vercel/turborepo · error · Error

Directory path contains potentially unsafe characters: ${dir

Error message

Directory path contains potentially unsafe characters: ${dir}

What it means

create-turbo runs `tryGitInit(root)` at the end of scaffolding (git init + initial commit), and first calls assertSafeDirectory, which rejects any target path containing shell metacharacters (` $ ( ) { } | ; & < > ! #). This is a command-injection guard on the path that reaches git subprocess invocation; scaffolding aborts with this plain Error before git runs.

Source

Thrown at packages/create-turbo/src/utils/git.ts:36

*.pem

# debug
npm-debug.log*
yarn-debug.log*
yarn-error.log*

# turbo
.turbo

# vercel
.vercel
`;

const SHELL_METACHARACTERS = /[`$(){}|;&<>!#]/;

function assertSafeDirectory(dir: string): void {
  if (SHELL_METACHARACTERS.test(dir)) {
    throw new Error(
      `Directory path contains potentially unsafe characters: ${dir}`
    );
  }
}

function git(args: Array<string>, cwd: string): boolean {
  const result = spawnSync("git", args, { stdio: "ignore", cwd });
  if (result.status !== 0) {
    throw new Error(`git ${args[0]} failed`);
  }
  return true;
}

function isInGitRepository(root: string): boolean {
  try {
    git(["rev-parse", "--is-inside-work-tree"], root);
    return true;
  } catch (_) {

View on GitHub (pinned to 9f94a7d215)

Solutions

1. Re-run create-turbo with a project name/path limited to letters, digits, hyphen, underscore, dot, and slash (e.g. `my-app`, `apps/turbo-v2`)
2. If the special-character name is a hard requirement, scaffold under a safe name first and rename the directory afterwards with `mv`
3. In scripts, sanitize the interpolated variable before passing it to create-turbo

Example fix

# before
npx create-turbo@latest "apps/turbo!(v2)"
# after
npx create-turbo@latest apps/turbo-v2

const SHELL_METACHARACTERS = /[`$(){}|;&<>!#]/;

function isSafeDirectory(dir: string): boolean {
  return !SHELL_METACHARACTERS.test(dir);
}
// run before create-turbo / tryGitInit:
if (!isSafeDirectory(targetDir)) throw new Error('pick an alphanumeric path');

function isSafeDirectoryName(name: string): boolean {
  return !/[`$(){}|;&<>!#]/.test(name);
}

try {
  await createApp({ root: targetDir });
} catch (err) {
  if (err instanceof Error && err.message.includes('potentially unsafe characters')) {
    // re-prompt the user for a sanitized name instead of crashing
    targetDir = sanitize(targetDir); // strip/replace metacharacters, then retry once
  } else throw err;
}

When it happens

Trigger: Passing create-turbo an installation path or project name whose string contains any of: backtick, $, (, ), {, }, |, ;, &, <, >, !, #. Examples: `npx create-turbo my$app`, a directory like `app(1)`, `c#service`, `foo&bar`, `turbo!(v2)`.

Common situations: Copy-pasting a folder name containing special characters; Windows 'Copy of app (2)'-style names; users attempting shell-expansion-like project names; scripted invocations that interpolate unescaped variables into the path.

Related errors

• Invalid ${description}: path must be an absolute, non-empty
• Unable to write .gitignore
• Unable to read package.json
• Unable to write package.json
• Unable to update README.md

AI-assisted analysis of vercel/turborepo@9f94a7d215 (2026-08-16). Data as JSON: /api/errors/d6f6a6f1e6c25946. Report an issue: GitHub.