fix(archives): prevent zip symlink overwrite

Author: jdalton

.config/repo/tsconfig.check.json

@@ -2,7 +2,6 @@
   "//": "Member-owned half of the type-check config. .config/fleet/tsconfig.check.json extends this LAST, so anything declared here wins over the fleet defaults. Its main job is compilerOptions.paths: a member's package aliases resolve for `pnpm run type` only when they are declared here, because the root tsconfig.json is a sibling of the check chain rather than an ancestor. Paths are relative to THIS file, so a src/ wrapper reads ../../src/external/<name>. Seeded empty and extended unconditionally, so leave the file in place even with nothing in it.",
   "compilerOptions": {
     "paths": {
-      "adm-zip": ["../../src/external/adm-zip"],
       "cacache": ["../../src/external/cacache"],
       "fast-sort": ["../../src/external/fast-sort"],
       "make-fetch-happen": ["../../src/external/make-fetch-happen"],

docs/repo/agents.md/architecture.md

@@ -7,7 +7,7 @@ Per-repo CLAUDE.md detail extracted to fit the 40KB whole-file cap. The CLAUDE.m
 Core infrastructure library for Socket.dev security tools.
 
 - **Internal imports:** relative paths (e.g. `'../constants/packages'`). Path aliases are intentionally avoided.
-- **Vendored externals:** `cacache`, `make-fetch-happen`, `fast-sort`, `pacote`, `adm-zip`, `tar-fs`, `picomatch` live in `src/external/` and are remapped via `tsconfig.json` `paths`. Import them by bare package name.
+- **Vendored externals:** `cacache`, `make-fetch-happen`, `fast-sort`, `pacote`, `tar-fs`, `picomatch` live in `src/external/` and are remapped via `tsconfig.json` `paths`. Import them by bare package name.
 
 ## Commands
 

package.json

@@ -4092,7 +4092,6 @@
     "@vitest/ui": "catalog:",
     "@vitiate/core": "catalog:",
     "@yarnpkg/extensions": "2.0.7",
-    "adm-zip": "0.6.0",
     "ast-v8-to-istanbul": "catalog:",
     "c8": "catalog:",
     "cacache": "20.0.4",
@@ -4104,6 +4103,7 @@
     "fast-check": "catalog:",
     "fast-glob": "3.3.3",
     "fast-sort": "3.4.1",
+    "fflate": "0.8.3",
     "get-east-asian-width": "1.6.0",
     "globals": "17.11.0",
     "has-flag": "5.0.1",

pnpm-lock.yaml

@@ -25,7 +25,6 @@ export const externalPackages = [
   { name: 'normalize-package-data', bundle: false },
   { name: 'semver', bundle: true },
   // Utilities
-  { name: 'adm-zip', bundle: true },
   { name: 'debug', bundle: true },
   { name: 'tar-fs', bundle: true },
   // p-map: Standalone bundle. ESM-only package, bundled before pico-pack.

scripts/repo/build-externals/config.mts

@@ -111,7 +111,6 @@ const STUB_MAP: Record<string, string | [RegExp, string]> = {
  */
 export function createForceNodeModulesPlugin(): Plugin {
   const packagesWithPathMappings = [
-    'adm-zip',
     'cacache',
     'make-fetch-happen',
     'fast-sort',

scripts/repo/build-externals/rolldown-config.mts

@@ -1,12 +1,11 @@
 /**
  * @file Private internals for `archives/*` modules — defaults, lazy module
- *   accessors (adm-zip, tar-fs, node:path), shared pre-extraction validators
+ *   accessors (tar-fs, node:path), shared pre-extraction validators
  *   (`assertArchiveExists`, `validatePathWithinBase`).
  */
 
 import { ErrorCtor } from '../primordials/error.mjs'
 import { StringPrototypeStartsWith } from '../primordials/string.mjs'
-import type AdmZipType from '../external/adm-zip.js'
 import type tarFsType from '../external/tar-fs.js'
 import { getNodePath } from '../node/path.mjs'
 import { getNodeFs } from '../node/fs.mjs'
@@ -21,17 +20,14 @@ export {
   DEFAULT_MAX_TOTAL_SIZE,
 } from './types.mjs'
 
-let admZip: typeof AdmZipType | undefined
 let tarFs: typeof tarFsType | undefined
 
 /**
  * Assert that an archive file exists on disk before handing it to the
  * underlying extractor. Normalizes the "missing archive" surface across all
  * three extractors (zip/tar/tar.gz): each now throws a Node-style `ENOENT`
  * error with the archive path. Without this preflight, `zip` goes through
- * adm-zip and surfaces as `"Invalid filename"`, while `tar`/`tar.gz` surface
- * the raw Node `ENOENT` — inconsistent, and adm-zip's message didn't include
- * the path.
+ * the underlying extractor. The error includes the missing path.
  *
  * @private
  *
@@ -49,13 +45,6 @@ export function assertArchiveExists(archivePath: string): void {
   }
 }
 
-export function getAdmZip() {
-  if (admZip === undefined) {
-    admZip = /*@__PURE__*/ require('../external/adm-zip.js')
-  }
-  return admZip!
-}
-
 export function getTarFs() {
   if (tarFs === undefined) {
     tarFs = /*@__PURE__*/ require('../external/tar-fs.js')

src/archives/shared.mts

@@ -4,7 +4,7 @@
  *   limits that record documents. No imports and no side effects, which is
  *   load-bearing: `npm/registry/tarball/shared` reads the defaults from here
  *   on the BROWSER path, and the sibling `archives/shared` cannot serve them
- *   because it also owns the adm-zip / tar-fs / `node:fs` accessors.
+ *   because it also owns the tar-fs / `node:fs` accessors.
  */
 
 /**