@openclaw/openshell-sandbox 2026.9.4 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/archive-tar-stream.js

@@ -1,54 +1,86 @@
 import fs from "node:fs";
-import { Writable } from "node:stream";
-import { pipeline } from "node:stream/promises";
+import { Readable, Writable } from "node:stream";
+import { finished, pipeline } from "node:stream/promises";
 import { createGunzip } from "node:zlib";
-import { GzipInput, validateGzipContainerTail } from "./archive-gzip-tail.js";
+import { GzipInput, isGzipBuffer, validateGzipBufferTail, validateGzipContainerTail } from "./archive-gzip-tail.js";
 import { ArchiveFormatError } from "./archive-errors.js";
-import { TarParserStream } from "./archive-tar-wasm.js";
+import { TarParserStream, TarWasmSession } from "./archive-tar-wasm.js";
+import { readFileWindowFully } from "./positional-read.js";
+function* bufferChunks(buffer) {
+    for (let offset = 0; offset < buffer.length; offset += 65536)
+        yield buffer.subarray(offset, offset + 65536);
+}
 async function gzipFile(filePath) {
     const handle = await fs.promises.open(filePath, "r");
     try {
         const magic = Buffer.alloc(2);
-        const { bytesRead } = await handle.read(magic, 0, 2, 0);
-        return bytesRead === 2 && magic[0] === 31 && magic[1] === 139;
+        const bytesRead = await readFileWindowFully(handle, magic, 0);
+        return bytesRead === 2 && isGzipBuffer(magic);
     }
     finally {
         await handle.close();
     }
 }
 async function withTarStream(params, consume) {
-    const gzip = await gzipFile(params.archivePath);
-    const parser = new TarParserStream(params.limits, params.onMember);
-    const input = fs.createReadStream(params.archivePath, { highWaterMark: 65536 });
-    const decoder = gzip ? createGunzip() : undefined;
-    const gzipInput = decoder ? new GzipInput(decoder) : undefined;
-    const destroy = (error) => {
-        input.destroy(error);
-        gzipInput?.destroy(error);
-        decoder?.destroy(error);
-        parser.destroy(error);
-    };
-    const pumps = decoder && gzipInput
-        ? [pipeline(decoder, parser, { signal: params.signal }), pipeline(input, gzipInput, { signal: params.signal })]
-        : [pipeline(input, parser, { signal: params.signal })];
-    // Either pump tears down both routes; join every pump even after the first failure.
-    const settled = Promise.all(pumps.map((pump) => pump.then(() => undefined, (cause) => {
-        const error = cause instanceof Error ? cause : new Error(String(cause));
-        destroy(error);
-        return error;
-    }))).then((errors) => errors.find((error) => error !== undefined));
+    const buffer = params.archiveBuffer;
+    const kind = params.kind ?? "tar";
+    const gzip = kind === "tar" && (buffer !== undefined ? isGzipBuffer(buffer) : await gzipFile(params.archivePath));
+    const session = new TarWasmSession(params.limits);
     try {
-        const result = await consume(parser);
-        const error = await settled;
-        if (error)
-            throw error;
-        if (gzipInput)
-            await validateGzipContainerTail(params.archivePath, gzipInput.tailOffset, params.signal);
-        return result;
+        const parser = new TarParserStream(params.limits, params.onMember, session);
+        const input = buffer !== undefined
+            ? Readable.from(bufferChunks(buffer), { objectMode: false, highWaterMark: 65536 })
+            : fs.createReadStream(params.archivePath, { highWaterMark: 65536 });
+        // Match the WASM input window for both staged files and buffered reads.
+        const decoder = gzip ? createGunzip({ chunkSize: 65536 }) : undefined;
+        const gzipInput = decoder ? new GzipInput(decoder) : undefined;
+        const destroy = (error) => {
+            input.destroy(error);
+            gzipInput?.destroy(error);
+            decoder?.destroy(error);
+            parser.destroy(error);
+        };
+        // A pipeline with an async-generator stage can settle before its file's
+        // asynchronous close. Join the actual close events before freeing WASM.
+        const closed = Promise.all([input, parser, ...(decoder ? [decoder] : []), ...(gzipInput ? [gzipInput] : [])].map(stream => {
+            const closing = new Promise(resolve => { stream.once("close", resolve); });
+            return finished(stream, { cleanup: true }).then(() => undefined, (cause) => cause instanceof Error ? cause : new Error(String(cause))).then(async (error) => { await closing; return error; });
+        }));
+        const pumps = decoder && gzipInput
+            ? [pipeline(decoder, parser, { signal: params.signal }), pipeline(input, gzipInput, { signal: params.signal })]
+            : kind !== "tar"
+                ? [pipeline(input, (source) => session.decode(source, kind, params.signal), parser, { signal: params.signal })]
+                : [pipeline(input, parser, { signal: params.signal })];
+        // Either pump tears down both routes; join every pump even after the first failure.
+        const settled = Promise.all(pumps.map((pump) => pump.then(() => undefined, (cause) => {
+            const error = cause instanceof Error ? cause : new Error(String(cause));
+            destroy(error);
+            return error;
+        }))).then((errors) => errors.find((error) => error !== undefined));
+        try {
+            const result = await consume(parser);
+            const error = await settled;
+            if (error)
+                throw error;
+            const closeError = (await closed).find(error => error !== undefined);
+            if (closeError)
+                throw closeError;
+            if (gzipInput) {
+                if (buffer !== undefined)
+                    await validateGzipBufferTail(buffer, gzipInput.tailOffset, params.signal);
+                else
+                    await validateGzipContainerTail(params.archivePath, gzipInput.tailOffset, params.signal);
+            }
+            return result;
+        }
+        finally {
+            destroy();
+            await settled;
+            await closed;
+        }
     }
     finally {
-        destroy();
-        await settled;
+        session.dispose();
     }
 }
 export async function inspectTar(params) {
@@ -57,7 +89,7 @@ export async function inspectTar(params) {
     });
 }
 /** Replay in physical order, retaining at most one decoded chunk. Every range
- * comes from complete admission of the immutable staged input. */
+ * comes from complete admission of the immutable input. */
 export async function replayTar(params) {
     await withTarStream(params, async (parser) => {
         const iterator = parser[Symbol.asyncIterator]();

