@openclaw/openshell-sandbox 2026.9.3 → 2026.9.5

package/node_modules/@openclaw/fs-safe/dist/absolute-path.js

@@ -4,7 +4,9 @@ import path from "node:path";
 import { assertAsyncDirectoryGuard, createAsyncDirectoryGuard, } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { pathExists } from "./fs.js";
+import { realpathSync } from "./realpath.js";
 import { resolveRootPath } from "./root-path.js";
+import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 function resolveSymlinkPolicy(policy) {
     if (policy === undefined)
         return "reject";
@@ -67,7 +69,7 @@ async function directoryGuardFailure(err, dir, scopeLabel) {
         return { ok: false, code: err.code, error: err };
     }
     try {
-        const stat = fsSync.lstatSync(dir);
+        const stat = fsSync.lstatSync(pathForWindowsFilesystem(dir));
         const failure = classifyExistingDirectorySegment(stat, scopeLabel);
         if (failure) {
             return failure;
@@ -87,7 +89,7 @@ async function resolveTrustedDirectoryPrefix(targetPath, scopeLabel) {
     let current = root;
     let currentStat;
     try {
-        currentStat = fsSync.lstatSync(current);
+        currentStat = fsSync.lstatSync(pathForWindowsFilesystem(current));
     }
     catch (err) {
         const failure = classifyDirectoryLookupError(err, scopeLabel);
@@ -111,7 +113,7 @@ async function resolveTrustedDirectoryPrefix(targetPath, scopeLabel) {
         }
         const next = path.join(current, segment);
         try {
-            const nextStat = fsSync.lstatSync(next);
+            const nextStat = fsSync.lstatSync(pathForWindowsFilesystem(next));
             const segmentFailure = classifyExistingDirectorySegment(nextStat, scopeLabel);
             if (segmentFailure) {
                 return segmentFailure;
@@ -144,19 +146,28 @@ export function assertAbsolutePathInput(filePath) {
     if (filePath.includes("\0")) {
         throw new FsSafeError("invalid-path", "path must not contain NUL bytes");
     }
+    assertNoWindowsPathAlias(filePath);
     if (!path.isAbsolute(filePath)) {
         throw new FsSafeError("invalid-path", "path must be absolute");
     }
-    return path.normalize(filePath);
+    const normalized = path.normalize(filePath);
+    assertNoWindowsPathAlias(normalized);
+    return normalized;
 }
 export async function findExistingAncestor(filePath) {
+    assertNoWindowsPathAlias(filePath);
     return (await findExistingAncestorWithStat(filePath))?.path ?? null;
 }
 async function findExistingAncestorWithStat(filePath) {
-    let current = path.resolve(filePath);
+    assertNoWindowsPathAlias(filePath);
+    let current = resolvePathPreservingWindowsRoot(filePath);
+    assertNoWindowsPathAlias(current);
     while (true) {
         try {
-            return { path: current, stat: fsSync.lstatSync(current) };
+            return {
+                path: current,
+                stat: fsSync.lstatSync(pathForWindowsFilesystem(current)),
+            };
         }
         catch (err) {
             if (err.code !== "ENOENT") {
@@ -245,26 +256,37 @@ export async function ensureAbsoluteDirectory(dirPath, options = {}) {
     return { ok: true, path: targetPath };
 }
 export async function canonicalPathFromExistingAncestor(filePath) {
+    assertNoWindowsPathAlias(filePath);
     const ancestor = await findExistingAncestor(filePath);
     if (!ancestor) {
-        return path.resolve(filePath);
+        const resolved = resolvePathPreservingWindowsRoot(filePath);
+        assertNoWindowsPathAlias(resolved);
+        return resolved;
     }
     let canonicalAncestor = ancestor;
+    let resolvedAncestor;
     try {
-        canonicalAncestor = fsSync.realpathSync.native(ancestor);
+        resolvedAncestor = realpathSync.native(pathForWindowsFilesystem(ancestor));
     }
     catch {
         // Keep lexical path when the existing ancestor cannot be canonicalized.
     }
+    if (resolvedAncestor !== undefined) {
+        assertNoWindowsPathAlias(resolvedAncestor);
+        canonicalAncestor = resolvedAncestor;
+    }
     const relative = path.relative(ancestor, filePath);
-    return relative ? path.join(canonicalAncestor, relative) : canonicalAncestor;
+    const canonicalPath = relative ? path.join(canonicalAncestor, relative) : canonicalAncestor;
+    assertNoWindowsPathAlias(canonicalPath);
+    return canonicalPath;
 }
 export async function resolveAbsolutePathForRead(filePath, options = {}) {
     const symlinks = resolveSymlinkPolicy(options.symlinks);
     const normalized = assertAbsolutePathInput(filePath);
     let canonicalPath;
     try {
-        canonicalPath = fsSync.realpathSync.native(normalized);
+        canonicalPath = realpathSync.native(pathForWindowsFilesystem(normalized));
+        assertNoWindowsPathAlias(canonicalPath);
     }
     catch (err) {
         if (err.code === "ENOENT") {
@@ -281,7 +303,7 @@ export async function resolveAbsolutePathForWrite(filePath, options = {}) {
     const symlinks = resolveSymlinkPolicy(options.symlinks);
     const normalized = assertAbsolutePathInput(filePath);
     const parentDir = path.dirname(normalized);
-    const parentExists = await pathExists(parentDir);
+    const parentExists = await pathExists(pathForWindowsFilesystem(parentDir));
     if (symlinks === "reject") {
         const filesystemRoot = path.parse(normalized).root;
         await resolveRootPath({

