@openclaw/openshell-sandbox 2026.9.2 → 2026.9.4

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-fallback.js

@@ -0,0 +1,331 @@
+import syncFs, {} from "node:fs";
+import { FsSafeError } from "./errors.js";
+import { sameFileIdentity } from "./file-identity.js";
+import { readOwnedCopySource, readOwnedCopySourceSync } from "./replace-file-copy-source.js";
+import { resolveReadOpenFlags } from "./read-open-flags.js";
+const SUPPORTS_NOFOLLOW = process.platform !== "win32" && "O_NOFOLLOW" in syncFs.constants;
+const NOFOLLOW = SUPPORTS_NOFOLLOW ? syncFs.constants.O_NOFOLLOW : 0;
+const OPEN_READ_FLAGS = resolveReadOpenFlags();
+const OPEN_READ_WRITE_FLAGS = syncFs.constants.O_RDWR | NOFOLLOW;
+const OPEN_WRITE_EXCLUSIVE_FLAGS = syncFs.constants.O_WRONLY | syncFs.constants.O_CREAT | syncFs.constants.O_EXCL | NOFOLLOW;
+const READ_CHUNK_BYTES = 64 * 1024;
+function notFound(error) {
+    return error.code === "ENOENT";
+}
+function assertPinnedDestination(pathname, opened, dest, hardlinks) {
+    if (pathname.isSymbolicLink()) {
+        throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${dest}`);
+    }
+    if (!pathname.isFile() || !opened.isFile()) {
+        throw new FsSafeError("not-file", `Copy fallback destination must be a regular file: ${dest}`);
+    }
+    if (!sameFileIdentity(pathname, opened)) {
+        throw new FsSafeError("path-mismatch", `Copy fallback destination changed while opening: ${dest}`);
+    }
+    if (hardlinks === "reject" && opened.nlink > 1) {
+        throw new FsSafeError("hardlink", `Hardlinked copy fallback destination not allowed: ${dest}`);
+    }
+}
+async function openPinnedDestination(fsModule, dest, hardlinks) {
+    const preview = await fsModule.lstat(dest).catch((error) => {
+        if (notFound(error))
+            return null;
+        throw error;
+    });
+    if (!preview)
+        return null;
+    if (preview.isSymbolicLink()) {
+        throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${dest}`);
+    }
+    const handle = await fsModule.open(dest, OPEN_READ_WRITE_FLAGS);
+    try {
+        const opened = await handle.stat();
+        const current = await fsModule.lstat(dest);
+        assertPinnedDestination(current, opened, dest, hardlinks);
+        return { handle, stat: opened };
+    }
+    catch (error) {
+        await handle.close().catch(() => undefined);
+        throw error;
+    }
+}
+function openPinnedDestinationSync(fsModule, dest, hardlinks) {
+    let preview;
+    try {
+        preview = fsModule.lstatSync(dest);
+    }
+    catch (error) {
+        if (notFound(error))
+            return null;
+        throw error;
+    }
+    if (preview.isSymbolicLink()) {
+        throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${dest}`);
+    }
+    const fd = fsModule.openSync(dest, OPEN_READ_WRITE_FLAGS);
+    try {
+        const opened = fsModule.fstatSync(fd);
+        assertPinnedDestination(fsModule.lstatSync(dest), opened, dest, hardlinks);
+        return { fd, stat: opened };
+    }
+    catch (error) {
+        fsModule.closeSync(fd);
+        throw error;
+    }
+}
+export async function assertDestinationHardlinkPolicy(fsModule, dest, policy) {
+    if (policy !== "reject")
+        return;
+    const preview = await fsModule.lstat(dest).catch((error) => {
+        if (notFound(error))
+            return null;
+        throw error;
+    });
+    if (!preview || preview.isSymbolicLink() || !preview.isFile())
+        return;
+    const handle = await fsModule.open(dest, OPEN_READ_FLAGS);
+    try {
+        const opened = await handle.stat();
+        const current = await fsModule.lstat(dest);
+        if (current.isSymbolicLink() || !current.isFile() || !sameFileIdentity(current, opened)) {
+            throw new FsSafeError("path-mismatch", `Atomic replace destination changed while opening: ${dest}`);
+        }
+        if (opened.nlink > 1) {
+            throw new FsSafeError("hardlink", `Hardlinked atomic replace destination not allowed: ${dest}`);
+        }
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+    }
+}
+export function assertDestinationHardlinkPolicySync(fsModule, dest, policy) {
+    if (policy !== "reject")
+        return;
+    let preview;
+    try {
+        preview = fsModule.lstatSync(dest);
+    }
+    catch (error) {
+        if (notFound(error))
+            return;
+        throw error;
+    }
+    if (preview.isSymbolicLink() || !preview.isFile())
