@openclaw/openshell-sandbox 2026.9.4 → 2026.9.5

package/node_modules/@openclaw/fs-safe/dist/json.js

@@ -8,8 +8,11 @@ import { stringifyJsonDocument } from "./json-stringify.js";
 import { readRegularFile, readRegularFileSync, statRegularFile } from "./regular-file.js";
 import { openRootFileSync } from "./root-file.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
+import { admitStandalonePublicationPath } from "./standalone-publication-path.js";
 import { writeTextAtomic } from "./text-atomic.js";
 import { sleep } from "./timing.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 const READ_RETRY_MAX_ATTEMPTS = 5;
 const READ_RETRY_BASE_DELAY_MS = 50;
 function isRetryableReadError(err, options) {
@@ -166,16 +169,17 @@ export function tryReadJsonSync(pathname, options = {}) {
     }
 }
 export function writeJsonSync(pathname, data) {
+    const filePath = admitStandalonePublicationPath(pathname);
     // Keep literal parent segments so staging follows the same symlinks as the target.
-    const tmpPath = path.format({ ...path.parse(pathname), base: `.fs-safe-${randomUUID()}.tmp` });
+    const tmpPath = path.format({ ...path.parse(filePath), base: `.fs-safe-${randomUUID()}.tmp` });
     const payload = `${stringifyJsonDocument(data, null, 2)}\n`;
-    fsSync.mkdirSync(path.dirname(pathname), { recursive: true, mode: JSON_DIR_MODE });
+    fsSync.mkdirSync(recursiveMkdirPath(path.dirname(filePath)), { recursive: true, mode: JSON_DIR_MODE });
     try {
         const tempIdentity = writeTempJsonFile(tmpPath, payload);
         trySetSecureMode(tmpPath, tempIdentity);
-        renameJsonFileWithFallback(tmpPath, pathname);
-        trySetSecureMode(pathname, tempIdentity);
-        trySyncDirectory(pathname);
+        renameJsonFileWithFallback(tmpPath, filePath);
+        trySetSecureMode(filePath, tempIdentity);
+        trySyncDirectory(filePath);
     }
     finally {
         try {
@@ -206,29 +210,59 @@ function resolveInvalidMessage(invalidMessage, relativePath) {
     return invalidMessage ?? `${relativePath} has an unexpected shape`;
 }
 export function readRootStructuredFileSync(options) {
-    const absolutePath = path.resolve(options.rootDir, options.relativePath);
+    return readRootStructuredFileSyncInternal(options, options);
+}
+function readRootStructuredFileSyncInternal(options, parser) {
+    let absolutePath;
+    let relativePath;
+    let rootDir;
+    let rootRealPath;
+    try {
+        rootDir = options.rootDir;
+        relativePath = options.relativePath;
+        rootRealPath = options.rootRealPath;
+        assertNoWindowsPathAlias(rootDir);
+        assertNoWindowsPathAlias(relativePath, "relative");
+        if (rootRealPath !== undefined) {
+            assertNoWindowsPathAlias(rootRealPath);
+        }
+        absolutePath = path.resolve(rootDir, relativePath);
+        assertNoWindowsPathAlias(absolutePath);
+    }
+    catch (error) {
+        return {
+            ok: false,
+            reason: "open",
+            failure: { ok: false, reason: "validation", error },
+        };
+    }
+    const boundaryLabel = options.boundaryLabel;
+    const rejectHardlinks = options.rejectHardlinks;
+    const maxBytes = options.maxBytes;
     const opened = openRootFileSync({
         absolutePath,
-        rootPath: options.rootDir,
-        ...(options.rootRealPath !== undefined ? { rootRealPath: options.rootRealPath } : {}),
-        boundaryLabel: options.boundaryLabel,
-        rejectHardlinks: options.rejectHardlinks,
-        maxBytes: options.maxBytes,
+        rootPath: rootDir,
+        rootRealPath,
+        boundaryLabel,
+        rejectHardlinks,
+        maxBytes,
         allowedType: "file",
     });
     if (!opened.ok) {
         return { ok: false, reason: "open", failure: opened };
     }
     try {
-        const raw = options.maxBytes === undefined
+        const raw = maxBytes === undefined
             ? fsSync.readFileSync(opened.fd, "utf8")
-            : readFileDescriptorBoundedSync(opened.fd, options.maxBytes).toString("utf8");
-        const parsed = options.parse(raw);
-        if (options.validate && !options.validate(parsed)) {
+            : readFileDescriptorBoundedSync(opened.fd, maxBytes).toString("utf8");
+        const parse = parser.parse;
+        const parsed = Reflect.apply(parse, parser, [raw]);
+        const validate = parser.validate;
+        if (validate && !Reflect.apply(validate, parser, [parsed])) {
             return {
                 ok: false,
                 reason: "invalid",
-                error: resolveInvalidMessage(options.invalidMessage, options.relativePath),
+                error: resolveInvalidMessage(parser.invalidMessage, relativePath),
             };
         }
         return {
@@ -243,7 +277,7 @@ export function readRootStructuredFileSync(options) {
         return {
             ok: false,
             reason: "parse",
-            error: `failed to parse ${options.relativePath}: ${String(error)}`,
+            error: `failed to parse ${relativePath}: ${String(error)}`,
         };
     }
     finally {
@@ -251,14 +285,12 @@ export function readRootStructuredFileSync(options) {
     }
 }
 export function readRootJsonSync(options) {
-    return readRootStructuredFileSync({
-        ...options,
+    return readRootStructuredFileSyncInternal(options, {
         parse: (raw) => JSON.parse(raw),
     });
 }
 export function readRootJsonObjectSync(options) {
-    return readRootStructuredFileSync({
-        ...options,
+    return readRootStructuredFileSyncInternal(options, {
         parse: (raw) => JSON.parse(raw),
         validate: isRecord,
         invalidMessage: (relativePath) => `${relativePath} must contain a JSON object`,
@@ -333,8 +365,9 @@ export function readJsonSync(filePath, options = {}) {
     }
 }
 export async function writeJson(filePath, value, options) {
+    const admittedPath = admitStandalonePublicationPath(filePath);
     const text = stringifyJsonDocument(value, null, 2);
-    await writeTextAtomic(filePath, text, {
+    await writeTextAtomic(admittedPath, text, {
         mode: options?.mode,
         dirMode: options?.dirMode,
         trailingNewline: options?.trailingNewline,

