xai-org/grok-build · error

{what} '{value}' must not contain '..'

Error message

{what} '{value}' must not contain '..'

What it means

ensure_ref_arg_safe rejects ref values containing ".." — the git range syntax and a path-traversal-like sequence — so a single ref argument cannot be reinterpreted as a range expression (e.g. "a..b") or otherwise smuggle two refs into one argument. The library throws this to keep client-influenced ref arguments unambiguous.

Source

Thrown at crates/codegen/xai-grok-workspace/src/session/git.rs:3093

        });
    }
    anyhow::bail!("merge of base ref '{base}' failed: {merge_out}")
}
/// Reject a ref/branch value that could be parsed as a git option (leading `-`)
/// or that carries whitespace/control characters or `..`. A boundary guard for
/// client-influenced refs (notably `base_ref`) so they cannot be smuggled in as
/// flags; combined with `--end-of-options` at each call site.
fn ensure_ref_arg_safe(value: &str, what: &str) -> Result<()> {
    anyhow::ensure!(!value.is_empty(), "{what} must not be empty");
    anyhow::ensure!(
        !value.starts_with('-'),
        "{what} '{value}' must not start with '-'"
    );
    anyhow::ensure!(
        !value.chars().any(|c| c.is_whitespace() || c.is_control()),
        "{what} '{value}' contains whitespace or control characters"
    );
    anyhow::ensure!(
        !value.contains(".."),
        "{what} '{value}' must not contain '..'"
    );
    Ok(())
}
/// Seed a committed `.gitignore` (secrets never enter git)
/// when a fresh conversation branch is created and the repo has none. Distinct
/// from [`seed_default_excludes`], which seeds the *local-only* `info/exclude`
/// as a `stage_all` backstop; this file is meant to be committed, so it also
/// protects explicit user commits and BYO-remote exports. Never overwrites an
/// existing `.gitignore`.
async fn seed_default_gitignore(git_root: &Path) -> Result<()> {
    let path = git_root.join(".gitignore");
    if tokio::fs::metadata(&path).await.is_ok() {
        return Ok(());
    }
    tokio::fs::write(&path, xai_grok_workspace_types::binding::DEFAULT_GITIGNORE).await?;
    git_cli(git_root, &["add", "--end-of-options", ".gitignore"]).await?;

View on GitHub (pinned to bc7f02eddd)

Solutions

1. Pass a single plain ref name; if you need a range, use the API meant for ranges rather than the branch/ref parameter.
2. Strip or reject ".." at your input boundary before calling the library.
3. Qualify ambiguous short names explicitly (e.g. "refs/heads/main") so no range interpretation is possible.

Example fix

// before
let target = "main..feature"; // range past as branch
merge_to_main(&root, "session", target, false).await?;
// after
let target = "feature"; // single ref only
anyhow::ensure!(!target.contains(".."), "range syntax not allowed here");
merge_to_main(&root, "session", target, false).await?;

if ref_name.contains("..") { return Err(format!("'{}' is not a single ref (contains '..')", ref_name)); }

When it happens

Trigger: Passing a ref containing ".." (e.g. "main..dev", "v1..v2", or path-like "../x") into an operation that validates via ensure_ref_arg_safe (crates/codegen/xai-grok-workspace/src/session/git.rs:3093), where the parameter is meant to be a single branch/ref name.

Common situations: A caller reuses a range expression (meant for git log/diff ranges) as a branch argument; a path fragment leaks into a ref field; a user types "origin/main..HEAD" into a branch selector in a UI.

Related errors

• {what} '{value}' contains whitespace or control characters
• unsupported checkout target (need a full commit oid or a sim
• refusing unsafe fetch refspec
• not a git repository: {}
• not a git repository: {}

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/8a552a5ee3390714. Report an issue: GitHub.