@openclaw/openshell-sandbox 2026.9.3 → 2026.9.5

package/node_modules/@openclaw/fs-safe/dist/json-durable-queue-read.js

@@ -0,0 +1,61 @@
+import fs, {} from "node:fs";
+import { normalizeMaxBytes } from "./byte-budget.js";
+import { readBoundedAsync } from "./bounded-read.js";
+import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { inspectFileIdentity } from "./strict-file-identity.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
+export const DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES = 16 * 1024 * 1024;
+async function inspectQueueEntry(inspect, maxBytes, expected) {
+    let inspectionFailed = false;
+    try {
+        return await inspectFileIdentity(async () => {
+            try {
+                const stat = inspect();
+                if (stat.isSymbolicLink() || !stat.isFile()) {
+                    throw new Error("queue entry is not a regular file");
+                }
+                if (stat.nlink > 1n)
+                    throw new Error("queue entry hardlinks are not allowed");
+                if (stat.size > maxBytes)
+                    throw new Error(`queue entry exceeds ${maxBytes} bytes`);
+                return stat;
+            }
+            catch (error) {
+                inspectionFailed = true;
+                throw error;
+            }
+        }, expected);
+    }
+    catch (error) {
+        // Translate only the identity helper's rejection, never inspection errors.
+        if (inspectionFailed)
+            throw error;
+        throw new Error("queue entry changed during read", { cause: error });
+    }
+}
+export async function withJsonDurableQueueEntry(filePath, options, run) {
+    const maxBytes = normalizeMaxBytes(options.maxBytes, {
+        defaultValue: DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES,
+    });
+    assertNoWindowsPathAlias(filePath);
+    const inspectPath = () => fs.lstatSync(filePath, { bigint: true });
+    const initialStat = await inspectQueueEntry(inspectPath, maxBytes);
+    const handle = await fs.promises.open(filePath, resolveReadOpenFlags());
+    let closePromise;
+    const releaseReadPin = () => closePromise ??= (async () => { await handle.close(); })();
+    try {
+        const openedStat = await inspectQueueEntry(() => fs.fstatSync(handle.fd, { bigint: true }), maxBytes, initialStat);
+        await inspectQueueEntry(inspectPath, maxBytes, openedStat);
+        const bytes = await readBoundedAsync(maxBytes, async (buffer, length) => (await handle.read(buffer, 0, length, null)).bytesRead, {
+            initialSize: openedStat.size >= 0n && Number.isSafeInteger(Number(openedStat.size))
+                ? Number(openedStat.size) : undefined,
+            createLimitError: () => new Error(`queue entry exceeds ${maxBytes} bytes`),
+        });
+        // The migration owner may release this pin only at the verified publication
+        // boundary; until then an unlinked inode cannot be recycled into a new claim.
+        return await run(JSON.parse(bytes.toString("utf8")), openedStat, releaseReadPin);
+    }
+    finally {
+        await releaseReadPin();
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/json-durable-queue.d.ts

@@ -1,3 +1,4 @@
+export { DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES } from "./json-durable-queue-read.js";
 export type JsonDurableQueueEntryPaths = {
     jsonPath: string;
     deliveredPath: string;
@@ -14,7 +15,6 @@ export type JsonDurableQueueLoadOptions<T> = {
     cleanupTmpMaxAgeMs?: number;
     maxBytes?: number;
 };
-export declare const DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES: number;
 export declare function unlinkBestEffort(filePath: string): Promise<void>;
 export declare function jsonDurableQueueEntryExists(filePath: string): Promise<boolean>;
 export declare function resolveJsonDurableQueueEntryPaths(queueDir: string, id: string): JsonDurableQueueEntryPaths;

