@stigmer/runner 3.12.0 → 3.12.1

package/dist/middleware/path-normalization.d.ts

@@ -1,6 +1,6 @@
 /**
  * Workspace-relative path normalization for permission-rule-bearing graphs
- * (issue #429).
+ * (issues #429, #528).
  *
  * deepagents' permission enforcement canonicalizes tool-call paths BEFORE any
  * rule or backend runs, and its validation refuses non-absolute paths — on
@@ -20,13 +20,26 @@
  * resolves relative paths under the workspace root, so act mode keeps a
  * byte-zero delta.
  *
+ * It also supplies the workspace root when `ls`/`glob`/`grep` are called
+ * with NO path argument (issue #528). Those tools' schema default is "/" —
+ * the OS ROOT under the legacy backend — and the default is applied inside
+ * the tool, after this seam, so under the workspace read boundary a bare
+ * first `ls` would otherwise die with `permission denied for read on /`
+ * (the same first-turn degradation class #429 fixed). An EXPLICIT "/" is
+ * deliberately NOT rewritten: the model asked for the OS root, and the
+ * honest answer under plan mode's read boundary is the rules' denial —
+ * silently substituting workspace contents would be an answer to a
+ * different question.
+ *
  * Invariant — nothing becomes newly reachable: only paths whose resolution
  * stays INSIDE the workspace root are rewritten. Escaping relatives (`../x`)
  * and `~`-carrying paths are left raw so today's validation refusal keeps
  * speaking (a naive join would resolve `..` away and smuggle an out-of-root
  * read past validation), and absolute paths pass through byte-untouched.
  * The middleware converts false errors into correct behavior — never a
- * refusal into an allowance the rules didn't decide.
+ * refusal into an allowance the rules didn't decide. (The absent-path
+ * injection honors the same line: it narrows the tool's own OS-root default
+ * to the workspace, granting nothing the rules would refuse.)
  *
  * Tool matching is by bare built-in name, the house doctrine (an MCP server
  * is not expected to shadow a built-in name — see shared/tool-kind.ts); the

package/dist/middleware/path-normalization.js

@@ -1,6 +1,6 @@
 /**
  * Workspace-relative path normalization for permission-rule-bearing graphs
- * (issue #429).
+ * (issues #429, #528).
  *
  * deepagents' permission enforcement canonicalizes tool-call paths BEFORE any
  * rule or backend runs, and its validation refuses non-absolute paths — on
@@ -20,13 +20,26 @@
  * resolves relative paths under the workspace root, so act mode keeps a
  * byte-zero delta.
  *
+ * It also supplies the workspace root when `ls`/`glob`/`grep` are called
+ * with NO path argument (issue #528). Those tools' schema default is "/" —
+ * the OS ROOT under the legacy backend — and the default is applied inside
+ * the tool, after this seam, so under the workspace read boundary a bare
+ * first `ls` would otherwise die with `permission denied for read on /`
+ * (the same first-turn degradation class #429 fixed). An EXPLICIT "/" is
+ * deliberately NOT rewritten: the model asked for the OS root, and the
+ * honest answer under plan mode's read boundary is the rules' denial —
+ * silently substituting workspace contents would be an answer to a
+ * different question.
+ *
  * Invariant — nothing becomes newly reachable: only paths whose resolution
  * stays INSIDE the workspace root are rewritten. Escaping relatives (`../x`)
  * and `~`-carrying paths are left raw so today's validation refusal keeps
  * speaking (a naive join would resolve `..` away and smuggle an out-of-root
  * read past validation), and absolute paths pass through byte-untouched.
  * The middleware converts false errors into correct behavior — never a
- * refusal into an allowance the rules didn't decide.
+ * refusal into an allowance the rules didn't decide. (The absent-path
+ * injection honors the same line: it narrows the tool's own OS-root default
+ * to the workspace, granting nothing the rules would refuse.)
  *
  * Tool matching is by bare built-in name, the house doctrine (an MCP server
  * is not expected to shadow a built-in name — see shared/tool-kind.ts); the
@@ -38,9 +51,8 @@ import { isAbsolute, relative } from "node:path";
 import { resolveWorkspacePath } from "../shared/file-change.js";
 /**
  * The path-bearing argument of each deepagents built-in filesystem tool.
- * `ls`/`glob`/`grep` take a base directory `path` (defaulting to "/" when
- * omitted — absolute, so untouched here); the file tools take `file_path`.
- * Confirmed against the installed deepagents' tool definitions.
+ * `ls`/`glob`/`grep` take a base directory `path`; the file tools take
+ * `file_path`. Confirmed against the installed deepagents' tool definitions.
  */
 const PATH_ARG_BY_TOOL = new Map([
     ["ls", "path"],
@@ -50,6 +62,14 @@ const PATH_ARG_BY_TOOL = new Map([
     ["write_file", "file_path"],
     ["edit_file", "file_path"],
 ]);
+/**
+ * The tools whose path argument is optional with an OS-root ("/") schema
+ * default. When the model omits it, this middleware supplies the workspace
+ * root instead (issue #528). The file tools are deliberately excluded: an
+ * absent `file_path` is a genuine model error, and the tool's own input
+ * validation gives the better message.
+ */
+const DIR_DEFAULTING_TOOLS = new Set(["ls", "glob", "grep"]);
 /**
  * Rewrite `raw` to its workspace-absolute form, or return undefined when the
  * value must be left untouched (absolute already, `~`-carrying, or escaping
@@ -91,6 +111,20 @@ export function createPathNormalizationMiddleware(config) {
             if (!argKey)
                 return handler(request);
             const raw = request.toolCall.args[argKey];
+            // Absent base directory on ls/glob/grep: the middleware sees the
+            // model's raw args, BEFORE the tool's zod parse applies the "/"
+            // (OS root) schema default — so the omission must be filled here,
+            // where the workspace root is known. An explicit "/" is not this
+            // case and flows through to an honest rule denial (header doctrine).
+            if (raw == null && DIR_DEFAULTING_TOOLS.has(request.toolCall.name)) {
+                return handler({
+                    ...request,
+                    toolCall: {
+                        ...request.toolCall,
+                        args: { ...request.toolCall.args, [argKey]: rootDir },
+                    },
+                });
+            }
             if (typeof raw !== "string")
                 return handler(request);
             const normalized = normalizeWorkspacePathArg(raw, rootDir);

