chainlesschain 0.162.95 → 0.162.97

package/src/lib/cowork-cron.js

@@ -32,6 +32,7 @@
 import crypto from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { withFileLock } from "./with-file-lock.js";
 
 export const _deps = {
   existsSync,
@@ -260,49 +261,59 @@ export function addSchedule(cwd, input) {
   const err = validateCron(cron);
   if (err) throw new Error(`invalid cron: ${err}`);
 
-  const schedules = loadSchedules(cwd);
-  const entry = {
-    id: `sch-${crypto.randomUUID().slice(0, 12)}`,
-    cron: cron.trim(),
-    templateId,
-    userMessage,
-    files: Array.isArray(files) ? files : [],
-    enabled: true,
-    createdAt: _deps.now().toISOString(),
-    lastRunAt: null,
-    lastStatus: null,
-  };
-  schedules.push(entry);
-  saveSchedules(cwd, schedules);
-  return entry;
+  // Serialize the read-modify-write across processes (cc+cc / cc+desktop share
+  // the cowork dir) so concurrently-added schedules don't clobber each other.
+  return withFileLock(_scheduleFile(cwd), () => {
+    const schedules = loadSchedules(cwd);
+    const entry = {
+      id: `sch-${crypto.randomUUID().slice(0, 12)}`,
+      cron: cron.trim(),
+      templateId,
+      userMessage,
+      files: Array.isArray(files) ? files : [],
+      enabled: true,
+      createdAt: _deps.now().toISOString(),
+      lastRunAt: null,
+      lastStatus: null,
+    };
+    schedules.push(entry);
+    saveSchedules(cwd, schedules);
+    return entry;
+  });
 }
 
 export function removeSchedule(cwd, id) {
-  const schedules = loadSchedules(cwd);
-  const idx = schedules.findIndex((s) => s.id === id);
-  if (idx === -1) return false;
-  schedules.splice(idx, 1);
-  saveSchedules(cwd, schedules);
-  return true;
+  return withFileLock(_scheduleFile(cwd), () => {
+    const schedules = loadSchedules(cwd);
+    const idx = schedules.findIndex((s) => s.id === id);
+    if (idx === -1) return false;
+    schedules.splice(idx, 1);
+    saveSchedules(cwd, schedules);
+    return true;
+  });
 }
 
 export function setScheduleEnabled(cwd, id, enabled) {
-  const schedules = loadSchedules(cwd);
-  const s = schedules.find((x) => x.id === id);
-  if (!s) return false;
-  s.enabled = !!enabled;
-  saveSchedules(cwd, schedules);
-  return true;
+  return withFileLock(_scheduleFile(cwd), () => {
+    const schedules = loadSchedules(cwd);
+    const s = schedules.find((x) => x.id === id);
+    if (!s) return false;
+    s.enabled = !!enabled;
+    saveSchedules(cwd, schedules);
+    return true;
+  });
 }
 
 export function updateScheduleRunState(cwd, id, { lastRunAt, lastStatus }) {
-  const schedules = loadSchedules(cwd);
-  const s = schedules.find((x) => x.id === id);
-  if (!s) return false;
-  if (lastRunAt) s.lastRunAt = lastRunAt;
-  if (lastStatus) s.lastStatus = lastStatus;
-  saveSchedules(cwd, schedules);
-  return true;
+  return withFileLock(_scheduleFile(cwd), () => {
+    const schedules = loadSchedules(cwd);
+    const s = schedules.find((x) => x.id === id);
+    if (!s) return false;
+    if (lastRunAt) s.lastRunAt = lastRunAt;
+    if (lastStatus) s.lastStatus = lastStatus;
+    saveSchedules(cwd, schedules);
+    return true;
+  });
 }
 
 // ─── Scheduler ───────────────────────────────────────────────────────────────

package/src/lib/cowork-learning.js

@@ -20,6 +20,8 @@ import {
   writeFileSync,
   mkdirSync,
   appendFileSync,
+  renameSync,
+  unlinkSync,
 } from "node:fs";
 import { join } from "node:path";
 
@@ -29,9 +31,37 @@ export const _deps = {
   writeFileSync,
   mkdirSync,
   appendFileSync,
+  renameSync,
+  unlinkSync,
   now: () => new Date(),
 };
 