package/node_modules/@openclaw/fs-safe/dist/archive-tar-wasm.d.ts

@@ -1,18 +1,29 @@
 import { Transform, type TransformCallback } from "node:stream";
 import type { TarMeterLimits } from "./archive-limits.js";
-import type { TarEntryInfo } from "./archive-tar.js";
+import type { TarEntryInfo } from "./archive-plan.js";
 export type AdmittedTarMember = TarEntryInfo & {
     offset: number;
 };
-/** Backpressure-aware transport only; all TAR semantics live in the Rust core. */
-export declare class TarParserStream extends Transform {
-    private readonly onMember?;
+/** One bounded memory domain owns both admission and decompression. Its owner
+ * must join the decoder and parser before disposing this shared instance. */
+export declare class TarWasmSession {
     private abi;
-    constructor(limits: TarMeterLimits, onMember?: ((entry: AdmittedTarMember) => void) | undefined);
+    constructor(limits: TarMeterLimits);
     private bytes;
     private text;
+    parse(chunk: Buffer, onMember?: (entry: AdmittedTarMember) => void): void;
+    finish(): void;
+    private codecError;
+    decode(source: AsyncIterable<Buffer>, kind: "tar-zstd" | "tar-bzip2", signal?: AbortSignal): AsyncGenerator<Buffer>;
+    dispose(): void;
+}
+/** Backpressure-aware transport only; all TAR semantics live in the Rust core. */
+export declare class TarParserStream extends Transform {
+    private readonly onMember?;
+    private readonly session;
+    private readonly ownsSession;
+    constructor(limits: TarMeterLimits, onMember?: ((entry: AdmittedTarMember) => void) | undefined, session?: TarWasmSession);
     _transform(chunk: Buffer, _encoding: BufferEncoding, callback: TransformCallback): void;
     _flush(callback: TransformCallback): void;
     _destroy(error: Error | null, callback: (error: Error | null) => void): void;
 }
-//# sourceMappingURL=archive-tar-wasm.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-tar-wasm.js

