larksuite/cli · error

file provider exceeded maxBytes (%d)

Error message

file provider exceeded maxBytes (%d)

What it means

The secret file content exceeds the provider's maxBytes limit (DefaultFileMaxBytes, 1 MiB by default). Because vfs.ReadFile loads the whole file, the provider enforces the cap after reading and rejects oversized files to avoid unbounded memory use from a potentially hostile or misconfigured path.

Source

Thrown at internal/binding/secret_resolve_file.go:64

		return "", fmt.Errorf("file provider security audit failed: %w", err)
	}

	// Read file content
	maxBytes := pc.MaxBytes
	if maxBytes <= 0 {
		maxBytes = DefaultFileMaxBytes
	}

	// Note: vfs.ReadFile loads the entire file. maxBytes is enforced post-read
	// because vfs does not expose a size-limited reader. For secret files this
	// is acceptable (default limit 1 MiB; secrets are typically < 1 KB).
	data, err := vfs.ReadFile(securePath)
	if err != nil {
		return "", fmt.Errorf("failed to read secret file %s: %w", securePath, err)
	}

	if len(data) > maxBytes {
		return "", fmt.Errorf("file provider exceeded maxBytes (%d)", maxBytes)
	}

	content := string(data)
	mode := pc.Mode
	if mode == "" {
		mode = "json" // default mode per OpenClaw
	}

	switch mode {
	case "singleValue":
		// OpenClaw requires ref.id == SINGLE_VALUE_FILE_REF_ID for singleValue mode
		if ref.ID != SingleValueFileRefID {
			return "", fmt.Errorf("singleValue file provider expects ref id %q, got %q",
				SingleValueFileRefID, ref.ID)
		}
		// Entire file content is the secret; trim trailing newline
		return strings.TrimRight(content, "\r\n"), nil

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Verify Path points at the actual secrets file, not a larger artifact (log, tarball, backup).
2. If the secrets file legitimately needs more room, raise ProviderConfig.MaxBytes to a sane bound.
3. Trim the file to only the secret entries needed.

Example fix

// before
maxBytes: 1024  // secrets file is 4 KB
// after
maxBytes: 1048576  // or omit to use the 1 MiB default

info, err := os.Stat(os.ExpandEnv(pc.Path))
if err == nil && uint64(info.Size()) > maxBytesOrDefault(pc.MaxBytes) {
    return fmt.Errorf("secret file %s is %d bytes, exceeds maxBytes", pc.Path, info.Size())
}

secret, err := resolveSecretRef(ctx, ref)
if err != nil {
    if strings.Contains(err.Error(), "exceeded maxBytes") {
        // verify you pointed at the right file or raise maxBytes deliberately
    }
    return err
}

When it happens

Trigger: Calling resolveSecretRef with a {source:"file"} SecretRef where the file at Path is larger than pc.MaxBytes (or the 1 MiB default when MaxBytes <= 0).

Common situations: The configured path accidentally points at a large log, dump, or bundle file instead of the secrets file; a legit secrets file grew past a deliberately low custom MaxBytes; someone concatenated multiple secret files.

Understand the failure class

Background: "File too large" / "file size exceeds limit" errors: why libraries cap file sizes and how to fix them — this error's family across 46 libraries.

Related errors

• file provider path is empty
• file provider security audit failed: %w
• failed to read secret file %s: %w
• singleValue file provider expects ref id %q, got %q
• file provider JSON parse error: %w

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/87eea83abf925673. Report an issue: GitHub.