@openclaw/openshell-sandbox 2026.9.4 → 2026.9.5

package/node_modules/@openclaw/fs-safe/dist/directory-durability.js

@@ -4,6 +4,8 @@ import path from "node:path";
 import { ensureAbsoluteDirectory } from "./absolute-path.js";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentity } from "./file-identity.js";
+import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot } from "./windows-path-alias.js";
+import { realpathSync } from "./realpath.js";
 function directoryOpenFlags() {
     if (process.platform === "win32") {
         return "r";
@@ -41,39 +43,67 @@ function assertDirectory(identity, pathname, label) {
         throw new FsSafeError("not-file", `${label} must be a real directory: ${pathname}`);
     }
 }
+function ownDirectoryReceipt(receipt) {
+    const pathname = receipt.path;
+    const realPath = receipt.realPath;
+    const identity = receipt.identity;
+    return { path: pathname, realPath, identity };
+}
+function assertDirectoryReceiptPaths(receipt, label) {
+    assertNoWindowsPathAlias(receipt.path, "filesystem", `${label} path uses a Windows filesystem namespace alias`);
+    assertNoWindowsPathAlias(receipt.realPath, "filesystem", `${label} real path uses a Windows filesystem namespace alias`);
+}
 async function createDirectoryReceipt(directoryPath, label) {
-    const resolvedPath = path.resolve(directoryPath);
-    const identity = fsSync.lstatSync(resolvedPath);
+    assertNoWindowsPathAlias(directoryPath, "filesystem", `${label} path uses a Windows filesystem namespace alias`);
+    const resolvedPath = resolvePathPreservingWindowsRoot(directoryPath);
+    assertNoWindowsPathAlias(resolvedPath, "filesystem", `${label} path uses a Windows filesystem namespace alias`);
+    const operationPath = pathForWindowsFilesystem(resolvedPath);
+    const identity = fsSync.lstatSync(operationPath);
     assertDirectory(identity, resolvedPath, label);
+    const realPath = realpathSync.native(operationPath);
+    assertNoWindowsPathAlias(realPath, "filesystem", `${label} real path uses a Windows filesystem namespace alias`);
     return {
         path: resolvedPath,
-        realPath: fsSync.realpathSync.native(resolvedPath),
+        realPath,
         identity,
     };
 }
 function createDirectoryReceiptSync(directoryPath, label) {
-    const resolvedPath = path.resolve(directoryPath);
-    const identity = fsSync.lstatSync(resolvedPath);
+    assertNoWindowsPathAlias(directoryPath, "filesystem", `${label} path uses a Windows filesystem namespace alias`);
+    const resolvedPath = resolvePathPreservingWindowsRoot(directoryPath);
+    assertNoWindowsPathAlias(resolvedPath, "filesystem", `${label} path uses a Windows filesystem namespace alias`);
+    const operationPath = pathForWindowsFilesystem(resolvedPath);
+    const identity = fsSync.lstatSync(operationPath);
     assertDirectory(identity, resolvedPath, label);
+    const realPath = realpathSync(operationPath);
+    assertNoWindowsPathAlias(realPath, "filesystem", `${label} real path uses a Windows filesystem namespace alias`);
     return {
         path: resolvedPath,
-        realPath: fsSync.realpathSync(resolvedPath),
+        realPath,
         identity,
     };
 }
 async function assertDirectoryReceiptCurrent(receipt, label) {
-    const currentIdentity = fsSync.lstatSync(receipt.path);
+    assertDirectoryReceiptPaths(receipt, label);
+    const operationPath = pathForWindowsFilesystem(receipt.path);
+    const currentIdentity = fsSync.lstatSync(operationPath);
     assertDirectory(currentIdentity, receipt.path, label);
+    const realPath = realpathSync.native(operationPath);
+    assertNoWindowsPathAlias(realPath, "filesystem", `${label} real path uses a Windows filesystem namespace alias`);
     if (!sameFileIdentity(receipt.identity, currentIdentity) ||
-        (fsSync.realpathSync.native(receipt.path)) !== receipt.realPath) {
+        realPath !== receipt.realPath) {
         throw new FsSafeError("path-mismatch", `${label} changed during durable directory operation: ${receipt.path}`);
     }
 }
 function assertDirectoryReceiptCurrentSync(receipt, label) {
-    const currentIdentity = fsSync.lstatSync(receipt.path);
+    assertDirectoryReceiptPaths(receipt, label);
+    const operationPath = pathForWindowsFilesystem(receipt.path);
+    const currentIdentity = fsSync.lstatSync(operationPath);
     assertDirectory(currentIdentity, receipt.path, label);
+    const realPath = realpathSync(operationPath);
+    assertNoWindowsPathAlias(realPath, "filesystem", `${label} real path uses a Windows filesystem namespace alias`);
     if (!sameFileIdentity(receipt.identity, currentIdentity) ||
-        fsSync.realpathSync(receipt.path) !== receipt.realPath) {
+        realPath !== receipt.realPath) {
         throw new FsSafeError("path-mismatch", `${label} changed during durable directory operation: ${receipt.path}`);
     }
 }
@@ -87,19 +117,21 @@ async function assertOpenDirectoryCurrent(handle, receipt, label) {
 }
 class PinnedDirectoryImpl {
     receipt;
+    #authority;
     #handle;
     #label;
     #closed = false;
     constructor(handle, receipt, label) {
         this.#handle = handle;