package/node_modules/@openclaw/fs-safe/dist/json-durable-queue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json-durable-queue.d.ts","sourceRoot":"","sources":["../src/json-durable-queue.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAOF,eAAO,MAAM,0CAA0C,QAAmB,CAAC;AAM3E,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;AAED,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUpF;AAmBD,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,GACT,0BAA0B,CAO5B;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AAgLD,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhB;AA6DD,wBAAsB,yBAAyB,CAAC,CAAC,EAC/C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClC,OAAO,CAAC,CAAC,CAAC,CASZ;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/F;AAED,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,MAAM,EAAE;IACzD,KAAK,EAAE,0BAA0B,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAsBpB;AAED,wBAAsB,kCAAkC,CAAC,CAAC,EACxD,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC,CAAC,EAAE,CAAC,CA8Dd;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB"}
+{"version":3,"file":"json-durable-queue.d.ts","sourceRoot":"","sources":["../src/json-durable-queue.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,0CAA0C,EAAE,MAAM,8BAA8B,CAAC;AAE1F,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAMF,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGtE;AAED,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAWpF;AAmBD,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,GACT,0BAA0B,CAQ5B;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhB;AAwID,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;AAmBD,wBAAsB,yBAAyB,CAAC,CAAC,EAC/C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClC,OAAO,CAAC,CAAC,CAAC,CAEZ;AAgBD,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/F;AAED,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,MAAM,EAAE;IACzD,KAAK,EAAE,0BAA0B,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAwBpB;AAED,wBAAsB,kCAAkC,CAAC,CAAC,EACxD,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC,CAAC,EAAE,CAAC,CA2Ed;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB"}

package/node_modules/@openclaw/fs-safe/dist/json-durable-queue.js

@@ -1,24 +1,30 @@
 import fs, {} from "node:fs";
 import path from "node:path";
-import { normalizeMaxBytes } from "./byte-budget.js";
 import { syncDirectory } from "./directory-durability.js";
 import { syncQueueDirectoryCreation } from "./json-durable-queue-directory.js";
-import { getErrorCode, acknowledgeDurableQueueEntry, claimDurableQueueEntry, completeDeliveredQueueEntry, moveDurableQueueEntryToFailed, } from "./json-durable-queue-ownership.js";
+import { queueValidationRoot, queueValidationRoots, resolveQueueFilesystemPath, } from "./json-durable-queue-paths.js";
+import { getErrorCode, acknowledgeDurableQueueEntry, claimDurableQueueEntry, completeDeliveredQueueEntry, migrateDurableQueueEntry, moveDurableQueueEntryToFailed, validateDurableQueueEntryPaths, } from "./json-durable-queue-ownership.js";
+import { withJsonDurableQueueEntry } from "./json-durable-queue-read.js";
 import { stringifyJsonDocument } from "./json-stringify.js";
-import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { realpathSync } from "./realpath.js";
+import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
 import { replaceFileAtomicWithDirectorySync } from "./replace-file.js";
 import { assertSafePathSegment } from "./safe-path-segment.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
-export const DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES = 16 * 1024 * 1024;
+import { admitStandalonePublicationPath } from "./standalone-publication-path.js";
+import { assertNoWindowsPathAlias, hasWindowsPathAlias, } from "./windows-path-alias.js";
+export { DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES } from "./json-durable-queue-read.js";
 function assertSafeQueueEntryId(id) {
     assertSafePathSegment(id, { label: "queue entry id" });
 }
 export async function unlinkBestEffort(filePath) {
+    if (hasWindowsPathAlias(filePath, "filesystem"))
+        return;
     await fs.promises.unlink(filePath).catch(() => undefined);
 }
 export async function jsonDurableQueueEntryExists(filePath) {
+    assertNoWindowsPathAlias(filePath);
     try {
-        const stat = await fs.promises.lstat(filePath);
+        const stat = fs.lstatSync(filePath);
         return stat.isFile();
     }
     catch (error) {
@@ -30,7 +36,7 @@ export async function jsonDurableQueueEntryExists(filePath) {
 }
 async function unlinkStaleTmpBestEffort(filePath, now, maxAgeMs) {