package/node_modules/@openclaw/fs-safe/dist/advanced.d.ts

@@ -1,6 +1,13 @@
 export { createAsyncLock } from "./async-lock.js";
+export { copyFileHandle, type CopyFileHandleOptions } from "./file-handle-transfer.js";
+export { overwriteFileHandle, type OverwriteFileHandleOptions } from "./overwrite-file-handle.js";
+export { probePathCaseInsensitiveSync, type ProbePathCaseOptions } from "./path-case.js";
+export { resolvePathPrefixSync, type ResolvedPathPrefix } from "./path-prefix.js";
+export { probePathSuffixAliasesSync, type ProbePathSuffixAliasesOptions } from "./path-suffix-aliases.js";
+export { readDirectoryIdentity, assertDirectoryIdentitySync, type DirectoryIdentity, } from "./directory-guard.js";
 export { stageFileInDirectory, type StagedFile, type StagedFileReceipt, type PublishedFileReceipt, type StagedFilePublication, type StagedFileCleanupReceipt, type StagedFileFailureDetails, } from "./native-staged-file.js";
 export { readFileDescriptorBounded, readFileDescriptorBoundedSync, readFileHandleBounded, } from "./bounded-read.js";
+export { readFileWindowFully, readFileWindowFullySync, type ReadFileWindowOptions, } from "./positional-read.js";
 export { assertNoUnsafeDeviceReadPath, isUnsafeDeviceReadPath, matchUnsafeDeviceReadPath, type UnsafeDeviceReadPathMatch, type UnsafeDeviceReadPathOptions, type UnsafeDeviceReadPathReason, } from "./device-path.js";
 export { assertAbsolutePathInput, canonicalPathFromExistingAncestor, ensureAbsoluteDirectory, findExistingAncestor, resolveAbsolutePathForRead, resolveAbsolutePathForWrite, type AbsolutePathSymlinkPolicy, type EnsureAbsoluteDirectoryOptions, type EnsureAbsoluteDirectoryResult, type ResolvedAbsolutePath, type ResolvedWritableAbsolutePath, } from "./absolute-path.js";
 export { sameFileIdentity, type FileIdentityStat } from "./file-identity.js";
@@ -14,7 +21,7 @@ export { assertNoHardlinkedFinalPath, assertNoPathAliasEscape, PATH_ALIAS_POLICI
 export { openRootFile, openRootFileSync, canUseRootFileOpen, matchRootFileOpenFailure, type OpenRootFileParams, type OpenRootFileSyncParams, type RootFileOpenFailure, type RootFileOpenFailureReason, type RootFileOpenResult, } from "./root-file.js";
 export { ROOT_PATH_ALIAS_POLICIES, resolvePathViaExistingAncestorSync, resolveRootPath, resolveRootPathSync, type ResolvedRootPath, type RootPathAliasPolicy, } from "./root-path.js";
 export { ensureDirectoryWithinRoot, pathScope, resolveExistingPathsWithinRoot, resolvePathWithinRoot, resolvePathsWithinRoot, resolveStrictExistingPathsWithinRoot, resolveWritablePathWithinRoot, type PathScope, type PathScopeOptions, type PathScopeResolveOptions, } from "./root-paths.js";
-export { safeDirName, safePathSegmentHashed, resolveSafeInstallDir, assertCanonicalPathWithinBase, } from "./install-path.js";
+export { safeDirName, safePathSegmentHashed, safePathSegmentHashedV2, resolveSafeInstallDir, assertCanonicalPathWithinBase, } from "./install-path.js";
 export { assertNoSymlinkParents, assertNoSymlinkParentsSync, type AssertNoSymlinkParentsOptions, } from "./symlink-parents.js";
 export { movePathToTrash, type MovePathToTrashOptions } from "./trash.js";
 export { withTimeout } from "./timing.js";

