@schlessera/brain-ui-server 0.28.1 → 0.29.0

package/dist/skills/install.d.ts

@@ -12,8 +12,10 @@
  *   `..`, absolute path, backslash, or NUL rejects the archive; files are
  *   written only under `.agents/skills/<name>/`, staged then swapped so a
  *   half-written skill is never discoverable.
- * - Caps: archive ≤ 20 MB compressed, ≤ 50 MB inflated, ≤ 400 files per
- *   skill, per-file ≤ 10 MB.
+ * - Caps: archive ≤ 100 MB compressed, ≤ 250 MB inflated, ≤ 400 files per
+ *   skill, per-file ≤ 10 MB. The inflated and per-file caps are enforced
+ *   DURING decompression (streaming), so a zip bomb aborts at the cap
+ *   instead of inflating fully into memory first.
  * - Conflicts are SKIPPED by default and reported; `overwrite: true` may
  *   replace an existing CUSTOM skill (enabled or disabled) but can never
  *   touch a package skill — those are symlinks and stay refused.
@@ -39,6 +41,17 @@ export interface InstallOptions {
 export interface InstallDeps {
     brainPath: string;
 }
+export interface UnzipCaps {
+    maxFileBytes: number;
+    maxInflatedBytes: number;
+}
+/**
+ * Streaming unzip with the size caps enforced as bytes decompress. unzipSync
+ * would inflate the whole archive before any check could run — exactly the
+ * zip-bomb window the caps exist to close. Caps are injectable for tests;
+ * production uses the module constants.
+ */
+export declare function unzipWithCaps(archive: Uint8Array, caps?: UnzipCaps): Record<string, Uint8Array>;
 /**
  * The shared core: install every skill found among already-unzipped entries.
  * Throws InstallError for archive-level problems; per-skill problems land as

package/dist/skills/install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/skills/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAClD,eAAO,MAAM,kBAAkB,QAAmB,CAAC;AACnD,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,cAAc,QAAmB,CAAC;AAI/C,qBAAa,YAAa,SAAQ,KAAK;CAAG;AAE1C,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAmBD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EACnC,IAAI,GAAE,cAAmB,GACxB,cAAc,EAAE,CAyDlB;AA2ED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,UAAU,EACnB,IAAI,GAAE,cAAmB,GACxB,cAAc,EAAE,CAalB;AAMD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAqBpE;AAED,gEAAgE;AAChE,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACpE,OAAO,CAAC,cAAc,EAAE,CAAC,CA8C3B"}
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/skills/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH,eAAO,MAAM,iBAAiB,QAAoB,CAAC;AACnD,eAAO,MAAM,kBAAkB,QAAoB,CAAC;AACpD,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,cAAc,QAAmB,CAAC;AAI/C,qBAAa,YAAa,SAAQ,KAAK;CAAG;AAE1C,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AA6BD,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,UAAU,EACnB,IAAI,GAAE,SAAkF,GACvF,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CA2C5B;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EACnC,IAAI,GAAE,cAAmB,GACxB,cAAc,EAAE,CAyDlB;AA2ED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,UAAU,EACnB,IAAI,GAAE,cAAmB,GACxB,cAAc,EAAE,CAKlB;AAMD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAqBpE;AAED,gEAAgE;AAChE,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AA2B7E;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,YAAY,EACpB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACpE,OAAO,CAAC,cAAc,EAAE,CAAC,CAmC3B"}