     try {
-        const stat = await fs.promises.stat(filePath);
+        const stat = fs.statSync(filePath);
         if (stat.isFile() && now - stat.mtimeMs >= maxAgeMs) {
             await unlinkBestEffort(filePath);
         }
@@ -43,6 +49,7 @@ async function unlinkStaleTmpBestEffort(filePath, now, maxAgeMs) {
 }
 export function resolveJsonDurableQueueEntryPaths(queueDir, id) {
     assertSafeQueueEntryId(id);
+    assertNoWindowsPathAlias(queueDir);
     return {
         jsonPath: path.join(queueDir, `${id}.json`),
         deliveredPath: path.join(queueDir, `${id}.delivered`),
@@ -50,16 +57,20 @@ export function resolveJsonDurableQueueEntryPaths(queueDir, id) {
     };
 }
 export async function ensureJsonDurableQueueDirs(params) {
-    const roots = await queueValidationRoots(params.queueDir, params.failedDir);
-    await ensureJsonDurableQueueDir(params.queueDir, roots.queueRoot);
-    await ensureJsonDurableQueueDir(params.failedDir, roots.failedRoot);
+    const queueDir = params.queueDir;
+    const failedDir = params.failedDir;
+    assertNoWindowsPathAlias(queueDir);
+    assertNoWindowsPathAlias(failedDir);
+    const roots = await queueValidationRoots(queueDir, failedDir);
+    await ensureJsonDurableQueueDir(queueDir, roots.queueRoot);
+    await ensureJsonDurableQueueDir(failedDir, roots.failedRoot);
 }
 async function ensureJsonDurableQueueDir(dir, validationRoot) {
     const root = validationRoot
         ? validationRoot
         : queueValidationRoot(dir);
     await assertNoSymlinkDirectorySegments(root, dir, true);
-    await fs.promises.mkdir(dir, { recursive: true, mode: 0o700 });
+    await fs.promises.mkdir(recursiveMkdirPath(dir), { recursive: true, mode: 0o700 });
     await assertNoSymlinkDirectorySegments(root, dir, false);
     await chmodQueueDirectory(dir);
     await syncQueueDirectoryCreation(dir, root.path);
@@ -70,41 +81,6 @@ async function assertJsonDurableQueueDir(dir, validationRoot) {
         : queueValidationRoot(dir);
     await assertNoSymlinkDirectorySegments(root, dir, false);
 }
-function commonPathAncestor(paths) {
-    const resolved = paths.map((entry) => path.resolve(entry));
-    const root = path.parse(resolved[0] ?? process.cwd()).root;
-    const parts = resolved.map((entry) => path.relative(root, entry).split(path.sep));
-    const common = [];
-    for (let index = 0; parts.every((part) => index < part.length); index++) {
-        const segment = parts[0]?.[index];
-        if (!segment || !parts.every((part) => part[index] === segment))
-            break;
-        common.push(segment);
-    }
-    return path.join(root, ...common);
-}
-function samePathRoot(paths) {
-    const roots = paths.map((entry) => path.parse(path.resolve(entry)).root);
-    const first = process.platform === "win32" ? roots[0]?.toLowerCase() : roots[0];
-    return roots.every((root) => (process.platform === "win32" ? root.toLowerCase() : root) === first);
-}
-async function queueValidationRoots(queueDir, failedDir) {
-    if (samePathRoot([queueDir, failedDir])) {
-        const common = commonPathAncestor([queueDir, failedDir]);
-        const root = queueValidationRoot(common);
-        return { failedRoot: root, queueRoot: root };
-    }
-    return {
-        failedRoot: queueValidationRoot(failedDir),
-        queueRoot: queueValidationRoot(queueDir),
-    };
-}
-function queueValidationRoot(dir) {
-    return {
-        path: path.parse(path.resolve(dir)).root,
-        allowSymlinkBase: process.platform === "darwin",
-    };
-}
 async function isDarwinSystemAlias(dir, stat) {
     if (process.platform !== "darwin" || !stat.isSymbolicLink()) {
         return false;
@@ -113,22 +89,27 @@ async function isDarwinSystemAlias(dir, stat) {
     if (resolved !== "/tmp" && resolved !== "/var") {
         return false;
     }
-    return await fs.promises.realpath(resolved).then((realPath) => realPath === `/private${resolved}`, () => false);
+    try {
+        return realpathSync.native(resolved) === `/private${resolved}`;
+    }
+    catch {
+        return false;
+    }
 }
 async function assertNoSymlinkDirectorySegments(validationRoot, dir, allowMissing) {
-    let base = path.resolve(validationRoot.path);
-    let target = path.resolve(dir);
