@openclaw/matrix 2026.9.5 → 2026.9.7

package/node_modules/@openclaw/fs-safe/dist/native-policy-parent-windows.js

@@ -0,0 +1,209 @@
+import fsSync, {} from "node:fs";
+import path from "node:path";
+import { assertDirectoryIdentitySync, inspectDirectoryIdentitySync, } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { openNativeParentAdmission } from "./native-parent-admission.js";
+import { captureNativeFdClose } from "./native-binding.js";
+import { inspectNativeDirectoryObservation } from "./native-directory-observation.js";
+import { createPathSegmentRoute, joinPathSegmentRoute } from "./path-segment-route.js";
+import { isSymlinkOpenError } from "./path.js";
+import { checkedMutationDirectory } from "./pinned-mutation-observation.js";
+import { canReuseParentWithMutationAssertion } from "./root-write-lock-binding.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { createSuppressedError } from "./suppressed-error.js";
+function assertParentCurrent(parent) {
+    const current = inspectFileIdentitySync(() => fsSync.fstatSync(parent.fd, { bigint: true }), parent.guard.stat);
+    assertDirectoryIdentitySync(parent.guard.dir, {
+        dev: parent.guard.stat.dev,
+        ino: parent.guard.stat.ino,
+        realPath: parent.guard.realPath,
+    });
+    return current;
+}
+function closeAfterFailure(closeFd, fd, failure, report = false) {
+    if (fd === undefined)
+        return;
+    try {
+        closeFd(fd);
+    }
+    catch (error) {
+        if (report)
+            throw failure
+                ? createSuppressedError(error, failure.error, "native parent admission and close failed")
+                : error;
+    }
+}
+export async function capturePolicyAwareWindowsParent(binding, params, rootAdmission) {
+    const closeFd = captureNativeFdClose(binding);
+    let session;
+    function parentObservation(fd, guard) {
+        return checkedMutationDirectory(guard.dir, guard.realPath, guard.stat, typeof binding.observeDirectory === "function" ? () => {
+            const stat = inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }), guard.stat);
+            let observed;
+            try {
+                observed = inspectNativeDirectoryObservation(binding, guard.dir, stat);
+            }
+            catch (error) {
+                if (error?.code === "OBSERVATION_UNAVAILABLE")
+                    return undefined;
+                throw error;
+            }
+            return { canonicalPath: observed.realPath,
+                identity: { dev: stat.dev, ino: stat.ino, mode: stat.mode, nlink: stat.nlink } };
+        } : undefined);
+    }
+    async function openParent(fd, parentPath, relativePath) {
+        try {
+            const admitted = await openNativeParentAdmission(binding, {
+                ...rootAdmission,
+                root: { fd },
+                rootPath: parentPath,
+                // Policy fences retain every identity bit even with a legacy numeric root.
+                exactRoot: true,
+            }, relativePath, "native-directory");
+            const guard = { ...admitted.guard, stat: admitted.guard.stat };
+            return { fd: admitted.fd, guard, observation: parentObservation(admitted.fd, guard) };
+        }
+        catch (error) {
+            if (!isSymlinkOpenError(error))
+                throw error;
+            throw new FsSafeError(params.mutationAdmission.rejectParentSymlinks ? "symlink" : "path-mismatch", "native write parent changed during policy admission", { cause: error instanceof Error ? error : undefined });
+        }
+    }
+    async function authorize(targetPath, mutationPath = targetPath, phase = "parent") {
+        const request = Object.freeze({ targetPath, mutationPath, phase });
+        return await (session ? session.authorize(request) : params.mutationAdmission.authorize(request));
+    }
+    // Existing complete parents need one open and one target admission. Exact
+    // parent denies apply only to creation, never to merely using a directory.
+    let complete;
+    try {
+        complete = await openParent(rootAdmission.root.fd, params.rootPath, params.relativeParentPath);
+    }
+    catch (error) {
+        if (error?.code !== "ENOENT" || !params.mkdir)
+            throw error;
+    }
+    if (complete) {
+        try {
+            await authorize(path.join(complete.guard.realPath, params.basename));
+            assertParentCurrent(complete);
+            return complete;
+        }
+        catch (error) {
+            closeAfterFailure(closeFd, complete.fd, { error }, rootAdmission.reportCloseErrors);
+            throw error;
+        }
+    }
+    const segments = params.relativeParentPath.split("/").filter(Boolean);
+    const route = createPathSegmentRoute(segments);
+    const rootStat = inspectDirectoryIdentitySync(params.rootPath, inspectFileIdentitySync(() => fsSync.fstatSync(rootAdmission.root.fd, { bigint: true })));
+    let current = {
+        fd: rootAdmission.root.fd,
+        guard: { dir: params.rootPath, realPath: params.rootPath, stat: rootStat },
+        observation: parentObservation(rootAdmission.root.fd, {
