@bevel-software/platform-core-backend 0.22.0 → 0.24.0

package/dist/modules/workspace/workspace.service.js

@@ -4,17 +4,21 @@ const log = logger('workspace');
 import path from 'node:path';
 import AdmZip from 'adm-zip';
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { validateRelativePath, validateFilename, FOLDER_PLACEHOLDER, isFolderPlaceholder, entryExistsMessage, } from '@bevel-software/platform-shared';
+import { validateRelativePath, FOLDER_PLACEHOLDER, isFolderPlaceholder, entryExistsMessage, } from '@bevel-software/platform-shared';
 import { isAbsence } from '../../shared/fs.contract.js';
 import { DestinationTakenError, inspectDestination, renameNoReplace, } from '../../shared/rename-no-replace.js';
 import { NodeGitRunner } from '../workflow/git/node-git-runner.js';
 import { assertWithinDirectory } from '../../shared/path-containment.js';
 import { assertRepoRootNameFree, normalizeWorkspacePath } from '../kb-fs/repo-path.js';
 import { assertNoGitInternalsSegment, assertNotGitInternals, hasGitInternalsSegment } from '../../shared/git-internals.js';
+import { isZipNoiseEntry, readZipEntry, zipEntryName, zipEntryNameRefusal, zipEntrySegments } from './zip-entry-rules.js';
 import { GitInternalsError, PathNotFoundError, PathTraversalError, UnreadableArchiveError, WorkflowValidationError, } from '../../shared/domain-errors.js';
 import { workspaceIdForBranch, branchForWorkspaceId } from '../../shared/workspace-id.js';
 import { BranchNotFoundError, RemoteBranchGoneError, WorkflowDomainError, isMissingRemoteBranchFailure, } from '../../shared/domain-errors.js';
 import { assertValidBranchName } from '../kb-fs/branch-name.js';
+import { normalizeRepositoryAddress, sameRepository } from '../kb-fs/remote-url.js';
+import { redactSecret, urlQuerySecrets } from '../../shared/redact-secret.js';
+import { setAsideClone, setAsideRootFor, setAsideStamp } from './set-aside-clone.js';
 import { cloneCredentialArgs, cloneCredentialConfigArgs, cloneTrackingConfigArgs, SAFE_IMPLICIT_FETCH_ARGS, } from '../kb-fs/clone-config.js';
 // Zip-bomb guardrails. The upload cap is 50 MB compressed; even a generous
 // 100× expansion ratio still fits inside these limits, so a well-behaved
@@ -142,6 +146,8 @@ export class WorkspaceService {
     kb;
     disk;
     gitRunner;
+    setAsideRoot;
+    aroundSetAside;
     /** Maps branch → absolute directory path. Lazily populated. */
     branchDirs = new Map();
     /**
@@ -213,13 +219,41 @@ export class WorkspaceService {
      * runner on its default deadline and no token, for a directly
      * constructed service.
      */
-    gitRunner = new NodeGitRunner()) {
+    gitRunner = new NodeGitRunner(), 
+    /**
+     * Where a working copy of a repository that is no longer the configured
+     * one is kept. THE SAME VALUE THE KB STARTUP PHASE IS GIVEN — what the two
+     * of them move must end up in one place, and omitting it here falls back to
+     * a directory that does not survive a deployment's next recreate.
+     *
+     * Why, in one place: `setAsideRootFor` in `set-aside-clone.ts`.
+     */
+    setAsideRoot, 
+    /**
+     * What surrounds the setting aside of ONE working copy when a branch is
+     * opened and its clone turns out to be of another repository: given the
+     * workspace id and the move, it runs the move. The composition root
+     * passes what the startup phase does around its own set-asides: the
+     * commit worker held still, the copy's queued commits held back for a
+     * person, the locks on its branch dropped. If it throws, the copy stays
+     * where it was and the branch is refused with that reason. Absent, the
+     * move runs as it is.
+     */
+    aroundSetAside = (_workspaceId, move) => move()) {
         this.workspacesRoot = workspacesRoot;
         this.kb = kb;
         this.disk = disk;
         this.gitRunner = gitRunner;
+        this.setAsideRoot = setAsideRoot;
+        this.aroundSetAside = aroundSetAside;
         this.kbRepoUrl = typeof kbRepoUrl === 'function' ? kbRepoUrl : () => kbRepoUrl;
     }
+    /**
+     * The set-asides in flight, one per branch. Two callers opening the same
+     * branch both find the clone of another repository; the second waits for
+     * the first's move instead of trying to move a directory that has gone.
