI variable containing an unexpected character. User-supplied identifier with uppercase or punctuation. Path with spaces not sanitized upstream.

Related errors

• Invalid skill name "${name}". Must be lowercase letters/digi
• Invalid file path in stageSkill: "${relPath}".
• State name must be alphanumeric (a-z, 0-9, _, -)
• Invalid CSS property name: ${property}. Only letters and hyp
• Unknown host '${name}'. Valid hosts: ${ALL_HOST_NAMES.join('

AI-assisted analysis of garrytan/gstack@94993f7401 (2026-08-12). Data as JSON: /api/errors/b3c897901a0809ce. Report an issue: GitHub.