@openclaw/openshell-sandbox 2026.9.2 → 2026.9.4

package/node_modules/@openclaw/fs-safe/dist/device-path.js

@@ -0,0 +1,137 @@
+import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { isFileUrl, trySafeFileURLToPath } from "./local-file-access.js";
+const POSIX_BLOCKED_DEVICE_PATHS = new Set([
+    "/dev/zero",
+    "/dev/random",
+    "/dev/urandom",
+    "/dev/full",
+    "/dev/stdin",
+    "/dev/stdout",
+    "/dev/stderr",
+    "/dev/tty",
+    "/dev/console",
+]);
+export const WINDOWS_RESERVED_DEVICE_NAMES = new Set([
+    "CON",
+    "PRN",
+    "AUX",
+    "NUL",
+    "CLOCK$",
+    "CONIN$",
+    "CONOUT$",
+    "COM1",
+    "COM2",
+    "COM3",
+    "COM4",
+    "COM5",
+    "COM6",
+    "COM7",
+    "COM8",
+    "COM9",
+    "COM¹",
+    "COM²",
+    "COM³",
+    "LPT1",
+    "LPT2",
+    "LPT3",
+    "LPT4",
+    "LPT5",
+    "LPT6",
+    "LPT7",
+    "LPT8",
+    "LPT9",
+    "LPT¹",
+    "LPT²",
+    "LPT³",
+]);
+const WINDOWS_SEPARATOR_CHAR_CODE = 0x5c;
+const WINDOWS_IGNORED_SPACE_CHAR_CODE = 0x20;
+const WINDOWS_IGNORED_DOT_CHAR_CODE = 0x2e;
+function trimTrailingWindowsSeparators(value) {
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === WINDOWS_SEPARATOR_CHAR_CODE) {
+        end -= 1;
+    }
+    return end === value.length ? value : value.slice(0, end);
+}
+function trimTrailingWindowsIgnoredChars(value) {
+    let end = value.length;
+    while (end > 0) {
+        const charCode = value.charCodeAt(end - 1);
+        if (charCode !== WINDOWS_IGNORED_SPACE_CHAR_CODE &&
+            charCode !== WINDOWS_IGNORED_DOT_CHAR_CODE) {
+            break;
+        }
+        end -= 1;
+    }
+    return end === value.length ? value : value.slice(0, end);
+}
+function candidateReadPaths(filePath, platform) {
+    if (!isFileUrl(filePath)) {
+        return [filePath];
+    }
+    const parsed = trySafeFileURLToPath(filePath, platform);
+    return parsed === undefined ? [filePath] : [filePath, parsed];
+}
+function normalizePosixPath(filePath, cwd) {
+    if (path.posix.isAbsolute(filePath)) {
+        return path.posix.normalize(filePath);
+    }
+    const base = cwd && path.posix.isAbsolute(cwd) ? cwd : process.cwd();
+    return path.posix.resolve(base, filePath);
+}
+function matchPosixDeviceReadPath(filePath, cwd) {
+    const normalized = normalizePosixPath(filePath, cwd);
+    if (POSIX_BLOCKED_DEVICE_PATHS.has(normalized)) {
+        return { path: normalized, reason: "posix-device" };
+    }
+    if (normalized === "/dev/fd" || normalized.startsWith("/dev/fd/")) {
+        return { path: normalized, reason: "posix-fd" };
+    }
+    if (/^\/proc\/(?:self|thread-self|\d+)\/fd(?:\/|$)/.test(normalized)) {
+        return { path: normalized, reason: "posix-fd" };
+    }
+    return undefined;
+}
+function normalizeWindowsDeviceBaseName(filePath) {
+    const normalized = trimTrailingWindowsSeparators(filePath.replace(/\//g, "\\"));
+    const lastSegment = normalized.split("\\").filter(Boolean).at(-1) ?? normalized;
+    const withoutStream = lastSegment.split(":")[0] ?? lastSegment;
+    const stem = withoutStream.split(".")[0] ?? withoutStream;
+    return trimTrailingWindowsIgnoredChars(stem).toUpperCase();
+}
+export function isWindowsReservedDeviceName(name) {
+    return name.length > 0 && WINDOWS_RESERVED_DEVICE_NAMES.has(normalizeWindowsDeviceBaseName(name));
+}
+function matchWindowsDeviceReadPath(filePath) {
+    const normalized = filePath.replace(/\//g, "\\");
+    if (/^\\\\\.\\/.test(normalized) || /^\\\\\?\\GLOBALROOT\\Device\\/i.test(normalized)) {
+        return { path: normalized, reason: "windows-device" };
+    }
+    const baseName = normalizeWindowsDeviceBaseName(filePath);
+    if (WINDOWS_RESERVED_DEVICE_NAMES.has(baseName)) {
+        return { path: normalized, reason: "windows-device" };
+    }
+    return undefined;
+}
+export function matchUnsafeDeviceReadPath(filePath, options = {}) {
