@openclaw/openshell-sandbox 2026.9.1 → 2026.9.3

package/node_modules/@openclaw/fs-safe/dist/move-path-cleanup.js

@@ -0,0 +1,161 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+export function entryIdentity(stat) {
+    return {
+        ctimeMs: stat.ctimeMs,
+        dev: stat.dev,
+        ino: stat.ino,
+        mode: stat.mode,
+        mtimeMs: stat.mtimeMs,
+        nlink: stat.nlink,
+        size: stat.size,
+    };
+}
+export function sameIdentity(a, b) {
+    return (a.dev === b.dev &&
+        a.ino === b.ino &&
+        a.mode === b.mode &&
+        a.nlink === b.nlink &&
+        a.size === b.size &&
+        a.mtimeMs === b.mtimeMs &&
+        a.ctimeMs === b.ctimeMs);
+}
+function sameDirectoryNode(a, b) {
+    return a.dev === b.dev && a.ino === b.ino;
+}
+export function sourceChangedError(sourcePath) {
+    return Object.assign(new Error(`Source changed during move fallback: ${sourcePath}`), {
+        code: "ESTALE",
+    });
+}
+export async function assertSourceStillMatches(sourcePath, identity) {
+    if (!sameIdentity(identity, entryIdentity(await fs.lstat(sourcePath)))) {
+        throw sourceChangedError(sourcePath);
+    }
+}
+function identityKey(identity) {
+    return `${identity.dev}:${identity.ino}`;
+}
+function collectAliasCandidates(sourcePath, manifest, candidates) {
+    if (manifest.kind === "directory") {
+        for (const child of manifest.children) {
+            collectAliasCandidates(path.join(sourcePath, child.name), child.manifest, candidates);
+        }
+        return;
+    }
+    if (manifest.nlink <= 1) {
+        return;
+    }
+    const key = identityKey(manifest);
+    const entries = candidates.get(key) ?? [];
+    entries.push({ manifest, path: sourcePath });
+    candidates.set(key, entries);
+}
+export function createCleanupCopiedEntryState(sourcePath, manifest) {
+    const candidates = new Map();
+    collectAliasCandidates(sourcePath, manifest, candidates);
+    const aliasGroups = new Map();
+    for (const [key, entries] of candidates) {
+        if (entries.length < 2) {
+            continue;
+        }
+        const first = entries[0];
+        if (!first || entries.some((entry) => !sameIdentity(first.manifest, entry.manifest))) {
+            throw sourceChangedError(sourcePath);
+        }
+        aliasGroups.set(key, {
+            expected: first.manifest,
+            remainingPaths: new Set(entries.map((entry) => entry.path)),
+            stale: false,
+        });
+    }
+    return { aliasGroups };
+}
+function sameOwnedUnlinkTransition(before, after) {
+    return (before.dev === after.dev &&
+        before.ino === after.ino &&
+        before.mode === after.mode &&
+        before.size === after.size &&
+        before.mtimeMs === after.mtimeMs &&
+        before.nlink > 0 &&
+        after.nlink === before.nlink - 1 &&
+        after.ctimeMs >= before.ctimeMs);
+}
+function poisonAliasGroup(group) {
+    group.stale = true;
+    return "stale";
+}
+async function observeOwnedAliasUnlink(sourcePath, group) {
+    group.remainingPaths.delete(sourcePath);
+    const remainingPath = group.remainingPaths.values().next().value;
+    if (!remainingPath) {
+        return "removed";
+    }
+    let observed;
+    try {
+        observed = await fs.lstat(remainingPath);
+    }
+    catch (error) {
+        if (error?.code === "ENOENT") {
+            return poisonAliasGroup(group);
+        }
+        throw error;
+    }
+    const observedIdentity = entryIdentity(observed);
+    if (!sameOwnedUnlinkTransition(group.expected, observedIdentity)) {
+        return poisonAliasGroup(group);
+    }
+    group.expected = observedIdentity;
+    return "removed";
+}
+function mergeCleanupResults(a, b) {
+    return a === "stale" || b === "stale" ? "stale" : "removed";
+}
+export async function cleanupCopiedEntry(sourcePath, manifest, state, assertBeforeMutation) {
+    const aliasGroup = manifest.kind === "leaf" ? state.aliasGroups.get(identityKey(manifest)) : undefined;
+    if (aliasGroup?.stale) {
+        return "stale";
+    }
+    let currentStat;
+    try {
+        currentStat = await fs.lstat(sourcePath);
+    }
+    catch (error) {
+        if (error?.code === "ENOENT") {
+            return aliasGroup ? poisonAliasGroup(aliasGroup) : "removed";
+        }
+        throw error;
+    }
+    if (manifest.kind === "directory") {
+        if (!currentStat.isDirectory() || !sameDirectoryNode(manifest, entryIdentity(currentStat))) {
+            return "stale";
+        }
+        // A same-inode directory can gain unrelated children after commit. Still
+        // clean manifest children so the fallback does not duplicate copied files.
