@openclaw/openshell-sandbox 2026.9.2 → 2026.9.3

package/node_modules/@openclaw/fs-safe/dist/replace-file.js

@@ -0,0 +1,329 @@
+import { randomUUID } from "node:crypto";
+import syncFs, {} from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { assertDestinationHardlinkPolicy, assertDestinationHardlinkPolicySync, copyFallbackReplace, copyFallbackReplaceSync, } from "./replace-file-copy-fallback.js";
+import { applyDirectoryMode, applyDirectoryModeSync, syncDirectoryBestEffort, syncDirectoryBestEffortSync, writeTempFile, writeTempFileSync, } from "./replace-file-descriptor.js";
+import { atomicExpectedContentHash, validateRenameIdentity, withAtomicRenameIdentityLock, withAtomicRenameIdentityLockSync, } from "./replace-file-rename-policy.js";
+import { AsyncAtomicTempOwner, SyncAtomicTempOwner } from "./replace-file-temp-owner.js";
+import { assertSafePathPrefix } from "./safe-path-segment.js";
+import { sleep, sleepSync } from "./timing.js";
+import { serializePathWrite } from "./write-queue.js";
+function isRetryableRenameError(error) {
+    return error.code === "EBUSY";
+}
+function isPermissionRenameError(error) {
+    const code = error.code;
+    return code === "EPERM" || code === "EEXIST";
+}
+async function renameWithRetry(params) {
+    for (let attempt = 0; attempt <= params.maxRetries; attempt++) {
+        if (attempt > 0)
+            await params.assertSourceCurrent();
+        try {
+            await params.fsModule.rename(params.src, params.dest);
+            return { method: "rename" };
+        }
+        catch (error) {
+            if (isRetryableRenameError(error) && attempt < params.maxRetries) {
+                await sleep(params.baseDelayMs * 2 ** attempt);
+                continue;
+            }
+            if (params.copyFallbackOnPermissionError && isPermissionRenameError(error)) {
+                await copyFallbackReplace({
+                    fsModule: params.fsModule,
+                    src: params.src,
+                    dest: params.dest,
+                    destinationHardlinks: params.destinationHardlinks,
+                    restore: params.copyFallbackRestore,
+                    maxRestoreBytes: params.maxRestoreBytes,
+                    expectedSourceIdentity: params.sourceIdentity,
+                    sync: params.syncFallback,
+                });
+                return { method: "copy-fallback" };
+            }
+            throw error;
+        }
+    }
+    throw new Error("Atomic rename retry loop exhausted.");
+}
+function renameWithRetrySync(params) {
+    for (let attempt = 0; attempt <= params.maxRetries; attempt++) {
+        if (attempt > 0)
+            params.assertSourceCurrent();
+        try {
+            params.fsModule.renameSync(params.src, params.dest);
+            return { method: "rename" };
+        }
+        catch (error) {
+            if (isRetryableRenameError(error) && attempt < params.maxRetries) {
+                sleepSync(params.baseDelayMs * 2 ** attempt);
+                continue;
+            }
+            if (params.copyFallbackOnPermissionError && isPermissionRenameError(error)) {
+                copyFallbackReplaceSync({
+                    fsModule: params.fsModule,
+                    src: params.src,
+                    dest: params.dest,
+                    destinationHardlinks: params.destinationHardlinks,
+                    restore: params.copyFallbackRestore,
+                    maxRestoreBytes: params.maxRestoreBytes,
+                    expectedSourceIdentity: params.sourceIdentity,
+                    fchmodSync: params.fchmodSync,
+                    sync: params.syncFallback,
+                });
+                return { method: "copy-fallback" };
+            }
+            throw error;
+        }
+    }
+    throw new Error("Atomic rename retry loop exhausted.");
+}
+function validateReplaceFilePath(filePath) {
+    if (!filePath || filePath.includes("\0")) {
+        throw new Error("Atomic replace file path must be non-empty.");
+    }
+}
+function validateRestoreOptions(options) {
+    if (options.copyFallbackRestore !== "restore-original")
+        return;
+    if (options.maxRestoreBytes === undefined) {
+        throw new RangeError("maxRestoreBytes is required when copyFallbackRestore is restore-original");
+    }
+    if (!Number.isSafeInteger(options.maxRestoreBytes) || options.maxRestoreBytes < 0) {
+        throw new RangeError("maxRestoreBytes must be a non-negative safe integer");
+    }