+        return;
+    const fd = fsModule.openSync(dest, OPEN_READ_FLAGS);
+    try {
+        const opened = fsModule.fstatSync(fd);
+        const current = fsModule.lstatSync(dest);
+        if (current.isSymbolicLink() || !current.isFile() || !sameFileIdentity(current, opened)) {
+            throw new FsSafeError("path-mismatch", `Atomic replace destination changed while opening: ${dest}`);
+        }
+        if (opened.nlink > 1) {
+            throw new FsSafeError("hardlink", `Hardlinked atomic replace destination not allowed: ${dest}`);
+        }
+    }
+    finally {
+        fsModule.closeSync(fd);
+    }
+}
+async function readBounded(handle, maxBytes) {
+    const chunks = [];
+    let position = 0;
+    while (position <= maxBytes) {
+        const buffer = Buffer.allocUnsafe(Math.min(READ_CHUNK_BYTES, maxBytes - position + 1));
+        const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);
+        if (bytesRead === 0)
+            break;
+        position += bytesRead;
+        if (position > maxBytes) {
+            throw new FsSafeError("too-large", `Atomic replace restore snapshot exceeds maxRestoreBytes (${maxBytes})`);
+        }
+        chunks.push(buffer.subarray(0, bytesRead));
+    }
+    return Buffer.concat(chunks, position);
+}
+function readBoundedSync(fsModule, fd, maxBytes) {
+    const chunks = [];
+    let position = 0;
+    while (position <= maxBytes) {
+        const buffer = Buffer.allocUnsafe(Math.min(READ_CHUNK_BYTES, maxBytes - position + 1));
+        const bytesRead = fsModule.readSync(fd, buffer, 0, buffer.length, position);
+        if (bytesRead === 0)
+            break;
+        position += bytesRead;
+        if (position > maxBytes) {
+            throw new FsSafeError("too-large", `Atomic replace restore snapshot exceeds maxRestoreBytes (${maxBytes})`);
+        }
+        chunks.push(buffer.subarray(0, bytesRead));
+    }
+    return Buffer.concat(chunks, position);
+}
+async function writeAll(handle, data) {
+    await handle.truncate(0);
+    let written = 0;
+    while (written < data.length) {
+        const result = await handle.write(data, written, data.length - written, written);
+        if (result.bytesWritten === 0)
+            throw new Error("Copy fallback write made no progress");
+        written += result.bytesWritten;
+    }
+    await handle.truncate(data.length);
+}
+function writeAllSync(fsModule, fd, data) {
+    fsModule.ftruncateSync(fd, 0);
+    let written = 0;
+    while (written < data.length) {
+        const bytesWritten = fsModule.writeSync(fd, data, written, data.length - written, written);
+        if (bytesWritten === 0)
+            throw new Error("Copy fallback write made no progress");
+        written += bytesWritten;
+    }
+    fsModule.ftruncateSync(fd, data.length);
+}
+function restoreFailure(writeError, cleanup, restoreError) {
+    const primary = writeError instanceof Error ? writeError : new Error(String(writeError));
+    const details = { cleanup };
+    const cause = restoreError
+        ? new AggregateError([primary, restoreError], "copy fallback and original restoration both failed")
+        : primary;
+    return new FsSafeError("helper-failed", cleanup === "restored"
+        ? `Atomic copy fallback failed; original destination restored: ${primary.message}`
+        : `Atomic copy fallback failed and original restoration failed: ${primary.message}`, { cause, details });
+}
+async function replacePinnedWithRestore(handle, replacement, maxRestoreBytes, replacementMode) {
+    const originalMode = (await handle.stat()).mode;
+    const original = await readBounded(handle, maxRestoreBytes);
+    try {
+        await writeAll(handle, replacement);
+        await handle.chmod(replacementMode);
+        await handle.sync();
+    }
+    catch (writeError) {
+        try {
+            await writeAll(handle, original);
+            await handle.chmod(originalMode);
+            await handle.sync();
+            throw restoreFailure(writeError, "restored");
+        }
+        catch (restoreError) {
+            if (restoreError instanceof FsSafeError && restoreError.details?.cleanup === "restored") {
+                throw restoreError;
+            }
+            throw restoreFailure(writeError, "restore-failed", restoreError);
+        }
+    }
+}
+function replacePinnedWithRestoreSync(fsModule, fd, replacement, maxRestoreBytes, replacementMode, fchmodSync) {