package/node_modules/@openclaw/fs-safe/dist/local-file-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-file-access.d.ts","sourceRoot":"","sources":["../src/local-file-access.ts"],"names":[],"mappings":"AAOA,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEhD;AAOD,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAeT;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAET;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,SAAS,GAAG,IAAI,CAIjF;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAqBR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,SAAS,CAMpB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAgB3E"}
+{"version":3,"file":"local-file-access.d.ts","sourceRoot":"","sources":["../src/local-file-access.ts"],"names":[],"mappings":"AAQA,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEhD;AAOD,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAeT;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAET;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,SAAS,GAAG,IAAI,CAIjF;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAwBR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,SAAS,CAMpB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAgB3E"}

package/node_modules/@openclaw/fs-safe/dist/local-file-access.js

@@ -1,6 +1,7 @@
 import path from "node:path";
 import { fileURLToPath, URL } from "node:url";
 import { normalizeLowercaseStringOrEmpty } from "./string-coerce.js";
+import { hasWindowsPathAlias } from "./windows-path-alias.js";
 const ENCODED_FILE_URL_SEPARATOR_RE = /%(?:2f|5c)/i;
 const FILE_URL_PREFIX_RE = /^file:\/\//i;
 export function isFileUrl(input) {
@@ -54,6 +55,9 @@ export function safeFileURLToPath(fileUrl, platform = process.platform) {
         throw new Error(`file:// URLs cannot encode path separators: ${fileUrl}`);
     }
     const filePath = fileURLToPath(parsed, { windows: platform === "win32" });
+    if (hasWindowsPathAlias(filePath, "filesystem", platform)) {
+        throw new Error(`Local file URL cannot use Windows filesystem namespace aliases: ${filePath}`);
+    }
     if (isWindowsNetworkPath(filePath, platform)) {
         throw new Error(`Local file URL cannot use Windows network paths: ${filePath}`);
     }

