@openclaw/openshell-sandbox 2026.9.3 → 2026.9.5

package/node_modules/@openclaw/fs-safe/dist/secret-file.js

@@ -1,6 +1,7 @@
 import fs, {} from "node:fs";
 import fsp from "node:fs/promises";
 import path from "node:path";
+import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
 import { canonicalPathFromExistingAncestor } from "./absolute-path.js";
 import { readFileDescriptorBoundedSync } from "./bounded-read.js";
 import { assertAsyncDirectoryGuard, createAsyncDirectoryGuard, inspectDirectoryIdentity } from "./directory-guard.js";
@@ -16,32 +17,36 @@ import { verifyAtomicWriteResult } from "./root-write-verification.js";
 import { assertSecretFilePreview, resolveSecretReadPolicy, secretPathErrorCode, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
 import { serializePathWrite } from "./write-queue.js";
+import { assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 export const PRIVATE_SECRET_DIR_MODE = 0o700;
 export const PRIVATE_SECRET_FILE_MODE = 0o600;
 export function readSecretFileSync(filePath, label, options = {}) {
     const { resolvedPath, maxBytes } = resolveSecretReadPolicy(filePath, label, options);
-    function inspectInput(symlinkMessage) {
-        const stat = options.rejectSymlink
-            ? fs.lstatSync(resolvedPath, { bigint: true })
-            : fs.statSync(resolvedPath, { bigint: true });
-        if (options.rejectSymlink && stat.isSymbolicLink()) {
-            throw new FsSafeError("symlink", symlinkMessage);
-        }
-        return stat;
-    }
+    let rejectSymlink;
     let previewStat;
     try {
         assertNoUnsafeDeviceReadPath(resolvedPath);
+        rejectSymlink = Boolean(options.rejectSymlink);
         previewStat = inspectFileIdentitySync(() => inspectInput(`${label} file at ${resolvedPath} must not be a symlink.`));
     }
     catch (error) {
         throw secretReadError(error instanceof FsSafeError ? error.code : secretPathErrorCode(error), "inspect", label, resolvedPath, error);
     }
-    assertSecretFilePreview(previewStat, label, resolvedPath, maxBytes, options.rejectHardlinks !== false);
+    function inspectInput(symlinkMessage) {
+        const stat = rejectSymlink
+            ? fs.lstatSync(resolvedPath, { bigint: true })
+            : fs.statSync(resolvedPath, { bigint: true });
+        if (rejectSymlink && stat.isSymbolicLink()) {
+            throw new FsSafeError("symlink", symlinkMessage);
+        }
+        return stat;
+    }
+    const rejectHardlinks = options.rejectHardlinks !== false;
+    assertSecretFilePreview(previewStat, label, resolvedPath, maxBytes, rejectHardlinks);
     const opened = openPinnedFileSync({
         filePath: resolvedPath,
-        rejectPathSymlink: options.rejectSymlink,
-        rejectHardlinks: options.rejectHardlinks !== false,
+        rejectPathSymlink: rejectSymlink,
+        rejectHardlinks,
     });
     if (!opened.ok) {
         throw secretReadError(opened.reason === "path" ? "not-found" : "path-mismatch", "read", label, resolvedPath, opened.reason === "validation" ? new Error("security validation failed") : opened.error);
@@ -50,14 +55,14 @@ export function readSecretFileSync(filePath, label, options = {}) {
     try {
         const openedIdentity = inspectFileIdentitySync(() => {
             const stat = fs.fstatSync(opened.fd, { bigint: true });
-            if (!stat.isFile() || (options.rejectHardlinks !== false && stat.nlink > 1n)) {
+            if (!stat.isFile() || (rejectHardlinks && stat.nlink > 1n)) {
                 throw new FsSafeError("path-mismatch", "security validation failed");
