{"record":{"id":"470ca8f9dcfd877d","repo":"Hmbown/CodeWhale","slug":"exceeds-the-byte-workspace-env-limit","errorCode":null,"errorMessage":"{} exceeds the {} byte workspace .env limit","messagePattern":"(.+?) exceeds the (.+?) byte workspace \\.env limit","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/lib.rs","lineNumber":2631,"sourceCode":"    false\n}\n\nfn read_stable_workspace_dotenv(path: &Path) -> Result<Vec<u8>> {\n    let mut file = open_workspace_dotenv_without_following_links(path)?;\n    let metadata = file\n        .metadata()\n        .map_err(|error| anyhow!(\"could not inspect {}: {error}\", path.display()))?;\n    if !metadata.is_file() {\n        bail!(\"{} is not a regular file\", path.display());\n    }\n    if workspace_dotenv_has_multiple_links(&file, &metadata)? {\n        bail!(\n            \"{} has multiple filesystem links, not a unique workspace-owned file\",\n            path.display()\n        );\n    }\n    if metadata.len() > MAX_WORKSPACE_DOTENV_BYTES {\n        bail!(\n            \"{} exceeds the {} byte workspace .env limit\",\n            path.display(),\n            MAX_WORKSPACE_DOTENV_BYTES\n        );\n    }\n\n    let mut contents = Vec::with_capacity(metadata.len() as usize);\n    (&mut file)\n        .take(MAX_WORKSPACE_DOTENV_BYTES + 1)\n        .read_to_end(&mut contents)\n        .map_err(|error| anyhow!(\"could not read {}: {error}\", path.display()))?;\n    if contents.len() as u64 > MAX_WORKSPACE_DOTENV_BYTES {\n        bail!(\n            \"{} exceeds the {} byte workspace .env limit\",\n            path.display(),\n            MAX_WORKSPACE_DOTENV_BYTES\n        );\n    }","sourceCodeStart":2613,"sourceCodeEnd":2649,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/lib.rs#L2613-L2649","documentation":"First of two size guards in read_stable_workspace_dotenv: the fstat metadata of the opened .env must not exceed MAX_WORKSPACE_DOTENV_BYTES (1 MiB, 1024*1024). A credential file should hold a handful of literal pairs; anything past the cap is refused before a single byte is read, bounding memory and parse cost on untrusted workspace input.","triggerScenarios":"A workspace .env larger than 1 MiB — a misdirected dump, embedded base64 blob, appended log output, or a generated catalog written into .env — present when codewhale loads workspace dotenv credentials.","commonSituations":"`some-tool >> .env` logging accidents; secrets exporters dumping whole environments; generated .env files from templates with large inline material.","solutions":["Check the size: `wc -c .env` — if it is near or past 1048576, inspect the content","Remove anything that is not a literal KEY=value credential line (logs, blobs, dumps)","Keep generated bulk data in a different file; .env is for a small set of literal secrets"],"exampleFix":"# before\nwc -c .env        # 2500000 .env\n\n# after: keep only literal credential lines\ngrep -E '^[A-Za-z_][A-Za-z0-9_]*=' .env > .env.trimmed && mv .env.trimmed .env\nwc -c .env        # 412 .env","handlingStrategy":"validation","validationCode":"MAX=1048576  # 1 MiB\nsize=$(wc -c < .env)\n[ \"$size\" -le \"$MAX\" ] || { echo \".env is $size bytes (limit $MAX)\"; exit 2; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep .env to literal credential pairs only","Never append logs or generated output to .env","Lint .env size in pre-commit or workspace bootstrap"],"tags":["dotenv","security","file-size","workspace"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}