package/node_modules/@openclaw/fs-safe/dist/local-file-descriptor.d.ts

@@ -0,0 +1,17 @@
+import type { BigIntStats, Stats } from "node:fs";
+import type { FileHandle } from "node:fs/promises";
+import type { HardlinkPolicy } from "./root-options.js";
+import type { SymlinkPolicy } from "./root-symlink-policy.js";
+type OwnedLocalFile = {
+    handle: FileHandle;
+    stat: Stats;
+    identity: BigIntStats;
+    preOpenStat: BigIntStats | undefined;
+};
+export declare function openLocalFileDescriptor(filePath: string, options?: {
+    hardlinks?: HardlinkPolicy;
+    symlinks?: SymlinkPolicy;
+    readWrite?: true;
+}): Promise<OwnedLocalFile>;
+export {};
+//# sourceMappingURL=local-file-descriptor.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/local-file-descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-file-descriptor.d.ts","sourceRoot":"","sources":["../src/local-file-descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAYnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAO9D,KAAK,cAAc,GAAG;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,EAAE,WAAW,CAAC;IACtB,WAAW,EAAE,WAAW,GAAG,SAAS,CAAC;CACtC,CAAC;AAIF,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,GACA,OAAO,CAAC,cAAc,CAAC,CA0EzB"}

package/node_modules/@openclaw/fs-safe/dist/local-file-descriptor.js

@@ -0,0 +1,84 @@
+import fsSync from "node:fs";
+import fs from "node:fs/promises";
+import { FsSafeError } from "./errors.js";
+import { recordFileOpenFailure, recordPreOpenFileChange } from "./opened-file-failure.js";
+import { assertNoUnsafeDeviceReadPath, hasNodeErrorCode, isNotFoundPathError, isSymlinkOpenError, } from "./path.js";
+import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { fileNotFoundError, hardlinkedPathNotAllowedError } from "./root-errors.js";
+import { inspectFileIdentity } from "./strict-file-identity.js";
+import { getFsSafeTestHooks } from "./test-hooks.js";
+const OPEN_READ_FLAGS = resolveReadOpenFlags();
+const OPEN_READ_FOLLOW_FLAGS = resolveReadOpenFlags({ followSymlinks: true });
+// Ownership transfers only after descriptor verification. Each admission caller
+// must close on rejection and construct an OpenResult only after admission.
+export async function openLocalFileDescriptor(filePath, options) {
+    assertNoUnsafeDeviceReadPath(filePath);
+    const fsSafeTestHooks = getFsSafeTestHooks();
+    let preOpenStat;
+    let observedBeforeOpen = false;
+    // Reject directories before opening so we never surface EISDIR to callers (e.g. tool
+    // results that get sent to messaging channels). See openclaw/openclaw#31186.
+    try {
+        preOpenStat = await inspectFileIdentity(() => {
+            const stat = fsSync.lstatSync(filePath, { bigint: true });
+            observedBeforeOpen = true;
+            if (stat.isSymbolicLink() && options?.symlinks !== "follow-within-root") {
+                throw new FsSafeError("symlink", "symlink not allowed");
+            }
+            if (!stat.isFile() && !stat.isSymbolicLink()) {
+                throw new FsSafeError("not-file", "not a file");
+            }
+            return stat;
+        });
+    }
+    catch (err) {
+        if (err instanceof FsSafeError || observedBeforeOpen) {
+            throw err;
+        }
+        // Only an initial lookup failure falls through; a failed re-inspection aborts.
+    }
+    if (preOpenStat) {
+        await fsSafeTestHooks?.afterPreOpenLstat?.(filePath);
+    }
+    const openFlags = (options?.symlinks === "follow-within-root"
+        ? OPEN_READ_FOLLOW_FLAGS
+        : OPEN_READ_FLAGS) | (options?.readWrite ? fsSync.constants.O_RDWR : 0);
+    await fsSafeTestHooks?.beforeOpen?.(filePath, openFlags);
+    let handle;
+    try {
+        handle = await fs.open(filePath, openFlags).catch((error) => recordFileOpenFailure(isNotFoundPathError(error) ? fileNotFoundError() : error, filePath));
+    }
+    catch (err) {
+        if (isSymlinkOpenError(err)) {
+            throw new FsSafeError("symlink", "symlink open blocked", { cause: err });
+        }
+        // Defensive: if open still throws EISDIR (e.g. race), sanitize so it never leaks.
+        if (hasNodeErrorCode(err, "EISDIR")) {
+            throw new FsSafeError("not-file", "not a file");
+        }
+        throw err;
+    }
+    try {
+        await fsSafeTestHooks?.afterOpen?.(filePath, handle);
+        const stat = fsSync.fstatSync(handle.fd);
+        if (!stat.isFile()) {
+            throw new FsSafeError("not-file", "not a file");
+        }
+        // Keep numeric Stats for the public receipt, never for identity verification.
+        let openedIdentity;
+        const identity = await inspectFileIdentity(() => (openedIdentity = fsSync.fstatSync(handle.fd, { bigint: true })), preOpenStat && !preOpenStat.isSymbolicLink() ? preOpenStat : undefined).catch(async (error) => {
+            if ([0, 1].includes(stat.nlink)) {
+                await recordPreOpenFileChange(error, handle, filePath, preOpenStat, openedIdentity);
+            }
+            throw error;
+        });
+        if (options?.hardlinks === "reject" && stat.nlink > 1) {
+            throw hardlinkedPathNotAllowedError();
+        }
+        return { handle, stat, identity, preOpenStat };
+    }
+    catch (err) {
+        await handle.close().catch(() => { });
+        throw err;
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/local-roots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-roots.d.ts","sourceRoot":"","sources":["../src/local-roots.ts"],"names":[],"mappings":"AAQA,OAAO,EAAQ,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAE3F,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG,sBAAsB,GAAG;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,sBAAsB,GAAG;IACnE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAgDF,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,oCAAoC,GAC5C,oBAAoB,GAAG,IAAI,CAuC7B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA2CtC"}
+{"version":3,"file":"local-roots.d.ts","sourceRoot":"","sources":["../src/local-roots.ts"],"names":[],"mappings":"AAQA,OAAO,EAAQ,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAQ3F,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG,sBAAsB,GAAG;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,sBAAsB,GAAG;IACnE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAiEF,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,oCAAoC,GAC5C,oBAAoB,GAAG,IAAI,CA2C7B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAuCtC"}

