Hmbown/CodeWhale · error · anyhow::Error

{} exceeds the {} byte workspace .env limit

Error message

{} exceeds the {} byte workspace .env limit

What it means

First of two size guards in read_stable_workspace_dotenv: the fstat metadata of the opened .env must not exceed MAX_WORKSPACE_DOTENV_BYTES (1 MiB, 1024*1024). A credential file should hold a handful of literal pairs; anything past the cap is refused before a single byte is read, bounding memory and parse cost on untrusted workspace input.

Source

Thrown at crates/tui/src/lib.rs:2631

    false
}

fn read_stable_workspace_dotenv(path: &Path) -> Result<Vec<u8>> {
    let mut file = open_workspace_dotenv_without_following_links(path)?;
    let metadata = file
        .metadata()
        .map_err(|error| anyhow!("could not inspect {}: {error}", path.display()))?;
    if !metadata.is_file() {
        bail!("{} is not a regular file", path.display());
    }
    if workspace_dotenv_has_multiple_links(&file, &metadata)? {
        bail!(
            "{} has multiple filesystem links, not a unique workspace-owned file",
            path.display()
        );
    }
    if metadata.len() > MAX_WORKSPACE_DOTENV_BYTES {
        bail!(
            "{} exceeds the {} byte workspace .env limit",
            path.display(),
            MAX_WORKSPACE_DOTENV_BYTES
        );
    }

    let mut contents = Vec::with_capacity(metadata.len() as usize);
    (&mut file)
        .take(MAX_WORKSPACE_DOTENV_BYTES + 1)
        .read_to_end(&mut contents)
        .map_err(|error| anyhow!("could not read {}: {error}", path.display()))?;
    if contents.len() as u64 > MAX_WORKSPACE_DOTENV_BYTES {
        bail!(
            "{} exceeds the {} byte workspace .env limit",
            path.display(),
            MAX_WORKSPACE_DOTENV_BYTES
        );
    }

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Check the size: `wc -c .env` — if it is near or past 1048576, inspect the content
2. Remove anything that is not a literal KEY=value credential line (logs, blobs, dumps)
3. Keep generated bulk data in a different file; .env is for a small set of literal secrets

Example fix

# before
wc -c .env        # 2500000 .env

# after: keep only literal credential lines
grep -E '^[A-Za-z_][A-Za-z0-9_]*=' .env > .env.trimmed && mv .env.trimmed .env
wc -c .env        # 412 .env

MAX=1048576  # 1 MiB
size=$(wc -c < .env)
[ "$size" -le "$MAX" ] || { echo ".env is $size bytes (limit $MAX)"; exit 2; }

When it happens

Trigger: A workspace .env larger than 1 MiB — a misdirected dump, embedded base64 blob, appended log output, or a generated catalog written into .env — present when codewhale loads workspace dotenv credentials.

Common situations: `some-tool >> .env` logging accidents; secrets exporters dumping whole environments; generated .env files from templates with large inline material.

Related errors

• {} uses variable expansion; workspace .env values must be li
• {} is not a regular file
• persistent allow rules must be scoped to a workspace
• project workspace path cannot contain '..' components
• external {} credential file {} exceeds the {} byte safety li

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/470ca8f9dcfd877d. Report an issue: GitHub.