+            dir: params.rootPath, realPath: params.rootPath, stat: rootStat,
+        }),
+    };
+    let ownedFd;
+    let failure;
+    const initialTarget = joinPathSegmentRoute(params.rootPath, route, 0, params.basename);
+    if (canReuseParentWithMutationAssertion(params.assertBeforeMutation, params.rootPath, initialTarget)) {
+        session = params.mutationAdmission?.beginNativeParentWalk?.() ??
+            params.mutationAdmission?.beginSharedParentWalk?.();
+        if (session && session.retainedTargetPath !== initialTarget) {
+            session.dispose();
+            session = undefined;
+        }
+    }
+    try {
+        for (let index = 0; index < segments.length; index += 1) {
+            const segment = segments[index];
+            const parentPath = current.guard.realPath;
+            let child;
+            let createdByMkdir = false;
+            let createReceipt;
+            try {
+                child = await openParent(current.fd, parentPath, segment);
+            }
+            catch (error) {
+                if (error?.code !== "ENOENT")
+                    throw error;
+                // The request admits both the prospective leaf and this missing direct
+                // child. A deeper denial can leave already admitted ancestors intact.
+                const targetPath = session?.retainedTargetPath ??
+                    joinPathSegmentRoute(parentPath, route, index, params.basename);
+                const mutationPath = path.join(parentPath, segment);
+                const request = Object.freeze({ targetPath, mutationPath, phase: "parent-create" });
+                createReceipt = session?.tryAuthorizeAtParent(request, current.observation);
+                if (!createReceipt) {
+                    createReceipt = await authorize(targetPath, mutationPath, "parent-create");
+                    assertParentCurrent(current);
+                }
+                if (params.assertBeforeMutation) {
+                    // Opaque callbacks retain their post-callback descriptor/path fence.
+                    params.assertBeforeMutation();
+                    assertParentCurrent(current);
+                }
+                // Synchronous session admission already ends at the exact parent fence.
+                const mkdirChild = binding.mkdirChildBeneath;
+                if (typeof mkdirChild !== "function") {
+                    throw new FsSafeError("helper-unavailable", "native direct-child parent creation is unavailable");
+                }
+                createdByMkdir = mkdirChild.call(binding, current.fd, segment, 0o777) === true;
+                child = await openParent(current.fd, parentPath, segment);
+            }
+            try {
+                const targetPath = joinPathSegmentRoute(child.guard.realPath, route, index + 1, params.basename);
+                if (session && targetPath !== session.retainedTargetPath) {
+                    session.dispose();
+                    session = undefined;
+                }
+                let evidence;
+                if (session && createdByMkdir && createReceipt) {
+                    try {
+                        evidence = Object.freeze({
+                            admission: createReceipt,
+                            parent: parentObservation(current.fd, { ...current.guard,
+                                stat: inspectFileIdentitySync(() => fsSync.fstatSync(current.fd, { bigint: true }), current.guard.stat),
+                            }),
+                            child: child.observation,
+                        });
+                    }
+                    catch {
+                        // Incomplete optional evidence returns to ordered admission below.
+                    }
+                }
+                // Advancement refreshes both named directories after all Root/policy
+                // observations; these receipts supply expectations, not cached authority.
+                const advanced = evidence && session.advanceCreatedDirectory(evidence);
+                if (!advanced) {
+                    await authorize(targetPath);
+                    assertParentCurrent(child);
+                }
+            }
+            catch (error) {
+                closeAfterFailure(closeFd, child.fd, { error }, rootAdmission.reportCloseErrors);
+                throw error;
+            }
+            const previousFd = ownedFd;
+            current = child;
+            ownedFd = child.fd;
+            if (previousFd !== undefined)
+                closeFd(previousFd);
+        }
+        if (ownedFd === undefined) {
+            throw new FsSafeError("path-mismatch", "native write parent admission did not complete");
+        }
+        ownedFd = undefined;
+        return current;
+    }
+    catch (error) {
+        failure = { error };
+        throw error;
+    }
+    finally {
+        session?.dispose();
+        closeAfterFailure(closeFd, ownedFd, failure, rootAdmission.reportCloseErrors);
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/native-rename-outcome.d.ts