@@ -1,6 +1,7 @@
 import { classifyArchiveParserError } from "./archive-parser-errors.js";
 import { readFileSync } from "node:fs";
 import { Transform } from "node:stream";
+import { setImmediate } from "node:timers/promises";
 import { ArchiveFormatError } from "./archive-errors.js";
 // Node exposes WebAssembly without DOM globals; keep the private ABI types local.
 const wasm = globalThis.WebAssembly;
@@ -17,23 +18,21 @@ const types = new Map([
     [51, "CharacterDevice"], [52, "BlockDevice"], [53, "Directory"],
     [54, "FIFO"], [55, "ContiguousFile"], [68, "GNUDumpDir"],
 ]);
+const utf8Decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
 function parserError(message) {
     const mapped = classifyArchiveParserError(message);
     if (mapped)
         return mapped;
     return new ArchiveFormatError(message.replace(/^archive-header-invalid:/, "invalid TAR header:"));
 }
-/** Backpressure-aware transport only; all TAR semantics live in the Rust core. */
-export class TarParserStream extends Transform {
-    onMember;
+/** One bounded memory domain owns both admission and decompression. Its owner
+ * must join the decoder and parser before disposing this shared instance. */
+export class TarWasmSession {
     abi;
-    constructor(limits, onMember) {
-        super();
-        this.onMember = onMember;
+    constructor(limits) {
         this.abi = instance();
         if (this.abi.init(limits.maxEntries, limits.maxMetaEntryBytes, limits.maxDecodedBytes, limits.maxManifestBytes, Number(process.platform === "win32")) !== 0) {
-            this.abi.dispose();
-            this.abi = undefined;
+            this.dispose();
             throw new RangeError("invalid TAR parser limits");
         }
     }
@@ -47,27 +46,135 @@ export class TarParserStream extends Transform {
     }
     text() {
         const abi = this.abi;
-        return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(this.bytes(abi.text_ptr(), abi.text_len()));
+        return utf8Decoder.decode(this.bytes(abi.text_ptr(), abi.text_len()));
     }
-    _transform(chunk, _encoding, callback) {
-        try {
-            const abi = this.abi;
-            for (let offset = 0; offset < chunk.length;) {
-                const length = Math.min(65536, chunk.length - offset);
-                this.bytes(abi.input_ptr(), length).set(chunk.subarray(offset, offset + length));
-                const used = abi.push(length);
+    parse(chunk, onMember) {
+        const abi = this.abi;
+        for (let offset = 0; offset < chunk.length; offset += 65536) {
+            const length = Math.min(65536, chunk.length - offset);
+            this.bytes(abi.input_ptr(), length).set(chunk.subarray(offset, offset + length));
+            // A member event can stop before the end of this already-copied inbox.
+            for (let consumed = 0; consumed < length;) {
+                const used = abi.push(consumed, length - consumed);
                 if (used < 0)
                     throw parserError(this.text());
-                if (used === 0 || used > length)
+                if (used === 0 || used > length - consumed)
                     throw new ArchiveFormatError("TAR WASM made no progress");
-                offset += used;
+                consumed += used;
                 const type = abi.member_type();
                 if (type >= 0)
-                    this.onMember?.({
+                    onMember?.({
                         path: this.text(), type: types.get(type) ?? "Unsupported", size: abi.member_size(),
                         mode: abi.member_mode(), offset: abi.member_offset(),
                     });
             }
+        }
+    }
+    finish() {
+        if (this.abi.finish() !== 0)
+            throw parserError(this.text());
+    }
+    codecError() {
+        const abi = this.abi;
+        return new ArchiveFormatError(utf8Decoder.decode(this.bytes(abi.codec_error_ptr(), abi.codec_error_len())));
+    }
+    async *decode(source, kind, signal) {
+        const abi = this.abi;
+        signal?.throwIfAborted();
+        if (abi.codec_init(kind === "tar-bzip2" ? 1 : 2) !== 0)
+            throw this.codecError();
+        let work = 0;
+        let calls = 0;
+        let unconsumedBoundary = false;
+        const step = (input) => {
+            signal?.throwIfAborted();
