@stigmer/runner 3.12.0 → 3.12.2

package/src/shared/filereview/__tests__/capture.test.ts

@@ -946,6 +946,54 @@ describe("capture orchestration — CAS-only non-git workspace (Slice 2a)", () =
     await expect(readFile(join(ws, "drop.txt"), "utf-8")).rejects.toThrow();
   });
 
+  it("authors a DELETE from {before, after:null} and reconciles it both ways (issue #303)", async () => {
+    // The delete flow end-to-end at this seam: the harness captured the
+    // pre-delete bytes and the file is gone from disk (the tool ran). The
+    // candidate must carry a DELETE with the before blob; an approved DELETE
+    // stays deleted, a rejected DELETE is restored byte-exact from the blob.
+    const status = newStatus();
+    const storage = makeStorage();
+    const readBlob = reconcilerReadBlob(storage);
+    const enc = (s: string) => new TextEncoder().encode(s);
+
+    const baseline = await captureBaselineToLedger({
+      status, gitRoot: ws, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID,
+      harnessId: HARNESS, gitWorkspace: false,
+    });
+    await captureCandidateToLedger({
+      status, gitRoot: ws, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID,
+      baselineTree: baseline, harnessId: HARNESS, gitWorkspace: false, storage,
+      casCaptures: [
+        { path: "gone-approved.txt", before: enc("A"), after: null, captureClass: FileCaptureClass.NON_GIT_CAS },
+        { path: "gone-rejected.txt", before: enc("B"), after: null, captureClass: FileCaptureClass.NON_GIT_CAS },
+      ],
+    });
+
+    const cand = candidateChanges(status);
+    expect(cand.map((c) => c.kind)).toEqual([FileChangeKind.DELETE, FileChangeKind.DELETE]);
+    // A DELETE names its path on the BEFORE side only, with the restorable blob.
+    expect(cand.map((c) => c.pathBefore)).toEqual(["gone-approved.txt", "gone-rejected.txt"]);
+    expect(cand.map((c) => c.pathAfter)).toEqual(["", ""]);
+    expect(cand[0].before?.body.case).toBe("ref");
+    expect(cand[0].after).toBeUndefined();
+
+    const changeSet = decidedChangeSet(status, {
+      "gone-approved.txt": FileDecisionAction.APPROVE,
+      "gone-rejected.txt": FileDecisionAction.REJECT,
+    });
+    const result = await applyCaptureDecisions({
+      status, gitRoot: ws, executionId: EXEC_ID, changeSet, harnessId: HARNESS,
+      gitWorkspace: false, storage, readBlob,
+    });
+
+    expect(result.failed).toBe(false);
+    expect(result.approvedPaths).toEqual(["gone-approved.txt"]);
+    expect(result.rejectedPaths).toEqual(["gone-rejected.txt"]);
+    // Approved DELETE: the file stays gone. Rejected DELETE: restored byte-exact.
+    await expect(readFile(join(ws, "gone-approved.txt"), "utf-8")).rejects.toThrow();
+    expect(await readFile(join(ws, "gone-rejected.txt"), "utf-8")).toBe("B");
+  });
+
   it("is not a capture turn when neither a git ref nor a CAS manifest exists", async () => {
     const status = newStatus();
     const storage = makeStorage();

package/src/shared/mcp-enabled-tools.ts

@@ -21,8 +21,12 @@
  * identity space as the sub-agent McpAccess filter and the approval-policy
  * maps. An enabled name the server does not expose is warned and dropped
  * (enforce the intersection): the restriction still holds and the run
- * proceeds with the valid subset; apply-time validation against
- * discovered_capabilities is the server-side follow-up that catches typos.
+ * proceeds with the valid subset. The server-side half (issue #402) rejects
+ * such names at apply time once the referenced server has discovered
+ * capabilities (stigmer-server validateEnabledToolsStep /
+ * validateDefaultEnabledToolsStep); this runtime leniency remains the
+ * safety net for manifests applied before a server's first connect and for
+ * toolsets that changed since the last discovery.
  */
 