+     */
+    inFlightSetAsides = new Map();
     get kbDirName() {
         return this.kb.kbDirName;
     }
@@ -369,6 +403,19 @@ export class WorkspaceService {
      * a conventional default branch isn't on the remote) just to run a global op.
      * Scans disk rather than the in-memory `branchDirs` map so clones that
      * survived a process restart are still found.
+     *
+     * INTERCHANGEABLE ONLY ONCE IT CAN REACH THE REMOTE. The clone handed back
+     * is one this process may never have opened, and opening a branch is the
+     * only other place a clone's credential helper is brought into line with the
+     * deployment's (`getOrCreateForBranch`). A clone made before the helper was
+     * persisted, or before a token was configured, has none — and it is exactly
+     * the kind that sorts first on disk, because it is old. Every repo-global
+     * operation then ran its fetches in a working copy that could not
+     * authenticate: the fetch failed, quietly, and each change request whose
+     * branch that clone had never seen was reported as `unknown branch`, list
+     * after list, while the branches sat on the remote. So the helper is stamped
+     * here too, before the clone is offered. A no-op for a clone already stamped
+     * in this process, and it never throws (see `stampCredentialHelper`).
      */
     async findAnyWorkspaceId() {
         let entries;
@@ -381,13 +428,16 @@ export class WorkspaceService {
         for (const entry of entries) {
             if (!entry.isDirectory())
                 continue;
+            const repoDir = path.join(this.workspacesRoot, entry.name, this.kbDirName);
             try {
-                await fs.access(path.join(this.workspacesRoot, entry.name, this.kbDirName, '.git'));
-                return entry.name;
+                await fs.access(path.join(repoDir, '.git'));
             }
             catch {
                 // No `.git` — half-built or unrelated dir; keep looking.
+                continue;
             }
+            await this.refreshCredentialHelperIfStale(branchForWorkspaceId(entry.name), repoDir);
+            return entry.name;
         }
         return null;
     }
@@ -526,22 +576,111 @@ export class WorkspaceService {
         }
         // Check disk — the clone may have been bootstrapped by a previous
         // process and survived a restart.
-        try {
-            await fs.access(path.join(repoDir, '.git'));
-            // Migration for clones already on disk: re-stamp the tracking config the
-            // first time this process opens them, so a clone whose config drifted
-            // (duplicate fetch refspec / merge ref) is repaired before anything
-            // pulls it. Once per branch per process — the cached paths above return
-            // before reaching here.
-            await this.normalizeCloneConfig(repoDir, branch);
-            this.registerBranchDir(branch, workspaceDir);
-            return this.buildWorkspaceInfo(branch, workspaceDir);
+        const onDisk = await fs.access(path.join(repoDir, '.git')).then(() => true, () => false);
+        // A clone fetches and pushes through the address stored in its OWN
+        // `remote.origin.url`, which nothing rewrites when the configured
+        // repository changes. Adopting one of the repository that was replaced is
+        // how every later fetch answers "repository not found" — so it is set
+        // aside here and cloned fresh below, the same rule, and the same
+        // destination, as the KB startup phase applies to the whole workspaces
+        // root.
+        //
+        // SET ASIDE, never deleted. The phase sweeps only AFTER it has reached the
+        // configured remote, so that a typo in the address cannot cost anyone
+        // their work. This path has reached nothing: it is a branch being opened,
+        // and it runs in exactly the states where the address is stored but
+        // unproven — a gated boot, a break-glass start, a save that changed the
+        // address before the phase got to it. Deleting on a string difference
+        // there would throw away commits that exist nowhere else because somebody
+        // mistyped a host name.
+        //
+        // OUTSIDE the adoption `try` below, deliberately: a clone that cannot be
+        // moved must fail this call with that reason. Swallowed into "bootstrap
+        // below", it would be found again by the clone step, which sees a
+        // directory with a `.git` in it, calls that already-cloned, and hands back
+        // the very working copy this refused to adopt.
+        // Counted before the disk is looked at: the startup phase may take this
+        // very copy away while the checks below are awaited (`forgetClone`), and a
+        // copy that went must not be registered as the branch's.
+        const discardsAtAdoption = this.discardsOf(id);
+        const setAsideInFlight = this.inFlightSetAsides.get(branch);
+        if (setAsideInFlight) {
+            // Someone else is moving it. Wait, then clone below; a move that failed
+            // refuses this caller with the same reason.