+            this.bytes(abi.codec_input_ptr(), input.length).set(input);
+            const result = abi.codec_push(input.length);
+            if (result < 0)
+                throw this.codecError();
+            const consumed = abi.codec_consumed(), produced = abi.codec_produced();
+            if (!Number.isInteger(consumed) || consumed < 0 || consumed > input.length ||
+                !Number.isInteger(produced) || produced < 0 || produced > 65536 ||
+                (result !== 0 && result !== 1) ||
+                (input.length > 0 && consumed === 0 && produced === 0 && (result !== 1 || unconsumedBoundary))) {
+                throw new ArchiveFormatError("compressed TAR WASM made no progress");
+            }
+            if (input.length > 0)
+                unconsumedBoundary = consumed === 0 && produced === 0;
+            work += consumed + produced;
+            calls++;
+            // The parser can grow this same memory, and the next codec call reuses it.
+            return { consumed, output: produced ? Buffer.from(this.bytes(abi.codec_output_ptr(), produced)) : undefined };
+        };
+        const empty = Buffer.alloc(0);
+        // Yield even for output-free skippable frames and arbitrarily small members.
+        const yieldIfNeeded = async () => {
+            if (work >= 256 * 1024 || calls >= 32) {
+                work = 0;
+                calls = 0;
+                await setImmediate(undefined, { signal });
+            }
+            signal?.throwIfAborted();
+        };
+        for await (const chunk of source) {
+            for (let offset = 0; offset < chunk.length;) {
+                const { consumed, output } = step(chunk.subarray(offset, offset + 65536));
+                offset += consumed;
+                if (output)
+                    yield output;
+                await yieldIfNeeded();
+                // A full output window can leave more decoded bytes with no new input.
+                if (output) {
+                    for (;;) {
+                        const drained = step(empty);
+                        if (drained.output)
+                            yield drained.output;
+                        await yieldIfNeeded();
+                        if (!drained.output)
+                            break;
+                    }
+                }
+            }
+        }
+        // Physical EOF, rather than a selected range or TAR EOF, ends the decoder.
+        for (;;) {
+            const drained = step(empty);
+            if (drained.output)
+                yield drained.output;
+            await yieldIfNeeded();
+            if (!drained.output)
+                break;
+        }
+        if (abi.codec_finish() !== 0)
+            throw this.codecError();
+    }
+    dispose() {
+        const abi = this.abi;
+        this.abi = undefined;
+        if (abi) {
+            try {
+                abi.codec_dispose();
+            }
+            finally {
+                abi.dispose();
+            }
+        }
+    }
+}
+/** Backpressure-aware transport only; all TAR semantics live in the Rust core. */
+export class TarParserStream extends Transform {
+    onMember;
+    session;
+    ownsSession;
+    constructor(limits, onMember, session) {
+        super();
+        this.onMember = onMember;
+        this.session = session ?? new TarWasmSession(limits);
+        this.ownsSession = session === undefined;
+    }
+    _transform(chunk, _encoding, callback) {
+        try {
+            this.session.parse(chunk, this.onMember);
             callback(null, chunk);
         }
         catch (error) {
@@ -76,8 +183,7 @@ export class TarParserStream extends Transform {
     }
     _flush(callback) {
         try {
-            if (this.abi.finish() !== 0)
-                throw parserError(this.text());
+            this.session.finish();
             callback();
         }
         catch (error) {
@@ -86,14 +192,12 @@ export class TarParserStream extends Transform {
     }
     _destroy(error, callback) {
         try {
-            this.abi?.dispose();
+            if (this.ownsSession)
+                this.session.dispose();
         }
         catch (cause) {
             error ??= cause instanceof Error ? cause : new Error(String(cause));
         }
-        finally {
-            this.abi = undefined;
-        }
         callback(error);
     }
 }