             }
             return stat;
         }, previewStat);
         inspectFileIdentitySync(() => {
             const stat = fs.lstatSync(opened.path, { bigint: true });
-            if (!stat.isFile() || (options.rejectHardlinks !== false && stat.nlink > 1n)) {
+            if (!stat.isFile() || (rejectHardlinks && stat.nlink > 1n)) {
                 throw new FsSafeError("path-mismatch", "security validation failed");
             }
             return stat;
@@ -151,8 +156,8 @@ async function inspectPrivateDirectory(directory, kind) {
     });
 }
 async function ensurePrivateDirectory(rootDir, targetDir, mode) {
-    const resolvedRoot = path.resolve(rootDir);
-    const resolvedTarget = path.resolve(targetDir);
+    const resolvedRoot = resolvePathPreservingWindowsRoot(rootDir);
+    const resolvedTarget = resolvePathPreservingWindowsRoot(targetDir);
     let rootStat = await inspectPrivateDirectory(resolvedRoot, "root").catch((error) => {
         if (error.code !== "ENOENT")
             throw error;
@@ -166,7 +171,7 @@ async function ensurePrivateDirectory(rootDir, targetDir, mode) {
         catch (error) {
             if (error.code !== "ENOENT")
                 throw error;
-            await fsp.mkdir(path.dirname(resolvedRoot), { recursive: true, mode });
+            await fsp.mkdir(recursiveMkdirPath(path.dirname(resolvedRoot)), { recursive: true, mode });
             createdRoot = await createPrivateDirectory(resolvedRoot, mode);
         }
         rootStat = await inspectPrivateDirectory(resolvedRoot, "root");
@@ -227,21 +232,42 @@ async function ensurePrivateDirectory(rootDir, targetDir, mode) {
     }
     return { rootGuard, parentGuard: targetGuard };
 }
+function snapshotSecretFileWriteParams(params, rootDir, filePath) {
+    return {
+        rootDir,
+        filePath,
+        content: params.content,
+        mode: params.mode,
+        dirMode: params.dirMode,
+        durable: params.durable,
+    };
+}
 async function secretFileWriteQueueKey(filePath) {
+    assertNoWindowsPathAlias(filePath, "filesystem", "private secret path uses a Windows filesystem namespace alias");
     try {
         return await canonicalPathFromExistingAncestor(filePath);
     }
-    catch {
+    catch (error) {
+        if (error instanceof FsSafeError && error.code === "invalid-path")
+            throw error;
         // Keep validation and its public error shape owned by the write path below.
-        return path.resolve(filePath);
+        const resolved = path.resolve(filePath);
+        assertNoWindowsPathAlias(resolved, "filesystem", "private secret path uses a Windows filesystem namespace alias");
+        return resolved;
     }
 }
 // Internal preparation for private writers and their pre-write locks; not lasting authorization.
 export async function prepareSecretFileWrite(params) {
+    const rootDir = params.rootDir;
+    const filePath = params.filePath;
+    assertNoWindowsPathAlias(rootDir, "filesystem", "private secret root uses a Windows filesystem namespace alias");
+    assertNoWindowsPathAlias(filePath, "filesystem", "private secret path uses a Windows filesystem namespace alias");
     const mode = params.mode ?? PRIVATE_SECRET_FILE_MODE;
     const dirMode = params.dirMode ?? PRIVATE_SECRET_DIR_MODE;
-    const resolvedRoot = path.resolve(params.rootDir);
-    const resolvedFile = path.resolve(params.filePath);
+    const resolvedRoot = resolvePathPreservingWindowsRoot(rootDir);
+    const resolvedFile = path.resolve(filePath);
