Fix setup nu extract cap for Nushell 0.114 archives

[tonythethompson]

Summary

numan setup nu fails on current official Nushell releases:

Error: Failed to extract '.../nu-0.114.1-x86_64-unknown-linux-gnu.tar.gz'
Caused by:
    Archive uncompressed size exceeds 268435456 bytes. This may be an archive bomb.

Nu 0.114.1 linux-gnu is ~279 MiB uncompressed (mostly bundled plugins like polars). Bootstrap only needs the nu binary.

Fix

• Extract only **/nu / **/nu.exe from the official release archive
• Raise the bootstrap uncompressed-size cap from 256 MiB to 512 MiB
• Archive-bomb accounting (file_count / total_bytes) now charges every regular-file entry scanned, including entries skipped by the include filter. The filter only decides what is written to disk.

Test plan

• cargo test --lib install::extract::
• cargo test --lib nu::bootstrap::
• Smoke against real nu-0.114.1-x86_64-unknown-linux-gnu.tar.gz

Release note

This is a client fix. Users need a new Numan release (or cargo install from this commit) before brew/cargo-installed numan setup nu works again for Nu 0.114.x.

  

[coderabbitai]

Warning

Review limit reached

@cursor[bot], you've reached your PR review limit, so we couldn't start this review.

Next review available in: 5 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7ad85845-4392-4d27-bd16-f843edf22ac6

📥 Commits

Reviewing files that changed from the base of the PR and between 2bff710 and bca5178.

📒 Files selected for processing (3)

• CHANGELOG.md
• src/install/extract.rs
• src/nu/bootstrap.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Sorry @tonythethompson, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[qodo-code-review]

PR Summary by Qodo

Fix setup nu extraction for Nushell 0.114.x by filtering to nu binary

🐞 Bug fix 🧪 Tests 📝 Documentation 🕐 20-40 Minutes

AI Description

• Extract only the nu/nu.exe binary from official Nushell release archives.
• Raise Nu bootstrap uncompressed-size cap to 512 MiB to avoid false archive-bomb failures.
• Add unit + smoke tests to validate filtering and real-archive install behavior.

Diagram

graph TD
A["numan setup nu"] --> B[("Nu release archive")] --> C["nu/bootstrap.rs"] --> D["extract_archive()"] --> E["Installed nu binary"]
C --> F["ExtractConfig: include+cap"] --> D

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Remove/disable uncompressed-size cap for Nu archives

• ➕ Simplifies configuration and avoids future size regressions.
• ➖ Reduces protection against archive bombs/malicious assets.
• ➖ Makes extraction behavior less predictable for other managed installs.

2. Stream-validate only included entries (ignore excluded sizes)

• ➕ Keeps a strict cap while preventing excluded plugin payloads from counting against it.
• ➕ More robust if archives continue growing in excluded areas.
• ➖ More complex extraction implementation; depends on how size accounting is implemented in the extractor.
• ➖ Higher risk of subtle security/DoS regressions if accounting is wrong.

3. Fetch/install a minimal `nu`-only artifact (if upstream provides one)

• ➕ Avoids large archives entirely; faster downloads and extracts.
• ➖ Not currently guaranteed by upstream release assets; adds conditional logic and platform-specific handling.

Recommendation: The chosen approach (include-filtering to **/nu/**/nu.exe plus a moderately higher cap) is the best tradeoff: it restores installs for 0.114.x while keeping an explicit archive-bomb guardrail. A more sophisticated “count only included entries” approach could further tighten security, but it would add extractor complexity with limited immediate payoff.

Files changed (3) +118 / -5

Bug fix (1) +109 / -4

bootstrap.rsExtract only 'nu' from release archives and raise bootstrap size cap +109/-4

Extract only 'nu' from release archives and raise bootstrap size cap

• Introduces a dedicated Nu release extraction configuration that includes only the 'nu'/'nu.exe' binary and raises the uncompressed-size limit to 512 MiB. Updates the install path to use this config and adds tests validating the cap choice, include-filter behavior, and an optional real-archive smoke test.

src/nu/bootstrap.rs

Documentation (2) +9 / -1

CHANGELOG.mdDocument fix for Nu 0.114.x archive extraction failures +7/-0

Document fix for Nu 0.114.x archive extraction failures

• Adds an Unreleased changelog entry describing why 'numan setup nu' failed on Nushell 0.114.x and how the bootstrap now avoids bundled plugin extraction while raising the cap.

CHANGELOG.md

extract.rsClarify ExtractConfig size-cap usage for Nu bootstrap +2/-1

Clarify ExtractConfig size-cap usage for Nu bootstrap

• Updates the inline documentation to note that Nu bootstrap uses a larger uncompressed-size cap and filters extraction to the 'nu' binary.

src/install/extract.rs

[greptile-apps]

Greptile Summary

The PR restores numan setup nu for current Nushell archives by extracting only the shell executable while retaining archive-wide bomb accounting.