+        let result = "removed";
+        for (const child of manifest.children) {
+            result = mergeCleanupResults(result, await cleanupCopiedEntry(path.join(sourcePath, child.name), child.manifest, state, assertBeforeMutation));
+        }
+        assertBeforeMutation();
+        try {
+            await fs.rmdir(sourcePath);
+        }
+        catch (error) {
+            const code = error?.code;
+            if (code === "ENOTEMPTY" || code === "EEXIST") {
+                return "stale";
+            }
+            throw error;
+        }
+        return result;
+    }
+    const expected = aliasGroup?.expected ?? manifest;
+    if (!sameIdentity(expected, entryIdentity(currentStat))) {
+        return aliasGroup ? poisonAliasGroup(aliasGroup) : "stale";
+    }
+    assertBeforeMutation();
+    await fs.unlink(sourcePath);
+    return aliasGroup
+        ? await observeOwnedAliasUnlink(sourcePath, aliasGroup)
+        : "removed";
+}

package/node_modules/@openclaw/fs-safe/dist/move-path.d.ts

@@ -0,0 +1,21 @@
+export type MovePathPublicationReceipt = Readonly<{
+    path: string;
+    dev: bigint;
+    ino: bigint;
+}>;
+export type MovePathWithCopyFallbackOptions = {
+    /** Rechecks authority before each rename and copied-source unlink/rmdir dispatch. */
+    assertBeforeMutation?: () => void;
+    /** Rechecks caller authority synchronously immediately before each rename dispatch. */
+    assertBeforeRename?: () => void;
+    /** Reports the committed destination before post-rename checks or source cleanup. */
+    onDestinationPublished?: (receipt: MovePathPublicationReceipt) => void;
+    from: string;
+    sourceHardlinks?: "allow" | "reject";
+    to: string;
+};
+type MoveCopyFallbackReason = "cross-device" | "windows-rename-denied";
+export declare function moveCopyFallbackReasonForRenameError(error: unknown, platform?: NodeJS.Platform): MoveCopyFallbackReason | undefined;
+export declare function movePathWithCopyFallback(options: MovePathWithCopyFallbackOptions): Promise<void>;
+export {};
+//# sourceMappingURL=move-path.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/move-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"move-path.d.ts","sourceRoot":"","sources":["../src/move-path.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;IAClC,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;IAChC,qFAAqF;IACrF,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,IAAI,CAAC;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,KAAK,sBAAsB,GAAG,cAAc,GAAG,uBAAuB,CAAC;AAEvE,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,sBAAsB,GAAG,SAAS,CASpC;AAsPD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAqHf"}

package/node_modules/@openclaw/fs-safe/dist/move-path.js

@@ -0,0 +1,334 @@
+import { randomUUID } from "node:crypto";
+import { constants as fsConstants } from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { guardedRename } from "./guarded-mutation.js";
+import { assertSourceStillMatches, cleanupCopiedEntry, createCleanupCopiedEntryState, entryIdentity, sameIdentity, sourceChangedError, } from "./move-path-cleanup.js";
+import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { registerTempPathForExit } from "./temp-cleanup.js";
