amicus 4.9.6 → 4.9.7

package/src/sidecar/electron-exe-rel.js

@@ -0,0 +1,131 @@
+/**
+ * WHICH exe a package resolves through, and whether a `dist/` HOLDS one.
+ *
+ * ONE RULE, ONE HOME. `resolveElectronBinary` (electron-install.js) decides what
+ * amicus will SPAWN; `promoteDist`'s retirement guard (electron-layout.js)
+ * decides what amicus may DELETE. Until v4.9.7 only the first one read
+ * `path.txt` — the second asked whether `dist/` held THIS HOST'S default exe —
+ * and a package cross-installed through `npm_config_platform` holds a different
+ * basename, so a failed promote destroyed a working tree (A1). Two copies of a
+ * rule are free to drift; this module exists so there is one.
+ *
+ * WHICH VALUE `promoteDist`'S GUARD MAY READ, since getting this wrong is how
+ * the fix would have been as blind as the defect:
+ *   - `raw`, the bytes `path.txt` held BEFORE the promote's step 0 — YES.
+ *   - `replaced` (electron-layout.js) — NO. It is nulled in exactly the branch
+ *     the guard most needs a name for, and it is untrimmed, so feeding it to
+ *     `path.join` fails OPEN on a trailing newline.
+ *   - A RE-READ of `path.txt` at the guard — NO, and this is the sharp one.
+ *     Step 0 has already written `platformExe` there, so a re-reading guard
+ *     reads its own writer's value and learns nothing. MEASURED: at the guard
+ *     the file says `electron.exe` even for a package cross-installed as
+ *     `electron`, and the tree is deleted exactly as before the fix. That is
+ *     failure mode #21, the echoed read-back.
+ *
+ * `ELECTRON_OVERRIDE_DIST_PATH` IS DELIBERATELY NOT PART OF THIS RULE, and
+ * `promoteDist` gains no `env`. The guard governs a DELETE of `distDir` and
+ * nothing else, so the only question is what THAT tree holds; under an override
+ * `resolveElectronBinary` does not look in `dist/` at all. Ignoring it can only
+ * make the guard readier to find an exe — the fail-CLOSED direction.
+ *
+ * TRUE LEAF: `path` only, with `fs` injected by the caller — so both callers can
+ * require it with no risk of a cycle.
+ *
+ * @module sidecar/electron-exe-rel
+ */
+
+'use strict';
+
+const path = require('path');
+
+/** Platform exe basename, matching electron's getPlatformPath(). */
+function platformExe(platform) {
+  switch (platform) {
+    case 'mas':
+    case 'darwin':
+      return path.join('Electron.app', 'Contents', 'MacOS', 'Electron');
+    case 'win32':
+      return 'electron.exe';
+    default:
+      return 'electron';
+  }
+}
+
+/**
+ * The relative exe path a package RESOLVES through, from `path.txt`'s RAW bytes.
+ *
+ * `resolveElectronBinary`'s rule, stated once: TRIM, and fall back to
+ * `platformExe` when the file is absent, unreadable OR blank. `null` is the
+ * caller's "the read threw".
+ *
+ * THE TRIM AND THE BLANK ARM ARE BOTH LOAD-BEARING, and the A1 filing named
+ * neither — it said "absent or unreadable". MEASURED: a guard that skips the
+ * trim deletes a real `dist/electron.exe` under a `path.txt` of
+ * `"electron.exe\n"`, because `existsSync(join(dist, 'electron.exe\n'))` is
+ * false on Windows; and one that returns a blank value names `dist/` ITSELF,
+ * which exists, so it would refuse every promote forever.
+ */
+function heldExeRel(raw, platform) {
+  const rel = typeof raw === 'string' ? raw.trim() : '';
