@openclaw/crabline 0.1.9 → 0.1.11

package/dist/src/openclaw/private-file.js

@@ -0,0 +1,465 @@
+import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import fs, {} from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const WINDOWS_OWNER_ONLY_ACL_SCRIPT = String.raw `
+$ErrorActionPreference = "Stop"
+$filePath = $env:CRABLINE_PRIVATE_FILE_PATH
+if ([string]::IsNullOrWhiteSpace($filePath)) {
+  throw "CRABLINE_PRIVATE_FILE_PATH is required."
+}
+
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+$sid = $identity.User
+if ($null -eq $sid) {
+  throw "Could not resolve the current Windows user SID."
+}
+
+$acl = Get-Acl -LiteralPath $filePath
+$acl.SetOwner($sid)
+$acl.SetAccessRuleProtection($true, $false)
+$existingRules = @($acl.GetAccessRules(
+  $true,
+  $false,
+  [System.Security.Principal.SecurityIdentifier]
+))
+foreach ($existingRule in $existingRules) {
+  [void]$acl.RemoveAccessRuleSpecific($existingRule)
+}
+$rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+  $sid,
+  [System.Security.AccessControl.FileSystemRights]::FullControl,
+  [System.Security.AccessControl.AccessControlType]::Allow
+)
+$acl.SetAccessRule($rule)
+Set-Acl -LiteralPath $filePath -AclObject $acl
+
+$actual = Get-Acl -LiteralPath $filePath
+$ownerSid = $actual.GetOwner([System.Security.Principal.SecurityIdentifier])
+$rules = @($actual.GetAccessRules(
+  $true,
+  $true,
+  [System.Security.Principal.SecurityIdentifier]
+))
+if (-not $actual.AreAccessRulesProtected) {
+  throw "Private file DACL still inherits permissions."
+}
+if ($ownerSid.Value -ne $sid.Value) {
+  throw "Private file owner SID does not match the current user."
+}
+if ($rules.Count -ne 1) {
+  throw "Private file DACL must contain exactly one access rule."
+}
+$actualRule = $rules[0]
+if (
+  $actualRule.IsInherited -or
+  $actualRule.IdentityReference.Value -ne $sid.Value -or
+  $actualRule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow -or
+  (($actualRule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne [System.Security.AccessControl.FileSystemRights]::FullControl)
+) {
+  throw "Private file DACL is not owner-only full control."
+}
+`;
+const WINDOWS_OWNER_ONLY_DIRECTORY_ACL_SCRIPT = String.raw `
+$ErrorActionPreference = "Stop"
+$directoryPath = $env:CRABLINE_PRIVATE_DIRECTORY_PATH
+if ([string]::IsNullOrWhiteSpace($directoryPath)) {
+  throw "CRABLINE_PRIVATE_DIRECTORY_PATH is required."
+}
+
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+$sid = $identity.User
+if ($null -eq $sid) {
+  throw "Could not resolve the current Windows user SID."
+}
+
+$acl = Get-Acl -LiteralPath $directoryPath
+$acl.SetOwner($sid)
+$acl.SetAccessRuleProtection($true, $false)
+$existingRules = @($acl.GetAccessRules(
+  $true,
+  $false,
+  [System.Security.Principal.SecurityIdentifier]
+))
+foreach ($existingRule in $existingRules) {
+  [void]$acl.RemoveAccessRuleSpecific($existingRule)
+}
+$inheritance = (
+  [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor
+  [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
+)
+$rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+  $sid,
+  [System.Security.AccessControl.FileSystemRights]::FullControl,
+  $inheritance,
+  [System.Security.AccessControl.PropagationFlags]::None,
+  [System.Security.AccessControl.AccessControlType]::Allow
+)
+$acl.SetAccessRule($rule)
+Set-Acl -LiteralPath $directoryPath -AclObject $acl
+
+$actual = Get-Acl -LiteralPath $directoryPath
+$ownerSid = $actual.GetOwner([System.Security.Principal.SecurityIdentifier])
+$rules = @($actual.GetAccessRules(
+  $true,
+  $true,
+  [System.Security.Principal.SecurityIdentifier]
+))
+if (-not $actual.AreAccessRulesProtected) {
+  throw "Private directory DACL still inherits permissions."
+}
+if ($ownerSid.Value -ne $sid.Value) {
+  throw "Private directory owner SID does not match the current user."
+}
+if ($rules.Count -ne 1) {
+  throw "Private directory DACL must contain exactly one access rule."
+}
+$actualRule = $rules[0]
+$requiredInheritance = (
+  [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor
+  [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
+)
+if (
+  $actualRule.IsInherited -or
+  $actualRule.IdentityReference.Value -ne $sid.Value -or
+  $actualRule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow -or
+  (($actualRule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne [System.Security.AccessControl.FileSystemRights]::FullControl) -or
+  (($actualRule.InheritanceFlags -band $requiredInheritance) -ne $requiredInheritance)
+) {
+  throw "Private directory DACL is not owner-only inheritable full control."