+    let base = resolveQueueFilesystemPath(validationRoot.path);
+    let target = resolveQueueFilesystemPath(dir);
     let current = base;
-    let baseStat = await fs.promises.lstat(base);
+    let baseStat = fs.lstatSync(base);
     if (baseStat.isSymbolicLink() && validationRoot.allowSymlinkBase) {
         const relative = path.relative(base, target);
         if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
             throw new Error(`durable queue path is not a directory: ${dir}`);
         }
-        base = await fs.promises.realpath(base);
+        base = realpathSync.native(base);
         target = path.join(base, ...relative.split(path.sep).filter(Boolean));
         current = base;
-        baseStat = await fs.promises.lstat(base);
+        baseStat = fs.lstatSync(base);
     }
     if (baseStat.isSymbolicLink() || !baseStat.isDirectory()) {
         throw new Error(`durable queue path is not a directory: ${dir}`);
@@ -142,7 +123,7 @@ async function assertNoSymlinkDirectorySegments(validationRoot, dir, allowMissin
         current = path.join(current, segment);
         let stat;
         try {
-            stat = await fs.promises.lstat(current);
+            stat = fs.lstatSync(current);
         }
         catch (error) {
             if (allowMissing && error.code === "ENOENT") {
@@ -153,7 +134,7 @@ async function assertNoSymlinkDirectorySegments(validationRoot, dir, allowMissin
         if (stat.isSymbolicLink() || !stat.isDirectory()) {
             if (stat.isSymbolicLink() && validationRoot.allowSymlinkBase) {
                 if (await isDarwinSystemAlias(current, stat)) {
-                    current = await fs.promises.realpath(current);
+                    current = realpathSync.native(current);
                     continue;
                 }
             }
@@ -172,7 +153,7 @@ async function chmodQueueDirectory(dir) {
         let handle;
         try {
             handle = await fs.promises.open(dir, fs.constants.O_RDONLY | noFollow | directoryFlag);
-            const stat = await handle.stat();
+            const stat = fs.fstatSync(handle.fd);
             if (!stat.isDirectory()) {
                 throw new Error(`durable queue path is not a directory: ${dir}`);
             }
@@ -193,7 +174,7 @@ async function chmodQueueDirectory(dir) {
             }
         }
     }
-    const stat = await fs.promises.lstat(dir);
+    const stat = fs.lstatSync(dir);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
         throw new Error(`durable queue path is not a directory: ${dir}`);
     }
@@ -205,96 +186,51 @@ async function chmodQueueDirectory(dir) {
     }
 }
 export async function writeJsonDurableQueueEntry(params) {
+    await writeQueueEntry(params);
+}
+async function writeQueueEntry(params, beforeRename) {
+    const filePath = admitStandalonePublicationPath(params.filePath);
+    const entry = params.entry;
+    const tempPrefix = params.tempPrefix;
     await replaceFileAtomicWithDirectorySync({
-        filePath: params.filePath,
-        content: stringifyJsonDocument(params.entry, null, 2),
+        filePath,
+        content: stringifyJsonDocument(entry, null, 2),
         mode: 0o600,
-        tempPrefix: params.tempPrefix,
+        tempPrefix,
         syncTempFile: true,
+        beforeRename,
     }, syncDirectory);
 }
-async function inspectQueueEntry(inspect, maxBytes, expected) {
-    let inspectionFailed = false;
-    try {
-        return await inspectFileIdentity(async () => {
-            try {
-                const stat = await inspect();
-                if (stat.isSymbolicLink() || !stat.isFile()) {
-                    throw new Error("queue entry is not a regular file");
-                }
-                if (stat.nlink > 1n)
-                    throw new Error("queue entry hardlinks are not allowed");
-                if (stat.size > maxBytes)
-                    throw new Error(`queue entry exceeds ${maxBytes} bytes`);
-                return stat;
-            }
-            catch (error) {
-                inspectionFailed = true;
-                throw error;
-            }
-        }, expected);
-    }
-    catch (error) {
-        // Translate only the identity helper's rejection, never inspection errors.
