@openclaw/openshell-sandbox 2026.9.1 → 2026.9.3

package/node_modules/@openclaw/fs-safe/docs/writing.md

@@ -0,0 +1,347 @@
+# Writing
+
+The `Root` handle exposes a tight set of mutation verbs. Replacement writes
+(`write`, `writeJson`, and `copyIn`) publish with a sibling-temp commit so no
+half-written replacement appears at the destination. Create-only writes
+(`create`, `createJson`, and `write` with `overwrite: false`) use sibling-temp
+staging with an atomic no-replace rename only on backends that provide one —
+the native binding, which `require` mode guarantees and `auto` mode uses when
+the binding loads. The pure-JavaScript fallback has no atomic no-clobber
+rename and does not stage: it claims the final name exclusively with `O_EXCL`
+and writes content in place, so a concurrent observer can see the new file
+before its content is complete. Use `require` mode when that visibility window
+matters.
+`append` and `openWritable` intentionally modify an opened file in place;
+`move`, `remove`, and `mkdir` mutate directory entries rather than file bytes.
+Each verb applies the boundary checks appropriate to its operation.
+
+```ts
+await fs.write("state.json", body);
+await fs.create("seed.json", initial);   // throws if exists
+await fs.writeJson("config.json", state);
+await fs.append("logs/today.log", line);
+await fs.copyIn("inbox/upload.bin", "/tmp/upload.bin");
+await fs.move("notes/draft.md", "notes/published.md");
+await fs.remove("logs/yesterday.log");
+await fs.mkdir("snapshots/2026/05");
+```
+
+## What replacement writes do
+
+1. Resolve the relative target against the canonical root and reject anything that escapes (`outside-workspace`).
+2. If `mkdir: true`, create missing parent directories relative to a pinned parent fd in the native path, or with per-component identity guards in the JavaScript fallback.
+3. Pin or guard the parent directory for the selected mechanism. Native operations use a parent fd; guarded JavaScript verifies directory identity before and after mutation. The JavaScript check cannot make the intervening pathname syscall atomic, so a same-privilege peer that can replace the parent may cause an out-of-root side effect before detection. Use native `require` mode for that threat model; see the [security model](security-model.md#symlinks-write-side).
+4. Write data to a sibling temp file in the same directory.
+5. Atomically rename the temp file over the destination.
+6. Stat the resulting fd and verify identity.
+
+Private sibling temporary names are independent of the destination basename,
+so staging does not add a suffix to an otherwise valid long filename.
+
+A failure before the final rename leaves the destination at its previous
+contents. A successful rename publishes the complete replacement. This
+old-or-new guarantee does not apply to `append()` or `openWritable()`, which
+write in place, or to lower-level atomic helpers when their explicitly
+non-atomic permission-error copy fallback is enabled.
+
+Post-publication verification can still reject after a complete replacement has
+been committed. Rejection does not promise that a successful rename was rolled
+back; the published file or a raced replacement may remain at the destination.
+
+## Denying mutations
+
+All mutation verbs accept `denyMutations?: DenyMutationPolicy`, either as a root default or per-call option:
+
+```ts
+const fs = await root("/srv/workspace", {
+  denyMutations: {
+    paths: ["/srv/workspace/.env"],
+    prefixes: ["/srv/workspace/.ssh"],
+  },
+});
+
+await fs.write(".env", "x");       // throws FsSafeError code "denied-path"
+await fs.remove(".ssh/id_rsa");    // throws FsSafeError code "denied-path"
+```
+
+`paths` blocks exact absolute paths. `prefixes` blocks absolute paths and everything below them. fs-safe preserves path strings exactly and canonicalizes through existing ancestors before comparing, so a mutation through a symlinked ancestor to a denied path is still denied. Root-level and per-call policies are additive; per-call policy can add denies, but cannot clear root defaults.
+
+## Write verbs
+
+### `fs.write(rel, data, options?)`
+
+Overwrite or create. Always atomic.