+}
+`;
+const runWindowsAclCommand = async (command, args, options) => {
+    await execFileAsync(command, args, options);
+};
+export function resolveWindowsPowerShellPath(systemRoot) {
+    const normalizedRoot = systemRoot?.trim() ? path.win32.normalize(systemRoot.trim()) : undefined;
+    if (!normalizedRoot || !/^[A-Za-z]:\\/.test(normalizedRoot)) {
+        throw new Error("SystemRoot must be an absolute local Windows path.");
+    }
+    return path.win32.join(normalizedRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+}
+export async function applyOwnerOnlyWindowsAcl(filePath, run = runWindowsAclCommand, systemRoot = process.env.SystemRoot) {
+    try {
+        const powershellPath = resolveWindowsPowerShellPath(systemRoot);
+        await run(powershellPath, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", WINDOWS_OWNER_ONLY_ACL_SCRIPT], {
+            env: {
+                ...process.env,
+                CRABLINE_PRIVATE_FILE_PATH: path.resolve(filePath),
+            },
+            windowsHide: true,
+        });
+    }
+    catch (error) {
+        throw new Error("Could not apply and verify an owner-only Windows ACL; powershell.exe with Set-Acl is required.", { cause: error });
+    }
+}
+export async function applyOwnerOnlyWindowsDirectoryAcl(directoryPath, run = runWindowsAclCommand, systemRoot = process.env.SystemRoot) {
+    try {
+        const powershellPath = resolveWindowsPowerShellPath(systemRoot);
+        await run(powershellPath, [
+            "-NoLogo",
+            "-NoProfile",
+            "-NonInteractive",
+            "-Command",
+            WINDOWS_OWNER_ONLY_DIRECTORY_ACL_SCRIPT,
+        ], {
+            env: {
+                ...process.env,
+                CRABLINE_PRIVATE_DIRECTORY_PATH: path.resolve(directoryPath),
+            },
+            windowsHide: true,
+        });
+    }
+    catch (error) {
+        throw new Error("Could not apply and verify an owner-only Windows directory ACL; powershell.exe with Set-Acl is required.", { cause: error });
+    }
+}
+async function readHandleIdentity(handle) {
+    const stats = await handle.stat({ bigint: true });
+    if (stats.ino <= 0n) {
+        throw new Error("The filesystem did not provide a stable private file identity.");
+    }
+    return {
+        device: stats.dev,
+        inode: stats.ino,
+    };
+}
+async function assertPathIdentity(filePath, expected) {
+    try {
+        const stats = await fs.lstat(filePath, { bigint: true });
+        if (stats.isFile() &&
+            stats.nlink === 1n &&
+            stats.dev === expected.device &&
+            stats.ino === expected.inode) {
+            return;
+        }
+    }
+    catch (error) {
+        throw new Error("Private file path identity changed during publication.", { cause: error });
+    }
+    throw new Error("Private file path identity changed during publication.");
+}
+async function readDirectoryHandleIdentity(handle) {
+    const stats = await handle.stat({ bigint: true });
+    if (!stats.isDirectory() || stats.ino <= 0n) {
+        throw new Error("The filesystem did not provide a stable private directory identity.");
+    }
+    return {
+        device: stats.dev,
+        inode: stats.ino,
+        userId: stats.uid,
+    };
+}
+async function assertDirectoryPathIdentity(directoryPath, expected) {
+    try {
+        const stats = await fs.lstat(directoryPath, { bigint: true });
+        if (stats.isDirectory() && stats.dev === expected.device && stats.ino === expected.inode) {
+            return;
+        }
+    }
+    catch (error) {
+        throw new Error("Private directory path identity changed during publication.", {
+            cause: error,
+        });
+    }
+    throw new Error("Private directory path identity changed during publication.");
+}
+export async function captureDirectoryIdentity(directoryPath) {
+    const handle = await fs.open(directoryPath, "r");
+    try {
+        const identity = await readDirectoryHandleIdentity(handle);
+        const secured = {
+            async assertIdentityAt(currentPath = directoryPath) {
+                await assertDirectoryPathIdentity(currentPath, identity);
+            },
+            directoryPath,
+        };
+        await secured.assertIdentityAt();
+        return secured;
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function syncParentDirectory(filePath, platform = process.platform) {
+    if (platform === "win32") {
+        return;
+    }
+    const handle = await fs.open(path.dirname(filePath), "r");
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function syncParentAtAccessibleBoundary(filePath, syncParent, platform) {
+    try {
+        await syncParent(filePath, platform);
+        return true;
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "EACCES" || code === "EPERM") {
+            return false;
+        }
+        throw error;
+    }
+}
+async function syncPathAncestry(filePath, syncParent, platform, firstCreatedDirectory) {
+    const resolvedFilePath = path.resolve(filePath);
+    let currentPath = resolvedFilePath;
+    const syncThroughPath = firstCreatedDirectory === undefined ? undefined : path.resolve(firstCreatedDirectory);
+    for (;;) {
+        const mandatory = syncThroughPath !== undefined || currentPath === resolvedFilePath;
+        if (mandatory) {
+            await syncParent(currentPath, platform);
+        }
+        else if (!(await syncParentAtAccessibleBoundary(currentPath, syncParent, platform))) {
+            return;
+        }
+        if (currentPath === syncThroughPath) {
+            return;
+        }
+        const parentPath = path.dirname(currentPath);
+        if (path.dirname(parentPath) === parentPath) {
+            return;
+        }
+        currentPath = parentPath;
+    }
+}
+export async function removeSecuredPrivateDirectory(secured, currentPath = secured.directoryPath, quarantineBaseName = path.basename(currentPath)) {
+    if (path.basename(quarantineBaseName) !== quarantineBaseName || quarantineBaseName.length === 0) {
+        throw new Error("Private directory quarantine basename is malformed.");
+    }
+    const quarantinePath = path.join(path.dirname(currentPath), `.${quarantineBaseName}.${process.pid}.${randomUUID()}.remove`);