-        if (inspectionFailed)
-            throw error;
-        throw new Error("queue entry changed during read", { cause: error });
-    }
-}
-async function readBoundedUtf8File(params) {
-    const inspectPath = () => fs.promises.lstat(params.filePath, { bigint: true });
-    const initialStat = await inspectQueueEntry(inspectPath, params.maxBytes);
-    const handle = await fs.promises.open(params.filePath, resolveReadOpenFlags());
-    try {
-        const openedStat = await inspectQueueEntry(() => handle.stat({ bigint: true }), params.maxBytes, initialStat);
-        await inspectQueueEntry(inspectPath, params.maxBytes, openedStat);
-        const chunks = [];
-        const scratch = Buffer.allocUnsafe(Math.min(64 * 1024, params.maxBytes + 1));
-        let total = 0;
-        while (true) {
-            const { bytesRead } = await handle.read(scratch, 0, scratch.length, null);
-            if (bytesRead === 0) {
-                return Buffer.concat(chunks, total).toString("utf8");
-            }
-            total += bytesRead;
-            if (total > params.maxBytes) {
-                throw new Error(`queue entry exceeds ${params.maxBytes} bytes`);
-            }
-            chunks.push(Buffer.from(scratch.subarray(0, bytesRead)));
-        }
-    }
-    finally {
-        await handle.close();
-    }
-}
 export async function readJsonDurableQueueEntry(filePath, options = {}) {
-    return JSON.parse(await readBoundedUtf8File({
-        filePath,
-        maxBytes: normalizeMaxBytes(options.maxBytes, {
-            defaultValue: DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES,
-        }),
-    }));
+    return await withJsonDurableQueueEntry(filePath, options, async (entry) => entry);
+}
+async function migrateClaimedQueueEntry(params) {
+    await migrateDurableQueueEntry(params.paths, params.identity, params.releaseReadPin, async (filePath, beforePublish) => {
+        await writeQueueEntry({ filePath, entry: params.entry, tempPrefix: params.tempPrefix }, beforePublish);
+    });
 }
 export async function ackJsonDurableQueueEntry(paths) {
     await acknowledgeDurableQueueEntry(paths);
 }
 export async function loadJsonDurableQueueEntry(params) {
     try {
-        const claimedPath = await claimDurableQueueEntry(params.paths);
+        const pathsInput = params.paths;
+        const paths = validateDurableQueueEntryPaths(pathsInput);
+        const claimedPath = await claimDurableQueueEntry(paths);
         if (!claimedPath)
             return null;
-        const raw = await readJsonDurableQueueEntry(claimedPath, {
+        return await withJsonDurableQueueEntry(claimedPath, {
             maxBytes: params.maxBytes,
+        }, async (raw, identity, releaseReadPin) => {
+            const read = params.read;
+            const result = read ? await Reflect.apply(read, params, [raw, paths.jsonPath]) : { entry: raw };
+            if (result.migrated) {
+                await migrateClaimedQueueEntry({
+                    paths, identity, releaseReadPin, entry: result.entry, tempPrefix: params.tempPrefix,
+                });
+            }
+            return result.entry;
         });
-        const result = params.read ? await params.read(raw, params.paths.jsonPath) : { entry: raw };
-        if (result.migrated) {
-            await writeJsonDurableQueueEntry({
-                filePath: claimedPath,
-                entry: result.entry,
-                tempPrefix: params.tempPrefix,
-            });
-        }
-        return result.entry;
     }
     catch (error) {
         if (getErrorCode(error) === "ENOENT") {
@@ -304,9 +240,11 @@ export async function loadJsonDurableQueueEntry(params) {
     }
 }
 export async function loadPendingJsonDurableQueueEntries(options) {
+    const queueDir = options.queueDir;
+    assertNoWindowsPathAlias(queueDir);
     let files;
     try {
-        files = await fs.promises.readdir(options.queueDir);
+        files = await fs.promises.readdir(queueDir);
     }
     catch (error) {
         if (getErrorCode(error) === "ENOENT") {
@@ -318,10 +256,17 @@ export async function loadPendingJsonDurableQueueEntries(options) {
     for (const file of files) {
         if (file.endsWith(".delivered")) {
