@openclaw/openshell-sandbox 2026.9.2 → 2026.9.4

package/node_modules/@openclaw/fs-safe/dist/absolute-path.js

@@ -0,0 +1,307 @@
+import fsSync from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { assertAsyncDirectoryGuard, createAsyncDirectoryGuard, } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { pathExists } from "./fs.js";
+import { resolveRootPath } from "./root-path.js";
+function resolveSymlinkPolicy(policy) {
+    if (policy === undefined)
+        return "reject";
+    if (policy !== "reject" && policy !== "follow") {
+        throw new TypeError(`invalid absolute path symlink policy: ${String(policy)}`);
+    }
+    return policy;
+}
+function ensureDirectoryFailure(code, message, cause) {
+    return {
+        ok: false,
+        code,
+        error: new FsSafeError(code, message, { cause }),
+    };
+}
+async function assertGuardResult(guard, scopeLabel) {
+    try {
+        await assertAsyncDirectoryGuard(guard);
+        return { ok: true };
+    }
+    catch (err) {
+        if (err instanceof FsSafeError) {
+            return await directoryGuardFailure(err, guard.dir, scopeLabel);
+        }
+        throw err;
+    }
+}
+async function createDirectoryGuardResult(dir, scopeLabel) {
+    try {
+        return { ok: true, guard: await createAsyncDirectoryGuard(dir) };
+    }
+    catch (err) {
+        if (err instanceof FsSafeError) {
+            return await directoryGuardFailure(err, dir, scopeLabel);
+        }
+        throw err;
+    }
+}
+function classifyDirectoryLookupError(err, scopeLabel) {
+    const code = err.code;
+    if (code === "ENOENT") {
+        return ensureDirectoryFailure("not-found", `directory path must have a real existing ancestor within ${scopeLabel}`, err);
+    }
+    if (code === "ENOTDIR") {
+        return ensureDirectoryFailure("not-file", `path must be a real directory within ${scopeLabel}`, err);
+    }
+    return null;
+}
+function classifyExistingDirectorySegment(stat, scopeLabel) {
+    if (stat.isSymbolicLink()) {
+        return ensureDirectoryFailure("symlink", `directory path traverses a symlink within ${scopeLabel}`);
+    }
+    if (!stat.isDirectory()) {
+        return ensureDirectoryFailure("not-file", `path must be a real directory within ${scopeLabel}`);
+    }
+    return null;
+}
+async function directoryGuardFailure(err, dir, scopeLabel) {
+    if (err.code !== "not-file") {
+        return { ok: false, code: err.code, error: err };
+    }
+    try {
+        const stat = fsSync.lstatSync(dir);
+        const failure = classifyExistingDirectorySegment(stat, scopeLabel);
+        if (failure) {
+            return failure;
+        }
+    }
+    catch (lookupErr) {
+        const failure = classifyDirectoryLookupError(lookupErr, scopeLabel);
+        if (failure) {
+            return failure;
+        }
+        throw lookupErr;
+    }
+    return { ok: false, code: err.code, error: err };
+}
+async function resolveTrustedDirectoryPrefix(targetPath, scopeLabel) {
+    const root = path.parse(targetPath).root;
+    let current = root;
+    let currentStat;
+    try {
+        currentStat = fsSync.lstatSync(current);
+    }
+    catch (err) {
+        const failure = classifyDirectoryLookupError(err, scopeLabel);
+        if (failure) {
+            return failure;
+        }
+        throw err;
+    }
+    const rootFailure = classifyExistingDirectorySegment(currentStat, scopeLabel);
+    if (rootFailure) {
+        return rootFailure;
+    }
+    // Walk forward with lstat. Looking backward for the "nearest existing
+    // ancestor" can cross an existing suffix through a symlinked parent before
