feat(sandbox): 不可信字节在沙箱子进程里解析(撤销权限、超时与内存强杀);种子、文件预览、字幕解析迁入

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/adapters/src/qbittorrent/client.ts

@@ -5,10 +5,11 @@
  * 叠加:多实例、错误分类(DownloaderError)、提交幂等(本地 infohash 预查 + 收单超时按 hash 回查)。
  */
 import { randomBytes } from "node:crypto";
+import { parseTorrentIsolated } from "../isolation.ts";
 import { DownloaderError, type DownloaderErrorKind } from "./errors.ts";
 import { assertSafeToDeleteData, type SafeDeleteCheck } from "./safe-delete.ts";
 import { isDownloadComplete, mapQbState, type QbObservedState } from "./state.ts";
-import { BencodeError, parseMagnet, parseTorrent } from "./torrent.ts";
+import { BencodeError, parseMagnet } from "./torrent.ts";
 
 export interface QbInstanceConfig {
   /** 本系统内的下载器实例 ID(downloader_instance.id) */
@@ -760,7 +761,7 @@ export class QbClient implements DownloaderClient {
     const src = req.source;
     if (src.kind === "file") {
       try {
-        hash = parseTorrent(src.bytes).hash;
+        hash = (await parseTorrentIsolated(src.bytes)).hash;
       } catch (e) {
         if (e instanceof BencodeError) return { kind: "rejected", reason: `invalid torrent: ${e.message}`, hash: null };
         throw e;