 /**

package/src/shared/mcp-manager.ts

@@ -73,6 +73,14 @@ export function toMcpClientConfig(
         transport: "http",
         url: server.url,
         headers: server.headers,
+        // Re-establish severed connections (oss#316): when a remote MCP
+        // server restarts mid-execution — the hosted bridge's sessions are
+        // in-memory, so a deploy orphans every live one — the adapter's
+        // onclose hook re-runs initialize, minting a fresh session for
+        // subsequent calls instead of stranding the agent on a dead one.
+        // Covers transport-close only; a session lost with no stream open
+        // still surfaces as a JSON-RPC session-not-found on the next call.
+        reconnect: { enabled: true, maxAttempts: 3, delayMs: 1_000 },
       };
     }
   }

package/src/shared/plan-mode-permissions.ts

@@ -2,12 +2,26 @@
  * The Plan-mode filesystem permission rules — the enforcement twin of
  * `plan-mode-prompt.ts` (which carries the instruction half of the contract).
  *
- * Plan mode is read-only BY CONSTRUCTION on the native harness: these rules
- * deny every filesystem write operation at the tool level so
- * write_file/edit_file cannot mutate the workspace regardless of what the
- * model was told. Rules are first-match-wins with a permissive default, so a
- * single deny-all-writes rule is sufficient. (The Cursor harness has no
- * tool-level lever and enforces plan mode via its prompt prefix instead.)
+ * Plan mode is contained BY CONSTRUCTION on the native harness: these rules
+ * deny every filesystem write everywhere AND scope reads to the session
+ * workspace (issue #528 — owner ruling: the workspace is plan mode's read
+ * boundary on cloud and desktop runners alike). Without the read boundary,
+ * model-provided absolute paths reached anywhere the process account could
+ * read — the pod filesystem (including /proc/self/environ) on cloud runners,
+ * the user's whole home directory on desktop — while plan mode still carries
+ * exfiltration-capable tools (web_fetch, MCP). Rules are first-match-wins
+ * with a permissive default (deepagents' decidePathAccess), so order is
+ * load-bearing: the workspace read-allow must precede the read-deny.
+ *
+ * The workspace-root pattern is matched as a STRING against the raw tool-call
+ * path (micromatch, dot:true), before the backend touches disk. That is
+ * exactly why the legitimate out-of-workspace reads keep working: skills,
+ * attachments, and the approved plan live in the platform dir but are
+ * addressed through the `{workspace}/.stigmer` symlink (see
+ * shared/workspace/stigmer-link.ts), so their path strings are in-root even
+ * though the bytes are not. The same holds for multi-workspace local entries
+ * (`{workspace}/{name}` symlinks). A realpath-based boundary would break
+ * both; do not "harden" this into one.
  *
  * Applied in execute-deep-agent/setup.ts to the parent graph AND threaded
  * into every compiled sub-agent graph: deepagents' parent-permission
@@ -18,9 +32,9 @@
  *
  * Rules travel with a companion: every graph that carries them also installs
  * the path-normalization middleware (middleware/path-normalization.ts,
- * issue #429), because deepagents' rule validation refuses workspace-relative
- * paths outright — without the shim, prompt-compliant relative READS die in
- * validation instead of just working. Both are derived from the same
+ * issues #429/#528), because deepagents' rule validation refuses
+ * workspace-relative paths outright and its `ls`/`glob`/`grep` schema default
+ * of "/" would deny the bare first listing. Both are derived from the same
  * expression at each composition site so they cannot drift apart.
  *
  * Invariant: never combine these rules with a shell-capable (sandbox)
@@ -30,8 +44,41 @@
  * for shell capability on both the parent and sub-agent backends.
  */
 
+import { resolve } from "node:path";
 import type { FilesystemPermission } from "deepagents";
 
