@westbayberry/dg 2.3.2 → 2.3.4

package/dist/state/cleanup-registry.js

@@ -1,7 +1,12 @@
 import { renameSync } from "node:fs";
 import { rename } from "node:fs/promises";
 import { JsonStoreError, readJsonFile, writeJsonFileAtomic } from "./store.js";
-import { acquireLock, CLEANUP_REGISTRY_LOCK } from "./locks.js";
+import { acquireLockWithRetry, CLEANUP_REGISTRY_LOCK } from "./locks.js";
+// Match the stale window the sync setup/uninstall callers pass; without staleMs
+// the stale-lock takeover is disabled and a crashed holder whose PID was reused
+// (classified "alive") wedges hook install/uninstall forever.
+const CLEANUP_REGISTRY_LOCK_STALE_MS = 30 * 60 * 1000;
+const CLEANUP_REGISTRY_LOCK_TIMEOUT_MS = 5_000;
 export function emptyCleanupRegistry() {
     return {
         version: 1,
@@ -37,7 +42,10 @@ export async function writeCleanupRegistry(paths, registry) {
     await writeJsonFileAtomic(paths.cleanupRegistryPath, registry);
 }
 export async function recordCleanupEntry(paths, entry) {
-    const lock = await acquireLock(paths, CLEANUP_REGISTRY_LOCK);
+    const lock = await acquireLockWithRetry(paths, CLEANUP_REGISTRY_LOCK, {
+        staleMs: CLEANUP_REGISTRY_LOCK_STALE_MS,
+        timeoutMs: CLEANUP_REGISTRY_LOCK_TIMEOUT_MS
+    });
     try {
         const { registry } = await loadCleanupRegistry(paths);
         const nextEntry = {
@@ -58,7 +66,10 @@ export async function recordCleanupEntry(paths, entry) {
     }
 }
 export async function removeCleanupEntry(paths, target) {
-    const lock = await acquireLock(paths, CLEANUP_REGISTRY_LOCK);
+    const lock = await acquireLockWithRetry(paths, CLEANUP_REGISTRY_LOCK, {
+        staleMs: CLEANUP_REGISTRY_LOCK_STALE_MS,
+        timeoutMs: CLEANUP_REGISTRY_LOCK_TIMEOUT_MS
+    });
     try {
         const { registry } = await loadCleanupRegistry(paths);
         const next = {

package/dist/state/cooldown-held.js

@@ -1,7 +1,11 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { writeJsonAtomic } from "../util/json-file.js";
+import { acquireLockSyncWithRetry } from "./locks.js";
 import { resolveDgPaths } from "./paths.js";
+export const COOLDOWN_HELD_LOCK = "cooldown-held";
+const COOLDOWN_HELD_LOCK_TIMEOUT_MS = 5_000;
+const COOLDOWN_HELD_LOCK_STALE_MS = 60_000;
 export const HELD_PACKAGES_CAP = 500;
 export const UNKNOWN_ELIGIBILITY_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 export function heldPackagesPath(env = process.env) {
@@ -50,17 +54,36 @@ export function readHeldPackages(env = process.env, now = new Date()) {
 }
 export function recordHeldPackage(entry, env = process.env, now = new Date()) {
     const path = heldPackagesPath(env);
-    const nowIso = now.toISOString();
-    const existing = prune(readDocument(path), now);
-    const key = heldKey(entry);
-    const previous = existing.find((candidate) => heldKey(candidate) === key);
-    const updated = {
-        ...entry,
-        firstSeenAt: previous?.firstSeenAt ?? nowIso,
-        lastSeenAt: nowIso
-    };
-    const merged = [...existing.filter((candidate) => heldKey(candidate) !== key), updated]
-        .sort((left, right) => right.lastSeenAt.localeCompare(left.lastSeenAt))
-        .slice(0, HELD_PACKAGES_CAP);
-    writeJsonAtomic(path, { schemaVersion: 1, entries: merged });
+    // Serialize the read-modify-write so concurrent installs don't clobber each
+    // other's held-package records (last-writer-wins drops entries). Recording is
+    // best-effort UX, so a contended/stale lock falls back to an unlocked write
+    // rather than failing the install.
+    let lock;
+    try {
+        lock = acquireLockSyncWithRetry(resolveDgPaths(env), COOLDOWN_HELD_LOCK, {
+            staleMs: COOLDOWN_HELD_LOCK_STALE_MS,
+            timeoutMs: COOLDOWN_HELD_LOCK_TIMEOUT_MS
+        });
+    }
+    catch {
+        lock = undefined;
+    }
+    try {
+        const nowIso = now.toISOString();
+        const existing = prune(readDocument(path), now);
+        const key = heldKey(entry);
+        const previous = existing.find((candidate) => heldKey(candidate) === key);
+        const updated = {
+            ...entry,
+            firstSeenAt: previous?.firstSeenAt ?? nowIso,
+            lastSeenAt: nowIso
+        };
+        const merged = [...existing.filter((candidate) => heldKey(candidate) !== key), updated]
+            .sort((left, right) => right.lastSeenAt.localeCompare(left.lastSeenAt))
+            .slice(0, HELD_PACKAGES_CAP);
+        writeJsonAtomic(path, { schemaVersion: 1, entries: merged });
+    }
+    finally {
+        lock?.release();
+    }
 }