+  return rel || platformExe(platform);
+}
+
+/**
+ * WHICH executable `distDir` holds — under either name it could resolve
+ * through — or `null` for a tree that is not an install under any of them.
+ *
+ * A UNION, NEVER A REPLACEMENT, and the union is why this returns a NAME. The
+ * filing's literal rule ("judge by what `path.txt` names") was MEASURED to open
+ * three new holes it does not mention: a whitespace-only `path.txt`, one with a
+ * trailing newline, and a TRUNCATED one (`electr` — the shape `promoteDist`'s
+ * own best-effort put-back can leave) each turned a real `dist/electron.exe`
+ * into "not an install, delete it". So `platformExe` is not replaced by the
+ * `path.txt` name; it is joined by it, and the set of trees this licenses
+ * deleting can only ever SHRINK.
+ *
+ * ARM 1 IS THE PRE-FIX RULE, BYTE FOR BYTE, and it runs first and
+ * unconditionally. That ordering is the guarantee: no tree the shipped guard
+ * protects today can be deleted by this one.
+ *
+ * ARM 2 CARRIES TWO BOUNDS THE FIRST DOES NOT NEED.
+ *   CONTAINED — a `path.txt` of `..`, `.`, `''` or `../SIBLING` joins to
+ *   something that EXISTS outside `dist/` (all MEASURED true), which would
+ *   refuse every promote forever while claiming `dist/` held an exe it never
+ *   held. The predicate is `zip-entry-write.js :: writeSymlink`'s, verbatim —
+ *   including the `path.sep`, whose absence MEASURABLY fails OPEN: a legal
+ *   `dist/..electron.exe` reads as escaping and the tree is deleted.
+ *   A FILE, NOT A DIRECTORY — every natural truncation of the darwin name
+ *   (`Electron.app`, `Electron.app/Contents`, `Electron.app/Contents/MacOS`) is
+ *   a real DIRECTORY in a real tree, and `existsSync` says true for all three.
+ *   Accepting one would wedge the self-heal permanently on the AV-quarantine
+ *   shape it exists for, printing "dist/ holds a usable Electron.app".
+ *
+ * A throwing `existsSync` (only an injected fs does this) reads as "I could not
+ * establish that this tree is empty", which refuses. Fail closed.
+ *
+ * @param {object} o
+ * @param {string} o.distDir
+ * @param {string|null} o.raw  path.txt's bytes BEFORE any writer touched them
+ * @param {string} o.platform
+ * @param {object} o.fs
+ * @returns {string|null} the exe path, relative to `distDir`, that was found
+ */
+function distHeldExe({ distDir, raw, platform, fs }) {
+  const fallback = platformExe(platform);
+  // ARM 1 — the pre-fix rule, unchanged and first.
+  try { if (fs.existsSync(path.join(distDir, fallback))) { return fallback; } } catch { return fallback; }
+  const held = heldExeRel(raw, platform);
+  if (held === fallback) { return null; }
+  // ARM 2 — the name path.txt gives, contained and required to be a file.
+  const full = path.join(distDir, held);
+  const inside = path.relative(distDir, full);
+  if (inside === '' || inside === '..' || inside.startsWith(`..${path.sep}`) || path.isAbsolute(inside)) { return null; }
+  try { return fs.statSync(full).isFile() ? held : null; } catch { return null; }
+}
+
+/** Write path.txt: the basename `electron/index.js` joins onto `dist/`. */
+function writePathTxt({ electronDir, platform, fs }) {
+  fs.writeFileSync(path.join(electronDir, 'path.txt'), platformExe(platform));
+}
+
+module.exports = { platformExe, writePathTxt, heldExeRel, distHeldExe };

