ruvnet/ruflo · error · Error

Key exceeds maximum length of ${MAX_KEY_LENGTH} characters

Error message

Key exceeds maximum length of ${MAX_KEY_LENGTH} characters

What it means

Thrown by validateMemoryInput when a memory key exceeds 1024 characters (MAX_KEY_LENGTH). Keys index memory entries on disk; an unbounded length would bloat the index and the JSON store. The check runs on the write, read, and delete paths before any filesystem access.

Source

Thrown at v3/@claude-flow/cli/src/mcp-tools/memory-tools.ts:73

  if (!existsSync(dir)) {
    mkdirSync(dir, { recursive: true });
  }
}

// D-2: Input bounds for memory parameters
const MAX_KEY_LENGTH = 1024;
const MAX_VALUE_SIZE = 1024 * 1024; // 1MB
const MAX_QUERY_LENGTH = 4096;

// #1425 — single source of truth for the dangerous-character set rejected by
// validateMemoryInput. Imported by sanitizeMemoryKey so write-side sanitization
// and read-side rejection can never drift apart (the symmetry bug behind #1884).
const DANGEROUS_KEY_CHARS = /[;&|`$(){}[\]<>!#\\\0]|\.\.[/\\]/g;
const DANGEROUS_KEY_PATTERN = /[;&|`$(){}[\]<>!#\\\0]|\.\.[/\\]/;

function validateMemoryInput(key?: string, value?: string, query?: string, namespace?: string): void {
  if (key && key.length > MAX_KEY_LENGTH) {
    throw new Error(`Key exceeds maximum length of ${MAX_KEY_LENGTH} characters`);
  }
  if (value && value.length > MAX_VALUE_SIZE) {
    throw new Error(`Value exceeds maximum size of ${MAX_VALUE_SIZE} bytes`);
  }
  if (query && query.length > MAX_QUERY_LENGTH) {
    throw new Error(`Query exceeds maximum length of ${MAX_QUERY_LENGTH} characters`);
  }
  // Reject path traversal and shell metacharacters in keys/namespaces (#1425)
  if (key && DANGEROUS_KEY_PATTERN.test(key)) {
    throw new Error('Key contains disallowed characters');
  }
  if (namespace && DANGEROUS_KEY_PATTERN.test(namespace)) {
    throw new Error('Namespace contains disallowed characters');
  }
}

// #1884 — sanitize a key produced from arbitrary input (markdown headings,
// frontmatter names, file names) so it survives validateMemoryInput on the

View on GitHub (pinned to 6b01dc5a68)

Solutions

1. Shorten the key to <= 1024 chars, e.g. by hashing long content with sha256 and using the hex digest.
2. Use sanitizeMemoryKey (or equivalent) which truncates to MAX_KEY_LENGTH.
3. Move large payloads into `value`, not `key`.
4. Validate key.length <= 1024 before calling the memory tool.

Example fix

// before
memory store --key "${hugeBlob}" --value "..."
// after
const key = createHash('sha256').update(hugeBlob).digest('hex')  // 64 chars
memory store --key "$key" --value "$hugeBlob"

const MAX_KEY_LENGTH = 1024;
function safeMemoryKey(key) {
  if (typeof key !== 'string') throw new Error('key must be a string');
  if (key.length > MAX_KEY_LENGTH) {
    return createHash('sha256').update(key).digest('hex');  // 64 chars
  }
  return key;
}

When it happens

Trigger: Calling memory store/retrieve/delete with a key longer than 1024 chars. Long generated keys (hashed content, full file paths, large base64 blobs) are the usual culprit.

Common situations: Using a full document or base64 blob as a key; concatenating many identifiers into one key; a hash that produced an unexpectedly long string; keys derived from unbounded user input.

Related errors

• Value exceeds maximum size of ${MAX_VALUE_SIZE} bytes
• Query exceeds maximum length of ${MAX_QUERY_LENGTH} characte
• candidate ${label} must ingest at least one vector
• records must be a non-empty array of {id?, vector, text?}
• Key exceeds maximum nesting depth of ${MAX_NESTING_DEPTH}

AI-assisted analysis of ruvnet/ruflo@6b01dc5a68 (2026-08-12). Data as JSON: /api/errors/c99f334e19ec9259. Report an issue: GitHub.