package/dist/state/locks.js

@@ -1,8 +1,11 @@
-import { closeSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
+import { randomBytes } from "node:crypto";
+import { closeSync, linkSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { link, mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
 import { join } from "node:path";
 export const CLEANUP_REGISTRY_LOCK = "cleanup-registry";
 let takeoverCounter = 0;
+let createCounter = 0;
+let reclaimCounter = 0;
 function isErrno(error, code) {
     return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
@@ -21,26 +24,39 @@ export async function acquireLock(paths, name, options = {}) {
         mode: 0o700
     });
     const path = join(paths.locksDir, `${name}.lock`);
-    await removeStaleLock(path, options);
-    let handle;
+    const reclaim = await acquireReclaimLock(path);
     try {
-        handle = await open(path, "wx", 0o600);
-    }
-    catch (error) {
-        if (isErrno(error, "EEXIST")) {
-            throw new LockBusyError(path);
+        await removeStaleLock(path, options);
+        const metadata = {
+            pid: process.pid,
+            acquiredAt: (options.now ?? new Date()).toISOString()
+        };
+        // Write the metadata to a temp file, then atomically claim the lock by linking
+        // it onto the final path (fails EEXIST if held). The lock therefore never
+        // exists empty, so a concurrent reader can't mis-classify a just-created lock
+        // as corrupt/stale and wedge or steal it.
+        const tmpPath = `${path}.new-${process.pid}-${++createCounter}`;
+        const handle = await open(tmpPath, "wx", 0o600);
+        try {
+            await handle.writeFile(`${JSON.stringify(metadata)}\n`, "utf8");
         }
-        throw error;
-    }
-    const metadata = {
-        pid: process.pid,
-        acquiredAt: (options.now ?? new Date()).toISOString()
-    };
-    try {
-        await handle.writeFile(`${JSON.stringify(metadata)}\n`, "utf8");
+        finally {
+            await handle.close();
+        }
+        try {
+            await link(tmpPath, path);
+        }
+        catch (error) {
+            await rm(tmpPath, { force: true });
+            if (isErrno(error, "EEXIST")) {
+                throw new LockBusyError(path);
+            }
+            throw error;
+        }
+        await rm(tmpPath, { force: true });
     }
     finally {
-        await handle.close();
+        await releaseReclaimLock(path, reclaim);
     }
     return {
         name,
@@ -59,26 +75,36 @@ export function acquireLockSync(paths, name, options = {}) {
         mode: 0o700
     });
     const path = join(paths.locksDir, `${name}.lock`);
-    removeStaleLockSync(path, options);
-    let fd;
+    const reclaim = acquireReclaimLockSync(path);
     try {
-        fd = openSync(path, "wx", 0o600);
-    }
-    catch (error) {
-        if (isErrno(error, "EEXIST")) {
-            throw new LockBusyError(path);
+        removeStaleLockSync(path, options);
+        const metadata = {
+            pid: process.pid,
+            acquiredAt: (options.now ?? new Date()).toISOString()
+        };
+        // Atomic claim via temp + link, so the lock is never observable empty.
+        const tmpPath = `${path}.new-${process.pid}-${++createCounter}`;
+        const fd = openSync(tmpPath, "wx", 0o600);
+        try {
+            writeFileSync(fd, `${JSON.stringify(metadata)}\n`, "utf8");
         }
-        throw error;
-    }
-    const metadata = {
-        pid: process.pid,
-        acquiredAt: (options.now ?? new Date()).toISOString()
-    };
-    try {
-        writeFileSync(fd, `${JSON.stringify(metadata)}\n`, "utf8");
+        finally {
