Problem
WP Codebox rejects the current official WooCommerce 11.0.0 package before Playground boot because its extracted 5,872 files exceed DEFAULT_MAX_EXTRACTED_FILES = 5,000. Canonical SSI fixture 20-switchback-woocommerce-extra-hard correctly resolves the immutable WordPress.org package and passes staged-artifact dependency discovery with PR #2241, but both its initial and isolated runtime attempts fail admission with Recipe source extraction contains too many files: 5872.
The immutable fixture and official package must remain unchanged. The generic extraction boundary needs a bounded policy that admits current legitimate provider packages while retaining zip-bomb and resource protections.
Evidence
- Source:
https://downloads.wordpress.org/plugin/woocommerce.11.0.0.zip
- SHA-256:
ba08c7fc58c98a11f22866269c5832d85c52b664806ec206036f09737ba21666
- Extracted count:
5,872
- Current default:
5,000
- Failure occurs before Playground/import/editor/visual execution.
Acceptance
- Current official WooCommerce packages are admitted under a still-bounded extraction policy.
- Archive file-count, expanded-byte, per-file, path, and compression-ratio protections remain fail closed.
- Limits are explicit in source provenance/diagnostics and can be configured by trusted recipe-source class rather than silently unbounded.
- Tests cover a valid package above 5,000 files and an over-limit archive rejection.
- Canonical fixture 20 reaches import without fixture or package changes.
AI assistance
OpenAI gpt-5.6-sol via OpenCode and a general OpenCode subagent ran the immutable fixture with the WP Codebox #2241 candidate, isolated the pre-runtime file-count admission boundary, and drafted the generic bounded policy contract. Chris Huber directed the investigation and remains responsible for the issue and resulting change.
Problem
WP Codebox rejects the current official WooCommerce 11.0.0 package before Playground boot because its extracted
5,872files exceedDEFAULT_MAX_EXTRACTED_FILES = 5,000. Canonical SSI fixture20-switchback-woocommerce-extra-hardcorrectly resolves the immutable WordPress.org package and passes staged-artifact dependency discovery with PR #2241, but both its initial and isolated runtime attempts fail admission withRecipe source extraction contains too many files: 5872.The immutable fixture and official package must remain unchanged. The generic extraction boundary needs a bounded policy that admits current legitimate provider packages while retaining zip-bomb and resource protections.
Evidence
https://downloads.wordpress.org/plugin/woocommerce.11.0.0.zipba08c7fc58c98a11f22866269c5832d85c52b664806ec206036f09737ba216665,8725,000Acceptance
AI assistance
OpenAI gpt-5.6-sol via OpenCode and a general OpenCode subagent ran the immutable fixture with the WP Codebox #2241 candidate, isolated the pre-runtime file-count admission boundary, and drafted the generic bounded policy contract. Chris Huber directed the investigation and remains responsible for the issue and resulting change.