+    await secured.assertIdentityAt(currentPath);
+    await fs.rename(currentPath, quarantinePath);
+    await secured.assertIdentityAt(quarantinePath);
+    await syncParentDirectory(quarantinePath);
+    await fs.rm(quarantinePath, { force: true, recursive: true });
+    await syncParentDirectory(quarantinePath);
+}
+export async function securePrivateDirectory(directoryPath, options = {}) {
+    let created = false;
+    try {
+        await fs.mkdir(directoryPath, { mode: 0o700 });
+        created = true;
+    }
+    catch (error) {
+        if (error.code !== "EEXIST") {
+            throw error;
+        }
+    }
+    const handle = await fs.open(directoryPath, "r");
+    let handleOpen = true;
+    const closeHandle = async () => {
+        if (!handleOpen) {
+            return;
+        }
+        handleOpen = false;
+        await handle.close();
+    };
+    let identity;
+    try {
+        identity = await readDirectoryHandleIdentity(handle);
+    }
+    catch (error) {
+        try {
+            await closeHandle();
+        }
+        catch (closeError) {
+            const aggregateError = new AggregateError([error, closeError], "Private directory identity verification failed and its handle could not be closed.");
+            aggregateError.cause = error;
+            throw aggregateError;
+        }
+        throw error;
+    }
+    const secured = {
+        async assertIdentityAt(currentPath = directoryPath) {
+            await assertDirectoryPathIdentity(currentPath, identity);
+        },
+        directoryPath,
+    };
+    try {
+        await secured.assertIdentityAt();
+        if ((options.platform ?? process.platform) === "win32") {
+            await (options.secureWindowsDirectory ?? applyOwnerOnlyWindowsDirectoryAcl)(directoryPath);
+        }
+        else {
+            const currentUserId = options.currentUserId ?? process.geteuid?.();
+            if (currentUserId === undefined ||
+                !Number.isSafeInteger(currentUserId) ||
+                currentUserId < 0 ||
+                identity.userId !== BigInt(currentUserId)) {
+                throw new Error("Private directory must be owned by the current POSIX user.");
+            }
+            await handle.chmod(0o700);
+        }
+        await secured.assertIdentityAt();
+        const syncParent = options.syncParent ?? syncParentDirectory;
+        if (created) {
+            await syncParent(directoryPath, options.platform);
+        }
+        else {
+            await syncParentAtAccessibleBoundary(directoryPath, syncParent, options.platform);
+        }
+    }
+    catch (error) {
+        let primaryError = error;
+        try {
+            await closeHandle();
+        }
+        catch (closeError) {
+            const aggregateError = new AggregateError([error, closeError], "Private directory securing failed and its verification handle could not be closed.");
+            aggregateError.cause = error;
+            primaryError = aggregateError;
+        }
+        if (created) {
+            try {
+                await removeSecuredPrivateDirectory(secured);
+            }
+            catch (cleanupError) {
+                const aggregateError = new AggregateError([primaryError, cleanupError], `Private directory securing failed and rollback cleanup also failed: ${error instanceof Error ? error.message : String(error)}`);
+                aggregateError.cause = primaryError;
+                throw aggregateError;
+            }
+        }
+        throw primaryError;
+    }
+    finally {
+        await closeHandle();
+    }
+    return secured;
+}
+export async function publishPrivateFileAtomically(filePath, contents, options = {}) {
+    const temporaryPath = path.join(path.dirname(filePath), `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`);
+    const parentDirectory = path.resolve(path.dirname(filePath));
+    const firstCreatedDirectory = await fs.mkdir(parentDirectory, { recursive: true });
+    let handle;
+    let publicationFailed = false;
+    let primaryError;
+    try {
+        handle = await fs.open(temporaryPath, "wx+", 0o600);
+        const identity = await readHandleIdentity(handle);
+        if ((options.platform ?? process.platform) === "win32") {
+            await (options.secureWindowsFile ?? applyOwnerOnlyWindowsAcl)(temporaryPath);
+        }
+        else {
+            await handle.chmod(0o600);
+        }
+        await assertPathIdentity(temporaryPath, identity);
+        await handle.writeFile(contents, "utf8");
+        await handle.sync();
+        await assertPathIdentity(temporaryPath, identity);
+        await options.beforeRename?.(temporaryPath);
+        await assertPathIdentity(temporaryPath, identity);
+        await fs.rename(temporaryPath, filePath);
+        await syncPathAncestry(filePath, options.syncParent ?? syncParentDirectory, options.platform, firstCreatedDirectory);
+        await options.afterRename?.(filePath);
+        await assertPathIdentity(filePath, identity);
+    }
+    catch (error) {
+        publicationFailed = true;
+        primaryError = error;
+    }
+    const cleanupErrors = [];
+    try {
+        await handle?.close();
+    }
+    catch (error) {
+        cleanupErrors.push(error);
+    }
+    try {
+        await (options.removeTemporaryFile ??
+            ((candidatePath) => fs.rm(candidatePath, { force: true })))(temporaryPath);
+    }
+    catch (error) {
+        cleanupErrors.push(error);
+    }
+    if (publicationFailed) {
+        if (cleanupErrors.length > 0) {
+            const primaryMessage = primaryError instanceof Error ? primaryError.message : String(primaryError);
+            const aggregateError = new AggregateError([primaryError, ...cleanupErrors], `${primaryMessage} Private temporary file cleanup also failed.`);
+            aggregateError.cause = primaryError;
+            const primaryCode = typeof primaryError === "object" && primaryError !== null
+                ? primaryError.code
+                : undefined;
+            if (primaryCode) {
+                Object.assign(aggregateError, { code: primaryCode });
+            }