-export const PLAN_MODE_PERMISSIONS: FilesystemPermission[] = [
-  { operations: ["write"], paths: ["/**"], mode: "deny" },
-];
+/**
+ * Backslash-escape every character micromatch/picomatch treats as glob
+ * syntax, so the result matches the input literally. micromatch exports no
+ * escape API of its own, and this is correctness, not caution: an unescaped
+ * `(` in a desktop project path would make the workspace read-allow rule
+ * silently never match — bricking every plan-mode read for that workspace.
+ * Semantics are pinned end-to-end through deepagents' own matcher by the
+ * special-character workspace suite in plan-mode-path-normalization.test.ts.
+ */
+export function escapeGlobLiteral(literal: string): string {
+  return literal.replace(/[\\*?()[\]{}!+@]/g, "\\$&");
+}
+
+/**
+ * Build the plan-mode rule set for a graph whose filesystem backend is
+ * rooted at `workspaceRootDir`. The three rules read as the policy:
+ * reads allowed in the workspace, reads denied everywhere else, writes
+ * denied everywhere.
+ *
+ * `{root}/**` matches the root itself as well as its subtree (verified
+ * against the installed micromatch), so one allow pattern suffices. The
+ * root is `path.resolve`d first because enforcement canonicalizes incoming
+ * paths (collapsed slashes, no trailing separator) before matching — a
+ * trailing slash in the pattern would silently match nothing.
+ */
+export function buildPlanModePermissions(
+  workspaceRootDir: string,
+): FilesystemPermission[] {
+  const canonicalRoot = resolve(workspaceRootDir);
+  return [
+    { operations: ["read"], paths: [`${escapeGlobLiteral(canonicalRoot)}/**`] },
+    { operations: ["read"], paths: ["/**"], mode: "deny" },
+    { operations: ["write"], paths: ["/**"], mode: "deny" },
+  ];
+}

package/src/shared/zip-extract.ts

@@ -1,10 +1,24 @@
 /**
- * Minimal, dependency-free ZIP archive parser.
+ * Skill-artifact ZIP extraction: text-decoded entries with non-fatal
+ * structural failure.
  *
- * Handles the local file header format, supporting stored (method 0) and
- * deflated (method 8) entries. Returns parsed entries as path + content
- * pairs — consumers bring their own write mechanism (WorkspaceBackend,
- * node:fs, etc.).
+ * Structural parsing lives in zip-structure.ts (central-directory-based —
+ * see that module's doc for why local-header walks are never acceptable,
+ * issue #450). This module owns the skill-artifact *policy* on top of it:
+ *
+ * Input without a readable central directory is not given a second
+ * chance on purpose: every artifact reaching the runner was validated at
+ * push by a central-directory-based reader on both editions (OSS:
+ * `safearchive/zip` in stigmer-server's skill storage; cloud:
+ * commons-compress `ZipFile` in SkillArtifactExtractor), so a missing
+ * EOCD here can only mean a truncated or corrupted download — and the
+ * honest result for that is the documented empty return, not a guess.
+ * (The attachment injector consumes the same structural layer under the
+ * opposite policy — fail-hard — because its input is untrusted.)
+ *
+ * Handles stored (method 0) and deflated (method 8) entries. Returns
+ * parsed entries as path + content pairs — consumers bring their own
+ * write mechanism (WorkspaceBackend, node:fs, etc.).
  *
  * Extracted from skill-writer.ts so both the deep-agent and Cursor
  * harnesses can share the same ZIP parsing logic without coupling to
@@ -12,6 +26,7 @@
  */
 
 import { createInflateRaw } from "node:zlib";
+import { EOCD_MIN_SIZE, parseZipStructure, type ZipStructuralEntry } from "./zip-structure.js";
 
 // ─── Public API ──────────────────────────────────────────────────────────
 
@@ -29,18 +44,26 @@ export interface ZipFileEntry {
  * entries whose filename (basename or full path) matches any excluded name.
  *
  * Returns an empty array for empty, truncated, or non-ZIP input rather
- * than throwing — callers treat missing artifacts as non-fatal.
+ * than throwing — callers treat missing artifacts as non-fatal. Errors
+ * while *decompressing* a structurally valid entry (corrupt deflate
+ * stream, unsupported compression method) do propagate: at that point
+ * the archive's structure vouched for the entry, and silently dropping
+ * it would be the exact corruption this module exists to prevent.
  */
 export async function extractZipFileEntries(
   zipBytes: Uint8Array,
   options?: { exclude?: readonly string[] },
 ): Promise<ZipFileEntry[]> {
-  if (zipBytes.length < 4) return [];
+  if (zipBytes.length < EOCD_MIN_SIZE) return [];
 
-  let entries: ZipEntry[];
+  let entries: ZipStructuralEntry[];
   try {
-    entries = parseZipEntries(zipBytes);
-  } catch {
+    entries = parseZipStructure(zipBytes);
+  } catch (err) {
+    console.warn(
+      "[zip-extract] archive has no readable central directory " +
+      `(truncated or corrupt download?): ${err instanceof Error ? err.message : String(err)}`,
+    );
     return [];
   }
 
