@openclaw/openshell-sandbox 2026.9.4 → 2026.9.5

package/node_modules/@openclaw/fs-safe/dist/root-remove-identity.js

@@ -0,0 +1,89 @@
+import fsSync from "node:fs";
+import { inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { realpathSync } from "./realpath.js";
+import { directoryComponentNotDirectoryError } from "./root-errors.js";
+const MAX_SAFE_DIRECTORY_IDENTITY = BigInt(Number.MAX_SAFE_INTEGER);
+function identityMismatch(cause) {
+    return new FsSafeError("path-mismatch", "removal ancestor identity changed or could not be verified", {
+        cause: cause instanceof Error ? cause : undefined,
+    });
+}
+function safeIdentityNumber(value) {
+    if (value < 0n || value > MAX_SAFE_DIRECTORY_IDENTITY)
+        return undefined;
+    return Number(value);
+}
+export function createRemovalDirectoryAssertion(path, identity, realPath, platform = process.platform) {
+    const dev = safeIdentityNumber(identity.dev);
+    const ino = safeIdentityNumber(identity.ino);
+    const numeric = dev !== undefined && ino !== undefined &&
+        (platform !== "win32" || (dev !== 0 && ino !== 0));
+    return Object.freeze({
+        path,
+        dev: identity.dev,
+        ino: identity.ino,
+        numericDev: numeric ? dev : undefined,
+        numericIno: numeric ? ino : undefined,
+        platform,
+        realPath,
+    });
+}
+function assertDirectoryType(stat) {
+    if (typeof stat?.isDirectory !== "function" || typeof stat.isSymbolicLink !== "function") {
+        throw identityMismatch();
+    }
+    if (stat.isSymbolicLink() || !stat.isDirectory())
+        throw directoryComponentNotDirectoryError();
+}
+function assertExactObservation(stat, expected, platform) {
+    assertDirectoryType(stat);
+    if (typeof stat.dev !== "bigint" || typeof stat.ino !== "bigint")
+        throw identityMismatch();
+    if (platform === "win32" && (stat.dev === 0n || stat.ino === 0n))
+        throw identityMismatch();
+    if (stat.dev !== expected.dev || stat.ino !== expected.ino)
+        throw identityMismatch();
+}
+function assertNumericObservation(assertion) {
+    const stat = fsSync.lstatSync(assertion.path);
+    assertDirectoryType(stat);
+    if (!Number.isSafeInteger(stat.dev) || stat.dev < 0 ||
+        !Number.isSafeInteger(stat.ino) || stat.ino < 0) {
+        throw identityMismatch();
+    }
+    let unknown = false;
+    const observedDev = stat.dev;
+    const expectedDev = assertion.numericDev;
+    if (assertion.platform === "win32" && observedDev === 0) {
+        unknown = true;
+    }
+    else if (observedDev !== expectedDev) {
+        // Reject a known mismatch before considering an unknown companion field.
+        throw identityMismatch();
+    }
+    const observedIno = stat.ino;
+    const expectedIno = assertion.numericIno;
+    if (assertion.platform === "win32" && observedIno === 0) {
+        unknown = true;
+    }
+    else if (observedIno !== expectedIno) {
+        throw identityMismatch();
+    }
+    if (unknown) {
+        // The numeric lstat is the first observation. Permit one exact retry only,
+        // retaining every known component and the original exact admission receipt.
