{"record":{"id":"7fc040ad89bd003b","repo":"jdx/mise","slug":"encrypted-file-exceeds-the-size-limit-path","errorCode":null,"errorMessage":"encrypted file exceeds the size limit: {path}","messagePattern":"encrypted file exceeds the size limit: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/history/sync/files.rs","lineNumber":363,"sourceCode":"        bail!(\"unsupported encrypted file mode: {path}\");\n    }\n    let inner = Plaintext {\n        path: path.into(),\n        mode: mode.into(),\n        scheme: scheme.into(),\n        content: Bytes(content.to_vec()),\n    };\n    let bytes = rmp_serde::to_vec_named(&inner)?;\n    let outer = Envelope {\n        path: path.into(),\n        mode: mode.into(),\n        scheme: scheme.into(),\n        ciphertext: Bytes(agecrypt::encrypt_bytes(&bytes, recipients)?),\n    };\n    let mut encoded = MAGIC.to_vec();\n    encoded.extend(rmp_serde::to_vec_named(&outer)?);\n    if encoded.len() as u64 > agecrypt::MAX_ENCRYPTED_BYTES {\n        bail!(\"encrypted file exceeds the size limit: {path}\");\n    }\n    Ok(encoded)\n}\n\n#[cfg(test)]\nmod tests {\n    #[test]\n    fn audit_reuses_verified_ancestry_but_rechecks_new_encryption_policy() {\n        use crate::system::history::manifest::{Enrollment, Manifest};\n        let tmp = tempfile::tempdir().unwrap();\n        let repo = HistoryRepo::open_or_init_in(tmp.path()).unwrap().unwrap();\n        let tree = repo\n            .write_tree(&[(\n                \"100644\".into(),\n                repo.hash_blob(b\"plain\").unwrap(),\n                \"home/secret\".into(),\n            )])\n            .unwrap();","sourceCodeStart":345,"sourceCodeEnd":381,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/history/sync/files.rs#L345-L381","documentation":"Thrown by `encode` after serializing and encrypting a file when the resulting envelope exceeds `agecrypt::MAX_ENCRYPTED_BYTES`. Large binary blobs cannot be stored as encrypted sync objects, so the operation is rejected with the offending path named.","triggerScenarios":"Calling `encode` (via `encrypt`) on a file whose plaintext (plus envelope overhead) exceeds the max encrypted size limit — e.g. multi-hundred-MB binaries, large media files, or big credential stores.","commonSituations":"Dotfile globs accidentally including large files (videos, VM images, databases, browser profiles); a growing password-manager database exceeding the limit.","solutions":["Exclude the oversized file from the encryption list.","Move the large file to dedicated storage (e.g. git-lfs, cloud storage) and symlink or reference it.","Compress or trim the file's contents before syncing."],"exampleFix":"// before\nencrypt = [\"~/**\"]\n// after\nencrypt = [\"~/.config/**\", \"!~/.local/share/large-media/**\"]","handlingStrategy":"validation","validationCode":"const stat = await fs.stat(path);\nif (stat.size > MAX_PLAINTEXT_SAFE_BYTES) {\n  throw new Error(`${path} is too large to encrypt`);\n}\nawait sync.encrypt(path, mode, content);","typeGuard":"function isWithinSizeLimit(size: number, limit: number): boolean {\n  return size <= limit;\n}","tryCatchPattern":"try {\n  await sync.encrypt(path, mode, content);\n} catch (e) {\n  if (/exceeds the size limit/.test(String(e))) {\n    log.warn(`move ${path} to external storage and exclude it from encryption`);\n  } else throw e;\n}","preventionTips":["Keep large binaries out of dotfile globs.","Periodically audit encrypted files for size growth.","Use symlinks plus exclusions for large media/data files."],"tags":["encryption","size-limit","validation"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}