abhigyanpatwari/GitNexus · error · SandboxError

evidence exceeds the per-file limit: {name}

Error message

evidence exceeds the per-file limit: {name}

What it means

Raised by stage_evidence_bundle after _evidence_bytes returns, when the redacted payload length itself exceeds MAX_EVIDENCE_FILE_BYTES (256 KiB). This is the post-redaction, in-memory cap applied to all entry types (Path, bytes, str, json), distinct from [422] which checks the on-disk Path size before redaction. It catches the case where bytes/str/json input or redacted output is oversized.

Source

Thrown at eval/workflow_bench/proposer_sandbox.py:233

    *,
    secrets: Sequence[str] = (),
) -> Path:
    """Write a redacted owner-only evidence bundle with hard byte caps."""

    destination = destination.resolve()
    if destination.exists():
        raise SandboxError(f"evidence destination already exists: {destination}")
    destination.mkdir(parents=True, mode=0o700)
    destination.chmod(0o700)
    total = 0
    try:
        for name, value in entries.items():
            relative = PurePosixPath(name)
            if len(relative.parts) != 1 or relative.name in {"", ".", ".."}:
                raise SandboxError(f"evidence names must be simple relative files: {name!r}")
            payload = _evidence_bytes(value, secrets)
            if len(payload) > MAX_EVIDENCE_FILE_BYTES:
                raise SandboxError(f"evidence exceeds the per-file limit: {name}")
            total += len(payload)
            if total > MAX_BUNDLE_BYTES:
                raise SandboxError("evidence bundle exceeds the total byte limit")
            path = destination / relative.name
            path.write_bytes(payload)
            path.chmod(0o600)
    except BaseException:
        shutil.rmtree(destination, ignore_errors=True)
        raise
    return destination


def _validated_base_url(base_url: str) -> str:
    value = base_url.strip()
    parsed = urlsplit(value)
    if (
        parsed.scheme not in {"http", "https"}
        or not parsed.hostname

View on GitHub (pinned to d540b00184)

Solutions

1. Truncate the string/bytes before staging: payload[:MAX_EVIDENCE_FILE_BYTES] or keep the meaningful tail.
2. Stream-extract the relevant slice from the source data rather than staging the whole thing.
3. If you must capture more, split into multiple entries each under the cap.
4. For JSON, project to only the fields you need before serialization.

Example fix

// before
stage_evidence_bundle(dest, {"stdout": huge_stdout})  # str, >256 KiB
// after
capped = huge_stdout[-MAX_EVIDENCE_FILE_BYTES:] if len(huge_stdout) > MAX_EVIDENCE_FILE_BYTES else huge_stdout
stage_evidence_bundle(dest, {"stdout": capped})

from eval.workflow_bench.proposer_sandbox import MAX_EVIDENCE_FILE_BYTES

def capped(value):
    if isinstance(value, (bytes, bytearray)):
        return bytes(value[:MAX_EVIDENCE_FILE_BYTES])
    if isinstance(value, str):
        return value[:MAX_EVIDENCE_FILE_BYTES]
    return value

entries = {k: capped(v) for k, v in entries.items()}

null

try:
    stage_evidence_bundle(dest, entries, secrets=secrets)
except SandboxError as exc:
    if 'per-file limit' in str(exc) and 'name' in str(exc):
        # 425 path: post-redaction oversize on bytes/str/json
        entries = {k: capped(v) for k, v in entries.items()}
        stage_evidence_bundle(dest, entries, secrets=secrets)
    raise

When it happens

Trigger: A non-Path entry (bytes/str/JSON-serialized object) whose redacted form is larger than 262144 bytes, or a Path whose redacted text grew to exceed the cap despite a smaller raw size (rare) — primarily the bytes/str/json branches.

Common situations: A large stdout/stderr captured as str and passed directly; a big dict/JSON object serialized via json.dumps; base64 or hex blob that survives redaction; caller assumed the cap applied only to files and passed a huge string.

Related errors

• {label} exceeds the bounded evidence limit
• unsafe results artifact path: {relative_value!r}
• transcript artifact metadata must contain only path, sha256,
• transcript artifact exceeds the bounded run-output limit
• transcript_artifacts must be a list

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/820885135ba16a33. Report an issue: GitHub.