-        this.receipt = receipt;
+        this.#authority = receipt;
+        this.receipt = ownDirectoryReceipt(receipt);
         this.#label = label;
     }
     async assertCurrent() {
         if (this.#closed) {
             throw new FsSafeError("helper-failed", `${this.#label} pin is already closed`);
         }
-        await assertOpenDirectoryCurrent(this.#handle, this.receipt, this.#label);
+        await assertOpenDirectoryCurrent(this.#handle, this.#authority, this.#label);
     }
     async sync() {
         await this.assertCurrent();
@@ -126,9 +158,11 @@ class PinnedDirectoryImpl {
 }
 export async function pinDirectory(directory, options = {}) {
     const label = options.label ?? "directory";
-    const receipt = typeof directory === "string" ? await createDirectoryReceipt(directory, label) : directory;
+    const receipt = typeof directory === "string"
+        ? await createDirectoryReceipt(directory, label)
+        : ownDirectoryReceipt(directory);
     await assertDirectoryReceiptCurrent(receipt, label);
-    const handle = await fs.open(receipt.path, directoryOpenFlags());
+    const handle = await fs.open(pathForWindowsFilesystem(receipt.path), directoryOpenFlags());
     try {
         await assertOpenDirectoryCurrent(handle, receipt, label);
         return new PinnedDirectoryImpl(handle, receipt, label);
@@ -140,7 +174,9 @@ export async function pinDirectory(directory, options = {}) {
 }
 export async function syncDirectory(directory, options = {}) {
     const label = options.label ?? "directory";
-    const receipt = typeof directory === "string" ? await createDirectoryReceipt(directory, label) : directory;
+    const receipt = typeof directory === "string"
+        ? await createDirectoryReceipt(directory, label)
+        : ownDirectoryReceipt(directory);
     let pinned;
     try {
         pinned = await pinDirectory(receipt, { label });
@@ -161,11 +197,13 @@ export async function syncDirectory(directory, options = {}) {
 }
 export function syncDirectorySync(directory, options = {}) {
     const label = options.label ?? "directory";
-    const receipt = typeof directory === "string" ? createDirectoryReceiptSync(directory, label) : directory;
+    const receipt = typeof directory === "string"
+        ? createDirectoryReceiptSync(directory, label)
+        : ownDirectoryReceipt(directory);
     assertDirectoryReceiptCurrentSync(receipt, label);
     let descriptor;
     try {
-        descriptor = fsSync.openSync(receipt.path, directoryOpenFlags());
+        descriptor = fsSync.openSync(pathForWindowsFilesystem(receipt.path), directoryOpenFlags());
     }
     catch (error) {
         if (!isWindowsDirectoryOpenUnsupported(error)) {
@@ -210,7 +248,9 @@ export function syncDirectoryBestEffortSync(directoryPath) {
     }
 }
 async function findExistingAncestorReceipt(targetPath, label) {
-    let currentPath = path.resolve(targetPath);
+    assertNoWindowsPathAlias(targetPath, "filesystem", `${label} path uses a Windows filesystem namespace alias`);
+    let currentPath = resolvePathPreservingWindowsRoot(targetPath);
+    assertNoWindowsPathAlias(currentPath, "filesystem", `${label} path uses a Windows filesystem namespace alias`);
     while (true) {
         try {
             return await createDirectoryReceipt(currentPath, label);
@@ -228,12 +268,16 @@ async function findExistingAncestorReceipt(targetPath, label) {
     }
 }
 export async function ensureDurableDirectory(options) {
-    const directoryPath = path.resolve(options.directoryPath);
     const label = options.label ?? "directory";
+    const requestedDirectoryPath = options.directoryPath;
+    assertNoWindowsPathAlias(requestedDirectoryPath, "filesystem", `${label} path uses a Windows filesystem namespace alias`);
+    const directoryPath = resolvePathPreservingWindowsRoot(requestedDirectoryPath);
+    assertNoWindowsPathAlias(directoryPath, "filesystem", `${label} path uses a Windows filesystem namespace alias`);
     const ancestorReceipt = await findExistingAncestorReceipt(directoryPath, label);
     const targetExists = ancestorReceipt.path === directoryPath;
-    if (options.expectedExistingIdentity &&
-        (!targetExists || !sameFileIdentity(options.expectedExistingIdentity, ancestorReceipt.identity))) {
+    const expectedExistingIdentity = options.expectedExistingIdentity;
+    if (expectedExistingIdentity &&
+        (!targetExists || !sameFileIdentity(expectedExistingIdentity, ancestorReceipt.identity))) {
         throw new FsSafeError("path-mismatch", `${label} changed before durable directory pinning: ${directoryPath}`);
     }
     const ancestor = await pinDirectory(ancestorReceipt, { label });
@@ -241,8 +285,9 @@ export async function ensureDurableDirectory(options) {
     try {
         await ancestor.assertCurrent();
         if (!targetExists) {
-            if (options.create) {
-                await options.create(directoryPath);
+            const create = options.create;
+            if (create) {
+                await Reflect.apply(create, options, [directoryPath]);
             }
             else {
                 const created = await ensureAbsoluteDirectory(directoryPath, {

