@validate.qa/runner 1.0.102 → 1.0.104

package/dist/run-write-guard.mjs

@@ -1,8 +1,8 @@
 import {
   require_run_write_guard
-} from "./chunk-4WLP3RWN.mjs";
-import "./chunk-E2RRAE27.mjs";
-import "./chunk-3JM6XTSZ.mjs";
+} from "./chunk-TGVKABFN.mjs";
+import "./chunk-UZ67UBXH.mjs";
+import "./chunk-EKY6CN4Y.mjs";
 import {
   __toESM
 } from "./chunk-WQXBGQU4.mjs";

package/dist/tar-extract-child.js

@@ -6739,7 +6739,13 @@ var require_tar_isolated = __commonJS({
     }
     async function extractZipIsolated(archivePath, destDir, options) {
       try {
-        await runTarJobIsolated({ op: "extract-zip", archivePath: (0, node_path_1.resolve)(archivePath), destDir: (0, node_path_1.resolve)(destDir) }, options.subject, options);
+        const job = {
+          op: "extract-zip",
+          archivePath: (0, node_path_1.resolve)(archivePath),
+          destDir: (0, node_path_1.resolve)(destDir),
+          ...options.oversizeFiles ? { oversizeFiles: options.oversizeFiles } : {}
+        };
+        await runTarJobIsolated(job, options.subject, options);
       } catch (err) {
         if (err instanceof TarIsolationUnavailableError)
           throw refuseUnavailable(err, options.subject, options.log);
@@ -6817,7 +6823,7 @@ var require_repo_acquire = __commonJS({
       return mod && mod.__esModule ? mod : { "default": mod };
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ARCHIVE_TOO_LARGE_RE = exports2.MAX_ZIP_TOTAL_BYTES = exports2.MAX_ZIP_FILE_BYTES = exports2.MAX_ZIP_ENTRIES = exports2.MAX_ARCHIVE_BYTES = void 0;
+    exports2.ARCHIVE_TOO_LARGE_RE = exports2.REPO_TARBALL_LIMITS = exports2.MAX_ZIP_TOTAL_BYTES = exports2.MAX_ZIP_FILE_BYTES = exports2.MAX_ZIP_ENTRIES = exports2.MAX_ARCHIVE_BYTES = void 0;
     exports2.acquireRepoForImport = acquireRepoForImport;
     exports2.downloadArchiveCapped = downloadArchiveCapped;
     exports2.formatArchiveCap = formatArchiveCap;
@@ -6843,6 +6849,7 @@ var require_repo_acquire = __commonJS({
     exports2.MAX_ZIP_ENTRIES = 2e4;
     exports2.MAX_ZIP_FILE_BYTES = 50 * 1024 * 1024;
     exports2.MAX_ZIP_TOTAL_BYTES = 600 * 1024 * 1024;
+    exports2.REPO_TARBALL_LIMITS = { maxEntries: 2e5, maxFileBytes: exports2.MAX_ZIP_FILE_BYTES, maxTotalBytes: exports2.MAX_ZIP_TOTAL_BYTES, oversizeFiles: "skip" };
     function envGithubTokenForImports() {
       const optedIn = ["1", "true", "yes", "on"].includes(String(process.env.RUNNER_IMPORT_ENV_GITHUB_TOKEN ?? "").trim().toLowerCase());
       if (!optedIn)
@@ -6886,7 +6893,14 @@ var require_repo_acquire = __commonJS({
           extractRoot,
           /* strip */
           1,
-          { subject: "repository archive", onUnavailable: "in-process", log, signal: spec.signal, tenantKey: spec.projectId }
+          {
+            subject: "repository archive",
+            onUnavailable: "in-process",
+            log,
+            signal: spec.signal,
+            tenantKey: spec.projectId,
+            limits: { ...exports2.REPO_TARBALL_LIMITS }
+          }
         );
         await (0, promises_1.rm)(tarPath, { force: true }).catch(noop);
         log(`[repo-acquire] extracted github tarball (${archiveBytes} bytes)`);
@@ -6909,7 +6923,8 @@ var require_repo_acquire = __commonJS({
               log,
               signal: spec.signal,
               tenantKey: spec.projectId,
-              hint: "Check it is a valid .tar.gz, or upload it as a .zip."
+              hint: "Check it is a valid .tar.gz, or upload it as a .zip.",
+              limits: { ...exports2.REPO_TARBALL_LIMITS }
             }
           );
         } else if (kind === "zip") {
@@ -6918,7 +6933,8 @@ var require_repo_acquire = __commonJS({
             log,
             signal: spec.signal,
             tenantKey: spec.projectId,
-            hint: "Check it is a valid .zip, or upload it as a .tar.gz."
+            hint: "Check it is a valid .zip, or upload it as a .tar.gz.",
+            oversizeFiles: exports2.REPO_TARBALL_LIMITS.oversizeFiles
           });
         } else {
           await (0, promises_1.rm)(archivePath, { force: true }).catch(noop);
@@ -7128,7 +7144,7 @@ var require_repo_acquire = __commonJS({
           bad = new Error(`Tar entry path contains a NUL byte: ${JSON.stringify(shownPath)}`);
