fix(FN-5170): use in-process tar extraction for company imports

- Replace host tar invocation in parseCompanyArchive with in-process archive extraction
- Add core regression coverage for parsing archive contents without shell tar behavior
- Add unmocked dashboard route tests covering CLI company archive imports end to end
- Add a changeset for the published @runfusion/fusion package update

Fusion-Task-Id: FN-5170

packages/core/src/__tests__/agent-companies-parser.test.ts

@@ -1,10 +1,10 @@
-import { execSync } from "node:child_process";
-import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import * as childProcess from "node:child_process";
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import zlib from "node:zlib";
 
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 
 import {
   AgentCompaniesParseError,
@@ -37,6 +37,12 @@ function writeTextFile(path: string, content: string): void {
   writeFileSync(path, content, "utf-8");
 }
 
+function createTarFixture(archivePath: string, cwd: string, rootEntry: string): void {
+  childProcess.execSync(
+    `tar czf ${JSON.stringify(archivePath)} -C ${JSON.stringify(cwd)} ${JSON.stringify(rootEntry)}`,
+  );
+}
+
 // Keep ZIP fixtures fully deterministic and self-contained without relying on
 // external `zip` binaries that may be unavailable in CI/worktree environments.
 function createZipFromEntries(
@@ -431,13 +437,59 @@ name: Archive CEO
 ---`);
 
       const archivePath = join(root, "company.tgz");
-      execSync(`tar czf ${JSON.stringify(archivePath)} -C ${JSON.stringify(root)} company-package`);
+      createTarFixture(archivePath, root, "company-package");
 
       const pkg = await parseCompanyArchive(archivePath);
       expect(pkg.company?.name).toBe("Archive Company");
       expect(pkg.agents[0]?.name).toBe("Archive CEO");
     });
 
+    it("extracts .tgz archives without invoking the host tar binary", async () => {
+      const root = createTempDir();
+      const packageDir = join(root, "company-package");
+      writeTextFile(join(packageDir, "COMPANY.md"), `---\nname: Archive Company\n---`);
+
+      const archivePath = join(root, "company.tgz");
+      createTarFixture(archivePath, root, "company-package");
+
+      const execFileMock = vi.fn();
+      const execMock = vi.fn();
+      const spawnMock = vi.fn();
+      const execSyncMock = vi.fn();
+
+      vi.resetModules();
+      vi.doMock("node:child_process", async (importOriginal) => {
+        const actual = await importOriginal<typeof import("node:child_process")>();
+        return {
+          ...actual,
+          execFile: execFileMock,
+          exec: execMock,
+          spawn: spawnMock,
+          execSync: execSyncMock,
+        };
+      });
+
+      const parserModule = await import("../agent-companies-parser.js");
+      const pkg = await parserModule.parseCompanyArchive(archivePath);
+
+      expect(pkg.company?.name).toBe("Archive Company");
+      expect(execFileMock).not.toHaveBeenCalled();
+      expect(execMock).not.toHaveBeenCalled();
+      expect(spawnMock).not.toHaveBeenCalled();
+      expect(execSyncMock).not.toHaveBeenCalled();
+
+      vi.doUnmock("node:child_process");
+      vi.resetModules();
+    });
+
+    it("does not reference child-process tar extraction in production source", () => {
+      const parserSource = readFileSync(new URL("../agent-companies-parser.ts", import.meta.url), "utf-8");
+      expect(parserSource).not.toContain("node:child_process");
+      expect(parserSource).not.toContain("execSync(");
+      expect(parserSource).not.toContain("execFile(");
+      expect(parserSource).not.toContain("spawn(");
+    });
+
     it("throws descriptive error when tar extraction fails", async () => {
       const root = createTempDir();
       const archivePath = join(root, "corrupt.tgz");
@@ -463,13 +515,30 @@ name: Nested Archive CEO
 ---`);
 
       const archivePath = join(root, "nested-company.tgz");
-      execSync(`tar czf ${JSON.stringify(archivePath)} -C ${JSON.stringify(root)} outer-layer`);
+      createTarFixture(archivePath, root, "outer-layer");
 
       const pkg = await parseCompanyArchive(archivePath);
       expect(pkg.company?.name).toBe("Nested Archive Company");
       expect(pkg.agents[0]?.name).toBe("Nested Archive CEO");
     });
 
+    it("surfaces a deterministic AgentCompaniesParseError when the archive is truncated mid-stream", async () => {
+      const root = createTempDir();
+      const packageDir = join(root, "company-package");
+      writeTextFile(join(packageDir, "COMPANY.md"), `---\nname: Archive Company\n---`);
+
+      const validArchivePath = join(root, "valid-company.tgz");
+      createTarFixture(validArchivePath, root, "company-package");
+
+      const truncatedArchivePath = join(root, "truncated-company.tgz");
+      writeFileSync(truncatedArchivePath, readFileSync(validArchivePath).subarray(0, 64));
+
+      await expect(parseCompanyArchive(truncatedArchivePath)).rejects.toMatchObject({
+        name: "AgentCompaniesParseError",
+        message: expect.stringMatching(/^Failed to parse Agent Companies archive/),
+      });
+    });
+
     it("throws AgentCompaniesParseError for a non-existent .tar.gz file", async () => {
       const archivePath = join(createTempDir(), "missing.tgz");
 
@@ -518,6 +587,25 @@ name: Nested Archive CEO
       expect(pkg.agents[0]?.name).toBe("GStack CEO");
     });
 