+    // this helper gets a chance to reject that parent.
+    const segments = path.relative(root, targetPath).split(path.sep).filter(Boolean);
+    for (let index = 0; index < segments.length; index += 1) {
+        const segment = segments[index];
+        if (!segment) {
+            continue;
+        }
+        const next = path.join(current, segment);
+        try {
+            const nextStat = fsSync.lstatSync(next);
+            const segmentFailure = classifyExistingDirectorySegment(nextStat, scopeLabel);
+            if (segmentFailure) {
+                return segmentFailure;
+            }
+            current = next;
+            currentStat = nextStat;
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "ENOENT") {
+                return {
+                    ok: true,
+                    ancestorPath: current,
+                    missingSegments: segments.slice(index),
+                };
+            }
+            const failure = classifyDirectoryLookupError(err, scopeLabel);
+            if (failure) {
+                return failure;
+            }
+            throw err;
+        }
+    }
+    return { ok: true, ancestorPath: current, missingSegments: [] };
+}
+export function assertAbsolutePathInput(filePath) {
+    if (!filePath) {
+        throw new FsSafeError("invalid-path", "path is required");
+    }
+    if (filePath.includes("\0")) {
+        throw new FsSafeError("invalid-path", "path must not contain NUL bytes");
+    }
+    if (!path.isAbsolute(filePath)) {
+        throw new FsSafeError("invalid-path", "path must be absolute");
+    }
+    return path.normalize(filePath);
+}
+export async function findExistingAncestor(filePath) {
+    return (await findExistingAncestorWithStat(filePath))?.path ?? null;
+}
+async function findExistingAncestorWithStat(filePath) {
+    let current = path.resolve(filePath);
+    while (true) {
+        try {
+            return { path: current, stat: fsSync.lstatSync(current) };
+        }
+        catch (err) {
+            if (err.code !== "ENOENT") {
+                throw err;
+            }
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return null;
+        }
+        current = parent;
+    }
+}
+export async function ensureAbsoluteDirectory(dirPath, options = {}) {
+    const scopeLabel = options.scopeLabel ?? "directory";
+    let targetPath;
+    try {
+        targetPath = assertAbsolutePathInput(dirPath);
+    }
+    catch (err) {
+        if (err instanceof FsSafeError) {
+            return { ok: false, code: err.code, error: err };
+        }
+        throw err;
+    }
+    const prefix = await resolveTrustedDirectoryPrefix(targetPath, scopeLabel);
+    if (!prefix.ok) {
+        return prefix;
+    }
+    let current = prefix.ancestorPath;
+    const initialGuard = await createDirectoryGuardResult(prefix.ancestorPath, scopeLabel);
+    if (!initialGuard.ok) {
+        return initialGuard;
+    }
+    let currentGuard = initialGuard.guard;
+    for (const segment of prefix.missingSegments) {
+        current = path.join(current, segment);
+        while (true) {
+            const guardResult = await assertGuardResult(currentGuard, scopeLabel);
+            if (!guardResult.ok) {
+                return guardResult;
+            }
+            try {
+                const stat = fsSync.lstatSync(current);
+                if (stat.isSymbolicLink()) {
+                    return ensureDirectoryFailure("symlink", `directory path traverses a symlink within ${scopeLabel}`);
+                }
+                if (!stat.isDirectory()) {
+                    return ensureDirectoryFailure("not-file", `path must be a real directory within ${scopeLabel}`);
