{"record":{"id":"c4f517c8d0022335","repo":"santifer/career-ops","slug":"the-published-index-exceeds-max-index-bytes-byt","errorCode":null,"errorMessage":"the published index exceeds ${MAX_INDEX_BYTES} bytes (${declared}): ${url}","messagePattern":"the published index exceeds (.+?) bytes \\((.+?)\\): (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"plugins/h1b-sponsor/install-h1b-index.mjs","lineNumber":149,"sourceCode":"    ? null\n    : String(doc.version).slice(0, 64);\n  return { filename, sha256, version };\n}\n\n/**\n * Stream the asset to `tmpFile`, hashing as it goes, and return the digest.\n *\n * Streamed rather than buffered: the body is millions of times the size of\n * anything else this plugin reads, and readBoundedText's 1 MiB ceiling exists\n * precisely because nothing on the API path should ever be this big. Hashing\n * during the write means the file is never read a second time to verify it.\n */\nasync function downloadAsset(fetchImpl, url, tmpFile) {\n  return fetchImpl(url, { timeoutMs: ASSET_TIMEOUT_MS }, async res => {\n    if (res.status !== 200) throw new Error(`could not download the index (HTTP ${res.status}): ${url}`);\n    const declared = Number(res.headers?.get?.('content-length'));\n    if (Number.isFinite(declared) && declared > MAX_INDEX_BYTES) {\n      throw new Error(`the published index exceeds ${MAX_INDEX_BYTES} bytes (${declared}): ${url}`);\n    }\n    if (!res.body || typeof res.body.getReader !== 'function') {\n      throw new Error(`the index response carried no readable body: ${url}`);\n    }\n\n    const hash = createHash('sha256');\n    const out = createWriteStream(tmpFile);\n    // A write failure (disk full, an unwritable target) arrives as an 'error'\n    // event on the stream, and an EventEmitter error with no listener is an\n    // uncaughtException: the CLI died on a stack trace instead of returning\n    // the envelope, and the cleanup that removes the partial .tmp file never\n    // ran. Recording the error here makes the crash impossible; the checks\n    // below turn it into the ordinary failure it is. once(out, 'drain') needs\n    // no extra wiring, it already rejects when 'error' fires mid-wait.\n    let writeError = null;\n    out.on('error', err => { writeError = err; });\n    const reader = res.body.getReader();\n    let total = 0;","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/santifer/career-ops/blob/1696bec4d021768e7359f9aad6b329cba883da20/plugins/h1b-sponsor/install-h1b-index.mjs#L131-L167","documentation":"downloadAsset() checks the declared Content-Length header before reading the body and aborts if the index claims to be larger than MAX_INDEX_BYTES. This pre-flight cap prevents committing to a huge download from a hostile or misconfigured endpoint; it is the header-based half of the size guard (the streamed-body half is a separate error).","triggerScenarios":"The asset response is 200 and res.headers.get('content-length') parses to a finite number greater than MAX_INDEX_BYTES.","commonSituations":"H1B_API_BASE points at an unrelated large file (or a mirror serving something else at that path); a proxy returns a giant error/archive with 200; the release pipeline accidentally published the wrong, oversized artifact; a hostile endpoint deliberately advertises a huge body.","solutions":["curl -I the asset URL and compare Content-Length with MAX_INDEX_BYTES to confirm what is actually being served.","Verify H1B_API_BASE / the asset URL points at the genuine release host, not a mirror or wrong path.","If you publish the index, republish the correct artifact within the size budget.","Do not try to bypass the cap — the limit is intentional; escalate to the release maintainers if the real index legitimately outgrew it."],"exampleFix":"// before\nH1B_API_BASE=https://mirror.example.internal   // serves a 200 MB archive at that path\n// after\nunset H1B_API_BASE  // default endpoint serves the real, size-capped index","handlingStrategy":"validation","validationCode":"const head = await fetch(assetUrl, { method: 'HEAD' });\nconst MAX_INDEX_BYTES = 8 * 1024 * 1024;\nconst len = Number(head.headers.get('content-length'));\nif (head.ok && Number.isFinite(len) && len > MAX_INDEX_BYTES) {\n  throw new Error(`asset is ${len} bytes, over the ${MAX_INDEX_BYTES} cap — wrong endpoint or artifact`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  await installH1BIndex();\n} catch (e) {\n  if (String(e.message).includes('exceeds') && e.message.includes('bytes')) {\n    console.error('Declared index size exceeds the cap; verify H1B_API_BASE and the published artifact.');\n  } else throw e;\n}","preventionTips":["HEAD-check the asset size once when configuring a custom endpoint.","Never point the installer at mirrors or unrelated large files at the same path.","Keep published index artifacts within the documented size budget.","Treat the size cap as a safety feature — don't patch it out of the source."],"tags":["network","validation","http"],"backgroundTag":"unexpected-response-size","analyzedSha":"1696bec4d021768e7359f9aad6b329cba883da20","analyzedAt":"2026-09-01T19:19:23.111Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}