@@ -0,0 +1,3 @@
+export declare const NATIVE_RENAME_SOURCE_IDENTITY_MISMATCH = "FS_SAFE_INTERNAL_RENAME_SOURCE_IDENTITY_MISMATCH";
+export type NativeRenameFailureOutcome = "uncommitted" | "indeterminate";
+export declare function classifyNativeRenameFailure(error: unknown): NativeRenameFailureOutcome;

package/node_modules/@openclaw/fs-safe/dist/native-rename-outcome.js

@@ -0,0 +1,8 @@
+export const NATIVE_RENAME_SOURCE_IDENTITY_MISMATCH = "FS_SAFE_INTERNAL_RENAME_SOURCE_IDENTITY_MISMATCH";
+export function classifyNativeRenameFailure(error) {
+    const code = error?.code ?? "";
+    // Ordinary errno can follow a committed remote rename whose reply was lost.
+    return code === NATIVE_RENAME_SOURCE_IDENTITY_MISMATCH
+        ? "uncommitted"
+        : "indeterminate";
+}

package/node_modules/@openclaw/fs-safe/dist/native-staged-file.d.ts

@@ -0,0 +1,45 @@
+import type { DirectoryReceipt } from "./directory-durability.js";
+import { type BigIntStats, type Stats } from "node:fs";
+import type { AnyAsyncDirectoryGuard } from "./directory-guard.js";
+import type { FileIdentityStat } from "./file-identity.js";
+import { type NativeBinding } from "./native-binding.js";
+import type { PinnedWriteInput, PinnedWriteParams } from "./pinned-write-types.js";
+import type { PublishedFileReceipt, StagedFile, StagedFileCleanupReceipt, StagedFileReceipt } from "./staged-file-types.js";
+export type NativeStagingBinding = NativeBinding & Required<Pick<NativeBinding, "createStagedFile" | "stagedFileMatches" | "removeStagedFile">>;
+export declare function assertNativeStaging(binding: NativeBinding): asserts binding is NativeStagingBinding;
+type StagedPermissionPolicy = "private-creation" | "mode-only";
+type NativeStageOwner = Readonly<{
+    binding: NativeStagingBinding;
+    parentFd: number;
+    closeParentFd: (fd: number) => void;
+    directory: StagedFileReceipt["directory"];
+    portableNames?: boolean;
+    mode: number;
+    sync?: boolean;
+    strictFileSync?: boolean;
+    assertBeforeMutation?: () => void;
+    permissionPolicy?: StagedPermissionPolicy;
+    name?: string;
+}>;
+declare class NativeStagedFile implements StagedFile {
+    #private;
+    constructor(owner: NativeStageOwner);
+    static create(owner: NativeStageOwner, input: PinnedWriteInput, maxBytes?: number): Promise<NativeStagedFile>;
+    static write(binding: NativeStagingBinding, parentFd: number, closeParentFd: (fd: number) => void, directory: StagedFileReceipt["directory"], params: PinnedWriteParams, parentGuard: AnyAsyncDirectoryGuard): Promise<FileIdentityStat>;
+    get receipt(): StagedFileReceipt;
+    assertCurrent(): Promise<void>;
+    publish(basename: string, options: {
+        overwrite: boolean;
+    }, onPublished?: PinnedWriteParams["onPublished"]): Promise<PublishedFileReceipt>;
+    cleanup(): Promise<StagedFileCleanupReceipt>;
+    [Symbol.asyncDispose](): Promise<void>;
+}
+export declare const createNativeStage: (...args: Parameters<typeof NativeStagedFile.create>) => Promise<StagedFile>;
+export declare const writeNativeStage: typeof NativeStagedFile.write;
+export declare function stageFileInDirectory(options: {
+    directory: string | DirectoryReceipt<Stats | BigIntStats>;
+    content: string | Uint8Array;
+    /** Published mode; the unpublished stage stays at 0600. Defaults to 0600. */
+    mode?: number;
+}): Promise<StagedFile>;
+export {};