package/node_modules/@openclaw/fs-safe/dist/local-roots.js

@@ -2,11 +2,12 @@ import fsSync from "node:fs";
 import path from "node:path";
 import { normalizeMaxBytes } from "./byte-budget.js";
 import { FsSafeError } from "./errors.js";
-import { expandHomePrefix, resolveHomeRelativePath } from "./home-dir.js";
+import { expandHomePrefix, resolveRequiredHomeDir } from "./home-dir.js";
 import { isFileUrl, safeFileURLToPath } from "./local-file-access.js";
-import { isPathInside } from "./path.js";
-import { resolveRootPathSync } from "./root-path.js";
+import { realpathSync } from "./realpath.js";
+import { ROOT_PATH_ALIAS_POLICIES, resolveRootPathSync } from "./root-path.js";
 import { root } from "./root.js";
+import { assertNoWindowsPathAlias, isWindowsPathAliasError, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 function resolveLocalPathInput(input, label) {
     if (isFileUrl(input)) {
         try {
@@ -20,7 +21,18 @@ function resolveLocalPathInput(input, label) {
     if (input.includes("\0")) {
         throw new FsSafeError("invalid-path", `${label} must not contain NUL bytes`);
     }
-    return resolveHomeRelativePath(input);
+    assertNoWindowsPathAlias(input, "filesystem", `${label} uses a Windows filesystem namespace alias`);
+    const homePrefix = input === "~" || input.startsWith("~/") ||
+        (path.sep === "\\" && input.startsWith("~\\"));
+    const expanded = homePrefix ? `${resolveRequiredHomeDir()}${path.sep}${input.slice(2)}` : input;
+    assertNoWindowsPathAlias(expanded, "filesystem", `${label} uses a Windows filesystem namespace alias`);
+    if (path.isAbsolute(expanded))
+        return expanded;
+    const drive = path.parse(expanded).root;
+    const base = drive ? path.resolve(drive) : process.cwd();
+    const resolved = `${base}${path.sep}${expanded.slice(drive.length)}`;
+    assertNoWindowsPathAlias(resolved, "filesystem", `${label} uses a Windows filesystem namespace alias`);
+    return resolved;
 }
 function resolveLocalRootInput(input, label) {
     const trimmed = input.trim();
@@ -33,29 +45,44 @@ function resolveLocalRootInput(input, label) {
     if (resolved.includes("\0")) {
         throw new FsSafeError("invalid-path", `${label} entry must not contain NUL bytes`);
     }
+    assertNoWindowsPathAlias(resolved, "filesystem", `${label} entry uses a Windows filesystem namespace alias`);
     if (!path.isAbsolute(resolved)) {
         throw new FsSafeError("invalid-path", `${label} entries must be absolute paths: ${input}`);
     }
-    return path.resolve(resolved);
+    const absolute = resolvePathPreservingWindowsRoot(resolved);
+    assertNoWindowsPathAlias(absolute, "filesystem", `${label} entry uses a Windows filesystem namespace alias`);
+    return absolute;
 }
 function resolveRootRealSync(rootDir) {
+    let realPath;
     try {
         // Configured roots may themselves be symlinks. Follow only this trusted
         // root entry, then use its canonical directory for containment checks.
-        const stat = fsSync.statSync(rootDir);
+        const operationPath = pathForWindowsFilesystem(rootDir);
+        const stat = fsSync.statSync(operationPath);
         if (!stat.isDirectory()) {
             return null;
         }
-        return fsSync.realpathSync(rootDir);
+        realPath = realpathSync(operationPath);
     }
     catch {
         return null;
     }
+    assertNoWindowsPathAlias(realPath, "filesystem", "local root uses a Windows filesystem namespace alias");
+    return realPath;
 }
 export function resolveLocalPathFromRootsSync(options) {
     const label = options.label ?? "local roots";