package/node_modules/@openclaw/fs-safe/dist/advanced.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"advanced.d.ts","sourceRoot":"","sources":["../src/advanced.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,GAClC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EACL,6BAA6B,EAC7B,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,6BAA6B,EAClC,KAAK,oCAAoC,GAC1C,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,kCAAkC,EAClC,eAAe,EACf,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,SAAS,EACT,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,EACtB,oCAAoC,EACpC,6BAA6B,EAC7B,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,6BAA6B,EAC7B,eAAe,EACf,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,KAAK,QAAQ,EACb,QAAQ,EACR,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"advanced.d.ts","sourceRoot":"","sources":["../src/advanced.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,KAAK,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,EAAE,4BAA4B,EAAE,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,KAAK,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAC1G,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,KAAK,iBAAiB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,iCAAiC,EACjC,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,GAClC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EACL,6BAA6B,EAC7B,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,6BAA6B,EAClC,KAAK,oCAAoC,GAC1C,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,kCAAkC,EAClC,eAAe,EACf,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,SAAS,EACT,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,EACtB,oCAAoC,EACpC,6BAA6B,EAC7B,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,6BAA6B,EAC7B,eAAe,EACf,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,KAAK,QAAQ,EACb,QAAQ,EACR,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC"}

package/node_modules/@openclaw/fs-safe/dist/advanced.js

@@ -2,8 +2,15 @@
 // public subpaths; prefer root/json/store/temp/archive unless you are building a
 // higher-level primitive.
 export { createAsyncLock } from "./async-lock.js";
+export { copyFileHandle } from "./file-handle-transfer.js";
+export { overwriteFileHandle } from "./overwrite-file-handle.js";
+export { probePathCaseInsensitiveSync } from "./path-case.js";
+export { resolvePathPrefixSync } from "./path-prefix.js";
+export { probePathSuffixAliasesSync } from "./path-suffix-aliases.js";
+export { readDirectoryIdentity, assertDirectoryIdentitySync, } from "./directory-guard.js";
 export { stageFileInDirectory, } from "./native-staged-file.js";
 export { readFileDescriptorBounded, readFileDescriptorBoundedSync, readFileHandleBounded, } from "./bounded-read.js";
+export { readFileWindowFully, readFileWindowFullySync, } from "./positional-read.js";
 export { assertNoUnsafeDeviceReadPath, isUnsafeDeviceReadPath, matchUnsafeDeviceReadPath, } from "./device-path.js";
 export { assertAbsolutePathInput, canonicalPathFromExistingAncestor, ensureAbsoluteDirectory, findExistingAncestor, resolveAbsolutePathForRead, resolveAbsolutePathForWrite, } from "./absolute-path.js";
 export { sameFileIdentity } from "./file-identity.js";
@@ -17,7 +24,7 @@ export { assertNoHardlinkedFinalPath, assertNoPathAliasEscape, PATH_ALIAS_POLICI
 export { openRootFile, openRootFileSync, canUseRootFileOpen, matchRootFileOpenFailure, } from "./root-file.js";
 export { ROOT_PATH_ALIAS_POLICIES, resolvePathViaExistingAncestorSync, resolveRootPath, resolveRootPathSync, } from "./root-path.js";
 export { ensureDirectoryWithinRoot, pathScope, resolveExistingPathsWithinRoot, resolvePathWithinRoot, resolvePathsWithinRoot, resolveStrictExistingPathsWithinRoot, resolveWritablePathWithinRoot, } from "./root-paths.js";
-export { safeDirName, safePathSegmentHashed, resolveSafeInstallDir, assertCanonicalPathWithinBase, } from "./install-path.js";
+export { safeDirName, safePathSegmentHashed, safePathSegmentHashedV2, resolveSafeInstallDir, assertCanonicalPathWithinBase, } from "./install-path.js";
 export { assertNoSymlinkParents, assertNoSymlinkParentsSync, } from "./symlink-parents.js";
 export { movePathToTrash } from "./trash.js";
 export { withTimeout } from "./timing.js";