+                }
+                break;
+            }
+            catch (err) {
+                if (err.code !== "ENOENT") {
+                    throw err;
+                }
+                const parentStillValid = await assertGuardResult(currentGuard, scopeLabel);
+                if (!parentStillValid.ok) {
+                    return parentStillValid;
+                }
+                try {
+                    await fs.mkdir(current, { mode: options.mode });
+                }
+                catch (mkdirErr) {
+                    if (mkdirErr.code === "EEXIST") {
+                        continue;
+                    }
+                    throw mkdirErr;
+                }
+            }
+        }
+        const nextGuard = await createDirectoryGuardResult(current, scopeLabel);
+        if (!nextGuard.ok) {
+            return nextGuard;
+        }
+        const previousGuardStillValid = await assertGuardResult(currentGuard, scopeLabel);
+        if (!previousGuardStillValid.ok) {
+            return previousGuardStillValid;
+        }
+        currentGuard = nextGuard.guard;
+    }
+    const finalGuardResult = await assertGuardResult(currentGuard, scopeLabel);
+    if (!finalGuardResult.ok) {
+        return finalGuardResult;
+    }
+    return { ok: true, path: targetPath };
+}
+export async function canonicalPathFromExistingAncestor(filePath) {
+    const ancestor = await findExistingAncestor(filePath);
+    if (!ancestor) {
+        return path.resolve(filePath);
+    }
+    let canonicalAncestor = ancestor;
+    try {
+        canonicalAncestor = fsSync.realpathSync.native(ancestor);
+    }
+    catch {
+        // Keep lexical path when the existing ancestor cannot be canonicalized.
+    }
+    const relative = path.relative(ancestor, filePath);
+    return relative ? path.join(canonicalAncestor, relative) : canonicalAncestor;
+}
+export async function resolveAbsolutePathForRead(filePath, options = {}) {
+    const symlinks = resolveSymlinkPolicy(options.symlinks);
+    const normalized = assertAbsolutePathInput(filePath);
+    let canonicalPath;
+    try {
+        canonicalPath = fsSync.realpathSync.native(normalized);
+    }
+    catch (err) {
+        if (err.code === "ENOENT") {
+            throw new FsSafeError("not-found", "path not found", { cause: err });
+        }
+        throw err;
+    }
+    if (symlinks === "reject" && canonicalPath !== normalized) {
+        throw new FsSafeError("symlink", "path traverses a symlink", { cause: { canonicalPath } });
+    }
+    return { path: normalized, canonicalPath };
+}
+export async function resolveAbsolutePathForWrite(filePath, options = {}) {
+    const symlinks = resolveSymlinkPolicy(options.symlinks);
+    const normalized = assertAbsolutePathInput(filePath);
+    const parentDir = path.dirname(normalized);
+    const parentExists = await pathExists(parentDir);
+    if (symlinks === "reject") {
+        const filesystemRoot = path.parse(normalized).root;
+        await resolveRootPath({
+            absolutePath: normalized,
+            rootPath: filesystemRoot,
+            rootCanonicalPath: filesystemRoot,
+            boundaryLabel: "absolute path",
+            rejectSymlinks: true,
+        });
+    }
+    const canonicalPath = await canonicalPathFromExistingAncestor(normalized);
+    if (symlinks === "reject" && canonicalPath !== normalized) {
+        throw new FsSafeError("symlink", "path traverses a symlink", {
+            cause: { canonicalPath },
+        });
+    }
+    return {
+        path: normalized,
+        canonicalPath,
+        parentDir,
+        parentExists,
+    };
+}