+    assertNoWindowsPathAlias(resolvedRoot, "filesystem", "private secret root uses a Windows filesystem namespace alias");
+    assertNoWindowsPathAlias(resolvedFile, "filesystem", "private secret path uses a Windows filesystem namespace alias");
     assertPathWithinRoot(resolvedRoot, resolvedFile);
     for (const [kind, value] of [["file", mode], ["directory", dirMode]]) {
         if (!Number.isInteger(value) || value < 0 || value > 0o7777) {
@@ -253,8 +279,11 @@ export async function prepareSecretFileWrite(params) {
     await assertAsyncDirectoryGuard(rootGuard);
     await assertAsyncDirectoryGuard(parentGuard);
     assertRealPathWithinRoot(rootGuard.realPath, parentGuard.realPath);
+    assertNoWindowsPathAlias(rootGuard.realPath, "filesystem", "private secret root uses a Windows filesystem namespace alias");
+    assertNoWindowsPathAlias(parentGuard.realPath, "filesystem", "private secret parent uses a Windows filesystem namespace alias");
     const fileName = path.basename(resolvedFile);
     const finalFilePath = path.join(parentGuard.realPath, fileName);
+    assertNoWindowsPathAlias(finalFilePath, "filesystem", "private secret path uses a Windows filesystem namespace alias");
     return { mode, rootGuard, parentGuard, fileName, finalFilePath };
 }
 async function materializeSecretFileAtomic(params, createOnly) {
@@ -284,6 +313,7 @@ async function materializeSecretFileAtomic(params, createOnly) {
         basename: fileName,
         mkdir: false,
         mode,
+        sync: params.durable !== false,
         overwrite: !createOnly,
         input: { kind: "buffer", data: typeof params.content === "string" ? params.content : Buffer.from(params.content) },
         rootIdentity: { dev: parentGuard.stat.dev, ino: parentGuard.stat.ino },
@@ -307,16 +337,26 @@ async function materializeSecretFileAtomic(params, createOnly) {
     });
 }
 export async function writeSecretFileAtomic(params) {
-    const canonicalPath = await secretFileWriteQueueKey(params.filePath);
+    const rootDir = params.rootDir;
+    const filePath = params.filePath;
+    assertNoWindowsPathAlias(rootDir, "filesystem", "private secret root uses a Windows filesystem namespace alias");
+    assertNoWindowsPathAlias(filePath, "filesystem", "private secret path uses a Windows filesystem namespace alias");
+    const ownedParams = snapshotSecretFileWriteParams(params, rootDir, filePath);
+    const canonicalPath = await secretFileWriteQueueKey(filePath);
     await serializePathWrite(canonicalPath, async () => {
-        await materializeSecretFileAtomic(params, false);
+        await materializeSecretFileAtomic(ownedParams, false);
     });
 }
 export async function createSecretFileAtomic(params) {
     try {
-        const canonicalPath = await secretFileWriteQueueKey(params.filePath);
+        const rootDir = params.rootDir;
+        const filePath = params.filePath;
+        assertNoWindowsPathAlias(rootDir, "filesystem", "private secret root uses a Windows filesystem namespace alias");
+        assertNoWindowsPathAlias(filePath, "filesystem", "private secret path uses a Windows filesystem namespace alias");
+        const ownedParams = snapshotSecretFileWriteParams(params, rootDir, filePath);
+        const canonicalPath = await secretFileWriteQueueKey(filePath);
         await serializePathWrite(canonicalPath, async () => {
-            await materializeSecretFileAtomic(params, true);
+            await materializeSecretFileAtomic(ownedParams, true);
         });
     }
     catch (error) {