package/node_modules/@openclaw/fs-safe/dist/directory-entry-path.d.ts

@@ -0,0 +1,3 @@
+/** Strip only trailing separators: lstat must inspect the entry, not follow a leaf link. */
+export declare function directoryEntryPath(dir: string, platform?: NodeJS.Platform): string;
+//# sourceMappingURL=directory-entry-path.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/directory-entry-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-entry-path.d.ts","sourceRoot":"","sources":["../src/directory-entry-path.ts"],"names":[],"mappings":"AAEA,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,kBAAmB,GAAG,MAAM,CAenF"}

package/node_modules/@openclaw/fs-safe/dist/directory-entry-path.js

@@ -0,0 +1,21 @@
+import path from "node:path";
+/** Strip only trailing separators: lstat must inspect the entry, not follow a leaf link. */
+export function directoryEntryPath(dir, platform = process.platform) {
+    const windows = platform === "win32";
+    if (typeof dir === "string") {
+        const last = dir[dir.length - 1];
+        if (last !== "/" && (!windows || last !== "\\"))
+            return dir;
+    }
+    let rootLength = (windows ? path.win32 : path.posix).parse(dir).root.length;
+    if (windows && /^[\\/]{2}[?.][\\/]UNC[\\/]/i.test(dir)) {
+        // Node parses the namespace prefix as the root; retain the complete UNC share.
+        const uncRoot = path.win32.parse(`\\\\${dir.slice(8)}`).root;
+        if (uncRoot.length > 1)
+            rootLength = Math.max(rootLength, uncRoot.length + 6);
+    }
+    let end = dir.length;
+    while (end > rootLength && (dir[end - 1] === "/" || (windows && dir[end - 1] === "\\")))
+        end--;
+    return end === rootLength || end === dir.length ? dir : dir.slice(0, end);
+}