package/node_modules/@openclaw/fs-safe/dist/advanced.d.ts

@@ -0,0 +1,26 @@
+export { createAsyncLock } from "./async-lock.js";
+export { stageFileInDirectory, type StagedFile, type StagedFileReceipt, type PublishedFileReceipt, type StagedFilePublication, type StagedFileCleanupReceipt, type StagedFileFailureDetails, } from "./native-staged-file.js";
+export { readFileDescriptorBounded, readFileDescriptorBoundedSync, readFileHandleBounded, } from "./bounded-read.js";
+export { assertNoUnsafeDeviceReadPath, isUnsafeDeviceReadPath, matchUnsafeDeviceReadPath, type UnsafeDeviceReadPathMatch, type UnsafeDeviceReadPathOptions, type UnsafeDeviceReadPathReason, } from "./device-path.js";
+export { assertAbsolutePathInput, canonicalPathFromExistingAncestor, ensureAbsoluteDirectory, findExistingAncestor, resolveAbsolutePathForRead, resolveAbsolutePathForWrite, type AbsolutePathSymlinkPolicy, type EnsureAbsoluteDirectoryOptions, type EnsureAbsoluteDirectoryResult, type ResolvedAbsolutePath, type ResolvedWritableAbsolutePath, } from "./absolute-path.js";
+export { sameFileIdentity, type FileIdentityStat } from "./file-identity.js";
+export { sanitizeUntrustedFileName } from "./filename.js";
+export { pathExists, pathExistsSync } from "./fs.js";
+export { resolveLocalPathFromRootsSync, readLocalFileFromRoots, type LocalRootsInputOptions, type LocalRootsPathResult, type LocalRootsReadResult, type ReadLocalFileFromRootsOptions, type ResolveLocalPathFromRootsSyncOptions, } from "./local-roots.js";
+export { assertNoWindowsNetworkPath, basenameFromMediaSource, hasEncodedFileUrlSeparator, isWindowsDriveLetterPath, isWindowsNetworkPath, safeFileURLToPath, trySafeFileURLToPath, } from "./local-file-access.js";
+export { formatPosixMode } from "./permissions.js";
+export { configureFsSafeLocks, getFsSafeLockConfig, type FsSafeLockConfig, } from "./lock-config.js";
+export { assertNoHardlinkedFinalPath, assertNoPathAliasEscape, PATH_ALIAS_POLICIES, type PathAliasPolicy, } from "./path-policy.js";
+export { openRootFile, openRootFileSync, canUseRootFileOpen, matchRootFileOpenFailure, type OpenRootFileParams, type OpenRootFileSyncParams, type RootFileOpenFailure, type RootFileOpenFailureReason, type RootFileOpenResult, } from "./root-file.js";
+export { ROOT_PATH_ALIAS_POLICIES, resolvePathViaExistingAncestorSync, resolveRootPath, resolveRootPathSync, type ResolvedRootPath, type RootPathAliasPolicy, } from "./root-path.js";
+export { ensureDirectoryWithinRoot, pathScope, resolveExistingPathsWithinRoot, resolvePathWithinRoot, resolvePathsWithinRoot, resolveStrictExistingPathsWithinRoot, resolveWritablePathWithinRoot, type PathScope, type PathScopeOptions, type PathScopeResolveOptions, } from "./root-paths.js";
+export { safeDirName, safePathSegmentHashed, resolveSafeInstallDir, assertCanonicalPathWithinBase, } from "./install-path.js";
+export { assertNoSymlinkParents, assertNoSymlinkParentsSync, type AssertNoSymlinkParentsOptions, } from "./symlink-parents.js";
+export { movePathToTrash, type MovePathToTrashOptions } from "./trash.js";
+export { withTimeout } from "./timing.js";
+export { resolveHomeRelativePath } from "./home-dir.js";
+export { appendRegularFile, appendRegularFileSync, readRegularFile, readRegularFileSync, resolveRegularFileAppendFlags, statRegularFile, statRegularFileSync, type AppendRegularFileOptions, type RegularFileStatResult, } from "./regular-file.js";
+export { buildRandomTempFilePath, sanitizeTempFileName, type TempFile, tempFile, withTempFile, } from "./temp-target.js";
+export { writeSiblingTempFile, writeViaSiblingTempPath, type WriteSiblingTempFileOptions, type WriteSiblingTempFileResult, } from "./sibling-temp.js";
+export { createIcaclsResetCommand, formatIcaclsResetCommand, formatWindowsAclSummary, inspectWindowsAcl, parseIcaclsOutput, resolveWindowsUserPrincipal, summarizeWindowsAcl, type IcaclsResetCommandOptions, type PermissionCommandFailure, type PermissionExec, type WindowsAclEntry, type WindowsAclSummary, } from "./permissions.js";
+//# sourceMappingURL=advanced.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/advanced.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advanced.d.ts","sourceRoot":"","sources":["../src/advanced.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,GAClC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EACL,6BAA6B,EAC7B,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,6BAA6B,EAClC,KAAK,oCAAoC,GAC1C,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,kCAAkC,EAClC,eAAe,EACf,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,SAAS,EACT,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,EACtB,oCAAoC,EACpC,6BAA6B,EAC7B,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,6BAA6B,EAC7B,eAAe,EACf,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,KAAK,QAAQ,EACb,QAAQ,EACR,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC"}

