xai-org/grok-build · error

{what} must not be empty

Error message

{what} must not be empty

What it means

ensure_ref_arg_safe is a boundary guard for git ref/branch strings that come from client input (notably base_ref) before they are passed to git CLI calls. This first check rejects an empty string, since an empty ref name is never valid and could desynchronize later argument ordering. The library throws it early so a malformed ref never reaches a spawned git process.

Source

Thrown at crates/codegen/xai-grok-workspace/src/session/git.rs:3084

    }
    if merge_in_progress(git_root).await? {
        let files = git_cli(git_root, &["diff", "--name-only", "--diff-filter=U"])
            .await?
            .lines()
            .map(str::to_owned)
            .collect();
        return Ok(GitSyncBaseResult {
            outcome: GitSyncBaseOutcome::Conflicts { files },
        });
    }
    anyhow::bail!("merge of base ref '{base}' failed: {merge_out}")
}
/// Reject a ref/branch value that could be parsed as a git option (leading `-`)
/// or that carries whitespace/control characters or `..`. A boundary guard for
/// client-influenced refs (notably `base_ref`) so they cannot be smuggled in as
/// flags; combined with `--end-of-options` at each call site.
fn ensure_ref_arg_safe(value: &str, what: &str) -> Result<()> {
    anyhow::ensure!(!value.is_empty(), "{what} must not be empty");
    anyhow::ensure!(
        !value.starts_with('-'),
        "{what} '{value}' must not start with '-'"
    );
    anyhow::ensure!(
        !value.chars().any(|c| c.is_whitespace() || c.is_control()),
        "{what} '{value}' contains whitespace or control characters"
    );
    anyhow::ensure!(
        !value.contains(".."),
        "{what} '{value}' must not contain '..'"
    );
    Ok(())
}
/// Seed a committed `.gitignore` (secrets never enter git)
/// when a fresh conversation branch is created and the repo has none. Distinct
/// from [`seed_default_excludes`], which seeds the *local-only* `info/exclude`
/// as a `stage_all` backstop; this file is meant to be committed, so it also

View on GitHub (pinned to bc7f02eddd)

Solutions

1. Provide a non-empty branch/ref name at the call site that constructs the request.
2. Validate or default the ref at the API/config boundary before invoking the git operation (e.g. reject empty fields with 400, or substitute the default branch).
3. If the ref comes from a config or env var, check it is non-empty during startup.

Example fix

// before
let base_ref = params.base_ref.unwrap_or_default();
git_ops.merge_to_main(&git_root, &conv_branch, &base_ref, push).await?;
// after
let base_ref = match params.base_ref {
    Some(r) if !r.is_empty() => r,
    _ => anyhow::bail!("base_ref is required and must not be empty"),
};

fn valid_ref(name: &str) -> bool { !name.is_empty() && !name.starts_with('-') && !name.contains("..") && name.chars().all(|c| !c.is_whitespace() && !c.is_control()) }
if !valid_ref(&base_ref) { return Err("base_ref must be a non-empty ref name"); }

When it happens

Trigger: Calling any git operation in crates/codegen/xai-grok-workspace/src/session/git.rs that forwards a caller-supplied ref (e.g. merge_to_main, diff/base_ref operations) with an empty value for that ref, such as session_branch = "" or base_ref = "".

Common situations: An API caller omits the branch field and the server passes the default-constructed empty String through; a deserializer accepts missing optional field as empty string instead of rejecting it; a config file has branch= with no value.

Related errors

• unsupported checkout target (need a full commit oid or a sim
• refusing unsafe fetch refspec
• invalid worktree id {:?}
• not a git repository: {}
• not a git repository: {}

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/4d5085b5a13f3495. Report an issue: GitHub.