+            throw aggregateError;
+        }
+        throw primaryError;
+    }
+    if (cleanupErrors.length === 1) {
+        throw cleanupErrors[0];
+    }
+    if (cleanupErrors.length > 1) {
+        throw new AggregateError(cleanupErrors, "Private temporary file publication cleanup failed.");
+    }
+}
+//# sourceMappingURL=private-file.js.map

package/dist/src/openclaw/private-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-file.js","sourceRoot":"","sources":["../../../src/openclaw/private-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAmB,MAAM,kBAAkB,CAAC;AACvD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,6BAA6B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyD/C,CAAC;AAEF,MAAM,uCAAuC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoEzD,CAAC;AAWF,MAAM,oBAAoB,GAAqB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;IAC9E,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,UAAU,4BAA4B,CAAC,UAAqC;IAChF,MAAM,cAAc,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,GAAG,GAAqB,oBAAoB,EAC5C,UAAU,GAA8B,OAAO,CAAC,GAAG,CAAC,UAAU;IAE9D,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,GAAG,CACP,cAAc,EACd,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,6BAA6B,CAAC,EACvF;YACE,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,0BAA0B,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;aACnD;YACD,WAAW,EAAE,IAAI;SAClB,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,gGAAgG,EAChG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,aAAqB,EACrB,GAAG,GAAqB,oBAAoB,EAC5C,UAAU,GAA8B,OAAO,CAAC,GAAG,CAAC,UAAU;IAE9D,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,GAAG,CACP,cAAc,EACd;YACE,SAAS;YACT,YAAY;YACZ,iBAAiB;YACjB,UAAU;YACV,uCAAuC;SACxC,EACD;YACE,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,+BAA+B,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;aAC7D;YACD,WAAW,EAAE,IAAI;SAClB,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,0GAA0G,EAC1G,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,KAAK,UAAU,kBAAkB,CAAC,MAAkB;IAClD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,GAAG;QACjB,KAAK,EAAE,KAAK,CAAC,GAAG;KACjB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,QAAsB;IACxE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IACE,KAAK,CAAC,MAAM,EAAE;YACd,KAAK,CAAC,KAAK,KAAK,EAAE;YAClB,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM;YAC7B,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,EAC5B,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,wDAAwD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC;AAQD,KAAK,UAAU,2BAA2B,CAAC,MAAkB;IAC3D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,GAAG;QACjB,KAAK,EAAE,KAAK,CAAC,GAAG;QAChB,MAAM,EAAE,KAAK,CAAC,GAAG;KAClB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,aAAqB,EACrB,QAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;YACzF,OAAO;QACT,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6DAA6D,EAAE;YAC7E,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;AACjF,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,aAAqB;IAErB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,OAAO,GAA4B;YACvC,KAAK,CAAC,gBAAgB,CAAC,WAAW,GAAG,aAAa;gBAChD,MAAM,2BAA2B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC3D,CAAC;YACD,aAAa;SACd,CAAC;QACF,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,QAAgB,EAChB,UAA2E,EAC3E,QAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAgB,EAChB,UAA2E,EAC3E,QAA0B,EAC1B,qBAA8B;IAE9B,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,WAAW,GAAG,gBAAgB,CAAC;IACnC,MAAM,eAAe,GACnB,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACxF,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,eAAe,KAAK,SAAS,IAAI,WAAW,KAAK,gBAAgB,CAAC;QACpF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,8BAA8B,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACtF,OAAO;QACT,CAAC;QACD,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,WAAW,GAAG,UAAU,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAgC,EAChC,WAAW,GAAG,OAAO,CAAC,aAAa,EACnC,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;IAE/C,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,KAAK,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAC9B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EACzB,IAAI,kBAAkB,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,SAAS,CAC/D,CAAC;IACF,MAAM,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC7C,MAAM,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,EAAE,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,mBAAmB,CAAC,cAAc,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,aAAqB,EACrB,OAAO,GAKH,EAAE;IAEN,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,UAAU,GAAG,IAAI,CAAC;IACtB,MAAM,WAAW,GAAG,KAAK,IAAI,EAAE;QAC7B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,UAAU,GAAG,KAAK,CAAC;QACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC;IACF,IAAI,QAA2B,CAAC;IAChC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,WAAW,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,MAAM,cAAc,GAAG,IAAI,cAAc,CACvC,CAAC,KAAK,EAAE,UAAU,CAAC,EACnB,oFAAoF,CACrF,CAAC;YACF,cAAc,CAAC,KAAK,GAAG,KAAK,CAAC;YAC7B,MAAM,cAAc,CAAC;QACvB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAA4B;QACvC,KAAK,CAAC,gBAAgB,CAAC,WAAW,GAAG,aAAa;YAChD,MAAM,2BAA2B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3D,CAAC;QACD,aAAa;KACd,CAAC;IACF,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;YACvD,MAAM,CAAC,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC7F,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACnE,IACE,aAAa,KAAK,SAAS;gBAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC;gBACpC,aAAa,GAAG,CAAC;gBACjB,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,aAAa,CAAC,EACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC7D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,MAAM,8BAA8B,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,WAAW,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,MAAM,cAAc,GAAG,IAAI,cAAc,CACvC,CAAC,KAAK,EAAE,UAAU,CAAC,EACnB,oFAAoF,CACrF,CAAC;YACF,cAAc,CAAC,KAAK,GAAG,KAAK,CAAC;YAC7B,YAAY,GAAG,cAAc,CAAC;QAChC,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,6BAA6B,CAAC,OAAO,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB,MAAM,cAAc,GAAG,IAAI,cAAc,CACvC,CAAC,YAAY,EAAE,YAAY,