+/**
+ * Atomically write a learned-template JSON via _deps. A crash mid-write would
+ * truncate `<templateId>.json`; loadUserTemplate's catch then drops it, losing
+ * the learned prompt extension. Temp sibling + rename (atomic within a
+ * filesystem). Graceful-degrade to a direct write when the injected fs lacks
+ * renameSync — the real fs always has it, so production is always atomic.
+ */
+function _atomicWriteJson(file, data) {
+  if (typeof _deps.renameSync !== "function") {
+    _deps.writeFileSync(file, data, "utf-8");
+    return;
+  }
+  const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    _deps.writeFileSync(tmp, data, "utf-8");
+    _deps.renameSync(tmp, file);
+  } catch (err) {
+    try {
+      if (_deps.existsSync(tmp) && _deps.unlinkSync) _deps.unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
 /** Minimum historical runs before a template qualifies for a patch suggestion. */
 export const MIN_RUNS_FOR_PATCH = 10;
 /** Minimum distinct failures needed to trigger a suggestion. */
@@ -414,7 +444,7 @@ export function applyPromptPatch(cwd, patch) {
     updatedAt: _deps.now().toISOString(),
   };
   const file = join(dir, `${patch.templateId}.json`);
-  _deps.writeFileSync(file, JSON.stringify(doc, null, 2), "utf-8");
+  _atomicWriteJson(file, JSON.stringify(doc, null, 2));
 
   // Audit trail — never pruned automatically
   _deps.appendFileSync(

package/src/lib/cowork-share.js

@@ -15,7 +15,14 @@
  * @module cowork-share
  */
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+  renameSync,
+  unlinkSync,
+} from "node:fs";
 import { join } from "node:path";
 import crypto, { createHash } from "node:crypto";
 import {
@@ -29,9 +36,38 @@ export const _deps = {
   mkdirSync,
   readFileSync,
   writeFileSync,
+  renameSync,
+  unlinkSync,
   now: () => new Date().toISOString(),
 };
 
+/**
+ * Atomically write a JSON file via _deps. Imported result packets are persistent
+ * local state (shared-results/<taskId>.json) and exported packets are read by
+ * other tools — a crash mid-write must not leave a truncated/invalid packet
+ * (verifyPacket/readPacket would reject it). Temp sibling + rename (atomic
+ * within a filesystem). Graceful-degrade to a direct write when the injected fs
+ * lacks renameSync — the real fs always has it, so production is always atomic.
+ */
+function _atomicWriteJson(file, data) {
+  if (typeof _deps.renameSync !== "function") {
+    _deps.writeFileSync(file, data, "utf-8");
+    return;
+  }
+  const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    _deps.writeFileSync(tmp, data, "utf-8");
+    _deps.renameSync(tmp, file);
+  } catch (err) {
+    try {
+      if (_deps.existsSync(tmp) && _deps.unlinkSync) _deps.unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
 const SUPPORTED_SIG_ALG = "Ed25519";
 
 const PACKET_VERSION = 1;
@@ -256,7 +292,7 @@ export function findHistoryRecord(cwd, taskId) {
  * Write a packet to disk as pretty-printed JSON.
  */
 export function writePacket(filePath, packet) {
-  _deps.writeFileSync(filePath, JSON.stringify(packet, null, 2), "utf-8");
+  _atomicWriteJson(filePath, JSON.stringify(packet, null, 2));
   return filePath;
 }
 
@@ -317,7 +353,7 @@ export function importResultPacket(cwd, packet) {
   const dir = join(cwd, ".chainlesschain", "cowork", "shared-results");
   _deps.mkdirSync(dir, { recursive: true });
   const file = join(dir, `${packet.payload.taskId}.json`);
-  _deps.writeFileSync(file, JSON.stringify(packet, null, 2), "utf-8");
+  _atomicWriteJson(file, JSON.stringify(packet, null, 2));
   return { file, taskId: packet.payload.taskId };
 }
 

package/src/lib/cowork-template-marketplace.js

@@ -22,6 +22,7 @@ import {
   writeFileSync,
   readdirSync,
   unlinkSync,
+  renameSync,
 } from "node:fs";
 import { join } from "node:path";
 
