{"record":{"id":"c99f334e19ec9259","repo":"ruvnet/ruflo","slug":"key-exceeds-maximum-length-of-max-key-length-ch","errorCode":null,"errorMessage":"Key exceeds maximum length of ${MAX_KEY_LENGTH} characters","messagePattern":"Key exceeds maximum length of (.+?) characters","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/mcp-tools/memory-tools.ts","lineNumber":73,"sourceCode":"  if (!existsSync(dir)) {\n    mkdirSync(dir, { recursive: true });\n  }\n}\n\n// D-2: Input bounds for memory parameters\nconst MAX_KEY_LENGTH = 1024;\nconst MAX_VALUE_SIZE = 1024 * 1024; // 1MB\nconst MAX_QUERY_LENGTH = 4096;\n\n// #1425 — single source of truth for the dangerous-character set rejected by\n// validateMemoryInput. Imported by sanitizeMemoryKey so write-side sanitization\n// and read-side rejection can never drift apart (the symmetry bug behind #1884).\nconst DANGEROUS_KEY_CHARS = /[;&|`$(){}[\\]<>!#\\\\\\0]|\\.\\.[/\\\\]/g;\nconst DANGEROUS_KEY_PATTERN = /[;&|`$(){}[\\]<>!#\\\\\\0]|\\.\\.[/\\\\]/;\n\nfunction validateMemoryInput(key?: string, value?: string, query?: string, namespace?: string): void {\n  if (key && key.length > MAX_KEY_LENGTH) {\n    throw new Error(`Key exceeds maximum length of ${MAX_KEY_LENGTH} characters`);\n  }\n  if (value && value.length > MAX_VALUE_SIZE) {\n    throw new Error(`Value exceeds maximum size of ${MAX_VALUE_SIZE} bytes`);\n  }\n  if (query && query.length > MAX_QUERY_LENGTH) {\n    throw new Error(`Query exceeds maximum length of ${MAX_QUERY_LENGTH} characters`);\n  }\n  // Reject path traversal and shell metacharacters in keys/namespaces (#1425)\n  if (key && DANGEROUS_KEY_PATTERN.test(key)) {\n    throw new Error('Key contains disallowed characters');\n  }\n  if (namespace && DANGEROUS_KEY_PATTERN.test(namespace)) {\n    throw new Error('Namespace contains disallowed characters');\n  }\n}\n\n// #1884 — sanitize a key produced from arbitrary input (markdown headings,\n// frontmatter names, file names) so it survives validateMemoryInput on the","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/ruvnet/ruflo/blob/6b01dc5a687b26b3e218f796de45ec51f8fa9e8c/v3/@claude-flow/cli/src/mcp-tools/memory-tools.ts#L55-L91","documentation":"Thrown by validateMemoryInput when a memory key exceeds 1024 characters (MAX_KEY_LENGTH). Keys index memory entries on disk; an unbounded length would bloat the index and the JSON store. The check runs on the write, read, and delete paths before any filesystem access.","triggerScenarios":"Calling memory store/retrieve/delete with a key longer than 1024 chars. Long generated keys (hashed content, full file paths, large base64 blobs) are the usual culprit.","commonSituations":"Using a full document or base64 blob as a key; concatenating many identifiers into one key; a hash that produced an unexpectedly long string; keys derived from unbounded user input.","solutions":["Shorten the key to <= 1024 chars, e.g. by hashing long content with sha256 and using the hex digest.","Use sanitizeMemoryKey (or equivalent) which truncates to MAX_KEY_LENGTH.","Move large payloads into `value`, not `key`.","Validate key.length <= 1024 before calling the memory tool."],"exampleFix":"// before\nmemory store --key \"${hugeBlob}\" --value \"...\"\n// after\nconst key = createHash('sha256').update(hugeBlob).digest('hex')  // 64 chars\nmemory store --key \"$key\" --value \"$hugeBlob\"","handlingStrategy":"validation","validationCode":"const MAX_KEY_LENGTH = 1024;\nfunction safeMemoryKey(key) {\n  if (typeof key !== 'string') throw new Error('key must be a string');\n  if (key.length > MAX_KEY_LENGTH) {\n    return createHash('sha256').update(key).digest('hex');  // 64 chars\n  }\n  return key;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Hash long content before using it as a key.","Keep keys short, descriptive identifiers.","Validate length at the boundary."],"tags":["memory","validation","input-validation","limits","mcp-tools"],"backgroundTag":null,"analyzedSha":"6b01dc5a687b26b3e218f796de45ec51f8fa9e8c","analyzedAt":"2026-08-12T13:20:50.148Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}