package/dist/middleware/path-normalization.js.map

@@ -1 +1 @@
-{"version":3,"file":"path-normalization.js","sourceRoot":"","sources":["../../src/middleware/path-normalization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAGhE;;;;;GAKG;AACH,MAAM,gBAAgB,GAAgC,IAAI,GAAG,CAAC;IAC5D,CAAC,IAAI,EAAE,MAAM,CAAC;IACd,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,WAAW,EAAE,WAAW,CAAC;IAC1B,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,WAAW,EAAE,WAAW,CAAC;CAC3B,CAAC,CAAC;AAOH;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAW,EACX,OAAe;IAEf,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1D,wEAAwE;IACxE,wEAAwE;IACxE,wCAAwC;IACxC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,MAAM,EAAE,YAAY,EAAE,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAEnE,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,6BAA6B;IAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9D,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAC/C,MAA+B;IAE/B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAE3B,OAAO;QACL,IAAI,EAAE,6BAA6B;QAEnC,YAAY,CAAC,OAAO,EAAE,OAAO;YAC3B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAErC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAErD,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC3D,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAEtD,OAAO,OAAO,CAAC;gBACb,GAAG,OAAO;gBACV,QAAQ,EAAE;oBACR,GAAG,OAAO,CAAC,QAAQ;oBACnB,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE;iBACzD;aACF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"path-normalization.js","sourceRoot":"","sources":["../../src/middleware/path-normalization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAGhE;;;;GAIG;AACH,MAAM,gBAAgB,GAAgC,IAAI,GAAG,CAAC;IAC5D,CAAC,IAAI,EAAE,MAAM,CAAC;IACd,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,WAAW,EAAE,WAAW,CAAC;IAC1B,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,WAAW,EAAE,WAAW,CAAC;CAC3B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAOlF;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAW,EACX,OAAe;IAEf,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1D,wEAAwE;IACxE,wEAAwE;IACxE,wCAAwC;IACxC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,MAAM,EAAE,YAAY,EAAE,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAEnE,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,6BAA6B;IAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9D,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAC/C,MAA+B;IAE/B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAE3B,OAAO;QACL,IAAI,EAAE,6BAA6B;QAEnC,YAAY,CAAC,OAAO,EAAE,OAAO;YAC3B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAErC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAE1C,iEAAiE;YACjE,gEAAgE;YAChE,kEAAkE;YAClE,iEAAiE;YACjE,qEAAqE;YACrE,IAAI,GAAG,IAAI,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnE,OAAO,OAAO,CAAC;oBACb,GAAG,OAAO;oBACV,QAAQ,EAAE;wBACR,GAAG,OAAO,CAAC,QAAQ;wBACnB,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE;qBACtD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAErD,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC3D,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAEtD,OAAO,OAAO,CAAC;gBACb,GAAG,OAAO;gBACV,QAAQ,EAAE;oBACR,GAAG,OAAO,CAAC,QAAQ;oBACnB,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE;iBACzD;aACF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/shared/mcp-enabled-tools.d.ts