         } else if (typeof size !== "number" || !Number.isSafeInteger(size) || size < 0 || size > MAX_OCTAL_TAR_SIZE) {
           bad = new Error(`Tar entry has an invalid size field: ${shownPath}`);
-        } else if (size > limits.maxFileBytes) {
+        } else if (size > limits.maxFileBytes && limits.oversizeFiles !== "skip") {
           bad = new Error(`Tar entry too large: ${shownPath} (declared ${size} bytes > ${limits.maxFileBytes} cap)`);
         } else if ((declaredTotal += size) > limits.maxTotalBytes) {
           bad = new Error(`Tar total uncompressed size exceeds ${limits.maxTotalBytes} cap (tar-bomb guard)`);
@@ -7195,7 +7211,8 @@ var require_repo_acquire = __commonJS({
             return false;
           }
           const sz = Number(entry.size ?? 0);
-          if (sz > limits.maxFileBytes) {
+          const oversize = sz > limits.maxFileBytes;
+          if (oversize && limits.oversizeFiles !== "skip") {
             capError = new Error(`Tar entry too large: ${p} (declared ${sz} bytes > ${limits.maxFileBytes} cap)`);
             return false;
           }
@@ -7204,13 +7221,13 @@ var require_repo_acquire = __commonJS({
             capError = new Error(`Tar total uncompressed size exceeds ${limits.maxTotalBytes} cap (tar-bomb guard)`);
             return false;
           }
-          return true;
+          return !oversize;
         }
       }));
       if (capError)
         throw capError;
     }
-    async function extractZipSafely(buf, destDir, log = noop) {
+    async function extractZipSafely(buf, destDir, log = noop, options = {}) {
       const zip = new adm_zip_1.default(buf);
       const entries = zip.getEntries();
       if (entries.length > exports2.MAX_ZIP_ENTRIES) {
@@ -7219,6 +7236,7 @@ var require_repo_acquire = __commonJS({
       const destResolved = (0, node_path_1.resolve)(destDir);
       let total = 0;
       let files = 0;
+      let skipped = 0;
       for (const entry of entries) {
         const name = entry.entryName;
         if (isUnsafeEntryName(name)) {
@@ -7233,12 +7251,18 @@ var require_repo_acquire = __commonJS({
           continue;
         }
         const declared = entry.header?.size ?? 0;
-        if (declared > exports2.MAX_ZIP_FILE_BYTES) {
-          throw new Error(`Zip entry too large: ${name} (declared ${declared} bytes > ${exports2.MAX_ZIP_FILE_BYTES} cap)`);
-        }
         if (total + declared > exports2.MAX_ZIP_TOTAL_BYTES) {
           throw new Error(`Zip total uncompressed size exceeds ${exports2.MAX_ZIP_TOTAL_BYTES} cap (zip-bomb guard)`);
         }
+        if (declared > exports2.MAX_ZIP_FILE_BYTES && options.oversizeFiles !== "skip") {
+          throw new Error(`Zip entry too large: ${name} (declared ${declared} bytes > ${exports2.MAX_ZIP_FILE_BYTES} cap)`);
+        }
+        if (declared > exports2.MAX_ZIP_FILE_BYTES) {
+          total += declared;
+          skipped++;
+          log(`[repo-acquire] zip: skipped ${name} (declared ${declared} bytes > ${exports2.MAX_ZIP_FILE_BYTES} per-file cap)`);
+          continue;
+        }
         const data = entry.getData();
         if (data.length > exports2.MAX_ZIP_FILE_BYTES) {
           throw new Error(`Zip entry too large: ${name} (${data.length} bytes > ${exports2.MAX_ZIP_FILE_BYTES} cap)`);
@@ -7251,7 +7275,7 @@ var require_repo_acquire = __commonJS({
         await (0, promises_1.writeFile)(target, data);
         files++;
       }
-      log(`[repo-acquire] zip extracted: ${files} file(s), ${total} bytes`);
+      log(`[repo-acquire] zip extracted: ${files} file(s), ${total} bytes${skipped ? `, ${skipped} oversize file(s) skipped` : ""}`);
     }
     async function normalizeRepoRoot(extractRoot) {
       let entries;
@@ -7558,7 +7582,7 @@ var require_tar_extract_child = __commonJS({
           return { ok: true };
         case "extract-zip": {
           const logs = [];
-          await (0, repo_acquire_js_1.extractZipSafely)(await (0, promises_1.readFile)(job.archivePath), job.destDir, (line) => logs.push(line));
+          await (0, repo_acquire_js_1.extractZipSafely)(await (0, promises_1.readFile)(job.archivePath), job.destDir, (line) => logs.push(line), { oversizeFiles: job.oversizeFiles });
           return { ok: true, logs };
         }
         case "slim":

