@annals/agent-mesh 0.18.4 → 0.18.5

package/dist/index.js

@@ -125,7 +125,7 @@ var BridgeWSClient = class extends EventEmitter {
     this.opts = opts;
   }
   async connect() {
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       this.intentionalClose = false;
       this.registered = false;
       try {
@@ -143,7 +143,7 @@ var BridgeWSClient = class extends EventEmitter {
             this.registered = true;
             this.reconnectDelay = INITIAL_RECONNECT_DELAY;
             this.startHeartbeat();
-            resolve2();
+            resolve3();
           } else {
             reject(new Error(`Registration failed: ${msg.error || "unknown"}`));
           }
@@ -439,10 +439,10 @@ var FileReceiver = class {
     this.peer = new ndc.PeerConnection("receiver", {
       iceServers: ICE_SERVERS
     });
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       this.peer.onLocalDescription((sdp, type) => {
         if (type === "offer") {
-          resolve2(sdp);
+          resolve3(sdp);
         }
         this.signalCallback?.({ signal_type: type, payload: sdp });
       });
@@ -491,8 +491,8 @@ var FileReceiver = class {
     }
   }
   waitForCompletion(timeoutMs = CONNECT_TIMEOUT_MS) {
-    return new Promise((resolve2, reject) => {
-      this.resolveComplete = resolve2;
+    return new Promise((resolve3, reject) => {
+      this.resolveComplete = resolve3;
       this.rejectComplete = reject;
       setTimeout(() => {
         if (!this.closed) {
@@ -608,8 +608,8 @@ var FileUploadReceiver = class {
     }
   }
   waitForCompletion(timeoutMs = 3e4) {
-    return new Promise((resolve2, reject) => {
-      this.resolveComplete = resolve2;
+    return new Promise((resolve3, reject) => {
+      this.resolveComplete = resolve3;
       this.rejectComplete = reject;
       setTimeout(() => {
         if (!this.closed) {
@@ -672,10 +672,10 @@ var FileUploadSender = class {
     this.peer = new ndc.PeerConnection("upload-sender", {
       iceServers: ICE_SERVERS
     });
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       this.peer.onLocalDescription((sdp, type) => {
         if (type === "offer") {
-          resolve2(sdp);
+          resolve3(sdp);
         }
         this.signalCallback?.({ signal_type: type, payload: sdp });
       });
@@ -712,8 +712,8 @@ var FileUploadSender = class {
     }
   }
   waitForCompletion(timeoutMs = 3e4) {
-    return new Promise((resolve2, reject) => {
-      this.resolveComplete = resolve2;
+    return new Promise((resolve3, reject) => {
+      this.resolveComplete = resolve3;
       this.rejectComplete = reject;
       setTimeout(() => {
         if (!this.closed) {
@@ -833,7 +833,7 @@ var LocalRuntimeQueueError = class extends Error {
   }
 };
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function isProcessAlive2(pid) {
   try {
@@ -1152,14 +1152,193 @@ function createLocalRuntimeQueue(config) {
 }
 
 // src/bridge/manager.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "fs";
-import { execSync } from "child_process";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, readdirSync } from "fs";
+import { readFile as readFileAsync, writeFile as writeFileAsync, unlink, mkdir as mkdirAsync } from "fs/promises";
+import { execSync as execSync2 } from "child_process";
 import { join as join3 } from "path";
 import { homedir as homedir2 } from "os";
+
+// src/utils/zip.ts
+import { deflateRawSync, inflateRawSync } from "zlib";
+import { execSync } from "child_process";
+import { resolve, relative } from "path";
+function dosTime(date) {
+  return {
+    time: date.getHours() << 11 | date.getMinutes() << 5 | date.getSeconds() >> 1,
+    date: date.getFullYear() - 1980 << 9 | date.getMonth() + 1 << 5 | date.getDate()
+  };
+}
+function crc32(buf) {
+  let crc = 4294967295;
+  for (let i = 0; i < buf.length; i++) {
+    crc ^= buf[i];
+    for (let j = 0; j < 8; j++) {
+      crc = crc >>> 1 ^ (crc & 1 ? 3988292384 : 0);
+    }
+  }
+  return (crc ^ 4294967295) >>> 0;
+}
+function writeUint16LE(buf, val, offset) {
+  buf[offset] = val & 255;
+  buf[offset + 1] = val >>> 8 & 255;
+}
+function writeUint32LE(buf, val, offset) {
+  buf[offset] = val & 255;
+  buf[offset + 1] = val >>> 8 & 255;
+  buf[offset + 2] = val >>> 16 & 255;
+  buf[offset + 3] = val >>> 24 & 255;
+}
+function createZipBuffer(entries) {
+  const now = /* @__PURE__ */ new Date();
+  const { time, date } = dosTime(now);
+  const records = [];
+  const chunks = [];
+  let offset = 0;
+  for (const entry of entries) {
+    const nameBytes = Buffer.from(entry.path, "utf-8");
+    const crc = crc32(entry.data);
+    const compressed = deflateRawSync(entry.data, { level: 6 });
+    const compressedSize = compressed.length;
+    const uncompressedSize = entry.data.length;
+    const header = Buffer.alloc(30 + nameBytes.length);
+    writeUint32LE(header, 67324752, 0);