@@ -21,8 +21,12 @@
  * identity space as the sub-agent McpAccess filter and the approval-policy
  * maps. An enabled name the server does not expose is warned and dropped
  * (enforce the intersection): the restriction still holds and the run
- * proceeds with the valid subset; apply-time validation against
- * discovered_capabilities is the server-side follow-up that catches typos.
+ * proceeds with the valid subset. The server-side half (issue #402) rejects
+ * such names at apply time once the referenced server has discovered
+ * capabilities (stigmer-server validateEnabledToolsStep /
+ * validateDefaultEnabledToolsStep); this runtime leniency remains the
+ * safety net for manifests applied before a server's first connect and for
+ * toolsets that changed since the last discovery.
  */
 /**
  * Compute the effective allow-list for one resolved MCP server.

package/dist/shared/mcp-enabled-tools.js

@@ -21,8 +21,12 @@
  * identity space as the sub-agent McpAccess filter and the approval-policy
  * maps. An enabled name the server does not expose is warned and dropped
  * (enforce the intersection): the restriction still holds and the run
- * proceeds with the valid subset; apply-time validation against
- * discovered_capabilities is the server-side follow-up that catches typos.
+ * proceeds with the valid subset. The server-side half (issue #402) rejects
+ * such names at apply time once the referenced server has discovered
+ * capabilities (stigmer-server validateEnabledToolsStep /
+ * validateDefaultEnabledToolsStep); this runtime leniency remains the
+ * safety net for manifests applied before a server's first connect and for
+ * toolsets that changed since the last discovery.
  */
 /**
  * Compute the effective allow-list for one resolved MCP server.

package/dist/shared/mcp-enabled-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-enabled-tools.js","sourceRoot":"","sources":["../../src/shared/mcp-enabled-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,iBAAgD,EAChD,mBAAkD;IAElD,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,iBAAiB,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,mBAAmB,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAY,EACZ,KAAmB,EACnB,YAA2C;IAE3C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CACV,iBAAiB,IAAI,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACtE,qEAAqE;YACrE,OAAO,QAAQ,CAAC,MAAM,sCAAsC;YAC5D,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CACT,iBAAiB,IAAI,8BAA8B,KAAK,CAAC,MAAM,GAAG;QAClE,yBAAyB,QAAQ,CAAC,MAAM,EAAE,CAC3C,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA6D;IAE7D,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"mcp-enabled-tools.js","sourceRoot":"","sources":["../../src/shared/mcp-enabled-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,iBAAgD,EAChD,mBAAkD;IAElD,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,iBAAiB,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,mBAAmB,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAY,EACZ,KAAmB,EACnB,YAA2C;IAE3C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CACV,iBAAiB,IAAI,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACtE,qEAAqE;YACrE,OAAO,QAAQ,CAAC,MAAM,sCAAsC;YAC5D,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CACT,iBAAiB,IAAI,8BAA8B,KAAK,CAAC,MAAM,GAAG;QAClE,yBAAyB,QAAQ,CAAC,MAAM,EAAE,CAC3C,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA6D;IAE7D,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/shared/plan-mode-permissions.d.ts