package/node_modules/@openclaw/fs-safe/dist/secret-read-async.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-read-async.d.ts","sourceRoot":"","sources":["../src/secret-read-async.ts"],"names":[],"mappings":"AAOA,OAAO,EAML,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAEjC,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B"}
+{"version":3,"file":"secret-read-async.d.ts","sourceRoot":"","sources":["../src/secret-read-async.ts"],"names":[],"mappings":"AAQA,OAAO,EAML,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAGjC,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,CAAC,CA6DjB;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B"}

package/node_modules/@openclaw/fs-safe/dist/secret-read-async.js

@@ -4,44 +4,50 @@ import { readFileHandleBounded } from "./bounded-read.js";
 import { assertNoUnsafeDeviceReadPath } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
+import { realpathSync } from "./realpath.js";
+import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
 import { assertSecretFilePreview, resolveSecretReadPolicy, secretPathErrorCode, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export async function readSecretFile(filePath, label, options = {}) {
     const { resolvedPath, maxBytes } = resolveSecretReadPolicy(filePath, label, options);
-    async function inspectInput(symlinkMessage) {
-        const stat = options.rejectSymlink
-            ? await fs.lstat(resolvedPath, { bigint: true })
-            : await fs.stat(resolvedPath, { bigint: true });
-        if (options.rejectSymlink && stat.isSymbolicLink()) {
-            throw new FsSafeError("symlink", symlinkMessage);
-        }
-        return stat;
-    }
+    let rejectSymlink;
     let previewStat;
     try {
         assertNoUnsafeDeviceReadPath(resolvedPath);
-        previewStat = await inspectFileIdentity(() => inspectInput(`${label} file at ${resolvedPath} must not be a symlink.`));
+        rejectSymlink = Boolean(options.rejectSymlink);
+        previewStat = inspectFileIdentitySync(() => inspectInput(`${label} file at ${resolvedPath} must not be a symlink.`));
     }
     catch (error) {
         throw secretReadError(error instanceof FsSafeError ? error.code : secretPathErrorCode(error), "inspect", label, resolvedPath, error);
     }
-    assertSecretFilePreview(previewStat, label, resolvedPath, maxBytes, options.rejectHardlinks !== false);
+    function inspectInput(symlinkMessage) {
+        const stat = rejectSymlink
+            ? fsSync.lstatSync(resolvedPath, { bigint: true })
+            : fsSync.statSync(resolvedPath, { bigint: true });
+        if (rejectSymlink && stat.isSymbolicLink()) {
+            throw new FsSafeError("symlink", symlinkMessage);
+        }
+        return stat;
+    }
+    const rejectHardlinks = options.rejectHardlinks !== false;
+    assertSecretFilePreview(previewStat, label, resolvedPath, maxBytes, rejectHardlinks);
     let handle;
     let raw;
     try {
-        const realPath = await fs.realpath(resolvedPath);
+        const realPath = realpathSync.native(resolvedPath);
+        assertNoWindowsPathAlias(realPath, "filesystem", `${label} file path uses a Windows filesystem namespace alias`);
         assertNoUnsafeDeviceReadPath(realPath);
         handle = await fs.open(realPath, resolveReadOpenFlags());
         const openedHandle = handle;
         const openedStat = await inspectFileIdentity(async () => {
-            const stat = await openedHandle.stat({ bigint: true });
-            if (!stat.isFile() || (options.rejectHardlinks !== false && stat.nlink > 1n)) {
+            const stat = fsSync.fstatSync(openedHandle.fd, { bigint: true });
+            if (!stat.isFile() || (rejectHardlinks && stat.nlink > 1n)) {
                 throw new FsSafeError("path-mismatch", "security validation failed");
             }
             return stat;
         }, previewStat);
         await inspectFileIdentity(async () => {
-            const stat = await fs.lstat(realPath, { bigint: true });
+            const stat = fsSync.lstatSync(realPath, { bigint: true });
             if (!stat.isFile())
                 throw new FsSafeError("path-mismatch", "security validation failed");
             return stat;

package/node_modules/@openclaw/fs-safe/dist/secret-read-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-read-policy.d.ts","sourceRoot":"","sources":["../src/secret-read-policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAEhE,eAAO,MAAM,6BAA6B,QAAY,CAAC;AAEvD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAGnE;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,SAAS,GAAG,MAAM,EAC1B,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,OAAO,GACb,WAAW,CAGb;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,OAAO,GACvB,IAAI,CAUN;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAM9F;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG;IACxG,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB,CASA"}
+{"version":3,"file":"secret-read-policy.d.ts","sourceRoot":"","sources":["../src/secret-read-policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAGhE,eAAO,MAAM,6BAA6B,QAAY,CAAC;AAEvD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAGnE;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,SAAS,GAAG,MAAM,EAC1B,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,OAAO,GACb,WAAW,CAGb;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,OAAO,GACvB,IAAI,CAUN;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAM9F;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG;IACxG,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAYA"}