+    writeUint16LE(header, 20, 4);
+    writeUint16LE(header, 0, 6);
+    writeUint16LE(header, 8, 8);
+    writeUint16LE(header, time, 10);
+    writeUint16LE(header, date, 12);
+    writeUint32LE(header, crc, 14);
+    writeUint32LE(header, compressedSize, 18);
+    writeUint32LE(header, uncompressedSize, 22);
+    writeUint16LE(header, nameBytes.length, 26);
+    writeUint16LE(header, 0, 28);
+    nameBytes.copy(header, 30);
+    records.push({ header, compressed, crc, compressedSize, uncompressedSize, offset });
+    chunks.push(header, compressed);
+    offset += header.length + compressed.length;
+  }
+  const centralDirStart = offset;
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i];
+    const rec = records[i];
+    const nameBytes = Buffer.from(entry.path, "utf-8");
+    const cdh = Buffer.alloc(46 + nameBytes.length);
+    writeUint32LE(cdh, 33639248, 0);
+    writeUint16LE(cdh, 20, 4);
+    writeUint16LE(cdh, 20, 6);
+    writeUint16LE(cdh, 0, 8);
+    writeUint16LE(cdh, 8, 10);
+    writeUint16LE(cdh, time, 12);
+    writeUint16LE(cdh, date, 14);
+    writeUint32LE(cdh, rec.crc, 16);
+    writeUint32LE(cdh, rec.compressedSize, 20);
+    writeUint32LE(cdh, rec.uncompressedSize, 24);
+    writeUint16LE(cdh, nameBytes.length, 28);
+    writeUint16LE(cdh, 0, 30);
+    writeUint16LE(cdh, 0, 32);
+    writeUint16LE(cdh, 0, 34);
+    writeUint16LE(cdh, 0, 36);
+    writeUint32LE(cdh, 0, 38);
+    writeUint32LE(cdh, rec.offset, 42);
+    nameBytes.copy(cdh, 46);
+    chunks.push(cdh);
+    offset += cdh.length;
+  }
+  const centralDirSize = offset - centralDirStart;
+  const eocd = Buffer.alloc(22);
+  writeUint32LE(eocd, 101010256, 0);
+  writeUint16LE(eocd, 0, 4);
+  writeUint16LE(eocd, 0, 6);
+  writeUint16LE(eocd, entries.length, 8);
+  writeUint16LE(eocd, entries.length, 10);
+  writeUint32LE(eocd, centralDirSize, 12);
+  writeUint32LE(eocd, centralDirStart, 16);
+  writeUint16LE(eocd, 0, 20);
+  chunks.push(eocd);
+  return Buffer.concat(chunks);
+}
+function safeUnzip(zipPath, destDir) {
+  const absDestDir = resolve(destDir);
+  const listing = execSync(`unzip -l "${zipPath}"`, { encoding: "utf-8" });
+  const lines = listing.split("\n");
+  for (const line of lines) {
+    const match = line.match(/^\s*\d+\s+\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}\s+(.+)$/);
+    if (!match) continue;
+    const entryPath = match[1].trim();
+    if (!entryPath) continue;
+    if (entryPath.startsWith("/")) {
+      throw new Error(`Blocked: ZIP contains absolute path entry: ${entryPath}`);
+    }
+    if (entryPath.includes("..")) {
+      throw new Error(`Blocked: ZIP contains path traversal entry: ${entryPath}`);
+    }
+    const resolved = resolve(absDestDir, entryPath);
+    const rel = relative(absDestDir, resolved);
+    if (rel.startsWith("..") || resolve(resolved) !== resolved.replace(/\/$/, "")) {
+      if (rel.startsWith("..")) {
+        throw new Error(`Blocked: ZIP entry escapes target directory: ${entryPath}`);
+      }
+    }
+  }
+  execSync(`unzip -o -q "${zipPath}" -d "${destDir}"`);
+}
+function extractZipBuffer(buf) {
+  const entries = [];
+  let eocdOffset = -1;
+  for (let i = buf.length - 22; i >= 0; i--) {
+    if (buf.readUInt32LE(i) === 101010256) {
+      eocdOffset = i;
+      break;
+    }
+  }
+  if (eocdOffset === -1) {
+    throw new Error("Invalid ZIP: EOCD not found");
+  }
+  const entryCount = buf.readUInt16LE(eocdOffset + 10);
+  const centralDirOffset = buf.readUInt32LE(eocdOffset + 16);
+  let offset = centralDirOffset;
+  for (let i = 0; i < entryCount; i++) {
+    if (buf.readUInt32LE(offset) !== 33639248) {
+      throw new Error(`Invalid ZIP: bad central directory signature at ${offset}`);
+    }
+    const compressionMethod = buf.readUInt16LE(offset + 10);
+    const compressedSize = buf.readUInt32LE(offset + 20);
+    const uncompressedSize = buf.readUInt32LE(offset + 24);
+    const nameLen = buf.readUInt16LE(offset + 28);
+    const extraLen = buf.readUInt16LE(offset + 30);
+    const commentLen = buf.readUInt16LE(offset + 32);
+    const localHeaderOffset = buf.readUInt32LE(offset + 42);
+    const name = buf.subarray(offset + 46, offset + 46 + nameLen).toString("utf-8");
+    if (!name.endsWith("/")) {
+      const localNameLen = buf.readUInt16LE(localHeaderOffset + 26);
+      const localExtraLen = buf.readUInt16LE(localHeaderOffset + 28);
+      const dataOffset = localHeaderOffset + 30 + localNameLen + localExtraLen;
+      const compressedData = buf.subarray(dataOffset, dataOffset + compressedSize);
+      let data;
+      if (compressionMethod === 0) {
+        data = Buffer.from(compressedData);
+      } else if (compressionMethod === 8) {
+        data = inflateRawSync(compressedData);
+      } else {
+        throw new Error(`Unsupported compression method: ${compressionMethod}`);
+      }
+      if (data.length !== uncompressedSize) {
