Patching mutated the install in place with no recovery, so a failure left a
partly patched Wand behind: rewritten bundles in app.asar.unpacked, or a patched
app.asar with no launcher deployed, which cannot clear the fuse and fails with
-36861. Restore both backups on any failure and rethrow the original error.
Pack the archive into a sibling file and swap it in at the end. Writing straight
into app.asar truncated it when the stream opened, so a failed pack destroyed
the archive it was replacing.
InsertFile resolved the grandparent node instead of the parent.
Reads no longer create phantom directories in the header.
Bound symlink traversal and skip reparse points when crawling.
Locked or unreadable files now abort packing instead of being dropped.
Read headers and integrity blocks with a full-read loop.
Assert the header keeps its size before overwriting the placeholder.
Validate Pickle buffer sizes, payload overflow and negative lengths.
Check CreateSymbolicLink and external tool exit codes.
Drop unused Pickle accessors, TransformedFile and FilesystemFilesAndLinks.Links.
Pickle.Resize allocated the backing array as _header.Length + newCapacity
but advertised _capacityAfterHeader = newCapacity. On the first growth
_header is still empty, so the array ended up _headerSize (4) bytes short of
the header + capacity it claimed. A write that fills the payload then
overran the buffer, throwing an ArgumentException when the serialised asar
header was 4089-4092 bytes.
Allocate _headerSize + newCapacity instead, matching Chromium's
realloc(header_size_ + new_capacity).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
AsarExtractor's path-traversal guard called Extensions.GetRelativePath,
whose fast path strips the destination prefix literally without resolving
".." segments. A crafted archive entry such as "a/../../evil" produced a
relative path that did not start with "..", so the guard passed and the
file was written outside the extraction directory once the OS resolved the
"..". The out-of-package symlink guard shared the same weakness.
Add Extensions.IsPathInside, which normalises both paths with
Path.GetFullPath before the containment check, and use it for both the
file/directory and symlink guards.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- reduce ASAR IO overhead with streamed archive reads, buffered copies, faster relative-path handling and placeholder integrity records
- fix in-place app.asar.unpacked packing/extraction self-copy cases that caused locked-file failures
- tighten JS patch discovery with candidate bundle filters and search hints
- require prebuilt remote-panel dist artifacts and clean up embedded bridge/script packaging
- add unified build entrypoints for PowerShell, cmd and bash and move native CMake output under .tmp
- add release metadata validation, changelog section extraction, pre-commit hook and GitHub Actions validation/release pipelines
- make CHANGELOG the source of truth for release notes and document the tag-driven release flow
- add updater release notes UI with latest/full changelog loading and localize the new update strings
- modularize bridge renderer scripts, add installed apps and game status sync, and support remote launch/stop commands
- centralize bridge protocol, IPC and WebSocket constants and improve LAN IP selection for QR pairing
- refactor remote panel controls/state enums, persist accent color, polish library/session UI and refresh assets
kitbyte