+        assertExactObservation(fsSync.lstatSync(assertion.path, { bigint: true }), assertion, assertion.platform);
+    }
+}
+export function assertRemovalDirectoryCurrent(assertion) {
+    if (assertion.numericDev !== undefined && assertion.numericIno !== undefined) {
+        assertNumericObservation(assertion);
+    }
+    else {
+        inspectDirectoryIdentitySync(assertion.path, assertion, undefined, assertion.platform);
+    }
+    if (assertion.realPath !== undefined && realpathSync.native(assertion.path) !== assertion.realPath) {
+        throw identityMismatch();
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/root-remove-receipt.d.ts

@@ -0,0 +1,17 @@
+import type { BigIntStats } from "node:fs";
+export type CapturedRemovalDirectory = Readonly<{
+    path: string;
+    stat: BigIntStats;
+}>;
+export declare class RemovalPathReceipts {
+    private rootStat;
+    private directories;
+    readonly observeRoot: (stat: BigIntStats) => void;
+    observeDirectory(dir: string, stat: BigIntStats): void;
+    complete(rootReal: string, targetPath: string): {
+        rootStat: BigIntStats;
+        parent: CapturedRemovalDirectory | undefined;
+        directories: readonly CapturedRemovalDirectory[];
+    } | undefined;
+}
+//# sourceMappingURL=root-remove-receipt.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-remove-receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-remove-receipt.d.ts","sourceRoot":"","sources":["../src/root-remove-receipt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAI3C,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;CACnB,CAAC,CAAC;AAKH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAA0B;IAC1C,OAAO,CAAC,WAAW,CAAoD;IAEvE,QAAQ,CAAC,WAAW,SAAU,WAAW,KAAG,IAAI,CAA8B;IAE9E,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAIrD;IAED,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;QAC9C,QAAQ,EAAE,WAAW,CAAC;QACtB,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC;QAC7C,WAAW,EAAE,SAAS,wBAAwB,EAAE,CAAC;KAClD,GAAG,SAAS,CAiBZ;CACF"}

package/node_modules/@openclaw/fs-safe/dist/root-remove-receipt.js

@@ -0,0 +1,37 @@
+import path from "node:path";
+import { isPathInside } from "./path.js";
+// Private to a single nonrecursive removal. No observations are shared across
+// operations, and a lexical observation never stands in for an unvisited alias
+// target on the final canonical chain.
+export class RemovalPathReceipts {
+    rootStat;
+    directories;
+    observeRoot = (stat) => { this.rootStat = stat; };
+    observeDirectory(dir, stat) {
+        // Retain the first object if raw traversal revisits the same spelling.
+        const directories = this.directories ??= new Map();
+        if (!directories.has(dir))
+            directories.set(dir, { path: dir, stat });
+    }
+    complete(rootReal, targetPath) {
+        const parentPath = path.dirname(targetPath);
+        if (!this.rootStat || !isPathInside(rootReal, parentPath))
+            return undefined;
+        const directories = [];
+        let current = parentPath;
+        while (current !== rootReal) {
+            // Exact spelling is intentional: case/namespace aliases and symlink hops
+            // that did not visit the complete canonical chain use fresh admission.
+            const directory = this.directories?.get(current);
+            if (!directory)
+                return undefined;
+            directories.push(directory);
+            const parent = path.dirname(current);
+            if (parent === current)
+                return undefined;
+            current = parent;
+        }
+        directories.reverse();
+        return { rootStat: this.rootStat, parent: directories.at(-1), directories };
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/root-remove.d.ts

@@ -0,0 +1,6 @@
+import { type RootContext } from "./root-context.js";
+import type { RootRemoveOptions } from "./root-options.js";
+import type { RemovalPathReceipts } from "./root-remove-receipt.js";
+export declare function validateRemoveOptions(options: RootRemoveOptions): void;
+export declare function removePathInRootFallback(root: RootContext, targetPath: string, options: RootRemoveOptions, receipts?: RemovalPathReceipts): Promise<void>;
+//# sourceMappingURL=root-remove.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-remove.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-remove.d.ts","sourceRoot":"","sources":["../src/root-remove.ts"],"names":[],"mappings":"AAeA,OAAO,EAA6B,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAM3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AASpE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAgBtE;AAsOD,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,CAAC,EAAE,mBAAmB,GAC7B,OAAO,CAAC,IAAI,CAAC,CA6Lf"}