package/src/sidecar/electron-install.js

@@ -16,7 +16,9 @@
  *
  * AT THE SIZE GATE, so pieces live next door: `./electron-custody` reads the
  * artifact into memory once, `./zip-from-buffer` extracts what was read,
- * `./electron-layout` holds `platformExe`/`writePathTxt`/`extractBytesToDist`
+ * `./electron-exe-rel` holds the ONE `path.txt` rule (`platformExe`/`heldExeRel`/
+ * `writePathTxt`/`distHeldExe`), shared with `promoteDist`'s retirement guard since
+ * v4.9.7 (A1); `./electron-layout` holds `promoteDist`/`extractBytesToDist`
  * (`platformExe` re-exported here for `ei.platformExe`), `./electron-refuse`
  * holds the refusal messages, `./electron-repair-cache` the whole cached-artifact
  * route, `./electron-provision` the pinned download. The arrow points one way out
@@ -32,7 +34,7 @@ const { cachedZip } = require('./electron-cache');
 const { isSafeArtifactName } = require('./electron-custody');
 const { avHint, verifyExtractOutcome: verifyQuarantine } = require('./electron-quarantine');
 const { acquireRepairLock } = require('./electron-lock');
-const { platformExe } = require('./electron-layout');
+const { platformExe, heldExeRel } = require('./electron-exe-rel');
 const { controlledProvision } = require('./electron-provision');
 const { repairFromCache } = require('./electron-repair-cache');
 const { isUnsafeArchive, refuseUnsafeArchive } = require('./electron-refuse');
@@ -61,16 +63,9 @@ function defaultElectronDir() {
  * @returns {string|null} resolved exe path, or null if path.txt is unreadable.
  */
 function resolveElectronBinary({ electronDir = defaultElectronDir(), env = process.env, platform = process.platform, fs = fsDefault } = {}) {
-  let exeRel;
-  const pathFile = path.join(electronDir, 'path.txt');
-  try {
-    exeRel = fs.readFileSync(pathFile, 'utf-8').trim();
-  } catch {
-    exeRel = '';
-  }
-  if (!exeRel) {
-    exeRel = platformExe(platform);
-  }
+  let raw = null;
+  try { raw = fs.readFileSync(path.join(electronDir, 'path.txt'), 'utf-8'); } catch { /* absent or unreadable */ }
+  const exeRel = heldExeRel(raw, platform);   // the ONE rule (electron-exe-rel.js)
   const override = env.ELECTRON_OVERRIDE_DIST_PATH;
   if (override) {
     return path.join(override, exeRel);

package/src/sidecar/electron-layout.js

@@ -18,8 +18,11 @@
  * caller already hashed and writes `dist/` by extract-into-incoming + promote
  * (see `promoteDist`).
  *
- * TRUE LEAF: `path` only, with `fs` and the extractor injected by the caller —
- * so electron-provision.js requires it too without any risk of a cycle.
+ * NEAR-LEAF: `path` and `crypto`, plus the true leaf `./electron-exe-rel` (the
+ * one `path.txt` rule, shared with `resolveElectronBinary` since v4.9.7 — A1),
+ * with `fs` and the extractor injected by the caller — so electron-provision.js
+ * requires it too without any risk of a cycle. `platformExe` is re-exported
+ * from here because it was defined here through v4.9.6.
  *
  * @module sidecar/electron-layout
  */
@@ -28,24 +31,7 @@
 
 const crypto = require('crypto');
 const path = require('path');
-
-/** Platform exe basename, matching electron's getPlatformPath(). */
-function platformExe(platform) {
-  switch (platform) {
-    case 'mas':
-    case 'darwin':
-      return path.join('Electron.app', 'Contents', 'MacOS', 'Electron');
-    case 'win32':
-      return 'electron.exe';
-    default:
-      return 'electron';
-  }
-}
-
-/** Write path.txt: the basename `electron/index.js` joins onto `dist/`. */
-function writePathTxt({ electronDir, platform, fs }) {
-  fs.writeFileSync(path.join(electronDir, 'path.txt'), platformExe(platform));
-}
+const { platformExe, writePathTxt, distHeldExe } = require('./electron-exe-rel');
 