+
+```ts
+await fs.write("state/last-run.json", JSON.stringify(run));
+await fs.write("notes/today.txt", "hello\n", { encoding: "utf8" });
+```
+
+`data` accepts `string | Buffer`. `mode` sets the file's POSIX mode. If neither the call nor `RootDefaults` supplies it, a replacement preserves the existing file mode and a new file uses `0o600`. `mkdir` and `overwrite` both default to `true`; set `overwrite: false` for the same no-clobber behavior as `create()`.
+
+#### Write options
+
+| Option | Type | Default / behavior |
+|---|---|---|
+| `denyMutations` | `DenyMutationPolicy` | Merged with root-level denies. |
+| `durable` | `boolean` | `true`; use `false` to skip file and parent fsync. |
+| `encoding` | `BufferEncoding` | `"utf8"` for strings. |
+| `mkdir` | `boolean` | `true`; creates missing parents. |
+| `mode` | `number` | Inherited on replacement, otherwise `0o600`. |
+| `overwrite` | `boolean` | `true`; `false` is create-only. |
+| `renameIdentity` | `RenameIdentityPolicy` | `"strict"`. |
+
+`write`, `create`, `writeJson`, `createJson`, and `append` accept `durable`.
+Precedence is per-call option, then `Root.defaults.durable`, then `true`;
+an explicitly `undefined` call option preserves the root default.
+`durable: false` keeps the sibling-temp replace/rename behavior of replacement
+writes but skips file and parent-directory fsync calls. Create-only and append
+publication behavior, permissions, identity checks, and error codes are unchanged.
+Use it only for reconstructible data: a crash may lose the write or leave the
+previous file. `copyIn`, `move`, and streaming `openWritable` do not use this option.
+The existing pure-JavaScript Windows writer performs no fsync calls in either
+setting; native Windows writes honor the option. Directory sync remains best-effort.
+
+POSIX modes without read permission, including `0o000` and `0o200`, succeed:
+final verification uses a descriptor retained by the writer rather than reopening
+the published file. The requested mode is not relaxed for verification.
+Publication verification compares exact bigint descriptor and pathname identities,
+including large file indexes that cannot be represented by a JavaScript number.
+With durability enabled (the default), native publication syncs content before rename and syncs the parent directory.
+Modes that retain owner read/write skip the extra mode-only file sync: after a
+crash, the file may retain staged mode `0o600` instead of the wider requested mode.
+Modes that remove owner read or write, and corrections of observed wider staging
+permissions, keep the post-chmod file sync.
+Later reads still obey OS permissions, and access checks on a pre-existing
+destination are unchanged. The explicit FUSE compatibility policy still requires
+a readable destination to prove matching content when rename changes its identity.
+
+When Windows cannot report a pathname's identity, the publication verifier reopens
+the name and compares that descriptor's exact identity with the original retained
+file, without reading bytes. It also rechecks links and root/parent containment.
+This write-specific proof does not relax ordinary reads: unknown pathname metadata
+alone is never proof that the name still refers to the expected file.
+
+### `fs.create(rel, data, options?)`
+
+Don't-clobber variant of `write()`. Throws `already-exists` if the target is there.
+Create-only preflight preserves boundary, alias, hardlink, and type checks without
+opening an existing target to inherit its mode; a fresh file uses the requested
+mode or the normal new-file default. When the native binding is in use
+(`require` mode, or `auto` mode with a successfully loaded binding), content is
+staged privately and published with an atomic no-replace rename, so the name
+never appears before its bytes. In the pure-JavaScript fallback the name is
+claimed exclusively first and content is written afterward, so observers can
+briefly see an empty file; failure cleanup removes a claimed file only when its
+identity is unchanged.