+    const originalMode = fsModule.fstatSync(fd).mode;
+    const original = readBoundedSync(fsModule, fd, maxRestoreBytes);
+    try {
+        writeAllSync(fsModule, fd, replacement);
+        fchmodSync?.(fd, replacementMode);
+        fsModule.fsyncSync(fd);
+    }
+    catch (writeError) {
+        try {
+            writeAllSync(fsModule, fd, original);
+            fchmodSync?.(fd, originalMode);
+            fsModule.fsyncSync(fd);
+            throw restoreFailure(writeError, "restored");
+        }
+        catch (restoreError) {
+            if (restoreError instanceof FsSafeError && restoreError.details?.cleanup === "restored") {
+                throw restoreError;
+            }
+            throw restoreFailure(writeError, "restore-failed", restoreError);
+        }
+    }
+}
+export async function copyFallbackReplace(params) {
+    const source = await readOwnedCopySource({
+        fsModule: params.fsModule,
+        src: params.src,
+        expectedIdentity: params.expectedSourceIdentity,
+    });
+    const { replacement } = source;
+    let destHandle = null;
+    try {
+        if (params.restore === "restore-original") {
+            const pinned = await openPinnedDestination(params.fsModule, params.dest, params.destinationHardlinks);
+            if (pinned) {
+                destHandle = pinned.handle;
+                await replacePinnedWithRestore(destHandle, replacement, params.maxRestoreBytes, source.mode);
+            }
+        }
+        if (!destHandle) {
+            const destStat = await params.fsModule.lstat(params.dest).catch((error) => {
+                if (notFound(error))
+                    return null;
+                throw error;
+            });
+            if (destStat?.isSymbolicLink()) {
+                throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${params.dest}`);
+            }
+            if (destStat) {
+                await assertDestinationHardlinkPolicy(params.fsModule, params.dest, params.destinationHardlinks);
+                await params.fsModule.rm(params.dest, { force: true });
+            }
+            destHandle = await params.fsModule.open(params.dest, OPEN_WRITE_EXCLUSIVE_FLAGS, source.mode & 0o777);
+            await destHandle.writeFile(replacement);
+            await destHandle.chmod(source.mode);
+            if (params.sync) {
+                await destHandle.sync();
+            }
+        }
+    }
+    finally {
+        await destHandle?.close().catch(() => undefined);
+    }
+}
+export function copyFallbackReplaceSync(params) {
+    const source = readOwnedCopySourceSync({
+        fsModule: params.fsModule,
+        src: params.src,
+        expectedIdentity: params.expectedSourceIdentity,
+    });
+    const { replacement } = source;
+    let destFd;
+    try {
+        if (params.restore === "restore-original") {
+            const pinned = openPinnedDestinationSync(params.fsModule, params.dest, params.destinationHardlinks);
+            if (pinned) {
+                destFd = pinned.fd;
+                replacePinnedWithRestoreSync(params.fsModule, destFd, replacement, params.maxRestoreBytes, source.mode, params.fchmodSync);
+            }
+        }
+        if (destFd === undefined) {
+            let destStat = null;
+            try {
+                destStat = params.fsModule.lstatSync(params.dest);
+            }
+            catch (error) {
+                if (!notFound(error))
+                    throw error;
+            }
+            if (destStat?.isSymbolicLink()) {
+                throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${params.dest}`);
+            }
+            if (destStat) {
+                assertDestinationHardlinkPolicySync(params.fsModule, params.dest, params.destinationHardlinks);
+                params.fsModule.rmSync(params.dest, { force: true });
+            }
+            destFd = params.fsModule.openSync(params.dest, OPEN_WRITE_EXCLUSIVE_FLAGS, source.mode & 0o777);
+            writeAllSync(params.fsModule, destFd, replacement);
+            params.fchmodSync?.(destFd, source.mode);
+            if (params.sync) {
+                params.fsModule.fsyncSync(destFd);
+            }
+        }
+    }
+    finally {
+        if (destFd !== undefined) {
+            try {
+                params.fsModule.closeSync(destFd);
+            }
+            catch {
+                // Best-effort close after fallback replacement.