+            closeSync(fd);
+        }
+        try {
+            linkSync(tmpPath, path);
+        }
+        catch (error) {
+            rmSync(tmpPath, { force: true });
+            if (isErrno(error, "EEXIST")) {
+                throw new LockBusyError(path);
+            }
+            throw error;
+        }
+        rmSync(tmpPath, { force: true });
     }
     finally {
-        closeSync(fd);
+        releaseReclaimLockSync(path, reclaim);
     }
     return {
         name,
@@ -115,6 +141,27 @@ export function acquireLockSyncWithRetry(paths, name, options = {}) {
 function sleepSync(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
+export async function acquireLockWithRetry(paths, name, options = {}) {
+    const deadline = Date.now() + (options.timeoutMs ?? 5_000);
+    const acquireOptions = {
+        ...(options.staleMs !== undefined ? { staleMs: options.staleMs } : {}),
+        ...(options.now !== undefined ? { now: options.now } : {})
+    };
+    for (;;) {
+        try {
+            return await acquireLock(paths, name, acquireOptions);
+        }
+        catch (error) {
+            if (!(error instanceof LockBusyError) || Date.now() + LOCK_RETRY_DELAY_MS > deadline) {
+                throw error;
+            }
+            await new Promise((resolve) => {
+                const timer = setTimeout(resolve, LOCK_RETRY_DELAY_MS);
+                timer.unref?.();
+            });
+        }
+    }
+}
 export function isProcessAlive(pid) {
     try {
         process.kill(pid, 0);
@@ -148,6 +195,12 @@ async function removeStaleLock(path, options) {
         }
         content = null;
     }
+    if (content !== null && content.trim() === "") {
+        // Atomic create never leaves an empty lock, so an empty file here is a
+        // leftover from a crash / old version — take it over rather than wedge.
+        await takeoverLock(path);
+        return;
+    }
     const holder = content === null ? "unknown" : holderStateFromContent(content);
     if (holder === "alive") {
         return;
@@ -185,6 +238,10 @@ function removeStaleLockSync(path, options) {
         }
         content = null;
     }
+    if (content !== null && content.trim() === "") {
+        takeoverLockSync(path);
+        return;
+    }
     const holder = content === null ? "unknown" : holderStateFromContent(content);
     if (holder === "alive") {
         return;
@@ -242,6 +299,154 @@ function takeoverLockSync(path) {
         force: true
     });
 }
+// The classify-then-takeover-then-relink reclaim of a stale/dead lock renames by
+// name, so two processes that both saw the same dead holder could each rename the
+// other's freshly relinked lock away and both end up "holding" it. Serialize the
+// reclaim of a given lock name behind this meta-lock, claimed with the same
+// EEXIST-on-create primitive, so only one process reclaims at a time. It is held
+// only across a handful of syscalls; a short mtime fallback lets a crash mid-
+// reclaim self-heal without wedging every future acquirer.
+//
+// The stale window MUST stay strictly below the smallest lock-acquire retry budget
+// (the 5_000ms callers in this module and in dgfile.ts). Otherwise a meta-lock
+// abandoned by a crash less than one budget ago can never be reclaimed inside a
+// caller's retry loop, turning a self-healing situation into a hard acquisition
+// failure.
+export const META_LOCK_STALE_MS = 3_000;
+function reclaimLockPath(path) {
+    return `${path}.takeover`;
+}
+// Self-identifying owner token so release only removes the meta-lock this process
+// still owns. Without it, a process whose meta-lock was reclaimed as stale by a
+// peer would delete the peer's successor meta-lock on release, re-opening the very
