jdx/mise · error

encrypted file exceeds the size limit

Error message

encrypted file exceeds the size limit: {path}

What it means

Thrown by `encode` after serializing and encrypting a file when the resulting envelope exceeds `agecrypt::MAX_ENCRYPTED_BYTES`. Large binary blobs cannot be stored as encrypted sync objects, so the operation is rejected with the offending path named.

Solutions

1. Exclude the oversized file from the encryption list.
2. Move the large file to dedicated storage (e.g. git-lfs, cloud storage) and symlink or reference it.
3. Compress or trim the file's contents before syncing.

Example fix

// before
encrypt = ["~/**"]
// after
encrypt = ["~/.config/**", "!~/.local/share/large-media/**"]

const stat = await fs.stat(path);
if (stat.size > MAX_PLAINTEXT_SAFE_BYTES) {
  throw new Error(`${path} is too large to encrypt`);
}
await sync.encrypt(path, mode, content);

function isWithinSizeLimit(size: number, limit: number): boolean {
  return size <= limit;
}

try {
  await sync.encrypt(path, mode, content);
} catch (e) {
  if (/exceeds the size limit/.test(String(e))) {
    log.warn(`move ${path} to external storage and exclude it from encryption`);
  } else throw e;
}

When it happens

Trigger: Calling `encode` (via `encrypt`) on a file whose plaintext (plus envelope overhead) exceeds the max encrypted size limit — e.g. multi-hundred-MB binaries, large media files, or big credential stores.

Common situations: Dotfile globs accidentally including large files (videos, VM images, databases, browser profiles); a growing password-manager database exceeding the limit.

Understand the failure class

Background: "File too large" / "file size exceeds limit" errors: why libraries cap file sizes and how to fix them — this error's family across 46 libraries.

Related errors

• compressed payload exceeds the size limit
• encrypt an external dotfile source instead of configuration
• encrypted file does not match its path or mode
• encrypted payload exceeds the size limit
• [history.encryption].recipients must not be empty…

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/7fc040ad89bd003b. Report an issue: GitHub.

Appendix: source

Thrown at src/system/history/sync/files.rs:363

        bail!("unsupported encrypted file mode: {path}");
    }
    let inner = Plaintext {
        path: path.into(),
        mode: mode.into(),
        scheme: scheme.into(),
        content: Bytes(content.to_vec()),
    };
    let bytes = rmp_serde::to_vec_named(&inner)?;
    let outer = Envelope {
        path: path.into(),
        mode: mode.into(),
        scheme: scheme.into(),
        ciphertext: Bytes(agecrypt::encrypt_bytes(&bytes, recipients)?),
    };
    let mut encoded = MAGIC.to_vec();
    encoded.extend(rmp_serde::to_vec_named(&outer)?);
    if encoded.len() as u64 > agecrypt::MAX_ENCRYPTED_BYTES {
        bail!("encrypted file exceeds the size limit: {path}");
    }
    Ok(encoded)
}

#[cfg(test)]
mod tests {
    #[test]
    fn audit_reuses_verified_ancestry_but_rechecks_new_encryption_policy() {
        use crate::system::history::manifest::{Enrollment, Manifest};
        let tmp = tempfile::tempdir().unwrap();
        let repo = HistoryRepo::open_or_init_in(tmp.path()).unwrap().unwrap();
        let tree = repo
            .write_tree(&[(
                "100644".into(),
                repo.hash_blob(b"plain").unwrap(),
                "home/secret".into(),
            )])
            .unwrap();

View on GitHub (pinned to 533346cc37)