@openclaw/openshell-sandbox 2026.9.1 → 2026.9.3

package/node_modules/@openclaw/fs-safe/dist/private-temp-workspace.js

@@ -0,0 +1,299 @@
+import { randomUUID } from "node:crypto";
+import fsSync from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileStore, fileStoreSync, } from "./file-store.js";
+import { FsSafeError } from "./errors.js";
+import { isNotFoundPathError } from "./path.js";
+import { throwFsSafeReadError } from "./root-errors.js";
+import { matchRootFileOpenFailure, openRootFileSync, } from "./root-file.js";
+import { registerTempPathForExit, } from "./temp-cleanup.js";
+import { TempWorkspaceCleanupCapability, TempWorkspaceCleanupOwner, } from "./temp-workspace-owner.js";
+function resolveTempWorkspaceCleanupSafety(value) {
+    if (value === undefined || value === "compatible")
+        return "compatible";
+    if (value === "require-bounded")
+        return value;
+    throw new TypeError("cleanupSafety must be compatible or require-bounded");
+}
+function sanitizeTempPrefix(prefix) {
+    const sanitized = prefix.trim().replace(/[^a-zA-Z0-9._-]/g, "-");
+    if (!sanitized || sanitized === "." || sanitized === "..") {
+        return "fs-safe-";
+    }
+    return sanitized.endsWith("-") ? sanitized : `${sanitized}-`;
+}
+function resolveWorkspaceLeaf(dir, fileName) {
+    return path.join(dir, assertWorkspaceFileName(fileName));
+}
+function assertWorkspaceFileName(fileName) {
+    const value = fileName.trim();
+    if (!value ||
+        value === "." ||
+        value === ".." ||
+        value.includes("\0") ||
+        value.includes("/") ||
+        value.includes("\\") ||
+        path.basename(value) !== value) {
+        throw new Error(`Invalid temp workspace file name: ${JSON.stringify(fileName)}`);
+    }
+    return value;
+}
+function throwTempWorkspaceOpenFailure(failure) {
+    return matchRootFileOpenFailure(failure, {
+        path: ({ error }) => {
+            if (isNotFoundPathError(error)) {
+                throw new FsSafeError("not-found", "temp workspace file not found", { cause: error });
+            }
+            throw new FsSafeError("path-mismatch", "temp workspace target changed during read", {
+                cause: error,
+            });
+        },
+        validation: ({ error }) => {
+            if (error instanceof FsSafeError) {
+                throw error;
+            }
+            throw new FsSafeError("path-mismatch", "temp workspace target failed read validation", {
+                cause: error,
+            });
+        },
+        io: ({ error }) => throwFsSafeReadError(error, "temp workspace"),
+        fallback: ({ error }) => {
+            throw new FsSafeError("path-mismatch", "temp workspace target changed during read", {
+                cause: error,
+            });
+        },
+    });
+}
+async function ensurePrivateDirectory(dir, mode) {
+    await fs.mkdir(dir, { recursive: true, mode });
+    const stat = await fs.stat(dir);
+    if (!stat.isDirectory()) {
+        throw new Error(`Temp root must be a directory: ${dir}`);
+    }
+    await fs.chmod(dir, mode).catch(() => undefined);
+}
+function ensurePrivateDirectorySync(dir, mode) {
+    fsSync.mkdirSync(dir, { recursive: true, mode });
+    const stat = fsSync.statSync(dir);
+    if (!stat.isDirectory()) {
+        throw new Error(`Temp root must be a directory: ${dir}`);
+    }
+    try {
+        fsSync.chmodSync(dir, mode);
+    }
+    catch {
+        // Best-effort on platforms that do not enforce POSIX modes.
+    }
+}
+async function createTempWorkspace(options) {
+    const dirMode = options.dirMode ?? 0o700;
+    const mode = options.mode ?? 0o600;
+    const cleanupSafety = resolveTempWorkspaceCleanupSafety(options.cleanupSafety);
+    const requestedRoot = path.resolve(options.rootDir);
+    const root = await fs.realpath(requestedRoot).catch(() => requestedRoot);
+    await ensurePrivateDirectory(root, dirMode);
+    const capability = new TempWorkspaceCleanupCapability(root, cleanupSafety);
+    let dir;
+    let stat;
+    let cleanupOwner;
+    let unregisterTempDir;
+    try {
+        dir = await fs.mkdtemp(path.join(root, sanitizeTempPrefix(options.prefix)));
+        await fs.chmod(dir, dirMode).catch(() => undefined);
+        stat = await fs.lstat(dir, { bigint: true });
+        if (stat.isSymbolicLink() || !stat.isDirectory()) {
+            throw new Error(`Temp workspace must be a directory: ${dir}`);
+        }
+        if (capability.parent)
+            capability.assertCurrent();
+        cleanupOwner = new TempWorkspaceCleanupOwner(dir, stat, capability);
+        unregisterTempDir = registerTempPathForExit(dir, {
+            cleanupSync: () => cleanupOwner.cleanupSync(),
+        });
+    }
+    catch (error) {
+        try {
+            if (cleanupOwner)
+                cleanupOwner.cleanupSync();
+            else
+                capability.close();
+        }
+        catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], "temp workspace creation and cleanup both failed");
+        }
+        throw error;
+    }
+    const owner = cleanupOwner;
+    const identity = { dev: Number(stat.dev), ino: Number(stat.ino) };
+    // Once registered, even a store-construction failure remains exit-cleanable.
+    const store = fileStore({ rootDir: dir, private: true, dirMode, mode });
+    return {
+        dir,
+        identity,
+        store,
+        path: (fileName) => resolveWorkspaceLeaf(dir, fileName),
+        write: async (fileName, data) => await store.write(assertWorkspaceFileName(fileName), data, { mode }),