 /**
  * The two litter prefixes this module creates, and how long one may survive.
@@ -154,19 +140,26 @@ function sweepPromoteLitter({
  * and the caller then downloaded 138 MB and repeated the same promote.
  *
  * So the in-place removal now happens ONLY when there is nothing to lose: a
- * `dist/` that holds no `platformExe` is not an install, and destroying it costs
- * the user nothing they had. When the old tree DOES hold an executable, the
- * promote REFUSES and that tree is untouched — the repair fails, which is
- * strictly better than a working GUI becoming no GUI.
+ * `dist/` that holds NEITHER the exe `path.txt` names NOR `platformExe` is not
+ * an install, and destroying it costs the user nothing they had. When the old
+ * tree DOES hold an executable, the promote REFUSES and that tree is untouched —
+ * the repair fails, which is strictly better than a working GUI becoming no GUI.
  *
  * THE GUARANTEE, stated so it is checkable:
- *   **A promote never removes a `dist/` that held an executable unless the new
- *   tree is already in its place.**
+ *   **A promote never removes a `dist/` that HELD an executable — under the name
+ *   `path.txt` gives it, or `platformExe` when `path.txt` is absent, unreadable
+ *   or blank — unless the new tree is already in its place.**
+ * "HELD" means a FILE INSIDE `dist/`; `electron-exe-rel.js :: distHeldExe` owns
+ * that rule and carries what each of its bounds was measured to cost (A1).
  * The one exit that can still leave a user without a usable `dist/` is both
  * renames failing after step 1 SUCCEEDED. The old tree is then whole and
  * undeleted at `.amicus-retired-<hex>`, and the thrown message names it so the
  * user can rename it back.
  *
+ * WHICH VALUE THE GUARD READS (A1): `raw`, captured BEFORE step 0 — not
+ * `replaced`, and never a re-read. `electron-exe-rel.js` carries why, the
+ * `ELECTRON_OVERRIDE_DIST_PATH` ruling, and the measurements behind both.
+ *
  * `path.txt` IS WRITTEN FIRST (B2). Writing it LAST made "dist but no path.txt"
  * unobservable only while that write SUCCEEDED, and it ran after the old tree was
  * retired AND DELETED, so one ENOSPC/EPERM/AV-locked 12-byte write left a `dist/`
@@ -189,8 +182,10 @@ function sweepPromoteLitter({
 function promoteDist({ electronDir, incomingDist, platform, fs }) {
   const distDir = path.join(electronDir, 'dist');
   const pathFile = path.join(electronDir, 'path.txt');
-  let replaced = null;                    // step 0's overwritten DIFFERENT value
-  try { replaced = fs.readFileSync(pathFile, 'utf8'); } catch { /* absent or unreadable */ }
+  let raw = null;                         // path.txt BEFORE step 0 overwrites it
+  let unreadable = false;                 // a read that failed for a reason other than ENOENT
+  try { raw = fs.readFileSync(pathFile, 'utf8'); } catch (e) { unreadable = !e || e.code !== 'ENOENT'; }
+  let replaced = raw;                     // step 0's overwritten DIFFERENT value
   try {
     if (replaced === platformExe(platform)) { replaced = null; } else {
       try { writePathTxt({ electronDir, platform, fs }); } catch (e) {
@@ -205,10 +200,15 @@ function promoteDist({ electronDir, incomingDist, platform, fs }) {
         retiredExists = true;
       } catch (e) {
         // The old tree cannot be moved. Removing it in place is irreversible, so
-        // it is allowed only when the tree is not an install anyway.
-        if (fs.existsSync(path.join(distDir, platformExe(platform)))) {
+        // it is allowed only when the tree is an install under NEITHER name (A1).
+        if (unreadable) {
+          throw new Error(`${(e && e.message) || e} — path.txt could not be read, so which exe `
+            + 'dist/ holds is unknown and it was left exactly as it was');
+        }
+        const held = distHeldExe({ distDir, raw, platform, fs });
+        if (held) {
           throw new Error(`${(e && e.message) || e} — the existing dist/ holds a usable `
-            + `${platformExe(platform)} and was left exactly as it was`);
+            + `${held} and was left exactly as it was`);
         }
         fs.rmSync(distDir, { recursive: true, force: true });
       }