package/node_modules/@openclaw/fs-safe/dist/advanced.js

@@ -0,0 +1,28 @@
+// Advanced composition surface. These exports are less stable than the focused
+// public subpaths; prefer root/json/store/temp/archive unless you are building a
+// higher-level primitive.
+export { createAsyncLock } from "./async-lock.js";
+export { stageFileInDirectory, } from "./native-staged-file.js";
+export { readFileDescriptorBounded, readFileDescriptorBoundedSync, readFileHandleBounded, } from "./bounded-read.js";
+export { assertNoUnsafeDeviceReadPath, isUnsafeDeviceReadPath, matchUnsafeDeviceReadPath, } from "./device-path.js";
+export { assertAbsolutePathInput, canonicalPathFromExistingAncestor, ensureAbsoluteDirectory, findExistingAncestor, resolveAbsolutePathForRead, resolveAbsolutePathForWrite, } from "./absolute-path.js";
+export { sameFileIdentity } from "./file-identity.js";
+export { sanitizeUntrustedFileName } from "./filename.js";
+export { pathExists, pathExistsSync } from "./fs.js";
+export { resolveLocalPathFromRootsSync, readLocalFileFromRoots, } from "./local-roots.js";
+export { assertNoWindowsNetworkPath, basenameFromMediaSource, hasEncodedFileUrlSeparator, isWindowsDriveLetterPath, isWindowsNetworkPath, safeFileURLToPath, trySafeFileURLToPath, } from "./local-file-access.js";
+export { formatPosixMode } from "./permissions.js";
+export { configureFsSafeLocks, getFsSafeLockConfig, } from "./lock-config.js";
+export { assertNoHardlinkedFinalPath, assertNoPathAliasEscape, PATH_ALIAS_POLICIES, } from "./path-policy.js";
+export { openRootFile, openRootFileSync, canUseRootFileOpen, matchRootFileOpenFailure, } from "./root-file.js";
+export { ROOT_PATH_ALIAS_POLICIES, resolvePathViaExistingAncestorSync, resolveRootPath, resolveRootPathSync, } from "./root-path.js";
+export { ensureDirectoryWithinRoot, pathScope, resolveExistingPathsWithinRoot, resolvePathWithinRoot, resolvePathsWithinRoot, resolveStrictExistingPathsWithinRoot, resolveWritablePathWithinRoot, } from "./root-paths.js";
+export { safeDirName, safePathSegmentHashed, resolveSafeInstallDir, assertCanonicalPathWithinBase, } from "./install-path.js";
+export { assertNoSymlinkParents, assertNoSymlinkParentsSync, } from "./symlink-parents.js";
+export { movePathToTrash } from "./trash.js";
+export { withTimeout } from "./timing.js";
+export { resolveHomeRelativePath } from "./home-dir.js";
+export { appendRegularFile, appendRegularFileSync, readRegularFile, readRegularFileSync, resolveRegularFileAppendFlags, statRegularFile, statRegularFileSync, } from "./regular-file.js";
+export { buildRandomTempFilePath, sanitizeTempFileName, tempFile, withTempFile, } from "./temp-target.js";
+export { writeSiblingTempFile, writeViaSiblingTempPath, } from "./sibling-temp.js";
+export { createIcaclsResetCommand, formatIcaclsResetCommand, formatWindowsAclSummary, inspectWindowsAcl, parseIcaclsOutput, resolveWindowsUserPrincipal, summarizeWindowsAcl, } from "./permissions.js";

package/node_modules/@openclaw/fs-safe/dist/archive-crc32.d.ts

@@ -0,0 +1,2 @@
+export declare function updateCrc32(previous: number, buffer: Buffer): number;
+//# sourceMappingURL=archive-crc32.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-crc32.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-crc32.d.ts","sourceRoot":"","sources":["../src/archive-crc32.ts"],"names":[],"mappings":"AAQA,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAMpE"}

package/node_modules/@openclaw/fs-safe/dist/archive-crc32.js

@@ -0,0 +1,14 @@
+const CRC32_TABLE = Array.from({ length: 256 }, (_, index) => {
+    let value = index;
+    for (let bit = 0; bit < 8; bit += 1) {
+        value = (value & 1) !== 0 ? 0xedb88320 ^ (value >>> 1) : value >>> 1;
+    }
+    return value >>> 0;
+});
+export function updateCrc32(previous, buffer) {
+    let crc = previous ^ -1;
+    for (const byte of buffer) {
+        crc = (crc >>> 8) ^ (CRC32_TABLE[(crc ^ byte) & 0xff] ?? 0);
+    }
+    return (crc ^ -1) >>> 0;
+}