+
+```ts
+try {
+  await fs.create("config/seed.json", initial);
+} catch (err) {
+  if (err instanceof FsSafeError && err.code !== "already-exists") throw err;
+}
+```
+
+### `fs.writeJson(rel, value, options?)`
+
+`JSON.stringify(value, replacer, space)` + atomic write. Adds a trailing newline by default.
+
+```ts
+await fs.writeJson("config.json", state, { space: 2 });
+await fs.writeJson("compact.json", state, { trailingNewline: false });
+```
+
+Options:
+
+```ts
+type RootWriteJsonOptions = RootWriteOptions & {
+  replacer?: (this: any, key: string, value: any) => any | (number | string)[];
+  space?: number | string;
+  trailingNewline?: boolean; // default true
+};
+```
+
+`createJson(rel, value, options?)` is the don't-clobber variant.
+
+### `fs.append(rel, data, options?)`
+
+Open in append mode, write, sync the file handle, and close. Honors `mkdir` for the parent directory and syncs the parent directory when the append creates the file. `durable: false` skips both syncs. Pass `prependNewlineIfNeeded: true` to insert a `\n` if the file does not already end in one.
+
+```ts
+await fs.append("logs/today.log", `[${ts}] ${line}\n`);
+await fs.append("notes/scratch.md", "* new bullet", { prependNewlineIfNeeded: true });
+```
+
+For high-volume logging, consider [`openWritable`](#openwritable) and a long-lived append handle. Direct append-mode writes preserve kernel append semantics, but they are not atomic against external rotators that rename or unlink the target.
+
+### `fs.copyIn(rel, sourceAbsPath, options?)`
+
+Bring a file from outside the root into the root, atomically. The source path must be absolute. The library streams the source through the boundary, writes to a sibling temp, and renames over the destination.
+
+```ts
+await fs.copyIn("inbox/upload.bin", "/tmp/incoming.bin", {
+  maxBytes: 64 * 1024 * 1024,
+});
+```
+
+Options are `{ denyMutations?, maxBytes?, mkdir?, mode?, sourceHardlinks? }`.
+Use `sourceHardlinks: "reject"` to refuse if the source itself is a hardlinked
+alias. There is no encoding option: copying preserves source bytes.
+
+### `fs.move(from, to, options?)`
+
+Rename one path inside the root to another. Defaults to no clobber:
+
+```ts
+await fs.move("incoming/foo.txt", "archive/foo.txt");
+await fs.move("incoming/foo.txt", "archive/foo.txt", { overwrite: true });
+```
+
+Both `from` and `to` are bounded; `..` in either is rejected.
+
+### `fs.remove(rel)`
+
+Unlink a file or `rmdir` an empty directory. Non-empty directories throw `not-empty`. For atomic directory replacement, use [`replaceDirectoryAtomic`](atomic.md#replacedirectoryatomic).
+
+```ts
+await fs.remove("logs/yesterday.log");
+await fs.remove("snapshots/empty-dir"); // ok
+await fs.remove("snapshots/full-dir");  // throws not-empty
+```
+
+### `fs.mkdir(rel)`
+
+`mkdir -p`. Creates missing parents.
+
+```ts
+await fs.mkdir("snapshots/2026/05");
+```
+
+### `fs.ensureRoot()`
+
+Treats `""` / `"."` as the root itself. Useful when a generic helper computes a relative directory and might end up at the root.
+
+```ts
+const targetRel = path.relative(fs.rootReal, candidateAbs); // could be "" if candidateAbs === root
+await fs.ensureRoot(); // accepts "" without throwing
+```
+
+## `openWritable()` for streaming
+
+When `write` doesn't fit (very large outputs, slow producers), open a writable handle:
+
+```ts
+const opened = await fs.openWritable("logs/current.log", { writeMode: "append" });
+try {
+  for await (const chunk of source) {
+    await opened.handle.appendFile(chunk);
+  }
+} finally {
+  await opened.handle.close();
+}
+```
+
+Options are `{ denyMutations?, mkdir?, mode?, writeMode? }`, where `writeMode`
+is `"replace"` (default), `"append"`, or `"update"`. `replace` truncates existing
+files; `update` keeps existing contents. Streaming writes go directly to the
+destination — there is no atomic-rename step. If you need both streaming and
+atomicity, write to a sibling temp yourself and rename when done; the
+[`atomic`](atomic.md) helpers can do this for you.