+}
+function buildReplaceTempPath(filePath, tempPrefix) {
+    const dir = path.dirname(filePath);
+    const safePrefix = assertSafePathPrefix(tempPrefix ?? ".fs-safe-replace", { label: "atomic replace temp prefix" });
+    return path.join(dir, `${safePrefix}.${process.pid}.${randomUUID()}.tmp`);
+}
+async function resolveMode(options) {
+    const defaultMode = options.mode ?? 0o600;
+    if (!options.preserveExistingMode) {
+        return defaultMode;
+    }
+    const stat = await (options.fileSystem?.promises ?? fs).stat(options.filePath).catch((error) => {
+        if (error.code === "ENOENT") {
+            return null;
+        }
+        throw error;
+    });
+    return stat ? stat.mode : defaultMode;
+}
+function resolveModeSync(options) {
+    const defaultMode = options.mode ?? 0o600;
+    if (!options.preserveExistingMode) {
+        return defaultMode;
+    }
+    const fsModule = options.fileSystem ?? syncFs;
+    let stat;
+    try {
+        stat = fsModule.statSync(options.filePath);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            throw error;
+        }
+    }
+    return stat ? stat.mode : defaultMode;
+}
+function missingFchmodSyncError() {
+    return new TypeError("fileSystem.fchmodSync is required when mode, dirMode, or preserveExistingMode is specified");
+}
+export async function replaceFileAtomic(options) {
+    return await replaceFileAtomicWithDirectorySync(options);
+}
+// Internal owner hook: keep directory durability inside publication verification and serialization.
+export async function replaceFileAtomicWithDirectorySync(options, syncParent) {
+    const filePath = options.filePath;
+    validateReplaceFilePath(filePath);
+    validateRestoreOptions(options);
+    validateRenameIdentity(options.renameIdentity);
+    return await serializePathWrite(path.resolve(filePath), async () => {
+        if (options.renameIdentity !== "verify-content-with-lock") {
+            return await replaceFileAtomicUnserialized(options, syncParent);
+        }
+        await (options.fileSystem?.promises ?? fs).mkdir(path.dirname(filePath), {
+            recursive: true,
+            mode: options.dirMode ?? 0o700,
+        });
+        return await withAtomicRenameIdentityLock(filePath, async () => await replaceFileAtomicUnserialized(options, syncParent));
+    });
+}
+async function replaceFileAtomicUnserialized(options, syncParent) {
+    const filePath = options.filePath;
+    const fsModule = options.fileSystem?.promises ?? fs;
+    const dir = path.dirname(filePath);
+    const dirMode = options.dirMode ?? 0o700;
+    const mode = await resolveMode(options);
+    const expectedHash = atomicExpectedContentHash(options.renameIdentity, options.content);
+    const tempPath = buildReplaceTempPath(filePath, options.tempPrefix);
+    const tempOwner = new AsyncAtomicTempOwner(tempPath);
+    let originalError;
+    try {
+        await fsModule.mkdir(dir, { recursive: true, mode: dirMode });
+        await applyDirectoryMode({ fsModule, dirPath: dir, mode: dirMode });
+        tempOwner.start();
+        tempOwner.adopt(await writeTempFile({
+            fsModule,
+            tempPath,
+            content: options.content,
+            mode,
+            sync: options.syncTempFile === true,
+            onIdentity: tempOwner.onIdentity,
+        }));
+        await tempOwner.assertCurrent(fsModule);
+        if (options.beforeRename) {
+            await options.beforeRename({ filePath, tempPath });
+            await tempOwner.assertCurrent(fsModule);
+        }
+        if (options.destinationHardlinks === "reject") {
+            await assertDestinationHardlinkPolicy(fsModule, filePath, options.destinationHardlinks);
+            await tempOwner.assertCurrent(fsModule);
+        }
+        const result = await renameWithRetry({
+            fsModule,
+            src: tempPath,
+            dest: filePath,
+            maxRetries: options.renameMaxRetries ?? 0,
+            baseDelayMs: options.renameRetryBaseDelayMs ?? 50,
+            copyFallbackOnPermissionError: options.copyFallbackOnPermissionError === true,
+            copyFallbackRestore: options.copyFallbackRestore ?? "none",
+            maxRestoreBytes: options.maxRestoreBytes,
+            destinationHardlinks: options.destinationHardlinks,
+            sourceIdentity: tempOwner.identity,
+            assertSourceCurrent: () => tempOwner.assertCurrent(fsModule),
+            syncFallback: options.syncTempFile === true,