package/node_modules/@openclaw/fs-safe/dist/archive-deadline.d.ts

@@ -0,0 +1,12 @@
+export type ExtractionDeadline = {
+    signal: AbortSignal;
+    check: () => void;
+    ownDestinationMutation: <T>(run: () => Promise<T>) => Promise<T>;
+    waitForDestinationMutations: () => Promise<void>;
+    dispose: () => void;
+};
+export declare function ownExtractionDestinationMutation<T>(deadline: ExtractionDeadline | undefined, run: () => Promise<T>): Promise<T>;
+export declare function createPipelineTimeoutError(err: unknown, deadline: ExtractionDeadline): unknown;
+export declare function waitForDeadline<T>(promise: Promise<T>, deadline: ExtractionDeadline): Promise<T>;
+export declare function withExtractionDeadline<T>(timeoutMs: number, label: string, run: (deadline: ExtractionDeadline) => Promise<T>): Promise<T>;
+//# sourceMappingURL=archive-deadline.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-deadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-deadline.d.ts","sourceRoot":"","sources":["../src/archive-deadline.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,sBAAsB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACjE,2BAA2B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB,CAAC;AAEF,wBAAsB,gCAAgC,CAAC,CAAC,EACtD,QAAQ,EAAE,kBAAkB,GAAG,SAAS,EACxC,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACpB,OAAO,CAAC,CAAC,CAAC,CAEZ;AAWD,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAST;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAyDD,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,CAAC,CAAC,CAkBZ"}

package/node_modules/@openclaw/fs-safe/dist/archive-deadline.js

@@ -0,0 +1,103 @@
+export async function ownExtractionDestinationMutation(deadline, run) {
+    return deadline ? await deadline.ownDestinationMutation(run) : await run();
+}
+function signalReason(signal, fallback) {
+    const reason = signal.reason;
+    return reason instanceof Error ? reason : fallback ?? new Error(String(reason));
+}
+function deadlineReason(deadline) {
+    return signalReason(deadline.signal);
+}
+export function createPipelineTimeoutError(err, deadline) {
+    if (deadline.signal.aborted &&
+        err instanceof Error &&
+        (err.name === "AbortError" || err.message === "The operation was aborted")) {
+        return deadlineReason(deadline);
+    }
+    return err;
+}
+export async function waitForDeadline(promise, deadline) {
+    deadline.check();
+    if (deadline.signal.aborted) {
+        throw deadlineReason(deadline);
+    }
+    return await Promise.race([
+        promise,
+        new Promise((_, reject) => {
+            const abort = () => reject(deadlineReason(deadline));
+            deadline.signal.addEventListener("abort", abort, { once: true });
+            const cleanup = () => {
+                deadline.signal.removeEventListener("abort", abort);
+            };
+            promise.then(cleanup, cleanup);
+        }),
+    ]);
+}
+function createDestinationMutationOwner(check) {
+    const active = new Set();
+    return {
+        ownDestinationMutation: async (run) => {
+            check();
+            const operation = Promise.resolve().then(run);
+            const tracked = operation.then(() => undefined, () => undefined);
+            active.add(tracked);
+            void tracked.finally(() => active.delete(tracked));
+            return await operation;
+        },
+        waitForDestinationMutations: async () => {
+            while (active.size > 0) {
+                await Promise.all(active);
+            }
+        },
+    };
+}
+function createExtractionDeadline(timeoutMs, label) {
+    const controller = new AbortController();
+    const timeoutError = new Error(`${label} timed out after ${timeoutMs}ms`);
+    const check = () => {
+        if (controller.signal.aborted) {
+            throw signalReason(controller.signal, timeoutError);
+        }
+    };
+    const mutationOwner = createDestinationMutationOwner(check);
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+        return {
+            signal: controller.signal,
+            check,
+            ...mutationOwner,
+            dispose: () => undefined,
+        };
+    }
+    const timeoutId = setTimeout(() => {
+        controller.abort(timeoutError);
+    }, timeoutMs);
+    return {
+        signal: controller.signal,
+        check,
+        ...mutationOwner,
+        dispose: () => {
+            clearTimeout(timeoutId);
+        },
+    };
+}
+export async function withExtractionDeadline(timeoutMs, label, run) {
+    const deadline = createExtractionDeadline(timeoutMs, label);
+    const operation = Promise.resolve().then(async () => await run(deadline));
+    try {
+        deadline.check();
+        try {
+            return await waitForDeadline(operation, deadline);
+        }
+        catch (error) {
+            if (deadline.signal.aborted && error === deadlineReason(deadline)) {
+                // Preserve prompt timeout settlement for non-mutating work, but never
+                // return while live destination publication or rollback is still owned.
+                await deadline.waitForDestinationMutations();
+            }
+            throw error;
+        }
+    }
+    finally {
+        deadline.dispose();
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/archive-entry.d.ts

