unslothai/unsloth · warning · ValueError

Credential or configuration directories are not allowed

Error message

Credential or configuration directories are not allowed

What it means

ValueError raised when contains_sensitive_path_component(normalized) finds a path component associated with credentials or application configuration (e.g. .ssh, .gnupg, .aws, .config, .kube, AppData). Such folders hold secrets and tokens, and ingesting them into a searchable RAG store would leak secrets into embeddings and query results, so they are denied by component name anywhere in the path.

Source

Thrown at studio/backend/core/rag/folder_sync.py:159

    from hub.storage.scan_folders import (
        contains_sensitive_path_component,
        is_denied_system_path,
    )
    from utils.paths.external_media import is_local_filesystem_root

    if not os.path.isdir(normalized):
        raise ValueError("Path must be a directory, not a file")
    if not os.access(normalized, os.R_OK | os.X_OK):
        raise ValueError("Path is not readable")
    if is_local_filesystem_root(normalized):
        raise ValueError("The filesystem root cannot be registered")
    try:
        if Path(normalized) == Path.home().resolve():
            raise ValueError("The entire home folder cannot be registered")
    except RuntimeError:
        pass
    if contains_sensitive_path_component(normalized):
        raise ValueError("Credential or configuration directories are not allowed")
    if is_denied_system_path(normalized):
        raise ValueError("System directories are not allowed")
    return normalized


def _root_identity(root: str) -> tuple[int, int]:
    try:
        root_stat = os.lstat(root)
    except OSError as exc:
        raise RuntimeError("Linked folder is unavailable") from exc
    if stat.S_ISLNK(root_stat.st_mode) or not stat.S_ISDIR(root_stat.st_mode):
        raise RuntimeError("Linked folder is no longer a regular directory")
    if os.path.normcase(os.path.realpath(root)) != os.path.normcase(root):
        raise RuntimeError("Linked folder no longer resolves to its registered path")
    return root_stat.st_dev, root_stat.st_ino


def _store_identity(identity: tuple[int, int]) -> tuple[int | str, int | str]:

View on GitHub (pinned to 203007d190)

Solutions

  1. Move the documents you want indexed out of credential/config directories into a normal folder.
  2. If the data legitimately lives there, copy (not link) the specific document subfolder to a non-sensitive location and register that.
  3. Review the component list in hub.storage.scan_folders.contains_sensitive_path_component for your version to know exactly what is blocked.

Example fix

# before
validate_folder_path('/home/me/.config/myapp/notes')

# after
# copy notes to a regular folder first
validate_folder_path('/home/me/Documents/notes')
Defensive patterns

Strategy: validation

Validate before calling

from hub.storage.scan_folders import contains_sensitive_path_component
import os

def folder_has_no_sensitive_components(path: str) -> bool:
    normalized = os.path.realpath(os.path.abspath(os.path.expanduser(path)))
    return not contains_sensitive_path_component(normalized)

Try / catch

try:
    validate_folder_path(path)
except ValueError as e:
    if "Credential or configuration" not in str(e):
        raise
    return bad_request("that folder contains credentials/config; move documents to a normal folder")

Prevention

When it happens

Trigger: Registering /home/user/.ssh, /home/user/.config, or any folder nested under such a component (e.g. /home/user/.config/myapp/data); paths where a parent directory happens to be named .aws or similar; Windows AppData-based paths.

Common situations: Apps that store documents under .config or AppData and users trying to index them; symlink-free but sensitive dotfolders; portable-app layouts under .local/share misconfigured as .config.

Related errors

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/38321a81af7ba316. Report an issue: GitHub.