+export function moveCopyFallbackReasonForRenameError(error, platform = process.platform) {
+    const code = error?.code;
+    if (code === "EXDEV") {
+        return "cross-device";
+    }
+    if (code === "EPERM" && platform === "win32") {
+        return "windows-rename-denied";
+    }
+    return undefined;
+}
+const MAX_HARDLINK_PREFLIGHT_ENTRIES = 50_000;
+function hardlinkedSourceError(sourcePath) {
+    return new FsSafeError("hardlink", `Refusing to move hardlinked file: ${sourcePath}`);
+}
+function hardlinkWalkTooLargeError() {
+    return new FsSafeError("too-large", `Source hardlink preflight exceeds ${MAX_HARDLINK_PREFLIGHT_ENTRIES} entries`);
+}
+async function preflightSourceHardlinks(sourcePath) {
+    const pending = [sourcePath];
+    let discovered = 1;
+    while (pending.length > 0) {
+        const current = pending.pop();
+        const stat = await fs.lstat(current);
+        if (stat.isFile() && stat.nlink > 1) {
+            throw hardlinkedSourceError(current);
+        }
+        if (!stat.isDirectory()) {
+            continue;
+        }
+        const directory = await fs.opendir(current);
+        for await (const entry of directory) {
+            discovered += 1;
+            if (discovered > MAX_HARDLINK_PREFLIGHT_ENTRIES) {
+                throw hardlinkWalkTooLargeError();
+            }
+            pending.push(path.join(current, entry.name));
+        }
+    }
+}
+function isSameOrDescendant(parentPath, candidatePath) {
+    const relative = path.relative(parentPath, candidatePath);
+    return (relative === "" ||
+        (!path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== ".."));
+}
+async function assertCopyDestinationOutsideSource(sourcePath, targetPath, expectedIdentity) {
+    const sourceStat = await fs.lstat(sourcePath);
+    const sourceIdentity = entryIdentity(sourceStat);
+    if (expectedIdentity && !sameIdentity(expectedIdentity, sourceIdentity)) {
+        throw sourceChangedError(sourcePath);
+    }
+    const normalizedSource = path.resolve(sourcePath);
+    const normalizedTarget = path.resolve(targetPath);
+    const [sourceParentReal, targetParentReal] = await Promise.all([
+        fs.realpath(path.dirname(normalizedSource)),
+        fs.realpath(path.dirname(normalizedTarget)),
+    ]);
+    const sourceCandidate = path.join(sourceParentReal, path.basename(normalizedSource));
+    const targetCandidate = path.join(targetParentReal, path.basename(normalizedTarget));
+    const sourceBoundary = sourceStat.isDirectory()
+        ? await fs.realpath(sourcePath)
+        : sourceCandidate;
+    const unsafeTarget = sourceStat.isDirectory()
+        ? isSameOrDescendant(sourceBoundary, targetCandidate)
+        : path.relative(sourceBoundary, targetCandidate) === "";
+    if (unsafeTarget) {
+        throw new FsSafeError("invalid-path", "Move destination must not be inside the source");
+    }
+    return sourceIdentity;
+}
+function modeBits(mode) {
+    return mode & 0o777;
+}
+async function chmodDirectoryPinned(directoryPath, mode) {
+    if (process.platform === "win32") {
+        // Node cannot portably open a Windows directory for descriptor-bound
+        // chmod. POSIX modes are not enforced there, so do not fall back to a
+        // pathname operation that could follow a replacement symlink.