package/dist/skills/install.js

@@ -12,18 +12,20 @@
  *   `..`, absolute path, backslash, or NUL rejects the archive; files are
  *   written only under `.agents/skills/<name>/`, staged then swapped so a
  *   half-written skill is never discoverable.
- * - Caps: archive ≤ 20 MB compressed, ≤ 50 MB inflated, ≤ 400 files per
- *   skill, per-file ≤ 10 MB.
+ * - Caps: archive ≤ 100 MB compressed, ≤ 250 MB inflated, ≤ 400 files per
+ *   skill, per-file ≤ 10 MB. The inflated and per-file caps are enforced
+ *   DURING decompression (streaming), so a zip bomb aborts at the cap
+ *   instead of inflating fully into memory first.
  * - Conflicts are SKIPPED by default and reported; `overwrite: true` may
  *   replace an existing CUSTOM skill (enabled or disabled) but can never
  *   touch a package skill — those are symlinks and stay refused.
  */
-import { unzipSync } from "fflate";
+import { Unzip, UnzipInflate } from "fflate";
 import { existsSync, lstatSync, mkdirSync, renameSync, rmSync, writeFileSync } from "fs";
 import { dirname, join } from "path";
 import matter from "gray-matter";
-export const MAX_ARCHIVE_BYTES = 20 * 1024 * 1024;
-export const MAX_INFLATED_BYTES = 50 * 1024 * 1024;
+export const MAX_ARCHIVE_BYTES = 100 * 1024 * 1024;
+export const MAX_INFLATED_BYTES = 250 * 1024 * 1024;
 export const MAX_FILES_PER_SKILL = 400;
 export const MAX_FILE_BYTES = 10 * 1024 * 1024;
 const NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
@@ -47,6 +49,64 @@ function existsAs(p) {
         return null;
     }
 }
+function concatChunks(chunks, total) {
+    const whole = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        whole.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return whole;
+}
+/**
+ * Streaming unzip with the size caps enforced as bytes decompress. unzipSync
+ * would inflate the whole archive before any check could run — exactly the
+ * zip-bomb window the caps exist to close. Caps are injectable for tests;
+ * production uses the module constants.
+ */
+export function unzipWithCaps(archive, caps = { maxFileBytes: MAX_FILE_BYTES, maxInflatedBytes: MAX_INFLATED_BYTES }) {
+    const entries = {};
+    let inflated = 0;
+    let sawEntry = false;
+    const unzip = new Unzip((file) => {
+        sawEntry = true;
+        if (file.name.endsWith("/"))
+            return; // directory marker
+        const chunks = [];
+        let size = 0;
+        file.ondata = (err, data, final) => {
+            if (err) {
+                throw new InstallError(`Archive entry ${JSON.stringify(file.name)} does not decompress: ${err.message}`);
+            }
+            size += data.length;
+            inflated += data.length;
+            if (size > caps.maxFileBytes) {
+                throw new InstallError(`${file.name} exceeds ${caps.maxFileBytes / 1024 / 1024}MB.`);
+            }
+            if (inflated > caps.maxInflatedBytes) {
+                throw new InstallError(`Archive inflates past the ${caps.maxInflatedBytes / 1024 / 1024}MB cap.`);
+            }
+            chunks.push(data);
+            if (final)
+                entries[file.name] = concatChunks(chunks, size);
+        };
+        file.start();