+        });
+        if (result.method === "rename") {
+            tempOwner.markRenamed();
+            await tempOwner.assertPublished(fsModule, filePath, expectedHash);
+        }
+        else {
+            await tempOwner.assertCurrent(fsModule);
+        }
+        let didSyncParent = false;
+        if (syncParent) {
+            await syncParent(dir);
+            didSyncParent = true;
+        }
+        else if (options.syncParentDir) {
+            await syncDirectoryBestEffort(fsModule, dir);
+            didSyncParent = true;
+        }
+        if (result.method === "rename" && didSyncParent) {
+            await tempOwner.assertPublished(fsModule, filePath, expectedHash);
+        }
+        return result;
+    }
+    catch (error) {
+        originalError = error;
+        throw error;
+    }
+    finally {
+        await tempOwner.finish({
+            fsModule,
+            originalError,
+            throwOnCleanupError: options.throwOnCleanupError === true,
+        });
+    }
+}
+export function replaceFileAtomicSync(options) {
+    const filePath = options.filePath;
+    validateReplaceFilePath(filePath);
+    validateRestoreOptions(options);
+    validateRenameIdentity(options.renameIdentity);
+    if (options.renameIdentity !== "verify-content-with-lock") {
+        return replaceFileAtomicSyncUnserialized(options);
+    }
+    (options.fileSystem ?? syncFs).mkdirSync(path.dirname(filePath), {
+        recursive: true,
+        mode: options.dirMode ?? 0o700,
+    });
+    return withAtomicRenameIdentityLockSync(filePath, () => replaceFileAtomicSyncUnserialized(options));
+}
+function replaceFileAtomicSyncUnserialized(options) {
+    const filePath = options.filePath;
+    const fsModule = options.fileSystem ?? syncFs;
+    const dir = path.dirname(filePath);
+    const dirMode = options.dirMode ?? 0o700;
+    const mode = resolveModeSync(options);
+    const expectedHash = atomicExpectedContentHash(options.renameIdentity, options.content);
+    const fchmodSync = options.fileSystem?.fchmodSync ?? (options.fileSystem === undefined ? syncFs.fchmodSync : undefined);
+    if (!fchmodSync &&
+        (options.mode !== undefined ||
+            options.preserveExistingMode === true ||
+            (process.platform !== "win32" && options.dirMode !== undefined))) {
+        throw missingFchmodSyncError();
+    }
+    const tempPath = buildReplaceTempPath(filePath, options.tempPrefix);
+    const tempOwner = new SyncAtomicTempOwner(tempPath);
+    let originalError;
+    try {
+        fsModule.mkdirSync(dir, { recursive: true, mode: dirMode });
+        applyDirectoryModeSync({ fsModule, dirPath: dir, mode: dirMode, fchmodSync });
+        tempOwner.start();
+        tempOwner.adopt(writeTempFileSync({
+            fsModule,
+            tempPath,
+            content: options.content,
+            mode,
+            fchmodSync,
+            sync: options.syncTempFile === true,
+            onIdentity: tempOwner.onIdentity,
+        }));
+        tempOwner.assertCurrent(fsModule);
+        if (options.beforeRename) {
+            options.beforeRename({ filePath, tempPath });
+            tempOwner.assertCurrent(fsModule);
+        }
+        if (options.destinationHardlinks === "reject") {
+            assertDestinationHardlinkPolicySync(fsModule, filePath, options.destinationHardlinks);
+            tempOwner.assertCurrent(fsModule);
+        }
+        const result = renameWithRetrySync({
+            fsModule,
+            src: tempPath,
+            dest: filePath,
+            maxRetries: options.renameMaxRetries ?? 0,
+            baseDelayMs: options.renameRetryBaseDelayMs ?? 50,
+            copyFallbackOnPermissionError: options.copyFallbackOnPermissionError === true,
+            copyFallbackRestore: options.copyFallbackRestore ?? "none",
+            maxRestoreBytes: options.maxRestoreBytes,
+            destinationHardlinks: options.destinationHardlinks,
+            sourceIdentity: tempOwner.identity,
+            assertSourceCurrent: () => tempOwner.assertCurrent(fsModule),
+            fchmodSync,
+            syncFallback: options.syncTempFile === true,
+        });
+        if (result.method === "rename") {
+            tempOwner.markRenamed();
+            tempOwner.assertPublished(fsModule, filePath, expectedHash);
+        }
+        else {
+            tempOwner.assertCurrent(fsModule);
+        }
+        let didSyncParent = false;
+        if (options.syncParentDir) {
