affaan-m/ECC · error · Error

Refusing to run install from untrusted repo root

Error message

Refusing to run install from untrusted repo root ${normalized}: package.json name '${pkgName}' is not an official ECC package.

What it means

readRegularTextFile enforces a maximum byte size (maxBytes). After confirming the file is a safe regular file, it compares the opened file's size (from fstat, as BigInt) against BigInt(maxBytes) and throws this error if it exceeds the limit. Reading is also bounded chunk-by-chunk as a second guard. The library throws this to prevent unbounded memory consumption from a huge or maliciously grown memory document.

Solutions

Increase the maxBytes option to a value above the file's actual size if the document is legitimately large.
Split or compact the memory document into smaller files, or prune stale entries.
Remove any non-memory/binary files accidentally placed at the path.
Investigate why the file grew that large (runaway appends, corruption) before simply raising the limit.

Example fix

// before
readBody(file, { maxBytes: 64 * 1024 }); // file is 200 KB

// after
readBody(file, { maxBytes: 1024 * 1024 }); // or compact the document below the limit

Defensive patterns

Strategy: validation

Validate before calling

const fs = require('fs');
function assertWithinReadLimit(path, maxBytes) {
  const size = fs.statSync(path).size;
  if (size > maxBytes) {
    throw new Error(`File ${path} is ${size} bytes; exceeds read limit ${maxBytes}. Compact or raise maxBytes.`);
  }
}

Type guard

const fitsReadLimit = (p, maxBytes) => { try { return fs.statSync(p).size <= maxBytes; } catch { return false; } };

Try / catch

try {
  const text = readRegularTextFile(file, { label: 'memory document', maxBytes });
} catch (err) {
  const m = err.message.match(/is too large \((\d+) bytes\)/);
  if (m) throw new Error(`Memory document exceeds the ${maxBytes}-byte limit (${m[1]} bytes). Compact it or raise maxBytes.`);
  throw err;
}

Prevention

Compact/prune memory documents regularly so they stay well under the limit.
Check file sizes with fs.statSync before reading large or unknown files.
Set maxBytes explicitly per use case instead of relying on defaults.
Alert on anomalous vault file growth (runaway appends or corruption).

When it happens

Trigger: Reading a memory document (via existing, source, or readBody) whose on-disk size exceeds the caller's maxBytes option — e.g. a huge accumulated log-like memory file, a binary accidentally placed in the vault, or a very small maxBytes configured for a legitimately large document.

Common situations: A memory file grew unbounded because writes kept appending without compaction; a user dropped a large export/archive into the vault directory; default size limits encountered when migrating bigger documents from another tool; corruption producing a pathologically large file.

Understand the failure class

Background: "File too large" / "file size exceeds limit" errors: why libraries cap file sizes and how to fix them — this error's family across 46 libraries.

Related errors

AI-assisted analysis of affaan-m/ECC@8321021c54 (2026-09-16). Data as JSON: /api/errors/bada7d71c9cd9457. Report an issue: GitHub.

Appendix: source

Thrown at scripts/auto-update.js:158

  const packageJsonPath = path.join(normalized, 'package.json');
  const installApplyPath = path.join(normalized, 'scripts', 'install-apply.js');

  if (!fs.existsSync(packageJsonPath)) {
    throw new Error(`Invalid ECC repo root: missing package.json at ${packageJsonPath}`);
  }

  if (!fs.existsSync(installApplyPath)) {
    throw new Error(`Invalid ECC repo root: missing install script at ${installApplyPath}`);
  }

  let pkgName = null;
  try {
    pkgName = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8')).name;
  } catch {
    throw new Error(`Invalid ECC repo root: unreadable package.json at ${packageJsonPath}`);
  }
  if (!ECC_PACKAGE_NAMES.has(pkgName)) {
    throw new Error(`Refusing to run install from untrusted repo root ${normalized}: package.json name '${pkgName}' is not an official ECC package.`);
  }

  return normalized;
}

function runExternalCommand(command, args, options = {}) {
  const result = spawnSync(command, args, {
    cwd: options.cwd,
    env: options.env || process.env,
    encoding: 'utf8',
    maxBuffer: 10 * 1024 * 1024
  });

  if (result.error) {
    throw result.error;
  }

  if (typeof result.status === 'number' && result.status !== 0) {

View on GitHub (pinned to 8321021c54)