package/node_modules/@openclaw/fs-safe/dist/secret-read-policy.js

@@ -1,6 +1,7 @@
 import { normalizeMaxBytes } from "./byte-budget.js";
 import { resolveHomeRelativePath } from "./home-dir.js";
 import { FsSafeError } from "./errors.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export const DEFAULT_SECRET_FILE_MAX_BYTES = 16 * 1024;
 export function secretPathErrorCode(error) {
     const code = error.code;
@@ -29,10 +30,13 @@ export function trimSecretFileContent(raw, label, resolvedPath) {
     return secret;
 }
 export function resolveSecretReadPolicy(filePath, label, options) {
-    const resolvedPath = resolveHomeRelativePath(filePath.trim());
+    const trimmedPath = filePath.trim();
+    assertNoWindowsPathAlias(trimmedPath, "filesystem", `${label} file path uses a Windows filesystem namespace alias`);
+    const resolvedPath = resolveHomeRelativePath(trimmedPath);
     if (!resolvedPath) {
         throw new FsSafeError("invalid-path", `${label} file path is empty.`, { cause: undefined });
     }
+    assertNoWindowsPathAlias(resolvedPath, "filesystem", `${label} file path uses a Windows filesystem namespace alias`);
     const maxBytes = normalizeMaxBytes(options.maxBytes, {
         defaultValue: DEFAULT_SECRET_FILE_MAX_BYTES,
     });

package/node_modules/@openclaw/fs-safe/dist/secure-file-windows.d.ts

@@ -0,0 +1,10 @@
+import type { BigIntStats, Stats } from "node:fs";
+import type { PermissionCheck } from "./permissions.js";
+type ExactIdentity = Pick<BigIntStats, "dev" | "ino">;
+export declare function inspectSecureWindowsDescriptor(params: {
+    fd: number;
+    identity: ExactIdentity;
+    stat: Stats;
+}): PermissionCheck;
+export {};
+//# sourceMappingURL=secure-file-windows.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secure-file-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-file-windows.d.ts","sourceRoot":"","sources":["../src/secure-file-windows.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AASlD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AA4BxD,KAAK,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC;AAuHtD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,KAAK,CAAC;CACb,GAAG,eAAe,CA0ClB"}