+    });
+    unzip.register(UnzipInflate);
+    try {
+        unzip.push(archive, true);
+    }
+    catch (e) {
+        if (e instanceof InstallError)
+            throw e;
+        throw new InstallError(`Not a readable ZIP archive: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    // The streaming parser scans for entry signatures and finds none in
+    // garbage instead of throwing the way unzipSync did.
+    if (!sawEntry)
+        throw new InstallError("Not a readable ZIP archive: no entries found.");
+    return entries;
+}
 /**
  * The shared core: install every skill found among already-unzipped entries.
  * Throws InstallError for archive-level problems; per-skill problems land as
@@ -179,14 +239,7 @@ export function installSkillsFromZip(deps, archive, opts = {}) {
     if (archive.length > MAX_ARCHIVE_BYTES) {
         throw new InstallError(`Archive exceeds ${MAX_ARCHIVE_BYTES / 1024 / 1024}MB.`);
     }
-    let entries;
-    try {
-        entries = unzipSync(archive);
-    }
-    catch (e) {
-        throw new InstallError(`Not a readable ZIP archive: ${e instanceof Error ? e.message : String(e)}`);
-    }
-    return installSkillsFromEntries(deps, entries, opts);
+    return installSkillsFromEntries(deps, unzipWithCaps(archive), opts);
 }
 /**
  * Parse "owner/repo", a github.com URL, or a /tree/<ref>/<subpath> URL.
@@ -219,6 +272,31 @@ export function parseGitHubSource(input) {
     }
     return { owner, repo };
 }
+/** Read a response body, aborting the download once it grows past the cap. */
+async function readBodyCapped(res, cap) {
+    if (!res.body) {
+        const whole = new Uint8Array(await res.arrayBuffer());
+        if (whole.length > cap) {
+            throw new InstallError(`Repository archive exceeds ${cap / 1024 / 1024}MB.`);
+        }
+        return whole;
+    }
+    const reader = res.body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.length;
+        if (total > cap) {
+            await reader.cancel();
+            throw new InstallError(`Repository archive exceeds ${cap / 1024 / 1024}MB.`);
+        }
+        chunks.push(value);
+    }
+    return concatChunks(chunks, total);
+}
 /**
  * Download a repo zipball (the API endpoint — works for private repos with a
  * token, follows the codeload redirect) and install through the shared
@@ -247,17 +325,8 @@ export async function installSkillsFromGitHub(deps, source, opts = {}) {
     if (!res.ok) {
         throw new InstallError(`GitHub zipball fetch failed: HTTP ${res.status}`);
     }
-    const buf = new Uint8Array(await res.arrayBuffer());
-    if (buf.length > MAX_ARCHIVE_BYTES) {
-        throw new InstallError(`Repository archive exceeds ${MAX_ARCHIVE_BYTES / 1024 / 1024}MB.`);
-    }
-    let entries;
-    try {
-        entries = unzipSync(buf);
-    }
-    catch (e) {
-        throw new InstallError(`GitHub returned an unreadable archive: ${e instanceof Error ? e.message : String(e)}`);
-    }
+    const buf = await readBodyCapped(res, MAX_ARCHIVE_BYTES);
+    const entries = unzipWithCaps(buf);
     const stripped = {};
     for (const [key, bytes] of Object.entries(entries)) {
         const slash = key.indexOf("/");