+        throw new Error(`Size mismatch for ${name}: expected ${uncompressedSize}, got ${data.length}`);
+      }
+      entries.push({ path: name, data });
+    }
+    offset += 46 + nameLen + extraLen + commentLen;
+  }
+  return entries;
+}
+
+// src/bridge/manager.ts
 var DUPLICATE_REQUEST_TTL_MS = 10 * 6e4;
 var SESSION_SWEEP_INTERVAL_MS = 6e4;
 var DEFAULT_SESSION_IDLE_TTL_MS = 10 * 6e4;
 var MIN_SESSION_IDLE_TTL_MS = 6e4;
+var TRANSFER_ACTIVE_TTL_MS = 5 * 6e4;
+var TRANSFER_DORMANT_TTL_MS = 60 * 6e4;
 function resolveSessionIdleTtlMs() {
   const raw = process.env.AGENT_BRIDGE_SESSION_IDLE_TTL_MS;
   if (!raw) {
@@ -1193,6 +1372,10 @@ var BridgeManager = class {
   pendingTransfers = /* @__PURE__ */ new Map();
   /** Pending WebRTC file uploads (caller→agent): transfer_id → FileUploadReceiver + cleanup timer */
   pendingUploads = /* @__PURE__ */ new Map();
+  /** Dormant transfers: ZIP evicted from memory, cached on disk for up to 1h */
+  dormantTransfers = /* @__PURE__ */ new Map();
+  /** Signals queued while a dormant transfer is being revived (prevents signal loss during async disk read) */
+  revivingTransfers = /* @__PURE__ */ new Map();
   constructor(opts) {
     this.wsClient = opts.wsClient;
     this.adapter = opts.adapter;
@@ -1205,6 +1388,7 @@ var BridgeManager = class {
       this.pruneIdleSessions();
     }, SESSION_SWEEP_INTERVAL_MS);
     this.cleanupTimer.unref?.();
+    void this.cleanupOrphanedTransferCache();
     log.info(`Bridge manager started with ${this.adapter.displayName} adapter`);
   }
   stop() {
@@ -1620,11 +1804,27 @@ var BridgeManager = class {
       };
       this.wsClient.send(rtcSignal);
     });
+    const zipPath = this.transferCachePath(offer.transfer_id);
+    void (async () => {
+      try {
+        await mkdirAsync(this.transferCacheDir(), { recursive: true });
+        await writeFileAsync(zipPath, zipBuffer);
+        log.debug(`ZIP cached to disk: transfer=${offer.transfer_id.slice(0, 8)}... path=${zipPath}`);
+      } catch (err) {
+        log.warn(`Failed to cache ZIP to disk: ${err}`);
+      }
+    })();
     const timer = setTimeout(() => {
       sender.close();
       this.pendingTransfers.delete(offer.transfer_id);
-      log.debug(`Transfer ${offer.transfer_id.slice(0, 8)}... expired`);
-    }, 5 * 6e4);
+      const dormantTimer = setTimeout(() => {
+        this.cleanupDormantTransfer(offer.transfer_id);
+        log.debug(`Dormant expired, disk cache removed: transfer=${offer.transfer_id.slice(0, 8)}...`);
+      }, TRANSFER_DORMANT_TTL_MS);
+      dormantTimer.unref?.();
+      this.dormantTransfers.set(offer.transfer_id, { zipPath, offer, timer: dormantTimer });
+      log.info(`Transfer transitioned to dormant: transfer=${offer.transfer_id.slice(0, 8)}...`);
+    }, TRANSFER_ACTIVE_TTL_MS);
     timer.unref?.();
     this.pendingTransfers.set(offer.transfer_id, { sender, timer });
     log.info(`WebRTC transfer registered: transfer=${offer.transfer_id.slice(0, 8)}... (${(zipBuffer.length / 1024).toFixed(1)} KB in memory)`);
@@ -1639,6 +1839,10 @@ var BridgeManager = class {
       });
       return;
     }
+    if (this.dormantTransfers.has(msg.transfer_id) || this.revivingTransfers.has(msg.transfer_id)) {
+      void this.handleDormantSignal(msg);
+      return;
+    }
     const uploadEntry = this.pendingUploads.get(msg.transfer_id);
     if (uploadEntry) {
       void uploadEntry.receiver.handleSignal({
@@ -1680,14 +1884,14 @@ var BridgeManager = class {
         const zipPath = join3(workspaceDir, ".upload.zip");
         writeFileSync2(zipPath, zipBuffer);
         try {
-          execSync(`unzip -o -q "${zipPath}" -d "${workspaceDir}"`);
+          safeUnzip(zipPath, workspaceDir);
           try {
-            execSync(`rm "${zipPath}"`);
+            execSync2(`rm "${zipPath}"`);
           } catch {
           }
           log.info(`[WebRTC] Upload: ${offer.file_count} file(s) extracted to ${workspaceDir}`);
-        } catch {
-          log.warn(`[WebRTC] Upload: Failed to extract ZIP. Saved to: ${zipPath}`);
+        } catch (unzipErr) {
+          log.warn(`[WebRTC] Upload: Failed to extract ZIP: ${unzipErr.message}. Saved to: ${zipPath}`);
         }
       } catch (err) {
         log.error(`[WebRTC] Upload extraction failed: ${err}`);
@@ -1715,6 +1919,121 @@ var BridgeManager = class {
       entry.sender.close();
     }
     this.pendingTransfers.clear();
+    for (const [id] of this.dormantTransfers) {
+      this.cleanupDormantTransfer(id);
+    }
+    this.revivingTransfers.clear();
+  }
+  // ========================================================
+  // Dormant transfer: disk cache + revival
+  // ========================================================
+  transferCacheDir() {
+    return join3(homedir2(), ".agent-mesh", "transfers");
+  }
+  transferCachePath(transferId) {