@@ -0,0 +1,14 @@
+export declare function isWindowsDrivePath(value: string): boolean;
+export declare function normalizeArchiveEntryPath(raw: string): string;
+export declare function validateArchiveEntryPath(entryPath: string, params?: {
+    escapeLabel?: string;
+}): void;
+export declare function stripArchivePath(entryPath: string, stripComponents: number): string | null;
+export declare function createArchiveOutputPathTracker(): (entryPath: string, originalPath: string) => void;
+export declare function resolveArchiveOutputPath(params: {
+    rootDir: string;
+    relPath: string;
+    originalPath: string;
+    escapeLabel?: string;
+}): string;
+//# sourceMappingURL=archive-entry.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-entry.d.ts","sourceRoot":"","sources":["../src/archive-entry.ts"],"names":[],"mappings":"AAMA,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIzD;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAChC,IAAI,CAoEN;AAGD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAc1F;AAED,wBAAgB,8BAA8B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,IAAI,CAgBlG;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAWT"}

package/node_modules/@openclaw/fs-safe/dist/archive-entry.js

@@ -0,0 +1,85 @@
+import path from "node:path";
+import { ArchiveSecurityError } from "./archive-errors.js";
+import { isWindowsReservedDeviceName } from "./device-path.js";
+import { formatErrorDetail } from "./error-detail.js";
+import { resolveSafeBaseDir } from "./path.js";
+export function isWindowsDrivePath(value) {
+    return normalizeArchiveEntryPath(value)
+        .split("/")
+        .some((segment) => /^[a-zA-Z]:/.test(segment));
+}
+export function normalizeArchiveEntryPath(raw) {
+    return raw.replaceAll("\\", "/");
+}
+export function validateArchiveEntryPath(entryPath, params) {
+    if (!entryPath || entryPath === "." || entryPath === "./") {
+        return;
+    }
+    if (isWindowsDrivePath(entryPath)) {
+        throw new ArchiveSecurityError("entry-path", `archive entry uses a drive path: ${formatErrorDetail(entryPath)}`);
+    }
+    if (entryPath.includes("\0")) {
+        throw new ArchiveSecurityError("entry-path", `archive entry contains a NUL byte: ${formatErrorDetail(entryPath)}`);
+    }
+    const slashNormalized = normalizeArchiveEntryPath(entryPath);
+    if (process.platform === "win32" &&
+        slashNormalized.split("/").some((segment) => segment.includes(":"))) {
+        throw new ArchiveSecurityError("entry-path", `archive entry uses a Windows alternate data stream path: ${formatErrorDetail(entryPath)}`);
+    }
+    if (process.platform === "win32" &&
+        slashNormalized.split("/").some((segment) => isWindowsReservedDeviceName(segment))) {
+        throw new ArchiveSecurityError("entry-path", `archive entry uses a reserved device path: ${formatErrorDetail(entryPath)}`);
+    }
+    const normalized = path.posix.normalize(slashNormalized);
+    if (normalized.split("/").some((segment) => Math.max(Buffer.byteLength(segment.normalize("NFC")), Buffer.byteLength(segment.normalize("NFD"))) > 255)) {
+        throw new ArchiveSecurityError("entry-path", `archive entry has an overlong path component: ${formatErrorDetail(entryPath)}`);
+    }
+    const escapeLabel = params?.escapeLabel ?? "destination";
+    if (normalized === ".." || normalized.startsWith("../")) {
+        throw new ArchiveSecurityError("entry-path", `archive entry escapes ${escapeLabel}: ${formatErrorDetail(entryPath)}`);
+    }
+    if (path.posix.isAbsolute(normalized) || normalized.startsWith("//")) {
+        throw new ArchiveSecurityError("entry-path", `archive entry is absolute: ${formatErrorDetail(entryPath)}`);