• Raises the Nushell bootstrap extraction cap from 256 MiB to 512 MiB.
• Filters extraction to nu or nu.exe, excluding bundled plugin payloads from disk.
• Counts all scanned regular files toward file-count and uncompressed-size limits, including excluded entries.
• Adds regression coverage and documents the behavior in the changelog.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/install/extract.rs	Moves archive-bomb accounting ahead of include filtering and adds regression coverage proving excluded regular files still count toward extraction limits.
src/nu/bootstrap.rs	Configures Nushell bootstrap extraction to select only the platform executable under a 512 MiB archive-wide cap and adds archive-layout tests.
CHANGELOG.md	Documents the restored Nushell 0.114.x setup behavior, filtered extraction, and archive-wide accounting semantics.

_{Reviews (2): Last reviewed commit: "Count all archive entries toward bomb li..." | Re-trigger Greptile}

[Copilot]

Pull request overview

This PR fixes numan setup nu failing to install current official Nushell releases (e.g. 0.114.1) due to the archive-bomb uncompressed-size guard tripping on larger upstream bundles.

Changes:

• Introduces a Nushell-release-specific extract config that (a) extracts only the nu/nu.exe binary and (b) increases the uncompressed-size cap to 512 MiB.
• Updates install_from_archive to use the new extract config, avoiding bundled plugin payload extraction during bootstrap.
• Adds targeted tests to ensure the size cap and include-filter behavior works as intended, plus a manual smoke test hook for real upstream archives.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/nu/bootstrap.rs	Adds a Nushell-release extract config (include filter + 512 MiB cap), wires it into install_from_archive, and adds tests (including an ignore-only real-archive smoke).
src/install/extract.rs	Clarifies ExtractConfig::max_uncompressed_bytes docs to reference the bootstrap override and include filtering.
CHANGELOG.md	Adds an Unreleased “Fixed” entry describing the restored setup nu behavior for 0.114.x archives.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Include bypasses bomb limits ✓ Resolved 🐞 Bug ⛨ Security

Description

Bootstrap now uses an include filter when extracting Nushell releases, but extract_archive() applies
its file-count and total-uncompressed-size bomb limits only after the include check. This allows
archives with a small matching nu entry plus enormous non-matching entries to evade the
guardrails, especially for streaming tar.gz/tar.xz where skipped payloads may still be
decompressed/consumed while scanning the stream.

Code

src/nu/bootstrap.rs[R78-81]

+        include: Some(vec![format!("**/{}", nu_binary_name())]),
+        max_uncompressed_bytes: Some(NU_RELEASE_MAX_UNCOMPRESSED_BYTES),
+        ..ExtractConfig::default()
+    }

Relevance

●● Moderate

Security hardening likely welcomed, but change affects streaming extract semantics; no close
precedent on include+bomb caps.

PR-#83
PR-#84

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Bootstrap enables include: **/nu, but both zip and tar extractors continue on non-matching
entries before incrementing file_count/total_bytes, so excluded entries are not counted toward
the archive-bomb caps. The added unit test explicitly expects this bypass by asserting extraction
succeeds under a tiny max_uncompressed_bytes even with a sibling “plugin” entry present.

src/nu/bootstrap.rs[74-82]
src/nu/bootstrap.rs[219-243]
src/install/extract.rs[140-203]
src/install/extract.rs[239-342]
src/nu/bootstrap.rs[1121-1161]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`extract_archive` currently charges `file_count` and `total_bytes` only for entries that pass the include filter. Because bootstrap now sets `include: **/nu`, large sibling entries in a tar/zip can be ignored by the accounting and therefore bypass the archive-bomb limits. For streaming tar formats this can still force significant decompression/IO while scanning entries.

### Issue Context
Bootstrap’s new `nu_release_extract_config()` uses `include` to avoid extracting bundled plugins, but the safety caps should still apply to the *archive as scanned*, not just the subset written to disk.

### Fix Focus Areas
- src/install/extract.rs[178-203]
- src/install/extract.rs[301-320]
- src/nu/bootstrap.rs[74-82]
- src/nu/bootstrap.rs[1121-1161]

### Suggested fix
1. In both `extract_zip` and `extract_tar_inner`, move the archive-bomb accounting (`file_count`, `total_bytes`, and associated max checks) to occur *before* the `include_checker.matches(...)` early-continue, so all regular-file entries are counted.
2. Keep the include filter only for deciding whether to **write** the entry to disk.
3. Update the unit test `install_from_archive_skips_bundled_plugin_payloads` to assert “plugins are not extracted” without asserting that excluded entries don’t count toward the size cap (since that behavior is what weakens the guard).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context used

✅ Compliance rules (platform): 26 rules

✅ REVIEW.md

Review mode: ⚖️ Balanced: This changes archive extraction behavior and the uncompressed-size safety cap, creating genuine security and correctness risk, but the logic is localized enough for one careful review pass.

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[qodo-code-review]

Qodo Fixer

No findings are within the configured fix scope. To change which findings are fixed, adjust the setting on your Qodo configuration page.

[linear-code]

NUM-76