@@ -32,10 +33,38 @@ export const _deps = {
   writeFileSync,
   readdirSync,
   unlinkSync,
+  renameSync,
   // Injected at runtime by CLI to avoid eager evomap-client load
   evomapClient: null,
 };
 
+/**
+ * Atomically write a JSON file via _deps. A user template (<id>.json) is
+ * persistent state; a crash mid-write truncates it and listUserTemplates /
+ * loadUserTemplate's JSON.parse then drops or throws on it. Temp sibling +
+ * rename (atomic within a filesystem). Graceful-degrade to a direct write when
+ * the injected fs lacks renameSync — the real fs always has it, so production
+ * is always atomic.
+ */
+function _atomicWriteJson(file, data) {
+  if (typeof _deps.renameSync !== "function") {
+    _deps.writeFileSync(file, data, "utf-8");
+    return;
+  }
+  const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    _deps.writeFileSync(tmp, data, "utf-8");
+    _deps.renameSync(tmp, file);
+  } catch (err) {
+    try {
+      if (_deps.existsSync(tmp) && _deps.unlinkSync) _deps.unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
 const EVOMAP_CATEGORY = "cowork-template";
 
 // ─── Paths ───────────────────────────────────────────────────────────────────
@@ -48,6 +77,26 @@ function _userTemplateFile(cwd, id) {
   return join(_userTemplatesDir(cwd), `${id}.json`);
 }
 
+/**
+ * A template id is interpolated into a filesystem path (user-templates/<id>.json)
+ * and arrives from installed templates whose payload comes from an external hub /
+ * MCP download. A malicious id like "../../.ssh/authorized_keys" or
+ * "C:\\Windows\\..." would escape the user-templates dir and overwrite/delete
+ * arbitrary files. Restrict it to a single safe path segment.
+ */
+function _isSafeTemplateId(id) {
+  return (
+    typeof id === "string" &&
+    id.length > 0 &&
+    id !== "." &&
+    id !== ".." &&
+    !id.includes("/") &&
+    !id.includes("\\") &&
+    !id.includes(":") &&
+    !id.includes("\0")
+  );
+}
+
 // ─── Serialization ───────────────────────────────────────────────────────────
 
 const SHARED_FIELDS = [
@@ -148,18 +197,21 @@ export function listUserTemplates(cwd) {
 /** Save a template to the local user-templates directory. */
 export function saveUserTemplate(cwd, template) {
   if (!template?.id) throw new Error("template.id is required");
+  if (!_isSafeTemplateId(template.id)) {
+    throw new Error(`Unsafe template id (path traversal): ${template.id}`);
+  }
   const dir = _userTemplatesDir(cwd);
   _deps.mkdirSync(dir, { recursive: true });
-  _deps.writeFileSync(
+  _atomicWriteJson(
     _userTemplateFile(cwd, template.id),
     JSON.stringify(template, null, 2),
-    "utf-8",
   );
   return template;
 }
 
 /** Remove an installed user template. Returns true if removed. */
 export function removeUserTemplate(cwd, id) {
+  if (!_isSafeTemplateId(id)) return false;
   const file = _userTemplateFile(cwd, id);
   if (!_deps.existsSync(file)) return false;
   _deps.unlinkSync(file);

package/src/lib/cowork-workflow.js

@@ -29,6 +29,7 @@ import {
   readdirSync,
   unlinkSync,
   appendFileSync,
+  renameSync,
 } from "node:fs";
 import { join } from "node:path";
 import { evaluate as evalExpr, resolveReference } from "./workflow-expr.js";
@@ -47,6 +48,7 @@ export const _deps = {
   readdirSync,
   unlinkSync,
   appendFileSync,
+  renameSync,
   now: () => Date.now(),
   runTask: null, // injected by CLI
   // Timer seams (injectable for deterministic retry/timeout tests).
@@ -55,6 +57,32 @@ export const _deps = {
   clearTimeout: (t) => clearTimeout(t),
 };
 