package/node_modules/@openclaw/fs-safe/dist/archive-crc32.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-crc32.d.ts","sourceRoot":"","sources":["../src/archive-crc32.ts"],"names":[],"mappings":"AAQA,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAMpE"}
+{"version":3,"file":"archive-crc32.d.ts","sourceRoot":"","sources":["../src/archive-crc32.ts"],"names":[],"mappings":"AAYA,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAOpE"}

package/node_modules/@openclaw/fs-safe/dist/archive-crc32.js

@@ -1,4 +1,7 @@
-const CRC32_TABLE = Array.from({ length: 256 }, (_, index) => {
+import zlib from "node:zlib";
+const nativeCrc32 = zlib.crc32;
+// Node 22.0–22.1 are supported but predate zlib.crc32.
+const CRC32_TABLE = nativeCrc32 ? undefined : Array.from({ length: 256 }, (_, index) => {
     let value = index;
     for (let bit = 0; bit < 8; bit += 1) {
         value = (value & 1) !== 0 ? 0xedb88320 ^ (value >>> 1) : value >>> 1;
@@ -6,6 +9,8 @@ const CRC32_TABLE = Array.from({ length: 256 }, (_, index) => {
     return value >>> 0;
 });
 export function updateCrc32(previous, buffer) {
+    if (nativeCrc32)
+        return nativeCrc32(buffer, previous >>> 0);
     let crc = previous ^ -1;
     for (const byte of buffer) {
         crc = (crc >>> 8) ^ (CRC32_TABLE[(crc ^ byte) & 0xff] ?? 0);

package/node_modules/@openclaw/fs-safe/dist/archive-deadline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-deadline.d.ts","sourceRoot":"","sources":["../src/archive-deadline.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,sBAAsB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACjE,2BAA2B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB,CAAC;AAEF,wBAAsB,gCAAgC,CAAC,CAAC,EACtD,QAAQ,EAAE,kBAAkB,GAAG,SAAS,EACxC,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACpB,OAAO,CAAC,CAAC,CAAC,CAEZ;AAWD,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAST;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAyDD,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,CAAC,CAAC,CAkBZ"}
+{"version":3,"file":"archive-deadline.d.ts","sourceRoot":"","sources":["../src/archive-deadline.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,sBAAsB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACjE,2BAA2B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB,CAAC;AAEF,wBAAsB,gCAAgC,CAAC,CAAC,EACtD,QAAQ,EAAE,kBAAkB,GAAG,SAAS,EACxC,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACpB,OAAO,CAAC,CAAC,CAAC,CAEZ;AAWD,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAST;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAuDD,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,CAAC,CAAC,CAkBZ"}

package/node_modules/@openclaw/fs-safe/dist/archive-deadline.js

@@ -1,3 +1,4 @@
+import { scheduleTimeout } from "./timing.js";
 export async function ownExtractionDestinationMutation(deadline, run) {
     return deadline ? await deadline.ownDestinationMutation(run) : await run();
 }
@@ -68,16 +69,14 @@ function createExtractionDeadline(timeoutMs, label) {
             dispose: () => undefined,
         };
     }
-    const timeoutId = setTimeout(() => {
+    const cancelTimeout = scheduleTimeout(() => {
         controller.abort(timeoutError);
     }, timeoutMs);
     return {
         signal: controller.signal,
         check,
         ...mutationOwner,
-        dispose: () => {
-            clearTimeout(timeoutId);
-        },
+        dispose: cancelTimeout,
     };
 }
 export async function withExtractionDeadline(timeoutMs, label, run) {