@@ -2,12 +2,26 @@
  * The Plan-mode filesystem permission rules — the enforcement twin of
  * `plan-mode-prompt.ts` (which carries the instruction half of the contract).
  *
- * Plan mode is read-only BY CONSTRUCTION on the native harness: these rules
- * deny every filesystem write operation at the tool level so
- * write_file/edit_file cannot mutate the workspace regardless of what the
- * model was told. Rules are first-match-wins with a permissive default, so a
- * single deny-all-writes rule is sufficient. (The Cursor harness has no
- * tool-level lever and enforces plan mode via its prompt prefix instead.)
+ * Plan mode is contained BY CONSTRUCTION on the native harness: these rules
+ * deny every filesystem write everywhere AND scope reads to the session
+ * workspace (issue #528 — owner ruling: the workspace is plan mode's read
+ * boundary on cloud and desktop runners alike). Without the read boundary,
+ * model-provided absolute paths reached anywhere the process account could
+ * read — the pod filesystem (including /proc/self/environ) on cloud runners,
+ * the user's whole home directory on desktop — while plan mode still carries
+ * exfiltration-capable tools (web_fetch, MCP). Rules are first-match-wins
+ * with a permissive default (deepagents' decidePathAccess), so order is
+ * load-bearing: the workspace read-allow must precede the read-deny.
+ *
+ * The workspace-root pattern is matched as a STRING against the raw tool-call
+ * path (micromatch, dot:true), before the backend touches disk. That is
+ * exactly why the legitimate out-of-workspace reads keep working: skills,
+ * attachments, and the approved plan live in the platform dir but are
+ * addressed through the `{workspace}/.stigmer` symlink (see
+ * shared/workspace/stigmer-link.ts), so their path strings are in-root even
+ * though the bytes are not. The same holds for multi-workspace local entries
+ * (`{workspace}/{name}` symlinks). A realpath-based boundary would break
+ * both; do not "harden" this into one.
  *
  * Applied in execute-deep-agent/setup.ts to the parent graph AND threaded
  * into every compiled sub-agent graph: deepagents' parent-permission
@@ -18,9 +32,9 @@
  *
  * Rules travel with a companion: every graph that carries them also installs
  * the path-normalization middleware (middleware/path-normalization.ts,
- * issue #429), because deepagents' rule validation refuses workspace-relative
- * paths outright — without the shim, prompt-compliant relative READS die in
- * validation instead of just working. Both are derived from the same
+ * issues #429/#528), because deepagents' rule validation refuses
+ * workspace-relative paths outright and its `ls`/`glob`/`grep` schema default
+ * of "/" would deny the bare first listing. Both are derived from the same
  * expression at each composition site so they cannot drift apart.
  *
  * Invariant: never combine these rules with a shell-capable (sandbox)
@@ -30,4 +44,26 @@
  * for shell capability on both the parent and sub-agent backends.
  */
 import type { FilesystemPermission } from "deepagents";
-export declare const PLAN_MODE_PERMISSIONS: FilesystemPermission[];
+/**
+ * Backslash-escape every character micromatch/picomatch treats as glob
+ * syntax, so the result matches the input literally. micromatch exports no
+ * escape API of its own, and this is correctness, not caution: an unescaped
+ * `(` in a desktop project path would make the workspace read-allow rule
+ * silently never match — bricking every plan-mode read for that workspace.
+ * Semantics are pinned end-to-end through deepagents' own matcher by the
+ * special-character workspace suite in plan-mode-path-normalization.test.ts.
+ */
+export declare function escapeGlobLiteral(literal: string): string;
+/**
+ * Build the plan-mode rule set for a graph whose filesystem backend is
+ * rooted at `workspaceRootDir`. The three rules read as the policy:
+ * reads allowed in the workspace, reads denied everywhere else, writes
+ * denied everywhere.
+ *
+ * `{root}/**` matches the root itself as well as its subtree (verified
+ * against the installed micromatch), so one allow pattern suffices. The
+ * root is `path.resolve`d first because enforcement canonicalizes incoming
+ * paths (collapsed slashes, no trailing separator) before matching — a
+ * trailing slash in the pattern would silently match nothing.
+ */
+export declare function buildPlanModePermissions(workspaceRootDir: string): FilesystemPermission[];