@@ -58,16 +81,6 @@ export async function extractZipFileEntries(
   return results;
 }
 
-// ─── Internals ───────────────────────────────────────────────────────────
-
-interface ZipEntry {
-  name: string;
-  isDirectory: boolean;
-  compressedData: Uint8Array;
-  compressionMethod: number;
-  uncompressedSize: number;
-}
-
 function isExcluded(name: string, excludeSet: ReadonlySet<string>): boolean {
   if (excludeSet.size === 0) return false;
   if (excludeSet.has(name)) return true;
@@ -76,104 +89,9 @@ function isExcluded(name: string, excludeSet: ReadonlySet<string>): boolean {
   return excludeSet.has(basename);
 }
 
-function parseZipEntries(data: Uint8Array): ZipEntry[] {
-  const entries: ZipEntry[] = [];
-  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
-  let offset = 0;
-
-  while (offset < data.length - 4) {
-    const signature = view.getUint32(offset, true);
-    if (signature !== 0x04034b50) break; // Local file header signature
-
-    const generalFlags = view.getUint16(offset + 6, true);
-    const hasDataDescriptor = (generalFlags & 0x08) !== 0;
-    const compressionMethod = view.getUint16(offset + 8, true);
-    let compressedSize = view.getUint32(offset + 18, true);
-    let uncompressedSize = view.getUint32(offset + 22, true);
-    const fileNameLength = view.getUint16(offset + 26, true);
-    const extraFieldLength = view.getUint16(offset + 28, true);
-
-    const fileNameStart = offset + 30;
-    const fileName = new TextDecoder().decode(
-      data.subarray(fileNameStart, fileNameStart + fileNameLength),
-    );
-
-    const dataStart = fileNameStart + fileNameLength + extraFieldLength;
-
-    if (hasDataDescriptor && compressedSize === 0) {
-      const sizes = findDataDescriptor(data, view, dataStart, compressionMethod);
-      compressedSize = sizes.compressedSize;
-      uncompressedSize = sizes.uncompressedSize;
-    }
-
-    const compressedData = data.subarray(dataStart, dataStart + compressedSize);
-
-    entries.push({
-      name: fileName,
-      isDirectory: fileName.endsWith("/"),
-      compressedData,
-      compressionMethod,
-      uncompressedSize,
-    });
-
-    let nextOffset = dataStart + compressedSize;
-    if (hasDataDescriptor) {
-      if (nextOffset + 4 <= data.length && view.getUint32(nextOffset, true) === 0x08074b50) {
-        nextOffset += 16; // signature(4) + crc(4) + compressedSize(4) + uncompressedSize(4)
-      } else {
-        nextOffset += 12; // crc(4) + compressedSize(4) + uncompressedSize(4)
-      }
-    }
-    offset = nextOffset;
-  }
-
-  return entries;
-}
-
-/**
- * Scan forward from dataStart to find the data descriptor that contains
- * the actual compressed and uncompressed sizes. Looks for either the
- * optional signature 0x08074b50 or falls back to scanning the central
- * directory for the matching entry.
- */
-function findDataDescriptor(
-  data: Uint8Array,
-  view: DataView,
-  dataStart: number,
-  _compressionMethod: number,
-): { compressedSize: number; uncompressedSize: number } {
-  for (let pos = dataStart; pos < data.length - 16; pos++) {
-    const sig = view.getUint32(pos, true);
-    if (sig === 0x08074b50) {
-      return {
-        compressedSize: view.getUint32(pos + 8, true),
-        uncompressedSize: view.getUint32(pos + 12, true),
-      };
-    }
-    if (sig === 0x04034b50 || sig === 0x02014b50) {
-      const descStart = pos - 12;
-      if (descStart >= dataStart) {
-        return {
-          compressedSize: view.getUint32(descStart + 4, true),
-          uncompressedSize: view.getUint32(descStart + 8, true),
-        };
-      }
-      break;
-    }
-  }
-  for (let pos = dataStart; pos < data.length - 4; pos++) {
-    const sig = view.getUint32(pos, true);
-    if (sig === 0x04034b50 || sig === 0x02014b50 || sig === 0x08074b50) {
-      const compressedSize = sig === 0x08074b50
-        ? view.getUint32(pos + 8, true)
-        : pos - dataStart;
-      return { compressedSize, uncompressedSize: 0 };
-    }
-  }
-  return { compressedSize: data.length - dataStart, uncompressedSize: 0 };
-}
+// ─── Decompression ───────────────────────────────────────────────────────
 