+            }
+        }
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-source.d.ts

@@ -0,0 +1,21 @@
+import syncFs, { type BigIntStats } from "node:fs";
+type AsyncSourceFileSystem = Pick<typeof import("node:fs/promises"), "lstat" | "open">;
+type SyncSourceFileSystem = Pick<typeof syncFs, "closeSync" | "fstatSync" | "lstatSync" | "openSync" | "readSync">;
+export declare function readOwnedCopySource(params: {
+    fsModule: AsyncSourceFileSystem;
+    src: string;
+    expectedIdentity?: BigIntStats;
+}): Promise<{
+    replacement: Buffer;
+    mode: number;
+}>;
+export declare function readOwnedCopySourceSync(params: {
+    fsModule: SyncSourceFileSystem;
+    src: string;
+    expectedIdentity?: BigIntStats;
+}): {
+    replacement: Buffer;
+    mode: number;
+};
+export {};
+//# sourceMappingURL=replace-file-copy-source.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replace-file-copy-source.d.ts","sourceRoot":"","sources":["../src/replace-file-copy-source.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,EAAE,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAOnD,KAAK,qBAAqB,GAAG,IAAI,CAAC,cAAc,kBAAkB,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;AACvF,KAAK,oBAAoB,GAAG,IAAI,CAC9B,OAAO,MAAM,EACb,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAClE,CAAC;AA0DF,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,QAAQ,EAAE,qBAAqB,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,CAAC,EAAE,WAAW,CAAC;CAChC,GAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BjD;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,CAAC,EAAE,WAAW,CAAC;CAChC,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA8BxC"}

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-source.js

@@ -0,0 +1,107 @@
+import syncFs, {} from "node:fs";
+import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { FsSafeError } from "./errors.js";
+import { sameFileIdentity } from "./file-identity.js";
+import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
+const OPEN_READ_FLAGS = resolveReadOpenFlags();
+const READ_CHUNK_BYTES = 64 * 1024;
+function assertSourcePreview(source, src) {
+    if (source.isSymbolicLink()) {
+        throw new FsSafeError("symlink", `Refusing copy fallback from non-file source: ${src}`);
+    }
+    if (!source.isFile()) {
+        throw new FsSafeError("not-file", `Refusing copy fallback from non-file source: ${src}`);
+    }
+    if (source.nlink !== 1) {
+        throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${src}`);
+    }
+}
+function sourceSymlinkError(src, cause) {
+    return new FsSafeError("symlink", `Refusing copy fallback from non-file source: ${src}`, {
+        cause,
+    });
+}
+async function openSource(fsModule, src) {
+    try {
+        return await fsModule.open(src, OPEN_READ_FLAGS);
+    }
+    catch (error) {
+        if (error.code === "ELOOP") {
+            throw sourceSymlinkError(src, error);
+        }
+        throw error;
+    }
+}
+function openSourceSync(fsModule, src) {
