Hmbown/CodeWhale · error

remote bundle exceeds the

Error message

remote bundle exceeds the {MAX_BUNDLE_BYTES} byte limit; refused

What it means

The remote bundle body is larger than `MAX_BUNDLE_BYTES`, so `fetch_bundle` refuses it. The body is read with `take(MAX_BUNDLE_BYTES + 1)` so an oversize download is detected after one extra byte instead of exhausting memory. This caps the cost of fetching untrusted URLs.

Solutions

1. Verify the URL actually serves the intended (small) bundle file.
2. If the bundle is legitimately large, reduce its contents or export/import it locally as a file instead of over HTTP.
3. Serve the bundle from a source whose response is within the limit; trim attachments from the bundle export.

Example fix

// before: URL returns a 200 MB archive
codewhale config bundle import https://example.com/huge-archive.zip
// after: use the trimmed bundle endpoint or local file
codewhale config bundle import https://example.com/bundles/config-small.zip

let resp = reqwest::get(url)?;
if let Some(len) = resp.content_length() {
    if len as u64 > MAX_BUNDLE_BYTES {
        return Err(format!("remote bundle is {len} bytes; over the {MAX_BUNDLE_BYTES} limit"));
    }
}

fn declares_acceptable_size(resp: &reqwest::Response, max: u64) -> bool {
    resp.content_length().map_or(true, |l| l as u64 <= max)
}

match fetch_bundle(url) {
    Err(e) if e.to_string().contains("byte limit") => {
        eprintln!("remote bundle too large; fetch the trimmed bundle or import from a local file");
    }
    Err(e) => return Err(e),
    Ok(bytes) => apply(bytes),
}

When it happens

Trigger: Importing a bundle from a URL whose response body exceeds the configured byte limit (one byte past the limit is enough to trigger).

Common situations: Pointing the import at the wrong URL (a large archive or a page, not a bundle); a compromised or hostile mirror serving an enormous body; exporting very large configs that outgrew the limit.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

• bundle fetch exceeded the five-redirect limit
• bundle fetch failed with HTTP status
• response exceeds size limit
• response exceeds size limit or has invalid length
• Anthropic API error (HTTP )

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/dd66d846ae0904d4. Report an issue: GitHub.

Appendix: source

Thrown at crates/cli/src/config_bundles.rs:809

        redirects += 1;
    };

    if !response.status().is_success() {
        bail!(
            "bundle fetch failed with HTTP status {}",
            response.status().as_u16()
        );
    }

    // Read at most MAX_BUNDLE_BYTES + 1 so an oversize body is detected
    // rather than silently truncated.
    let mut buffer = Vec::new();
    let body = response;
    body.take(MAX_BUNDLE_BYTES + 1)
        .read_to_end(&mut buffer)
        .map_err(|_| anyhow!("reading remote bundle failed"))?;
    if buffer.len() as u64 > MAX_BUNDLE_BYTES {
        bail!("remote bundle exceeds the {MAX_BUNDLE_BYTES} byte limit; refused");
    }
    Ok(buffer)
}

fn validate_bundle_url(url: &reqwest::Url) -> Result<()> {
    if !matches!(url.scheme(), "http" | "https") {
        bail!("unsupported bundle URL scheme; use https");
    }
    if !url.username().is_empty() || url.password().is_some() {
        bail!("bundle URLs may not include credentials");
    }
    let host = url.host_str().context("bundle URL must include a host")?;
    match url.scheme() {
        "https" => Ok(()),
        "http" if is_loopback_bundle_host(host) => Ok(()),
        "http" => bail!("plain http is only allowed for loopback hosts; use https"),
        _ => unreachable!("scheme was validated above"),
    }

View on GitHub (pinned to 73e0f67d83)