+        return;
+    }
+    const handle = await fs.open(directoryPath, fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | fsConstants.O_NOFOLLOW);
+    try {
+        await handle.chmod(mode);
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function writeAll(handle, buffer, bytesRead) {
+    let offset = 0;
+    while (offset < bytesRead) {
+        const { bytesWritten } = await handle.write(buffer, offset, bytesRead - offset);
+        offset += bytesWritten;
+    }
+}
+async function copyRegularFilePinned(params) {
+    let destinationCreated = false;
+    let sourceHandle;
+    try {
+        sourceHandle = await fs.open(params.from, resolveReadOpenFlags());
+    }
+    catch (error) {
+        const code = error?.code;
+        if (code === "ELOOP" || code === "ENOENT" || code === "ENOTDIR") {
+            throw sourceChangedError(params.from);
+        }
+        throw error;
+    }
+    try {
+        const openedStat = await sourceHandle.stat();
+        if (params.rejectHardlinks && openedStat.nlink > 1) {
+            throw hardlinkedSourceError(params.from);
+        }
+        if (!openedStat.isFile() || !sameIdentity(params.identity, entryIdentity(openedStat))) {
+            throw sourceChangedError(params.from);
+        }
+        const destinationHandle = await fs.open(params.to, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, modeBits(params.mode) || 0o666);
+        destinationCreated = true;
+        try {
+            const scratch = Buffer.allocUnsafe(64 * 1024);
+            while (true) {
+                const { bytesRead } = await sourceHandle.read(scratch, 0, scratch.length, null);
+                if (bytesRead === 0) {
+                    break;
+                }
+                await writeAll(destinationHandle, scratch, bytesRead);
+            }
+            // Re-check the opened source before the staged tree can be committed. If
+            // it changed while we copied, the caller should retry the move.
+            const finalSourceStat = await sourceHandle.stat();
+            if (params.rejectHardlinks && finalSourceStat.nlink > 1) {
+                throw hardlinkedSourceError(params.from);
+            }
+            if (!sameIdentity(params.identity, entryIdentity(finalSourceStat))) {
+                throw sourceChangedError(params.from);
+            }
+            await destinationHandle.chmod(modeBits(params.mode));
+        }
+        finally {
+            await destinationHandle.close();
+        }
+    }
+    catch (error) {
+        if (destinationCreated) {
+            await fs.rm(params.to, { force: true }).catch(() => undefined);
+        }
+        throw error;
+    }
+    finally {
+        await sourceHandle.close();
+    }
+}
+async function copyEntryWithManifest(from, to, options, expectedIdentity) {
+    const sourceStat = await fs.lstat(from);
+    const identity = entryIdentity(sourceStat);
+    if (expectedIdentity && !sameIdentity(expectedIdentity, identity)) {
+        throw sourceChangedError(from);
+    }
+    if (sourceStat.isSymbolicLink()) {
+        await fs.symlink(await fs.readlink(from), to);
+        // readlink() is path-based; verify the symlink we copied is still the one
+        // we inspected before letting the staged destination become visible.
+        await assertSourceStillMatches(from, identity);
+        return { ...identity, kind: "leaf" };
+    }
+    if (sourceStat.isDirectory()) {
+        await fs.mkdir(to, { mode: modeBits(sourceStat.mode) || 0o755 });
+        const children = [];
+        const childNames = [];
+        const directory = await fs.opendir(from);
+        for await (const entry of directory) {
+            if (options.budget && ++options.budget.discovered > MAX_HARDLINK_PREFLIGHT_ENTRIES) {
+                throw hardlinkWalkTooLargeError();
+            }
+            childNames.push(entry.name);
+        }
+        for (const child of childNames) {
+            children.push({
+                name: child,
+                manifest: await copyEntryWithManifest(path.join(from, child), path.join(to, child), options),
+            });
+        }
+        // Directory traversal is path-based in Node. Treat a changed parent as a
+        // stale move before committing so swapped-in outside trees are not imported.
+        await assertSourceStillMatches(from, identity);
+        // mkdir() honors process umask. Restore the source mode before commit so
+        // EXDEV fallback preserves directory permissions like fs.cp did.