+/**
+ * Atomically write a JSON file via _deps. A saved workflow definition is
+ * persistent user state; a crash mid-write truncates <id>.json and getWorkflow
+ * then fails to parse it. Temp sibling + rename (atomic within a filesystem).
+ * Graceful-degrade to a direct write when the injected fs lacks renameSync — the
+ * real fs always has it, so production is always atomic.
+ */
+function _atomicWriteJson(file, data) {
+  if (typeof _deps.renameSync !== "function") {
+    _deps.writeFileSync(file, data, "utf-8");
+    return;
+  }
+  const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    _deps.writeFileSync(tmp, data, "utf-8");
+    _deps.renameSync(tmp, file);
+  } catch (err) {
+    try {
+      if (_deps.existsSync(tmp) && _deps.unlinkSync) _deps.unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
 // ─── Paths ───────────────────────────────────────────────────────────────────
 
 function workflowsDir(cwd) {
@@ -302,7 +330,10 @@ export function resolveForEachItems(forEach, resultsById) {
 export function substituteItem(template, item) {
   if (typeof template !== "string") return template;
   const repl = typeof item === "string" ? item : JSON.stringify(item);
-  return template.replace(/\$\{item\}/g, repl);
+  // Insert via a function so $-sequences in the item ($&, $`, $', $$ — common in
+  // JSON values / shell snippets) are placed literally rather than interpreted
+  // as String.replace patterns, which would corrupt the substituted value.
+  return template.replace(/\$\{item\}/g, () => repl);
 }
 
 /** Evaluate a step's `when` expression. Missing expression → always true. */
@@ -376,11 +407,7 @@ export function saveWorkflow(cwd, wf) {
   if (!valid) throw new Error(`Invalid workflow: ${errors.join("; ")}`);
   const dir = workflowsDir(cwd);
   _deps.mkdirSync(dir, { recursive: true });
-  _deps.writeFileSync(
-    workflowFile(cwd, wf.id),
-    JSON.stringify(wf, null, 2),
-    "utf-8",
-  );
+  _atomicWriteJson(workflowFile(cwd, wf.id), JSON.stringify(wf, null, 2));
   return wf;
 }
 

package/src/lib/cross-chain-mtc.js

@@ -19,6 +19,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import mtcLib from "@chainlesschain/core-mtc";
+import { withFileLock } from "./with-file-lock.js";
 
 const {
   assembleBatch,
@@ -95,6 +96,28 @@ function ensureDirs(dir) {
   }
 }
 
+/**
+ * Atomically write a UTF-8 file. The cross-chain MTC store holds config, trust
+ * anchors (federation security material), staged bridge ops, the batch-seq
+ * counter, and closed batches — a crash mid-write corrupts ledger/security
+ * state. Temp sibling + rename (atomic within a filesystem); temp names end in
+ * `.tmp` (never `.json`), so a hard-crash leftover is ignored by listStagedOps.
+ */
+function atomicWriteFileSync(filePath, data) {
+  const tmp = `${filePath}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  try {
+    fs.writeFileSync(tmp, data, "utf-8");
+    fs.renameSync(tmp, filePath);
+  } catch (err) {
+    try {
+      if (fs.existsSync(tmp)) fs.unlinkSync(tmp);
+    } catch {
+      /* best-effort temp cleanup */
+    }
+    throw err;
+  }
+}
+
 // ─────────────────────────────────────────────────────────────────────
 // Namespace
 // ─────────────────────────────────────────────────────────────────────
@@ -173,7 +196,7 @@ export function saveCrossChainMtcConfig(dir, patch) {
       "config.mode must be independent, federated, or light-client",
     );
   }
-  fs.writeFileSync(configPath(dir), JSON.stringify(merged, null, 2), "utf-8");
+  atomicWriteFileSync(configPath(dir), JSON.stringify(merged, null, 2));
   return merged;
 }
 
@@ -201,11 +224,7 @@ export function loadTrustAnchors(dir) {
 }
 
 function saveTrustAnchorStore(dir, store) {
-  fs.writeFileSync(
-    trustAnchorsPath(dir),
-    JSON.stringify(store, null, 2),
-    "utf-8",
-  );
+  atomicWriteFileSync(trustAnchorsPath(dir), JSON.stringify(store, null, 2));
 }
 