-    const requestedPath = path.resolve(resolveLocalPathInput(options.filePath, "file path"));
     const rootDirs = options.roots.map((rootEntry) => resolveLocalRootInput(rootEntry, label));
+    let requestedPath;
+    try {
+        requestedPath = resolveLocalPathInput(options.filePath, "file path");
+    }
+    catch (error) {
+        if (isWindowsPathAliasError(error))
+            return null;
+        throw error;
+    }
     for (const rootDir of rootDirs) {
         const rootReal = resolveRootRealSync(rootDir);
         if (!rootReal) {
@@ -69,6 +96,7 @@ export function resolveLocalPathFromRootsSync(options) {
                 rootCanonicalPath: rootReal,
                 boundaryLabel: label,
                 rejectUnresolvedSymlinks: true,
+                policy: options.requireFile ? ROOT_PATH_ALIAS_POLICIES.unlinkTarget : undefined,
             });
         }
         catch {
@@ -77,11 +105,12 @@ export function resolveLocalPathFromRootsSync(options) {
         if (!candidate.exists && options.allowMissing !== true) {
             continue;
         }
+        if (candidate.exists && options.requireFile === true && candidate.kind !== "file")
+            continue;
         if (candidate.exists && options.requireFile === true) {
             try {
-                if (!fsSync.lstatSync(requestedPath).isFile()) {
+                if (!fsSync.lstatSync(pathForWindowsFilesystem(requestedPath)).isFile())
                     continue;
-                }
             }
             catch {
                 continue;
@@ -94,8 +123,16 @@ export function resolveLocalPathFromRootsSync(options) {
 export async function readLocalFileFromRoots(options) {
     const maxBytes = normalizeMaxBytes(options.maxBytes);
     const label = options.label ?? "local roots";
-    const requestedPath = path.resolve(resolveLocalPathInput(options.filePath, "file path"));
     const rootDirs = options.roots.map((rootEntry) => resolveLocalRootInput(rootEntry, label));
+    let requestedPath;
+    try {
+        requestedPath = resolveLocalPathInput(options.filePath, "file path");
+    }
+    catch (error) {
+        if (isWindowsPathAliasError(error))
+            return null;
+        throw error;
+    }
     for (const rootDir of rootDirs) {
         let scopedRoot;
         try {
@@ -113,22 +150,12 @@ export async function readLocalFileFromRoots(options) {
         if (maxBytes !== undefined) {
             readOptions.maxBytes = maxBytes;
         }
-        // A trusted root symlink has two valid spellings. Preserve the caller's
-        // lexical spelling when possible so Root.read() still enforces its
-        // symlink policy, while also accepting a path expressed below rootReal.
-        const relativePaths = [scopedRoot.rootDir, scopedRoot.rootReal]
-            .filter((rootPath, index, roots) => roots.indexOf(rootPath) === index)
-            .filter((rootPath) => isPathInside(rootPath, requestedPath))
-            .map((rootPath) => path.relative(rootPath, requestedPath))
-            .filter(Boolean);
-        for (const relativePath of relativePaths) {
-            try {
-                const result = await scopedRoot.read(relativePath, readOptions);
-                return { ...result, root: scopedRoot.rootReal };
-            }
-            catch {
-                // Try the canonical spelling before moving to the next configured root.
-            }
+        try {
+            const result = await scopedRoot.readAbsolute(requestedPath, readOptions);
+            return { ...result, root: scopedRoot.rootReal };
+        }
+        catch {
+            // Root handles both trusted spellings; try the next configured root.
         }
     }
     return null;