+// double-reclaim window the meta-lock exists to close.
+function reclaimToken() {
+    return `${process.pid}-${++reclaimCounter}-${randomBytes(8).toString("hex")}`;
+}
+export function acquireReclaimLockSync(path) {
+    const metaPath = reclaimLockPath(path);
+    const token = reclaimToken();
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            const fd = openSync(metaPath, "wx", 0o600);
+            writeFileSync(fd, token, "utf8");
+            return { fd, token };
+        }
+        catch (error) {
+            if (!isErrno(error, "EEXIST")) {
+                throw error;
+            }
+            if (!reclaimStaleMetaLockSync(metaPath)) {
+                throw new LockBusyError(path);
+            }
+        }
+    }
+    throw new LockBusyError(path);
+}
+function reclaimStaleMetaLockSync(metaPath) {
+    let details;
+    try {
+        details = statSync(metaPath);
+    }
+    catch (error) {
+        if (isErrno(error, "ENOENT")) {
+            return true;
+        }
+        throw error;
+    }
+    if (Date.now() - details.mtimeMs < META_LOCK_STALE_MS) {
+        return false;
+    }
+    const stalePath = `${metaPath}.stale-${process.pid}-${++takeoverCounter}`;
+    try {
+        renameSync(metaPath, stalePath);
+    }
+    catch (error) {
+        if (isErrno(error, "ENOENT")) {
+            return true;
+        }
+        throw error;
+    }
+    rmSync(stalePath, { force: true });
+    return true;
+}
+export function releaseReclaimLockSync(path, reclaim) {
+    closeSync(reclaim.fd);
+    ownerCheckedRemoveSync(reclaimLockPath(path), reclaim.token);
+}
+function ownerCheckedRemoveSync(metaPath, token) {
+    let content;
+    try {
+        content = readFileSync(metaPath, "utf8");
+    }
+    catch {
+        return;
+    }
+    if (content === token) {
+        rmSync(metaPath, { force: true });
+    }
+}
+async function acquireReclaimLock(path) {
+    const metaPath = reclaimLockPath(path);
+    const token = reclaimToken();
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            const handle = await open(metaPath, "wx", 0o600);
+            await handle.writeFile(token, "utf8");
+            return { handle, token };
+        }
+        catch (error) {
+            if (!isErrno(error, "EEXIST")) {
+                throw error;
+            }
+            if (!(await reclaimStaleMetaLock(metaPath))) {
+                throw new LockBusyError(path);
+            }
+        }
+    }
+    throw new LockBusyError(path);
+}
+async function reclaimStaleMetaLock(metaPath) {
+    let details;
+    try {
+        details = await stat(metaPath);
+    }
+    catch (error) {
+        if (isErrno(error, "ENOENT")) {
+            return true;
+        }
+        throw error;
+    }
+    if (Date.now() - details.mtimeMs < META_LOCK_STALE_MS) {
+        return false;
+    }
+    const stalePath = `${metaPath}.stale-${process.pid}-${++takeoverCounter}`;
+    try {
+        await rename(metaPath, stalePath);
+    }
+    catch (error) {
+        if (isErrno(error, "ENOENT")) {
+            return true;
+        }
+        throw error;
+    }
+    await rm(stalePath, { force: true });
+    return true;
+}
+async function releaseReclaimLock(path, reclaim) {
+    await reclaim.handle.close();
+    const metaPath = reclaimLockPath(path);
+    let content;
+    try {
+        content = await readFile(metaPath, "utf8");
+    }
+    catch {
+        return;
+    }
+    if (content === reclaim.token) {
+        await rm(metaPath, { force: true });
+    }
+}
 function assertLockName(name) {
     if (!/^[a-z][a-z0-9-]{0,63}$/.test(name)) {
         throw new Error(`Invalid dg lock name: ${name}`);

