@openclaw/openshell-sandbox 2026.9.3 → 2026.9.5

package/node_modules/@openclaw/fs-safe/dist/trash.js

@@ -3,7 +3,10 @@ import os from "node:os";
 import path from "node:path";
 import { sameFileIdentity } from "./file-identity.js";
 import { guardedRenameSync, guardedRmSync } from "./guarded-mutation.js";
+import { realpathSync } from "./realpath.js";
+import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
+import { hasWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 const TRASH_DESTINATION_COLLISION_CODES = new Set(["EEXIST", "ENOTEMPTY", "ERR_FS_CP_EEXIST"]);
 const TRASH_DESTINATION_RETRY_LIMIT = 4;
 function getFsErrorCode(error) {
@@ -18,34 +21,62 @@ function isTrashDestinationCollision(error) {
     return Boolean(code && TRASH_DESTINATION_COLLISION_CODES.has(code));
 }
 function isSameOrChildPath(candidate, parent) {
-    return candidate === parent || candidate.startsWith(`${parent}${path.sep}`);
+    return candidate === parent || candidate.startsWith(parent.endsWith(path.sep) ? parent : `${parent}${path.sep}`);
+}
+function assertNoTrashPathAlias(value, label) {
+    if (hasWindowsPathAlias(value, "filesystem")) {
+        throw new Error(`Refusing to trash ${label} using a Windows filesystem namespace alias: ${value}`);
+    }
+}
+function collectAllowedTrashRoots(allowedRoots) {
+    const roots = [...(allowedRoots ?? [os.homedir(), os.tmpdir()])];
+    for (const root of roots)
+        assertNoTrashPathAlias(root, "allowed root");
+    return roots;
 }
 function resolveAllowedTrashRoots(allowedRoots) {
-    const roots = [...(allowedRoots ?? [os.homedir(), os.tmpdir()])].flatMap((root) => {
-        const lexicalRoot = path.resolve(root);
+    const roots = allowedRoots.flatMap((root) => {
+        assertNoTrashPathAlias(root, "allowed root");
+        const lexicalRoot = resolvePathPreservingWindowsRoot(root);
+        assertNoTrashPathAlias(lexicalRoot, "allowed root");
+        let realRoot;
         try {
             // Keep both spellings: broken symlink targets cannot be realpathed and
             // may only compare equal to the caller's lexical allowed root.
-            return [path.resolve(fs.realpathSync.native(root)), lexicalRoot];
+            realRoot = realpathSync.native(root);
         }
         catch {
             return [lexicalRoot];
         }
+        assertNoTrashPathAlias(realRoot, "allowed root");
+        const resolvedRealRoot = resolvePathPreservingWindowsRoot(realRoot);
+        assertNoTrashPathAlias(resolvedRealRoot, "allowed root");
+        return [resolvedRealRoot, lexicalRoot];
     });
     return [...new Set(roots)];
 }
 function resolveTrashTargetPath(targetPath) {
+    assertNoTrashPathAlias(targetPath, "target path");
+    let realPath;
     try {
-        return { path: path.resolve(fs.realpathSync.native(targetPath)), resolved: true };
+        realPath = realpathSync.native(targetPath);
     }
     catch {
         // Broken symlinks are valid trash targets. Fall back to the lexical path,
         // then rely on lstat identity so the move renames the symlink itself.
-        return { path: path.resolve(targetPath), resolved: false };
+        const lexicalPath = path.resolve(targetPath);
+        assertNoTrashPathAlias(lexicalPath, "target path");
+        return { path: lexicalPath, resolved: false };
     }
+    const resolvedPath = path.resolve(realPath);
+    assertNoTrashPathAlias(resolvedPath, "target path");
+    return { path: resolvedPath, resolved: true };
 }
 function assertAllowedTrashTarget(targetPath, allowedRoots) {
-    const stat = fs.lstatSync(path.resolve(targetPath));
+    assertNoTrashPathAlias(targetPath, "target path");
+    const lexicalTarget = path.resolve(targetPath);
+    assertNoTrashPathAlias(lexicalTarget, "target path");
+    const stat = fs.lstatSync(lexicalTarget);
     const resolvedTarget = resolveTrashTargetPath(targetPath);
     const resolvedTargetPath = resolvedTarget.path;
     const isAllowed = resolveAllowedTrashRoots(allowedRoots).some((root) => resolvedTargetPath !== root && isSameOrChildPath(resolvedTargetPath, root));
@@ -53,7 +84,7 @@ function assertAllowedTrashTarget(targetPath, allowedRoots) {
         throw new Error(`Refusing to trash path outside allowed roots: ${targetPath}`);
     }
     return {
-        path: path.resolve(targetPath),
+        path: lexicalTarget,
         realPath: resolvedTargetPath,