+        await chmodDirectoryPinned(to, modeBits(sourceStat.mode));
+        return { ...identity, children, kind: "directory" };
+    }
+    if (!sourceStat.isFile()) {
+        throw new Error(`Refusing to move non-file path with copy fallback: ${from}`);
+    }
+    if (options.sourceHardlinks === "reject" && sourceStat.nlink > 1) {
+        throw hardlinkedSourceError(from);
+    }
+    await copyRegularFilePinned({
+        from,
+        identity,
+        mode: sourceStat.mode,
+        rejectHardlinks: options.sourceHardlinks === "reject",
+        to,
+    });
+    return { ...identity, kind: "leaf" };
+}
+function assertSynchronousResult(returned, name) {
+    if (returned !== undefined) {
+        // TypeScript permits async functions for () => void; consume their rejection.
+        void Promise.resolve(returned).catch(() => { });
+        throw new TypeError(`${name} must return undefined synchronously`);
+    }
+}
+export async function movePathWithCopyFallback(options) {
+    // Keep the initiating owner's callbacks across preparation and copy fallback.
+    const callerRenameAssert = options.assertBeforeRename;
+    const callerMutationAssert = options.assertBeforeMutation;
+    const callerPublished = options.onDestinationPublished;
+    let assertionRejected = false;
+    let destinationPublished = false;
+    const assertBeforeMutation = () => {
+        assertSynchronousResult(callerMutationAssert?.(), "assertBeforeMutation");
+    };
+    const assertBeforeRename = () => {
+        try {
+            assertSynchronousResult(callerRenameAssert?.(), "assertBeforeRename");
+            assertBeforeMutation();
+        }
+        catch (error) {
+            assertionRejected = true;
+            throw error;
+        }
+    };
+    let publicationReceipt;
+    const onSourceInspected = callerPublished
+        ? (identity) => {
+            publicationReceipt = Object.freeze({
+                path: targetPath,
+                dev: identity.dev,
+                ino: identity.ino,
+            });
+        }
+        : undefined;
+    const onRenamed = () => {
+        destinationPublished = true;
+        if (publicationReceipt) {
+            assertSynchronousResult(callerPublished?.(publicationReceipt), "onDestinationPublished");
+        }
+    };
+    const sourcePath = path.resolve(options.from);
+    const targetPath = path.resolve(options.to);
+    const rejectHardlinks = options.sourceHardlinks === "reject";
+    if (rejectHardlinks) {
+        await preflightSourceHardlinks(sourcePath);
+    }
+    if (!rejectHardlinks) {
+        try {
+            await guardedRename({
+                from: sourcePath,
+                to: targetPath,
+                assertBeforeRename,
+                onSourceInspected,
+                onRenamed,
+            });
+            return;
+        }
+        catch (error) {
+            // An owner's EXDEV/EPERM refusal is not permission to copy instead.
+            if (assertionRejected || destinationPublished || !moveCopyFallbackReasonForRenameError(error)) {
+                throw error;
+            }
+        }
+    }
+    else {
+        // A pathname preflight cannot make nlink and rename one atomic operation.
+        // Commit a fresh inode through the copy path so a post-scan hardlink can
+        // never become the published target; the copy loop fences nlink again.
+    }
+    const sourceIdentity = await assertCopyDestinationOutsideSource(sourcePath, targetPath);
+    const targetDir = path.dirname(targetPath);
+    const staged = path.join(targetDir, `.fs-safe-move-${process.pid}-${randomUUID()}.tmp`);
+    const unregisterStaged = registerTempPathForExit(staged, { recursive: true });
+    try {
+        const manifest = await copyEntryWithManifest(sourcePath, staged, {
+            sourceHardlinks: rejectHardlinks ? "reject" : "allow",
+            ...(rejectHardlinks ? { budget: { discovered: 1 } } : {}),
+        }, sourceIdentity);
+        const cleanupState = createCleanupCopiedEntryState(sourcePath, manifest);
+        unregisterStaged.setIdentity(await fs.lstat(staged, { bigint: true }));
+        await assertCopyDestinationOutsideSource(sourcePath, targetPath, manifest);
+        await guardedRename({
+            from: staged,
+            to: targetPath,
+            assertBeforeRename,
+            onSourceInspected,
+            onRenamed: () => {
+                unregisterStaged();
+                onRenamed();
+            },
+        });
+        const cleanupResult = await cleanupCopiedEntry(sourcePath, manifest, cleanupState, assertBeforeMutation);
+        if (cleanupResult === "stale") {
+            throw sourceChangedError(sourcePath);
+        }
+    }
+    finally {
+        if (!destinationPublished) {
+            try {
+                const stagedIdentity = await fs.lstat(staged, { bigint: true });
+                if (!stagedIdentity.isSymbolicLink())
+                    unregisterStaged.setIdentity(stagedIdentity);
+            }
+            catch (error) {
+                if (error.code === "ENOENT") {
+                    unregisterStaged();
+                }
+            }
+            try {
+                await fs.rm(staged, { recursive: true, force: true });
+                unregisterStaged();
+            }
+            catch {
+                // Keep the identity-bound exit cleanup registered for a later retry.