+    return join3(this.transferCacheDir(), `${transferId}.zip`);
+  }
+  cleanupDormantTransfer(transferId) {
+    const entry = this.dormantTransfers.get(transferId);
+    if (!entry) return;
+    clearTimeout(entry.timer);
+    this.dormantTransfers.delete(transferId);
+    void unlink(entry.zipPath).catch(() => {
+    });
+  }
+  async reviveDormantTransfer(dormant) {
+    const zipBuffer = await readFileAsync(dormant.zipPath);
+    if (zipBuffer.length !== dormant.offer.zip_size) {
+      throw new Error(`ZIP size mismatch: expected ${dormant.offer.zip_size}, got ${zipBuffer.length}`);
+    }
+    const sender = new FileSender(dormant.offer.transfer_id, zipBuffer);
+    sender.onSignal((signal) => {
+      const entry = this.pendingTransfers.get(dormant.offer.transfer_id);
+      if (!entry) return;
+      const rtcSignal = {
+        type: "rtc_signal",
+        transfer_id: dormant.offer.transfer_id,
+        target_agent_id: entry.targetAgentId || "",
+        signal_type: signal.signal_type,
+        payload: signal.payload
+      };
+      this.wsClient.send(rtcSignal);
+    });
+    const timer = setTimeout(() => {
+      sender.close();
+      this.pendingTransfers.delete(dormant.offer.transfer_id);
+      void unlink(dormant.zipPath).catch(() => {
+      });
+      log.debug(`Revived transfer expired: transfer=${dormant.offer.transfer_id.slice(0, 8)}...`);
+    }, TRANSFER_ACTIVE_TTL_MS);
+    timer.unref?.();
+    this.pendingTransfers.set(dormant.offer.transfer_id, { sender, timer });
+    log.info(`Revived from disk cache: transfer=${dormant.offer.transfer_id.slice(0, 8)}... (${(zipBuffer.length / 1024).toFixed(1)} KB)`);
+    return sender;
+  }
+  async handleDormantSignal(msg) {
+    const transferId = msg.transfer_id;
+    const alreadyRevived = this.pendingTransfers.get(transferId);
+    if (alreadyRevived) {
+      alreadyRevived.targetAgentId = msg.from_agent_id;
+      void alreadyRevived.sender.handleSignal({
+        signal_type: msg.signal_type,
+        payload: msg.payload
+      });
+      return;
+    }
+    const queue = this.revivingTransfers.get(transferId);
+    if (queue) {
+      queue.push(msg);
+      return;
+    }
+    const dormant = this.dormantTransfers.get(transferId);
+    if (!dormant) return;
+    this.revivingTransfers.set(transferId, []);
+    clearTimeout(dormant.timer);
+    this.dormantTransfers.delete(transferId);
+    try {
+      const sender = await this.reviveDormantTransfer(dormant);
+      const entry = this.pendingTransfers.get(transferId);
+      if (entry) {
+        entry.targetAgentId = msg.from_agent_id;
+      }
+      void sender.handleSignal({
+        signal_type: msg.signal_type,
+        payload: msg.payload
+      });
+      const queued = this.revivingTransfers.get(transferId) || [];
+      this.revivingTransfers.delete(transferId);
+      for (const queuedMsg of queued) {
+        void sender.handleSignal({
+          signal_type: queuedMsg.signal_type,
+          payload: queuedMsg.payload
+        });
+      }
+    } catch (err) {
+      log.warn(`Failed to revive dormant transfer ${transferId.slice(0, 8)}...: ${err}`);
+      this.revivingTransfers.delete(transferId);
+      void unlink(dormant.zipPath).catch(() => {
+      });
+    }
+  }
+  async cleanupOrphanedTransferCache() {
+    try {
+      const dir = this.transferCacheDir();
+      let files;
+      try {
+        files = readdirSync(dir);
+      } catch {
+        return;
+      }
+      const zipFiles = files.filter((f) => f.endsWith(".zip"));
+      if (zipFiles.length === 0) return;
+      await Promise.all(zipFiles.map((f) => unlink(join3(dir, f)).catch(() => {
+      })));
+      log.info(`Cleaned ${zipFiles.length} orphaned transfer cache file(s)`);
+    } catch (err) {
+      log.debug(`Transfer cache cleanup failed: ${err}`);
+    }
   }
   updateSessionCount() {
     this.wsClient.setActiveSessions(this.pool.size);
@@ -1729,7 +2048,7 @@ var AgentAdapter = class {
 import { spawn } from "child_process";
 
 // src/utils/sandbox.ts
-import { execSync as execSync2 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 import { join as join4 } from "path";
 var SRT_PACKAGE = "@anthropic-ai/sandbox-runtime";
 var SENSITIVE_PATHS = [
@@ -1788,7 +2107,7 @@ var sandboxManager = null;
 var sandboxInitialized = false;
 async function importSandboxManager() {
   try {
-    const globalRoot = execSync2("npm root -g", { encoding: "utf-8" }).trim();
+    const globalRoot = execSync3("npm root -g", { encoding: "utf-8" }).trim();
     const srtPath = join4(globalRoot, "@anthropic-ai/sandbox-runtime/dist/index.js");
     const mod = await import(srtPath);
     return mod.SandboxManager;
@@ -1877,7 +2196,7 @@ function buildCommandString(command, args) {
 function installSandboxRuntime() {
   log.info(`Installing ${SRT_PACKAGE}...`);
   try {
