fix: scan historical legacy package paths

[Patrick-Erichsen]

Summary

• reconstruct historical legacy package ZIPs for the protected Linux Plugin Inspector worker without applying modern cross-platform filename rules retroactively
• retain absolute-path, traversal-segment, backslash, NUL, empty-segment, and file/ancestor collision protections
• keep public downloads and modern package publication on the existing strict portable-path validator

Production symptom and root cause

The notification-disabled beta scan repeatedly stopped on s2-space-agent-os@2.0.0 because its historical release contains s2-os-core:requirements.txt and a mojibake filename with control-code bytes. Both predate portable filename validation. The protected scan artifact endpoint rebuilt this release through the modern strict ZIP builder and threw before returning bytes.

Repro workflow: https://github.com/openclaw/clawhub/actions/runs/30603891909

Provenance: strict validation entered the shared builder in #3090. This fix preserves that contract and adds a scan-only legacy projection at the failing endpoint.

Validation

• bunx vitest run convex/packageInspectorHttp.test.ts convex/lib/skillZip.test.ts — 26 passed
• bun run ci:unit — 5,831 passed, 2 skipped
• bun run ci:types-build — passed
• bun run ci:packages — passed
• bun run ci:static — passed from a clean clone (the source worktree intentionally preserves unrelated untracked artifacts)
• .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main --stream-engine-output — clean, no accepted/actionable findings

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clawhub	Ready	Preview	Jul 31, 2026 4:53am