+    }
+    if (slashNormalized.split("/").includes("..")) {
+        throw new ArchiveSecurityError("entry-path", `archive entry contains a parent segment: ${formatErrorDetail(entryPath)}`);
+    }
+}
+// Validate raw paths first. Zero stripping gives the canonical policy identity.
+export function stripArchivePath(entryPath, stripComponents) {
+    const raw = normalizeArchiveEntryPath(entryPath);
+    if (!raw || raw === "." || raw === "./") {
+        return null;
+    }
+    const parts = raw.split("/").filter((part) => part.length > 0 && part !== ".");
+    const strip = Math.max(0, Math.floor(stripComponents));
+    const stripped = strip === 0 ? parts.join("/") : parts.slice(strip).join("/");
+    const result = path.posix.normalize(stripped);
+    if (!result || result === "." || result === "./") {
+        return null;
+    }
+    return result;
+}
+export function createArchiveOutputPathTracker() {
+    const seen = new Set();
+    return (entryPath, originalPath) => {
+        const normalized = path.posix.normalize(normalizeArchiveEntryPath(entryPath));
+        // Archive policy must not depend on the destination volume's case or
+        // Unicode-normalization behavior. Otherwise the JavaScript and native
+        // writers can disagree about which of two colliding entries wins.
+        const collisionKey = normalized.normalize("NFC").toLowerCase().normalize("NFC");
+        if (seen.has(collisionKey)) {
+            throw new ArchiveSecurityError("entry-path", `archive entries collide at output path ${formatErrorDetail(normalized)}: ${formatErrorDetail(originalPath)}`);
+        }
+        seen.add(collisionKey);
+    };
+}
+export function resolveArchiveOutputPath(params) {
+    const safeBase = resolveSafeBaseDir(params.rootDir);
+    const outPath = path.resolve(params.rootDir, params.relPath);
+    const escapeLabel = params.escapeLabel ?? "destination";
+    if (!outPath.startsWith(safeBase)) {
+        throw new ArchiveSecurityError("entry-path", `archive entry escapes ${escapeLabel}: ${formatErrorDetail(params.originalPath)}`);
+    }
+    return outPath;
+}

package/node_modules/@openclaw/fs-safe/dist/archive-errors.d.ts

@@ -0,0 +1,13 @@
+export type ArchiveFormatErrorCode = "archive-header-invalid";
+export type ArchiveSecurityErrorCode = "destination-not-directory" | "destination-symlink" | "destination-symlink-traversal" | "entry-filtered" | "entry-link" | "entry-path";
+export declare class ArchiveSecurityError extends Error {
+    readonly code: ArchiveSecurityErrorCode;
+    constructor(code: ArchiveSecurityErrorCode, message: string, options?: ErrorOptions);
+}
+export declare class ArchiveFormatError extends Error {
+    readonly code: ArchiveFormatErrorCode;
+    constructor(message: string, options?: ErrorOptions);
+}
+export declare function isArchiveFormatErrorMessage(message: string): boolean;
+export declare function isArchiveTarPathErrorMessage(message: string): boolean;
+//# sourceMappingURL=archive-errors.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-errors.d.ts","sourceRoot":"","sources":["../src/archive-errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAE9D,MAAM,MAAM,wBAAwB,GAChC,2BAA2B,GAC3B,qBAAqB,GACrB,+BAA+B,GAC/B,gBAAgB,GAChB,YAAY,GACZ,YAAY,CAAC;AAEjB,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IAExC,YAAY,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,EAIlF;CACF;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAEtC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,EAIlD;CACF;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAKpE;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE"}