package/src/sidecar/electron-native-plan.js

@@ -80,6 +80,17 @@ function cleanDir(fs, dir) {
 /**
  * Walk the platform's native plan until one strategy leaves files in `dir`.
  *
+ * `cwd` IS THE INCOMING TREE, and it is a containment measure with an honest
+ * label: MEASURED NEUTRAL, not measured needed. Across 18 paired runs no shipped
+ * strategy wrote anything cwd-relative, so this changes no observed behaviour.
+ * It costs one line and adds no decision surface, and it converts a hypothetical
+ * cwd-relative write from "the user's own repo, under npx, forever" into "the
+ * incoming tree, which `extractBytesToDist`'s `finally` deletes unconditionally
+ * and `sweepPromoteLitter` takes if a kill skipped that". `unzip.js ::
+ * robustExtract`'s native loop deliberately does NOT get the same treatment: its
+ * `dir` is not inside a tree amicus deletes unconditionally, so binding a cwd
+ * there would point a child's working directory at the user's install.
+ *
  * The verdicts are unzip.js's, because they were right there: a spawn error or
  * an external signal-kill (`status: null` — SIGKILL, an OOM) is a FAILURE even
  * if files landed, a non-zero exit is a failure, and a clean exit that produced
@@ -87,12 +98,14 @@ function cleanDir(fs, dir) {
  * strategy starts from an empty directory.
  * @returns {string|null} the strategy name that worked, or null
  */
-function runNativePlan({ zip, dir, platform, fs, spawn, maxMs, log }) {
+function runNativePlan({ zip, dir, cwd, platform, fs, spawn, maxMs, log }) {
   const failures = [];
   for (const strat of nativeUnzipPlan(zip, dir, platform)) {
     let res;
     try {
-      res = spawn(strat.cmd, strat.args, { stdio: 'ignore', windowsHide: true, timeout: maxMs });
+      res = spawn(strat.cmd, strat.args, {
+        stdio: 'ignore', windowsHide: true, timeout: maxMs, cwd,
+      });
     } catch (e) {
       failures.push(`${strat.name}: spawn ${(e && e.code) || (e && e.message) || 'threw'}`);
       continue;
@@ -118,6 +131,11 @@ function runNativePlan({ zip, dir, platform, fs, spawn, maxMs, log }) {
  * will find it — so a rescue lands in `dist/` by the SAME single rename, with the
  * same litter sweep, and this module never touches the promote at all.
  *
+ * `namesComplete`/`namesChecked` are REQUIRED and deliberately have no defaults:
+ * they drive a disclosure, and a caller that forgot to thread them must not get
+ * the reassuring branch by omission. `announceNativeRescue` treats `undefined` as
+ * "not complete" for the same reason.
+ *
  * `flag: 'wx'` is a real control and a small one: `O_EXCL` refuses to write
  * through a name that already exists, INCLUDING a symlink someone pre-planted at
  * it. It does nothing about a substitution AFTER the write — that window is the
@@ -126,14 +144,14 @@ function runNativePlan({ zip, dir, platform, fs, spawn, maxMs, log }) {
  * `extractBytesToDist` removes the whole incoming tree regardless.
  * @returns {string|null} the strategy name that recovered the archive, or null
  */
-function nativeRescue({ bytes, dir, reason, platform, fs, spawn, maxMs, log }) {
+function nativeRescue({ bytes, dir, reason, namesComplete, namesChecked, platform, fs, spawn, maxMs, log }) {
   const incoming = path.dirname(dir);
   if (!path.basename(incoming).startsWith(INCOMING_PREFIX)) {
     log(`[amicus] the native-extractor rescue was NOT attempted: ${collapseExcerpt(dir, PATH_EXCERPT_CHARS)} is not inside an amicus incoming directory.`);
     return null;
   }
   const zip = path.join(incoming, RESCUE_ZIP);
-  announceNativeRescue({ zip, reason, log });
+  announceNativeRescue({ zip, reason, namesComplete, namesChecked, log });
   try {
     fs.writeFileSync(zip, bytes, { flag: 'wx', mode: 0o600 });
   } catch (e) {
@@ -144,7 +162,7 @@ function nativeRescue({ bytes, dir, reason, platform, fs, spawn, maxMs, log }) {
     // The failed extractor's partial tree is evidence of nothing and would be
     // promoted as if it were a rescue. It goes before the child runs.
     cleanDir(fs, dir);
-    const strategy = runNativePlan({ zip, dir, platform, fs, spawn, maxMs, log });
+    const strategy = runNativePlan({ zip, dir, cwd: incoming, platform, fs, spawn, maxMs, log });
     if (strategy) {
       log(`[amicus] recovered via the native extractor (${strategy}). These bytes were NOT re-hashed; the result is marked unverified.`);
     }