+
+On POSIX, existing-target opens use `O_NONBLOCK` as an admission safeguard so
+a no-reader FIFO cannot stall regular-file validation. This does not change
+ordinary regular-file write semantics. `replace` and `update` remain write-only
+opens, including for mode `0o200` files; replacement truncation happens only
+after type, identity, and boundary checks pass. Rejected existing paths are
+never cleanup-owned or unlinked.
+
+## Write defaults vs per-call options
+
+Set `mkdir: true` once on `root()`; pass text encodings per call when needed:
+
+```ts
+const fs = await root("/srv/workspace", {
+  mkdir: true,
+});
+
+await fs.write("notes/today.txt", "ascii", { encoding: "utf8" });
+await fs.write("data/blob.bin", buffer);     // mkdir true, no encoding because data is Buffer
+await fs.write("data/blob.bin", buffer, { mkdir: false }); // override
+```
+
+## Errors you'll catch
+
+| Code | When |
+|---|---|
+| `outside-workspace` | Target resolves outside the root. |
+| `already-exists` | `create()` / `createJson()` / `move({ overwrite: false })` hit an existing target. |
+| `not-found` | Parent does not exist and `mkdir` is false. |
+| `not-empty` | `remove()` on a non-empty directory. |
+| `not-removable` | `remove()` could not unlink/rmdir (typically permissions or device busy). |
+| `path-mismatch` | Post-write fd identity check did not match. Almost always a parallel writer, or a FUSE mount with unstable inode numbers — see `renameIdentity` below. |
+| `too-large` | `copyIn()` source exceeded `maxBytes`. |
+| `symlink` | A path component is a symlink and policy is `reject`. |
+| `hardlink` | `sourceHardlinks: "reject"` saw `nlink > 1`. |
+
+Full list in [Errors](errors.md).
+
+## Common patterns
+
+### Replace if changed
+
+```ts
+const next = JSON.stringify(state);
+const prev = await fs.readText("state.json").catch(() => "");
+if (prev !== next) await fs.write("state.json", next);
+```
+
+### Stage many writes, then commit
+
+```ts
+const stagingDir = "snapshots/incoming";
+await fs.mkdir(stagingDir);
+for (const file of files) await fs.write(`${stagingDir}/${file.name}`, file.body);
+await fs.move(stagingDir, "snapshots/2026-05-05", { overwrite: true });
+```
+
+For a true commit-or-rollback over a *directory*, use [`replaceDirectoryAtomic`](atomic.md#replacedirectoryatomic).
+
+### Rotate logs
+
+```ts
+const today = `logs/${formatDate(new Date())}.log`;
+try {
+  await fs.create(today, "");
+} catch (err) {
+  if (!(err instanceof FsSafeError) || err.code !== "already-exists") throw err;
+}
+await fs.append(today, line);
+```
+
+## FUSE mounts and unstable inode numbers
+
+Some FUSE mounts — rclone is a confirmed example — assign the destination a different inode number from the source temp file as a result of rename, even within a single process with zero concurrency. Repeated stats of an unchanged destination remain stable, but the source-to-destination `(dev, ino)` comparison always fails with `path-mismatch`.