package/node_modules/@openclaw/fs-safe/dist/secure-file-windows.js

@@ -0,0 +1,186 @@
+import { FsSafeError } from "./errors.js";
+import { recordFileObservationFailure } from "./file-observation.js";
+import { getNativeBinding } from "./native.js";
+const IDENTITY_RE = /^([0-9a-f]{8}):([0-9a-f]{16})$/;
+const SID_RE = /^s-\d+-\d+(?:-\d+)+$/;
+const OWNER_CLASSES = new Set(["current-user", "system", "administrators", "foreign"]);
+const TRUSTED_OWNER_CLASSES = new Set(["current-user", "system", "administrators"]);
+const SYSTEM_SID = "s-1-5-18";
+const ADMINISTRATORS_SID = "s-1-5-32-544";
+const WORLD_SIDS = new Set([
+    "s-1-1-0", "s-1-5-11", "s-1-5-32-545", "s-1-5-7",
+    "s-1-5-32-546", "s-1-5-4", "s-1-5-2",
+]);
+const GENERIC_READ = 0x8000_0000;
+const GENERIC_WRITE = 0x4000_0000;
+const GENERIC_ALL = 0x1000_0000;
+const DELETE_ACCESS = 0x0001_0000;
+const WRITE_DAC = 0x0004_0000;
+const WRITE_OWNER = 0x0008_0000;
+const FILE_READ_DATA = 0x0000_0001;
+const FILE_WRITE_DATA = 0x0000_0002;
+const FILE_APPEND_DATA = 0x0000_0004;
+const FILE_READ_EA = 0x0000_0008;
+const FILE_WRITE_EA = 0x0000_0010;
+const FILE_DELETE_CHILD = 0x0000_0040;
+const FILE_READ_ATTRIBUTES = 0x0000_0080;
+const FILE_WRITE_ATTRIBUTES = 0x0000_0100;
+function permissionUnverified(message, cause) {
+    throw new FsSafeError("permission-unverified", message, cause === undefined ? {} : { cause });
+}
+function identityMismatch() {
+    const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
+    recordFileObservationFailure(error, "identity");
+    throw error;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function isUint32(value) {
+    return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 0xffff_ffff;
+}
+function parseIdentity(value) {
+    if (typeof value !== "string")
+        identityMismatch();
+    const match = IDENTITY_RE.exec(value);
+    if (!match)
+        identityMismatch();
+    return {
+        dev: BigInt(`0x${match[1]}`),
+        ino: BigInt(`0x${match[2]}`),
+    };
+}
+function validateFlags(value) {
+    if (!isRecord(value))
+        return false;
+    const raw = value.raw;
+    if (!isUint32(raw) || (raw & ~0xdf) !== 0)
+        return false;
+    const fields = [
+        ["objectInherit", 0x01], ["containerInherit", 0x02],
+        ["noPropagateInherit", 0x04], ["inheritOnly", 0x08], ["inherited", 0x10],
+        ["successfulAccess", 0x40], ["failedAccess", 0x80],
+    ];
+    return fields.every(([field, bit]) => typeof value[field] === "boolean" && value[field] === ((raw & bit) !== 0));
+}
+function validateAce(value) {
+    return isRecord(value) && typeof value.sid === "string" && SID_RE.test(value.sid) &&
+        isUint32(value.mask) && (value.aceType === "allow" || value.aceType === "deny") &&
+        validateFlags(value.flags);
+}
+function canRead(mask) {
+    return (mask & (GENERIC_ALL | GENERIC_READ | FILE_READ_DATA | FILE_READ_EA |
+        FILE_READ_ATTRIBUTES)) !== 0;
+}
+function canWrite(mask) {
+    return (mask & (GENERIC_ALL | GENERIC_WRITE | FILE_WRITE_DATA | FILE_APPEND_DATA |
+        FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES | FILE_DELETE_CHILD | DELETE_ACCESS |
+        WRITE_DAC | WRITE_OWNER)) !== 0;
+}
+function expectedOwnerClass(facts) {
+    if (facts.ownerSid === facts.currentUserSid)
+        return "current-user";
+    if (facts.ownerSid === SYSTEM_SID)
+        return "system";
+    if (facts.ownerSid === ADMINISTRATORS_SID)
+        return "administrators";
+    return "foreign";
+}
+function validateSecurity(value) {
+    if (!isRecord(value))
+        permissionUnverified("Windows descriptor ACL facts were malformed");
+    const facts = value;
+    const booleans = [
+        "worldWritable", "groupWritable", "worldReadable", "groupReadable",
+        "fallbackRequired", "daclPresent", "isLocal", "aceListComplete",
+    ];
+    if (!booleans.every((field) => typeof facts[field] === "boolean") ||
+        typeof facts.ownerSid !== "string" || !SID_RE.test(facts.ownerSid) ||
+        typeof facts.currentUserSid !== "string" || !SID_RE.test(facts.currentUserSid) ||
+        typeof facts.ownerClass !== "string" || !OWNER_CLASSES.has(facts.ownerClass) ||
+        !Array.isArray(facts.unsupportedAceTypes) ||
+        !facts.unsupportedAceTypes.every(isUint32) ||
+        !Array.isArray(facts.aces) || !facts.aces.every(validateAce)) {
+        permissionUnverified("Windows descriptor ACL facts were malformed");
+    }
+    if (facts.ownerClass !== expectedOwnerClass(facts)) {
+        permissionUnverified("Windows descriptor owner facts were inconsistent");
+    }
+    if (facts.fallbackRequired || !facts.isLocal || !facts.aceListComplete ||
+        facts.unsupportedAceTypes.length !== 0) {
