abhigyanpatwari/GitNexus · error · SandboxError

evidence exceeds the per-file limit: {value}

Error message

evidence exceeds the per-file limit: {value}

What it means

Raised by _evidence_bytes when a Path evidence file's on-disk size (value.stat().st_size, pre-redaction) exceeds MAX_EVIDENCE_FILE_BYTES (256 KiB). The cap is enforced before read_bytes() so a huge file is never read into memory or scanned for secrets.

Source

Thrown at eval/workflow_bench/proposer_sandbox.py:200

    for secret in secrets:
        if secret:
            text = text.replace(secret, "[REDACTED]")
    text = _TOKEN_PATTERNS[0].sub("[REDACTED]", text)
    text = _TOKEN_PATTERNS[1].sub("[REDACTED]", text)
    text = _TOKEN_PATTERNS[2].sub(r"\1[REDACTED]", text)
    return _TOKEN_PATTERNS[3].sub(r"\1[REDACTED]@", text)


def _evidence_bytes(value: Any, secrets: Sequence[str]) -> bytes:
    if isinstance(value, Path):
        try:
            mode = value.lstat().st_mode
        except OSError as exc:
            raise SandboxError(f"evidence path is unreadable: {value}: {exc}") from exc
        if value.is_symlink() or not stat.S_ISREG(mode):
            raise SandboxError(f"evidence must be a regular non-symlink file: {value}")
        if value.stat().st_size > MAX_EVIDENCE_FILE_BYTES:
            raise SandboxError(f"evidence exceeds the per-file limit: {value}")
        raw = value.read_bytes()
        return redact_text(raw.decode(errors="replace"), secrets).encode()
    if isinstance(value, bytes):
        raw = value
    elif isinstance(value, str):
        raw = value.encode()
    else:
        raw = (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode()
    return redact_text(raw.decode(errors="replace"), secrets).encode()


def stage_evidence_bundle(
    destination: Path,
    entries: Mapping[str, Any],
    *,
    secrets: Sequence[str] = (),
) -> Path:
    """Write a redacted owner-only evidence bundle with hard byte caps."""

View on GitHub (pinned to d540b00184)

Solutions

1. Trim or tail the file to fit: keep the last 256 KiB (or the meaningful slice) and stage that, as eval/workflow_bench/evolve.py:_bounded_regular_text already does.
2. Switch the entry from Path to bytes/str containing only the excerpt you need.
3. If the file legitimately needs full capture, split it across multiple <=256 KiB entries (each still capped) or raise MAX_EVIDENCE_FILE_BYTES deliberately with a code change after review.
4. Filter the content before staging (e.g. strip base64 blobs, drop noisy lines).

Example fix

// before
stage_evidence_bundle(dest, {"run.log": Path("run.log")})  # run.log is 2 MiB
// after
bounded = _bounded_regular_text(Path("run.log"), limit=MAX_EVIDENCE_FILE_BYTES)
stage_evidence_bundle(dest, {"run.log": bounded})

from pathlib import Path
from eval.workflow_bench.proposer_sandbox import MAX_EVIDENCE_FILE_BYTES

def fits_per_file(p: Path) -> bool:
    try:
        return p.stat().st_size <= MAX_EVIDENCE_FILE_BYTES
    except OSError:
        return False

entries = {k: v for k, v in entries.items() if not isinstance(v, Path) or fits_per_file(v)}

null

try:
    stage_evidence_bundle(dest, entries, secrets=secrets)
except SandboxError as exc:
    if 'per-file limit' in str(exc) and 'value' in str(exc):
        # 422 path: trim the oversized file and retry
        trim_oversized_path_entries(entries)
        stage_evidence_bundle(dest, entries, secrets=secrets)
    raise

When it happens

Trigger: stage_evidence_bundle receives a Path entry whose actual file size is greater than 262144 bytes.

Common situations: A full run log or stdout capture was attached untrimmed; an oracle dumped a large JSON snapshot; binary artifact (screenshot, core file) mistakenly staged; verbose tracing left on; a build output file was selected instead of the trimmed summary.

Related errors

• evidence source must be a regular non-symlink file: {path}
• results directory is unavailable: {root}: {exc}
• transcript artifact is unavailable: {path}: {exc}
• evidence path is unreadable: {value}: {exc}
• evidence must be a regular non-symlink file: {value}

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/ae2a7e3c48b12019. Report an issue: GitHub.