+            await setAsideInFlight;
+        }
+        else if (onDisk && (await this.isCloneOfAnotherRepository(repoDir))) {
+            // Asked again: another caller may have started the move while the
+            // address was being read.
+            const startedMeanwhile = this.inFlightSetAsides.get(branch);
+            if (startedMeanwhile) {
+                await startedMeanwhile;
+            }
+            else if (this.discardsOf(id) !== discardsAtAdoption) {
+                // The copy whose address this call read is no longer there: a move
+                // began AND ended while it was being read. An in-flight entry is
+                // cleared the moment its move ends, so a caller that comes back after
+                // that finds nobody to wait for — and its answer is about a copy that
+                // has already been set aside. Acting on it would set aside whatever is
+                // at this path NOW, which is the fresh clone the first caller is in
+                // the middle of making. Nothing is left to move; the bootstrap below
+                // waits for that clone.
+            }
+            else {
+                const kept = path.join(setAsideRootFor(this.workspacesRoot, this.setAsideRoot), setAsideStamp(), id);
+                // What surrounds the move may wait, and the startup phase may set
+                // this very copy aside meanwhile. Then there is nothing left to move:
+                // the phase did it, and said so.
+                let moved = false;
+                const moving = this.aroundSetAside(id, async () => {
+                    if (this.discardsOf(id) !== discardsAtAdoption)
+                        return;
+                    await setAsideClone(repoDir, kept);
+                    moved = true;
+                    // Said the way the startup phase says it: the copy at this path was
+                    // taken away. That is what the check above reads, so every caller
+                    // that looked at the old copy before this line knows its answer is
+                    // stale, however late it comes back.
+                    this.forgetClone(id);
+                }).finally(() => {
+                    this.inFlightSetAsides.delete(branch);
+                });
+                this.inFlightSetAsides.set(branch, moving);
+                await moving;
+                if (moved) {
+                    log.warn(`the "${branch}" working copy was a clone of another repository. Set aside at ${kept}; nothing was ` +
+                        'deleted, and it is being cloned fresh from the configured one. Work that was never pushed is in ' +
+                        'that folder: `git log` there shows it.');
+                }
+            }
         }
-        catch {
-            // Not on disk — bootstrap below.
+        else if (onDisk) {
+            try {
+                // Migration for clones already on disk: re-stamp the tracking config
+                // the first time this process opens them, so a clone whose config
+                // drifted (duplicate fetch refspec / merge ref) is repaired before
+                // anything pulls it. Once per branch per process — the cached paths
+                // above return before reaching here.
+                await this.normalizeCloneConfig(repoDir, branch);
+                // Taken away meanwhile: nothing to adopt, clone below.
+                if (this.discardsOf(id) !== discardsAtAdoption)
+                    throw new Error('the working copy was set aside');
+                this.registerBranchDir(branch, workspaceDir);
+                return this.buildWorkspaceInfo(branch, workspaceDir);
+            }
+            catch {
+                // No longer worth adopting — bootstrap below.
+            }
         }
         // Single-flight bootstrap. Concurrent callers for the same branch
         // share the first one's promise instead of stacking clones.
+        //
+        // Recorded before any of it: a clone takes seconds, and the save that
+        // replaces the repository can land in the middle of one. Whatever this
+        // bootstrap produces is about the repository configured NOW, so if the
+        // working copy is taken away while it runs (`forgetClone`) the result must
+        // not be published — see `adoptBootstrapped`.
+        const discardsAtBootstrap = this.discardsOf(workspaceIdForBranch(branch));
         let resolveBootstrap;
         let rejectBootstrap;
         const bootstrap = new Promise((res, rej) => {
@@ -552,7 +691,7 @@ export class WorkspaceService {
         const existingBootstrap = this.inFlightBootstraps.get(branch);
         if (existingBootstrap) {
             await existingBootstrap;
-            this.registerBranchDir(branch, workspaceDir);
+            this.adoptBootstrapped(branch, workspaceDir, discardsAtBootstrap);
             return this.buildWorkspaceInfo(branch, workspaceDir);
         }
         this.inFlightBootstraps.set(branch, bootstrap);
@@ -566,7 +705,7 @@ export class WorkspaceService {
             // naturally; seeding the remote is the KB startup phase's job, at boot.
             createdWorkspaceDir = await fs.mkdir(workspaceDir, { recursive: true });
             await this.cloneProcessMapForBranch(workspaceDir, branch);
-            this.registerBranchDir(branch, workspaceDir);
+            this.adoptBootstrapped(branch, workspaceDir, discardsAtBootstrap);
             resolveBootstrap();
         }
         catch (err) {
@@ -611,6 +750,30 @@ export class WorkspaceService {
             kbDirName: this.kbDirName,
         };
     }
+    /**
+     * Publish a finished bootstrap's working copy to the branch→directory cache
+     * — unless the copy was taken out from under it while it ran.