+    const platform = options.platform ?? process.platform;
+    for (const candidate of candidateReadPaths(filePath, platform)) {
+        const match = platform === "win32"
+            ? matchWindowsDeviceReadPath(candidate)
+            : matchPosixDeviceReadPath(candidate, options.cwd);
+        if (match) {
+            return match;
+        }
+    }
+    return undefined;
+}
+export function isUnsafeDeviceReadPath(filePath, options) {
+    return matchUnsafeDeviceReadPath(filePath, options) !== undefined;
+}
+export function assertNoUnsafeDeviceReadPath(filePath, options) {
+    if (matchUnsafeDeviceReadPath(filePath, options)) {
+        throw new FsSafeError("device-path", `file reads from unsafe device paths are not allowed: ${filePath}`);
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/directory-durability.d.ts

@@ -0,0 +1,44 @@
+import { type Stats } from "node:fs";
+import { type FileIdentityStat } from "./file-identity.js";
+export type DirectorySyncOutcome = {
+    status: "synced";
+} | {
+    status: "unsupported";
+    code?: string;
+};
+export type DirectoryReceipt = {
+    path: string;
+    realPath: string;
+    identity: Stats;
+};
+export type DurableDirectoryReceipt = DirectoryReceipt & {
+    parentSync: DirectorySyncOutcome | {
+        status: "not-needed";
+    };
+};
+export type PinnedDirectory = {
+    readonly receipt: DirectoryReceipt;
+    assertCurrent(): Promise<void>;
+    sync(): Promise<DirectorySyncOutcome>;
+    close(): Promise<void>;
+};
+export type EnsureDurableDirectoryOptions = {
+    directoryPath: string;
+    label?: string;
+    mode?: number;
+    expectedExistingIdentity?: FileIdentityStat;
+    create?: (directoryPath: string) => Promise<void>;
+};
+export declare function pinDirectory(directory: string | DirectoryReceipt, options?: {
+    label?: string;
+}): Promise<PinnedDirectory>;
+export declare function syncDirectory(directory: string | DirectoryReceipt, options?: {
+    label?: string;
+}): Promise<DirectorySyncOutcome>;
+export declare function syncDirectorySync(directory: string | DirectoryReceipt, options?: {
+    label?: string;
+}): DirectorySyncOutcome;
+export declare function syncDirectoryBestEffort(directoryPath: string): Promise<void>;
+export declare function syncDirectoryBestEffortSync(directoryPath: string): void;
+export declare function ensureDurableDirectory(options: EnsureDurableDirectoryOptions): Promise<DurableDirectoryReceipt>;
+//# sourceMappingURL=directory-durability.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/directory-durability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-durability.d.ts","sourceRoot":"","sources":["../src/directory-durability.ts"],"names":[],"mappings":"AAAA,OAAe,EAAE,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAM7C,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,KAAK,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,GAAG;IACvD,UAAU,EAAE,oBAAoB,GAAG;QAAE,MAAM,EAAE,YAAY,CAAA;KAAE,CAAC;CAC7D,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACtC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wBAAwB,CAAC,EAAE,gBAAgB,CAAC;IAC5C,MAAM,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD,CAAC;AAgKF,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,GAAG,gBAAgB,EACpC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,OAAO,CAAC,eAAe,CAAC,CAa1B;AAED,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,GAAG,gBAAgB,EACpC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAmB/B;AAED,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,GAAG,gBAAgB,EACpC,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,oBAAoB,CAuCtB;AAED,wBAAsB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF;AAED,wBAAgB,2BAA2B,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAMvE;AAuBD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,uBAAuB,CAAC,CA8ElC"}