-    execSync2(`npm install -g ${SRT_PACKAGE}`, { stdio: "inherit" });
+    execSync3(`npm install -g ${SRT_PACKAGE}`, { stdio: "inherit" });
     log.success(`${SRT_PACKAGE} installed successfully`);
     return true;
   } catch {
@@ -1986,20 +2305,20 @@ function which(command) {
   if (!ALLOWED_COMMANDS.test(command)) {
     return Promise.resolve(null);
   }
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     execFile("which", [command], async (err, stdout) => {
       if (!err && stdout.trim()) {
-        resolve2(stdout.trim());
+        resolve3(stdout.trim());
         return;
       }
-      resolve2(await resolveFallbackPath(command));
+      resolve3(await resolveFallbackPath(command));
     });
   });
 }
 
 // src/utils/client-workspace.ts
-import { mkdirSync as mkdirSync4, readdirSync, symlinkSync, existsSync as existsSync3, lstatSync } from "fs";
-import { join as join5, relative } from "path";
+import { mkdirSync as mkdirSync4, readdirSync as readdirSync2, symlinkSync, existsSync as existsSync3, lstatSync } from "fs";
+import { join as join5, relative as relative2 } from "path";
 var SYMLINK_ALLOW = /* @__PURE__ */ new Set([
   "CLAUDE.md",
   ".claude",
@@ -2031,7 +2350,7 @@ function createClientWorkspace(projectPath, clientId) {
   const wsDir = join5(projectPath, ".bridge-clients", clientId);
   const isNew = !existsSync3(wsDir);
   mkdirSync4(wsDir, { recursive: true });
-  const entries = readdirSync(projectPath, { withFileTypes: true });
+  const entries = readdirSync2(projectPath, { withFileTypes: true });
   for (const entry of entries) {
     if (!shouldInclude(entry.name)) continue;
     const link = join5(wsDir, entry.name);
@@ -2041,7 +2360,7 @@ function createClientWorkspace(projectPath, clientId) {
     } catch {
     }
     const target = join5(projectPath, entry.name);
-    const relTarget = relative(wsDir, target);
+    const relTarget = relative2(wsDir, target);
     try {
       symlinkSync(relTarget, link);
     } catch (err) {
@@ -2056,11 +2375,11 @@ function createClientWorkspace(projectPath, clientId) {
 
 // src/adapters/claude.ts
 import { writeFile, mkdir, stat as stat2 } from "fs/promises";
-import { join as join7, relative as relative3, basename } from "path";
+import { join as join7, relative as relative4, basename } from "path";
 
 // src/utils/auto-upload.ts
 import { readdir, readFile, stat } from "fs/promises";
-import { join as join6, relative as relative2 } from "path";
+import { join as join6, relative as relative3 } from "path";
 var MAX_AUTO_UPLOAD_FILE_SIZE = 10 * 1024 * 1024;
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
@@ -2116,153 +2435,6 @@ async function collectRealFiles(dir, maxFiles = Infinity) {
   return files;
 }
 
-// src/utils/zip.ts
-import { deflateRawSync, inflateRawSync } from "zlib";
-function dosTime(date) {
-  return {
-    time: date.getHours() << 11 | date.getMinutes() << 5 | date.getSeconds() >> 1,
-    date: date.getFullYear() - 1980 << 9 | date.getMonth() + 1 << 5 | date.getDate()
-  };
-}
-function crc32(buf) {
-  let crc = 4294967295;
-  for (let i = 0; i < buf.length; i++) {
-    crc ^= buf[i];
-    for (let j = 0; j < 8; j++) {
-      crc = crc >>> 1 ^ (crc & 1 ? 3988292384 : 0);
-    }
-  }
-  return (crc ^ 4294967295) >>> 0;
-}
-function writeUint16LE(buf, val, offset) {
-  buf[offset] = val & 255;
-  buf[offset + 1] = val >>> 8 & 255;
-}
-function writeUint32LE(buf, val, offset) {
-  buf[offset] = val & 255;
-  buf[offset + 1] = val >>> 8 & 255;
-  buf[offset + 2] = val >>> 16 & 255;
-  buf[offset + 3] = val >>> 24 & 255;
-}
-function createZipBuffer(entries) {
-  const now = /* @__PURE__ */ new Date();
-  const { time, date } = dosTime(now);
-  const records = [];
-  const chunks = [];
-  let offset = 0;
-  for (const entry of entries) {
-    const nameBytes = Buffer.from(entry.path, "utf-8");
-    const crc = crc32(entry.data);
-    const compressed = deflateRawSync(entry.data, { level: 6 });
-    const compressedSize = compressed.length;
-    const uncompressedSize = entry.data.length;
-    const header = Buffer.alloc(30 + nameBytes.length);
-    writeUint32LE(header, 67324752, 0);
-    writeUint16LE(header, 20, 4);
-    writeUint16LE(header, 0, 6);
-    writeUint16LE(header, 8, 8);
-    writeUint16LE(header, time, 10);
-    writeUint16LE(header, date, 12);
-    writeUint32LE(header, crc, 14);
-    writeUint32LE(header, compressedSize, 18);
-    writeUint32LE(header, uncompressedSize, 22);
-    writeUint16LE(header, nameBytes.length, 26);
-    writeUint16LE(header, 0, 28);
-    nameBytes.copy(header, 30);
-    records.push({ header, compressed, crc, compressedSize, uncompressedSize, offset });
-    chunks.push(header, compressed);
-    offset += header.length + compressed.length;
-  }
-  const centralDirStart = offset;
-  for (let i = 0; i < entries.length; i++) {
-    const entry = entries[i];
-    const rec = records[i];