+     *
+     * The save that replaces the knowledge-base repository sets every working
+     * copy aside and clears this cache (`forgetClone`), and a clone takes
+     * seconds: a bootstrap already in flight when that happens finishes
+     * afterwards, and a plain `registerBranchDir` would put the path back. The
+     * directory is gone (set aside), so every reader from then on gets an
+     * ENOENT off the fast path and nothing ever re-clones it — a cache entry
+     * is exactly what stops that.
+     *
+     * Refused rather than retried here: the address this bootstrap cloned from
+     * is not the one configured now, so there is nothing to salvage. The caller
+     * is told, and opening the branch again clones it from the new address.
+     */
+    adoptBootstrapped(branch, workspaceDir, discardsAtStart) {
+        if (this.discardsOf(workspaceIdForBranch(branch)) !== discardsAtStart) {
+            this.branchDirs.delete(branch);
+            throw new Error(`The knowledge-base repository was replaced while the "${branch}" working copy was being created, so ` +
+                'that copy was set aside instead of being used. Open it again to get one of the new repository.');
+        }
+        this.registerBranchDir(branch, workspaceDir);
+    }
     /**
      * Await the in-flight bootstrap for a branch (if any). On reject —
      * meaning the clone rolled back — drop the branch→dir mapping so the
@@ -636,6 +799,94 @@ export class WorkspaceService {
     isBootstrapInFlight(branch) {
         return this.inFlightBootstraps.has(branch);
     }
+    /**
+     * Whether the clone at `repoDir` belongs to a repository OTHER than the
+     * configured one.
+     *
+     * Errs towards NO — "could not tell" must never delete someone's work:
+     * an address that cannot be read (no `origin`, a git that would not run)
+     * leaves the clone alone, and only two addresses that are read and differ
+     * in more than their spelling count as different repositories (see
+     * `kb-fs/remote-url.ts`). An UNCONFIGURED address answers no as well: a
+     * process that does not know where the repository is has no business
+     * declaring a clone stale.
+     */
+    async isCloneOfAnotherRepository(repoDir) {
+        const configured = this.kbRepoUrl().trim();
+        if (configured === '')
+            return false;
+        let origin;
+        try {
+            const { stdout } = await this.gitRunner.run(repoDir, ['config', '--get', 'remote.origin.url']);
+            origin = stdout.trim();
+        }
+        catch {
+            return false;
+        }
+        if (origin === '' || sameRepository(origin, configured))
+            return false;
+        // Normalizing strips the userinfo but KEEPS the query string, and the
+        // knowledge-base address is one that may carry its credential there (a
+        // signed URL — see `urlQuerySecrets`). So the address is scrubbed on the
+        // way into the log, exactly as the startup phase scrubs its own.
+        log.warn(`the "${path.basename(path.dirname(repoDir))}" working copy is a clone of another repository ` +
+            `(${redactSecret(normalizeRepositoryAddress(origin), urlQuerySecrets(origin))}).`);
+        return true;
+    }
+    /**
+     * How many times each working copy has been taken out from under this
+     * process — see {@link forgetClone}. Deleting from the caches is not enough
+     * on a RUNNING server: work already in flight against the copy that went
+     * away finishes afterwards and writes its result back into those very
+     * caches. So every such reader records the count it started with and checks
+     * it before publishing: a count that moved means what it learned is about a
+     * working copy that no longer exists, and is dropped.
+     *
+     * Keyed by workspace id, which is what the phase announces and what both
+     * readers can derive (`workspaceIdForBranch`).
+     */
+    discardCount = new Map();
+    /**
+     * Both readers and `forgetClone` go through this, so a caller's spelling of
+     * a workspace id can never make them disagree about which working copy is
+     * meant: the id is taken back to its branch and spelled afresh, which is the
+     * one form the phase announces.
+     */
+    discardKey(workspaceId) {
+        return workspaceIdForBranch(branchForWorkspaceId(workspaceId));
+    }
+    discardsOf(workspaceId) {
+        return this.discardCount.get(this.discardKey(workspaceId)) ?? 0;
+    }
+    /**
+     * Forget everything this process remembers about a working copy that was
+     * taken away underneath it — the KB startup phase setting aside a clone of a
+     * repository that was replaced.