package/dist/state/sessions.js

@@ -84,7 +84,7 @@ export async function sweepStaleSessions(paths, options) {
             }
             throw error;
         });
-        if (!details || now - details.mtimeMs < options.olderThanMs) {
+        if (!details || now - details.mtimeMs < options.olderThanMs || sessionWorkerAlive(dir)) {
             continue;
         }
         await rm(dir, {
@@ -129,7 +129,7 @@ export function findStaleSessionsSync(paths, options) {
             }
             throw error;
         }
-        if (now - details.mtimeMs >= options.olderThanMs) {
+        if (now - details.mtimeMs >= options.olderThanMs && !sessionWorkerAlive(dir)) {
             stale.push(entry.name);
         }
     }

package/dist/util/sh-escape.js

@@ -0,0 +1,6 @@
+export function escapeDoubleQuotedSh(value) {
+    return value.replace(/[\\"$`]/g, "\\$&");
+}
+export function escapeDoubleQuotedFish(value) {
+    return value.replace(/[\\"$]/g, "\\$&");
+}

package/dist/util/tty-prompt.js

@@ -1,4 +1,9 @@
 import { closeSync, openSync, readSync } from "node:fs";
+import { StringDecoder } from "node:string_decoder";
+const EAGAIN_POLL_INTERVAL_MS = 10;
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
 export function promptYesNo(question, defaultYes, out = process.stderr) {
     const answer = promptLine(`${question} ${defaultYes ? "[Y/n]" : "[y/N]"} `, out);
     if (answer === null) {
@@ -21,14 +26,17 @@ export function promptLine(question, out = process.stderr) {
     try {
         out.write(question);
         const byte = Buffer.alloc(1);
+        const decoder = new StringDecoder("utf8");
         let answer = "";
-        for (;;) {
+        let terminated = false;
+        while (!terminated) {
             let read = 0;
             try {
                 read = readSync(tty, byte, 0, 1, null);
             }
             catch (error) {
                 if (error.code === "EAGAIN") {
+                    sleepSync(EAGAIN_POLL_INTERVAL_MS);
                     continue;
                 }
                 break;
@@ -36,12 +44,13 @@ export function promptLine(question, out = process.stderr) {
             if (read === 0) {
                 break;
             }
-            const char = byte.toString("utf8");
-            if (char === "\n" || char === "\r") {
+            if (byte[0] === 0x0a || byte[0] === 0x0d) {
+                terminated = true;
                 break;
             }
-            answer += char;
+            answer += decoder.write(byte);
         }
+        answer += decoder.end();
         return answer;
     }
     finally {