-    const nameBytes = Buffer.from(entry.path, "utf-8");
-    const cdh = Buffer.alloc(46 + nameBytes.length);
-    writeUint32LE(cdh, 33639248, 0);
-    writeUint16LE(cdh, 20, 4);
-    writeUint16LE(cdh, 20, 6);
-    writeUint16LE(cdh, 0, 8);
-    writeUint16LE(cdh, 8, 10);
-    writeUint16LE(cdh, time, 12);
-    writeUint16LE(cdh, date, 14);
-    writeUint32LE(cdh, rec.crc, 16);
-    writeUint32LE(cdh, rec.compressedSize, 20);
-    writeUint32LE(cdh, rec.uncompressedSize, 24);
-    writeUint16LE(cdh, nameBytes.length, 28);
-    writeUint16LE(cdh, 0, 30);
-    writeUint16LE(cdh, 0, 32);
-    writeUint16LE(cdh, 0, 34);
-    writeUint16LE(cdh, 0, 36);
-    writeUint32LE(cdh, 0, 38);
-    writeUint32LE(cdh, rec.offset, 42);
-    nameBytes.copy(cdh, 46);
-    chunks.push(cdh);
-    offset += cdh.length;
-  }
-  const centralDirSize = offset - centralDirStart;
-  const eocd = Buffer.alloc(22);
-  writeUint32LE(eocd, 101010256, 0);
-  writeUint16LE(eocd, 0, 4);
-  writeUint16LE(eocd, 0, 6);
-  writeUint16LE(eocd, entries.length, 8);
-  writeUint16LE(eocd, entries.length, 10);
-  writeUint32LE(eocd, centralDirSize, 12);
-  writeUint32LE(eocd, centralDirStart, 16);
-  writeUint16LE(eocd, 0, 20);
-  chunks.push(eocd);
-  return Buffer.concat(chunks);
-}
-function extractZipBuffer(buf) {
-  const entries = [];
-  let eocdOffset = -1;
-  for (let i = buf.length - 22; i >= 0; i--) {
-    if (buf.readUInt32LE(i) === 101010256) {
-      eocdOffset = i;
-      break;
-    }
-  }
-  if (eocdOffset === -1) {
-    throw new Error("Invalid ZIP: EOCD not found");
-  }
-  const entryCount = buf.readUInt16LE(eocdOffset + 10);
-  const centralDirOffset = buf.readUInt32LE(eocdOffset + 16);
-  let offset = centralDirOffset;
-  for (let i = 0; i < entryCount; i++) {
-    if (buf.readUInt32LE(offset) !== 33639248) {
-      throw new Error(`Invalid ZIP: bad central directory signature at ${offset}`);
-    }
-    const compressionMethod = buf.readUInt16LE(offset + 10);
-    const compressedSize = buf.readUInt32LE(offset + 20);
-    const uncompressedSize = buf.readUInt32LE(offset + 24);
-    const nameLen = buf.readUInt16LE(offset + 28);
-    const extraLen = buf.readUInt16LE(offset + 30);
-    const commentLen = buf.readUInt16LE(offset + 32);
-    const localHeaderOffset = buf.readUInt32LE(offset + 42);
-    const name = buf.subarray(offset + 46, offset + 46 + nameLen).toString("utf-8");
-    if (!name.endsWith("/")) {
-      const localNameLen = buf.readUInt16LE(localHeaderOffset + 26);
-      const localExtraLen = buf.readUInt16LE(localHeaderOffset + 28);
-      const dataOffset = localHeaderOffset + 30 + localNameLen + localExtraLen;
-      const compressedData = buf.subarray(dataOffset, dataOffset + compressedSize);
-      let data;
-      if (compressionMethod === 0) {
-        data = Buffer.from(compressedData);
-      } else if (compressionMethod === 8) {
-        data = inflateRawSync(compressedData);
-      } else {
-        throw new Error(`Unsupported compression method: ${compressionMethod}`);
-      }
-      if (data.length !== uncompressedSize) {
-        throw new Error(`Size mismatch for ${name}: expected ${uncompressedSize}, got ${data.length}`);
-      }
-      entries.push({ path: name, data });
-    }
-    offset += 46 + nameLen + extraLen + commentLen;
-  }
-  return entries;
-}
-
 // src/adapters/claude.ts
 var DEFAULT_IDLE_TIMEOUT = 30 * 60 * 1e3;
 var MIN_IDLE_TIMEOUT = 60 * 1e3;
@@ -2425,7 +2597,7 @@ var ClaudeSession = class {
     const entries = [];
     let totalBytes = 0;
     for (const absPath of files) {
-      const relPath = relative3(workspaceRoot, absPath).replace(/\\/g, "/");
+      const relPath = relative4(workspaceRoot, absPath).replace(/\\/g, "/");
       if (!relPath || relPath.startsWith("..")) continue;
       try {
         const fileStat = await stat2(absPath);
@@ -2714,7 +2886,7 @@ function logWorkspaceHint(slug, projectPath) {
   console.log(`  ${GRAY}${getWorkspaceHint()}${RESET}`);
 }
 function sleep2(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function createAdapter(type, config) {
   switch (type) {
@@ -2985,7 +3157,7 @@ async function pollForToken(baseUrl, deviceCode, expiresIn, interval) {
   const deadline = Date.now() + expiresIn * 1e3;
   let pollMs = Math.max(interval * 1e3, POLL_INTERVAL_MS);
   while (Date.now() < deadline) {
-    await new Promise((resolve2) => setTimeout(resolve2, pollMs));
+    await new Promise((resolve3) => setTimeout(resolve3, pollMs));
     const res = await fetch(`${baseUrl}/api/auth/device/token`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -3112,7 +3284,7 @@ function registerStatusCommand(program2) {
 
 // src/commands/start.ts
 function sleep3(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function registerStartCommand(program2) {
   program2.command("start [name]").description("Start agent(s) in the background").option("--all", "Start all registered agents").action(async (name, opts) => {