package/node_modules/@openclaw/fs-safe/dist/move-path-cleanup.d.ts

@@ -1,3 +1,4 @@
+import fsSync from "node:fs";
 export type EntryIdentity = {
     ctimeMs: number;
     dev: number;
@@ -12,6 +13,7 @@ export type CopiedEntryManifest = (EntryIdentity & {
         name: string;
         manifest: CopiedEntryManifest;
     }>;
+    directoryIdentity: Readonly<Pick<fsSync.BigIntStats, "dev" | "ino">>;
     kind: "directory";
 }) | (EntryIdentity & {
     kind: "leaf";

package/node_modules/@openclaw/fs-safe/dist/move-path-cleanup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"move-path-cleanup.d.ts","sourceRoot":"","sources":["../src/move-path-cleanup.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B,CAAC,aAAa,GAAG;IACf,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;IACjE,IAAI,EAAE,WAAW,CAAC;CACnB,CAAC,GACF,CAAC,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEvC,KAAK,wBAAwB,GAAG,SAAS,GAAG,OAAO,CAAC;AAEpD,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,aAAa,CAAC;IACxB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC7C,CAAC;AAEF,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,aAAa,CAUhB;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAUxE;AAMD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,KAAK,CAI5D;AAED,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,IAAI,CAAC,CAIf;AA0BD,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,mBAAmB,GAC5B,uBAAuB,CAuBzB;AAsDD,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,mBAAmB,EAC7B,KAAK,EAAE,uBAAuB,EAC9B,oBAAoB,EAAE,MAAM,IAAI,GAC/B,OAAO,CAAC,wBAAwB,CAAC,CAyDnC"}
+{"version":3,"file":"move-path-cleanup.d.ts","sourceRoot":"","sources":["../src/move-path-cleanup.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAC;AAM7B,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B,CAAC,aAAa,GAAG;IACf,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;IACjE,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;IACrE,IAAI,EAAE,WAAW,CAAC;CACnB,CAAC,GACF,CAAC,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEvC,KAAK,wBAAwB,GAAG,SAAS,GAAG,OAAO,CAAC;AAEpD,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,aAAa,CAAC;IACxB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC7C,CAAC;AAEF,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,aAAa,CAUhB;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAUxE;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,KAAK,CAI5D;AAED,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,IAAI,CAAC,CAIf;AA0BD,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,mBAAmB,GAC5B,uBAAuB,CAuBzB;AAsDD,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,mBAAmB,EAC7B,KAAK,EAAE,uBAAuB,EAC9B,oBAAoB,EAAE,MAAM,IAAI,GAC/B,OAAO,CAAC,wBAAwB,CAAC,CAkFnC"}