+        permissionUnverified("Windows descriptor ACL facts were incomplete or unsupported");
+    }
+    if (!facts.daclPresent && facts.aces.length !== 0) {
+        permissionUnverified("Windows descriptor DACL facts were inconsistent");
+    }
+    return facts;
+}
+function validatePermissionSummary(facts) {
+    let worldReadable = !facts.daclPresent;
+    let worldWritable = !facts.daclPresent;
+    let groupReadable = false;
+    let groupWritable = false;
+    const trustedSids = new Set([facts.currentUserSid, SYSTEM_SID, ADMINISTRATORS_SID]);
+    for (const ace of facts.aces) {
+        if (ace.aceType !== "allow" || ace.flags.inheritOnly || trustedSids.has(ace.sid))
+            continue;
+        const world = WORLD_SIDS.has(ace.sid);
+        if (world) {
+            worldReadable ||= canRead(ace.mask);
+            worldWritable ||= canWrite(ace.mask);
+        }
+        else {
+            groupReadable ||= canRead(ace.mask);
+            groupWritable ||= canWrite(ace.mask);
+        }
+    }
+    if (facts.worldReadable !== worldReadable || facts.worldWritable !== worldWritable ||
+        facts.groupReadable !== groupReadable || facts.groupWritable !== groupWritable) {
+        permissionUnverified("Windows descriptor ACL summary was inconsistent");
+    }
+}
+export function inspectSecureWindowsDescriptor(params) {
+    let native;
+    try {
+        native = getNativeBinding();
+    }
+    catch (cause) {
+        permissionUnverified("Windows descriptor ACL verification requires the matching native helper", cause);
+    }
+    const inspect = native?.inspectWindowsSecureFileHandle;
+    if (typeof inspect !== "function") {
+        permissionUnverified("Windows descriptor ACL verification requires an up-to-date native helper");
+    }
+    let result;
+    try {
+        result = inspect.call(native, params.fd);
+    }
+    catch (cause) {
+        permissionUnverified("Windows descriptor ACL verification failed", cause);
+    }
+    if (!isRecord(result))
+        permissionUnverified("Windows descriptor ACL facts were malformed");
+    const observed = parseIdentity(result.identity);
+    if (observed.dev !== params.identity.dev || observed.ino !== params.identity.ino) {
+        identityMismatch();
+    }
+    const facts = validateSecurity(result.security);
+    validatePermissionSummary(facts);
+    return {
+        ok: true,
+        isSymlink: false,
+        isDir: params.stat.isDirectory(),
+        mode: typeof params.stat.mode === "number" ? params.stat.mode : null,
+        bits: null,
+        source: "windows-acl",
+        worldWritable: facts.worldWritable,
+        groupWritable: facts.groupWritable,
+        worldReadable: facts.worldReadable,
+        groupReadable: facts.groupReadable,
+        ownerSid: facts.ownerSid,
+        ownerTrusted: TRUSTED_OWNER_CLASSES.has(facts.ownerClass),
+        aclSummary: `native descriptor owner=${facts.ownerClass} world=` +
+            `${facts.worldReadable ? "r" : "-"}${facts.worldWritable ? "w" : "-"} ` +
+            `group=${facts.groupReadable ? "r" : "-"}${facts.groupWritable ? "w" : "-"}`,
+    };
+}

package/node_modules/@openclaw/fs-safe/dist/secure-file.d.ts

@@ -1,4 +1,4 @@
-import type { Stats } from "node:fs";
+import { type Stats } from "node:fs";
 import { type PermissionCheck, type PermissionCheckOptions } from "./permissions.js";
 export type SecureFileReadOptions = {
     filePath: string;

package/node_modules/@openclaw/fs-safe/dist/secure-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secure-file.d.ts","sourceRoot":"","sources":["../src/secure-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAarC,OAAO,EAOL,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAG1B,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B,WAAW,CAAC,EAAE,2BAA2B,CAAC;IAC1C,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,EAAE,CAAC,EAAE,mBAAmB,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;AAE7D,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;IACZ,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B,CAAC;AA4LF,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAe/B"}
+{"version":3,"file":"secure-file.d.ts","sourceRoot":"","sources":["../src/secure-file.ts"],"names":[],"mappings":"AAAA,OAAe,EAAoB,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAe/D,OAAO,EAOL,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAU1B,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B,WAAW,CAAC,EAAE,2BAA2B,CAAC;IAC1C,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,EAAE,CAAC,EAAE,mBAAmB,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;AAE7D,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;IACZ,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B,CAAC;AAgTF,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAgC/B"}