What causes "Invalid branch or ref name. Name must not start with '-': ${ref}" in yamadashy/repomix?

Remove the leading '-' from the ref/branch value before calling the API.

yamadashy/repomix · critical · RepomixError

Invalid branch or ref name. Name must not start with '-': ${

Error message

Invalid branch or ref name. Name must not start with '-': ${ref}

What it means

validateGitRef rejects any branch, tag, or ref string that starts with '-' because such a value would be parsed by git as a command-line option instead of a ref name (argument injection). Git's own refname rules forbid leading '-', so legitimate refs are never affected. The check is a security guard applied before the ref is passed to execGitShallowClone.

Source

Thrown at src/core/git/gitCommand.ts:260

    if (url.startsWith('https://')) {
      new URL(url);
    }
  } catch (error: unknown) {
    logger.trace('Invalid repository URL:', redactErrorMessage(error));
    throw new RepomixError(`Invalid repository URL. Please provide a valid URL: ${redactUrl(url)}`);
  }
};

/**
 * Validates a Git ref (branch, tag, or commit) before passing it to git commands.
 * A ref starting with '-' could be interpreted as a git option (e.g. --upload-pack),
 * enabling argument injection. Git's own refname rules also forbid leading '-',
 * so rejecting it is safe for all legitimate branches, tags, and SHAs.
 * @throws {RepomixError} If the ref could be interpreted as a command-line option
 */
export const validateGitRef = (ref: string): void => {
  if (ref.startsWith('-')) {
    throw new RepomixError(`Invalid branch or ref name. Name must not start with '-': ${ref}`);
  }
};

View on GitHub (pinned to f465ad9093)

Solutions

Remove the leading '-' from the ref/branch value before calling the API.
Verify the ref exists: run `git rev-parse --verify <ref>` locally and use the exact valid name.
If the value comes from config or CLI args, fix the source (quoting, splitting, flag parsing) that injected the dash.

Example fix

// before
await repomixRemote({ repo: 'user/repo', branch: '--upload-pack=evil' });
// after
await repomixRemote({ repo: 'user/repo', branch: 'main' });

Defensive patterns

Strategy: validation

Validate before calling

if (typeof ref === 'string' && ref.startsWith('-')) {
  throw new Error(`Refusal: ref must not start with '-': ${ref}`);
}
await pack({ branch: ref });

Type guard

const isValidRef = (ref: unknown): ref is string =>
  typeof ref === 'string' && ref.length > 0 && !ref.startsWith('-');

Prevention

Never pass raw user input as a branch/ref without validating it starts with an alphanumeric character.
Sanitize CLI args and config values (trim whitespace, strip leading dashes) before use.
Treat ref names as data, never as shell/command fragments; prefer typed config objects over string interpolation.

When it happens

Trigger: Calling the clone/remote-processing API with a branch or ref argument whose value begins with a hyphen, e.g. '--upload-pack=malicious', '-oProxyCommand=...', or a config value accidentally read with a leading dash.

Common situations: A CLI flag or config-file value like `--branch -foo`; untrusted user input passed as the ref; shell word-splitting or log-parsing that leaves a '-' prefix on the ref name.

Related errors

AI-assisted analysis of yamadashy/repomix@f465ad9093 (2026-08-29). Data as JSON: /api/errors/edb091ef4408e325. Report an issue: GitHub.