package/node_modules/@openclaw/fs-safe/dist/archive-durability.d.ts

@@ -0,0 +1,24 @@
+import { type ExtractionDeadline } from "./archive-deadline.js";
+import { type ArchiveDirectoryGuard } from "./archive-staging.js";
+import type { PublishedWriteIdentity } from "./pinned-write.js";
+import type { Root } from "./root.js";
+export type ArchivePublishedFile = {
+    relativePath: string;
+    identity: PublishedWriteIdentity;
+    guards: readonly ArchiveDirectoryGuard[];
+};
+export type ArchivePublishedDirectory = {
+    guard: ArchiveDirectoryGuard;
+    parents: readonly ArchiveDirectoryGuard[];
+    mode: number;
+};
+export declare function finalizeArchivePublication(params: {
+    targetRoot: Root;
+    destinationGuard: ArchiveDirectoryGuard;
+    sourceGuard: ArchiveDirectoryGuard;
+    files: readonly ArchivePublishedFile[];
+    directories: readonly ArchivePublishedDirectory[];
+    durable: boolean;
+    deadline?: ExtractionDeadline;
+}): Promise<void>;
+//# sourceMappingURL=archive-durability.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-durability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-durability.d.ts","sourceRoot":"","sources":["../src/archive-durability.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoC,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAMtC,MAAM,MAAM,oBAAoB,GAAG;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,sBAAsB,CAAC;IACjC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC1C,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,UAAU,EAAE,IAAI,CAAC;IACjB,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,WAAW,EAAE,qBAAqB,CAAC;IACnC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACvC,WAAW,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CA4FhB"}

package/node_modules/@openclaw/fs-safe/dist/archive-durability.js

@@ -0,0 +1,180 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+import fsSync from "node:fs";
+import path from "node:path";
+import { ownExtractionDestinationMutation } from "./archive-deadline.js";
+import { assertDirectoryIdentityGuard, assertResolvedInsideDestination, createArchiveSymlinkTraversalError, } from "./archive-staging.js";
+import { pinNodeDirectoryForMode } from "./directory-mode-node.js";
+import { pinDirectory, syncDirectory } from "./directory-durability.js";
+import { syncFileBestEffort } from "./file-sync.js";
+import { normalizePinnedWriteError } from "./root-errors.js";
+import { inspectFileIdentity } from "./strict-file-identity.js";
+import { getFsSafeTestHooks } from "./test-hooks.js";
+import { FsSafeError } from "./errors.js";
+export async function finalizeArchivePublication(params) {
+    const check = () => params.deadline?.check();
+    const assertGuards = async (guards) => {
+        for (const guard of [params.destinationGuard, ...guards, params.sourceGuard]) {
+            await assertDirectoryIdentityGuard(guard);
+            check();
+        }
+    };
+    await ownExtractionDestinationMutation(params.deadline, async () => {
+        if (params.durable) {
+            // Join every active sync before propagating failure or starting another batch.
+            for (let offset = 0; offset < params.files.length; offset += 8) {
+                check();
+                const results = await Promise.allSettled(params.files.slice(offset, offset + 8).map(async (file) => {
+                    const env_1 = { stack: [], error: void 0, hasError: false };
+                    try {
+                        await assertGuards(file.guards);
+                        const opened = __addDisposableResource(env_1, await params.targetRoot.open(file.relativePath, { hardlinks: "reject", symlinks: "reject" })
+                            .catch((error) => {
+                            if (error instanceof FsSafeError && (error.code === "hardlink" || error.code === "path-alias")) {
+                                throw createArchiveSymlinkTraversalError(file.relativePath);
+                            }
+                            throw error;
+                        }), true);
+                        check();
+                        await inspectFileIdentity(() => fsSync.fstatSync(opened.handle.fd, { bigint: true }), file.identity);
+                        check();