+    it("preserves subPath validation for .tgz archives", async () => {
+      const root = createTempDir();
+      const monorepoDir = join(root, "companies-main");
+      writeTextFile(join(monorepoDir, "aeon", "COMPANY.md"), `---\nname: Aeon\n---`);
+      writeTextFile(join(monorepoDir, "gstack", "COMPANY.md"), `---\nname: GStack\n---`);
+      writeTextFile(join(monorepoDir, "gstack", "agents", "ceo", "AGENTS.md"), `---\nname: GStack CEO\n---`);
+
+      const archivePath = join(root, "mono.tgz");
+      createTarFixture(archivePath, root, "companies-main");
+
+      const pkg = await parseCompanyArchive(archivePath, { subPath: "gstack" });
+      expect(pkg.company?.name).toBe("GStack");
+      expect(pkg.agents[0]?.name).toBe("GStack CEO");
+
+      await expect(parseCompanyArchive(archivePath, { subPath: "../etc" })).rejects.toThrow(
+        AgentCompaniesParseError,
+      );
+    });
+
     it("throws when subPath does not contain COMPANY.md", async () => {
       const root = createTempDir();
       const archivePath = join(root, "missing-subpath.zip");

packages/core/src/agent-companies-parser.ts

@@ -9,6 +9,7 @@ import { tmpdir } from "node:os";
 import { isAbsolute, join, normalize, resolve } from "node:path";
 
 import extractZip from "extract-zip";
+import { x as tarExtract } from "tar";
 import { parse as parseYaml } from "yaml";
 
 import type {
@@ -480,12 +481,10 @@ function resolveExtractionRoot(tempDir: string): string {
 }
 
 async function extractTarArchive(archivePath: string, outputDir: string): Promise<void> {
-  const [{ execFile }, { promisify }] = await Promise.all([
-    import("node:child_process"),
-    import("node:util"),
-  ]);
-  const execFileAsync = promisify(execFile);
-  await execFileAsync("tar", ["xzf", archivePath, "-C", outputDir]);
+  await tarExtract({
+    file: archivePath,
+    cwd: outputDir,
+  });
 }
 
 function sanitizeCompanySubPath(subPath: string): string {

packages/dashboard/src/__tests__/routes-agent-import-unmocked.test.ts

@@ -0,0 +1,98 @@
+import { execSync } from "node:child_process";
+import { EventEmitter } from "node:events";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { createServer } from "../server.js";
+import { request } from "../test-request.js";
+
+class MockStore extends EventEmitter {
+  constructor(private readonly rootDir: string) {
+    super();
+  }
+
+  getRootDir(): string {
+    return this.rootDir;
+  }
+
+  getFusionDir(): string {
+    return join(this.rootDir, ".fusion");
+  }
+
+  getDatabase() {
+    return {
+      exec() {},
+      prepare() {
+        return {
+          run() {
+            return { changes: 0 };
+          },
+          get() {
+            return undefined;
+          },
+          all() {
+            return [];
+          },
+        };
+      },
+    };
+  }
+}
+
+function createTarFixture(archivePath: string, cwd: string, rootEntry: string): void {
+  execSync(
+    `tar czf ${JSON.stringify(archivePath)} -C ${JSON.stringify(cwd)} ${JSON.stringify(rootEntry)}`,
+  );
+}
+
+async function postImport(app: Parameters<typeof request>[0], body: unknown) {
+  return request(app, "POST", "/api/agents/import", JSON.stringify(body), {
+    "content-type": "application/json",
+  });
+}
+
+describe("POST /api/agents/import (unmocked archive parsing)", () => {
+  let rootDir: string;
+  let app: ReturnType<typeof createServer>;
+
+  beforeEach(() => {
+    rootDir = mkdtempSync(join(tmpdir(), "fn-agent-import-unmocked-"));
+    mkdirSync(join(rootDir, ".fusion"), { recursive: true });
+    app = createServer(new MockStore(rootDir) as any);
+  });
+
+  afterEach(() => {
+    rmSync(rootDir, { recursive: true, force: true });
+  });
+
+  it("imports agents from a real .tgz archive source", async () => {
+    const packageDir = join(rootDir, "company-package");
+    mkdirSync(join(packageDir, "agents", "ceo"), { recursive: true });
+    mkdirSync(join(packageDir, "skills", "review"), { recursive: true });
+    writeFileSync(join(packageDir, "COMPANY.md"), "---\nname: Archive Company\nslug: archive-company\n---\n", "utf-8");
+    writeFileSync(join(packageDir, "agents", "ceo", "AGENTS.md"), "---\nname: Archive CEO\nrole: reviewer\n---\nLead reviews.\n", "utf-8");
+    writeFileSync(join(packageDir, "skills", "review", "SKILL.md"), "---\nname: Review\ndescription: Review skill\n---\n# Review\n", "utf-8");
+
+    const archivePath = join(rootDir, "company.tgz");
+    createTarFixture(archivePath, rootDir, "company-package");
+
+    const response = await postImport(app, { source: archivePath });
+
+    expect(response.status).toBe(200);
+    expect(response.body).toMatchObject({
+      companyName: "Archive Company",
+      companySlug: "archive-company",
+      skipped: [],
+      errors: [],
+      skillsCount: 1,
+      created: [
+        {
+          name: "Archive CEO",
+        },
+      ],
+    });
+  });
+});