             const id = file.slice(0, -".delivered".length);
-            await completeDeliveredQueueEntry(resolveJsonDurableQueueEntryPaths(options.queueDir, id));
+            try {
+                assertSafeQueueEntryId(id);
+            }
+            catch {
+                continue;
+            }
+            const paths = validateDurableQueueEntryPaths(resolveJsonDurableQueueEntryPaths(queueDir, id));
+            await completeDeliveredQueueEntry(paths);
         }
         else if (options.cleanupTmpMaxAgeMs !== undefined && file.endsWith(".tmp")) {
-            await unlinkStaleTmpBestEffort(path.join(options.queueDir, file), now, options.cleanupTmpMaxAgeMs);
+            await unlinkStaleTmpBestEffort(path.join(queueDir, file), now, options.cleanupTmpMaxAgeMs);
         }
     }
     const ids = [];
@@ -348,36 +293,46 @@ export async function loadPendingJsonDurableQueueEntries(options) {
     }
     const entries = [];
     for (const id of ids) {
-        const paths = resolveJsonDurableQueueEntryPaths(options.queueDir, id);
+        const paths = validateDurableQueueEntryPaths(resolveJsonDurableQueueEntryPaths(queueDir, id));
         const claimedPath = await claimDurableQueueEntry(paths, { skipUnowned: true });
         if (!claimedPath)
             continue;
-        let result;
+        let migrationStarted = false;
         try {
-            const raw = await readJsonDurableQueueEntry(claimedPath, { maxBytes: options.maxBytes });
-            result = options.read ? await options.read(raw, paths.jsonPath) : { entry: raw };
+            const entry = await withJsonDurableQueueEntry(claimedPath, { maxBytes: options.maxBytes }, async (raw, identity, releaseReadPin) => {
+                const read = options.read;
+                const result = read ? await Reflect.apply(read, options, [raw, paths.jsonPath]) : { entry: raw };
+                if (result.migrated) {
+                    migrationStarted = true;
+                    await migrateClaimedQueueEntry({
+                        paths, identity, releaseReadPin, entry: result.entry, tempPrefix: options.tempPrefix,
+                    });
+                }
+                return result.entry;
+            });
+            entries.push(entry);
         }
-        catch {
+        catch (error) {
+            if (migrationStarted)
+                throw error;
             continue;
         }
-        if (result.migrated) {
-            await writeJsonDurableQueueEntry({
-                filePath: claimedPath,
-                entry: result.entry,
-                tempPrefix: options.tempPrefix,
-            });
-        }
-        entries.push(result.entry);
     }
     return entries;
 }
 export async function moveJsonDurableQueueEntryToFailed(params) {
-    assertSafeQueueEntryId(params.id);
-    const roots = await queueValidationRoots(params.queueDir, params.failedDir);
-    await assertJsonDurableQueueDir(params.queueDir, roots.queueRoot);
-    await ensureJsonDurableQueueDir(params.failedDir, roots.failedRoot);
+    const id = params.id;
+    const queueDir = params.queueDir;
+    const failedDir = params.failedDir;
+    assertSafeQueueEntryId(id);
+    assertNoWindowsPathAlias(queueDir);
+    assertNoWindowsPathAlias(failedDir);
+    const roots = await queueValidationRoots(queueDir, failedDir);
+    await assertJsonDurableQueueDir(queueDir, roots.queueRoot);
+    await ensureJsonDurableQueueDir(failedDir, roots.failedRoot);
+    const paths = validateDurableQueueEntryPaths(resolveJsonDurableQueueEntryPaths(queueDir, id));
     await moveDurableQueueEntryToFailed({
-        paths: resolveJsonDurableQueueEntryPaths(params.queueDir, params.id),
-        failedPath: path.join(params.failedDir, `${params.id}.json`),
+        paths,
+        failedPath: path.join(failedDir, `${id}.json`),
     });
 }

package/node_modules/@openclaw/fs-safe/dist/json-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json-store.d.ts","sourceRoot":"","sources":["../src/json-store.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,oBAAoB,EAC1B,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI,oBAAoB,GAAG;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,YAAY,EAAE,oBAAoB,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;AAEtE,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAQvE"}
