From 6be8c5f1b5b4bef5ae01c115603eff22617180bc Mon Sep 17 00:00:00 2001 From: Ivan Malison Date: Sat, 11 Jul 2026 17:25:16 -0700 Subject: [PATCH] disk: refuse oversized safe_ncdu top queries --- dotfiles/agents/skills/disk-space-assessment/SKILL.md | 2 ++ dotfiles/lib/functions/safe_ncdu | 9 ++++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/dotfiles/agents/skills/disk-space-assessment/SKILL.md b/dotfiles/agents/skills/disk-space-assessment/SKILL.md index 93c130a2..1025583f 100644 --- a/dotfiles/agents/skills/disk-space-assessment/SKILL.md +++ b/dotfiles/agents/skills/disk-space-assessment/SKILL.md @@ -121,6 +121,8 @@ python /srv/dotfiles/dotfiles/agents/skills/disk-space-assessment/scripts/direnv This separates collectively direnv-only paths from paths retained by non-direnv roots and estimates each project's marginal uniquely retained footprint. Read `references/direnv-gc-roots.md` before interpreting or acting on the result. +For very large `/nix/store` exports, use `safe_ncdu open` for read-only navigation and the Nix audit tools for noninteractive attribution. `safe_ncdu top` refuses snapshots over 128 MiB compressed by default because its jq parser may exhaust memory. Do not estimate physical store usage by summing raw ncdu JSON `dsize` fields; use `du -sx --block-size=1 /nix/store` when a hardlink-aware physical total is necessary. + ## Assessment Handoff Return: diff --git a/dotfiles/lib/functions/safe_ncdu b/dotfiles/lib/functions/safe_ncdu index 69aba5bb..07097f59 100755 --- a/dotfiles/lib/functions/safe_ncdu +++ b/dotfiles/lib/functions/safe_ncdu @@ -184,7 +184,14 @@ function _safe_ncdu_top { echo "safe_ncdu top: missing SNAPSHOT" >&2 return 2 fi - _safe_ncdu_require zstdcat jq awk || return 1 + _safe_ncdu_require zstdcat jq awk stat || return 1 + local compressed_size + compressed_size="$(stat -Lc '%s' "$snapshot")" || return 1 + if [[ "$compressed_size" -gt 134217728 && "${SAFE_NCDU_ALLOW_LARGE_TOP:-0}" != 1 ]]; then + echo "safe_ncdu top: snapshot is larger than 128 MiB compressed; jq analysis may exhaust memory" >&2 + echo "safe_ncdu top: use 'safe_ncdu open $snapshot' or a domain-specific audit instead" >&2 + return 2 + fi zstdcat "$snapshot" | jq -r --argjson limit "$limit" --arg path "$query_path" ' def total: if type == "array" then