+    try {
+        return fsModule.openSync(src, OPEN_READ_FLAGS);
+    }
+    catch (error) {
+        if (error.code === "ELOOP") {
+            throw sourceSymlinkError(src, error);
+        }
+        throw error;
+    }
+}
+function readAllSync(fsModule, fd) {
+    const chunks = [];
+    let position = 0;
+    while (true) {
+        const buffer = Buffer.allocUnsafe(READ_CHUNK_BYTES);
+        const bytesRead = fsModule.readSync(fd, buffer, 0, buffer.length, position);
+        if (bytesRead === 0)
+            break;
+        position += bytesRead;
+        chunks.push(buffer.subarray(0, bytesRead));
+    }
+    return Buffer.concat(chunks, position);
+}
+export async function readOwnedCopySource(params) {
+    assertSourcePreview(await params.fsModule.lstat(params.src), params.src);
+    const handle = await openSource(params.fsModule, params.src);
+    try {
+        if (params.expectedIdentity) {
+            const exact = await inspectFileIdentity(() => handle.stat({ bigint: true }), params.expectedIdentity);
+            await inspectFileIdentity(() => params.fsModule.lstat(params.src, { bigint: true }), exact);
+        }
+        const opened = await handle.stat();
+        const current = await params.fsModule.lstat(params.src);
+        if (!opened.isFile() || current.isSymbolicLink() || !sameFileIdentity(opened, current)) {
+            throw new FsSafeError("path-mismatch", `Copy fallback source changed while opening: ${params.src}`);
+        }
+        if (opened.nlink !== 1) {
+            throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${params.src}`);
+        }
+        return { replacement: await handle.readFile(), mode: opened.mode };
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+    }
+}
+export function readOwnedCopySourceSync(params) {
+    assertSourcePreview(params.fsModule.lstatSync(params.src), params.src);
+    const fd = openSourceSync(params.fsModule, params.src);
+    try {
+        if (params.expectedIdentity) {
+            const exact = inspectFileIdentitySync(() => params.fsModule.fstatSync(fd, { bigint: true }), params.expectedIdentity);
+            inspectFileIdentitySync(() => params.fsModule.lstatSync(params.src, { bigint: true }), exact);
+        }
+        const opened = params.fsModule.fstatSync(fd);
+        const current = params.fsModule.lstatSync(params.src);
+        if (!opened.isFile() || current.isSymbolicLink() || !sameFileIdentity(opened, current)) {
+            throw new FsSafeError("path-mismatch", `Copy fallback source changed while opening: ${params.src}`);
+        }
+        if (opened.nlink !== 1) {
+            throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${params.src}`);
+        }
+        return { replacement: readAllSync(params.fsModule, fd), mode: opened.mode };
+    }
+    finally {
+        try {
+            params.fsModule.closeSync(fd);
+        }
+        catch {
+            // Best-effort close after reading a copy-fallback source.