package/dist/shared/plan-mode-permissions.js

@@ -2,12 +2,26 @@
  * The Plan-mode filesystem permission rules — the enforcement twin of
  * `plan-mode-prompt.ts` (which carries the instruction half of the contract).
  *
- * Plan mode is read-only BY CONSTRUCTION on the native harness: these rules
- * deny every filesystem write operation at the tool level so
- * write_file/edit_file cannot mutate the workspace regardless of what the
- * model was told. Rules are first-match-wins with a permissive default, so a
- * single deny-all-writes rule is sufficient. (The Cursor harness has no
- * tool-level lever and enforces plan mode via its prompt prefix instead.)
+ * Plan mode is contained BY CONSTRUCTION on the native harness: these rules
+ * deny every filesystem write everywhere AND scope reads to the session
+ * workspace (issue #528 — owner ruling: the workspace is plan mode's read
+ * boundary on cloud and desktop runners alike). Without the read boundary,
+ * model-provided absolute paths reached anywhere the process account could
+ * read — the pod filesystem (including /proc/self/environ) on cloud runners,
+ * the user's whole home directory on desktop — while plan mode still carries
+ * exfiltration-capable tools (web_fetch, MCP). Rules are first-match-wins
+ * with a permissive default (deepagents' decidePathAccess), so order is
+ * load-bearing: the workspace read-allow must precede the read-deny.
+ *
+ * The workspace-root pattern is matched as a STRING against the raw tool-call
+ * path (micromatch, dot:true), before the backend touches disk. That is
+ * exactly why the legitimate out-of-workspace reads keep working: skills,
+ * attachments, and the approved plan live in the platform dir but are
+ * addressed through the `{workspace}/.stigmer` symlink (see
+ * shared/workspace/stigmer-link.ts), so their path strings are in-root even
+ * though the bytes are not. The same holds for multi-workspace local entries
+ * (`{workspace}/{name}` symlinks). A realpath-based boundary would break
+ * both; do not "harden" this into one.
  *
  * Applied in execute-deep-agent/setup.ts to the parent graph AND threaded
  * into every compiled sub-agent graph: deepagents' parent-permission
@@ -18,9 +32,9 @@
  *
  * Rules travel with a companion: every graph that carries them also installs
  * the path-normalization middleware (middleware/path-normalization.ts,
- * issue #429), because deepagents' rule validation refuses workspace-relative
- * paths outright — without the shim, prompt-compliant relative READS die in
- * validation instead of just working. Both are derived from the same
+ * issues #429/#528), because deepagents' rule validation refuses
+ * workspace-relative paths outright and its `ls`/`glob`/`grep` schema default
+ * of "/" would deny the bare first listing. Both are derived from the same
  * expression at each composition site so they cannot drift apart.
  *
  * Invariant: never combine these rules with a shell-capable (sandbox)
@@ -29,7 +43,37 @@
  * it is the mode that clears `shellEnv`, and `shellEnv` is the single switch
  * for shell capability on both the parent and sub-agent backends.
  */
-export const PLAN_MODE_PERMISSIONS = [
-    { operations: ["write"], paths: ["/**"], mode: "deny" },
-];
+import { resolve } from "node:path";
+/**
+ * Backslash-escape every character micromatch/picomatch treats as glob
+ * syntax, so the result matches the input literally. micromatch exports no
+ * escape API of its own, and this is correctness, not caution: an unescaped
+ * `(` in a desktop project path would make the workspace read-allow rule
+ * silently never match — bricking every plan-mode read for that workspace.
+ * Semantics are pinned end-to-end through deepagents' own matcher by the
+ * special-character workspace suite in plan-mode-path-normalization.test.ts.
+ */
+export function escapeGlobLiteral(literal) {
+    return literal.replace(/[\\*?()[\]{}!+@]/g, "\\$&");
+}
+/**
+ * Build the plan-mode rule set for a graph whose filesystem backend is