package/node_modules/@openclaw/fs-safe/dist/root-remove.js

@@ -0,0 +1,448 @@
+import fsSync from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { assertSyncDirectoryGuard, createAsyncDirectoryGuard, inspectDirectoryIdentitySync, } from "./directory-guard.js";
+import { assertMutationNotDenied } from "./deny-mutations.js";
+import { FsSafeError } from "./errors.js";
+import { sameFileIdentityForCleanup } from "./file-identity.js";
+import { MutationAuthorityError } from "./mutation-authority.js";
+import { isNotFoundPathError, isPathInside } from "./path.js";
+import { assertRootIdentityCurrent } from "./root-context.js";
+import { normalizeRemoveGuardError, normalizeRemovePathError, rootPathChangedError } from "./root-errors.js";
+import { assertRemovalDirectoryCurrent, createRemovalDirectoryAssertion, } from "./root-remove-identity.js";
+import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { createSuppressedError } from "./suppressed-error.js";
+import { getFsSafeTestHooks } from "./test-hooks.js";
+const DEFAULT_MAX_ENTRIES = 100_000;
+const DEFAULT_MAX_DEPTH = 64;
+export function validateRemoveOptions(options) {
+    if (options.order !== undefined && options.order !== "filesystem" && options.order !== "sorted") {
+        throw new TypeError("remove order must be filesystem or sorted");
+    }
+    for (const key of ["maxEntries", "maxDepth"]) {
+        const value = options[key];
+        if (value !== undefined && value !== Number.POSITIVE_INFINITY && (!Number.isSafeInteger(value) || value < 0)) {
+            throw new RangeError(`${key} must be a non-negative safe integer`);
+        }
+    }
+    if (!options.recursive && (options.maxEntries !== undefined || options.maxDepth !== undefined)) {
+        throw new TypeError("remove budgets require recursive: true");
+    }
+    if (!options.recursive && options.order !== undefined) {
+        throw new TypeError("remove order requires recursive: true");
+    }
+}
+function assertNotAborted(signal) {
+    try {
+        signal?.throwIfAborted();
+    }
+    catch (error) {
+        // Preserve arbitrary abort reasons through Root's filesystem error mapping.
+        throw new MutationAuthorityError(error);
+    }
+}
+function removalAncestorChanged(error) {
+    return new FsSafeError("path-mismatch", "removal ancestor changed during operation", {
+        cause: error instanceof Error ? error : undefined,
+    });
+}
+function sameCanonicalDirectory(left, right) {
+    return left === right || (isPathInside(left, right) && isPathInside(right, left));
+}
+function assertExactRemovalReceiptPrefixCurrent(rootGuard, intermediates) {
+    try {
+        assertSyncDirectoryGuard(rootGuard);
+        for (const receipt of intermediates) {
+            inspectDirectoryIdentitySync(receipt.path, receipt);
+        }
+    }
+    catch (error) {
+        // force tolerates a vanished leaf, never a lost traversal boundary.
+        throw removalAncestorChanged(error);
+    }
+}
+async function assertMissingRemovalPrefixCurrent(rootGuard, intermediates) {
+    if (intermediates.length === 0) {
+        assertExactRemovalReceiptPrefixCurrent(rootGuard, intermediates);
+        return;
+    }
+    const deepest = intermediates[intermediates.length - 1];
+    assertExactRemovalReceiptPrefixCurrent(rootGuard, intermediates.slice(0, -1));
+    let deepestGuard;
+    try {
+        deepestGuard = await createAsyncDirectoryGuard(deepest.path, { bigint: true });
+    }
+    catch (error) {
+        throw removalAncestorChanged(error);
+    }
+    if (!sameFileIdentityForCleanup(deepestGuard.stat, deepest) ||
+        !sameCanonicalDirectory(deepestGuard.realPath, deepest.path)) {
+        throw removalAncestorChanged();
+    }
+}
+async function captureNonrecursiveRemovalAdmission(root, targetPath, options, receipts) {
+    const parentPath = path.dirname(targetPath);
+    if (!isPathInside(root.rootReal, parentPath)) {
+        throw new FsSafeError("path-mismatch", "removal parent is outside the retained root");
+    }
+    const retained = receipts?.complete(root.rootReal, targetPath);
+    let rootGuard;
+    try {
+        // A complete, exactly spelled parent canonicalization below also proves
+        // Root's canonical route. Retain Root's earlier exact identity either way.
+        rootGuard = retained && parentPath !== root.rootReal
+            ? { dir: root.rootReal, realPath: root.rootReal, stat: retained.rootStat }
+            : await createAsyncDirectoryGuard(root.rootReal, { bigint: true, initial: retained?.rootStat });
+    }
+    catch (error) {
+        // force may tolerate a missing target or parent, never a missing Root.
