langchain-ai/deepagents · error · FleetImportError

{info.filename}: zip entry expanded beyond declared size

Error message

{info.filename}: zip entry expanded beyond declared size

What it means

While copying an entry to the staging directory, the number of bytes actually read exceeds either the entry's declared `file_size` or the global 256 MiB cap. This runtime check catches archives whose declared metadata lies (or whose decompressor produces more data than declared) — a defense-in-depth layer against zip bombs that pass static validation.

Source

Thrown at libs/talon/deepagents_talon/fleet_import.py:298

            _validate_agent_name(subagent, name)
            _copy_zip_file(archive, info, staging / "agents" / subagent / "AGENTS.md")
        elif name in {"config.json", "tools.json"}:
            _copy_zip_file(archive, info, staging / name)
        elif _is_subagent_tools_path(name):
            subagent = PurePosixPath(name).parts[1]
            _validate_agent_name(subagent, name)
            _copy_zip_file(archive, info, staging / "agents" / subagent / "tools.json")


def _copy_zip_file(archive: zipfile.ZipFile, info: zipfile.ZipInfo, target: Path) -> None:
    target.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
    copied = 0
    with archive.open(info) as src, target.open("wb") as dst:
        while chunk := src.read(_COPY_CHUNK_SIZE):
            copied += len(chunk)
            if copied > info.file_size or copied > _MAX_ZIP_UNCOMPRESSED_BYTES:
                msg = f"{info.filename}: zip entry expanded beyond declared size"
                raise FleetImportError(msg)
            dst.write(chunk)
    target.chmod(0o600)


def _validate_agent_name(name: str, path: str) -> None:
    if not _AGENT_ID_PATTERN.fullmatch(name) or name in {".", ".."}:
        msg = f"{path}: unsafe subagent name {name!r}"
        raise FleetImportError(msg)


def _is_subagent_prompt_path(name: str) -> bool:
    parts = PurePosixPath(name).parts
    return (
        len(parts) == _SUBAGENT_FILE_PARTS and parts[0] == "subagents" and parts[2] == "AGENTS.md"
    )


def _is_subagent_tools_path(name: str) -> bool:

View on GitHub (pinned to a1af029e6e)

Solutions

1. Verify the archive (`zipfile.ZipFile(p).testzip()`); if corrupt, re-obtain the export from the source
2. Reject the archive as untrusted — the on-disk data does not match declared metadata; request a clean re-export
3. Inspect entry headers (local vs central) with `zipfile.ZipFile(p).getinfo(name)` for size mismatches and rebuild the zip

Example fix

# before: tampered zip where local header size != central directory
// after: recreate the archive from trusted files
zip -r fleet.zip AGENTS.md skills subagents  # then verify testzip()

import zipfile

zip_path.expanduser().verify_archive = None  # no-op placeholder
with zipfile.ZipFile(zip_path.expanduser()) as z:
    if z.testzip() is not None:
        raise ValueError("archive corrupt: verify before import")

try:
    import_fleet_zip(zip_path, target_dir=target)
except FleetImportError as exc:
    if "expanded beyond declared size" in str(exc):
        print("Archive metadata is inconsistent with content; treat as untrusted and re-export")
    raise

When it happens

Trigger: `import_fleet_zip` → `_materialize_staging` → `_copy_zip_file` reads chunks from `archive.open(info)` and the accumulated `copied` counter surpasses `info.file_size` or `_MAX_ZIP_UNCOMPRESSED_BYTES`.

Common situations: Deliberately crafted archives with lying headers (declared small, decompressed large), corrupted zips whose central directory disagrees with the local header, or decompression backend bugs.

Related errors

• {name}: zip entry compression ratio exceeds limit
• {name}: symlink entries are not supported
• debug log directory is not a real directory: {path}
• debug log directory is not owned by the current user: {path}
• Cannot determine whether {str(left)!r} is {str(right)!r}: {e

AI-assisted analysis of langchain-ai/deepagents@a1af029e6e (2026-08-29). Data as JSON: /api/errors/fe5ba718b90f0d8c. Report an issue: GitHub.