+{"version":3,"file":"json-store.d.ts","sourceRoot":"","sources":["../src/json-store.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,oBAAoB,EAC1B,MAAM,0BAA0B,CAAC;AAIlC,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI,oBAAoB,GAAG;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,YAAY,EAAE,oBAAoB,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;AAEtE,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAUvE"}

package/node_modules/@openclaw/fs-safe/dist/json-store.js

@@ -1,8 +1,12 @@
 import path from "node:path";
 import { fileStore } from "./file-store.js";
 import {} from "./json-document-store.js";
+import { admitStandalonePublicationPath } from "./standalone-publication-path.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export function jsonStore(options) {
-    const filePath = path.resolve(options.filePath);
+    const filePathInput = admitStandalonePublicationPath(options.filePath);
+    const filePath = path.resolve(filePathInput);
+    assertNoWindowsPathAlias(filePath);
     return fileStore({
         rootDir: path.dirname(filePath),
         private: true,

package/node_modules/@openclaw/fs-safe/dist/json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,SAAS,CAAC;AAO7B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE5E,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AA8JhF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,CAAC,GAAG,IAAI,CAUV;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,QAmB5D;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAElC,YAAY,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAKrE;CACF;AAED,MAAM,MAAM,4BAA4B,CAAC,CAAC,IACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,iCAAiC,CAAC,CAAC,IAAI;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,iCAAiC,CAAC,OAAO,CAAC,EAC1C,OAAO,GAAG,UAAU,GAAG,gBAAgB,CACxC,CAAC;AAgBF,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,OAAO,EAAE,iCAAiC,CAAC,CAAC,CAAC,GAC5C,4BAA4B,CAAC,CAAC,CAAC,CA4CjC;AAED,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1C,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,CAAC,CAAC,CAKjC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOvD;AAED,wBAAsB,WAAW,CAAC,CAAC,EACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAWnB;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,CAiB7F;AAED,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAmBnB;AAED,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,CAAC,CAYH;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,sBAAsB,EACtB,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,iBAAiB,CACnD,CAAC;AAEF,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,gBAAgB,iBAS3B"}
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,SAAS,CAAC;AAO7B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAI5E,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AA+JhF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,CAAC,GAAG,IAAI,CAUV;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,QAoB5D;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAElC,YAAY,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAKrE;CACF;AAED,MAAM,MAAM,4BAA4B,CAAC,CAAC,IACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,iCAAiC,CAAC,CAAC,IAAI;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,iCAAiC,CAAC,OAAO,CAAC,EAC1C,OAAO,GAAG,UAAU,GAAG,gBAAgB,CACxC,CAAC;AAgBF,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,OAAO,EAAE,iCAAiC,CAAC,CAAC,CAAC,GAC5C,4BAA4B,CAAC,CAAC,CAAC,CAEjC;AAkFD,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1C,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,CAAC,CAAC,CAIjC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAMvD;AAED,wBAAsB,WAAW,CAAC,CAAC,EACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAWnB;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,CAiB7F;AAED,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAmBnB;AAED,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,CAAC,CAYH;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,sBAAsB,EACtB,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,iBAAiB,CACnD,CAAC;AAEF,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,gBAAgB,iBAU3B"}