package/node_modules/@openclaw/fs-safe/dist/archive-zip-admission.d.ts

@@ -2,7 +2,6 @@ import type { ExtractionDeadline } from "./archive-deadline.js";
 import { type ResolvedArchiveExtractLimits } from "./archive-limits.js";
 import { type ZipDirectoryEntry } from "./archive-zip-directory.js";
 /** Admit physical records before a decoder can normalize or collapse names. */
-export declare function admitZipBuffer(input: Uint8Array, limits: ResolvedArchiveExtractLimits): number;
-/** The extraction input is already private and staged; read only bounded metadata. */
+export declare function admitZipBuffer(input: Uint8Array, limits: ResolvedArchiveExtractLimits, onEntry?: (entry: ZipDirectoryEntry) => void): number;
+/** The extraction input is private and immutable; read bounded metadata windows. */
 export declare function admitZipFile(archivePath: string, limits: ResolvedArchiveExtractLimits, deadline: ExtractionDeadline, onEntry?: (entry: ZipDirectoryEntry) => void): Promise<number>;
-//# sourceMappingURL=archive-zip-admission.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-zip-admission.js

@@ -12,10 +12,10 @@ function checkSize(size, limits) {
         zipFormat("invalid archive size");
 }
 /** Admit physical records before a decoder can normalize or collapse names. */
-export function admitZipBuffer(input, limits) {
+export function admitZipBuffer(input, limits, onEntry) {
     checkSize(input.byteLength, limits);
     const buffer = Buffer.from(input.buffer, input.byteOffset, input.byteLength);
-    const scan = scanZipDirectory(buffer.length, limits);
+    const scan = scanZipDirectory(buffer.length, limits, onEntry);
     let step = scan.next();
     while (!step.done) {
         const { offset, length } = step.value;
@@ -23,7 +23,9 @@ export function admitZipBuffer(input, limits) {
     }
     return step.value;
 }
-/** The extraction input is already private and staged; read only bounded metadata. */
+const METADATA_WINDOW_BYTES = 4096;
+const CACHED_READS_PER_YIELD = 32;
+/** The extraction input is private and immutable; read bounded metadata windows. */
 export async function admitZipFile(archivePath, limits, deadline, onEntry) {
     deadline.check();
     const opened = await openRootFile({
@@ -35,20 +37,54 @@ export async function admitZipFile(archivePath, limits, deadline, onEntry) {
     try {
         checkSize(opened.stat.size, limits);
         const scan = scanZipDirectory(opened.stat.size, limits, onEntry);
+        // Separate windows keep alternating central and local records hot. Never
+        // refill a buffer: the scanner can retain its views after cache eviction.
+        const windows = [];
+        let cachedReads = 0;
         let step = scan.next();
         while (!step.done) {
+            deadline.check();
             const { offset, length } = step.value;
-            const bytes = Buffer.alloc(length);
-            let received = 0;
-            while (received < length) {
-                deadline.check();
-                const count = await new Promise((resolve, reject) => {
-                    fs.read(opened.fd, bytes, received, length - received, offset + received, (error, count) => error ? reject(error) : resolve(count));
-                });
-                deadline.check();
-                if (!count)
-                    zipFormat("truncated staged record");
-                received += count;
+            const cached = windows.findIndex(window => offset >= window.offset &&
+                length <= window.bytes.length - (offset - window.offset));
+            let bytes;
+            if (cached !== -1) {
+                if (++cachedReads >= CACHED_READS_PER_YIELD) {
+                    cachedReads = 0;
+                    await new Promise(resolve => setImmediate(resolve));
+                    deadline.check();
+                }
+                const window = windows[cached];
+                if (cached === 1)
+                    windows.reverse();
+                bytes = window.bytes.subarray(offset - window.offset, offset - window.offset + length);
+            }
+            else {
+                const cacheable = length > 0 && length <= METADATA_WINDOW_BYTES;
+                const capacity = cacheable ? Math.min(METADATA_WINDOW_BYTES, opened.stat.size - offset) : length;
+                const buffer = Buffer.alloc(capacity);
+                let received = 0;
+                while (received < capacity) {
+                    deadline.check();
+                    const count = await new Promise((resolve, reject) => {
+                        fs.read(opened.fd, buffer, received, capacity - received, offset + received, (error, count) => error ? reject(error) : resolve(count));
+                    });
+                    cachedReads = 0;
+                    deadline.check();
+                    if (!count) {
+                        if (received < length)
+                            zipFormat("truncated staged record");
+                        break;
+                    }
+                    received += count;
+                }
+                const filled = buffer.subarray(0, received);
+                bytes = filled.subarray(0, length);
+                if (cacheable) {
+                    windows.unshift({ offset, bytes: filled });
+                    if (windows.length > 2)
+                        windows.pop();
+                }
             }
             step = scan.next(bytes);
         }

package/node_modules/@openclaw/fs-safe/dist/archive-zip-count.d.ts

@@ -1,2 +1 @@
 export declare function readZipCentralDirectoryEntryCount(buffer: Buffer | Uint8Array): number | null;
-//# sourceMappingURL=archive-zip-count.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-zip-count.js