package/dist/verify/local.js

@@ -12,6 +12,8 @@ const GNU_LONGNAME_TYPE = 0x4c;
 const GNU_LONGLINK_TYPE = 0x4b;
 const PAX_EXTENDED_TYPE = 0x78;
 const PAX_GLOBAL_TYPE = 0x67;
+const HARDLINK_TYPE = 0x31;
+const SYMLINK_TYPE = 0x32;
 export function verifyLocalTarget(targetPath, cwd = process.cwd()) {
     const absoluteTarget = resolve(cwd, targetPath);
     if (!existsSync(absoluteTarget)) {
@@ -120,6 +122,7 @@ function scanTarball(bytes, path) {
     let offset = 0;
     let unpackedSizeBytes = 0;
     let pendingLongName = null;
+    let pendingLongLink = null;
     let pendingPax = null;
     let globalPax = null;
     while (offset + TAR_BLOCK_SIZE <= tarBytes.length) {
@@ -151,6 +154,7 @@ function scanTarball(bytes, path) {
             continue;
         }
         if (typeflag === GNU_LONGLINK_TYPE) {
+            pendingLongLink = readNullTerminated(body, 0, body.length);
             offset = nextOffset;
             continue;
         }
@@ -180,7 +184,25 @@ function scanTarball(bytes, path) {
             break;
         }
         const name = paxPath ?? pendingLongName ?? rawName;
+        // A symlink/hardlink target that escapes the archive root is the link-based
+        // half of a zip-slip — flag it (the entry name is checked separately). Use
+        // the same precedence as the name: GNU LONGLINK, then PAX linkpath, then the
+        // ustar header linkname field (offset 157, 100 bytes).
+        if (typeflag === SYMLINK_TYPE || typeflag === HARDLINK_TYPE) {
+            const paxLink = pendingPax?.get("linkpath") ?? globalPax?.get("linkpath") ?? null;
+            const linkTarget = pendingLongLink ?? paxLink ?? readNullTerminated(header, 157, 100);
+            if (linkTarget.length > 0 && linkEscapesRoot(name, linkTarget)) {
+                findings.push({
+                    id: "archive-path-traversal",
+                    severity: "block",
+                    title: "Unsafe archive link target",
+                    message: "archive link points outside the extraction root or to an unsafe absolute path",
+                    location: `${name} -> ${linkTarget}`
+                });
+            }
+        }
         pendingLongName = null;
+        pendingLongLink = null;
         pendingPax = null;
         unpackedSizeBytes += size;
         entries.push({
@@ -198,7 +220,7 @@ function scanTarball(bytes, path) {
         }
         offset = nextOffset;
     }
-    if (errors.length === 0 && (pendingLongName !== null || pendingPax !== null)) {
+    if (errors.length === 0 && (pendingLongName !== null || pendingLongLink !== null || pendingPax !== null)) {
         errors.push("tar archive ends with an unapplied extended header");
     }
     findings.push(...packageManifestFindings(entries));
@@ -242,11 +264,13 @@ function scanZipLike(bytes, path) {
                 location: entry.name
             });
         }
-        unpackedSizeBytes += entry.uncompressedSize;
-        entries.push({
-            name: entry.name,
-            body: readZipEntryBody(bytes, entry, errors)
-        });
+        // Meter the ACTUAL inflated bytes against the cumulative budget, and cap each
+        // entry's inflation at the remaining budget — the central-directory
+        // uncompressedSize is attacker-forgeable, so a bomb could claim one byte per
+        // entry while each inflates to the per-entry cap, exhausting memory.
+        const body = readZipEntryBody(bytes, entry, errors, MAX_UNPACKED_BYTES - unpackedSizeBytes);
+        unpackedSizeBytes += body.length;
+        entries.push({ name: entry.name, body });
         if (entries.length > MAX_ARCHIVE_ENTRIES) {
             findings.push(limitFinding("archive has too many entries"));
             break;
@@ -368,7 +392,7 @@ function zipLocalHeaderMismatch(bytes, central) {
     }
     return null;
 }
-function readZipEntryBody(bytes, entry, errors) {
+function readZipEntryBody(bytes, entry, errors, maxBytes) {
     if ((entry.flags & 0x1) !== 0) {
         return Buffer.alloc(0);
     }
@@ -380,15 +404,15 @@ function readZipEntryBody(bytes, entry, errors) {
         errors.push(`${entry.name}: zip entry data is truncated`);
         return Buffer.alloc(0);
     }
-    return readZipBody(bytes.subarray(dataStart, dataStart + entry.compressedSize), entry.method, entry.name, errors);
+    return readZipBody(bytes.subarray(dataStart, dataStart + entry.compressedSize), entry.method, entry.name, errors, maxBytes);
 }
-function readZipBody(data, method, name, errors) {
+function readZipBody(data, method, name, errors, maxBytes) {
     if (method === 0) {
         return data;
     }
     if (method === 8) {
         try {
-            return inflateRawSync(data, { maxOutputLength: MAX_UNPACKED_BYTES });
+            return inflateRawSync(data, { maxOutputLength: Math.max(1, Math.min(MAX_UNPACKED_BYTES, maxBytes)) });
         }
         catch (error) {
             errors.push(`${name}: could not inflate zip entry: ${error instanceof Error ? error.message : "unknown inflate error"}`);
@@ -454,6 +478,32 @@ function pathSafetyFindings(entryPath) {
     }
     return findings;
 }
+// A symlink/hardlink target escapes the archive root if it is absolute, a
+// Windows path, or climbs above the directory holding the link. Unlike an entry
+// path, a link target legitimately uses `..` (npm `.bin/foo -> ../foo.js`), so
+// resolve it relative to the link's own location and reject only a net escape.
+function linkEscapesRoot(entryName, linkTarget) {
+    if (linkTarget.startsWith("/") || linkTarget.includes("\\") || /^[a-zA-Z]:/.test(linkTarget)) {
+        return true;
+    }
+    const baseDir = entryName.split("/").slice(0, -1);
+    let depth = 0;
+    for (const part of [...baseDir, ...linkTarget.split("/")]) {
+        if (part === "" || part === ".") {
+            continue;
+        }
+        if (part === "..") {
+            depth -= 1;
+            if (depth < 0) {
+                return true;
+            }
+        }
+        else {
+            depth += 1;
+        }
+    }
+    return false;
+}
 function isSafeArchivePath(entryPath) {
     if (entryPath.length === 0 || entryPath.includes("\\") || entryPath.startsWith("/") || /^[a-zA-Z]:/.test(entryPath)) {
         return false;