+        }
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/replace-file-descriptor.d.ts

@@ -0,0 +1,51 @@
+import syncFs, { type BigIntStats } from "node:fs";
+import fs, { type FileHandle } from "node:fs/promises";
+import { type DirectoryModeOwner } from "./directory-mode-owner.js";
+type AsyncTempFileSystem = Pick<typeof fs, "lstat" | "open" | "writeFile">;
+type SyncTempFileSystem = Pick<typeof syncFs, "closeSync" | "fstatSync" | "fsyncSync" | "lstatSync" | "openSync" | "writeFileSync">;
+export type SyncFchmod = (fd: number, mode: number) => void;
+export declare function syncDirectoryBestEffort(fsModule: Pick<typeof fs, "open">, dirPath: string): Promise<void>;
+export declare function syncDirectoryBestEffortSync(fsModule: Pick<typeof syncFs, "openSync" | "fsyncSync" | "closeSync">, dirPath: string): void;
+export declare function pinDirectoryForMode(params: {
+    fsModule: AsyncTempFileSystem;
+    dirPath: string;
+    /** Compatibility for best-effort directory modes; admission and close still fail closed. */
+    ignoreChmodError?: boolean;
+}): Promise<DirectoryModeOwner | undefined>;
+export declare function applyDirectoryMode(params: {
+    fsModule: AsyncTempFileSystem;
+    dirPath: string;
+    mode: number;
+    ignoreChmodError?: boolean;
+}): Promise<void>;
+export declare function applyDirectoryModeSync(params: {
+    fsModule: SyncTempFileSystem;
+    dirPath: string;
+    mode: number;
+    fchmodSync?: SyncFchmod;
+}): void;
+export declare function writeTempFile(params: {
+    fsModule: AsyncTempFileSystem;
+    tempPath: string;
+    content: string | Uint8Array;
+    mode: number;
+    sync: boolean;
+    onIdentity?: (identity: BigIntStats) => void;
+}): Promise<{
+    handle: FileHandle;
+    identity: BigIntStats;
+}>;
+export declare function writeTempFileSync(params: {
+    fsModule: SyncTempFileSystem;
+    tempPath: string;
+    content: string | Uint8Array;
+    mode: number;
+    fchmodSync?: SyncFchmod;
+    sync: boolean;
+    onIdentity?: (identity: BigIntStats) => void;
+}): {
+    fd: number;
+    identity: BigIntStats;
+};
+export {};
+//# sourceMappingURL=replace-file-descriptor.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/replace-file-descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replace-file-descriptor.d.ts","sourceRoot":"","sources":["../src/replace-file-descriptor.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,EAAE,EAAE,KAAK,WAAW,EAAc,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAIvD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE5G,KAAK,mBAAmB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC,CAAC;AAC3E,KAAK,kBAAkB,GAAG,IAAI,CAC5B,OAAO,MAAM,EACb,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,eAAe,CACrF,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAE5D,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,IAAI,CAAC,OAAO,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,WAAW,CAAC,EACrE,OAAO,EAAE,MAAM,GACd,IAAI,CAgBN;AA2BD,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CA6B1C;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhB;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,GAAG,IAAI,CAeP;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE;IAC1C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,IAAI,CAAC;CAC9C,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAA;CAAE,CAAC,CAuBzD;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,IAAI,CAAC;CAC9C,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAA;CAAE,CAoBxC"}

package/node_modules/@openclaw/fs-safe/dist/replace-file-descriptor.js

@@ -0,0 +1,161 @@
+import { syncFileBestEffort, syncFileBestEffortSync } from "./file-sync.js";
+import syncFs, {} from "node:fs";
+import fs, {} from "node:fs/promises";
+import { FsSafeError } from "./errors.js";
+import { sameFileIdentity } from "./file-identity.js";
+import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
+import { assertOwnedDirectory, ownDirectoryMode } from "./directory-mode-owner.js";
+export async function syncDirectoryBestEffort(fsModule, dirPath) {
+    let handle;
+    try {
+        handle = await fsModule.open(dirPath, "r");
+        await handle.sync();
+    }
+    catch {
+        // Best-effort on platforms/filesystems that do not support directory fsync.
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
+export function syncDirectoryBestEffortSync(fsModule, dirPath) {
+    let fd;
+    try {
+        fd = fsModule.openSync(dirPath, "r");
+        fsModule.fsyncSync(fd);
+    }
+    catch {
+        // Best-effort on platforms/filesystems that do not support directory fsync.
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                fsModule.closeSync(fd);
+            }
+            catch {
+                // Best-effort close after directory fsync.
+            }
+        }
+    }
+}
+function directoryOpenFlags() {
+    return (syncFs.constants.O_RDONLY |
+        syncFs.constants.O_DIRECTORY |
+        syncFs.constants.O_NOFOLLOW |
+        syncFs.constants.O_NONBLOCK);
+}
+function assertDirectory(identity, dirPath) {
+    if (identity.isSymbolicLink() || !identity.isDirectory()) {
+        throw new FsSafeError("not-file", `Atomic replace parent must be a real directory: ${dirPath}`);
+    }
+}
+function assertSameDirectory(expected, opened, dirPath) {
+    assertDirectory(opened, dirPath);
+    if (!sameFileIdentity(expected, opened)) {
+        throw new FsSafeError("path-mismatch", `Atomic replace parent changed before its mode could be applied: ${dirPath}`);
+    }
+}
+export async function pinDirectoryForMode(params) {
+    // Node does not enforce POSIX directory modes on Windows, and its directory
+    // descriptors are not consistently openable. mkdir(mode) remains the only
+    // bounded behavior there; never fall back to a pathname chmod.