         realPathResolved: resolvedTarget.resolved,
         stat,
@@ -74,21 +105,27 @@ function assertTrashTargetGuard(guard) {
 }
 function resolveTrashDir() {
     const homeDir = os.homedir();
+    assertNoTrashPathAlias(homeDir, "home directory");
     const trashDir = path.join(homeDir, ".Trash");
-    fs.mkdirSync(trashDir, { recursive: true, mode: 0o700 });
+    assertNoTrashPathAlias(trashDir, "trash directory");
+    fs.mkdirSync(recursiveMkdirPath(trashDir), { recursive: true, mode: 0o700 });
     const trashDirStat = fs.lstatSync(trashDir);
     if (!trashDirStat.isDirectory() || trashDirStat.isSymbolicLink()) {
         throw new Error(`Refusing to use non-directory/symlink trash directory: ${trashDir}`);
     }
-    const realHome = path.resolve(fs.realpathSync.native(homeDir));
-    const resolvedTrashDir = path.resolve(fs.realpathSync.native(trashDir));
+    const realHome = path.resolve(realpathSync.native(homeDir));
+    const resolvedTrashDir = path.resolve(realpathSync.native(trashDir));
+    assertNoTrashPathAlias(realHome, "home directory");
+    assertNoTrashPathAlias(resolvedTrashDir, "trash directory");
     if (resolvedTrashDir === realHome || !isSameOrChildPath(resolvedTrashDir, realHome)) {
         throw new Error(`Trash directory escaped home directory: ${trashDir}`);
     }
     return resolvedTrashDir;
 }
 function trashBaseName(targetPath) {
+    assertNoTrashPathAlias(targetPath, "target path");
     const resolvedTargetPath = path.resolve(targetPath);
+    assertNoTrashPathAlias(resolvedTargetPath, "target path");
     if (resolvedTargetPath === path.parse(resolvedTargetPath).root) {
         throw new Error(`Refusing to trash root path: ${targetPath}`);
     }
@@ -99,18 +136,26 @@ function trashBaseName(targetPath) {
     return base;
 }
 function resolveContainedPath(root, leaf) {
+    assertNoTrashPathAlias(root, "destination root");
+    assertNoTrashPathAlias(leaf, "destination name");
     const resolvedRoot = path.resolve(root);
     const resolvedPath = path.resolve(resolvedRoot, leaf);
+    assertNoTrashPathAlias(resolvedRoot, "destination root");
+    assertNoTrashPathAlias(resolvedPath, "destination path");
     if (!isSameOrChildPath(resolvedPath, resolvedRoot) || resolvedPath === resolvedRoot) {
         throw new Error(`Trash destination escaped trash directory: ${resolvedPath}`);
     }
     return resolvedPath;
 }
 function reserveTrashDestination(trashDir, base, timestamp) {
-    const containerPrefix = resolveContainedPath(trashDir, `${base}-${timestamp}-`);
+    assertNoTrashPathAlias(trashDir, "trash directory");
+    assertNoTrashPathAlias(base, "destination name");
+    const containerPrefix = resolveContainedPath(trashDir, `.fs-safe-trash-${timestamp}-`);
     const container = fs.mkdtempSync(containerPrefix);
     const resolvedContainer = path.resolve(container);
     const resolvedTrashDir = path.resolve(trashDir);
+    assertNoTrashPathAlias(resolvedContainer, "destination container");
+    assertNoTrashPathAlias(resolvedTrashDir, "trash directory");
     if (resolvedContainer === resolvedTrashDir ||
         !isSameOrChildPath(resolvedContainer, resolvedTrashDir)) {
         throw new Error(`Trash destination escaped trash directory: ${container}`);
@@ -120,6 +165,7 @@ function reserveTrashDestination(trashDir, base, timestamp) {
 function copyTrashTargetSync(target, dest) {
     if (target.stat.isSymbolicLink()) {
         const linkTarget = fs.readlinkSync(target.path);
+        assertNoTrashPathAlias(linkTarget, "symlink target");
         assertTrashTargetGuard(target);
         fs.symlinkSync(linkTarget, dest);
         return;
@@ -157,8 +203,10 @@ function movePathToDestination(target, dest) {
 }
 export async function movePathToTrash(targetPath, options = {}) {
     // Avoid resolving external trash helpers through the service PATH during cleanup.
+    assertNoTrashPathAlias(targetPath, "target path");
+    const allowedRoots = collectAllowedTrashRoots(options.allowedRoots);
     const base = trashBaseName(targetPath);
-    const target = assertAllowedTrashTarget(targetPath, options.allowedRoots);
+    const target = assertAllowedTrashTarget(targetPath, allowedRoots);
     const trashDir = resolveTrashDir();
     const timestamp = Date.now();
     for (let attempt = 0; attempt < TRASH_DESTINATION_RETRY_LIMIT; attempt += 1) {

