stablyai/orca · error

Pull request fetch remote must not start with "-".

Error message

Pull request fetch remote must not start with "-".

What it means

Thrown by fetchGitHubPullRequestHeadRef when isSafeReviewHeadFetchRemote rejects the remote name — specifically, a remote beginning with `-`. The remote is interpolated directly into a `git fetch` argument list (`['fetch', '--no-tags', remote, ...]`), so a leading dash would be parsed by git as an option rather than a remote name. This is a classic argv-injection / option-injection guard.

Source

Thrown at src/main/github/pr-head-tracking-ref.ts:50

  }
  if (!sshGitProvider) {
    throw new Error('SSH Git provider is not available. Reconnect to this target and try again.')
  }
  await sshGitProvider.fetchRemoteTrackingRef(repo.path, remote, branch, ref)
}

export async function fetchGitHubPullRequestHeadRef(
  repo: { path: string; connectionId?: string | null },
  sshGitProvider: SshGitProvider | null | undefined,
  remote: string,
  prNumber: number,
  options: { localGitExecOptions?: LocalGitExecOptions } = {}
): Promise<string> {
  if (!isValidReviewHeadNumber(prNumber)) {
    throw new Error(`Invalid pull request number: ${String(prNumber)}`)
  }
  if (!isSafeReviewHeadFetchRemote(remote)) {
    throw new Error('Pull request fetch remote must not start with "-".')
  }
  if (!repo.connectionId) {
    const localGitExecOptions = options.localGitExecOptions ?? { cwd: repo.path }
    const remoteComponent = await getReviewHeadRemoteComponent(remote, localGitExecOptions)
    // Why: return the same path the fetch wrote so callers don't re-resolve identity.
    const localRef = githubPullRequestHeadLocalRef(remoteComponent, prNumber)
    await gitExecFileAsync(
      ['fetch', '--no-tags', remote, `+refs/pull/${prNumber}/head:${localRef}`],
      {
        ...localGitExecOptions,
        timeout: REVIEW_HEAD_FETCH_TIMEOUT_MS
      }
    )
    return localRef
  }
  if (!sshGitProvider) {
    throw new Error('SSH Git provider is not available. Reconnect to this target and try again.')
  }

View on GitHub (pinned to 1136503c6a)

Solutions

1. Inspect `git remote -v` and remove/rename any remote whose name starts with `-`.
2. At the trust boundary (deep links, extension input), validate remote names against git-check-ref-format rules and reject leading dashes.
3. Re-add the remote with a safe name via `git remote rename` or remove + add.

Example fix

// before
await fetchGitHubPullRequestHeadRef(repo, provider, remote, prNumber)

// after
if (!isSafeReviewHeadFetchRemote(remote)) {
  throw new Error(`Refusing unsafe remote name: ${remote}`)
}
await fetchGitHubPullRequestHeadRef(repo, provider, remote, prNumber)

import { isSafeReviewHeadFetchRemote } from '../../shared/review-head-tracking-ref'
function assertSafeRemote(remote: string) {
  if (!isSafeReviewHeadFetchRemote(remote)) {
    throw new Error(`Refusing unsafe remote name: ${remote}`)
  }
}

function isSafeRemoteName(name: unknown): name is string {
  return typeof name === 'string' && name.length > 0 && !name.startsWith('-')
}

if (!isSafeRemoteName(remote)) {
  toast.error('Unsafe remote name.')
  return
}
await fetchGitHubPullRequestHeadRef(repo, provider, remote, prNumber)

When it happens

Trigger: A remote named `-something` in git config (malicious or accidental); a remote name sourced from user input or a deep link without sanitization; a corrupted remotes payload; testing code that passes a flag-shaped string as the remote.

Common situations: Adversarial or malformed git config; a deep-link or extension API supplying an unvalidated remote name; misconfigured remote added via `git remote add -foo`.

Related errors

• Access denied: invalid submodule path
• Invalid branch name
• Invalid pull request number: ${String(prNumber)}
• Merge request fetch remote must not start with "-".
• ${name} must be a positive integer, received ${value}

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/02c9767d20d08bc0. Report an issue: GitHub.