Protected ReadonlyloggerProtected ReadonlypreferenceProtected ReadonlyrequestThe raw RequestService, like the skill installer: this talks to GitHub rather than to the registry host, so the backend request allowlist (which covers the registry only) does not apply.
ProtecteddownloadOne request; the GitHub API redirects to codeload, which the request service follows.
Protectedextractiontar-fs reports a refusal to write through a symlinked parent as <absolute path> is not a valid path, a raw message naming an internal staging directory. It is a containment refusal like any
other, so it is reported like one.
ProtectedextractEvery entry is mapped before anything is written, so a malicious archive cannot write outside the
staging directory even partially. Containment here is lexical and deliberately so: it runs
before extraction, when the tree to resolve against does not exist yet. tar-fs performs the
real check as it writes, refusing to follow a symlinked parent directory.
Strips the archive's top-level directory so the plugin root - source.path, or the repository
root when omitted - becomes destination itself.
ProtectedheadersOptionaltoken: stringProtectedisProtectedisProtectedisA symlink target is relative to the link's own directory; a hard-link target is an archive path, so it gets the same strip and subtree mapping as the entry itself and is rewritten in place.
ProtectedmapAn entry whose own path escapes the root is unsafe and fails the extraction. A link whose target merely points out of the plugin is dropped instead: it would have been written inside the root, so refusing to create it loses that one link and nothing else.
Protectedmaxprotected so a product can change the caps.
ProtectedmaxProtectednormalizeProtectednothingNo regular file was written, which has two causes worth telling apart: the requested subtree is not in the archive at all, or it is there and holds only directories and links whose targets were dropped. Reporting the second as a wrong path would send the user hunting for a typo that is not there.
ProtectedparseOnly GitHub sources are supported, matching what the skill installer accepts.
Protectedrelative'' for the subtree root itself, undefined when outside the subtree.
ProtectedresolvePreference value (trimmed) when set, otherwise GITHUB_TOKEN from the environment.
ProtectedstripDrops GitHub's <owner>-<repo>-<sha>/ wrapper.
ProtectedtoProtectedtooThe one message both caps report, so the user is not told two different things.
ProtectedtoProtectedtraversesThe shape a lexical check cannot see: sub/up -> .. then s -> sub/up/.. are both lexically
contained, while the second really resolves to the parent of the extraction root.
A repository tarball is a single request that also carries the commit it was taken from, unlike the Contents API walk the skill installer uses, which needs one request per directory and per file.