+                        await syncFileBestEffort(opened.handle).catch((error) => { throw normalizePinnedWriteError(error); });
+                        check();
+                        await assertGuards(file.guards);
+                        await inspectFileIdentity(async () => {
+                            const stat = fsSync.lstatSync(opened.realPath, { bigint: true });
+                            if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink > 1n) {
+                                throw new FsSafeError("path-mismatch", "archive file changed during durability pass");
+                            }
+                            return stat;
+                        }, file.identity);
+                        check();
+                    }
+                    catch (e_1) {
+                        env_1.error = e_1;
+                        env_1.hasError = true;
+                    }
+                    finally {
+                        const result_1 = __disposeResources(env_1);
+                        if (result_1)
+                            await result_1;
+                    }
+                }));
+                const failure = results.find((result) => result.status === "rejected");
+                if (failure?.status === "rejected")
+                    throw failure.reason;
+            }
+        }
+        // Leave working modes intact until file syncing finishes. Re-pin one directory
+        // at a time against its original guard, so wide archives do not exhaust fds.
+        const directories = [...params.directories].sort((a, b) => b.guard.dir.split(path.sep).length - a.guard.dir.split(path.sep).length);
+        for (const directory of directories) {
+            const guards = [...directory.parents, directory.guard];
+            await assertGuards(guards);
+            const owner = await pinNodeDirectoryForMode(directory.guard.dir);
+            let pinned;
+            try {
+                check();
+                await assertGuards(guards);
+                if (params.durable && process.platform !== "win32") {
+                    // An existing search-only directory may become readable in its final mode.
+                    try {
+                        pinned = await pinDirectory(directory.guard.dir);
+                    }
+                    catch (error) {
+                        if (error.code !== "EACCES")
+                            throw error;
+                    }
+                    check();
+                }
+                await getFsSafeTestHooks()?.beforeArchiveOutputMutation?.("chmod", directory.guard.dir);
+                check();
+                await assertGuards(guards);
+                await owner.apply(directory.mode, { check, beforeChmod: async () => {
+                        await assertGuards(guards);
+                        await assertResolvedInsideDestination({ destinationRealDir: params.destinationGuard.realPath,
+                            targetPath: directory.guard.dir, originalPath: path.relative(params.targetRoot.rootDir, directory.guard.dir) });
+                        check();
+                    } });
+                check();
+                await assertGuards(guards);
+                if (params.durable) {
+                    if (process.platform === "win32") {
+                        await syncDirectory(directory.guard.dir).catch((error) => { throw normalizePinnedWriteError(error); });
+                    }
+                    else {
+                        pinned ??= await pinDirectory(directory.guard.dir);
+                        check();
+                        await pinned.sync().catch((error) => { throw normalizePinnedWriteError(error); });
+                    }
+                    check();
+                    await assertGuards(guards);
+                }
+            }
+            finally {
+                try {
+                    await pinned?.close();
+                }
+                finally {
+                    await owner.close();
+                }
+            }
+        }
+        if (params.durable) {
+            await assertGuards([]);
+            await syncDirectory(params.destinationGuard.realPath).catch((error) => { throw normalizePinnedWriteError(error); });
+            check();
+            await assertGuards([]);
+        }
+    });
+}