+
+Set `renameIdentity: "verify-content-with-lock"` on the root (or per call) to use a SHA-256 content comparison under a cooperative sidecar lock instead:
+
+```ts
+const fs = await root("/mnt/rclone-workspace", {
+  renameIdentity: "verify-content-with-lock",
+});
+
+await fs.write("state.json", body); // succeeds on rclone FUSE
+```
+
+**How it works.** The full write runs under an exclusive per-target lock named `.fs-safe-write-<sha256>.lock` in the root. Keeping the lock in the already-canonical root avoids creating an unguarded lock path through a missing or raced target parent. The guarded Node fallback accepts the source-temp-to-destination inode mismatch only when the SHA-256 of the re-read bytes matches the SHA-256 of the bytes written. Subsequent path identity checks remain strict, so this mode requires an unchanged destination path to report stable identity. It deliberately stays on the guarded JavaScript path because content verification replaces the normal inode-preserving rename contract. The lock is released before the call returns.
+
+**Security note.** `verify-content-with-lock` proves that the bytes observed after rename match the requested write and prevents *cooperating* writers from interleaving. It does **not** prove that the destination still names the temp-file object, retain fd-relative parent pinning, or stop a same-UID process that ignores the advisory lock. Do not use this option on directories writable by untrusted same-UID processes. Strict identity verification remains the default.
+
+Lock recovery is fail-closed. If a process crashes and leaves the root-level `.fs-safe-write-<sha256>.lock`, a later write reports the stale lock instead of deleting it based on a host-local PID. Recover only under external authority that excludes every competing writer; see [File lock](sidecar-lock.md#stale-recovery-guarded-remove-if-unchanged).
+
+## See also
+
+- [Atomic writes](atomic.md) — the lower-level `replaceFileAtomic` and friends.
+- [JSON files](json.md) — standalone JSON helpers without going through `root()`.
+- [Reading](reading.md) — companion read API.
+- [Errors](errors.md) — every code, when it fires.

package/node_modules/@openclaw/fs-safe/package.json

@@ -0,0 +1,187 @@
+{
+  "name": "@openclaw/fs-safe",
+  "version": "0.8.5",
+  "description": "Capability-style filesystem roots for Node.js apps that handle untrusted relative paths.",
+  "keywords": [
+    "filesystem",
+    "openclaw",
+    "path-traversal",
+    "security",
+    "typescript"
+  ],
+  "homepage": "https://fs-safe.io",
+  "bugs": {
+    "url": "https://github.com/openclaw/fs-safe/issues"
+  },
+  "license": "MIT",
+  "author": "OpenClaw Team <dev@openclaw.ai>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/openclaw/fs-safe.git"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "files": [
+    "dist/archive-parser.wasm",
+    "dist/**/*.js",
+    "dist/**/*.d.ts",
+    "dist/**/*.d.ts.map",
+    "docs/**/*.md",
+    "docs/assets/readme-banner.jpg",
+    "README.md",
+    "CHANGELOG.md",
+    "SECURITY.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./root": {
+      "types": "./dist/root.d.ts",
+      "default": "./dist/root.js"
+    },
+    "./config": {
+      "types": "./dist/config.d.ts",
+      "default": "./dist/config.js"
+    },
+    "./path": {
+      "types": "./dist/path.d.ts",
+      "default": "./dist/path.js"
+    },
+    "./output": {
+      "types": "./dist/output.d.ts",
+      "default": "./dist/output.js"
+    },
+    "./advanced": {
+      "types": "./dist/advanced.d.ts",
+      "default": "./dist/advanced.js"
+    },
+    "./json": {