CAAC,EAC5B,uEACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;gBACF,cAAc,CAAC,KAAK,GAAG,YAAY,CAAC;gBACpC,MAAM,cAAc,CAAC;YACvB,CAAC;QACH,CAAC;QACD,MAAM,YAAY,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,EAAE,CAAC;IACtB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,QAAgB,EAChB,QAAgB,EAChB,OAAO,GAOH,EAAE;IAEN,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAC7B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CACjE,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,IAAI,MAA8B,CAAC;IACnC,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,YAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;YACvD,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,wBAAwB,CAAC,CAAC,aAAa,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,aAAa,CAAC,CAAC;QAC5C,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,gBAAgB,CACpB,QAAQ,EACR,OAAO,CAAC,UAAU,IAAI,mBAAmB,EACzC,OAAO,CAAC,QAAQ,EAChB,qBAAqB,CACtB,CAAC;QACF,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iBAAiB,GAAG,IAAI,CAAC;QACzB,YAAY,GAAG,KAAK,CAAC;IACvB,CAAC;IAED,MAAM,aAAa,GAAc,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CACJ,OAAO,CAAC,mBAAmB;YAC3B,CAAC,CAAC,aAAqB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CACnE,CAAC,aAAa,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,cAAc,GAClB,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9E,MAAM,cAAc,GAAG,IAAI,cAAc,CACvC,CAAC,YAAY,EAAE,GAAG,aAAa,CAAC,EAChC,GAAG,cAAc,8CAA8C,CAChE,CAAC;YACF,cAAc,CAAC,KAAK,GAAG,YAAY,CAAC;YACpC,MAAM,WAAW,GACf,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI;gBACvD,CAAC,CAAE,YAAsC,CAAC,IAAI;gBAC9C,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,cAAc,CAAC;QACvB,CAAC;QACD,MAAM,YAAY,CAAC;IACrB,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,cAAc,CAAC,aAAa,EAAE,oDAAoD,CAAC,CAAC;IAChG,CAAC;AACH,CAAC","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport fs, { type FileHandle } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { promisify } from \"node:util\";\n\nconst execFileAsync = promisify(execFile);\n\nconst WINDOWS_OWNER_ONLY_ACL_SCRIPT = String.raw`\n$ErrorActionPreference = \"Stop\"\n$filePath = $env:CRABLINE_PRIVATE_FILE_PATH\nif ([string]::IsNullOrWhiteSpace($filePath)) {\n  throw \"CRABLINE_PRIVATE_FILE_PATH is required.\"\n}\n\n$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()\n$sid = $identity.User\nif ($null -eq $sid) {\n  throw \"Could not resolve the current Windows user SID.\"\n}\n\n$acl = Get-Acl -LiteralPath $filePath\n$acl.SetOwner($sid)\n$acl.SetAccessRuleProtection($true, $false)\n$existingRules = @($acl.GetAccessRules(\n  $true,\n  $false,\n  [System.Security.Principal.SecurityIdentifier]\n))\nforeach ($existingRule in $existingRules) {\n  [void]$acl.RemoveAccessRuleSpecific($existingRule)\n}\n$rule = [System.Security.AccessControl.FileSystemAccessRule]::new(\n  $sid,\n  [System.Security.AccessControl.FileSystemRights]::FullControl,\n  [System.Security.AccessControl.AccessControlType]::Allow\n)\n$acl.SetAccessRule($rule)\nSet-Acl -LiteralPath $filePath -AclObject $acl\n\n$actual = Get-Acl -LiteralPath $filePath\n$ownerSid = $actual.GetOwner([System.Security.Principal.SecurityIdentifier])\n$rules = @($actual.GetAccessRules(\n  $true,\n  $true,\n  [System.Security.Principal.SecurityIdentifier]\n))\nif (-not $actual.AreAccessRulesProtected) {\n  throw \"Private file DACL still inherits permissions.\"\n}\nif ($ownerSid.Value -ne $sid.Value) {\n  throw \"Private file owner SID does not match the current user.\"\n}\nif ($rules.Count -ne 1) {\n  throw \"Private file DACL must contain exactly one access rule.\"\n}\n$actualRule = $rules[0]\nif (\n  $actualRule.IsInherited -or\n  $actualRule.IdentityReference.Value -ne $sid.Value -or\n  $actualRule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow -or\n  (($actualRule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne [System.Security.AccessControl.FileSystemRights]::FullControl)\n) {\n  throw \"Private file DACL is not owner-only full control.\"\n}\n`;\n\nconst WINDOWS_OWNER_ONLY_DIRECTORY_ACL_SCRIPT = String.raw`\n$ErrorActionPreference = \"Stop\"\n$directoryPath = $env:CRABLINE_PRIVATE_DIRECTORY_PATH\nif ([string]::IsNullOrWhiteSpace($directoryPath)) {\n  throw \"CRABLINE_PRIVATE_DIRECTORY_PATH is required.\"\n}\n\n$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()\n$sid = $identity.User\nif ($null -eq $sid) {\n  throw \"Could not resolve the current Windows user SID.\"\n}\n\n$acl = Get-Acl -LiteralPath $directoryPath\n$acl.SetOwner($sid)\n$acl.SetAccessRuleProtection($true, $false)\n$existingRules = @($acl.GetAccessRules(\n  $true,\n  $false,\n  [System.Security.Principal.SecurityIdentifier]\n))\nforeach ($existingRule in $existingRules) {\n  [void]$acl.RemoveAccessRuleSpecific($existingRule)\n}\n$inheritance = (\n  [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor\n  [System.Security.AccessControl.InheritanceFlags]::ObjectInherit\n)\n$rule = [System.Security.AccessControl.FileSystemAccessRule]::new(\n  $sid,\n  [System.Security.AccessControl.FileSystemRights]::FullControl,\n  $inheritance,\n  [System.Security.AccessControl.PropagationFlags]::None,\n  [System.Security.AccessControl.AccessControlType]::Allow\n)\n$acl.SetAccessRule($rule)\nSet-Acl -LiteralPath $directoryPath -AclObject $acl\n\n$actual = Get-Acl -LiteralPath $directoryPath\n$ownerSid = $actual.GetOwner([System.Security.Principal.SecurityIdentifier])\n$rules = @($actual.GetAccessRules(\n  $true,\n  $true,\n  [System.Security.Principal.SecurityIdentifier]\n))\nif (-not $actual.AreAccessRulesProtected) {\n  throw \"Private directory DACL still inherits permissions.\"\n}\nif ($ownerSid.Value -ne $sid.Value) {\n  throw \"Private directory owner SID does not match the current user.\"\n}\nif ($rules.Count -ne 1) {\n  throw \"Private directory DACL must contain exactly one access rule.\"\n}\n$actualRule = $rules[0]\n$requiredInheritance = (\n  [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor\n  [System.Security.AccessControl.InheritanceFlags]::ObjectInherit\n)\nif (\n  $actualRule.IsInherited -or\n  $actualRule.IdentityReference.Value -ne $sid.Value -or\n  $actualRule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow -or\n  (($actualRule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne [System.Security.AccessControl.FileSystemRights]::FullControl) -or\n  (($actualRule.InheritanceFlags -band $requiredInheritance) -ne $requiredInheritance)\n) {\n  throw \"Private directory DACL is not owner-only inheritable full control.