package/node_modules/@openclaw/fs-safe/dist/archive-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-entry.d.ts","sourceRoot":"","sources":["../src/archive-entry.ts"],"names":[],"mappings":"AAMA,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIzD;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAChC,IAAI,CAoEN;AAGD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAc1F;AAED,wBAAgB,8BAA8B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,IAAI,CAgBlG;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAWT"}
+{"version":3,"file":"archive-entry.d.ts","sourceRoot":"","sources":["../src/archive-entry.ts"],"names":[],"mappings":"AAOA,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAChC,IAAI,CAgEN;AAGD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAc1F;AAED,wBAAgB,8BAA8B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,IAAI,CAgBlG;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAWT"}

package/node_modules/@openclaw/fs-safe/dist/archive-entry.js

@@ -3,10 +3,9 @@ import { ArchiveSecurityError } from "./archive-errors.js";
 import { isWindowsReservedDeviceName } from "./device-path.js";
 import { formatErrorDetail } from "./error-detail.js";
 import { resolveSafeBaseDir } from "./path.js";
+import { lowerCaseNfc, maxNormalizedUtf8Bytes } from "./unicode-path.js";
 export function isWindowsDrivePath(value) {
-    return normalizeArchiveEntryPath(value)
-        .split("/")
-        .some((segment) => /^[a-zA-Z]:/.test(segment));
+    return /(?:^|\/)[a-zA-Z]:/.test(normalizeArchiveEntryPath(value));
 }
 export function normalizeArchiveEntryPath(raw) {
     return raw.replaceAll("\\", "/");
@@ -22,16 +21,17 @@ export function validateArchiveEntryPath(entryPath, params) {
         throw new ArchiveSecurityError("entry-path", `archive entry contains a NUL byte: ${formatErrorDetail(entryPath)}`);
     }
     const slashNormalized = normalizeArchiveEntryPath(entryPath);
+    const rawSegments = slashNormalized.split("/");
     if (process.platform === "win32" &&
-        slashNormalized.split("/").some((segment) => segment.includes(":"))) {
+        rawSegments.some((segment) => segment.includes(":"))) {
         throw new ArchiveSecurityError("entry-path", `archive entry uses a Windows alternate data stream path: ${formatErrorDetail(entryPath)}`);
     }
     if (process.platform === "win32" &&
-        slashNormalized.split("/").some((segment) => isWindowsReservedDeviceName(segment))) {
+        rawSegments.some((segment) => isWindowsReservedDeviceName(segment))) {
         throw new ArchiveSecurityError("entry-path", `archive entry uses a reserved device path: ${formatErrorDetail(entryPath)}`);
     }
     const normalized = path.posix.normalize(slashNormalized);
-    if (normalized.split("/").some((segment) => Math.max(Buffer.byteLength(segment.normalize("NFC")), Buffer.byteLength(segment.normalize("NFD"))) > 255)) {
+    if (normalized.split("/").some((segment) => maxNormalizedUtf8Bytes(segment) > 255)) {
         throw new ArchiveSecurityError("entry-path", `archive entry has an overlong path component: ${formatErrorDetail(entryPath)}`);
     }
     const escapeLabel = params?.escapeLabel ?? "destination";
@@ -41,7 +41,7 @@ export function validateArchiveEntryPath(entryPath, params) {
     if (path.posix.isAbsolute(normalized) || normalized.startsWith("//")) {
         throw new ArchiveSecurityError("entry-path", `archive entry is absolute: ${formatErrorDetail(entryPath)}`);
     }
-    if (slashNormalized.split("/").includes("..")) {
+    if (rawSegments.includes("..")) {
         throw new ArchiveSecurityError("entry-path", `archive entry contains a parent segment: ${formatErrorDetail(entryPath)}`);
     }
 }
@@ -67,7 +67,7 @@ export function createArchiveOutputPathTracker() {
         // Archive policy must not depend on the destination volume's case or
         // Unicode-normalization behavior. Otherwise the JavaScript and native
         // writers can disagree about which of two colliding entries wins.
-        const collisionKey = normalized.normalize("NFC").toLowerCase().normalize("NFC");
+        const collisionKey = lowerCaseNfc(normalized);
         if (seen.has(collisionKey)) {
             throw new ArchiveSecurityError("entry-path", `archive entries collide at output path ${formatErrorDetail(normalized)}: ${formatErrorDetail(originalPath)}`);
         }

package/node_modules/@openclaw/fs-safe/dist/archive-gzip-tail.d.ts

@@ -1,5 +1,8 @@
 import { Writable } from "node:stream";
 import type { Gunzip } from "node:zlib";
+export declare function isGzipBuffer(input: Uint8Array): boolean;
+/** Validate the same physical suffix when admission owns an in-memory input. */
+export declare function validateGzipBufferTail(input: Buffer, consumed: number, signal?: AbortSignal): Promise<void>;
 /** Track physical input, not the sum of bytes consumed across separate writes:
  * gunzip can resume on a later chunk after leaving an earlier padding gap. */
 export declare class GzipInput extends Writable {

package/node_modules/@openclaw/fs-safe/dist/archive-gzip-tail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-gzip-tail.d.ts","sourceRoot":"","sources":["../src/archive-gzip-tail.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC;8EAC8E;AAC9E,qBAAa,SAAU,SAAQ,QAAQ;IAIzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,WAAW,CAAqB;IAExC,YAA6B,OAAO,EAAE,MAAM,EAE3C;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAEQ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAcxG;IAEQ,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAE9D;IAEQ,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAGpF;CACF;AAED;6EAC6E;AAC7E,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBvH"}
+{"version":3,"file":"archive-gzip-tail.d.ts","sourceRoot":"","sources":["../src/archive-gzip-tail.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAaxC,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAEvD;AAQD,gFAAgF;AAChF,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CASjH;AAED;8EAC8E;AAC9E,qBAAa,SAAU,SAAQ,QAAQ;IAIzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,WAAW,CAAqB;IAExC,YAA6B,OAAO,EAAE,MAAM,EAE3C;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAEQ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAcxG;IAEQ,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAE9D;IAEQ,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAGpF;CACF;AAED;6EAC6E;AAC7E,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBvH"}