+      "types": "./dist/json.d.ts",
+      "default": "./dist/json.js"
+    },
+    "./store": {
+      "types": "./dist/store.d.ts",
+      "default": "./dist/store.js"
+    },
+    "./secret": {
+      "types": "./dist/secret.d.ts",
+      "default": "./dist/secret.js"
+    },
+    "./permissions": {
+      "types": "./dist/permissions-public.d.ts",
+      "default": "./dist/permissions-public.js"
+    },
+    "./secure-file": {
+      "types": "./dist/secure-file.d.ts",
+      "default": "./dist/secure-file.js"
+    },
+    "./file-lock": {
+      "types": "./dist/file-lock.d.ts",
+      "default": "./dist/file-lock.js"
+    },
+    "./walk": {
+      "types": "./dist/walk.d.ts",
+      "default": "./dist/walk.js"
+    },
+    "./temp": {
+      "types": "./dist/temp.d.ts",
+      "default": "./dist/temp.js"
+    },
+    "./secure-temp-root": {
+      "types": "./dist/secure-temp-dir.d.ts",
+      "default": "./dist/secure-temp-dir.js"
+    },
+    "./atomic": {
+      "types": "./dist/atomic.d.ts",
+      "default": "./dist/atomic.js"
+    },
+    "./durability": {
+      "types": "./dist/durability.d.ts",
+      "default": "./dist/durability.js"
+    },
+    "./archive": {
+      "types": "./dist/archive.d.ts",
+      "default": "./dist/archive.js"
+    },
+    "./errors": {
+      "types": "./dist/errors.d.ts",
+      "default": "./dist/errors.js"
+    },
+    "./types": {
+      "types": "./dist/types.d.ts",
+      "default": "./dist/types.js"
+    },
+    "./test-hooks": {
+      "types": "./dist/test-hooks.d.ts",
+      "default": "./dist/test-hooks.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "benchmark": "node scripts/benchmark.mjs",
+    "benchmark:publish": "pnpm build && node scripts/bench-publish.mjs",
+    "build": "node scripts/prepack-build.mjs",
+    "lint:file-size": "node scripts/check-file-size.mjs",
+    "lint:fs-boundary": "node scripts/check-fs-boundary-primitives.mjs",
+    "prepack": "node scripts/prepack-build.mjs",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "test:coverage:collect": "pnpm build && vitest run --coverage --coverage.reporter=json --coverage.thresholds.lines=0 --coverage.thresholds.functions=0 --coverage.thresholds.statements=0 --coverage.thresholds.branches=0",
+    "test:coverage:merge": "node scripts/merge-coverage.mjs",
+    "test:security": "vitest run test/fs-safe.test.ts test/read-boundary-bypass.test.ts test/write-boundary-bypass.test.ts test/additional-boundary-bypass.test.ts test/adversarial-boundary-payloads.test.ts",
+    "check": "pnpm lint:file-size && pnpm lint:fs-boundary && pnpm build && pnpm docs:check && pnpm test && node scripts/check-pack.mjs",
+    "docs:check": "node scripts/check-doc-examples.mjs",
+    "docs:site": "node scripts/build-docs-site.mjs",
+    "native:build": "pnpm --filter @openclaw/fs-safe-native-build build",
+    "native:test": "cargo test --workspace",
+    "pack:check": "pnpm build && node scripts/check-pack.mjs",
+    "public-api:update": "pnpm build && node scripts/check-pack.mjs --update-public-api",
+    "package:collect": "node scripts/check-release-packages.mjs --output release-artifacts",
+    "package:smoke": "node scripts/check-release-packages.mjs --allow-host-only --output release-artifacts",
+    "check:changed": "pnpm run check",
+    "release:notes": "node scripts/release-notes.mjs",
+    "test:changed": "pnpm run test",
+    "crabbox:hydrate": "crabbox actions hydrate",
+    "crabbox:run": "crabbox run",
+    "crabbox:stop": "crabbox stop",
+    "crabbox:warmup": "crabbox warmup",
+    "archive:wasm": "node scripts/build-archive-wasm.mjs",
+    "archive:producer-smoke": "node scripts/archive-producer-smoke.mjs"