+            syncDirectoryBestEffortSync(fsModule, dir);
+            didSyncParent = true;
+        }
+        if (result.method === "rename" && didSyncParent) {
+            tempOwner.assertPublished(fsModule, filePath, expectedHash);
+        }
+        return result;
+    }
+    catch (error) {
+        originalError = error;
+        throw error;
+    }
+    finally {
+        tempOwner.finish({
+            fsModule,
+            originalError,
+            throwOnCleanupError: options.throwOnCleanupError === true,
+        });
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/root-context.d.ts

@@ -0,0 +1,38 @@
+export type RootContext = {
+    rootDir: string;
+    rootIdentity: {
+        dev: number;
+        ino: number;
+    } | {
+        dev: bigint;
+        ino: bigint;
+    };
+    rootReal: string;
+    rootWithSep: string;
+};
+export declare const ensureTrailingSep: (value: string) => string;
+export declare function assertValidRootRelativePath(relativePath: string): void;
+export declare function assertValidRootDestinationPath(relativePath: string): void;
+export declare function expandRelativePathWithHome(relativePath: string): Promise<string>;
+export declare function resolveRootContext(rootDir: string): Promise<RootContext>;
+export declare function rootRelativeReadPath(root: RootContext, filePath: string): string;
+export declare function assertRootIdentityCurrent(root: RootContext): Promise<void>;
+export declare function resolvePathInRoot(root: RootContext, relativePath: string, options?: {
+    aliasErrorCode?: "outside-workspace" | "path-alias";
+    allowFinalSymlink?: boolean;
+    rejectUnsafeDeviceReads?: boolean;
+    rejectSymlinks?: boolean;
+}): Promise<{
+    rootReal: string;
+    rootWithSep: string;
+    resolved: string;
+}>;
+export declare function resolvePathWithinRoot(params: {
+    rootDir: string;
+    relativePath: string;
+}): Promise<{
+    rootReal: string;
+    rootWithSep: string;
+    resolved: string;
+}>;
+//# sourceMappingURL=root-context.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-context.d.ts","sourceRoot":"","sources":["../src/root-context.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,eAAO,MAAM,iBAAiB,UAAW,MAAM,WACM,CAAC;AAEtD,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAEtE;AAED,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAKzE;AAID,wBAAsB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYtF;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA0B9E;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAehF;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhF;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,WAAW,EACjB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;IACR,cAAc,CAAC,EAAE,mBAAmB,GAAG,YAAY,CAAC;IACpD,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GACA,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA0CtE;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAEvE"}

package/node_modules/@openclaw/fs-safe/dist/root-context.js

@@ -0,0 +1,141 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { inspectDirectoryIdentity } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { sameFileIdentity } from "./file-identity.js";
+import { expandHomePrefix } from "./home-dir.js";
+import { assertNoNulPathInput, assertNoUnsafeDeviceReadPath, hasNodeErrorCode, isNotFoundPathError, isPathInside, } from "./path.js";
+import { ROOT_PATH_ALIAS_POLICIES, resolveRootPath } from "./root-path.js";
+import { outsideWorkspaceError } from "./root-errors.js";
+import { isDriveRelativePath } from "./safe-path-segment.js";
+export const ensureTrailingSep = (value) => value.endsWith(path.sep) ? value : value + path.sep;
+export function assertValidRootRelativePath(relativePath) {
+    assertNoNulPathInput(relativePath, "relative path contains a NUL byte");
+}
+export function assertValidRootDestinationPath(relativePath) {
+    assertValidRootRelativePath(relativePath);
+    if (isDriveRelativePath(relativePath)) {
+        throw new FsSafeError("invalid-path", "relative path must not start with a drive letter");
+    }
+}
+let cachedHomePath;
+export async function expandRelativePathWithHome(relativePath) {
+    const rawHome = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    if (cachedHomePath?.raw !== rawHome) {
+        let realHome = rawHome;
+        try {
+            realHome = fs.realpathSync.native(rawHome);
+        }
+        catch {
+            // If the home dir cannot be canonicalized, keep lexical expansion behavior.