+     *
+     * At boot there is nothing to forget; this is for the save that changes the
+     * address on a RUNNING server, where `branchDirs` would otherwise keep
+     * answering with the path of a directory that is gone and no later caller
+     * would ever re-clone it. The branch NAME is deliberately left in
+     * `branchesEverHeardOf` — the branch was real, and that record outlives
+     * its clone.
+     */
+    forgetClone(workspaceId) {
+        const branch = branchForWorkspaceId(workspaceId);
+        const workspaceDir = path.join(this.workspacesRoot, workspaceId);
+        const repoDir = path.join(workspaceDir, this.kbDirName);
+        this.discardCount.set(this.discardKey(workspaceId), this.discardsOf(workspaceId) + 1);
+        this.branchDirs.delete(branch);
+        this.lastFetchAt.delete(repoDir);
+        this.lastFetchOk.delete(repoDir);
+        // Dropped as well as un-stamped: the promise still running belongs to the
+        // working copy that went away, so a caller that joined it would be told a
+        // fetch of a directory that is gone refreshed the one that replaced it.
+        // The count above is what stops that promise re-stamping the TTL when it
+        // finally settles.
+        this.inFlightFetches.delete(repoDir);
+        // Keyed by branch, not by directory — see `stampCredentialHelper`.
+        this.stampedCredentialFingerprint.delete(branch);
+    }
     /**
      * Bring an adopted clone's config back to what a fresh clone would carry.
      *
@@ -1154,14 +1405,25 @@ export class WorkspaceService {
         // This driver runs outside the git layer's per-workspace mutex, so it may
         // only run the safe implicit-fetch shape — see `SAFE_IMPLICIT_FETCH_ARGS`
         // in `kb-fs/clone-config.ts` for the full rationale.
+        // What this fetch is ABOUT: the working copy in that directory as it is
+        // now. Should the repository be replaced while the fetch runs, the copy is
+        // set aside and a fresh one is cloned to the SAME path — so stamping the
+        // result afterwards would hand the new clone a freshness it never earned
+        // (or a failure that was the old one's), and the next reader would skip
+        // refreshing it for the whole TTL.
+        const discardsAtFetch = this.discardsOf(workspaceId);
+        const stillTheSameClone = () => this.discardsOf(workspaceId) === discardsAtFetch;
         const promise = this.gitRunner
             .run(repoDir, [...SAFE_IMPLICIT_FETCH_ARGS])
             .then(() => {
+            if (!stillTheSameClone())
+                return;
             this.lastFetchAt.set(repoDir, Date.now());
             this.lastFetchOk.set(repoDir, true);
         })
             .catch((err) => {
-            this.lastFetchOk.set(repoDir, false);
+            if (stillTheSameClone())
+                this.lastFetchOk.set(repoDir, false);
             log.warn('git fetch origin failed:', { detail: redactError(err, this.gitRunner.credentials.token()) });
         })
             .finally(() => {
@@ -1544,10 +1806,10 @@ export class WorkspaceService {
      */
     async unzipFile(workspaceId, zipWsPath, destDirWsPath, 
     /**
-     * Per-extracted-path write guard (ontology-session boundary). Called with
-     * each entry's workspace-relative target before it is written; if it throws,
-     * the entry is skipped (with the thrown message as the reason) rather than
-     * aborting the whole extraction. Omitted by non-agent / human callers.
+     * Per-extracted-path write guard. Called with each entry's
+     * workspace-relative target before it is written; if it throws, the entry
+     * is skipped (with the thrown message as the reason) rather than aborting
+     * the whole extraction. Omitted by non-agent / human callers.
      */
     guardWrite) {
         const { workspaceDir, relativePath: zipRelativePath, absolutePath: zipAbsolute } = await this.resolveInsideRepo(workspaceId, zipWsPath);
@@ -1616,37 +1878,20 @@ export class WorkspaceService {
                 continue;
             }
             processedCount++;
-            const rawName = entry.entryName.replace(/\\/g, '/');
-            if (rawName.startsWith('__MACOSX/') ||
-                rawName === '__MACOSX' ||
-                rawName.endsWith('/.DS_Store') ||
-                rawName === '.DS_Store' ||
-                /(^|\/)\._/.test(rawName)) {
+            const rawName = zipEntryName(entry.entryName);
+            if (isZipNoiseEntry(rawName))
                 continue;
-            }
-            if (!rawName || rawName.startsWith('/') || /(^|\/)\.\.($|\/)/.test(rawName)) {
-                skipped.push({ path: rawName || '(empty)', reason: 'Invalid path' });
-                continue;
-            }
-            // An archive never writes into the git folder, whatever the entry's spelling.