+        if (options.force && isNotFoundPathError(error))
+            await assertRootIdentityCurrent(root);
+        throw normalizeRemoveGuardError(error);
+    }
+    if (!sameFileIdentityForCleanup(rootGuard.stat, root.rootIdentity))
+        throw rootPathChangedError();
+    if (parentPath === root.rootReal) {
+        const rootAssertion = createRemovalDirectoryAssertion(rootGuard.dir, rootGuard.stat, rootGuard.realPath);
+        return Object.freeze({
+            assertAfterMutation() {
+                // Here Root is also the immediate parent, so retain its established
+                // post-dispatch error classification while checking it only once.
+                assertRemovalDirectoryCurrent(rootAssertion);
+            },
+            assertCurrent() {
+                try {
+                    assertRemovalDirectoryCurrent(rootAssertion);
+                }
+                catch (error) {
+                    throw removalAncestorChanged(error);
+                }
+            },
+        });
+    }
+    const intermediates = [];
+    const retainedDirectories = retained?.directories;
+    const freshSegments = retainedDirectories
+        ? undefined
+        : path.relative(root.rootReal, parentPath).split(path.sep).filter(Boolean).slice(0, -1);
+    const intermediateCount = retainedDirectories ? Math.max(0, retainedDirectories.length - 1) : freshSegments.length;
+    let freshAncestor = root.rootReal;
+    for (let index = 0; index < intermediateCount; index += 1) {
+        const retainedDirectory = retainedDirectories?.[index];
+        const ancestor = retainedDirectory?.path ?? (freshAncestor = path.join(freshAncestor, freshSegments[index]));
+        try {
+            const stat = inspectDirectoryIdentitySync(ancestor, undefined, retainedDirectory?.stat);
+            intermediates.push(createRemovalDirectoryAssertion(ancestor, stat));
+        }
+        catch (error) {
+            if (isNotFoundPathError(error)) {
+                await assertMissingRemovalPrefixCurrent(rootGuard, intermediates);
+                assertNotAborted(options.signal);
+                if (options.force)
+                    return undefined;
+            }
+            throw normalizeRemoveGuardError(error);
+        }
+    }
+    let parentGuard;
+    try {
+        parentGuard = await createAsyncDirectoryGuard(retained?.parent?.path ?? parentPath, {
+            bigint: true,
+            initial: retained?.parent?.stat,
+        });
+    }
+    catch (error) {
+        if (isNotFoundPathError(error)) {
+            await assertMissingRemovalPrefixCurrent(rootGuard, intermediates);
+            assertNotAborted(options.signal);
+            if (options.force)
+                return undefined;
+        }
+        throw normalizeRemoveGuardError(error);
+    }
+    if (!sameCanonicalDirectory(parentGuard.realPath, parentPath)) {
+        throw removalAncestorChanged();
+    }
+    const canonicalParentCoversRoot = retained !== undefined && parentGuard.realPath === parentPath;
+    if (retained && !canonicalParentCoversRoot) {
+        try {
+            rootGuard = await createAsyncDirectoryGuard(root.rootReal, { bigint: true, initial: retained.rootStat });
+        }
+        catch (error) {
+            if (options.force && isNotFoundPathError(error))
+                await assertRootIdentityCurrent(root);
+            throw normalizeRemoveGuardError(error);
+        }
+    }
+    const rootAssertion = createRemovalDirectoryAssertion(rootGuard.dir, rootGuard.stat, canonicalParentCoversRoot ? undefined : rootGuard.realPath);
+    const parentAssertion = createRemovalDirectoryAssertion(parentGuard.dir, parentGuard.stat, parentGuard.realPath);
+    const assertPrefixCurrent = () => {
+        try {
+            assertRemovalDirectoryCurrent(rootAssertion);
+            for (const assertion of intermediates)
+                assertRemovalDirectoryCurrent(assertion);
+        }
+        catch (error) {
+            throw removalAncestorChanged(error);
+        }
+    };
+    return Object.freeze({
+        assertAfterMutation() {
+            assertPrefixCurrent();
+            // Preserve the established nonrecursive post-dispatch mapping for the
+            // immediate parent: disappearance is `not-found`, while replacements
+            // retain their directory-guard classification. Earlier lost ancestry
+            // remains a fail-closed `path-mismatch`.