+        }
+        cachedHomePath = { raw: rawHome, real: realHome };
+    }
+    return expandHomePrefix(relativePath, { home: cachedHomePath.real });
+}
+export async function resolveRootContext(rootDir) {
+    assertNoNulPathInput(rootDir, "root dir contains a NUL byte");
+    let rootReal;
+    let rootIdentity;
+    try {
+        rootReal = fs.realpathSync.native(rootDir);
+        const rootStat = fs.statSync(rootReal);
+        if (!rootStat.isDirectory()) {
+            throw new FsSafeError("invalid-path", "root dir is not a directory");
+        }
+        rootIdentity = { dev: rootStat.dev, ino: rootStat.ino };
+    }
+    catch (err) {
+        if (err instanceof FsSafeError) {
+            throw err;
+        }
+        if (isNotFoundPathError(err)) {
+            throw new FsSafeError("not-found", "root dir not found");
+        }
+        throw err;
+    }
+    return {
+        rootDir: path.resolve(rootDir),
+        rootIdentity,
+        rootReal,
+        rootWithSep: ensureTrailingSep(rootReal),
+    };
+}
+export function rootRelativeReadPath(root, filePath) {
+    const absoluteInput = path.isAbsolute(filePath);
+    const candidatePath = absoluteInput
+        ? path.resolve(filePath)
+        : path.resolve(root.rootDir, filePath);
+    let relativeBase = root.rootDir;
+    if (absoluteInput &&
+        !isPathInside(root.rootDir, candidatePath) &&
+        isPathInside(root.rootReal, candidatePath)) {
+        // A Root created through an alias has two valid in-root absolute spellings.
+        relativeBase = root.rootReal;
+    }
+    return path.relative(relativeBase, candidatePath);
+}
+export async function assertRootIdentityCurrent(root) {
+    let current;
+    try {
+        if (typeof root.rootIdentity.dev === "bigint" && typeof root.rootIdentity.ino === "bigint") {
+            await inspectDirectoryIdentity(root.rootReal, { dev: root.rootIdentity.dev, ino: root.rootIdentity.ino });
+            return;
+        }
+        current = fs.lstatSync(root.rootReal);
+    }
+    catch (error) {
+        throw new FsSafeError("path-mismatch", "root path changed during operation", {
+            cause: error instanceof Error ? error : undefined,
+        });
+    }
+    if (current.isSymbolicLink() ||
+        !current.isDirectory() ||
+        !sameFileIdentity(current, root.rootIdentity)) {
+        throw new FsSafeError("path-mismatch", "root path changed during operation");
+    }
+}
+export async function resolvePathInRoot(root, relativePath, options) {
+    assertValidRootRelativePath(relativePath);
+    await assertRootIdentityCurrent(root);
+    const expanded = await expandRelativePathWithHome(relativePath);
+    const resolved = path.resolve(root.rootWithSep, expanded);
+    if (!isPathInside(root.rootWithSep, resolved)) {
+        throw outsideWorkspaceError();
+    }
+    if (options?.rejectUnsafeDeviceReads === true) {
+        assertNoUnsafeDeviceReadPath(resolved);
+    }
+    const rawAbsolutePath = path.isAbsolute(expanded)
+        ? expanded
+        : `${root.rootWithSep}${expanded}`;
+    try {
+        await resolveRootPath({
+            absolutePath: rawAbsolutePath,
+            rootPath: root.rootReal,
+            rootCanonicalPath: root.rootReal,
+            boundaryLabel: "root",
+            policy: options?.allowFinalSymlink ? ROOT_PATH_ALIAS_POLICIES.unlinkTarget : undefined,
+            rejectSymlinks: options?.rejectSymlinks,
+        });
+    }
+    catch (error) {
+        if (error instanceof FsSafeError && error.code === "symlink") {
+            throw error;
+        }
+        if (hasNodeErrorCode(error, "ENAMETOOLONG")) {
+            throw new FsSafeError("invalid-path", "relative path is too long", {
+                cause: error instanceof Error ? error : undefined,
+            });
+        }
+        const code = options?.aliasErrorCode ?? "outside-workspace";
+        throw new FsSafeError(code, code === "path-alias" ? "path alias escape blocked" : "file is outside workspace root", {
+            cause: error instanceof Error ? error : undefined,
+        });
