ruvnet/ruflo · error · Error

release asset exceeds ${maxBytes} byte limit

Error message

release asset exceeds ${maxBytes} byte limit

What it means

Error "release asset exceeds ${maxBytes} byte limit" thrown in ruvnet/ruflo.

Source

Thrown at v3/@claude-flow/cli/src/proxy/release.ts:67

export interface ReleaseAssets {
  archiveBytes: Buffer;
  archiveFilename: string;
  sumsBytes: Buffer;
  sigBase64: string;
}

const DEV_INSTALL_ENV = 'RUFLO_DEV_PROXY_INSTALL';
const RELEASE_SOURCE_ENV = 'RUFLO_PROXY_RELEASE_SOURCE';
const GH_REPO = 'cognitum-one/meta-proxy';
const PUBLIC_DIST_BASE = 'https://github.com/cognitum-one/meta-proxy-dist/releases/download';
const MAX_ARCHIVE_BYTES = 32 * 1024 * 1024;

async function downloadPublicAsset(url: string, maxBytes: number): Promise<Buffer> {
  const response = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(120_000) });
  if (!response.ok) throw new Error(`release download failed: HTTP ${response.status} for ${url}`);
  const declared = Number(response.headers.get('content-length') ?? 0);
  if (declared > maxBytes) throw new Error(`release asset exceeds ${maxBytes} byte limit`);
  const bytes = Buffer.from(await response.arrayBuffer());
  if (bytes.length > maxBytes) throw new Error(`release asset exceeds ${maxBytes} byte limit`);
  return bytes;
}

async function ghExecutor() {
  // Dynamic import, not a static one: @claude-flow/security is only an
  // optionalDependency of this package (see auth/security-bridge.ts for the
  // same reasoning) — a static top-level import would crash module load for
  // any consumer that doesn't have it installed, even ones that never touch
  // this dev-only download path.
  const { SafeExecutor } = await import('@claude-flow/security');
  return new SafeExecutor({ allowedCommands: ['gh'], timeout: 120_000 });
}

/**
 * Dev-only fallback: `gh release download` via SafeExecutor into `destDir`.
 * Requires the caller's environment to already have `gh` authenticated

View on GitHub (pinned to 6b01dc5a68)

When it happens

Trigger: Thrown at v3/@claude-flow/cli/src/proxy/release.ts:67 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@6b01dc5a68 (2026-08-12). Data as JSON: /api/errors/548dfa3d660efb5e. Report an issue: GitHub.