+            assertRemovalDirectoryCurrent(parentAssertion);
+        },
+        assertCurrent() {
+            assertPrefixCurrent();
+            try {
+                assertRemovalDirectoryCurrent(parentAssertion);
+            }
+            catch (error) {
+                throw removalAncestorChanged(error);
+            }
+        },
+    });
+}
+async function removeOne(root, targetPath, options, receipts) {
+    const admission = await captureNonrecursiveRemovalAdmission(root, targetPath, options, receipts);
+    if (!admission)
+        return;
+    try {
+        await getFsSafeTestHooks()?.beforeRootFallbackMutation?.("remove", targetPath);
+        admission.assertCurrent();
+    }
+    catch (error) {
+        throw normalizeRemoveGuardError(error);
+    }
+    try {
+        const isDirectory = fsSync.lstatSync(targetPath).isDirectory();
+        assertFinalSymlinkRejected(targetPath, options.mutationSymlinks !== undefined);
+        assertNotAborted(options.signal);
+        options.assertBeforeMutation?.();
+        await (isDirectory ? fs.rmdir(targetPath) : fs.unlink(targetPath));
+    }
+    catch (error) {
+        if (!(options.force && isNotFoundPathError(error)))
+            throw normalizeRemovePathError(error);
+    }
+    try {
+        admission.assertAfterMutation();
+    }
+    catch (error) {
+        throw normalizeRemoveGuardError(error);
+    }
+    assertNotAborted(options.signal);
+}
+export async function removePathInRootFallback(root, targetPath, options, receipts) {
+    assertNotAborted(options.signal);
+    if (!options.recursive) {
+        await removeOne(root, targetPath, options, receipts);
+        return;
+    }
+    const maxEntries = options.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
+    const details = (target, phase) => ({
+        operation: "remove",
+        phase,
+        relativePath: path.relative(targetPath, target),
+    });
+    let examined = 0;
+    const rootGuard = await createAsyncDirectoryGuard(root.rootReal, { bigint: true });
+    if (!sameFileIdentityForCleanup(rootGuard.stat, root.rootIdentity))
+        throw rootPathChangedError();
+    const guards = [rootGuard];
+    let ancestor = root.rootReal;
+    const parentRelative = path.relative(root.rootReal, path.dirname(targetPath));
+    for (const segment of parentRelative.split(path.sep).filter(Boolean)) {
+        ancestor = path.join(ancestor, segment);
+        let guard;
+        try {
+            guard = await createAsyncDirectoryGuard(ancestor, { bigint: true });
+        }
+        catch (error) {
+            if (isNotFoundPathError(error)) {
+                assertCurrent();
+                assertNotAborted(options.signal);
+                if (options.force)
+                    return;
+            }
+            throw normalizeRemoveGuardError(error);
+        }
+        if (!isPathInside(guard.realPath, ancestor) || !isPathInside(ancestor, guard.realPath)) {
+            throw new FsSafeError("path-mismatch", "removal ancestor changed during operation");
+        }
+        guards.push(guard);
+    }
+    function assertCurrent() {
+        for (const guard of guards) {
+            try {
+                assertSyncDirectoryGuard(guard);
+            }
+            catch (error) {
+                // force tolerates a vanished leaf, never a lost traversal boundary.