+    }
+    return { rootReal: root.rootReal, rootWithSep: root.rootWithSep, resolved };
+}
+export async function resolvePathWithinRoot(params) {
+    return await resolvePathInRoot(await resolveRootContext(params.rootDir), params.relativePath);
+}

package/node_modules/@openclaw/fs-safe/dist/root-errors.d.ts

@@ -0,0 +1,12 @@
+import { FsSafeError } from "./errors.js";
+export declare function fileNotFoundError(cause?: unknown): FsSafeError;
+export declare function outsideWorkspaceError(): FsSafeError;
+export declare function directoryComponentNotDirectoryError(cause?: unknown): FsSafeError;
+export declare function hardlinkedPathNotAllowedError(): FsSafeError;
+export declare function isAlreadyExistsError(error: unknown): boolean;
+export declare function normalizePinnedWriteError(error: unknown): Error;
+export declare function normalizePinnedPathError(error: unknown): Error;
+export declare function normalizeRemoveGuardError(error: unknown): Error;
+export declare function normalizeRemovePathError(error: unknown): Error;
+export declare function throwFsSafeReadError(error: unknown, label: string): never;
+//# sourceMappingURL=root-errors.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-errors.d.ts","sourceRoot":"","sources":["../src/root-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK1C,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,WAAW,CAI9D;AAED,wBAAgB,qBAAqB,IAAI,WAAW,CAEnD;AAED,wBAAgB,mCAAmC,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,WAAW,CAIhF;AAED,wBAAgB,6BAA6B,IAAI,WAAW,CAE3D;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE5D;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAU/D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAO9D;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAQ/D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAe9D;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAQzE"}

package/node_modules/@openclaw/fs-safe/dist/root-errors.js

@@ -0,0 +1,75 @@
+import { FsSafeError } from "./errors.js";
+import { hasNodeErrorCode, isNodeError, isNotFoundPathError } from "./path.js";
+const REMOVE_NOT_EMPTY_CODES = new Set(["ENOTEMPTY", "EEXIST"]);
+export function fileNotFoundError(cause) {
+    return cause === undefined
+        ? new FsSafeError("not-found", "file not found")
+        : new FsSafeError("not-found", "file not found", { cause });
+}
+export function outsideWorkspaceError() {
+    return new FsSafeError("outside-workspace", "file is outside workspace root");
+}
+export function directoryComponentNotDirectoryError(cause) {
+    return cause === undefined
+        ? new FsSafeError("not-file", "directory component must be a directory")
+        : new FsSafeError("not-file", "directory component must be a directory", { cause });
+}
+export function hardlinkedPathNotAllowedError() {
+    return new FsSafeError("hardlink", "hardlinked path not allowed");
+}
+export function isAlreadyExistsError(error) {
+    return hasNodeErrorCode(error, "EEXIST") || /File exists|EEXIST/i.test(String(error));
+}
+export function normalizePinnedWriteError(error) {
+    if (error instanceof FsSafeError) {
+        return error;
+    }
+    if (isNotFoundPathError(error)) {
+        return fileNotFoundError(error instanceof Error ? error : undefined);
+    }
+    return new FsSafeError("invalid-path", "path is not a regular file under root", {
+        cause: error instanceof Error ? error : undefined,
+    });
+}
+export function normalizePinnedPathError(error) {
+    if (error instanceof FsSafeError) {
+        return error;
+    }
+    return new FsSafeError("path-alias", "path is not under root", {
+        cause: error instanceof Error ? error : undefined,
+    });
+}
+export function normalizeRemoveGuardError(error) {
+    if (error instanceof FsSafeError) {
+        return error;
+    }
+    if (isNotFoundPathError(error)) {
+        return fileNotFoundError(error instanceof Error ? error : undefined);
+    }
+    return normalizePinnedPathError(error);
+}
+export function normalizeRemovePathError(error) {
+    if (error instanceof FsSafeError) {
+        return error;