+        writeText: async (fileName, data) => await store.writeText(assertWorkspaceFileName(fileName), data, { mode }),
+        writeJson: async (fileName, data, writeOptions) => await store.writeJson(assertWorkspaceFileName(fileName), data, {
+            mode,
+            trailingNewline: writeOptions?.trailingNewline,
+        }),
+        copyIn: async (fileName, sourcePath) => await store.copyIn(assertWorkspaceFileName(fileName), sourcePath, { mode }),
+        read: async (fileName) => {
+            try {
+                return await store.readBytes(assertWorkspaceFileName(fileName));
+            }
+            catch (error) {
+                throwFsSafeReadError(error, "temp workspace");
+            }
+        },
+        cleanup: async () => {
+            try {
+                return await owner.cleanup();
+            }
+            finally {
+                unregisterTempDir();
+            }
+        },
+        [Symbol.asyncDispose]: async () => {
+            try {
+                await owner.cleanup();
+            }
+            finally {
+                unregisterTempDir();
+            }
+        },
+    };
+}
+export async function tempWorkspace(options) {
+    return await createTempWorkspace(options);
+}
+export async function withTempWorkspace(options, run) {
+    const workspace = await createTempWorkspace({
+        ...options,
+        prefix: `${sanitizeTempPrefix(options.prefix)}${randomUUID()}-`,
+    });
+    try {
+        return await run(workspace);
+    }
+    finally {
+        await workspace.cleanup();
+    }
+}
+export function tempWorkspaceSync(options) {
+    const dirMode = options.dirMode ?? 0o700;
+    const mode = options.mode ?? 0o600;
+    const cleanupSafety = resolveTempWorkspaceCleanupSafety(options.cleanupSafety);
+    const requestedRoot = path.resolve(options.rootDir);
+    let root = requestedRoot;
+    try {
+        root = fsSync.realpathSync.native(requestedRoot);
+    }
+    catch {
+        root = requestedRoot;
+    }
+    ensurePrivateDirectorySync(root, dirMode);
+    const capability = new TempWorkspaceCleanupCapability(root, cleanupSafety);
+    let dir;
+    let stat;
+    let cleanupOwner;
+    let unregisterTempDir;
+    try {
+        dir = fsSync.mkdtempSync(path.join(root, sanitizeTempPrefix(options.prefix)));
+        try {
+            fsSync.chmodSync(dir, dirMode);
+        }
+        catch {
+            // Best-effort on platforms that do not enforce POSIX modes.
+        }
+        stat = fsSync.lstatSync(dir, { bigint: true });
+        if (stat.isSymbolicLink() || !stat.isDirectory()) {
+            throw new Error(`Temp workspace must be a directory: ${dir}`);
+        }
+        if (capability.parent)
+            capability.assertCurrent();
+        cleanupOwner = new TempWorkspaceCleanupOwner(dir, stat, capability);
+        unregisterTempDir = registerTempPathForExit(dir, {
+            cleanupSync: () => cleanupOwner.cleanupSync(),
+        });
+    }
+    catch (error) {
+        try {
+            if (cleanupOwner)
+                cleanupOwner.cleanupSync();
+            else
+                capability.close();
+        }
+        catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], "temp workspace creation and cleanup both failed");
+        }
+        throw error;
+    }
+    const owner = cleanupOwner;
+    const identity = { dev: Number(stat.dev), ino: Number(stat.ino) };
+    // Once registered, even a store-construction failure remains exit-cleanable.
+    const store = fileStoreSync({ rootDir: dir, private: true, dirMode, mode });
+    return {
+        dir,
+        identity,
+        store,
+        path: (fileName) => resolveWorkspaceLeaf(dir, fileName),
+        write: (fileName, data) => store.write(assertWorkspaceFileName(fileName), data, { mode }),
+        writeText: (fileName, data) => store.writeText(assertWorkspaceFileName(fileName), data, { mode }),
+        writeJson: (fileName, data, writeOptions) => store.writeJson(assertWorkspaceFileName(fileName), data, {
+            mode,
+            trailingNewline: writeOptions?.trailingNewline,
+        }),
+        read: (fileName) => {
+            const opened = openRootFileSync({
+                absolutePath: store.path(assertWorkspaceFileName(fileName)),
+                rootPath: dir,
+                boundaryLabel: "temp workspace",
+                rejectHardlinks: true,
+            });
+            if (!opened.ok) {
+                throwTempWorkspaceOpenFailure(opened);
+            }
+            try {
+                try {
+                    return fsSync.readFileSync(opened.fd);
+                }
+                catch (error) {
+                    throwFsSafeReadError(error, "temp workspace");
+                }
+            }
+            finally {
+                fsSync.closeSync(opened.fd);
+            }
+        },
+        cleanup: () => {
+            try {
+                return owner.cleanupSync();
+            }
+            finally {
+                unregisterTempDir();
+            }
+        },
+        [Symbol.dispose]: () => {
+            try {
+                owner.cleanupSync();
+            }
+            finally {
+                unregisterTempDir();
+            }
+        },
+    };
+}
+export function withTempWorkspaceSync(options, run) {
+    const workspace = tempWorkspaceSync({
+        ...options,
+        prefix: `${sanitizeTempPrefix(options.prefix)}${randomUUID()}-`,
+    });
+    try {
+        return run(workspace);
+    }
+    finally {
+        workspace.cleanup();
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/publish-file-failure.d.ts