package/dist/tar-extract-child.mjs

@@ -2,7 +2,7 @@ import {
   require_repo_acquire,
   require_repo_snapshot_slim,
   require_tar_isolated
-} from "./chunk-AAUHXGDS.mjs";
+} from "./chunk-PUMRAFJS.mjs";
 import {
   __commonJS,
   __require,
@@ -80,7 +80,7 @@ var require_tar_extract_child = __commonJS({
           return { ok: true };
         case "extract-zip": {
           const logs = [];
-          await (0, repo_acquire_js_1.extractZipSafely)(await (0, promises_1.readFile)(job.archivePath), job.destDir, (line) => logs.push(line));
+          await (0, repo_acquire_js_1.extractZipSafely)(await (0, promises_1.readFile)(job.archivePath), job.destDir, (line) => logs.push(line), { oversizeFiles: job.oversizeFiles });
           return { ok: true, logs };
         }
         case "slim":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.102",
+  "version": "1.0.104",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"
@@ -9,8 +9,9 @@
     "build": "tsup",
     "dev": "tsx src/cli.ts",
     "lint": "eslint .",
-    "test": "node --import tsx --test src/supervisor-child-argv.test.ts src/audit-scrub.test.ts src/retry-on-429.test.ts src/version-check.test.ts src/poll-interval.test.ts src/node-version-notice.test.ts src/services/auth-state.test.ts src/run-no-longer-active.test.ts src/mode-abort-no-verdict.test.ts src/discovery-render-type.test.ts src/batch-heal-no-start.test.ts src/heartbeat-active-runs.test.ts src/result-post-structure-413.test.ts src/result-shed-routes-413.test.ts src/result-post-retry.test.ts src/result-media-stale-epoch.test.ts src/run-write-guard-bundle.test.ts src/spec-driver-bundle.test.ts src/mcp-servers-bundle.test.ts src/codex-files-mcp-server-bundle.test.ts src/claim-nonce-not-logged.test.ts src/sign-in-capture.test.ts src/run-status-verdicts.test.ts src/sign-in-failure.test.ts src/mobile-ui-path-succeeded.test.ts src/supervisor-policy.test.ts src/login-check.test.ts src/heal-post-lost-ack.test.ts src/ui-heal-result-video.test.ts src/heal-log-stream-chunks.test.ts src/shutdown-claim-window.test.ts src/result-post-redeploy-budget.test.ts src/shutdown-signals.test.ts",