+            }
+        }
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/native-binding.d.ts

@@ -0,0 +1,93 @@
+import type { TarMeterLimits } from "./archive-limits.js";
+import type { ArchiveMemberKind } from "./archive-plan.js";
+export interface NativeFileHash {
+    bytes: number;
+    digest: string;
+}
+export interface NativeFileIdentity {
+    dev: number;
+    ino: number;
+    mode: number;
+    nlink: number;
+    size: number;
+    isFile: boolean;
+    isDirectory: boolean;
+    isSymbolicLink: boolean;
+}
+export interface NativeArchiveEntry {
+    index: number;
+    path: string;
+    kind: ArchiveMemberKind;
+    size: number;
+    mode: number;
+}
+export interface NativeArchivePlanEntry extends NativeArchiveEntry {
+}
+export interface NativeCopyResult {
+    fd: number;
+    bytes: number;
+    errorCode?: string;
+    errorMessage?: string;
+}
+export interface NativeOpenBeneathResult {
+    fd: number;
+    containment: "kernel-atomic" | "best-effort";
+}
+export interface NativeOwnedTreeRemovalResult {
+    outcome?: "removed" | "preserved";
+    errorCode?: string;
+    errorMessage?: string;
+}
+export interface NativeWindowsAccessControlEntry {
+    sid: string;
+    mask: number;
+    aceType: string;
+    flags: {
+        raw: number;
+        objectInherit: boolean;
+        containerInherit: boolean;
+        noPropagateInherit: boolean;
+        inheritOnly: boolean;
+        inherited: boolean;
+        successfulAccess: boolean;
+        failedAccess: boolean;
+    };
+}
+export interface NativeWindowsSecurityFacts {
+    ownerSid: string;
+    currentUserSid: string;
+    ownerClass: string;
+    worldWritable: boolean;
+    groupWritable: boolean;
+    worldReadable: boolean;
+    groupReadable: boolean;
+    fallbackRequired: boolean;
+    daclPresent: boolean;
+    isLocal: boolean;
+    aceListComplete: boolean;
+    unsupportedAceTypes: number[];
+    aces: NativeWindowsAccessControlEntry[];
+}
+export interface NativeBinding {
+    createStagedFile?(parentFd: number, basename: string): number;
+    stagedFileMatches?(parentFd: number, basename: string, fileFd: number): boolean;
+    removeStagedFile?(parentFd: number, basename: string, fileFd: number): "removed" | "name-absent" | "preserved";
+    cloneFileExclusive(sourceFd: number, targetRootFd: number, targetRelPath: string): number;
+    copyFileRangeExclusive(sourceFd: number, targetRootFd: number, targetRelPath: string): Promise<NativeCopyResult>;
+    createPrivateDirectory(path: string): void;
+    extractArchiveNative(path: string, kind: string, rootFd: number, plan: NativeArchivePlanEntry[], limits: TarMeterLimits, signal: AbortSignal): Promise<void>;
+    fstatIdentity(fd: number): NativeFileIdentity;
+    inspectArchiveNative(path: string, kind: string, limits: TarMeterLimits, signal: AbortSignal): Promise<NativeArchiveEntry[]>;
+    linkBeneath(sourceRootFd: number, sourceRelPath: string, targetRootFd: number, targetRelPath: string): void;
+    mkdirBeneath(rootFd: number, relPath: string, mode: number): void;
+    openBeneath(rootFd: number, relPath: string, flags: number): NativeOpenBeneathResult;
+    readArchiveEntryNative(path: string, kind: string, requested: string, maxBytes: number, limits: TarMeterLimits, signal: AbortSignal): Promise<Buffer>;
+    readOwnerAndDacl(path: string): NativeWindowsSecurityFacts;
+    ownedTreeRemovalAvailable?(parentFd: number): boolean;
+    removeOwnedTree?(parentFd: number, basename: string, directoryFd: number): Promise<NativeOwnedTreeRemovalResult>;
+    removeOwnedTreeSync?(parentFd: number, basename: string, directoryFd: number): NativeOwnedTreeRemovalResult;