+                throw new FsSafeError("path-mismatch", "removal ancestor changed during operation", { cause: error });
+            }
+        }
+    }
+    const inspect = (target, expected) => {
+        assertCurrent();
+        try {
+            return inspectFileIdentitySync(() => fsSync.lstatSync(target, { bigint: true }), expected);
+        }
+        catch (error) {
+            if (options.force && isNotFoundPathError(error))
+                return;
+            throw normalizeRemovePathError(error, details(target, expected ? "remove" : "inspect"));
+        }
+    };
+    async function visit(target, depth, entryCounted = false) {
+        assertNotAborted(options.signal);
+        if ((!entryCounted && examined >= maxEntries) || depth > maxDepth) {
+            throw new FsSafeError("too-large", "recursive removal budget exceeded", {
+                details: details(target, "inspect"),
+            });
+        }
+        if (!entryCounted)
+            examined += 1;
+        await assertMutationNotDenied(target, options.denyMutations, { protectAncestors: true });
+        assertNotAborted(options.signal);
+        const initial = inspect(target);
+        if (!initial)
+            return;
+        assertFinalSymlinkRejected(target, options.mutationSymlinks !== undefined, details(target, "inspect"));
+        if (initial.isDirectory()) {
+            let directoryGuard;
+            try {
+                directoryGuard = await createAsyncDirectoryGuard(target, { bigint: true });
+            }
+            catch (error) {
+                assertCurrent();
+                assertNotAborted(options.signal);
+                if (options.force && isNotFoundPathError(error))
+                    return;
+                throw normalizeRemovePathError(error, details(target, "inspect"));
+            }
+            if (!isPathInside(directoryGuard.realPath, target) || !isPathInside(target, directoryGuard.realPath) ||
+                !sameFileIdentityForCleanup(directoryGuard.stat, initial)) {
+                throw new FsSafeError("path-mismatch", "removal directory changed during operation");
+            }
+            guards.push(directoryGuard);
+            try {
+                assertCurrent();
+                assertNotAborted(options.signal);
+                const handle = await fs.opendir(target, { bufferSize: 1 }).catch(error => {
+                    if (options.force && isNotFoundPathError(error)) {
+                        assertNotAborted(options.signal);
+                        return undefined;
+                    }
+                    throw normalizeRemovePathError(error, details(target, "enumerate"));
+                });
+                if (handle) {
+                    let failed = false;
+                    let operationError;
+                    try {
+                        let names = options.order === "sorted" ? [] : undefined;
+                        if (names && maxEntries === Infinity) {
+                            assertCurrent();
+                            assertNotAborted(options.signal);
+                            const snapshot = await fs.readdir(target).catch(error => {
+                                if (options.force && isNotFoundPathError(error))
+                                    return undefined;
+                                throw normalizeRemovePathError(error, details(target, "enumerate"));
+                            });
+                            assertNotAborted(options.signal);
+                            if (snapshot) {
+                                assertCurrent();
+                                names = snapshot;
+                                examined += names.length;
+                            }
+                        }
+                        else {
+                            while (true) {
+                                assertCurrent();
+                                assertNotAborted(options.signal);
+                                const entry = await handle.read().catch(error => {
+                                    if (options.force && isNotFoundPathError(error))
+                                        return undefined;
+                                    throw normalizeRemovePathError(error, details(target, "enumerate"));
+                                });
+                                if (entry === undefined) {
+                                    assertNotAborted(options.signal);
+                                    if (names)
+                                        names.length = 0;
+                                    break;
+                                }
+                                assertCurrent();
+                                assertNotAborted(options.signal);
+                                if (!entry)
+                                    break;
+                                if (names) {
+                                    if (examined >= maxEntries) {
+                                        throw new FsSafeError("too-large", "recursive removal budget exceeded", {
+                                            details: details(path.join(target, entry.name), "enumerate"),
+                                        });
+                                    }
+                                    examined += 1;
+                                    names.push(entry.name);
+                                }
+                                else {
+                                    await visit(path.join(target, entry.name), depth + 1);
+                                }
+                            }
+                        }
+                        if (names) {
+                            for (const name of names.sort()) {
+                                await visit(path.join(target, name), depth + 1, true);
+                            }
+                        }
+                    }
+                    catch (error) {
+                        failed = true;
+                        operationError = error instanceof MutationAuthorityError ? error.rejection : error;
+                        throw error;
+                    }
+                    finally {
+                        try {
+                            // Close before rmdir, including on Windows and after revocation.