+    "test": "node --import tsx --test src/supervisor-child-argv.test.ts src/audit-scrub.test.ts src/retry-on-429.test.ts src/version-check.test.ts src/runner-upgrade-exit.test.ts src/poll-interval.test.ts src/node-version-notice.test.ts src/services/auth-state.test.ts src/run-no-longer-active.test.ts src/mode-abort-no-verdict.test.ts src/discovery-render-type.test.ts src/batch-heal-no-start.test.ts src/heartbeat-active-runs.test.ts src/result-post-structure-413.test.ts src/result-shed-routes-413.test.ts src/result-post-retry.test.ts src/result-media-stale-epoch.test.ts src/run-write-guard-bundle.test.ts src/run-write-guard-bundle-skip.test.ts src/spec-driver-bundle.test.ts src/mcp-servers-bundle.test.ts src/codex-files-mcp-server-bundle.test.ts src/claim-nonce-not-logged.test.ts src/sign-in-capture.test.ts src/run-status-verdicts.test.ts src/sign-in-failure.test.ts src/mobile-ui-path-succeeded.test.ts src/supervisor-policy.test.ts src/login-check.test.ts src/config-permissions.test.ts src/heal-post-lost-ack.test.ts src/ui-heal-result-video.test.ts src/heal-log-stream-chunks.test.ts src/shutdown-claim-window.test.ts src/result-post-redeploy-budget.test.ts src/shutdown-signals.test.ts src/sign-in-detect.test.ts src/no-credentials-help.test.ts src/resolve-credentials.test.ts src/sign-in-url.test.ts src/status-check.test.ts src/status-exit-code.test.ts src/services/doctor-web.test.ts src/browser-pool-failure.test.ts src/login-check-wrong-server.test.ts src/login-wrong-server-cli.test.ts src/start-wrong-server-cli.test.ts src/plaintext-server-warning.test.ts",
     "test:mobile": "node --import tsx --test --test-concurrency=2 src/runner.mobile-ai-env.test.ts src/runner.mobile-heal-audit-wiring.test.ts src/mobile-device-queue.test.ts src/device-lease.test.ts src/runner-watchdog.test.ts src/result-payload-budget.test.ts src/result-media-upload.test.ts src/services/appium-*.test.ts src/services/*mobile*.test.ts src/services/mobile/*.test.ts",
+    "test:browser": "RUN_BROWSER_TESTS=1 PLAYWRIGHT_HEADLESS=true node --import tsx --test src/sign-in-prove.browser.ts",
     "smoke:installed": "node scripts/installed-run-smoke.mjs",
     "check:packed-mcp": "node scripts/packed-install-check.mjs",
     "prepublishOnly": "npm run build"

package/dist/dist-52M5RDZ6.mjs

@@ -1,17 +0,0 @@
-import {
-  require_dist
-} from "./chunk-DN3O6EYT.mjs";
-import "./chunk-AAUHXGDS.mjs";
-import "./chunk-EXRFHATN.mjs";
-import "./chunk-ZZYBRIBT.mjs";
-import "./chunk-BXLEPT4M.mjs";
-import "./chunk-5DFBEL72.mjs";
-import "./chunk-CBVHPYVJ.mjs";
-import "./chunk-HJ6FKHMM.mjs";
-import "./chunk-PWFWMVZU.mjs";
-import "./chunk-E2VEMBQQ.mjs";
-import "./chunk-4WLP3RWN.mjs";
-import "./chunk-E2RRAE27.mjs";
-import "./chunk-3JM6XTSZ.mjs";
-import "./chunk-WQXBGQU4.mjs";
-export default require_dist();