-async function decompressEntry(entry: ZipEntry): Promise<string> {
+async function decompressEntry(entry: ZipStructuralEntry): Promise<string> {
   if (entry.compressionMethod === 0) {
     return new TextDecoder().decode(entry.compressedData);
   }

package/src/shared/zip-structure.ts

@@ -0,0 +1,181 @@
+/**
+ * Policy-free structural ZIP parsing: end-of-central-directory (EOCD)
+ * location plus central-directory walk, producing one record per entry.
+ *
+ * Parsing is *central-directory-based* — never a front-to-back walk of
+ * local file headers. This is a correctness decision, not a style choice
+ * (issues #450 and #567): local headers of streaming entries
+ * (general-purpose flag bit 3) carry zeroed sizes, and the only
+ * local-only way to recover them is scanning the payload for the
+ * data-descriptor signature — which silently truncates any stored entry
+ * whose *content* happens to contain those four bytes, and
+ * desynchronizes every entry after it. The central directory always
+ * carries the real sizes, and every consumer here holds the complete
+ * archive bytes, so nothing a local-header walk could offer is needed.
+ *
+ * This layer maps bytes to entry records and nothing else. Policy — what
+ * a structural failure means, which entries are acceptable, how payloads
+ * are decoded — belongs to the consumers, and they differ on purpose:
+ *
+ *   - shared/zip-extract.ts (skill artifacts): structural failure is
+ *     NON-FATAL — both editions' push gates validated every artifact
+ *     with a central-directory-based reader before storage, so a defect
+ *     here can only be a truncated or corrupted download.
+ *   - execute-deep-agent/attachment-injector.ts (user attachments):
+ *     structural failure is FAIL-HARD — the input is an untrusted
+ *     upload and nothing upstream vouched for it.
+ *
+ * ZIP64 is deliberately unsupported: both consumers cap input far below
+ * every ZIP64 threshold (skill push gates: 100MB / 10,000 files;
+ * attachment uploads: 10MB).
+ *
+ * Throws plain `Error`s on structural defects (no valid EOCD, a central
+ * directory or local header record that does not parse, a payload slice
+ * that runs past the end of the buffer); consumers translate those into
+ * their own error models.
+ */
+
+// ─── Entry records ───────────────────────────────────────────────────────
+
+export interface ZipStructuralEntry {
+  /** Entry path exactly as recorded in the central directory. */
+  readonly name: string;
+  readonly isDirectory: boolean;
+  readonly compressionMethod: number;
+  /**
+   * The central directory's declared uncompressed size — authoritative for
+   * pre-extraction accounting (e.g. ZIP-bomb budgeting), but still a
+   * *declaration*: a consumer that distrusts its input must enforce it
+   * against the actual decompressed output.
+   */
+  readonly uncompressedSize: number;
+  /** The entry's raw payload slice (a view, not a copy) of the archive buffer. */
+  readonly compressedData: Uint8Array;
+}
+
+// ─── Format constants ────────────────────────────────────────────────────
+
+const LOCAL_FILE_HEADER_SIG = 0x04034b50;
+const CENTRAL_DIRECTORY_SIG = 0x02014b50;
+const EOCD_SIG = 0x06054b50;
+
+/** Fixed size of the EOCD record, excluding the variable-length comment. */
+export const EOCD_MIN_SIZE = 22;
+/** The archive comment length is a u16, so the EOCD sits within the last 64KB + 22 bytes. */
+const EOCD_MAX_COMMENT = 0xffff;
+
+const LOCAL_HEADER_SIZE = 30;
+const CD_RECORD_SIZE = 46;
+
+// ─── Parsing ─────────────────────────────────────────────────────────────
+
+/**
+ * Enumerate the archive's entries from its central directory.
+ *
+ * Throws on any structural defect: no valid EOCD, a central directory or
+ * local header record that doesn't parse, or a payload slice that runs
+ * past the end of the buffer.
+ */
+export function parseZipStructure(data: Uint8Array): ZipStructuralEntry[] {