+    }
+    if (!isNodeError(error) || typeof error.code !== "string") {
+        return normalizePinnedPathError(error);
+    }
+    const cause = error instanceof Error ? error : undefined;
+    if (isNotFoundPathError(error)) {
+        return fileNotFoundError(cause);
+    }
+    if (REMOVE_NOT_EMPTY_CODES.has(error.code)) {
+        return new FsSafeError("not-empty", "directory is not empty", { cause });
+    }
+    return new FsSafeError("not-removable", "path could not be removed", { cause });
+}
+export function throwFsSafeReadError(error, label) {
+    if (error instanceof FsSafeError) {
+        throw error;
+    }
+    if (isNodeError(error)) {
+        throw new FsSafeError("read-failed", `${label} target could not be read`, { cause: error });
+    }
+    throw error;
+}

package/node_modules/@openclaw/fs-safe/dist/root-file.d.ts

@@ -0,0 +1,45 @@
+import fs from "node:fs";
+import type { PathAliasPolicy } from "./path-policy.js";
+import { type PinnedOpenSyncAllowedType, type PinnedOpenSyncFailureReason } from "./pinned-open.js";
+type BoundaryReadFs = Pick<typeof fs, "closeSync" | "constants" | "fstatSync" | "lstatSync" | "openSync" | "readFileSync" | "realpathSync">;
+export type RootFileOpenFailureReason = PinnedOpenSyncFailureReason | "validation";
+export type RootFileOpenResult = {
+    ok: true;
+    path: string;
+    fd: number;
+    stat: fs.Stats;
+    rootRealPath: string;
+} | {
+    ok: false;
+    reason: RootFileOpenFailureReason;
+    error?: unknown;
+};
+export type RootFileOpenFailure = Extract<RootFileOpenResult, {
+    ok: false;
+}>;
+export type OpenRootFileSyncParams = {
+    absolutePath: string;
+    rootPath: string;
+    boundaryLabel: string;
+    rootRealPath?: string;
+    maxBytes?: number;
+    rejectHardlinks?: boolean;
+    rejectSymlinks?: boolean;
+    allowedType?: PinnedOpenSyncAllowedType;
+    skipLexicalRootCheck?: boolean;
+    ioFs?: BoundaryReadFs;
+};
+export type OpenRootFileParams = OpenRootFileSyncParams & {
+    aliasPolicy?: PathAliasPolicy;
+};
+export declare function canUseRootFileOpen(ioFs: typeof fs): boolean;
+export declare function openRootFileSync(params: OpenRootFileSyncParams): RootFileOpenResult;
+export declare function matchRootFileOpenFailure<T>(failure: RootFileOpenFailure, handlers: {
+    path?: (failure: RootFileOpenFailure) => T;
+    validation?: (failure: RootFileOpenFailure) => T;
+    io?: (failure: RootFileOpenFailure) => T;
+    fallback: (failure: RootFileOpenFailure) => T;
+}): T;
+export declare function openRootFile(params: OpenRootFileParams): Promise<RootFileOpenResult>;
+export {};
+//# sourceMappingURL=root-file.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-file.d.ts","sourceRoot":"","sources":["../src/root-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAOzB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EACjC,MAAM,kBAAkB,CAAC;AAE1B,KAAK,cAAc,GAAG,IAAI,CACxB,OAAO,EAAE,EACP,WAAW,GACX,WAAW,GACX,WAAW,GACX,WAAW,GACX,UAAU,GACV,cAAc,GACd,cAAc,CACjB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,2BAA2B,GAAG,YAAY,CAAC;AAEnF,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,yBAAyB,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,EAAE;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAE7E,MAAM,MAAM,sBAAsB,GAAG;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,yBAAyB,CAAC;IACxC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,sBAAsB,GAAG;IACxD,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B,CAAC;AAQF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAW3D;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,kBAAkB,CAuBnF;AAED,wBAAgB,wBAAwB,CAAC,CAAC,EACxC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE;IACR,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,CAAC,CAAC;IAC3C,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,CAAC,CAAC;IACjD,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,CAAC,CAAC;IACzC,QAAQ,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,CAAC,CAAC;CAC/C,GACA,CAAC,CAUH;AAoDD,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,kBAAkB,CAAC,CAwB7B"}