fix: prevent bundled fallback from overwriting partial remote seeds

When seedFromRemote partially fails, the bundled fallback now skips
skills already in the manifest (installed by the partial remote
seed). Also adds Content-Length early check before downloading the
full catalog response body.

Author: shivammittal274

packages/browseros-agent/apps/server/src/skills/remote-sync.ts

@@ -91,6 +91,13 @@ export async function fetchRemoteCatalog(): Promise<RemoteSkillCatalog | null> {
       })
       return null
     }
+    const contentLength = Number(response.headers.get('content-length') ?? 0)
+    if (contentLength > SKILLS_LIMITS.MAX_CATALOG_BYTES) {
+      logger.warn('Remote skill catalog Content-Length too large', {
+        contentLength,
+      })
+      return null
+    }
     const text = await response.text()
     if (text.length > SKILLS_LIMITS.MAX_CATALOG_BYTES) {
       logger.warn('Remote skill catalog response too large', {

packages/browseros-agent/apps/server/src/skills/seed.ts

@@ -32,6 +32,7 @@ export async function seedDefaultSkills(): Promise<void> {
   let seeded = 0
 
   for (const skill of DEFAULT_SKILLS) {
+    if (manifest.skills[skill.id]) continue
     try {
       const version = extractVersion(skill.content)
       await writeSkillFile(skill.id, skill.content)