+    renameNoReplace(sourceRootFd: number, sourceRelPath: string, targetRootFd: number, targetRelPath: string): void;
+    renameReplace(sourceRootFd: number, sourceRelPath: string, targetRootFd: number, targetRelPath: string): void;
+    sha256File(fd: number): Promise<NativeFileHash>;
+}
+//# sourceMappingURL=native-binding.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/native-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-binding.d.ts","sourceRoot":"","sources":["../src/native-binding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;CAAG;AAErE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,eAAe,GAAG,aAAa,CAAC;CAC9C;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,+BAA+B;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,aAAa,EAAE,OAAO,CAAC;QACvB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,kBAAkB,EAAE,OAAO,CAAC;QAC5B,WAAW,EAAE,OAAO,CAAC;QACrB,SAAS,EAAE,OAAO,CAAC;QACnB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,+BAA+B,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAE5B,gBAAgB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9D,iBAAiB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAChF,gBAAgB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,CAAC;IAC/G,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1F,sBAAsB,CACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,sBAAsB,EAAE,EAC9B,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAC9C,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACjC,WAAW,CACT,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAClE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,uBAAuB,CAAC;IACrF,sBAAsB,CACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,0BAA0B,CAAC;IAC3D,yBAAyB,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,eAAe,CAAC,CACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACzC,mBAAmB,CAAC,CAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,4BAA4B,CAAC;IAChC,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,aAAa,CACX,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACjD"}

package/node_modules/@openclaw/fs-safe/dist/native-binding.js

@@ -0,0 +1 @@
+export {};

package/node_modules/@openclaw/fs-safe/dist/native-config.d.ts

@@ -0,0 +1,17 @@
+export type FsSafeNativeMode = "auto" | "off" | "require";
+export type FsSafeNativeConfig = {
+    mode: FsSafeNativeMode;
+};
+/** @deprecated Compatibility bridge for 0.4 upgrades. Use {@link FsSafeNativeConfig}. */
+export type FsSafePythonConfig = {
+    mode: FsSafeNativeMode;
+    pythonPath?: string;
+};
+export declare function configureFsSafeNative(config: Partial<FsSafeNativeConfig>): void;
+/**
+ * @deprecated Compatibility bridge for 0.4 upgrades. Use configureFsSafeNative.
+ */
+export declare function configureFsSafePython(config: Partial<FsSafePythonConfig>): void;
+export declare function getFsSafeNativeConfig(): FsSafeNativeConfig;
+export declare function __resetFsSafeNativeConfigForTest(): void;
+//# sourceMappingURL=native-config.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/native-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-config.d.ts","sourceRoot":"","sources":["../src/native-config.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;AAE1D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,gBAAgB,CAAC;CACxB,CAAC;AAEF,yFAAyF;AACzF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AA8BF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAE/E;AA4BD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAM/E;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,CAU1D;AAED,wBAAgB,gCAAgC,IAAI,IAAI,CAGvD"}