@@ -0,0 +1,28 @@
+import { FsSafeError } from "./errors.js";
+import type { FileIdentityStat } from "./file-identity.js";
+export type PublishFileExclusiveSyncFailurePolicy = "rollback" | "preserve";
+export type PublishFileExclusiveDirectorySyncFailure = {
+    status: "failed";
+    code?: string;
+};
+export type PublishFileExclusiveFailurePhase = "copy-create" | "copy-verify" | "directory-sync" | "hardlink-create" | "hardlink-verify" | "rename-create" | "rename-verify";
+export type PublishFileExclusiveCleanup = "removed" | "preserved" | "unknown";
+export type PublishFileExclusiveFailureDetails = {
+    phase: PublishFileExclusiveFailurePhase;
+    targetCreated: boolean;
+    targetIdentity?: FileIdentityStat;
+    cleanup: PublishFileExclusiveCleanup;
+    directorySync?: PublishFileExclusiveDirectorySyncFailure;
+};
+export type PublishFailureState = {
+    phase: PublishFileExclusiveFailurePhase;
+    targetCreated: boolean;
+    targetIdentity?: FileIdentityStat;
+    targetCleanupIdentity?: FileIdentityStat;
+    preserveTarget: boolean;
+    directorySync?: PublishFileExclusiveDirectorySyncFailure;
+};
+export declare function rememberCreatedTarget(state: PublishFailureState, identity: FileIdentityStat, phase: PublishFileExclusiveFailurePhase): void;
+export declare function publicationFailure(error: unknown, state: PublishFailureState, cleanup: PublishFileExclusiveCleanup): FsSafeError;
+export declare function directorySyncFailure(error: unknown): PublishFileExclusiveDirectorySyncFailure;
+//# sourceMappingURL=publish-file-failure.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/publish-file-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-file-failure.d.ts","sourceRoot":"","sources":["../src/publish-file-failure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,MAAM,MAAM,qCAAqC,GAAG,UAAU,GAAG,UAAU,CAAC;AAC5E,MAAM,MAAM,wCAAwC,GAAG;IACrD,MAAM,EAAE,QAAQ,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AACF,MAAM,MAAM,gCAAgC,GACxC,aAAa,GACb,aAAa,GACb,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,GACf,eAAe,CAAC;AACpB,MAAM,MAAM,2BAA2B,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAC9E,MAAM,MAAM,kCAAkC,GAAG;IAC/C,KAAK,EAAE,gCAAgC,CAAC;IACxC,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,OAAO,EAAE,2BAA2B,CAAC;IACrC,aAAa,CAAC,EAAE,wCAAwC,CAAC;CAC1D,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,gCAAgC,CAAC;IACxC,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,qBAAqB,CAAC,EAAE,gBAAgB,CAAC;IACzC,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,wCAAwC,CAAC;CAC1D,CAAC;AAEF,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,mBAAmB,EAC1B,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,gCAAgC,GACtC,IAAI,CAKN;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,2BAA2B,GACnC,WAAW,CAcb;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,wCAAwC,CAG1C"}