+    if (process.platform === "win32") {
+        return;
+    }
+    const expected = params.fsModule === fs
+        ? syncFs.lstatSync(params.dirPath) : await params.fsModule.lstat(params.dirPath);
+    assertDirectory(expected, params.dirPath);
+    const handle = await params.fsModule.open(params.dirPath, directoryOpenFlags());
+    try {
+        const owner = ownDirectoryMode({
+            async inspect() {
+                const opened = params.fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
+                assertOwnedDirectory(expected, opened);
+                return opened.mode & 0o7777;
+            },
+            chmod: (mode) => handle.chmod(mode),
+            close: () => handle.close(),
+            ignoreChmodError: params.ignoreChmodError,
+        });
+        await owner.verify();
+        return owner;
+    }
+    catch (error) {
+        await handle.close();
+        throw error;
+    }
+}
+export async function applyDirectoryMode(params) {
+    const owner = await pinDirectoryForMode(params);
+    try {
+        await owner?.apply(params.mode);
+    }
+    finally {
+        await owner?.close();
+    }
+}
+export function applyDirectoryModeSync(params) {
+    if (process.platform === "win32") {
+        return;
+    }
+    const expected = params.fsModule.lstatSync(params.dirPath);
+    assertDirectory(expected, params.dirPath);
+    const fd = params.fsModule.openSync(params.dirPath, directoryOpenFlags());
+    try {
+        assertSameDirectory(expected, params.fsModule.fstatSync(fd), params.dirPath);
+        // chmod ignores file-type bits; mask so raw stat modes are tolerated.
+        params.fchmodSync?.(fd, params.mode & 0o7777);
+    }
+    finally {
+        params.fsModule.closeSync(fd);
+    }
+}
+export async function writeTempFile(params) {
+    const handle = await params.fsModule.open(params.tempPath, "wx", params.mode);
+    try {
+        // Custom adapters retain their async-only metadata contract.
+        const inspect = () => params.fsModule === fs
+            ? syncFs.fstatSync(handle.fd, { bigint: true }) : handle.stat({ bigint: true });
+        const identity = await inspectFileIdentity(inspect);
+        params.onIdentity?.(identity);
+        await params.fsModule.writeFile(handle, params.content);
+        await handle.chmod(params.mode);
+        if (params.sync) {
+            await syncFileBestEffort(handle);
+        }
+        await inspectFileIdentity(inspect, identity);
+        return { handle, identity };
+    }
+    catch (error) {
+        try {
+            await handle.close();
+        }
+        catch (closeError) {
+            throw new AggregateError([error, closeError], "Atomic temp write and close failed");
+        }
+        throw error;
+    }
+}
+export function writeTempFileSync(params) {
+    const fd = params.fsModule.openSync(params.tempPath, "wx", params.mode);
+    try {
+        const identity = inspectFileIdentitySync(() => params.fsModule.fstatSync(fd, { bigint: true }));
+        params.onIdentity?.(identity);
+        params.fsModule.writeFileSync(fd, params.content);
+        params.fchmodSync?.(fd, params.mode);
+        if (params.sync) {
+            syncFileBestEffortSync(fd, params.fsModule);
+        }
+        inspectFileIdentitySync(() => params.fsModule.fstatSync(fd, { bigint: true }), identity);
+        return { fd, identity };
+    }
+    catch (error) {
+        try {
+            params.fsModule.closeSync(fd);
+        }
+        catch (closeError) {
+            throw new AggregateError([error, closeError], "Atomic temp write and close failed");
+        }
+        throw error;
+    }
+}