@@ -3207,7 +3379,7 @@ function registerStopCommand(program2) {
 
 // src/commands/restart.ts
 function sleep4(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function registerRestartCommand(program2) {
   program2.command("restart [name]").description("Restart agent(s)").option("--all", "Restart all registered agents").action(async (name, opts) => {
@@ -3294,10 +3466,10 @@ import { createInterface as createInterface2 } from "readline";
 import { unlinkSync } from "fs";
 function confirm(prompt) {
   const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     rl.question(prompt, (answer) => {
       rl.close();
-      resolve2(answer.trim().toLowerCase() === "y");
+      resolve3(answer.trim().toLowerCase() === "y");
     });
   });
 }
@@ -3350,7 +3522,7 @@ function registerOpenCommand(program2) {
 import { writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync as mkdirSync5 } from "fs";
 import { join as join8 } from "path";
 import { homedir as homedir5 } from "os";
-import { execSync as execSync3 } from "child_process";
+import { execSync as execSync4 } from "child_process";
 var LABEL = "com.agents-hot.agent-mesh";
 var PLIST_DIR = join8(homedir5(), "Library", "LaunchAgents");
 var PLIST_PATH = join8(PLIST_DIR, `${LABEL}.plist`);
@@ -3416,17 +3588,17 @@ function registerInstallCommand(program2) {
     }
     if (existsSync5(PLIST_PATH)) {
       try {
-        execSync3(`launchctl bootout gui/$(id -u) "${PLIST_PATH}" 2>/dev/null`, { stdio: "ignore" });
+        execSync4(`launchctl bootout gui/$(id -u) "${PLIST_PATH}" 2>/dev/null`, { stdio: "ignore" });
       } catch {
       }
     }
     const plist = generatePlist(node, script);
     writeFileSync3(PLIST_PATH, plist, { encoding: "utf-8" });
     try {
-      execSync3(`launchctl bootstrap gui/$(id -u) "${PLIST_PATH}"`, { stdio: "pipe" });
+      execSync4(`launchctl bootstrap gui/$(id -u) "${PLIST_PATH}"`, { stdio: "pipe" });
     } catch {
       try {
-        execSync3(`launchctl load "${PLIST_PATH}"`, { stdio: "pipe" });
+        execSync4(`launchctl load "${PLIST_PATH}"`, { stdio: "pipe" });
       } catch (err) {
         log.error(`Failed to load LaunchAgent: ${err}`);
         log.info(`Plist written to ${PLIST_PATH} \u2014 you can load it manually.`);
@@ -3450,7 +3622,7 @@ function registerInstallCommand(program2) {
 import { existsSync as existsSync6, unlinkSync as unlinkSync2 } from "fs";
 import { join as join9 } from "path";
 import { homedir as homedir6 } from "os";
-import { execSync as execSync4 } from "child_process";
+import { execSync as execSync5 } from "child_process";
 var LABEL2 = "com.agents-hot.agent-mesh";
 var PLIST_PATH2 = join9(homedir6(), "Library", "LaunchAgents", `${LABEL2}.plist`);
 function registerUninstallCommand(program2) {
@@ -3466,10 +3638,10 @@ function registerUninstallCommand(program2) {
       return;
     }
     try {
-      execSync4(`launchctl bootout gui/$(id -u) "${PLIST_PATH2}" 2>/dev/null`, { stdio: "ignore" });
+      execSync5(`launchctl bootout gui/$(id -u) "${PLIST_PATH2}" 2>/dev/null`, { stdio: "ignore" });
     } catch {
       try {
-        execSync4(`launchctl unload "${PLIST_PATH2}" 2>/dev/null`, { stdio: "ignore" });
+        execSync5(`launchctl unload "${PLIST_PATH2}" 2>/dev/null`, { stdio: "ignore" });
       } catch {
       }
     }
@@ -3670,10 +3842,10 @@ function parseVisibilityOrExit(input) {
 }
 function readLine(prompt) {
   const rl = createInterface3({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     rl.question(prompt, (answer) => {
       rl.close();
-      resolve2(answer.trim());
+      resolve3(answer.trim());
     });
   });
 }
@@ -3866,7 +4038,7 @@ function registerAgentsCommand(program2) {
 import { createInterface as createInterface4 } from "readline";
 import { existsSync as existsSync7, readFileSync as readFileSync2, mkdirSync as mkdirSync6, copyFileSync as copyFileSync2 } from "fs";
 import { basename as basename2, join as join10 } from "path";
-import { execSync as execSync5 } from "child_process";
+import { execSync as execSync6 } from "child_process";
 import { createHash as createHash2, randomUUID } from "crypto";
 import { tmpdir } from "os";
 
@@ -3898,10 +4070,10 @@ function prepareUploadFile(filePath) {
   const tempFile = join10(tempDir, fileName);
   copyFileSync2(filePath, tempFile);
   const zipPath = join10(tempDir, "upload.zip");
-  execSync5(`cd "${tempDir}" && zip -q "${zipPath}" "${fileName}"`);
+  execSync6(`cd "${tempDir}" && zip -q "${zipPath}" "${fileName}"`);
   const zipBuffer = readFileSync2(zipPath);
   try {
-    execSync5(`rm -rf "${tempDir}"`);
+    execSync6(`rm -rf "${tempDir}"`);
   } catch {
   }
   const zipSha256 = createHash2("sha256").update(zipBuffer).digest("hex");
@@ -3917,7 +4089,7 @@ function prepareUploadFile(filePath) {