package/node_modules/@openclaw/fs-safe/dist/unicode-path.d.ts

@@ -0,0 +1,3 @@
+export declare function lowerCaseNfc(value: string): string;
+export declare function maxNormalizedUtf8Bytes(value: string, includeRaw?: boolean): number;
+//# sourceMappingURL=unicode-path.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/unicode-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unicode-path.d.ts","sourceRoot":"","sources":["../src/unicode-path.ts"],"names":[],"mappings":"AAEA,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,UAAQ,GAAG,MAAM,CAUhF"}

package/node_modules/@openclaw/fs-safe/dist/unicode-path.js

@@ -0,0 +1,13 @@
+const NON_ASCII = /[^\x00-\x7f]/;
+export function lowerCaseNfc(value) {
+    return NON_ASCII.test(value) ? value.normalize("NFC").toLowerCase().normalize("NFC") : value.toLowerCase();
+}
+export function maxNormalizedUtf8Bytes(value, includeRaw = false) {
+    const nfc = value.normalize("NFC");
+    const bytes = Buffer.byteLength(nfc, "utf8");
+    const maximum = includeRaw && nfc !== value ? Math.max(bytes, Buffer.byteLength(value, "utf8")) : bytes;
+    // ASCII NFC output also has identical NFD and one UTF-8 byte per code unit.
+    if (bytes === nfc.length)
+        return maximum;
+    return Math.max(maximum, Buffer.byteLength(value.normalize("NFD"), "utf8"));
+}

package/node_modules/@openclaw/fs-safe/dist/walk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"walk.d.ts","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAC;AAI7B,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AACvE,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IAGnB,UAAU,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACrC,CAAC;AAEF,KAAK,+BAA+B,GAAG,mBAAmB,GAAG;IAC3D,UAAU,EAAE,oBAAoB,EAAE,CAAC;CACpC,CAAC;AA+FF,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,oBAAyB,GACjC,+BAA+B,CAyDjC;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,+BAA+B,CAAC,CAyD1C"}
+{"version":3,"file":"walk.d.ts","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAC;AAS7B,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AACvE,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IAGnB,UAAU,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACrC,CAAC;AAEF,KAAK,+BAA+B,GAAG,mBAAmB,GAAG;IAC3D,UAAU,EAAE,oBAAoB,EAAE,CAAC;CACpC,CAAC;AA+EF,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,oBAAyB,GACjC,+BAA+B,CA2DjC;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,+BAA+B,CAAC,CA2D1C"}