 /**
@@ -456,7 +475,7 @@ export function stageBridgeOp(dir, op, opts = {}) {
   if (fs.existsSync(file)) {
     return { staged: false, path: file, reason: "ALREADY_STAGED" };
   }
-  fs.writeFileSync(file, JSON.stringify(op, null, 2), "utf-8");
+  atomicWriteFileSync(file, JSON.stringify(op, null, 2));
   return { staged: true, path: file };
 }
 
@@ -498,7 +517,7 @@ function nextBatchSeq(dir, pair) {
   }
   const next = (map[pair] || 0) + 1;
   map[pair] = next;
-  fs.writeFileSync(p, JSON.stringify(map, null, 2), "utf-8");
+  atomicWriteFileSync(p, JSON.stringify(map, null, 2));
   return next;
 }
 
@@ -514,6 +533,18 @@ function nextBatchSeq(dir, pair) {
  *             skipped: { reason: string } | null }}
  */
 export function closeBatch(dir, opts = {}) {
+  // Serialize the whole staging-scan → batch-write → staging-cleanup section
+  // across processes. Without it, two concurrent closes both read the same
+  // staged ops, allocate the same per-pair sequence (namespace collision), and
+  // batch the same ops twice before clearing staging. Best-effort lock (never
+  // hangs); generous timeout since the section includes batch assembly+signing.
+  ensureDirs(dir);
+  return withFileLock(batchesDir(dir), () => _closeBatchImpl(dir, opts), {
+    timeoutMs: 15000,
+  });
+}
+
+function _closeBatchImpl(dir, opts = {}) {
   ensureDirs(dir);
   const cfg = loadCrossChainMtcConfig(dir);
   const grouped = listStagedOps(dir);
@@ -546,16 +577,14 @@ export function closeBatch(dir, opts = {}) {
       `${pair}-${String(seq).padStart(6, "0")}`,
     );
     fs.mkdirSync(outDir, { recursive: true });
-    fs.writeFileSync(
+    atomicWriteFileSync(
       path.join(outDir, "landmark.json"),
       JSON.stringify(result.landmark, null, 2),
-      "utf-8",
     );
     result.envelopes.forEach((env, i) => {
-      fs.writeFileSync(
+      atomicWriteFileSync(
         path.join(outDir, `envelope-${String(i).padStart(4, "0")}.json`),
         JSON.stringify(env, null, 2),
-        "utf-8",
       );
     });
 

package/src/lib/crypto-manager.js

@@ -136,14 +136,24 @@ export function decryptFile(inputPath, password, outputPath) {
  * Check if a file is encrypted with our format.
  */
 export function isEncryptedFile(filePath) {
+  let fd;
   try {
-    const fd = fs.openSync(filePath, "r");
+    fd = fs.openSync(filePath, "r");
     const buf = Buffer.alloc(MAGIC_HEADER.length);
     fs.readSync(fd, buf, 0, MAGIC_HEADER.length, 0);
-    fs.closeSync(fd);
     return buf.equals(MAGIC_HEADER);
   } catch (_err) {
     return false;
+  } finally {
+    // Close in finally so a readSync throw (permission change mid-op, OS error)
+    // can't leak the descriptor — repeated failures would otherwise exhaust FDs.
+    if (fd !== undefined) {
+      try {
+        fs.closeSync(fd);
+      } catch {
+        /* already closed / invalid fd — nothing to release */
+      }
+    }
   }
 }
 

package/src/lib/dbevo.js

@@ -41,6 +41,17 @@ export const SUGGESTION_TYPE = Object.freeze({
 
 let _migrations = []; // registered migration definitions
 let _migrationHistory = []; // executed migration records from DB
+
+/**
+ * Compare two version strings with NUMERIC collation so "10" sorts AFTER "2".
+ * A migration framework must order numeric versions correctly; plain
+ * localeCompare()/Array.sort() is lexicographic ("10" < "2"), which would run
+ * migration v10 before v2 and corrupt the schema. Numeric collation also leaves
+ * zero-padded / date / semver-ish versions ordered as expected.
+ */
+function cmpVersion(a, b) {
+  return String(a).localeCompare(String(b), undefined, { numeric: true });
+}
 let _queryLogs = [];
 let _suggestions = new Map();
 let _slowQueryThresholdMs = 100;
@@ -147,7 +158,7 @@ export function registerMigration(
   });
 