package/dist/skills/install.js.map

@@ -1 +1 @@
-{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/skills/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAClD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAEjD,MAAM,OAAO,YAAa,SAAQ,KAAK;CAAG;AAoB1C,8EAA8E;AAC9E,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAiB,EACjB,OAAmC,EACnC,OAAuB,EAAE;IAEzB,6DAA6D;IAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,mBAAmB;QACpD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,YAAY,CAAC,oCAAoC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,YAAY,cAAc,GAAG,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;QACzB,IAAI,QAAQ,GAAG,kBAAkB,EAAE,CAAC;YAClC,MAAM,IAAI,YAAY,CAAC,qCAAqC,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;SACrE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACnE,IAAI,EAAE,CAAC;IACV,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CACpB,oDAAoD;YAClD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CACN,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACvE,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,IAAI,gBAAgB,CAAC;QACvC,sEAAsE;QACtE,oCAAoC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsB,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,SAAS;YAC3C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;gBAAE,SAAS;YAC3D,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,UAAmC,EACnC,UAAkB,EAClB,WAAmB,EACnB,IAAoB;IAEpB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAEvF,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAA+B,CAAC;IACxF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,+BAA+B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SACpF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,wDAAwD;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,mBAAmB,QAAQ,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,2EAA2E;SACpF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,QAAQ,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC;IAClF,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAChG,CAAC;IAED,uEAAuE;IACvE,oCAAoC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,cAAc,CAAC;YAAE,MAAM,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IACvF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,iBAAiB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAClC,IAAiB,EACjB,OAAmB,EACnB,OAAuB,EAAE;IAEzB,IAAI,OAAO,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACvC,MAAM,IAAI,YAAY,CAAC,mBAAmB,iBAAiB,GAAG,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAmC,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CACpB,+BAA+B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,wBAAwB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;IAC3E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACpF,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;QACtE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAKD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAiB,EACjB,MAAoB,EACpB,OAAmE,EAAE;IAErE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,GAAG,GAAG,gCAAgC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;IAChI,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,YAAY,EAAE,cAAc;YAC5B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE;QACD,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CACpB,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE;YAClD,CAAC,IAAI,CAAC,KAAK;gBACT,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,kEAAkE,CAAC,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CAAC,qCAAqC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,IAAI,GAAG,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACnC,MAAM,IAAI,YAAY,CAAC,8BAA8B,iBAAiB,GAAG,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,OAAmC,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CACpB,0CAA0C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS,CAAC,wCAAwC;QACpE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IACzC,CAAC;IACD,OAAO,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE;QAC9C,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/skills/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAEjD,MAAM,OAAO,YAAa,SAAQ,KAAK;CAAG;AAoB1C,8EAA8E;AAC9E,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB,EAAE,KAAa;IACvD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAmB,EACnB,OAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE;IAExF,MAAM,OAAO,GAA+B,EAAE,CAAC;IAC/C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/B,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,mBAAmB;QACxD,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,IAAI,YAAY,CACpB,iBAAiB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,CACjF,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC;YACpB,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC;YACxB,IAAI,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC7B,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC;YACvF,CAAC;YACD,IAAI,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACrC,MAAM,IAAI,YAAY,CACpB,6BAA6B,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,IAAI,SAAS,CAC1E,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,IAAI,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,YAAY;YAAE,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,YAAY,CACpB,+BAA+B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC5E,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,qDAAqD;IACrD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IACvF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAiB,EACjB,OAAmC,EACnC,OAAuB,EAAE;IAEzB,6DAA6D;IAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,mBAAmB;QACpD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,YAAY,CAAC,oCAAoC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,YAAY,cAAc,GAAG,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;QACzB,IAAI,QAAQ,GAAG,kBAAkB,EAAE,CAAC;YAClC,MAAM,IAAI,YAAY,CAAC,qCAAqC,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;SACrE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACnE,IAAI,EAAE,CAAC;IACV,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CACpB,oDAAoD;YAClD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CACN,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACvE,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,IAAI,gBAAgB,CAAC;QACvC,sEAAsE;QACtE,oCAAoC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsB,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,SAAS;YAC3C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;gBAAE,SAAS;YAC3D,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,UAAmC,EACnC,UAAkB,EAClB,WAAmB,EACnB,IAAoB;IAEpB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAEvF,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAA+B,CAAC;IACxF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,+BAA+B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SACpF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,wDAAwD;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,mBAAmB,QAAQ,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,2EAA2E;SACpF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,QAAQ,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC;IAClF,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAChG,CAAC;IAED,uEAAuE;IACvE,oCAAoC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,cAAc,CAAC;YAAE,MAAM,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IACvF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,iBAAiB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAClC,IAAiB,EACjB,OAAmB,EACnB,OAAuB,EAAE;IAEzB,IAAI,OAAO,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACvC,MAAM,IAAI,YAAY,CAAC,mBAAmB,iBAAiB,GAAG,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,wBAAwB,CAAC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;IAC3E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACpF,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;QACtE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAKD,8EAA8E;AAC9E,KAAK,UAAU,cAAc,CAAC,GAAa,EAAE,GAAW;IACtD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,YAAY,CAAC,8BAA8B,GAAG,GAAG,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,YAAY,CAAC,8BAA8B,GAAG,GAAG,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAiB,EACjB,MAAoB,EACpB,OAAmE,EAAE;IAErE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,GAAG,GAAG,gCAAgC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;IAChI,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,YAAY,EAAE,cAAc;YAC5B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE;QACD,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CACpB,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE;YAClD,CAAC,IAAI,CAAC,KAAK;gBACT,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,kEAAkE,CAAC,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CAAC,qCAAqC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS,CAAC,wCAAwC;QACpE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IACzC,CAAC;IACD,OAAO,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE;QAC9C,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@schlessera/brain-ui-server",
-  "version": "0.28.1",
+  "version": "0.29.0",
   "description": "brain-kit chat-UI server: Hono app factory, WebSocket turn coordinator, auth (password/passkeys/tailscale/proxy), session catalog, and brain/files/voice routes",
   "license": "MIT",
   "keywords": [
@@ -51,8 +51,8 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "0.221.0",
-    "@schlessera/brain-render-template": "0.28.1",
-    "@schlessera/brain-ui-sdk": "0.28.1",
+    "@schlessera/brain-render-template": "0.29.0",
+    "@schlessera/brain-ui-sdk": "0.29.0",
     "@simplewebauthn/server": "^13.3.2",
     "fflate": "^0.8.2",
     "gray-matter": "^4.0.3",