package/src/sidecar/electron-native-rescue.js

@@ -118,6 +118,7 @@ const { nativeRescue, RESCUE_ZIP, INCOMING_PREFIX } = require('./electron-native
 const { offerNativeRescue } = require('./electron-rescue-notice');
 // The read-only name walk the boundary consults before it trusts a verdict.
 const { scanEntryNames } = require('./zip-name-scan');
+const { scanLocalNames } = require('./zip-local-name-scan');
 const { collapseExcerpt } = require('../utils/text-sanitize');
 
 /** The ONE extractor verdict a rescue may act on. See the docblock's boundary. */
@@ -144,27 +145,46 @@ function isRescuableFailure(err) {
  * unadvertised, left in place, exactly as if the archive had had nothing wrong
  * with it but that entry.
  *
- * THE RESIDUAL, STATED RATHER THAN ENGINEERED AWAY. The scan reads the central
- * directory; an archive whose central directory is unreadable — a truncated zip,
- * the commonest thing this rescue exists for — declares no names it can see, and
- * that archive still reaches the native extractor. Nothing here covers a SYMLINK
- * whose target escapes either: that is a payload, not a name. In both cases the
- * only remaining check is the extractor's own, which `tar` and `Expand-Archive`
- * were MEASURED to have (`ditto` and Info-ZIP `unzip` are unmeasured), and
- * `cleanDir` sweeps only inside `dir` — anything a native tool wrote outside it
- * would survive a failed strategy. `docs/configuration.md` says the same thing to
+ * BOTH TABLES, BECAUSE THE STRATEGIES DO NOT AGREE ON WHICH ONE THEY READ (B3).
+ * Through v4.9.6 this asked the CENTRAL directory only, so an archive that blinds
+ * yauzl there — a truncation, or any of four ONE-FIELD forgeries of a COMPLETE
+ * end-of-central-directory record — declared no names amicus could see and went
+ * to the native extractor anyway. MEASURED: seven such archives carrying
+ * `../../../PWNED-BY-NATIVE.txt` reached a real spawn, and on two the rescue ran
+ * to COMPLETION and promoted. Only the Windows tools' own `..` guards stopped the
+ * escape — the exact reliance this module says amicus will not make.
+ * And the tables can DISAGREE: on an archive declaring one name locally and
+ * another centrally, `tar.exe` wrote the LOCAL name while `Expand-Archive` wrote
+ * the CENTRAL one. So a refusal in EITHER table refuses the archive.
+ *
+ * THE RESIDUALS THAT REMAIN. Neither walk sees a SYMLINK whose target escapes:
+ * that is a payload, not a name. And an archive that defeats BOTH walks still
+ * reaches the extractor — rarer than before, but not impossible — so the notice
+ * printed before the spawn now says WHICH names were checked, rather than letting
+ * the user assume they all were. `docs/configuration.md` says the same thing to
  * the user who has to decide whether to set the flag.
+ *
+ * WHEN A NAME CHECK CANNOT SEE IT, the only check left is the extractor's own —
+ * and that claim is now RE-MEASURED on every CI run rather than asserted once
+ * (`tests/sidecar/native-extractor-containment.test.js`, 12 escape shapes per
+ * strategy). `tar.exe`, `Expand-Archive` and Info-ZIP `unzip` all contain their
+ * own escapes; GNU `tar` cannot read a zip at all; `ditto` is the one strategy
+ * still unmeasured, and that suite measures it the first time it runs on a Mac.