+ * rooted at `workspaceRootDir`. The three rules read as the policy:
+ * reads allowed in the workspace, reads denied everywhere else, writes
+ * denied everywhere.
+ *
+ * `{root}/**` matches the root itself as well as its subtree (verified
+ * against the installed micromatch), so one allow pattern suffices. The
+ * root is `path.resolve`d first because enforcement canonicalizes incoming
+ * paths (collapsed slashes, no trailing separator) before matching — a
+ * trailing slash in the pattern would silently match nothing.
+ */
+export function buildPlanModePermissions(workspaceRootDir) {
+    const canonicalRoot = resolve(workspaceRootDir);
+    return [
+        { operations: ["read"], paths: [`${escapeGlobLiteral(canonicalRoot)}/**`] },
+        { operations: ["read"], paths: ["/**"], mode: "deny" },
+        { operations: ["write"], paths: ["/**"], mode: "deny" },
+    ];
+}
 //# sourceMappingURL=plan-mode-permissions.js.map

package/dist/shared/plan-mode-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"plan-mode-permissions.js","sourceRoot":"","sources":["../../src/shared/plan-mode-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAA2B;IAC3D,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;CACxD,CAAC"}
+{"version":3,"file":"plan-mode-permissions.js","sourceRoot":"","sources":["../../src/shared/plan-mode-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,gBAAwB;IAExB,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChD,OAAO;QACL,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAC3E,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;QACtD,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;KACxD,CAAC;AACJ,CAAC"}

package/dist/shared/zip-extract.d.ts

@@ -1,10 +1,24 @@
 /**
- * Minimal, dependency-free ZIP archive parser.
+ * Skill-artifact ZIP extraction: text-decoded entries with non-fatal
+ * structural failure.
  *
- * Handles the local file header format, supporting stored (method 0) and
- * deflated (method 8) entries. Returns parsed entries as path + content
- * pairs — consumers bring their own write mechanism (WorkspaceBackend,
- * node:fs, etc.).
+ * Structural parsing lives in zip-structure.ts (central-directory-based —
+ * see that module's doc for why local-header walks are never acceptable,
+ * issue #450). This module owns the skill-artifact *policy* on top of it:
+ *
+ * Input without a readable central directory is not given a second
+ * chance on purpose: every artifact reaching the runner was validated at
+ * push by a central-directory-based reader on both editions (OSS:
+ * `safearchive/zip` in stigmer-server's skill storage; cloud:
+ * commons-compress `ZipFile` in SkillArtifactExtractor), so a missing
+ * EOCD here can only mean a truncated or corrupted download — and the
+ * honest result for that is the documented empty return, not a guess.
+ * (The attachment injector consumes the same structural layer under the
+ * opposite policy — fail-hard — because its input is untrusted.)
+ *
+ * Handles stored (method 0) and deflated (method 8) entries. Returns
+ * parsed entries as path + content pairs — consumers bring their own
+ * write mechanism (WorkspaceBackend, node:fs, etc.).
  *
  * Extracted from skill-writer.ts so both the deep-agent and Cursor
  * harnesses can share the same ZIP parsing logic without coupling to
@@ -23,7 +37,11 @@ export interface ZipFileEntry {
  * entries whose filename (basename or full path) matches any excluded name.
  *
  * Returns an empty array for empty, truncated, or non-ZIP input rather
- * than throwing — callers treat missing artifacts as non-fatal.
+ * than throwing — callers treat missing artifacts as non-fatal. Errors
+ * while *decompressing* a structurally valid entry (corrupt deflate
+ * stream, unsupported compression method) do propagate: at that point
+ * the archive's structure vouched for the entry, and silently dropping
+ * it would be the exact corruption this module exists to prevent.
  */
 export declare function extractZipFileEntries(zipBytes: Uint8Array, options?: {
     exclude?: readonly string[];