   };
 }
 function sleep5(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function chatWebrtcUpload(agentId, offer, zipBuffer, token, baseUrl) {
   log.info(`[WebRTC] Uploading file (${(offer.zip_size / 1024).toFixed(1)} KB)...`);
@@ -4276,8 +4448,8 @@ function registerChatCommand(program2) {
 }
 
 // src/commands/skills.ts
-import { readFile as readFile3, writeFile as writeFile3, readdir as readdir2, mkdir as mkdir2, rm, symlink, unlink } from "fs/promises";
-import { join as join12, resolve, relative as relative4 } from "path";
+import { readFile as readFile3, writeFile as writeFile3, readdir as readdir2, mkdir as mkdir2, rm, symlink, unlink as unlink2 } from "fs/promises";
+import { join as join12, resolve as resolve2, relative as relative5 } from "path";
 
 // src/utils/skill-parser.ts
 import { readFile as readFile2, writeFile as writeFile2, stat as stat3 } from "fs/promises";
@@ -4451,7 +4623,7 @@ function outputError(error, message, hint) {
   process.exit(1);
 }
 function resolveSkillDir(pathArg) {
-  return pathArg ? resolve(pathArg) : process.cwd();
+  return pathArg ? resolve2(pathArg) : process.cwd();
 }
 function parseSkillRef(ref) {
   if (!ref.includes("/")) {
@@ -4467,7 +4639,7 @@ function skillApiPath(authorLogin, slug) {
   return `/api/skills/${encodeURIComponent(authorLogin)}/${encodeURIComponent(slug)}`;
 }
 async function resolveSkillsRootAsync(pathArg) {
-  const projectRoot = pathArg ? resolve(pathArg) : process.cwd();
+  const projectRoot = pathArg ? resolve2(pathArg) : process.cwd();
   const skillsDir = join12(projectRoot, ".agents", "skills");
   const claudeSkillsDir = join12(projectRoot, ".claude", "skills");
   return { projectRoot, skillsDir, claudeSkillsDir };
@@ -4476,7 +4648,7 @@ async function ensureClaudeSymlink(claudeSkillsDir, slug) {
   await mkdir2(claudeSkillsDir, { recursive: true });
   const linkPath = join12(claudeSkillsDir, slug);
   try {
-    await unlink(linkPath);
+    await unlink2(linkPath);
   } catch {
   }
   try {
@@ -4489,7 +4661,7 @@ async function collectPackFiles(dir, manifest) {
   const results = [];
   const all = await walkDir(dir);
   for (const f of all) {
-    const rel = relative4(dir, f);
+    const rel = relative5(dir, f);
     results.push(rel);
   }
   const mainFile = manifest.main || "SKILL.md";
@@ -4963,7 +5135,7 @@ function registerSkillsCommand(program2) {
       }
       await rm(targetDir, { recursive: true, force: true });
       try {
-        await unlink(join12(claudeSkillsDir, slug));
+        await unlink2(join12(claudeSkillsDir, slug));
       } catch {
       }
       slog.success(`Removed skill: ${slug}`);
@@ -5101,7 +5273,7 @@ function registerDiscoverCommand(program2) {
 
 // src/commands/call.ts
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync4, mkdirSync as mkdirSync7, copyFileSync as copyFileSync3, existsSync as existsSync8 } from "fs";
-import { execSync as execSync6 } from "child_process";
+import { execSync as execSync7 } from "child_process";
 import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
 import { join as join13, basename as basename3 } from "path";
 import { tmpdir as tmpdir2 } from "os";
@@ -5126,7 +5298,7 @@ async function submitRating(baseUrl, token, agentId, callId, rating) {
   }
 }
 function sleep6(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function handleError2(err) {
   if (err instanceof PlatformApiError) {
@@ -5201,13 +5373,13 @@ async function webrtcDownload(agentId, offer, token, outputDir, json) {
     const zipPath = join13(outputDir, ".transfer.zip");
     writeFileSync4(zipPath, zipBuffer);
     try {
-      execSync6(`unzip -o -q "${zipPath}" -d "${outputDir}"`);
+      safeUnzip(zipPath, outputDir);
       try {
-        execSync6(`rm "${zipPath}"`);
+        execSync7(`rm "${zipPath}"`);
       } catch {
       }
-    } catch {
-      log.warn(`Failed to extract ZIP. Saved to: ${zipPath}`);
+    } catch (unzipErr) {
+      log.warn(`Failed to extract ZIP: ${unzipErr.message}. Saved to: ${zipPath}`);
       return;
     }
     if (json) {
@@ -5239,10 +5411,10 @@ function prepareFileForUpload(filePath) {
   const tempFile = join13(tempDir, fileName);
   copyFileSync3(filePath, tempFile);
   const zipPath = join13(tempDir, "upload.zip");
-  execSync6(`cd "${tempDir}" && zip -q "${zipPath}" "${fileName}"`);
+  execSync7(`cd "${tempDir}" && zip -q "${zipPath}" "${fileName}"`);
   const zipBuffer = readFileSync3(zipPath);
   try {
-    execSync6(`rm -rf "${tempDir}"`);
+    execSync7(`rm -rf "${tempDir}"`);
   } catch {
   }
   const zipSha256 = createHash3("sha256").update(zipBuffer).digest("hex");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@annals/agent-mesh",
-  "version": "0.18.4",
+  "version": "0.18.5",
   "description": "CLI bridge connecting local AI agents to the Agents.Hot platform",
   "type": "module",
   "bin": {