+ * What a failed strategy can still leave behind is ONLY a write to an ABSOLUTE
+ * path outside the incoming tree: everything else the rescue writes lives under
+ * that tree, which `extractBytesToDist`'s `finally` deletes unconditionally (B2).
+ * @param {{central:object, local:object}} seen the two walks' results
  * @returns {Error|null} a terminal UNZIP_UNSAFE_ARCHIVE, or null
  */
-async function hostileName(bytes, log) {
-  const seen = await scanEntryNames(bytes);
-  if (!seen.refusal) { return null; }
+function hostileName(seen, log) {
+  const refusal = seen.central.refusal || seen.local.refusal;
+  if (!refusal) { return null; }
   log('[amicus] REFUSING to rescue this archive: amicus could not read it, and while asking what');
   log('[amicus] it contains it found an entry that tries to write OUTSIDE the destination:');
-  log(`[amicus]   ${collapseExcerpt(seen.refusal)}`);
+  log(`[amicus]   ${collapseExcerpt(refusal)}`);
   log('[amicus] A native extractor may have no such check, so it is not offered this archive.');
   return Object.assign(
-    new Error(`refusing to extract this archive: ${collapseExcerpt(seen.refusal)}`),
+    new Error(`refusing to extract this archive: ${collapseExcerpt(refusal)}`),
     { code: 'UNZIP_UNSAFE_ARCHIVE' },
   );
 }
@@ -200,7 +220,8 @@ function withNativeRescue({
       // ...and the one class that IS rescuable is asked what names it declares
       // first, because the exclusion above keys on the refusal yauzl FORMED and
       // an earlier bad entry stops it forming one. See `hostileName`.
-      const hostile = await hostileName(bytes, log);
+      const seen = { central: await scanEntryNames(bytes), local: scanLocalNames(bytes) };
+      const hostile = hostileName(seen, log);
       if (hostile) { throw hostile; }
       if (!policy.allowUnverified) {
         // `offered` IS THE OFFER'S RECEIPT, and the cache route is required to
@@ -214,7 +235,25 @@ function withNativeRescue({
         throw err;
       }
       const strategy = nativeRescue({
-        bytes, dir: o.dir, reason: (err && err.message) || '', platform, fs, spawn, maxMs, log,
+        bytes,
+        dir: o.dir,
+        reason: (err && err.message) || '',
+        // WHAT THE NOTICE MAY CLAIM. Three states, not two: a real artifact
+        // truncated by a few KB has BOTH walks incomplete while the local walk
+        // read and cleared every name it found, so `central.read || local.complete`
+        // would print "nothing checked its entries" over 73 checked entries.
+        // BOTH, NOT EITHER. The two tables carry DIFFERENT names and the two
+        // strategies read different ones, so a disjunction cannot mean "every
+        // name was checked". MEASURED: a local walk stopped at entry 1 with a
+        // readable, benign central directory reported TRUE and printed nothing,
+        // while `tar.exe` reached a `../../../` entry only the local table had.
+        namesComplete: seen.central.read && seen.local.complete,
+        namesChecked: seen.local.names,
+        platform,
+        fs,
+        spawn,
+        maxMs,
+        log,
       });
       // A rescue that failed leaves the ORIGINAL classified error in flight, so
       // a genuinely bad archive is still evicted exactly as it was before.