-            if (hasGitInternalsSegment(rawName)) {
-                skipped.push({ path: rawName, reason: new GitInternalsError().message });
+            // What an entry's NAME may be — invalid path, the git folder in any
+            // spelling, a segment no filesystem keeps intact — is `zip-entry-rules`,
+            // so `apply_file_upload` judges the same names by the same rules rather
+            // than by a second copy of them.
+            const nameRefusal = zipEntryNameRefusal(rawName);
+            if (nameRefusal !== null) {
+                skipped.push({ path: rawName || '(empty)', reason: nameRefusal });
                 continue;
             }
             const trimmed = rawName.replace(/\/+$/, '');
-            const segments = trimmed.split('/').filter((s) => s.length > 0);
-            let invalidReason = null;
-            for (const segment of segments) {
-                const reason = validateFilename(segment);
-                if (reason) {
-                    invalidReason = reason;
-                    break;
-                }
-            }
-            if (invalidReason) {
-                skipped.push({ path: rawName, reason: invalidReason });
-                continue;
-            }
+            const segments = zipEntrySegments(rawName);
             const targetAbsolute = path.resolve(destAbsolute, ...segments);
             const destRoot = path.resolve(destAbsolute);
             if (targetAbsolute !== destRoot && !targetAbsolute.startsWith(destRoot + path.sep)) {
@@ -1656,10 +1901,10 @@ export class WorkspaceService {
             const relForReport = path
                 .relative(workspaceDir, targetAbsolute)
                 .replace(/\\/g, '/');
-            // Ontology-session boundary: a write-blocked (or cross-ontology) entry is
-            // skipped, not extracted, so an archive can't be a write path around it.
-            // Runs before any filesystem side effect — including directory creation —
-            // so a blocked entry leaves nothing behind on disk.
+            // An entry the write guard refuses is skipped, not extracted, so an
+            // archive can't be a way around whatever the guard enforces. Runs before
+            // any filesystem side effect — including directory creation — so a
+            // refused entry leaves nothing behind on disk.
             const allowEntry = async () => {
                 if (!guardWrite)
                     return true;
@@ -1668,7 +1913,7 @@ export class WorkspaceService {
                     return true;
                 }
                 catch (err) {
-                    skipped.push({ path: rawName, reason: err instanceof Error ? err.message : 'Blocked by the ontology-session boundary' });
+                    skipped.push({ path: rawName, reason: err instanceof Error ? err.message : 'Refused before it was written' });
                     return false;
                 }
             };
@@ -1725,14 +1970,27 @@ export class WorkspaceService {
                 });
                 continue;
             }
-            const data = entry.getData();
-            if (data.byteLength > UNZIP_MAX_ENTRY_BYTES) {
+            // Read through the one bounded reader (`readZipEntry`), never with the
+            // declared size above as the only bound: an entry that declares ZERO is
+            // inflated with no cap at all by the archive reader, so a few kilobytes
+            // could expand to whatever memory there is before the checks below ran.
+            // Capped at what is left of both limits, and a read that fails is this
+            // entry's refusal rather than the whole archive's.
+            const read = readZipEntry(entry, Math.min(UNZIP_MAX_ENTRY_BYTES, UNZIP_MAX_TOTAL_BYTES - totalUncompressed));
+            if (!read.ok && read.reason === 'unreadable') {
+                skipped.push({ path: rawName, reason: `Entry could not be read: ${read.detail}` });
+                continue;
+            }
+            if (!read.ok) {
                 skipped.push({
                     path: rawName,
-                    reason: `Entry exceeds ${UNZIP_MAX_ENTRY_BYTES} byte per-file limit`,
+                    reason: totalUncompressed + UNZIP_MAX_ENTRY_BYTES > UNZIP_MAX_TOTAL_BYTES
+                        ? `Archive exceeds ${UNZIP_MAX_TOTAL_BYTES} byte total uncompressed limit`
+                        : `Entry exceeds ${UNZIP_MAX_ENTRY_BYTES} byte per-file limit`,
                 });
                 continue;
             }
+            const data = read.data;
             if (totalUncompressed + data.byteLength > UNZIP_MAX_TOTAL_BYTES) {
                 skipped.push({
                     path: rawName,