package/node_modules/@openclaw/fs-safe/dist/publish-file-failure.js

@@ -0,0 +1,22 @@
+import { FsSafeError } from "./errors.js";
+export function rememberCreatedTarget(state, identity, phase) {
+    state.targetCreated = true;
+    state.targetIdentity = { dev: Number(identity.dev), ino: Number(identity.ino) };
+    state.targetCleanupIdentity = { dev: identity.dev, ino: identity.ino };
+    state.phase = phase;
+}
+export function publicationFailure(error, state, cleanup) {
+    const cause = error instanceof Error ? error : new Error(String(error));
+    const details = {
+        phase: state.phase,
+        targetCreated: state.targetCreated,
+        ...(state.targetIdentity ? { targetIdentity: state.targetIdentity } : {}),
+        ...(state.directorySync ? { directorySync: state.directorySync } : {}),
+        cleanup,
+    };
+    return new FsSafeError(error instanceof FsSafeError ? error.code : "helper-failed", `exclusive file publication failed during ${state.phase}: ${cause.message}`, { cause, details });
+}
+export function directorySyncFailure(error) {
+    const code = error?.code;
+    return typeof code === "string" ? { status: "failed", code } : { status: "failed" };
+}

package/node_modules/@openclaw/fs-safe/dist/publish-file.d.ts

@@ -0,0 +1,21 @@
+import { type Stats } from "node:fs";
+import { type DirectoryReceipt, type DirectorySyncOutcome } from "./directory-durability.js";
+import { type FileIdentityStat } from "./file-identity.js";
+import { type PublishFileExclusiveSyncFailurePolicy } from "./publish-file-failure.js";
+export type { PublishFileExclusiveCleanup, PublishFileExclusiveDirectorySyncFailure, PublishFileExclusiveFailureDetails, PublishFileExclusiveFailurePhase, PublishFileExclusiveSyncFailurePolicy, } from "./publish-file-failure.js";
+export type PublishFileExclusiveStrategy = "link-or-copy" | "link-required" | "rename-noreplace";
+export type PublishFileExclusiveResult = {
+    method: "hardlink" | "exclusive-copy" | "rename-noreplace";
+    identity: Stats;
+    directorySync: DirectorySyncOutcome;
+};
+export declare function isHardlinkFallbackError(error: unknown): boolean;
+export declare function publishFileExclusive(params: {
+    sourcePath: string;
+    targetPath: string;
+    expectedSourceIdentity?: FileIdentityStat;
+    strategy: PublishFileExclusiveStrategy;
+    onSyncFailure?: PublishFileExclusiveSyncFailurePolicy;
+    parentReceipt?: DirectoryReceipt;
+}): Promise<PublishFileExclusiveResult>;
+//# sourceMappingURL=publish-file.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/publish-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-file.d.ts","sourceRoot":"","sources":["../src/publish-file.ts"],"names":[],"mappings":"AACA,OAAe,EAAoB,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAML,KAAK,qCAAqC,EAC3C,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,2BAA2B,EAC3B,wCAAwC,EACxC,kCAAkC,EAClC,gCAAgC,EAChC,qCAAqC,GACtC,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,4BAA4B,GACpC,cAAc,GACd,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;IAC3D,QAAQ,EAAE,KAAK,CAAC;IAChB,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAkBF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE/D;AA0ND,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,gBAAgB,CAAC;IAC1C,QAAQ,EAAE,4BAA4B,CAAC;IACvC,aAAa,CAAC,EAAE,qCAAqC,CAAC;IACtD,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA4MtC"}