\"\n}\n`;\n\nexport type WindowsAclRunner = (\n  command: string,\n  args: string[],\n  options: {\n    env: NodeJS.ProcessEnv;\n    windowsHide: boolean;\n  },\n) => Promise<void>;\n\nconst runWindowsAclCommand: WindowsAclRunner = async (command, args, options) => {\n  await execFileAsync(command, args, options);\n};\n\nexport function resolveWindowsPowerShellPath(systemRoot: string | null | undefined): string {\n  const normalizedRoot = systemRoot?.trim() ? path.win32.normalize(systemRoot.trim()) : undefined;\n  if (!normalizedRoot || !/^[A-Za-z]:\\\\/.test(normalizedRoot)) {\n    throw new Error(\"SystemRoot must be an absolute local Windows path.\");\n  }\n  return path.win32.join(normalizedRoot, \"System32\", \"WindowsPowerShell\", \"v1.0\", \"powershell.exe\");\n}\n\nexport async function applyOwnerOnlyWindowsAcl(\n  filePath: string,\n  run: WindowsAclRunner = runWindowsAclCommand,\n  systemRoot: string | null | undefined = process.env.SystemRoot,\n): Promise<void> {\n  try {\n    const powershellPath = resolveWindowsPowerShellPath(systemRoot);\n    await run(\n      powershellPath,\n      [\"-NoLogo\", \"-NoProfile\", \"-NonInteractive\", \"-Command\", WINDOWS_OWNER_ONLY_ACL_SCRIPT],\n      {\n        env: {\n          ...process.env,\n          CRABLINE_PRIVATE_FILE_PATH: path.resolve(filePath),\n        },\n        windowsHide: true,\n      },\n    );\n  } catch (error) {\n    throw new Error(\n      \"Could not apply and verify an owner-only Windows ACL; powershell.exe with Set-Acl is required.\",\n      { cause: error },\n    );\n  }\n}\n\nexport async function applyOwnerOnlyWindowsDirectoryAcl(\n  directoryPath: string,\n  run: WindowsAclRunner = runWindowsAclCommand,\n  systemRoot: string | null | undefined = process.env.SystemRoot,\n): Promise<void> {\n  try {\n    const powershellPath = resolveWindowsPowerShellPath(systemRoot);\n    await run(\n      powershellPath,\n      [\n        \"-NoLogo\",\n        \"-NoProfile\",\n        \"-NonInteractive\",\n        \"-Command\",\n        WINDOWS_OWNER_ONLY_DIRECTORY_ACL_SCRIPT,\n      ],\n      {\n        env: {\n          ...process.env,\n          CRABLINE_PRIVATE_DIRECTORY_PATH: path.resolve(directoryPath),\n        },\n        windowsHide: true,\n      },\n    );\n  } catch (error) {\n    throw new Error(\n      \"Could not apply and verify an owner-only Windows directory ACL; powershell.exe with Set-Acl is required.\",\n      { cause: error },\n    );\n  }\n}\n\ntype FileIdentity = {\n  device: bigint;\n  inode: bigint;\n};\n\nasync function readHandleIdentity(handle: FileHandle): Promise<FileIdentity> {\n  const stats = await handle.stat({ bigint: true });\n  if (stats.ino <= 0n) {\n    throw new Error(\"The filesystem did not provide a stable private file identity.\");\n  }\n  return {\n    device: stats.dev,\n    inode: stats.ino,\n  };\n}\n\nasync function assertPathIdentity(filePath: string, expected: FileIdentity): Promise<void> {\n  try {\n    const stats = await fs.lstat(filePath, { bigint: true });\n    if (\n      stats.isFile() &&\n      stats.nlink === 1n &&\n      stats.dev === expected.device &&\n      stats.ino === expected.inode\n    ) {\n      return;\n    }\n  } catch (error) {\n    throw new Error(\"Private file path identity changed during publication.\", { cause: error });\n  }\n  throw new Error(\"Private file path identity changed during publication.\");\n}\n\ntype DirectoryIdentity = {\n  device: bigint;\n  inode: bigint;\n  userId: bigint;\n};\n\nasync function readDirectoryHandleIdentity(handle: FileHandle): Promise<DirectoryIdentity> {\n  const stats = await handle.stat({ bigint: true });\n  if (!stats.isDirectory() || stats.ino <= 0n) {\n    throw new Error(\"The filesystem did not provide a stable private directory identity.\");\n  }\n  return {\n    device: stats.dev,\n    inode: stats.ino,\n    userId: stats.uid,\n  };\n}\n\nasync function assertDirectoryPathIdentity(\n  directoryPath: string,\n  expected: DirectoryIdentity,\n): Promise<void> {\n  try {\n    const stats = await fs.lstat(directoryPath, { bigint: true });\n    if (stats.isDirectory() && stats.dev === expected.device && stats.ino === expected.inode) {\n      return;\n    }\n  } catch (error) {\n    throw new Error(\"Private directory path identity changed during publication.\", {\n      cause: error,\n    });\n  }\n  throw new Error(\"Private directory path identity changed during publication.\");\n}\n\nexport type SecuredPrivateDirectory = {\n  assertIdentityAt(directoryPath?: string): Promise<void>;\n  directoryPath: string;\n};\n\nexport async function captureDirectoryIdentity(\n  directoryPath: string,\n): Promise<SecuredPrivateDirectory> {\n  const handle = await fs.open(directoryPath, \"r\");\n  try {\n    const identity = await readDirectoryHandleIdentity(handle);\n    const secured: SecuredPrivateDirectory = {\n      async assertIdentityAt(currentPath = directoryPath) {\n        await assertDirectoryPathIdentity(currentPath, identity);\n      },\n      directoryPath,\n    };\n    await secured.assertIdentityAt();\n    return secured;\n  } finally {\n    await handle.close();\n  }\n}\n\nexport async function syncParentDirectory(\n  filePath: string,\n  platform: NodeJS.Platform = process.platform,\n): Promise<void> {\n  if (platform === \"win32\") {\n    return;\n  }\n  const handle = await fs.open(path.dirname(filePath), \"r\");\n  try {\n    await handle.sync();\n  } finally {\n    await handle.close();\n  }\n}\n\nasync function syncParentAtAccessibleBoundary(\n  filePath: string,\n  syncParent: (filePath: string, platform?: NodeJS.Platform) => Promise<void>,\n  platform?: NodeJS.Platform,\n): Promise<boolean> {\n  try {\n    await syncParent(filePath, platform);\n    return true;\n  } catch (error) {\n    const code = (error as NodeJS.ErrnoException).code;\n    if (code === \"EACCES\" || code === \"EPERM\") {\n      return false;\n    }\n    throw error;\n  }\n}\n\nasync function syncPathAncestry(\n  filePath: string,\n  syncParent: (filePath: string, platform?: NodeJS.Platform) => Promise<void>,\n  platform?: NodeJS.Platform,\n  firstCreatedDirectory?: string,\n): Promise<void> {\n  const resolvedFilePath = path.resolve(filePath);\n  let currentPath = resolvedFilePath;\n  const syncThroughPath =\n    firstCreatedDirectory === undefined ? undefined : path.resolve(firstCreatedDirectory);\n  for (;;) {\n    const mandatory = syncThroughPath !