   // Keep sorted by version
-  _migrations.sort((a, b) => a.version.localeCompare(b.version));
+  _migrations.sort((a, b) => cmpVersion(a.version, b.version));
 
   return { registered: true, version, checksum };
 }
@@ -178,13 +189,13 @@ export function getCurrentVersion(db) {
   );
 
   if (active.length === 0) return null;
-  return active.sort((a, b) => b.localeCompare(a))[0];
+  return active.sort((a, b) => cmpVersion(b, a))[0];
 }
 
 export function getPendingMigrations(db) {
   const current = getCurrentVersion(db);
   return _migrations.filter(
-    (m) => !current || m.version.localeCompare(current) > 0,
+    (m) => !current || cmpVersion(m.version, current) > 0,
   );
 }
 
@@ -193,7 +204,7 @@ export function migrateUp(db, targetVersion) {
   if (pending.length === 0) return { migrated: false, reason: "no_pending" };
 
   const toRun = targetVersion
-    ? pending.filter((m) => m.version.localeCompare(targetVersion) <= 0)
+    ? pending.filter((m) => cmpVersion(m.version, targetVersion) <= 0)
     : pending;
 
   if (toRun.length === 0) return { migrated: false, reason: "no_pending" };
@@ -248,13 +259,13 @@ export function migrateDown(db, targetVersion) {
     .filter((m) => {
       if (targetVersion) {
         return (
-          m.version.localeCompare(current) <= 0 &&
-          m.version.localeCompare(targetVersion) > 0
+          cmpVersion(m.version, current) <= 0 &&
+          cmpVersion(m.version, targetVersion) > 0
         );
       }
       return m.version === current;
     })
-    .sort((a, b) => b.version.localeCompare(a.version));
+    .sort((a, b) => cmpVersion(b.version, a.version));
 
   if (toRollBack.length === 0)
     return { rolledBack: false, reason: "nothing_to_rollback" };
@@ -331,7 +342,7 @@ export function validateMigrations() {
   if (_migrations.length === 0) return { valid: true, issues: [] };
 
   const issues = [];
-  const versions = _migrations.map((m) => m.version).sort();
+  const versions = _migrations.map((m) => m.version).sort(cmpVersion);
 
   // Check for gaps in version sequence
   for (let i = 1; i < versions.length; i++) {

package/src/lib/downloader.js

@@ -7,7 +7,7 @@ import {
 } from "node:fs";
 import { join } from "node:path";
 import { pipeline } from "node:stream/promises";
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import ora from "ora";
 import { GITHUB_RELEASES_URL } from "../constants.js";
 import { getBinDir, ensureDir } from "./paths.js";
@@ -208,16 +208,31 @@ async function fetchRelease(url) {
   return response.json();
 }
 
-function extractZip(zipPath, destDir) {
-  const p = getPlatform();
-  if (p === "win32") {
-    // Use PowerShell on Windows
-    execSync(
-      `powershell -Command "Expand-Archive -Path '${zipPath}' -DestinationPath '${destDir}' -Force"`,
-      { stdio: "ignore" },
+export function extractZip(
+  zipPath,
+  destDir,
+  { execFileImpl = execFileSync, platform = getPlatform() } = {},
+) {
+  // Never interpolate the paths into a shell string — `zipPath`/`destDir` derive
+  // from the (remote) release asset name, so a `"`/`$()`/`'` in a path would be a
+  // command-injection vector. execFileSync runs the tool directly (no shell), and
+  // on Windows the paths go through the environment so the -Command script stays
+  // a constant the shell can't be tricked by.
+  if (platform === "win32") {
+    execFileImpl(
+      "powershell",
+      [
+        "-NoProfile",
+        "-Command",
+        "Expand-Archive -Path $env:CC_ZIP_SRC -DestinationPath $env:CC_ZIP_DEST -Force",
+      ],
+      {
+        stdio: "ignore",
+        env: { ...process.env, CC_ZIP_SRC: zipPath, CC_ZIP_DEST: destDir },
+      },
     );
   } else {
-    execSync(`unzip -o "${zipPath}" -d "${destDir}"`, { stdio: "ignore" });
+    execFileImpl("unzip", ["-o", zipPath, "-d", destDir], { stdio: "ignore" });
   }
 }