package/node_modules/@openclaw/fs-safe/dist/walk.js

@@ -1,6 +1,8 @@
 import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { realpathSync } from "./realpath.js";
+import { pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 function validateWalkBudget(name, value) {
     if (value !== undefined && (!Number.isSafeInteger(value) || value < 0)) {
         throw new RangeError(`${name} must be a non-negative safe integer`);
@@ -27,12 +29,11 @@ function shouldStop(result, options) {
     return options.maxEntries !== undefined && result.scannedEntryCount >= Math.max(0, options.maxEntries);
 }
 function buildEntry(params) {
-    const fullPath = path.join(params.dir, params.dirent.name);
-    const relativePath = path.relative(params.rootDir, fullPath) || params.dirent.name;
+    const fullPath = params.fullPath;
     return {
         name: params.dirent.name,
         path: fullPath,
-        relativePath,
+        relativePath: params.relativePath,
         depth: params.depth,
         kind: params.kind ?? kindForDirent(params.dirent),
         dirent: params.dirent,
@@ -47,7 +48,7 @@ function recordFailedDir(result, root, dir, depth, error) {
         error,
     });
 }
-function resolveSyncKind(fullPath, dirent, symlinks) {
+function resolveKind(fullPath, dirent, symlinks) {
     const kind = kindForDirent(dirent);
     if (kind !== "symlink")
         return kind;
@@ -67,29 +68,9 @@ function resolveSyncKind(fullPath, dirent, symlinks) {
     }
     return "other";
 }
-async function resolveAsyncKind(fullPath, dirent, symlinks) {
-    const kind = kindForDirent(dirent);
-    if (kind !== "symlink")
-        return kind;
-    if (symlinks === "skip")
-        return null;
-    if (symlinks === "include")
-        return "symlink";
-    try {
-        const stat = await fs.stat(fullPath);
-        if (stat.isDirectory())
-            return "directory";
-        if (stat.isFile())
-            return "file";
-    }
-    catch {
-        return null;
-    }
-    return "other";
-}
 export function walkDirectorySync(rootDir, options = {}) {
     validateWalkOptions(options);
-    const root = path.resolve(rootDir);
+    const root = resolvePathPreservingWindowsRoot(rootDir);
     const symlinks = options.symlinks ?? "skip";
     const result = {
         entries: [],
@@ -98,12 +79,13 @@ export function walkDirectorySync(rootDir, options = {}) {
         failedDirs: [],
     };
     const visitedDirs = new Set();
-    function visit(dir, depth) {
+    function visit(dir, relativeDir, depth) {
         if (options.maxDepth !== undefined && depth > options.maxDepth)
             return;
         let realDir;
+        const operationPath = pathForWindowsFilesystem(dir);
         try {
-            realDir = fsSync.realpathSync(dir);
+            realDir = realpathSync(operationPath);
         }
         catch (error) {
             recordFailedDir(result, root, dir, depth, error);
@@ -114,7 +96,7 @@ export function walkDirectorySync(rootDir, options = {}) {
         visitedDirs.add(realDir);
         let entries;
         try {
-            entries = fsSync.readdirSync(dir, { withFileTypes: true });
+            entries = fsSync.readdirSync(operationPath, { withFileTypes: true });
         }
         catch (error) {
             recordFailedDir(result, root, dir, depth, error);
@@ -127,28 +109,29 @@ export function walkDirectorySync(rootDir, options = {}) {
             }
             result.scannedEntryCount += 1;
             const fullPath = path.join(dir, dirent.name);
-            const kind = resolveSyncKind(fullPath, dirent, symlinks);
+            const kind = resolveKind(fullPath, dirent, symlinks);
             if (!kind)
                 continue;
-            const entry = buildEntry({ rootDir: root, dir, dirent, depth, kind });
+            const relativePath = relativeDir ? `${relativeDir}${path.sep}${dirent.name}` : dirent.name;
+            const entry = buildEntry({ relativePath, fullPath, dirent, depth, kind });
             if (options.include?.(entry) ?? true) {
                 result.entries.push(entry);
             }
             if (kind === "directory" &&
                 (options.maxDepth === undefined || depth < options.maxDepth) &&
                 (options.descend?.(entry) ?? true)) {
-                visit(fullPath, depth + 1);
+                visit(fullPath, relativePath, depth + 1);
                 if (result.truncated)
                     return;
             }
         }
     }
-    visit(root, 1);
+    visit(root, "", 1);
     return result;
 }
 export async function walkDirectory(rootDir, options = {}) {
     validateWalkOptions(options);
-    const root = path.resolve(rootDir);
+    const root = resolvePathPreservingWindowsRoot(rootDir);
     const symlinks = options.symlinks ?? "skip";
     const result = {
         entries: [],
@@ -157,12 +140,13 @@ export async function walkDirectory(rootDir, options = {}) {
         failedDirs: [],
     };
     const visitedDirs = new Set();
-    async function visit(dir, depth) {
+    async function visit(dir, relativeDir, depth) {
         if (options.maxDepth !== undefined && depth > options.maxDepth)
             return;
         let realDir;
+        const operationPath = pathForWindowsFilesystem(dir);
         try {
-            realDir = await fs.realpath(dir);
+            realDir = realpathSync.native(operationPath);
         }
         catch (error) {
             recordFailedDir(result, root, dir, depth, error);
@@ -173,7 +157,7 @@ export async function walkDirectory(rootDir, options = {}) {
         visitedDirs.add(realDir);
         let entries;
         try {
-            entries = await fs.readdir(dir, { withFileTypes: true });
+            entries = await fs.readdir(operationPath, { withFileTypes: true });
         }
         catch (error) {
             recordFailedDir(result, root, dir, depth, error);
@@ -186,22 +170,23 @@ export async function walkDirectory(rootDir, options = {}) {
             }
             result.scannedEntryCount += 1;
             const fullPath = path.join(dir, dirent.name);
-            const kind = await resolveAsyncKind(fullPath, dirent, symlinks);
+            const kind = resolveKind(fullPath, dirent, symlinks);
             if (!kind)
                 continue;
-            const entry = buildEntry({ rootDir: root, dir, dirent, depth, kind });
+            const relativePath = relativeDir ? `${relativeDir}${path.sep}${dirent.name}` : dirent.name;
+            const entry = buildEntry({ relativePath, fullPath, dirent, depth, kind });
             if (options.include?.(entry) ?? true) {
                 result.entries.push(entry);
             }
             if (kind === "directory" &&
                 (options.maxDepth === undefined || depth < options.maxDepth) &&
                 (options.descend?.(entry) ?? true)) {
-                await visit(fullPath, depth + 1);
+                await visit(fullPath, relativePath, depth + 1);
                 if (result.truncated)
                     return;
             }
         }
     }
-    await visit(root, 1);
+    await visit(root, "", 1);
     return result;
 }