== undefined || currentPath === resolvedFilePath;\n    if (mandatory) {\n      await syncParent(currentPath, platform);\n    } else if (!(await syncParentAtAccessibleBoundary(currentPath, syncParent, platform))) {\n      return;\n    }\n    if (currentPath === syncThroughPath) {\n      return;\n    }\n    const parentPath = path.dirname(currentPath);\n    if (path.dirname(parentPath) === parentPath) {\n      return;\n    }\n    currentPath = parentPath;\n  }\n}\n\nexport async function removeSecuredPrivateDirectory(\n  secured: SecuredPrivateDirectory,\n  currentPath = secured.directoryPath,\n  quarantineBaseName = path.basename(currentPath),\n): Promise<void> {\n  if (path.basename(quarantineBaseName) !== quarantineBaseName || quarantineBaseName.length === 0) {\n    throw new Error(\"Private directory quarantine basename is malformed.\");\n  }\n  const quarantinePath = path.join(\n    path.dirname(currentPath),\n    `.${quarantineBaseName}.${process.pid}.${randomUUID()}.remove`,\n  );\n  await secured.assertIdentityAt(currentPath);\n  await fs.rename(currentPath, quarantinePath);\n  await secured.assertIdentityAt(quarantinePath);\n  await syncParentDirectory(quarantinePath);\n  await fs.rm(quarantinePath, { force: true, recursive: true });\n  await syncParentDirectory(quarantinePath);\n}\n\nexport async function securePrivateDirectory(\n  directoryPath: string,\n  options: {\n    currentUserId?: number;\n    platform?: NodeJS.Platform;\n    secureWindowsDirectory?: (directoryPath: string) => Promise<void>;\n    syncParent?: (filePath: string, platform?: NodeJS.Platform) => Promise<void>;\n  } = {},\n): Promise<SecuredPrivateDirectory> {\n  let created = false;\n  try {\n    await fs.mkdir(directoryPath, { mode: 0o700 });\n    created = true;\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code !== \"EEXIST\") {\n      throw error;\n    }\n  }\n\n  const handle = await fs.open(directoryPath, \"r\");\n  let handleOpen = true;\n  const closeHandle = async () => {\n    if (!handleOpen) {\n      return;\n    }\n    handleOpen = false;\n    await handle.close();\n  };\n  let identity: DirectoryIdentity;\n  try {\n    identity = await readDirectoryHandleIdentity(handle);\n  } catch (error) {\n    try {\n      await closeHandle();\n    } catch (closeError) {\n      const aggregateError = new AggregateError(\n        [error, closeError],\n        \"Private directory identity verification failed and its handle could not be closed.\",\n      );\n      aggregateError.cause = error;\n      throw aggregateError;\n    }\n    throw error;\n  }\n  const secured: SecuredPrivateDirectory = {\n    async assertIdentityAt(currentPath = directoryPath) {\n      await assertDirectoryPathIdentity(currentPath, identity);\n    },\n    directoryPath,\n  };\n  try {\n    await secured.assertIdentityAt();\n    if ((options.platform ?? process.platform) === \"win32\") {\n      await (options.secureWindowsDirectory ?? applyOwnerOnlyWindowsDirectoryAcl)(directoryPath);\n    } else {\n      const currentUserId = options.currentUserId ?? process.geteuid?.();\n      if (\n        currentUserId === undefined ||\n        !Number.isSafeInteger(currentUserId) ||\n        currentUserId < 0 ||\n        identity.userId !== BigInt(currentUserId)\n      ) {\n        throw new Error(\"Private directory must be owned by the current POSIX user.\");\n      }\n      await handle.chmod(0o700);\n    }\n    await secured.assertIdentityAt();\n    const syncParent = options.syncParent ?? syncParentDirectory;\n    if (created) {\n      await syncParent(directoryPath, options.platform);\n    } else {\n      await syncParentAtAccessibleBoundary(directoryPath, syncParent, options.platform);\n    }\n  } catch (error) {\n    let primaryError = error;\n    try {\n      await closeHandle();\n    } catch (closeError) {\n      const aggregateError = new AggregateError(\n        [error, closeError],\n        \"Private directory securing failed and its verification handle could not be closed.\",\n      );\n      aggregateError.cause = error;\n      primaryError = aggregateError;\n    }\n    if (created) {\n      try {\n        await removeSecuredPrivateDirectory(secured);\n      } catch (cleanupError) {\n        const aggregateError = new AggregateError(\n          [primaryError, cleanupError],\n          `Private directory securing failed and rollback cleanup also failed: ${\n            error instanceof Error ? error.message : String(error)\n          }`,\n        );\n        aggregateError.cause = primaryError;\n        throw aggregateError;\n      }\n    }\n    throw primaryError;\n  } finally {\n    await closeHandle();\n  }\n\n  return secured;\n}\n\nexport async function publishPrivateFileAtomically(\n  filePath: string,\n  contents: string,\n  options: {\n    afterRename?: (filePath: string) => Promise<void>;\n    beforeRename?: (temporaryPath: string) => Promise<void>;\n    platform?: NodeJS.Platform;\n    removeTemporaryFile?: (temporaryPath: string) => Promise<void>;\n    secureWindowsFile?: (temporaryPath: string) => Promise<void>;\n    syncParent?: (filePath: string, platform?: NodeJS.Platform) => Promise<void>;\n  } = {},\n): Promise<void> {\n  const temporaryPath = path.join(\n    path.dirname(filePath),\n    `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`,\n  );\n  const parentDirectory = path.resolve(path.dirname(filePath));\n  const firstCreatedDirectory = await fs.mkdir(parentDirectory, { recursive: true });\n  let handle: FileHandle | undefined;\n  let publicationFailed = false;\n  let primaryError: unknown;\n  try {\n    handle = await fs.open(temporaryPath, \"wx+\", 0o600);\n    const identity = await readHandleIdentity(handle);\n    if ((options.platform ?? process.platform) === \"win32\") {\n      await (options.secureWindowsFile ?? applyOwnerOnlyWindowsAcl)(temporaryPath);\n    } else {\n      await handle.chmod(0o600);\n    }\n\n    await assertPathIdentity(temporaryPath, identity);\n    await handle.writeFile(contents, \"utf8\");\n    await handle.sync();\n    await assertPathIdentity(temporaryPath, identity);\n    await options.beforeRename?.