package/src/sidecar/electron-rescue-notice.js

@@ -62,9 +62,26 @@ function offerNativeRescue({ reason, log = () => {} }) {
  * instead of reassuring anyone about it — the rescue is not safe, and the words a
  * user reads while it happens have to say so.
  */
-function announceNativeRescue({ zip, reason, log = () => {} }) {
+function announceNativeRescue({
+  zip, reason, namesComplete, namesChecked = 0, log = () => {},
+}) {
   log('[amicus] AMICUS_ALLOW_UNVERIFIED_ELECTRON=1 — running the NATIVE-EXTRACTOR RESCUE.');
   log(`[amicus]   amicus could not read the archive itself: ${collapseExcerpt(reason)}`);
+  // THREE STATES, NOT TWO, and the middle one is the common one: a real artifact
+  // truncated by a few KB leaves both walks incomplete while the local walk still
+  // read and cleared every name it reached. Saying "nothing checked its entries"
+  // there would be a FALSE disclosure on the shape this rescue exists for.
+  // `namesComplete` is undefined-means-no on purpose (see `nativeRescue`).
+  if (!namesComplete && namesChecked > 0) {
+    log(`[amicus]   IT CHECKED ${namesChecked} ENTRY NAMES AND COULD NOT CONFIRM IT SAW THEM ALL:`);
+    log('[amicus]   the archive stopped amicus part-way through its own tables, so an entry that');
+    log('[amicus]   writes OUTSIDE dist/ could sit past the point it reached.');
+  } else if (!namesComplete) {
+    log('[amicus]   AND IT COULD NOT READ THE ENTRY NAMES EITHER: neither this archive\'s central');
+    log('[amicus]   directory nor its local file headers could be walked, so NOTHING checked its');
+    log('[amicus]   entries for paths that write OUTSIDE dist/. The extractor below is the only');
+    log('[amicus]   check left.');
+  }
   log('[amicus] THE WINDOW THIS OPENS, stated plainly. amicus has written the bytes it hashed to');
   log(`[amicus]   ${collapseExcerpt(zip, PATH_EXCERPT_CHARS)}`);
   log('[amicus] and is about to hand that PATH to a native extractor it does not control. Between');

package/src/sidecar/zip-from-buffer.js

@@ -40,11 +40,22 @@
  * extraction root is REFUSED here and is not by extract-zip, and it is resolved
  * against the REALPATH of the directory the link lands in because the lexical
  * `path.dirname` was measured to be defeated outright by a chain of
- * directory-symlink entries earlier in the same archive. That is a behaviour
- * change on a shape amicus cannot test on this machine (the darwin `.app` bundle
- * is the only electron artifact with real symlinks), so it is refused in the
- * same `Out of bound path` wording, exercised against synthetic archives, and
- * named in the report as unverified on macOS.
+ * directory-symlink entries earlier in the same archive. It is refused in the
+ * same `Out of bound path` wording and exercised against synthetic archives
+ * here; the darwin `.app` bundle is the only electron artifact with real
+ * symlinks, and since v4.9.7 `.github/workflows/darwin-bundle.yml` runs this
+ * path over the REAL artifact on a real Mac. The v4.9.6 worry that the check
+ * might REJECT a working layout is refuted by measurement: the real
+ * `electron-v43.1.1-darwin-arm64.zip` declares 585 records and 14 symlinks,
+ * every target relative, none carrying a `..` component, none absolute, and 0
+ * of the 585 entry names traversing a symlinked component. The linux artifacts
+ * hold ZERO symlink entries, so `writeSymlink` is unreachable there at all.
+ *
+ * `root = fs.realpathSync(dir)` below is load-bearing for that answer and no
+ * Windows probe would ever show it: on macOS the extraction root usually sits
+ * under `/var`, which is itself a symlink to `/private/var`, so comparing a
+ * resolved target against an UNRESOLVED root would read every link in a real
+ * `.app` as an escape.
  *
  * ── ERROR CODES ARE A CAUSAL CLAIM ───────────────────────────────────────
  * `UNZIP_BUFFER_FAILED` = the ARCHIVE is bad. `UNZIP_DEST_FAILED` = the