package/node_modules/@openclaw/fs-safe/dist/windows-owner.d.ts

@@ -6,24 +6,21 @@ export type WindowsOwnerExec = (command: string, args: string[]) => Promise<{
 export type WindowsOwnerSummary = {
     sid?: string;
     currentUserSid?: string;
-    principalSids?: Record<string, string>;
-    principalTranslationFailed?: boolean;
+    daclPresent?: boolean;
+    aces?: WindowsOwnerAce[];
+    aclError?: string;
     remote?: boolean;
     trusted?: boolean;
     error?: string;
     errorDetail?: PermissionCommandFailure;
     errorCause?: unknown;
 };
-export declare function resolveWindowsPrincipalSids(params: {
-    principals: string[];
-    known?: Record<string, string>;
-    env?: NodeJS.ProcessEnv;
-    exec: WindowsOwnerExec;
-}): Promise<Record<string, string>>;
-export declare function resolveWindowsCurrentUserSid(params: {
-    env?: NodeJS.ProcessEnv;
-    exec: WindowsOwnerExec;
-}): Promise<string | null>;
+export type WindowsOwnerAce = {
+    sid: string;
+    mask: number;
+    deny: boolean;
+    inheritOnly: boolean;
+};
 export declare function inspectWindowsOwner(params: {
     targetPath: string;
     env?: NodeJS.ProcessEnv;