(temporaryPath);\n    await assertPathIdentity(temporaryPath, identity);\n    await fs.rename(temporaryPath, filePath);\n    await syncPathAncestry(\n      filePath,\n      options.syncParent ?? syncParentDirectory,\n      options.platform,\n      firstCreatedDirectory,\n    );\n    await options.afterRename?.(filePath);\n    await assertPathIdentity(filePath, identity);\n  } catch (error) {\n    publicationFailed = true;\n    primaryError = error;\n  }\n\n  const cleanupErrors: unknown[] = [];\n  try {\n    await handle?.close();\n  } catch (error) {\n    cleanupErrors.push(error);\n  }\n  try {\n    await (\n      options.removeTemporaryFile ??\n      ((candidatePath: string) => fs.rm(candidatePath, { force: true }))\n    )(temporaryPath);\n  } catch (error) {\n    cleanupErrors.push(error);\n  }\n\n  if (publicationFailed) {\n    if (cleanupErrors.length > 0) {\n      const primaryMessage =\n        primaryError instanceof Error ? primaryError.message : String(primaryError);\n      const aggregateError = new AggregateError(\n        [primaryError, ...cleanupErrors],\n        `${primaryMessage} Private temporary file cleanup also failed.`,\n      );\n      aggregateError.cause = primaryError;\n      const primaryCode =\n        typeof primaryError === \"object\" && primaryError !== null\n          ? (primaryError as NodeJS.ErrnoException).code\n          : undefined;\n      if (primaryCode) {\n        Object.assign(aggregateError, { code: primaryCode });\n      }\n      throw aggregateError;\n    }\n    throw primaryError;\n  }\n  if (cleanupErrors.length === 1) {\n    throw cleanupErrors[0];\n  }\n  if (cleanupErrors.length > 1) {\n    throw new AggregateError(cleanupErrors, \"Private temporary file publication cleanup failed.\");\n  }\n}\n"]}

package/dist/src/openclaw/shared.d.ts

@@ -2,19 +2,34 @@ import type { CrablineServerChannel, CrablineServerManifest } from "../servers/i
 import type { ServerEventObserver } from "../servers/recorder.js";
 export declare const DEFAULT_ACCOUNT_ID = "default";
 export declare const OPENCLAW_CRABLINE_CHANNEL_CAPABILITY_MATRIX_PATH = "crabline-fake-provider-capabilities.json";
+export declare const OPENCLAW_CRABLINE_PROVIDER_READINESS_PATH = "crabline-fake-provider-smoke.json";
+/** @deprecated Use OPENCLAW_CRABLINE_PROVIDER_READINESS_PATH. */
 export declare const OPENCLAW_CRABLINE_CHANNEL_SMOKE_PATH = "crabline-fake-provider-smoke.json";
 export declare const OPENCLAW_CRABLINE_MANIFEST_PATH = "crabline-fake-provider-server.json";
+export declare const OPENCLAW_CRABLINE_ARTIFACT_STORE_DIRECTORY = ".crabline-smoke-artifacts";
+export declare const OPENCLAW_CRABLINE_ARTIFACT_POINTER_PATH = ".crabline-smoke-artifacts/current.json";
 export declare const OPENCLAW_CRABLINE_DEFAULT_CHANNEL = "telegram";
 export type OpenClawCrablineChannelDriverSelection = {
     channel: CrablineServerChannel;
     channelDriver: "crabline";
     capabilityMatrixPath: typeof OPENCLAW_CRABLINE_CHANNEL_CAPABILITY_MATRIX_PATH;
+    providerReadinessArtifactPath?: typeof OPENCLAW_CRABLINE_PROVIDER_READINESS_PATH;
     smokeArtifactPath: typeof OPENCLAW_CRABLINE_CHANNEL_SMOKE_PATH;
 };
+/** @deprecated Use OpenClawCrablineProviderReadinessResult. */
 export type OpenClawCrablineChannelDriverSmokeResult = {
+    artifactPointerPath: string;
     capabilityReport: unknown;
+    capabilityMatrixPath: string;
+    generation: string;
     manifestPath: string;
     smoke: unknown;
+    smokeArtifactPath: string;
+    warnings?: string[];
+};
+export type OpenClawCrablineProviderReadinessResult = OpenClawCrablineChannelDriverSmokeResult & {
+    providerReadiness: unknown;
+    providerReadinessArtifactPath: string;
 };
 export type OpenClawCrablineConversation = {
     id: string;
@@ -36,7 +51,7 @@ export type OpenClawCrablineAgentDelivery = {
 export type OpenClawCrablineInboundInput = {
     conversation: {
         id: string;
-        kind: string;
+        kind: "direct" | "group";
     };
     senderId: string;
     senderName?: string | undefined;
@@ -86,6 +101,7 @@ export type StartedOpenClawCrablineAdapter = OpenClawCrablineGatewayBinding & {
 export type ParsedQaTarget = {
     kind: "direct" | "group";
     id: string;
+    native: boolean;
     threadId?: string;
 };
 export type OpenClawCrablineProviderAdapter = {
@@ -96,7 +112,7 @@ export type OpenClawCrablineProviderAdapter = {
         event: unknown;
         targetByProviderTarget: ReadonlyMap<string, string>;
     }): OpenClawCrablineOutboundMessage | null;
-    probe(): Promise<unknown>;
+    probe(signal?: AbortSignal): Promise<unknown>;
 };
 export type OpenClawCrablineProviderBridge<TManifest extends CrablineServerManifest = CrablineServerManifest> = {
     createAdapter(manifest: TManifest): OpenClawCrablineProviderAdapter;
@@ -116,10 +132,13 @@ export declare function createOpenClawCrablineProviderBridge<TProvider extends C
 }): OpenClawCrablineProviderBridge<Extract<CrablineServerManifest, {
     provider: TProvider;
 }>>;
+export declare function runOpenClawCrablineProviderProbe<T>(provider: CrablineServerManifest["provider"], probe: (signal: AbortSignal) => Promise<T>): Promise<T>;
 export declare function readString(value: unknown): string | undefined;
+export declare function readNonBlankString(value: unknown): string | undefined;
 export declare function isRecord(value: unknown): value is Record<string, unknown>;
 export declare function readInteger(value: unknown): number | undefined;
 export declare function parseQaTarget(target: string): ParsedQaTarget;
+export declare function canonicalConversationIdForInbound(input: OpenClawCrablineInboundInput): string;
 export declare function qaTargetForInbound(input: OpenClawCrablineInboundInput): string;
 export declare function createAdminInboundRequest(manifest: CrablineServerManifest): {
     providerHeaders: {