+                            await handle.close();
+                        }
+                        catch (error) {
+                            const closeError = normalizeRemovePathError(error, details(target, "enumerate"));
+                            if (failed)
+                                throw createSuppressedError(closeError, operationError, "recursive removal and close both failed");
+                            throw closeError;
+                        }
+                    }
+                }
+            }
+            finally {
+                guards.pop();
+            }
+        }
+        // A tolerated missing-directory observation still rechecks its target and ancestors.
+        await getFsSafeTestHooks()?.beforeRootFallbackMutation?.("remove", target);
+        await assertMutationNotDenied(target, options.denyMutations, { protectAncestors: true });
+        assertNotAborted(options.signal);
+        if (!inspect(target, initial))
+            return;
+        assertFinalSymlinkRejected(target, options.mutationSymlinks !== undefined, details(target, "remove"));
+        assertNotAborted(options.signal);
+        options.assertBeforeMutation?.();
+        try {
+            await (initial.isDirectory() ? fs.rmdir(target) : fs.unlink(target));
+        }
+        catch (error) {
+            if (!(options.force && isNotFoundPathError(error))) {
+                throw normalizeRemovePathError(error, details(target, "remove"));
+            }
+        }
+        assertCurrent();
+        assertNotAborted(options.signal);
+    }
+    await assertRootIdentityCurrent(root);
+    await visit(targetPath, 0);
+}

package/node_modules/@openclaw/fs-safe/dist/root-symlink-policy.d.ts

@@ -0,0 +1,14 @@
+import { type FsSafeErrorDetails } from "./errors.js";
+export type SymlinkPolicy = "reject" | "follow-within-root" | "follow-parents-within-root";
+export type MutationSymlinkPolicy = "reject" | "follow-parents-within-root";
+export declare function readSymlinkResolution(symlinks: SymlinkPolicy | undefined): {
+    rejectSymlinks: boolean;
+    rejectFinalSymlink: boolean;
+};
+export declare function mutationSymlinkResolution(symlinks: MutationSymlinkPolicy | undefined): {
+    rejectSymlinks: boolean;
+    rejectFinalSymlink: boolean;
+    resolveCanonical: boolean;
+};
+export declare function assertFinalSymlinkRejected(targetPath: string, reject: boolean | undefined, details?: FsSafeErrorDetails): void;
+//# sourceMappingURL=root-symlink-policy.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-symlink-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-symlink-policy.d.ts","sourceRoot":"","sources":["../src/root-symlink-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGnE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,oBAAoB,GAAG,4BAA4B,CAAC;AAC3F,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,4BAA4B,CAAC;AAE5E,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,GAAG,SAAS;IAErE,cAAc;IACd,kBAAkB;EAErB;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,SAAS;IAKjF,cAAc;IACd,kBAAkB;IAClB,gBAAgB;EAEnB;AAID,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,IAAI,CASN"}

package/node_modules/@openclaw/fs-safe/dist/root-symlink-policy.js

@@ -0,0 +1,34 @@
+import fs from "node:fs";
+import { FsSafeError } from "./errors.js";
+import { isNotFoundPathError } from "./path.js";
+export function readSymlinkResolution(symlinks) {
+    return {
+        rejectSymlinks: symlinks !== "follow-within-root" && symlinks !== "follow-parents-within-root",
+        rejectFinalSymlink: symlinks === "follow-parents-within-root",
+    };
+}
+export function mutationSymlinkResolution(symlinks) {
+    if (symlinks !== undefined && symlinks !== "reject" && symlinks !== "follow-parents-within-root") {
+        throw new RangeError("mutationSymlinks must be reject or follow-parents-within-root");
+    }
+    return {
+        rejectSymlinks: symlinks === "reject",
+        rejectFinalSymlink: symlinks !== undefined,
+        resolveCanonical: symlinks !== undefined,
+    };
+}
+// Call after parent fences and immediately before the mutation. This is a
+// final-component check, not an atomic conditional rename against another process.
+export function assertFinalSymlinkRejected(targetPath, reject, details) {
+    if (!reject)
+        return;
+    try {
+        if (fs.lstatSync(targetPath).isSymbolicLink()) {
+            throw new FsSafeError("symlink", "final symlink not allowed", { details });
+        }
+    }
+    catch (error) {
+        if (!isNotFoundPathError(error))
+            throw error;
+    }
+}