package/node_modules/@openclaw/fs-safe/dist/windows-owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"windows-owner.d.ts","sourceRoot":"","sources":["../src/windows-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,sBAAsB,CAAC;AAG9B,MAAM,MAAM,gBAAgB,GAAG,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AA4DF,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACxD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,EAAE,gBAAgB,CAAC;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAyBlC;AAED,wBAAsB,4BAA4B,CAAC,MAAM,EAAE;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,EAAE,gBAAgB,CAAC;CACxB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWzB;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,EAAE,gBAAgB,CAAC;CACxB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkD/B"}
+{"version":3,"file":"windows-owner.d.ts","sourceRoot":"","sources":["../src/windows-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,sBAAsB,CAAC;AAI9B,MAAM,MAAM,gBAAgB,GAAG,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAqDF,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,EAAE,gBAAgB,CAAC;CACxB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmD/B"}

package/node_modules/@openclaw/fs-safe/dist/windows-owner.js

@@ -1,5 +1,6 @@
 import { formatPermissionErrorDetail, getPermissionCommandFailure, } from "./permission-exec.js";
 import { resolveWindowsSystemCommand } from "./windows-command.js";
+import { hasWindowsPathAlias } from "./windows-path-alias.js";
 const SID_RE = /^\*?s-\d+-\d+(-\d+)+$/i;
 const TRUSTED_OWNER_SIDS = new Set(["s-1-5-18", "s-1-5-32-544"]);
 function normalizeSid(value) {
@@ -23,67 +24,34 @@ function windowsOwnerQueryCommand(targetPath) {
         "$driveRoot=if($extendedDrive){$p.Substring(4,3)}else{$root}",
         "$namespacePath=$p.StartsWith('\\\\')",
         "$remote=($namespacePath -and -not $extendedDrive) -or ([IO.DriveInfo]::new($driveRoot).DriveType -eq [IO.DriveType]::Network)",
-        "$rules=$acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier])",
-        "$principalSids=@($rules|ForEach-Object {$identity=$_.IdentityReference;$sid=$identity.Value;@{name=$sid;sid=$sid};try{@{name=$identity.Translate([System.Security.Principal.NTAccount]).Value;sid=$sid}}catch{}})",
-        "@{ownerSid=$ownerSid;currentUserSid=$currentSid;principalSids=$principalSids;principalTranslationFailed=$false;remote=$remote}|ConvertTo-Json -Depth 4 -Compress",
+        // Emit only ASCII SID and numeric facts: console encodings can replace both
+        // Unicode pathnames and account names before JavaScript receives the bytes.
+        "$raw=[System.Security.AccessControl.RawSecurityDescriptor]::new($acl.GetSecurityDescriptorBinaryForm(),0)",
+        "$dacl=$raw.DiscretionaryAcl;$complete=$true",
+        "$aces=@(foreach($ace in $dacl){if($ace -isnot [System.Security.AccessControl.CommonAce] -or $ace.IsCallback -or [int]$ace.AceType -notin @(0,1)){$complete=$false;continue};@{sid=$ace.SecurityIdentifier.Value;mask=([long]$ace.AccessMask -band 4294967295);deny=([int]$ace.AceType -eq 1);inheritOnly=([int]$ace.AceFlags -band 8) -ne 0}})",
+        "@{ownerSid=$ownerSid;currentUserSid=$currentSid;daclPresent=($null -ne $dacl);aces=$aces;complete=$complete;remote=$remote}|ConvertTo-Json -Depth 4 -Compress",
     ].join(";");
 }
-function windowsPrincipalQueryCommand(principals) {
-    const encodedPrincipals = Buffer.from(JSON.stringify(principals), "utf8").toString("base64");
-    return [
-        "$ErrorActionPreference='Stop'",
-        `$names=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encodedPrincipals}'))|ConvertFrom-Json`,
-        "$rows=@($names|ForEach-Object {@{name=$_;sid=(New-Object System.Security.Principal.NTAccount($_)).Translate([System.Security.Principal.SecurityIdentifier]).Value}})",
-        "ConvertTo-Json -InputObject $rows -Compress",
-    ].join(";");
-}
-function parsePrincipalSidRows(value) {
-    const rows = Array.isArray(value) ? value : value ? [value] : [];
-    const result = {};
-    for (const row of rows) {
-        if (!row || typeof row !== "object") {
-            continue;
-        }
