11import { spawn } from "node:child_process";
2+import { readPositiveIntegerParam } from "openclaw/plugin-sdk/param-readers";
23import type {
34OpenClawPluginNodeInvokePolicy,
45OpenClawPluginNodeInvokePolicyContext,
@@ -43,10 +44,11 @@ function readMaxBytes(input: {
4344hardMax: number;
4445policyMax?: number;
4546}): number {
46-const requested =
47-typeof input.value === "number" && Number.isFinite(input.value)
48- ? Math.floor(input.value)
49- : input.defaultValue;
47+const parsed =
48+input.value === undefined
49+ ? input.defaultValue
50+ : readPositiveIntegerParam({ maxBytes: input.value }, "maxBytes");
51+const requested = parsed ?? input.defaultValue;
5052const clamped = Math.max(1, Math.min(requested, input.hardMax));
5153return input.policyMax ? Math.min(clamped, input.policyMax) : clamped;
5254}
@@ -55,6 +57,15 @@ function commandKind(command: FileTransferCommand): FilePolicyKind {
5557return command === "file.write" ? "write" : "read";
5658}
575960+function validateFetchMaxBytesParam(command: FileTransferCommand, params: Record<string, unknown>) {
61+if (command !== "file.fetch" && command !== "dir.fetch") {
62+return;
63+}
64+if (params.maxBytes !== undefined) {
65+readPositiveIntegerParam(params, "maxBytes");
66+}
67+}
68+5869function promptVerb(command: FileTransferCommand): string {
5970switch (command) {
6071case "dir.fetch":
@@ -738,6 +749,15 @@ async function handleFileTransferInvoke(
738749if (!requestedPath) {
739750return { ok: false, code: "INVALID_PARAMS", message: `${op} path required` };
740751}
752+try {
753+validateFetchMaxBytesParam(command, params);
754+} catch (error) {
755+return {
756+ok: false,
757+code: "INVALID_PARAMS",
758+message: error instanceof Error ? error.message : String(error),
759+};
760+}
741761742762const gate = await requestApproval({
743763 ctx,
@@ -750,12 +770,21 @@ async function handleFileTransferInvoke(
750770return { ok: false, code: gate.code, message: gate.message };
751771}
752772753-const forwardedParams = prepareParams({
754- command,
755- params,
756-followSymlinks: gate.followSymlinks,
757-maxBytes: gate.maxBytes,
758-});
773+let forwardedParams: Record<string, unknown>;
774+try {
775+forwardedParams = prepareParams({
776+ command,
777+ params,
778+followSymlinks: gate.followSymlinks,
779+maxBytes: gate.maxBytes,
780+});
781+} catch (error) {
782+return {
783+ok: false,
784+code: "INVALID_PARAMS",
785+message: error instanceof Error ? error.message : String(error),
786+};
787+}
759788if (command === "file.fetch") {
760789const preflightDeny = await runPathPreflight({
761790 ctx,
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。