package/node_modules/@openclaw/fs-safe/dist/move-path-cleanup.js

@@ -1,5 +1,8 @@
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
 export function entryIdentity(stat) {
     return {
         ctimeMs: stat.ctimeMs,
@@ -20,16 +23,13 @@ export function sameIdentity(a, b) {
         a.mtimeMs === b.mtimeMs &&
         a.ctimeMs === b.ctimeMs);
 }
-function sameDirectoryNode(a, b) {
-    return a.dev === b.dev && a.ino === b.ino;
-}
 export function sourceChangedError(sourcePath) {
     return Object.assign(new Error(`Source changed during move fallback: ${sourcePath}`), {
         code: "ESTALE",
     });
 }
 export async function assertSourceStillMatches(sourcePath, identity) {
-    if (!sameIdentity(identity, entryIdentity(await fs.lstat(sourcePath)))) {
+    if (!sameIdentity(identity, entryIdentity(fsSync.lstatSync(sourcePath)))) {
         throw sourceChangedError(sourcePath);
     }
 }
@@ -93,7 +93,7 @@ async function observeOwnedAliasUnlink(sourcePath, group) {
     }
     let observed;
     try {
-        observed = await fs.lstat(remainingPath);
+        observed = fsSync.lstatSync(remainingPath);
     }
     catch (error) {
         if (error?.code === "ENOENT") {
@@ -112,22 +112,19 @@ function mergeCleanupResults(a, b) {
     return a === "stale" || b === "stale" ? "stale" : "removed";
 }
 export async function cleanupCopiedEntry(sourcePath, manifest, state, assertBeforeMutation) {
-    const aliasGroup = manifest.kind === "leaf" ? state.aliasGroups.get(identityKey(manifest)) : undefined;
-    if (aliasGroup?.stale) {
-        return "stale";
-    }
-    let currentStat;
-    try {
-        currentStat = await fs.lstat(sourcePath);
-    }
-    catch (error) {
-        if (error?.code === "ENOENT") {
-            return aliasGroup ? poisonAliasGroup(aliasGroup) : "removed";
-        }
-        throw error;
-    }
     if (manifest.kind === "directory") {
-        if (!currentStat.isDirectory() || !sameDirectoryNode(manifest, entryIdentity(currentStat))) {
+        let currentStat;
+        try {
+            currentStat = inspectFileIdentitySync(() => fsSync.lstatSync(sourcePath, { bigint: true }), manifest.directoryIdentity);
+        }
+        catch (error) {
+            if (error?.code === "ENOENT")
+                return "removed";
+            if (error instanceof FsSafeError && error.code === "path-mismatch")
+                return "stale";
+            throw error;
+        }
+        if (!currentStat.isDirectory()) {
             return "stale";
         }
         // A same-inode directory can gain unrelated children after commit. Still
@@ -136,7 +133,23 @@ export async function cleanupCopiedEntry(sourcePath, manifest, state, assertBefo
         for (const child of manifest.children) {
             result = mergeCleanupResults(result, await cleanupCopiedEntry(path.join(sourcePath, child.name), child.manifest, state, assertBeforeMutation));
         }
+        // Child cleanup and the caller's authority check can replace the directory.
+        // Keep the final exact observation after both, immediately before removal.
         assertBeforeMutation();
+        try {
+            currentStat = inspectFileIdentitySync(() => fsSync.lstatSync(sourcePath, { bigint: true }), manifest.directoryIdentity);
+        }
+        catch (error) {
+            if (error?.code === "ENOENT") {
+                return "stale";
+            }
+            if (error instanceof FsSafeError && error.code === "path-mismatch")
+                return "stale";
+            throw error;
+        }
+        if (!currentStat.isDirectory()) {
+            return "stale";
+        }
         try {
             await fs.rmdir(sourcePath);
         }
@@ -149,6 +162,20 @@ export async function cleanupCopiedEntry(sourcePath, manifest, state, assertBefo
         }
         return result;
     }
+    const aliasGroup = state.aliasGroups.get(identityKey(manifest));
+    if (aliasGroup?.stale) {
+        return "stale";
+    }
+    let currentStat;
+    try {
+        currentStat = fsSync.lstatSync(sourcePath);
+    }
+    catch (error) {
+        if (error?.code === "ENOENT") {
+            return aliasGroup ? poisonAliasGroup(aliasGroup) : "removed";
+        }
+        throw error;
+    }
     const expected = aliasGroup?.expected ?? manifest;
     if (!sameIdentity(expected, entryIdentity(currentStat))) {
         return aliasGroup ? poisonAliasGroup(aliasGroup) : "stale";