package/node_modules/@openclaw/fs-safe/dist/directory-durability.js

@@ -0,0 +1,299 @@
+import fsSync, {} from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { ensureAbsoluteDirectory } from "./absolute-path.js";
+import { FsSafeError } from "./errors.js";
+import { sameFileIdentity } from "./file-identity.js";
+function directoryOpenFlags() {
+    if (process.platform === "win32") {
+        return "r";
+    }
+    return (fsSync.constants.O_RDONLY |
+        fsSync.constants.O_DIRECTORY |
+        fsSync.constants.O_NOFOLLOW |
+        fsSync.constants.O_NONBLOCK);
+}
+function isWindowsDirectorySyncUnsupported(error) {
+    if (process.platform !== "win32") {
+        return false;
+    }
+    const code = error.code;
+    return (code === "EACCES" ||
+        code === "EINVAL" ||
+        code === "EISDIR" ||
+        code === "ENOSYS" ||
+        code === "ENOTSUP" ||
+        code === "EPERM");
+}
+function isWindowsDirectoryOpenUnsupported(error) {
+    if (process.platform !== "win32") {
+        return false;
+    }
+    const code = error.code;
+    return code === "EINVAL" || code === "EISDIR" || code === "ENOSYS" || code === "ENOTSUP";
+}
+function unsupportedOutcome(error) {
+    const code = error.code;
+    return code ? { status: "unsupported", code } : { status: "unsupported" };
+}
+function assertDirectory(identity, pathname, label) {
+    if (identity.isSymbolicLink() || !identity.isDirectory()) {
+        throw new FsSafeError("not-file", `${label} must be a real directory: ${pathname}`);
+    }
+}
+async function createDirectoryReceipt(directoryPath, label) {
+    const resolvedPath = path.resolve(directoryPath);
+    const identity = fsSync.lstatSync(resolvedPath);
+    assertDirectory(identity, resolvedPath, label);
+    return {
+        path: resolvedPath,
+        realPath: fsSync.realpathSync.native(resolvedPath),
+        identity,
+    };
+}
+function createDirectoryReceiptSync(directoryPath, label) {
+    const resolvedPath = path.resolve(directoryPath);
+    const identity = fsSync.lstatSync(resolvedPath);
+    assertDirectory(identity, resolvedPath, label);
+    return {
+        path: resolvedPath,
+        realPath: fsSync.realpathSync(resolvedPath),
+        identity,
+    };
+}
+async function assertDirectoryReceiptCurrent(receipt, label) {
+    const currentIdentity = fsSync.lstatSync(receipt.path);
+    assertDirectory(currentIdentity, receipt.path, label);
+    if (!sameFileIdentity(receipt.identity, currentIdentity) ||
+        (fsSync.realpathSync.native(receipt.path)) !== receipt.realPath) {
+        throw new FsSafeError("path-mismatch", `${label} changed during durable directory operation: ${receipt.path}`);
+    }
+}
+function assertDirectoryReceiptCurrentSync(receipt, label) {
+    const currentIdentity = fsSync.lstatSync(receipt.path);
+    assertDirectory(currentIdentity, receipt.path, label);
+    if (!sameFileIdentity(receipt.identity, currentIdentity) ||
+        fsSync.realpathSync(receipt.path) !== receipt.realPath) {
+        throw new FsSafeError("path-mismatch", `${label} changed during durable directory operation: ${receipt.path}`);
+    }
+}
+async function assertOpenDirectoryCurrent(handle, receipt, label) {
+    const openedIdentity = fsSync.fstatSync(handle.fd);
+    assertDirectory(openedIdentity, receipt.path, label);
+    if (!sameFileIdentity(receipt.identity, openedIdentity)) {
+        throw new FsSafeError("path-mismatch", `${label} handle changed during directory sync: ${receipt.path}`);
+    }
+    await assertDirectoryReceiptCurrent(receipt, label);
+}
+class PinnedDirectoryImpl {
+    receipt;
+    #handle;
+    #label;
+    #closed = false;
+    constructor(handle, receipt, label) {
+        this.#handle = handle;
+        this.receipt = receipt;
+        this.#label = label;
+    }
+    async assertCurrent() {
+        if (this.#closed) {