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  const eocd = findEndOfCentralDirectory(data, view);
+
+  const entries: ZipStructuralEntry[] = [];
+  let offset = eocd.centralDirectoryOffset;
+
+  for (let i = 0; i < eocd.entryCount; i++) {
+    if (offset + CD_RECORD_SIZE > data.length || view.getUint32(offset, true) !== CENTRAL_DIRECTORY_SIG) {
+      throw new Error(`invalid central directory record at offset ${offset}`);
+    }
+
+    const compressionMethod = view.getUint16(offset + 10, true);
+    const compressedSize = view.getUint32(offset + 20, true);
+    const uncompressedSize = view.getUint32(offset + 24, true);
+    const fileNameLength = view.getUint16(offset + 28, true);
+    const extraFieldLength = view.getUint16(offset + 30, true);
+    const commentLength = view.getUint16(offset + 32, true);
+    const localHeaderOffset = view.getUint32(offset + 42, true);
+
+    const fileName = new TextDecoder().decode(
+      data.subarray(offset + CD_RECORD_SIZE, offset + CD_RECORD_SIZE + fileNameLength),
+    );
+
+    // The local header is consulted for one thing only: the payload start.
+    // Its name/extra field lengths can legitimately differ from the central
+    // directory's (streaming writers pad the extra field), so the offset
+    // cannot be derived from CD fields alone.
+    const dataStart = payloadStart(data, view, localHeaderOffset, fileName);
+    if (dataStart + compressedSize > data.length) {
+      throw new Error(`entry "${fileName}" payload runs past end of archive`);
+    }
+
+    entries.push({
+      name: fileName,
+      isDirectory: fileName.endsWith("/"),
+      compressionMethod,
+      uncompressedSize,
+      compressedData: data.subarray(dataStart, dataStart + compressedSize),
+    });
+
+    offset += CD_RECORD_SIZE + fileNameLength + extraFieldLength + commentLength;
+  }
+
+  return entries;
+}
+
+interface EndOfCentralDirectory {
+  centralDirectoryOffset: number;
+  entryCount: number;
+}
+
+/**
+ * Locate and validate the end-of-central-directory record.
+ *
+ * Scans backward from the end of the archive across the maximum comment
+ * span. A signature match alone is not trusted (the four bytes can occur
+ * inside a trailing comment): the record must also point at an offset
+ * that actually holds a central directory record, or be a genuinely
+ * empty archive.
+ */
+function findEndOfCentralDirectory(data: Uint8Array, view: DataView): EndOfCentralDirectory {
+  const scanFloor = Math.max(0, data.length - EOCD_MIN_SIZE - EOCD_MAX_COMMENT);
+
+  for (let pos = data.length - EOCD_MIN_SIZE; pos >= scanFloor; pos--) {
+    if (view.getUint32(pos, true) !== EOCD_SIG) continue;
+
+    const entryCount = view.getUint16(pos + 10, true);
+    const centralDirectorySize = view.getUint32(pos + 12, true);
+    const centralDirectoryOffset = view.getUint32(pos + 16, true);
+
+    const directoryEndsAtRecord = centralDirectoryOffset + centralDirectorySize <= pos;
+    const directoryLooksReal =
+      entryCount === 0 ||
+      (centralDirectoryOffset + 4 <= data.length &&
+        view.getUint32(centralDirectoryOffset, true) === CENTRAL_DIRECTORY_SIG);
+
+    if (directoryEndsAtRecord && directoryLooksReal) {
+      return { centralDirectoryOffset, entryCount };
+    }
+  }
+
+  throw new Error("no end-of-central-directory record found");
+}
+
+/** Resolve where an entry's payload begins, from its local file header. */
+function payloadStart(
+  data: Uint8Array,
+  view: DataView,
+  localHeaderOffset: number,
+  fileName: string,
+): number {
+  if (
+    localHeaderOffset + LOCAL_HEADER_SIZE > data.length ||
+    view.getUint32(localHeaderOffset, true) !== LOCAL_FILE_HEADER_SIG
+  ) {
+    throw new Error(`entry "${fileName}" has no local file header at offset ${localHeaderOffset}`);
+  }
+
+  const localNameLength = view.getUint16(localHeaderOffset + 26, true);
+  const localExtraLength = view.getUint16(localHeaderOffset + 28, true);
+  return localHeaderOffset + LOCAL_HEADER_SIZE + localNameLength + localExtraLength;
+}