package/node_modules/@openclaw/fs-safe/dist/move-path-stage.d.ts

@@ -0,0 +1,8 @@
+import { type BigIntStats } from "node:fs";
+export declare function createMoveStageOwner(staged: string): Promise<{
+    record(created: BigIntStats): void;
+    assertCurrent: () => void;
+    published(): void;
+    cleanup(): Promise<void>;
+}>;
+//# sourceMappingURL=move-path-stage.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/move-path-stage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"move-path-stage.d.ts","sourceRoot":"","sources":["../src/move-path-stage.ts"],"names":[],"mappings":"AAAA,OAAe,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AASnD,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM;oBAkBrC,WAAW,GAAG,IAAI;yBAPV,IAAI;iBAkBf,IAAI;eACA,OAAO,CAAC,IAAI,CAAC;GAajC"}

package/node_modules/@openclaw/fs-safe/dist/move-path-stage.js

@@ -0,0 +1,56 @@
+import fsSync, {} from "node:fs";
+import path from "node:path";
+import { createAsyncDirectoryGuard } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { guardedRm, guardedRmSync } from "./guarded-mutation.js";
+import { sameFileIdentityForCleanup } from "./file-identity.js";
+import { registerTempPathForExit } from "./temp-cleanup.js";
+import { realpathSync } from "./realpath.js";
+export async function createMoveStageOwner(staged) {
+    const parent = await createAsyncDirectoryGuard(path.dirname(staged), { bigint: true });
+    let identity;
+    let unregister;
+    const changed = () => new FsSafeError("path-mismatch", "move staging path changed before publication");
+    const assertParent = () => {
+        const current = fsSync.lstatSync(parent.dir, { bigint: true });
+        if (!current.isDirectory() || current.isSymbolicLink() ||
+            !sameFileIdentityForCleanup(current, parent.stat) ||
+            realpathSync.native(parent.dir) !== parent.realPath)
+            throw changed();
+    };
+    const assertCurrent = () => {
+        assertParent();
+        if (!identity || !sameFileIdentityForCleanup(fsSync.lstatSync(staged, { bigint: true }), identity)) {
+            throw changed();
+        }
+    };
+    return {
+        record(created) {
+            if (!sameFileIdentityForCleanup(created, created))
+                throw changed();
+            identity = created;
+            unregister = registerTempPathForExit(staged, {
+                identity,
+                cleanupSync: () => {
+                    guardedRmSync({ target: staged, recursive: created.isDirectory(), assertBeforeMutation: assertCurrent });
+                },
+            });
+        },
+        assertCurrent,
+        published() { unregister?.(); },
+        async cleanup() {
+            if (!identity)
+                return;
+            try {
+                await guardedRm({ target: staged, recursive: identity.isDirectory(), assertBeforeMutation: assertCurrent });
+                unregister?.();
+            }
+            catch (error) {
+                if (error.code === "ENOENT" || error instanceof FsSafeError) {
+                    unregister?.();
+                }
+                // Retry only the original receipt after transient cleanup I/O failures.
+            }
+        },
+    };
+}

package/node_modules/@openclaw/fs-safe/dist/move-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"move-path.d.ts","sourceRoot":"","sources":["../src/move-path.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;IAClC,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;IAChC,qFAAqF;IACrF,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,IAAI,CAAC;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,KAAK,sBAAsB,GAAG,cAAc,GAAG,uBAAuB,CAAC;AAEvE,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,sBAAsB,GAAG,SAAS,CASpC;AAsPD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAqHf"}
+{"version":3,"file":"move-path.d.ts","sourceRoot":"","sources":["../src/move-path.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;IAClC,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;IAChC,qFAAqF;IACrF,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,IAAI,CAAC;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,KAAK,sBAAsB,GAAG,cAAc,GAAG,uBAAuB,CAAC;AAEvE,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,sBAAsB,GAAG,SAAS,CASpC;AAoSD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAoHf"}