+            throw new FsSafeError("helper-failed", `${this.#label} pin is already closed`);
+        }
+        await assertOpenDirectoryCurrent(this.#handle, this.receipt, this.#label);
+    }
+    async sync() {
+        await this.assertCurrent();
+        try {
+            await this.#handle.sync();
+        }
+        catch (error) {
+            if (!isWindowsDirectorySyncUnsupported(error)) {
+                throw error;
+            }
+            await this.assertCurrent();
+            return unsupportedOutcome(error);
+        }
+        await this.assertCurrent();
+        return { status: "synced" };
+    }
+    async close() {
+        if (this.#closed) {
+            return;
+        }
+        this.#closed = true;
+        await this.#handle.close();
+    }
+}
+export async function pinDirectory(directory, options = {}) {
+    const label = options.label ?? "directory";
+    const receipt = typeof directory === "string" ? await createDirectoryReceipt(directory, label) : directory;
+    await assertDirectoryReceiptCurrent(receipt, label);
+    const handle = await fs.open(receipt.path, directoryOpenFlags());
+    try {
+        await assertOpenDirectoryCurrent(handle, receipt, label);
+        return new PinnedDirectoryImpl(handle, receipt, label);
+    }
+    catch (error) {
+        await handle.close().catch(() => undefined);
+        throw error;
+    }
+}
+export async function syncDirectory(directory, options = {}) {
+    const label = options.label ?? "directory";
+    const receipt = typeof directory === "string" ? await createDirectoryReceipt(directory, label) : directory;
+    let pinned;
+    try {
+        pinned = await pinDirectory(receipt, { label });
+    }
+    catch (error) {
+        if (!isWindowsDirectoryOpenUnsupported(error)) {
+            throw error;
+        }
+        await assertDirectoryReceiptCurrent(receipt, label);
+        return unsupportedOutcome(error);
+    }
+    try {
+        return await pinned.sync();
+    }
+    finally {
+        await pinned.close();
+    }
+}
+export function syncDirectorySync(directory, options = {}) {
+    const label = options.label ?? "directory";
+    const receipt = typeof directory === "string" ? createDirectoryReceiptSync(directory, label) : directory;
+    assertDirectoryReceiptCurrentSync(receipt, label);
+    let descriptor;
+    try {
+        descriptor = fsSync.openSync(receipt.path, directoryOpenFlags());
+    }
+    catch (error) {
+        if (!isWindowsDirectoryOpenUnsupported(error)) {
+            throw error;
+        }
+        assertDirectoryReceiptCurrentSync(receipt, label);
+        return unsupportedOutcome(error);
+    }
+    try {
+        const openedIdentity = fsSync.fstatSync(descriptor);
+        assertDirectory(openedIdentity, receipt.path, label);
+        if (!sameFileIdentity(receipt.identity, openedIdentity)) {
+            throw new FsSafeError("path-mismatch", `${label} handle changed during directory sync: ${receipt.path}`);
+        }
+        assertDirectoryReceiptCurrentSync(receipt, label);
+        try {
+            fsSync.fsyncSync(descriptor);
+        }
+        catch (error) {
+            if (!isWindowsDirectorySyncUnsupported(error)) {
+                throw error;
+            }
+            assertDirectoryReceiptCurrentSync(receipt, label);
+            return unsupportedOutcome(error);
+        }
+        assertDirectoryReceiptCurrentSync(receipt, label);
+        return { status: "synced" };
+    }
+    finally {
+        fsSync.closeSync(descriptor);
+    }
+}
+export async function syncDirectoryBestEffort(directoryPath) {
+    await syncDirectory(directoryPath).catch(() => undefined);
+}
+export function syncDirectoryBestEffortSync(directoryPath) {
+    try {
+        syncDirectorySync(directoryPath);
+    }
+    catch {
+        // Compatibility helper for operations whose primary write may remain usable.
