fix(ergasia): download filesystem safety (reconciliation, disk guard, zip-slip)

crates/archon/src/serve.rs

@@ -454,6 +454,7 @@ async fn subtitle_target(
 /// that Syntaxis expects for dispatching downloads.
 struct SessionEngine {
     session: Arc<TorrentSession>,
+    extraction_limits: ergasia::ExtractionLimits,
 }
 
 impl ergasia::DownloadEngine for SessionEngine {
@@ -505,12 +506,12 @@ impl ergasia::DownloadEngine for SessionEngine {
         })
     }
 
-    fn extract(
+    async fn extract(
         &self,
         download_path: &std::path::Path,
         output_dir: &std::path::Path,
     ) -> Result<Option<ergasia::ExtractionResult>, ergasia::ErgasiaError> {
-        ergasia::extract_archives(download_path, output_dir, 3)
+        ergasia::extract_archives(download_path, output_dir, self.extraction_limits).await
     }
 }
 
@@ -677,12 +678,12 @@ pub async fn run_serve(args: ServeArgs, out: &mut impl Write) -> Result<(), Host
             .await
             .context(DownloadEngineSnafu)?,
     );
-    ergasia_session.reconcile_persisted_torrents();
     info!("ergasia (download engine) initialized");
 
     // Layer 2: Syntaxis (queue orchestration, depends on ergasia)
     let engine_adapter = Arc::new(SessionEngine {
         session: Arc::clone(&ergasia_session),
+        extraction_limits: ergasia::ExtractionLimits::from(&config.ergasia),
     });
     let syntaxis_svc = Arc::new(
         DownloadQueue::new(

crates/archon/tests/acquisition_integration.rs

@@ -89,7 +89,7 @@ impl ergasia::DownloadEngine for MockEngine {
         })
     }
 
-    fn extract(
+    async fn extract(
         &self,
         _download_path: &std::path::Path,
         _output_dir: &std::path::Path,

crates/ergasia/Cargo.toml

@@ -14,16 +14,17 @@ tokio.workspace = true
 tokio-util.workspace = true
 dashmap.workspace = true
 serde.workspace = true
+serde_json.workspace = true
 bytes.workspace = true
 librqbit.workspace = true
 zip.workspace = true
 unrar = "0.5"
 sevenz-rust2.workspace = true
 regex.workspace = true
+rustix = { version = "1", features = ["fs"] }
 
 [dev-dependencies]
 rstest.workspace = true
-serde_json.workspace = true
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
 tempfile = "3"
 

crates/ergasia/src/error.rs

@@ -77,6 +77,51 @@ pub enum ErgasiaError {
         location: snafu::Location,
     },
 
+    #[snafu(display("failed to query available disk space for {}", path.display()))]
+    DiskSpaceQuery {
+        path: PathBuf,
+        error: String,
+        #[snafu(implicit)]
+        location: snafu::Location,
+    },
+
+    #[snafu(display("unsafe archive entry {entry:?} in {}: {reason}", archive.display()))]
+    UnsafeArchiveEntry {
+        archive: PathBuf,
+        entry: String,
+        reason: String,
+        #[snafu(implicit)]
+        location: snafu::Location,
+    },
+
+    #[snafu(display(
+        "archive {} declares {declared_uncompressed} bytes uncompressed from {compressed} bytes compressed, exceeding the {max_ratio}x decompression ratio limit",
+        archive.display()
+    ))]
+    DecompressionRatioExceeded {
+        archive: PathBuf,
+        compressed: u64,
+        declared_uncompressed: u64,
+        max_ratio: f64,
+        #[snafu(implicit)]
+        location: snafu::Location,
+    },
+
+    #[snafu(display("archive extraction task failed to complete"))]
+    ExtractionJoin {
+        source: tokio::task::JoinError,
+        #[snafu(implicit)]
+        location: snafu::Location,
+    },
+
+    #[snafu(display("failed to persist torrent map at {}", path.display()))]
+    TorrentMapPersistence {
+        path: PathBuf,
+        error: String,
+        #[snafu(implicit)]
+        location: snafu::Location,
+    },
+
     #[snafu(display("unsupported archive format at {}: magic bytes {magic_bytes:02X?}", path.display()))]
     UnsupportedFormat {
         path: PathBuf,

crates/ergasia/src/extract/fs_walk.rs

@@ -0,0 +1,49 @@
+// Filesystem-walk inventory: derives ExtractedFile lists from what is actually on disk.
+
+use std::collections::HashSet;
+use std::path::{Path, PathBuf};
+
+use crate::extract::pipeline::ExtractedFile;
+
+pub(crate) fn snapshot_paths(dir: &Path) -> HashSet<PathBuf> {
+    let mut paths = HashSet::new();
+    visit(dir, &mut |path, _| {
+        paths.insert(path.to_path_buf());
+    });
+    paths
+}
+
+pub(crate) fn collect_files_excluding(
+    dir: &Path,
+    exclude: &HashSet<PathBuf>,
+    files: &mut Vec<ExtractedFile>,
+) {
+    visit(dir, &mut |path, size| {
+        if !exclude.contains(path) {
+            files.push(ExtractedFile {
+                path: path.to_path_buf(),
+                size_bytes: size,
+            });
+        }
+    });
+}
+
+fn visit(dir: &Path, on_file: &mut impl FnMut(&Path, u64)) {
+    let Ok(entries) = std::fs::read_dir(dir) else {
+        return;
+    };
+
+    for entry in entries.flatten() {
+        let path = entry.path();
+        // SAFETY: DirEntry::file_type does not follow symlinks, so a symlinked
+        // directory is inventoried as a file instead of being traversed.
+        let Ok(file_type) = entry.file_type() else {
+            continue;
+        };
+        if file_type.is_dir() {
+            visit(&path, on_file);
+        } else if let Ok(meta) = path.symlink_metadata() {
+            on_file(&path, meta.len());
+        }
+    }
+}

crates/ergasia/src/extract/mod.rs

@@ -1,9 +1,10 @@
 mod detect;
+mod fs_walk;
 mod pipeline;
 mod rar;
 mod seven_zip;
 mod zip_extract;
 
 pub use detect::{ArchiveFormat, detect_archive_format};
-pub use pipeline::{ExtractedFile, ExtractionResult, extract_archives};
+pub use pipeline::{ExtractedFile, ExtractionLimits, ExtractionResult, extract_archives};
 pub use rar::find_rar_first_volume;