-        const name = "name" in row && typeof row.name === "string" ? row.name.trim() : "";
-        const sid = "sid" in row && typeof row.sid === "string" ? normalizeSid(row.sid) : "";
-        if (name && SID_RE.test(sid)) {
-            result[name.toLowerCase()] = sid;
-        }
-    }
-    return result;
-}
-export async function resolveWindowsPrincipalSids(params) {
-    const principals = [...new Set(params.principals.map((value) => value.trim()).filter(Boolean))];
-    const known = Object.fromEntries(Object.entries(params.known ?? {}).map(([name, sid]) => [name.toLowerCase(), normalizeSid(sid)]));
-    const unresolved = principals.filter((principal) => !known[principal.toLowerCase()]);
-    if (unresolved.length === 0) {
-        return known;
+function parseWindowsAclFacts(parsed) {
+    if (parsed.complete !== true || typeof parsed.daclPresent !== "boolean" || !Array.isArray(parsed.aces)) {
+        return { aclError: "Windows ACL query returned incomplete descriptor data" };
     }
-    const command = resolveWindowsSystemCommand(String.raw `WindowsPowerShell\v1.0\powershell.exe`, params.env);
-    const { stdout } = await params.exec(command, [
-        "-NoLogo",
-        "-NoProfile",
-        "-NonInteractive",
-        "-EncodedCommand",
-        encodePowerShellCommand(windowsPrincipalQueryCommand(unresolved)),
-    ]);
-    const resolved = { ...known, ...parsePrincipalSidRows(JSON.parse(stdout.trim())) };
-    if (principals.some((principal) => !resolved[principal.toLowerCase()])) {
-        throw new Error("Windows ACL principal translation returned incomplete SID data");
-    }
-    return resolved;
-}
-export async function resolveWindowsCurrentUserSid(params) {
-    try {
-        const { stdout, stderr } = await params.exec(resolveWindowsSystemCommand("whoami.exe", params.env), ["/user", "/fo", "csv", "/nh"]);
-        const match = `${stdout}\n${stderr}`.match(/\*?S-\d+-\d+(?:-\d+)+/i);
-        return match ? normalizeSid(match[0]) : null;
-    }
-    catch {
-        return null;
+    const aces = [];
+    for (const row of parsed.aces) {
+        if (!row || typeof row !== "object" || typeof row.sid !== "string" || !SID_RE.test(row.sid) ||
+            typeof row.mask !== "number" || !Number.isInteger(row.mask) || row.mask < 0 || row.mask > 0xffff_ffff ||
+            typeof row.deny !== "boolean" || typeof row.inheritOnly !== "boolean") {
+            return { aclError: "Windows ACL query returned invalid access-rule data" };
+        }
+        aces.push({ sid: normalizeSid(row.sid), mask: row.mask, deny: row.deny, inheritOnly: row.inheritOnly });
     }
+    return { daclPresent: parsed.daclPresent, aces };
 }
 export async function inspectWindowsOwner(params) {
+    if (hasWindowsPathAlias(params.targetPath, "filesystem", "win32")) {
+        const error = new Error("Path uses a Windows filesystem namespace alias");
+        return { error: String(error), errorCause: error };
+    }
     let command = "";
     let startedAt = performance.now();
     try {
@@ -96,7 +64,11 @@ export async function inspectWindowsOwner(params) {
             "-EncodedCommand",
             encodePowerShellCommand(windowsOwnerQueryCommand(params.targetPath)),
         ]);
-        const parsed = JSON.parse(stdout.trim());
+        const value = JSON.parse(stdout.trim());
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+            return { error: "Windows owner query returned invalid SID data" };
+        }
+        const parsed = value;
         const ownerSid = typeof parsed.ownerSid === "string" && SID_RE.test(parsed.ownerSid)
             ? normalizeSid(parsed.ownerSid)
             : undefined;
@@ -110,8 +82,7 @@ export async function inspectWindowsOwner(params) {
         return {
             sid: ownerSid,
             currentUserSid,
-            principalSids: parsePrincipalSidRows(parsed.principalSids),
-            principalTranslationFailed: parsed.principalTranslationFailed === true,
+            ...parseWindowsAclFacts(parsed),
             remote,
             trusted: !remote && (ownerSid === currentUserSid || TRUSTED_OWNER_SIDS.has(ownerSid)),
         };