+    }
+}
+async function findExistingAncestorReceipt(targetPath, label) {
+    let currentPath = path.resolve(targetPath);
+    while (true) {
+        try {
+            return await createDirectoryReceipt(currentPath, label);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT") {
+                throw error;
+            }
+        }
+        const parentPath = path.dirname(currentPath);
+        if (parentPath === currentPath) {
+            throw new FsSafeError("not-found", `${label} has no existing directory ancestor`);
+        }
+        currentPath = parentPath;
+    }
+}
+export async function ensureDurableDirectory(options) {
+    const directoryPath = path.resolve(options.directoryPath);
+    const label = options.label ?? "directory";
+    const ancestorReceipt = await findExistingAncestorReceipt(directoryPath, label);
+    const targetExists = ancestorReceipt.path === directoryPath;
+    if (options.expectedExistingIdentity &&
+        (!targetExists || !sameFileIdentity(options.expectedExistingIdentity, ancestorReceipt.identity))) {
+        throw new FsSafeError("path-mismatch", `${label} changed before durable directory pinning: ${directoryPath}`);
+    }
+    const ancestor = await pinDirectory(ancestorReceipt, { label });
+    const pinnedDirectories = [ancestor];
+    try {
+        await ancestor.assertCurrent();
+        if (!targetExists) {
+            if (options.create) {
+                await options.create(directoryPath);
+            }
+            else {
+                const created = await ensureAbsoluteDirectory(directoryPath, {
+                    mode: options.mode,
+                    scopeLabel: label,
+                });
+                if (!created.ok) {
+                    throw created.error;
+                }
+            }
+        }
+        await ancestor.assertCurrent();
+        let currentPath = ancestor.receipt.path;
+        for (const segment of path
+            .relative(ancestor.receipt.path, directoryPath)
+            .split(path.sep)
+            .filter(Boolean)) {
+            currentPath = path.join(currentPath, segment);
+            pinnedDirectories.push(await pinDirectory(currentPath, { label }));
+        }
+        let parentSync = { status: "not-needed" };
+        for (let index = pinnedDirectories.length - 1; index > 0; index -= 1) {
+            const parent = pinnedDirectories[index - 1];
+            const child = pinnedDirectories[index];
+            if (!parent || !child) {
+                throw new FsSafeError("helper-failed", `${label} directory pin chain is incomplete`);
+            }
+            await child.assertCurrent();
+            try {
+                const outcome = await parent.sync();
+                if (outcome.status === "unsupported") {
+                    parentSync = outcome;
+                }
+                else if (parentSync.status === "not-needed") {
+                    parentSync = outcome;
+                }
+            }
+            catch (error) {
+                throw new FsSafeError("helper-failed", `${label} could not sync created directory edge ${child.receipt.path} through ${parent.receipt.path}`, { cause: error });
+            }
+            await child.assertCurrent();
+        }
+        const finalReceipt = pinnedDirectories.at(-1)?.receipt;
+        if (!finalReceipt) {
+            throw new FsSafeError("helper-failed", `${label} directory receipt is missing`);
+        }
+        await ancestor.assertCurrent();
+        await assertDirectoryReceiptCurrent(finalReceipt, label);
+        return { ...finalReceipt, parentSync };
+    }
+    finally {
+        await Promise.all(pinnedDirectories.toReversed().map(async (directory) => directory.close()));
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/directory-guard.d.ts

@@ -0,0 +1,31 @@
+import type { BigIntStats, Stats } from "node:fs";
+export type AsyncDirectoryGuard<T extends Stats | BigIntStats = Stats> = {
+    dir: string;
+    realPath: string;
+    stat: T;
+};
+export type AnyAsyncDirectoryGuard = AsyncDirectoryGuard<Stats | BigIntStats>;
+export type SyncDirectoryGuard = {
+    dir: string;
+    realPath: string;
+    stat: Stats;
+};
+export declare function createAsyncDirectoryGuard(dir: string, options: {
+    bigint: true;
+}): Promise<AsyncDirectoryGuard<BigIntStats>>;
+export declare function createAsyncDirectoryGuard(dir: string, options?: {
+    bigint?: false;
+}): Promise<AsyncDirectoryGuard>;
+export declare function createAsyncDirectoryGuard(dir: string, options: {
+    bigint: boolean;
+}): Promise<AnyAsyncDirectoryGuard>;
+export declare function assertAsyncDirectoryGuard(guard: AnyAsyncDirectoryGuard): Promise<void>;
+export declare function createSyncDirectoryGuard(dir: string): SyncDirectoryGuard;
+export declare function assertSyncDirectoryGuard(guard: SyncDirectoryGuard): void;
+export declare function createNearestExistingDirectoryGuard(rootReal: string, targetPath: string): Promise<AsyncDirectoryGuard>;
+export declare function createNearestExistingDirectoryGuard(rootReal: string, targetPath: string, options: {
+    bigint: boolean;
+}): Promise<AnyAsyncDirectoryGuard>;
+export declare function createNearestExistingSyncDirectoryGuard(rootReal: string, targetPath: string): SyncDirectoryGuard;
+export declare function inspectDirectoryIdentity(dir: string, expected?: Pick<BigIntStats, "dev" | "ino">): Promise<BigIntStats>;
