TencentCloud/TencentDB-Agent-Memory · error

invalid team_id for template path: ${teamId}

Error message

invalid team_id for template path: ${teamId}

What it means

templateFilePath builds the on-disk path .../<instanceId>/<teamId>/template.json. Before joining it validates teamId with /[/\\]|\.\./ — any path separator or parent-directory sequence is rejected to prevent path traversal (e.g. '../../etc' or 'a/b') escaping the templates directory. The error is thrown before any file I/O occurs.

Source

Thrown at MemoryPanel/src/panel/state/agent-template-store.ts:30

export interface AgentTemplateAssetIds {
  skills?: string[];
  code_graphs?: string[];
  wikis?: string[];
}

/** 模板配置（= JSON 文件内容，对齐 agent/create 入参）。 */
export interface AgentTemplateConfig {
  name: string;
  description?: string | null;
  prompt?: string | null;
  visibility?: string;
  metadata_json?: string;
  asset_ids?: AgentTemplateAssetIds;
}

function templateFilePath(dir: string, instanceId: string, teamId: string): string {
  if (/[/\\]|\.\./.test(teamId)) {
    throw new Error(`invalid team_id for template path: ${teamId}`);
  }
  return path.join(dir, instanceId, teamId, 'template.json');
}

export function saveAgentTemplate(
  dir: string,
  instanceId: string,
  teamId: string,
  config: AgentTemplateConfig,
): void {
  const filePath = templateFilePath(dir, instanceId, teamId);
  mkdirSync(path.dirname(filePath), { recursive: true });
  writeFileSync(filePath, JSON.stringify(config, null, 2), 'utf8');
}

export function getAgentTemplate(
  dir: string,
  instanceId: string,

View on GitHub (pinned to 3efcd317b8)

Solutions

1. Sanitize/validate team_id upstream: reject or normalize any value containing path separators or '..'
2. Map composite identifiers to a safe slug (e.g. replace '/' and '\\' with '-') before calling the store
3. Surface a clear validation error to the user instead of this internal path error
4. Regenerate legacy team IDs to a safe charset ([A-Za-z0-9_-]) and migrate stored templates

Example fix

// before
await saveAgentTemplate(dir, instanceId, rawTeamId, template); // rawTeamId = 'org/team'
// after
const safeTeamId = rawTeamId.replace(/[^A-Za-z0-9_-]/g, '-');
await saveAgentTemplate(dir, instanceId, safeTeamId, template);

function assertSafeTeamId(teamId: string): void {
  if (!/^[A-Za-z0-9_-]+$/.test(teamId)) throw new Error(`unsafe team_id: ${teamId}`);
}
assertSafeTeamId(teamId); // call before saveAgentTemplate/loadAgentTemplate

function isSafeTeamId(teamId: string): boolean {
  return /^[A-Za-z0-9_-]+$/.test(teamId) && !teamId.includes('..');
}

try {
  return loadAgentTemplate(dir, instanceId, teamId);
} catch (e) {
  if (e instanceof Error && e.message.startsWith('invalid team_id')) {
    throw new ValidationError(`team_id must not contain path separators or '..': ${teamId}`);
  }
  throw e;
}

When it happens

Trigger: Calling saveAgentTemplate / loadAgentTemplate (via filePath → templateFilePath) with a team_id containing '/' or '\\', or the literal '..' — typically an unsanitized user-supplied or externally-sourced team identifier.

Common situations: Importing team templates from untrusted JSON where team_id was never validated; legacy data with composite IDs like 'org/team'; users typing IDs with slashes in a UI.

Related errors

• Path traversal rejected in scoped storage key: ${key}
• Storage key must be relative, got absolute: ${key}
• Path traversal rejected: key "${key}" escapes rootDir
• Invalid generation log key
• memory 系统用户 key 必须匹配 sk-mem-[A-Za-z0-9_-]{32}

AI-assisted analysis of TencentCloud/TencentDB-Agent-Memory@3efcd317b8 (2026-09-01). Data as JSON: /api/errors/0afe0f5406f1534f. Report an issue: GitHub.