+  },
+  "optionalDependencies": {
+    "@openclaw/fs-safe-darwin-arm64": "0.8.5",
+    "@openclaw/fs-safe-darwin-x64": "0.8.5",
+    "@openclaw/fs-safe-linux-arm64-gnu": "0.8.5",
+    "@openclaw/fs-safe-linux-arm64-musl": "0.8.5",
+    "@openclaw/fs-safe-linux-x64-gnu": "0.8.5",
+    "@openclaw/fs-safe-linux-x64-musl": "0.8.5",
+    "@openclaw/fs-safe-win32-x64-msvc": "0.8.5",
+    "jszip": "^3.10.1"
+  },
+  "devDependencies": {
+    "@emnapi/runtime": "2.0.0-alpha.4",
+    "@napi-rs/cli": "3.9.0",
+    "@types/node": "^26.4.1",
+    "@vitest/coverage-v8": "5.0.0",
+    "fast-check": "^4.9.0",
+    "istanbul-lib-coverage": "3.2.2",
+    "istanbul-lib-report": "3.0.1",
+    "istanbul-reports": "3.2.0",
+    "sigstore": "5.0.0",
+    "tar": "7.5.22",
+    "typescript": "^7.0.2",
+    "vite": "8.2.2",
+    "vitest": "^5.0.0"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "packageManager": "pnpm@11.25.0"
+}

package/node_modules/@openclaw/fs-safe-darwin-arm64/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@openclaw/fs-safe-darwin-arm64",
+  "version": "0.8.5",
+  "description": "macOS arm64 native binding for @openclaw/fs-safe.",
+  "license": "MIT",
+  "author": "OpenClaw Team <dev@openclaw.ai>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/openclaw/fs-safe.git",
+    "directory": "packages/darwin-arm64"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "os": [
+    "darwin"
+  ],
+  "cpu": [
+    "arm64"
+  ],
+  "main": "fs-safe-native.node",
+  "files": [
+    "fs-safe-native.node"
+  ],
+  "engines": {
+    "node": ">=22"
+  }
+}

package/node_modules/@openclaw/fs-safe-darwin-x64/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@openclaw/fs-safe-darwin-x64",
+  "version": "0.8.5",
+  "description": "macOS x64 native binding for @openclaw/fs-safe.",
+  "license": "MIT",
+  "author": "OpenClaw Team <dev@openclaw.ai>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/openclaw/fs-safe.git",
+    "directory": "packages/darwin-x64"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "os": [
+    "darwin"
+  ],
+  "cpu": [
+    "x64"
+  ],
+  "main": "fs-safe-native.node",
+  "files": [
+    "fs-safe-native.node"
+  ],
+  "engines": {
+    "node": ">=22"
+  }
+}

package/node_modules/@openclaw/fs-safe-linux-arm64-gnu/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@openclaw/fs-safe-linux-arm64-gnu",
+  "version": "0.8.5",
+  "description": "Linux arm64 glibc native binding for @openclaw/fs-safe.",
+  "license": "MIT",
+  "author": "OpenClaw Team <dev@openclaw.ai>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/openclaw/fs-safe.git",
+    "directory": "packages/linux-arm64-gnu"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "os": [
+    "linux"
+  ],
+  "cpu": [
+    "arm64"
+  ],
+  "libc": [
+    "glibc"
+  ],
+  "main": "fs-safe-native.node",
+  "files": [
+    "fs-safe-native.node"
+  ],
+  "engines": {
+    "node": ">=22"
+  }
+}

package/node_modules/@openclaw/fs-safe-linux-arm64-musl/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@openclaw/fs-safe-linux-arm64-musl",
+  "version": "0.8.5",
+  "description": "Linux arm64 musl native binding for @openclaw/fs-safe.",
+  "license": "MIT",
+  "author": "OpenClaw Team <dev@openclaw.ai>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/openclaw/fs-safe.git",
+    "directory": "packages/linux-arm64-musl"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "os": [
+    "linux"
+  ],
+  "cpu": [
+    "arm64"
+  ],
+  "libc": [
+    "musl"
+  ],
+  "main": "fs-safe-native.node",
+  "files": [
+    "fs-safe-native.node"
+  ],
+  "engines": {
+    "node": ">=22"
+  }
+}