package/dist/shared/zip-extract.js

@@ -1,16 +1,31 @@
 /**
- * Minimal, dependency-free ZIP archive parser.
+ * Skill-artifact ZIP extraction: text-decoded entries with non-fatal
+ * structural failure.
  *
- * Handles the local file header format, supporting stored (method 0) and
- * deflated (method 8) entries. Returns parsed entries as path + content
- * pairs — consumers bring their own write mechanism (WorkspaceBackend,
- * node:fs, etc.).
+ * Structural parsing lives in zip-structure.ts (central-directory-based —
+ * see that module's doc for why local-header walks are never acceptable,
+ * issue #450). This module owns the skill-artifact *policy* on top of it:
+ *
+ * Input without a readable central directory is not given a second
+ * chance on purpose: every artifact reaching the runner was validated at
+ * push by a central-directory-based reader on both editions (OSS:
+ * `safearchive/zip` in stigmer-server's skill storage; cloud:
+ * commons-compress `ZipFile` in SkillArtifactExtractor), so a missing
+ * EOCD here can only mean a truncated or corrupted download — and the
+ * honest result for that is the documented empty return, not a guess.
+ * (The attachment injector consumes the same structural layer under the
+ * opposite policy — fail-hard — because its input is untrusted.)
+ *
+ * Handles stored (method 0) and deflated (method 8) entries. Returns
+ * parsed entries as path + content pairs — consumers bring their own
+ * write mechanism (WorkspaceBackend, node:fs, etc.).
  *
  * Extracted from skill-writer.ts so both the deep-agent and Cursor
  * harnesses can share the same ZIP parsing logic without coupling to
  * a specific workspace abstraction.
  */
 import { createInflateRaw } from "node:zlib";
+import { EOCD_MIN_SIZE, parseZipStructure } from "./zip-structure.js";
 /**
  * Parse and decompress all file entries from a ZIP archive.
  *
@@ -18,16 +33,22 @@ import { createInflateRaw } from "node:zlib";
  * entries whose filename (basename or full path) matches any excluded name.
  *
  * Returns an empty array for empty, truncated, or non-ZIP input rather
- * than throwing — callers treat missing artifacts as non-fatal.
+ * than throwing — callers treat missing artifacts as non-fatal. Errors
+ * while *decompressing* a structurally valid entry (corrupt deflate
+ * stream, unsupported compression method) do propagate: at that point
+ * the archive's structure vouched for the entry, and silently dropping
+ * it would be the exact corruption this module exists to prevent.
  */
 export async function extractZipFileEntries(zipBytes, options) {
-    if (zipBytes.length < 4)
+    if (zipBytes.length < EOCD_MIN_SIZE)
         return [];
     let entries;
     try {
-        entries = parseZipEntries(zipBytes);
+        entries = parseZipStructure(zipBytes);
     }
-    catch {
+    catch (err) {
+        console.warn("[zip-extract] archive has no readable central directory " +
+            `(truncated or corrupt download?): ${err instanceof Error ? err.message : String(err)}`);
         return [];
     }
     const excludeSet = new Set(options?.exclude ?? []);
@@ -50,87 +71,7 @@ function isExcluded(name, excludeSet) {
     const basename = name.includes("/") ? name.slice(name.lastIndexOf("/") + 1) : name;
     return excludeSet.has(basename);
 }
-function parseZipEntries(data) {
-    const entries = [];
-    const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
-    let offset = 0;
-    while (offset < data.length - 4) {
-        const signature = view.getUint32(offset, true);
-        if (signature !== 0x04034b50)
-            break; // Local file header signature
-        const generalFlags = view.getUint16(offset + 6, true);
-        const hasDataDescriptor = (generalFlags & 0x08) !== 0;
-        const compressionMethod = view.getUint16(offset + 8, true);
-        let compressedSize = view.getUint32(offset + 18, true);
-        let uncompressedSize = view.getUint32(offset + 22, true);
-        const fileNameLength = view.getUint16(offset + 26, true);
-        const extraFieldLength = view.getUint16(offset + 28, true);
-        const fileNameStart = offset + 30;
-        const fileName = new TextDecoder().decode(data.subarray(fileNameStart, fileNameStart + fileNameLength));
-        const dataStart = fileNameStart + fileNameLength + extraFieldLength;
-        if (hasDataDescriptor && compressedSize === 0) {
-            const sizes = findDataDescriptor(data, view, dataStart, compressionMethod);
-            compressedSize = sizes.compressedSize;
-            uncompressedSize = sizes.uncompressedSize;
-        }
-        const compressedData = data.subarray(dataStart, dataStart + compressedSize);
-        entries.push({
-            name: fileName,
-            isDirectory: fileName.endsWith("/"),
-            compressedData,
-            compressionMethod,
-            uncompressedSize,
-        });
-        let nextOffset = dataStart + compressedSize;
-        if (hasDataDescriptor) {
-            if (nextOffset + 4 <= data.length && view.getUint32(nextOffset, true) === 0x08074b50) {
-                nextOffset += 16; // signature(4) + crc(4) + compressedSize(4) + uncompressedSize(4)
-            }
-            else {
-                nextOffset += 12; // crc(4) + compressedSize(4) + uncompressedSize(4)
-            }
-        }
-        offset = nextOffset;
-    }
-    return entries;
-}
-/**
- * Scan forward from dataStart to find the data descriptor that contains
- * the actual compressed and uncompressed sizes. Looks for either the
- * optional signature 0x08074b50 or falls back to scanning the central
- * directory for the matching entry.
- */
-function findDataDescriptor(data, view, dataStart, _compressionMethod) {
-    for (let pos = dataStart; pos < data.length - 16; pos++) {
-        const sig = view.getUint32(pos, true);
-        if (sig === 0x08074b50) {
-            return {
-                compressedSize: view.getUint32(pos + 8, true),
-                uncompressedSize: view.getUint32(pos + 12, true),
-            };
-        }
-        if (sig === 0x04034b50 || sig === 0x02014b50) {
-            const descStart = pos - 12;
-            if (descStart >= dataStart) {
-                return {
-                    compressedSize: view.getUint32(descStart + 4, true),
-                    uncompressedSize: view.getUint32(descStart + 8, true),
-                };
-            }
-            break;
-        }
-    }
-    for (let pos = dataStart; pos < data.length - 4; pos++) {
-        const sig = view.getUint32(pos, true);
-        if (sig === 0x04034b50 || sig === 0x02014b50 || sig === 0x08074b50) {
-            const compressedSize = sig === 0x08074b50
-                ? view.getUint32(pos + 8, true)
-                : pos - dataStart;
-            return { compressedSize, uncompressedSize: 0 };
-        }
-    }
-    return { compressedSize: data.length - dataStart, uncompressedSize: 0 };
-}
+// ─── Decompression ───────────────────────────────────────────────────────
 async function decompressEntry(entry) {
     if (entry.compressionMethod === 0) {
         return new TextDecoder().decode(entry.compressedData);