+//# sourceMappingURL=directory-guard.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/directory-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-guard.d.ts","sourceRoot":"","sources":["../src/directory-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AASlD,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,KAAK,GAAG,WAAW,GAAG,KAAK,IAAI;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,CAAC,CAAC;CACT,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,mBAAmB,CAAC,KAAK,GAAG,WAAW,CAAC,CAAC;AAE9E,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;CACb,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;AAC7H,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AACnH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAStH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAU5F;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAMxE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAQxE;AAED,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AACxH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAqBzJ,wBAAgB,uCAAuC,CACrD,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,kBAAkB,CAcpB;AAGD,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAM7H"}

package/node_modules/@openclaw/fs-safe/dist/directory-guard.js

@@ -0,0 +1,82 @@
+import fsSync from "node:fs";
+import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { sameFileIdentity } from "./file-identity.js";
+import { inspectFileIdentity } from "./strict-file-identity.js";
+import { isNotFoundPathError } from "./path.js";
+import { directoryComponentNotDirectoryError } from "./root-errors.js";
+export async function createAsyncDirectoryGuard(dir, options) {
+    const stat = options?.bigint ? await inspectDirectoryIdentity(dir) : fsSync.lstatSync(dir);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw directoryComponentNotDirectoryError();
+    }
+    return { dir, realPath: fsSync.realpathSync.native(dir), stat };
+}
+export async function assertAsyncDirectoryGuard(guard) {
+    const stat = typeof guard.stat.dev === "bigint" && typeof guard.stat.ino === "bigint"
+        ? await inspectDirectoryIdentity(guard.dir, { dev: guard.stat.dev, ino: guard.stat.ino })
+        : fsSync.lstatSync(guard.dir);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw directoryComponentNotDirectoryError();
+    }
+    if (!sameFileIdentity(stat, guard.stat) || fsSync.realpathSync.native(guard.dir) !== guard.realPath) {
+        throw new FsSafeError("path-mismatch", "directory changed during operation");
+    }
+}
+export function createSyncDirectoryGuard(dir) {
+    const stat = fsSync.lstatSync(dir);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw directoryComponentNotDirectoryError();
+    }
+    return { dir, realPath: fsSync.realpathSync(dir), stat };
+}
+export function assertSyncDirectoryGuard(guard) {
+    const stat = fsSync.lstatSync(guard.dir);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw directoryComponentNotDirectoryError();
+    }
+    if (!sameFileIdentity(stat, guard.stat) || fsSync.realpathSync(guard.dir) !== guard.realPath) {
+        throw new FsSafeError("path-mismatch", "directory changed during operation");
+    }
+}
+export async function createNearestExistingDirectoryGuard(rootReal, targetPath, options = { bigint: false }) {
+    let current = path.resolve(targetPath);
+    const root = path.resolve(rootReal);
+    while (current !== root) {
+        try {
+            return await createAsyncDirectoryGuard(current, options);
+        }
+        catch (error) {
+            if (!isNotFoundPathError(error)) {
+                throw error;
+            }
+            current = path.dirname(current);
+        }
+    }
+    return await createAsyncDirectoryGuard(root, options);
+}
+export function createNearestExistingSyncDirectoryGuard(rootReal, targetPath) {
+    let current = path.resolve(targetPath);
+    const root = path.resolve(rootReal);
+    while (current !== root) {
+        try {
+            return createSyncDirectoryGuard(current);
+        }
+        catch (error) {
+            if (!isNotFoundPathError(error)) {
+                throw error;
+            }
+            current = path.dirname(current);
+        }
+    }
+    return createSyncDirectoryGuard(root);
+}
+// Recovery receipts must retain every identity bit, including on Windows.
+export async function inspectDirectoryIdentity(dir, expected) {
+    return await inspectFileIdentity(async () => {
+        const stat = fsSync.lstatSync(dir, { bigint: true });
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw directoryComponentNotDirectoryError();
+        return stat;
+    }, expected);
+}

package/node_modules/@openclaw/fs-safe/dist/directory-mode-node.d.ts

@@ -0,0 +1,8 @@
+import { type BigIntStats } from "node:fs";
+import { type DirectoryModeOwner } from "./directory-mode-owner.js";
+/** Real Node only: injected filesystem adapters must retain descriptor-chmod semantics. */
+export declare function pinNodeDirectoryForMode(dirPath: string, options?: {
+    expectedIdentity?: BigIntStats;
+    ownerUid?: number;
+}): Promise<DirectoryModeOwner>;
+//# sourceMappingURL=directory-mode-node.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/directory-mode-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-mode-node.d.ts","sourceRoot":"","sources":["../src/directory-mode-node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAKtD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAW5G,2FAA2F;AAC3F,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClE,OAAO,CAAC,kBAAkB,CAAC,CAsE7B"}