package/src/skills/install.ts

@@ -12,20 +12,22 @@
  *   `..`, absolute path, backslash, or NUL rejects the archive; files are
  *   written only under `.agents/skills/<name>/`, staged then swapped so a
  *   half-written skill is never discoverable.
- * - Caps: archive ≤ 20 MB compressed, ≤ 50 MB inflated, ≤ 400 files per
- *   skill, per-file ≤ 10 MB.
+ * - Caps: archive ≤ 100 MB compressed, ≤ 250 MB inflated, ≤ 400 files per
+ *   skill, per-file ≤ 10 MB. The inflated and per-file caps are enforced
+ *   DURING decompression (streaming), so a zip bomb aborts at the cap
+ *   instead of inflating fully into memory first.
  * - Conflicts are SKIPPED by default and reported; `overwrite: true` may
  *   replace an existing CUSTOM skill (enabled or disabled) but can never
  *   touch a package skill — those are symlinks and stay refused.
  */
 
-import { unzipSync } from "fflate";
+import { Unzip, UnzipInflate } from "fflate";
 import { existsSync, lstatSync, mkdirSync, renameSync, rmSync, writeFileSync } from "fs";
 import { dirname, join } from "path";
 import matter from "gray-matter";
 
-export const MAX_ARCHIVE_BYTES = 20 * 1024 * 1024;
-export const MAX_INFLATED_BYTES = 50 * 1024 * 1024;
+export const MAX_ARCHIVE_BYTES = 100 * 1024 * 1024;
+export const MAX_INFLATED_BYTES = 250 * 1024 * 1024;
 export const MAX_FILES_PER_SKILL = 400;
 export const MAX_FILE_BYTES = 10 * 1024 * 1024;
 
@@ -68,6 +70,75 @@ function existsAs(p: string): "dir" | "symlink" | null {
   }
 }
 