package/node_modules/@openclaw/fs-safe/dist/windows-path-alias.d.ts

@@ -0,0 +1,39 @@
+import { FsSafeError } from "./errors.js";
+export type WindowsPathAliasKind = "filesystem" | "relative";
+/**
+ * Capture an ordinary Windows drive-relative path without normalizing its raw
+ * suffix. This is only for public APIs whose existing contract accepts such
+ * paths; callers must still run namespace-alias admission on the result.
+ */
+export declare function anchorWindowsDriveRelativePath(value: string): string;
+/**
+ * Resolve a path without letting Node erase the separator from an exact
+ * extended-length drive root such as `\\?\C:\`. Bare `\\?\C:` input remains
+ * unchanged so the surrounding alias admission rejects it.
+ */
+export declare function resolvePathPreservingWindowsRoot(value: string): string;
+/**
+ * Preserve a namespaced drive root after a caller has already resolved the
+ * input. This lets admission fast paths keep exactly one live path.resolve
+ * call while retaining the same root-repair behavior as the general helper.
+ */
+export declare function repairResolvedWindowsRoot(value: string, resolved: string): string;
+/**
+ * Resolve path segments against a base while preserving a namespaced drive
+ * root when Node normalizes a legitimate rooted input back to that root.
+ * Raw bare namespace drives stay bare so admission checks still reject them.
+ */
+export declare function resolvePathFromBasePreservingWindowsRoot(base: string, ...segments: string[]): string;
+/**
+ * Adapt an admitted namespaced drive root for Node's Windows filesystem layer.
+ * Node removes the root separator from these paths during filesystem dispatch,
+ * so use the equivalent ordinary drive root for the operation. This is not an
+ * admission check: callers must validate attacker-controlled input first.
+ */
+export declare function pathForWindowsFilesystem(value: string): string;
+/** Returns true when a Windows pathname can address an alternate filesystem namespace. */
+export declare function hasWindowsPathAlias(value: string, kind: WindowsPathAliasKind, platform?: NodeJS.Platform | string): boolean;
+export declare function assertNoWindowsPathAliasForPlatform(value: string, kind: WindowsPathAliasKind, message: string, platform: NodeJS.Platform | string | undefined): void;
+export declare function assertNoWindowsPathAlias(value: string, kind?: WindowsPathAliasKind, message?: string, platform?: NodeJS.Platform | string): void;
+export declare function isWindowsPathAliasError(error: unknown): error is FsSafeError;
+//# sourceMappingURL=windows-path-alias.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/windows-path-alias.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-path-alias.d.ts","sourceRoot":"","sources":["../src/windows-path-alias.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,UAAU,CAAC;AAsD7D;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYpE;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUtE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUjF;AAED;;;;GAIG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,EACZ,GAAG,QAAQ,EAAE,MAAM,EAAE,GACpB,MAAM,CAgBR;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAkB9D;AAED,0FAA0F;AAC1F,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,oBAAoB,EAC1B,QAAQ,GAAE,MAAM,CAAC,QAAQ,GAAG,MAAyB,GACpD,OAAO,CAMT;AAED,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,oBAAoB,EAC1B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,GAAG,SAAS,GAC7C,IAAI,CAMN;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,oBAAmC,EACzC,OAAO,SAAmD,EAC1D,QAAQ,GAAE,MAAM,CAAC,QAAQ,GAAG,MAAyB,GACpD,IAAI,CAMN;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAE5E"}