Function validateBundle

apps/memos-local-openclaw/src/client/skill-sync.ts:178–196

(bundle: SkillGenerateOutput)

}

function validateBundle(bundle: SkillGenerateOutput): void {
  const allowedExtensions = new Set([".md", ".ts", ".js", ".sh", ".json", ".yaml", ".yml", ".txt"]);
  const files = [...bundle.scripts, ...bundle.references];
  if (Buffer.byteLength(bundle.skill_md, "utf8") > 100 * 1024) throw new Error("SKILL.md exceeds size limit");
  if (files.length > 50) throw new Error("bundle contains too many files");

  let totalBytes = Buffer.byteLength(bundle.skill_md, "utf8");
  for (const file of files) {
    const name = file.filename;
    if (!name || path.isAbsolute(name) || name.startsWith("/") || name.includes("..")) throw new Error(`unsafe filename: ${name}`);
    if (!/^[A-Za-z0-9._/-]+$/.test(name)) throw new Error(`invalid filename: ${name}`);
    const ext = path.extname(name).toLowerCase();
    if (!allowedExtensions.has(ext)) throw new Error(`unsupported file type: ${name}`);
    const fileSize = Buffer.byteLength(file.content, "utf8");
    if (fileSize > 512 * 1024) throw new Error(`file exceeds size limit: ${name}`);
    totalBytes += fileSize;
  }
  if (totalBytes > 5 * 1024 * 1024) throw new Error("bundle exceeds size limit");
}

function writeCompanionFiles(dirPath: string, root: "scripts" | "references", files: Array<{ filename: string; content: string }>): void {
  if (files.length === 0) return;