@@ -1,5 +1,6 @@
 // Conservative public count hint; strict admission must not rely on its fallback.
 const ZIP_EOCD_SIGNATURE = 0x06054b50;
+const ZIP_EOCD_SIGNATURE_BYTES = Buffer.from([0x50, 0x4b, 0x05, 0x06]);
 const ZIP64_EOCD_SIGNATURE = 0x06064b50;
 const ZIP64_EOCD_LOCATOR_SIGNATURE = 0x07064b50;
 const ZIP_EOCD_MIN_BYTES = 22;
@@ -38,7 +39,26 @@ function findZipEndOfCentralDirectory(buffer) {
         return -1;
     }
     const minOffset = Math.max(0, buffer.byteLength - ZIP_EOCD_MIN_BYTES - ZIP_EOCD_MAX_COMMENT_BYTES);
-    for (let offset = buffer.byteLength - ZIP_EOCD_MIN_BYTES; offset >= minOffset; offset -= 1) {
+    const lastOffset = buffer.byteLength - ZIP_EOCD_MIN_BYTES;
+    if (buffer.readUInt32LE(lastOffset) === ZIP_EOCD_SIGNATURE &&
+        buffer.readUInt16LE(lastOffset + ZIP_EOCD_COMMENT_LENGTH_OFFSET) === 0) {
+        return lastOffset;
+    }
+    const tail = buffer.subarray(minOffset);
+    let from = lastOffset - minOffset - 1;
+    // Keep the latest valid record semantics of this count hint. Bound native
+    // searches so dense false signatures retain the byte scan's cost.
+    for (let candidates = 0; candidates < 16 && from >= 0; candidates += 1) {
+        const found = tail.lastIndexOf(ZIP_EOCD_SIGNATURE_BYTES, from);
+        if (found < 0)
+            return -1;
+        const offset = minOffset + found;
+        const commentLength = buffer.readUInt16LE(offset + ZIP_EOCD_COMMENT_LENGTH_OFFSET);
+        if (offset + ZIP_EOCD_MIN_BYTES + commentLength === buffer.byteLength)
+            return offset;
+        from = found - 1;
+    }
+    for (let offset = minOffset + from; offset >= minOffset; offset -= 1) {
         if (buffer.readUInt32LE(offset) !== ZIP_EOCD_SIGNATURE) {
             continue;
         }

package/node_modules/@openclaw/fs-safe/dist/archive-zip-directory.d.ts

@@ -1,4 +1,5 @@
 import { type ResolvedArchiveExtractLimits } from "./archive-limits.js";
+import type { ArchiveEntryKind } from "./archive-plan.js";
 export type ZipRead = {
     offset: number;
     length: number;
@@ -9,7 +10,12 @@ export type ZipDirectoryEntry = {
     creatorSystem: number;
     externalAttributes: number;
     size: number;
+    compressedSize: number;
+    compressionMethod: number;
+    crc32: number;
     path?: string;
+    portableKey: string;
+    portableDirectory: boolean;
+    kind: ArchiveEntryKind;
 };
 export declare function scanZipDirectory(size: number, limits: ResolvedArchiveExtractLimits, onEntry?: (entry: ZipDirectoryEntry) => void): ZipScan;
-//# sourceMappingURL=archive-zip-directory.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-zip-directory.js

