santifer/career-ops · error · Error

the published index exceeds ${MAX_INDEX_BYTES} bytes (${decl

Error message

the published index exceeds ${MAX_INDEX_BYTES} bytes (${declared}): ${url}

What it means

downloadAsset() checks the declared Content-Length header before reading the body and aborts if the index claims to be larger than MAX_INDEX_BYTES. This pre-flight cap prevents committing to a huge download from a hostile or misconfigured endpoint; it is the header-based half of the size guard (the streamed-body half is a separate error).

Source

Thrown at plugins/h1b-sponsor/install-h1b-index.mjs:149

    ? null
    : String(doc.version).slice(0, 64);
  return { filename, sha256, version };
}

/**
 * Stream the asset to `tmpFile`, hashing as it goes, and return the digest.
 *
 * Streamed rather than buffered: the body is millions of times the size of
 * anything else this plugin reads, and readBoundedText's 1 MiB ceiling exists
 * precisely because nothing on the API path should ever be this big. Hashing
 * during the write means the file is never read a second time to verify it.
 */
async function downloadAsset(fetchImpl, url, tmpFile) {
  return fetchImpl(url, { timeoutMs: ASSET_TIMEOUT_MS }, async res => {
    if (res.status !== 200) throw new Error(`could not download the index (HTTP ${res.status}): ${url}`);
    const declared = Number(res.headers?.get?.('content-length'));
    if (Number.isFinite(declared) && declared > MAX_INDEX_BYTES) {
      throw new Error(`the published index exceeds ${MAX_INDEX_BYTES} bytes (${declared}): ${url}`);
    }
    if (!res.body || typeof res.body.getReader !== 'function') {
      throw new Error(`the index response carried no readable body: ${url}`);
    }

    const hash = createHash('sha256');
    const out = createWriteStream(tmpFile);
    // A write failure (disk full, an unwritable target) arrives as an 'error'
    // event on the stream, and an EventEmitter error with no listener is an
    // uncaughtException: the CLI died on a stack trace instead of returning
    // the envelope, and the cleanup that removes the partial .tmp file never
    // ran. Recording the error here makes the crash impossible; the checks
    // below turn it into the ordinary failure it is. once(out, 'drain') needs
    // no extra wiring, it already rejects when 'error' fires mid-wait.
    let writeError = null;
    out.on('error', err => { writeError = err; });
    const reader = res.body.getReader();
    let total = 0;

View on GitHub (pinned to 1696bec4d0)

Solutions

1. curl -I the asset URL and compare Content-Length with MAX_INDEX_BYTES to confirm what is actually being served.
2. Verify H1B_API_BASE / the asset URL points at the genuine release host, not a mirror or wrong path.
3. If you publish the index, republish the correct artifact within the size budget.
4. Do not try to bypass the cap — the limit is intentional; escalate to the release maintainers if the real index legitimately outgrew it.

Example fix

// before
H1B_API_BASE=https://mirror.example.internal   // serves a 200 MB archive at that path
// after
unset H1B_API_BASE  // default endpoint serves the real, size-capped index

const head = await fetch(assetUrl, { method: 'HEAD' });
const MAX_INDEX_BYTES = 8 * 1024 * 1024;
const len = Number(head.headers.get('content-length'));
if (head.ok && Number.isFinite(len) && len > MAX_INDEX_BYTES) {
  throw new Error(`asset is ${len} bytes, over the ${MAX_INDEX_BYTES} cap — wrong endpoint or artifact`);
}

try {
  await installH1BIndex();
} catch (e) {
  if (String(e.message).includes('exceeds') && e.message.includes('bytes')) {
    console.error('Declared index size exceeds the cap; verify H1B_API_BASE and the published artifact.');
  } else throw e;
}

When it happens

Trigger: The asset response is 200 and res.headers.get('content-length') parses to a finite number greater than MAX_INDEX_BYTES.

Common situations: H1B_API_BASE points at an unrelated large file (or a mirror serving something else at that path); a proxy returns a giant error/archive with 200; the release pipeline accidentally published the wrong, oversized artifact; a hostile endpoint deliberately advertises a huge body.

Related errors

• the release pointer is implausibly large: ${url}
• Could not fetch job page: ${e.message}
• too many redirects (>${MAX_REDIRECTS}) for ${url}
• could not read the release pointer (HTTP ${out.status}): ${u
• the release pointer is not JSON: ${url}

AI-assisted analysis of santifer/career-ops@1696bec4d0 (2026-09-01). Data as JSON: /api/errors/c4f517c8d0022335. Report an issue: GitHub.