package/dist/shared/zip-extract.js.map

@@ -1 +1 @@
-{"version":3,"file":"zip-extract.js","sourceRoot":"","sources":["../../src/shared/zip-extract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAW7C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAoB,EACpB,OAAyC;IAEzC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnC,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW;YAAE,SAAS;QAChC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC;YAAE,SAAS;QAEjD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD,SAAS,UAAU,CAAC,IAAY,EAAE,UAA+B;IAC/D,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAgB;IACvC,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,UAAU;YAAE,MAAM,CAAC,8BAA8B;QAEnE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,iBAAiB,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3D,IAAI,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAE3D,MAAM,aAAa,GAAG,MAAM,GAAG,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACvC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,cAAc,CAAC,CAC7D,CAAC;QAEF,MAAM,SAAS,GAAG,aAAa,GAAG,cAAc,GAAG,gBAAgB,CAAC;QAEpE,IAAI,iBAAiB,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;YAC3E,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;YACtC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC5C,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,cAAc,CAAC,CAAC;QAE5E,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YACnC,cAAc;YACd,iBAAiB;YACjB,gBAAgB;SACjB,CAAC,CAAC;QAEH,IAAI,UAAU,GAAG,SAAS,GAAG,cAAc,CAAC;QAC5C,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;gBACrF,UAAU,IAAI,EAAE,CAAC,CAAC,kEAAkE;YACtF,CAAC;iBAAM,CAAC;gBACN,UAAU,IAAI,EAAE,CAAC,CAAC,mDAAmD;YACvE,CAAC;QACH,CAAC;QACD,MAAM,GAAG,UAAU,CAAC;IACtB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,IAAgB,EAChB,IAAc,EACd,SAAiB,EACjB,kBAA0B;IAE1B,KAAK,IAAI,GAAG,GAAG,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,OAAO;gBACL,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,CAAC;gBAC7C,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,EAAE,IAAI,CAAC;aACjD,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,GAAG,GAAG,EAAE,CAAC;YAC3B,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;gBAC3B,OAAO;oBACL,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,CAAC,EAAE,IAAI,CAAC;oBACnD,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,CAAC,EAAE,IAAI,CAAC;iBACtD,CAAC;YACJ,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;IACD,KAAK,IAAI,GAAG,GAAG,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACnE,MAAM,cAAc,GAAG,GAAG,KAAK,UAAU;gBACvC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,CAAC;gBAC/B,CAAC,CAAC,GAAG,GAAG,SAAS,CAAC;YACpB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAe;IAC5C,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;YACnC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;AACpF,CAAC"}
+{"version":3,"file":"zip-extract.js","sourceRoot":"","sources":["../../src/shared/zip-extract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA2B,MAAM,oBAAoB,CAAC;AAW/F;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAoB,EACpB,OAAyC;IAEzC,IAAI,QAAQ,CAAC,MAAM,GAAG,aAAa;QAAE,OAAO,EAAE,CAAC;IAE/C,IAAI,OAA6B,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,0DAA0D;YAC1D,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxF,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW;YAAE,SAAS;QAChC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC;YAAE,SAAS;QAEjD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,UAA+B;IAC/D,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,4EAA4E;AAE5E,KAAK,UAAU,eAAe,CAAC,KAAyB;IACtD,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;YACnC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;AACpF,CAAC"}

package/dist/shared/zip-structure.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Policy-free structural ZIP parsing: end-of-central-directory (EOCD)
+ * location plus central-directory walk, producing one record per entry.
+ *
+ * Parsing is *central-directory-based* — never a front-to-back walk of
+ * local file headers. This is a correctness decision, not a style choice
+ * (issues #450 and #567): local headers of streaming entries
+ * (general-purpose flag bit 3) carry zeroed sizes, and the only
+ * local-only way to recover them is scanning the payload for the
+ * data-descriptor signature — which silently truncates any stored entry
+ * whose *content* happens to contain those four bytes, and
+ * desynchronizes every entry after it. The central directory always
+ * carries the real sizes, and every consumer here holds the complete
+ * archive bytes, so nothing a local-header walk could offer is needed.
+ *
+ * This layer maps bytes to entry records and nothing else. Policy — what
+ * a structural failure means, which entries are acceptable, how payloads
+ * are decoded — belongs to the consumers, and they differ on purpose:
+ *
+ *   - shared/zip-extract.ts (skill artifacts): structural failure is
+ *     NON-FATAL — both editions' push gates validated every artifact
+ *     with a central-directory-based reader before storage, so a defect
+ *     here can only be a truncated or corrupted download.
+ *   - execute-deep-agent/attachment-injector.ts (user attachments):
+ *     structural failure is FAIL-HARD — the input is an untrusted
+ *     upload and nothing upstream vouched for it.
+ *
+ * ZIP64 is deliberately unsupported: both consumers cap input far below
+ * every ZIP64 threshold (skill push gates: 100MB / 10,000 files;
+ * attachment uploads: 10MB).
+ *
+ * Throws plain `Error`s on structural defects (no valid EOCD, a central
+ * directory or local header record that does not parse, a payload slice
+ * that runs past the end of the buffer); consumers translate those into
+ * their own error models.
+ */
+export interface ZipStructuralEntry {
+    /** Entry path exactly as recorded in the central directory. */
+    readonly name: string;
+    readonly isDirectory: boolean;
+    readonly compressionMethod: number;
+    /**
+     * The central directory's declared uncompressed size — authoritative for
+     * pre-extraction accounting (e.g. ZIP-bomb budgeting), but still a
+     * *declaration*: a consumer that distrusts its input must enforce it
+     * against the actual decompressed output.
+     */
+    readonly uncompressedSize: number;
+    /** The entry's raw payload slice (a view, not a copy) of the archive buffer. */
+    readonly compressedData: Uint8Array;
+}
+/** Fixed size of the EOCD record, excluding the variable-length comment. */
+export declare const EOCD_MIN_SIZE = 22;
+/**
+ * Enumerate the archive's entries from its central directory.
+ *
+ * Throws on any structural defect: no valid EOCD, a central directory or
+ * local header record that doesn't parse, or a payload slice that runs
+ * past the end of the buffer.
+ */
+export declare function parseZipStructure(data: Uint8Array): ZipStructuralEntry[];