@@ -1,5 +1,15 @@
 import { assertArchiveEntryCountWithinLimit, } from "./archive-limits.js";
 import { admitZipNames, zipExtraFields, zipFormat, zipUInt64 } from "./archive-zip-names.js";
+function entryKind(attributes, directory) {
+    const type = (attributes >>> 16) & 0o170000;
+    // High-word symlinks remain links regardless of the creator or directory bits.
+    if (type === 0o120000)
+        return "symlink";
+    if ((attributes & 0x10) || type === 0o040000 || directory)
+        return "directory";
+    // Preserve the native decoder's rejection of unrecognized link-like types.
+    return (type & 0o120000) === 0o120000 ? "other" : "file";
+}
 function* read(offset, length, bound) {
     if (!Number.isSafeInteger(offset) || !Number.isSafeInteger(length) || offset < 0 || length < 0 || length > bound - offset) {
         zipFormat("record outside archive bounds");
@@ -9,7 +19,8 @@ function* read(offset, length, bound) {
         zipFormat("truncated record");
     return bytes;
 }
-function endOffset(tail) {
+const END_SIGNATURE = Buffer.from([0x50, 0x4b, 0x05, 0x06]);
+function denseEndOffset(tail) {
     let found = -1;
     for (let offset = tail.length - 22; offset >= 0; offset--) {
         if (tail.readUInt32LE(offset) === 0x06054b50 && offset + 22 + tail.readUInt16LE(offset + 20) === tail.length) {
@@ -22,6 +33,27 @@ function endOffset(tail) {
         zipFormat("end record missing");
     return found;
 }
+function endOffset(tail) {
+    let found = -1;
+    let from = 0;
+    // Sparse signatures use native search; dense attacker-controlled markers
+    // retain the bounded byte scan instead of one native call per marker.
+    for (let candidates = 0; candidates < 16; candidates++) {
+        const offset = tail.indexOf(END_SIGNATURE, from);
+        if (offset < 0 || offset > tail.length - 22) {
+            if (found < 0)
+                zipFormat("end record missing");
+            return found;
+        }
+        if (offset + 22 + tail.readUInt16LE(offset + 20) === tail.length) {
+            if (found !== -1)
+                zipFormat("ambiguous end records");
+            found = offset;
+        }
+        from = offset + 1;
+    }
+    return denseEndOffset(tail);
+}
 function* zip64End(locator, locatorAt, size) {
     const advertised = zipUInt64(locator, 8);
     // Seek the advertised record, or the fixed ordinary record for a prefixed
@@ -193,7 +225,7 @@ export function* scanZipDirectory(size, limits, onEntry) {
         const localExtraLength = local.readUInt16LE(28);
         const localNames = yield* read(localAt + 30, localNameLength + localExtraLength, directory.start);
         const localExtra = zipExtraFields(localNames.subarray(localNameLength));
-        const entryPath = admitZipNames({ central: centralName, local: localNames.subarray(0, localNameLength), flags, centralExtra, localExtra, seen });
+        const admittedName = admitZipNames({ central: centralName, local: localNames.subarray(0, localNameLength), flags, centralExtra, localExtra, seen });
         const localValues = wideValues(local, localExtra, false);
         const crc = central.readUInt32LE(16);
         if (!(flags & 8) && (local.readUInt32LE(14) !== crc || localValues.compressed !== values.compressed || localValues.uncompressed !== values.uncompressed)) {
@@ -213,7 +245,10 @@ export function* scanZipDirectory(size, limits, onEntry) {
         spans.push({ start: localAt, end: dataEnd });
         onEntry?.({
             index: count - 1, creatorSystem: central[5], externalAttributes: central.readUInt32LE(38),
-            size: values.uncompressed, path: entryPath,
+            size: values.uncompressed, path: admittedName.path, portableKey: admittedName.portableKey,
+            compressedSize: values.compressed, compressionMethod: central.readUInt16LE(10), crc32: crc,
+            portableDirectory: admittedName.portableDirectory,
+            kind: entryKind(central.readUInt32LE(38), admittedName.directory),
         });
         at = next;
     }

package/node_modules/@openclaw/fs-safe/dist/archive-zip-entry.d.ts

@@ -1,8 +1,10 @@
-import { type ArchiveEntryModePolicy } from "./archive-policy.js";
+import { type ArchiveEntryModePolicy, type ArchiveEntryKind } from "./archive-plan.js";
+import type { ZipDirectoryEntry } from "./archive-zip-directory.js";
 export type ZipEntry = {
     name: string;
     dir: boolean;
     unixPermissions?: number | null;
+    dosPermissions?: number | null;
     _data?: {
         crc32?: number;
         uncompressedSize?: number;
@@ -10,12 +12,13 @@ export type ZipEntry = {
     nodeStream?: () => NodeJS.ReadableStream;
     async: (type: "nodebuffer") => Promise<Buffer>;
 };
+/** Internal: register only after the complete decoder/admission association. */
+export declare function registerAdmittedZipEntry(entry: ZipEntry, physical: ZipDirectoryEntry): void;
 export declare function zipEntryIntegrityMetadata(entry: ZipEntry): {
     crc32?: number;
     uncompressedSize?: number;
 } | undefined;
-export declare function hasDeferredEmptyZipData(entry: ZipEntry): boolean;
 export declare function isZipSymlinkEntry(entry: ZipEntry): boolean;
+export declare function zipEntryKind(entry: ZipEntry): ArchiveEntryKind;
 export declare function zipEntryMode(entry: ZipEntry, policy: ArchiveEntryModePolicy | undefined): number;
 export declare function zipEntryDeclaredSize(entry: ZipEntry): number;
-//# sourceMappingURL=archive-zip-entry.d.ts.map