package/node_modules/@openclaw/fs-safe/dist/archive-gzip-tail.js

@@ -1,6 +1,35 @@
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import { Writable } from "node:stream";
 import { ArchiveFormatError } from "./archive-errors.js";
+const PADDING_WINDOW_BYTES = 65536;
+let zeroPadding;
+function assertZeroPadding(bytes) {
+    zeroPadding ??= Buffer.alloc(PADDING_WINDOW_BYTES);
+    if (!bytes.equals(zeroPadding.subarray(0, bytes.length))) {
+        throw new ArchiveFormatError("nonzero gzip container padding");
+    }
+}
+export function isGzipBuffer(input) {
+    return input[0] === 31 && input[1] === 139;
+}
+function assertConsumedBoundary(consumed, size) {
+    if (!Number.isSafeInteger(consumed) || consumed <= 0 || consumed > size) {
+        throw new ArchiveFormatError("invalid gzip consumed-input boundary");
+    }
+}
+/** Validate the same physical suffix when admission owns an in-memory input. */
+export async function validateGzipBufferTail(input, consumed, signal) {
+    signal?.throwIfAborted();
+    assertConsumedBoundary(consumed, input.length);
+    for (let position = consumed; position < input.length; position += PADDING_WINDOW_BYTES) {
+        signal?.throwIfAborted();
+        assertZeroPadding(input.subarray(position, position + PADDING_WINDOW_BYTES));
+        if (position + PADDING_WINDOW_BYTES < input.length)
+            await new Promise(resolve => setImmediate(resolve));
+    }
+    signal?.throwIfAborted();
+}
 /** Track physical input, not the sum of bytes consumed across separate writes:
  * gunzip can resume on a later chunk after leaving an earlier padding gap. */
 export class GzipInput extends Writable {
@@ -48,13 +77,11 @@ export async function validateGzipContainerTail(filePath, consumed, signal) {
     signal?.throwIfAborted();
     const handle = await fs.open(filePath, "r");
     try {
-        const { size } = await handle.stat();
-        if (!Number.isSafeInteger(consumed) || consumed <= 0 || consumed > size) {
-            throw new ArchiveFormatError("invalid gzip consumed-input boundary");
-        }
+        const { size } = fsSync.fstatSync(handle.fd);
+        assertConsumedBoundary(consumed, size);
         if (consumed === size)
             return;
-        const buffer = Buffer.allocUnsafe(65536);
+        const buffer = Buffer.allocUnsafe(PADDING_WINDOW_BYTES);
         let position = consumed;
         while (position < size) {
             signal?.throwIfAborted();
@@ -62,9 +89,7 @@ export async function validateGzipContainerTail(filePath, consumed, signal) {
             signal?.throwIfAborted();
             if (bytesRead === 0)
                 throw new ArchiveFormatError("truncated gzip container padding");
-            if (buffer.subarray(0, bytesRead).some((byte) => byte !== 0)) {
-                throw new ArchiveFormatError("nonzero gzip container padding");
-            }
+            assertZeroPadding(buffer.subarray(0, bytesRead));
             position += bytesRead;
         }
     }

package/node_modules/@openclaw/fs-safe/dist/archive-input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-input.d.ts","sourceRoot":"","sources":["../src/archive-input.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,qBAAqB,CAAC;AAM7B,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;AAM/E,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,kBAAkB,CAAC;CAC9B,GAAG,OAAO,CAAC,IAAI,CAAC,CAchB;AAED,wBAAsB,6BAA6B,CAAC,MAAM,EAAE;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,4BAA4B,CAAC;IACrC,QAAQ,EAAE,kBAAkB,CAAC;CAC9B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiE7B"}
+{"version":3,"file":"archive-input.d.ts","sourceRoot":"","sources":["../src/archive-input.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,qBAAqB,CAAC;AAO7B,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;AAM/E,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,kBAAkB,CAAC;CAC9B,GAAG,OAAO,CAAC,IAAI,CAAC,CAchB;AAED,wBAAsB,6BAA6B,CAAC,MAAM,EAAE;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,4BAA4B,CAAC;IACrC,QAAQ,EAAE,kBAAkB,CAAC;CAC9B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwE7B"}