+function concatChunks(chunks: Uint8Array[], total: number): Uint8Array {
+  const whole = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    whole.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return whole;
+}
+
+export interface UnzipCaps {
+  maxFileBytes: number;
+  maxInflatedBytes: number;
+}
+
+/**
+ * Streaming unzip with the size caps enforced as bytes decompress. unzipSync
+ * would inflate the whole archive before any check could run — exactly the
+ * zip-bomb window the caps exist to close. Caps are injectable for tests;
+ * production uses the module constants.
+ */
+export function unzipWithCaps(
+  archive: Uint8Array,
+  caps: UnzipCaps = { maxFileBytes: MAX_FILE_BYTES, maxInflatedBytes: MAX_INFLATED_BYTES }
+): Record<string, Uint8Array> {
+  const entries: Record<string, Uint8Array> = {};
+  let inflated = 0;
+  let sawEntry = false;
+  const unzip = new Unzip((file) => {
+    sawEntry = true;
+    if (file.name.endsWith("/")) return; // directory marker
+    const chunks: Uint8Array[] = [];
+    let size = 0;
+    file.ondata = (err, data, final) => {
+      if (err) {
+        throw new InstallError(
+          `Archive entry ${JSON.stringify(file.name)} does not decompress: ${err.message}`
+        );
+      }
+      size += data.length;
+      inflated += data.length;
+      if (size > caps.maxFileBytes) {
+        throw new InstallError(`${file.name} exceeds ${caps.maxFileBytes / 1024 / 1024}MB.`);
+      }
+      if (inflated > caps.maxInflatedBytes) {
+        throw new InstallError(
+          `Archive inflates past the ${caps.maxInflatedBytes / 1024 / 1024}MB cap.`
+        );
+      }
+      chunks.push(data);
+      if (final) entries[file.name] = concatChunks(chunks, size);
+    };
+    file.start();
+  });
+  unzip.register(UnzipInflate);
+  try {
+    unzip.push(archive, true);
+  } catch (e) {
+    if (e instanceof InstallError) throw e;
+    throw new InstallError(
+      `Not a readable ZIP archive: ${e instanceof Error ? e.message : String(e)}`
+    );
+  }
+  // The streaming parser scans for entry signatures and finds none in
+  // garbage instead of throwing the way unzipSync did.
+  if (!sawEntry) throw new InstallError("Not a readable ZIP archive: no entries found.");
+  return entries;
+}
+
 /**
  * The shared core: install every skill found among already-unzipped entries.
  * Throws InstallError for archive-level problems; per-skill problems land as
@@ -218,15 +289,7 @@ export function installSkillsFromZip(
   if (archive.length > MAX_ARCHIVE_BYTES) {
     throw new InstallError(`Archive exceeds ${MAX_ARCHIVE_BYTES / 1024 / 1024}MB.`);
   }
-  let entries: Record<string, Uint8Array>;
-  try {
-    entries = unzipSync(archive);
-  } catch (e) {
-    throw new InstallError(
-      `Not a readable ZIP archive: ${e instanceof Error ? e.message : String(e)}`
-    );
-  }
-  return installSkillsFromEntries(deps, entries, opts);
+  return installSkillsFromEntries(deps, unzipWithCaps(archive), opts);
 }
 
 // ---------------------------------------------------------------------------
@@ -272,6 +335,31 @@ export function parseGitHubSource(input: string): GitHubSource | null {
 /** Injectable for tests; production passes globalThis.fetch. */
 export type Fetcher = (url: string, init?: RequestInit) => Promise<Response>;
 
+/** Read a response body, aborting the download once it grows past the cap. */
+async function readBodyCapped(res: Response, cap: number): Promise<Uint8Array> {
+  if (!res.body) {
+    const whole = new Uint8Array(await res.arrayBuffer());
+    if (whole.length > cap) {
+      throw new InstallError(`Repository archive exceeds ${cap / 1024 / 1024}MB.`);
+    }
+    return whole;
+  }
+  const reader = res.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.length;
+    if (total > cap) {
+      await reader.cancel();
+      throw new InstallError(`Repository archive exceeds ${cap / 1024 / 1024}MB.`);
+    }
+    chunks.push(value);
+  }
+  return concatChunks(chunks, total);
+}
+
 /**
  * Download a repo zipball (the API endpoint — works for private repos with a
  * token, follows the codeload redirect) and install through the shared
@@ -306,19 +394,8 @@ export async function installSkillsFromGitHub(
   if (!res.ok) {
     throw new InstallError(`GitHub zipball fetch failed: HTTP ${res.status}`);
   }
-  const buf = new Uint8Array(await res.arrayBuffer());
-  if (buf.length > MAX_ARCHIVE_BYTES) {
-    throw new InstallError(`Repository archive exceeds ${MAX_ARCHIVE_BYTES / 1024 / 1024}MB.`);
-  }
-
-  let entries: Record<string, Uint8Array>;
-  try {
-    entries = unzipSync(buf);
-  } catch (e) {
-    throw new InstallError(
-      `GitHub returned an unreadable archive: ${e instanceof Error ? e.message : String(e)}`
-    );
-  }
+  const buf = await readBodyCapped(res, MAX_ARCHIVE_BYTES);
+  const entries = unzipWithCaps(buf);
   const stripped: Record<string, Uint8Array> = {};
   for (const [key, bytes] of Object.entries(entries)) {
     const slash = key.indexOf("/");