package/node_modules/@openclaw/fs-safe/dist/directory-guard.d.ts

@@ -1,4 +1,5 @@
 import type { BigIntStats, Stats } from "node:fs";
+import { type ExactStatIdentity, type StatObservationReceipt } from "./stat-observation.js";
 export type AsyncDirectoryGuard<T extends Stats | BigIntStats = Stats> = {
     dir: string;
     realPath: string;
@@ -10,8 +11,18 @@ export type SyncDirectoryGuard = {
     realPath: string;
     stat: Stats;
 };
+export type DirectoryIdentity = Readonly<{
+    dev: bigint;
+    ino: bigint;
+    realPath: string;
+}>;
+export declare function readDirectoryIdentity(dir: string): Promise<DirectoryIdentity>;
+export declare function assertDirectoryIdentitySync(observedPath: string, expected: Pick<DirectoryIdentity, "dev" | "ino"> & {
+    realPath?: string;
+}): void;
 export declare function createAsyncDirectoryGuard(dir: string, options: {
     bigint: true;
+    initial?: BigIntStats;
 }): Promise<AsyncDirectoryGuard<BigIntStats>>;
 export declare function createAsyncDirectoryGuard(dir: string, options?: {
     bigint?: false;
@@ -21,11 +32,26 @@ export declare function createAsyncDirectoryGuard(dir: string, options: {
 }): Promise<AnyAsyncDirectoryGuard>;
 export declare function assertAsyncDirectoryGuard(guard: AnyAsyncDirectoryGuard): Promise<void>;
 export declare function createSyncDirectoryGuard(dir: string): SyncDirectoryGuard;
-export declare function assertSyncDirectoryGuard(guard: SyncDirectoryGuard): void;
+export declare function assertSyncDirectoryGuard(guard: SyncDirectoryGuard | AnyAsyncDirectoryGuard): void;
 export declare function createNearestExistingDirectoryGuard(rootReal: string, targetPath: string): Promise<AsyncDirectoryGuard>;
 export declare function createNearestExistingDirectoryGuard(rootReal: string, targetPath: string, options: {
     bigint: boolean;
 }): Promise<AnyAsyncDirectoryGuard>;
 export declare function createNearestExistingSyncDirectoryGuard(rootReal: string, targetPath: string): SyncDirectoryGuard;
 export declare function inspectDirectoryIdentity(dir: string, expected?: Pick<BigIntStats, "dev" | "ino">): Promise<BigIntStats>;
+export declare function observeDirectoryIdentitySync(dir: string, options: {
+    bigint: true;
+}): BigIntStats;
+export declare function observeDirectoryIdentitySync(dir: string, options?: {
+    bigint?: false;
+}): Stats;
+export declare function inspectDirectoryIdentitySync(dir: string, expected?: Pick<BigIntStats, "dev" | "ino">, initial?: BigIntStats, platform?: NodeJS.Platform): BigIntStats;
+export type DirectoryObservationGuard = StatObservationReceipt & {
+    dir: string;
+    realPath: string;
+};
+export declare function extendDirectoryObservationGuard(observation: StatObservationReceipt, dir: string, realPath: string): DirectoryObservationGuard;
+export declare function inspectDirectoryObservationSync(dir: string, expected?: ExactStatIdentity): StatObservationReceipt;
+export declare function assertDirectoryObservationSync(dir: string, expected: ExactStatIdentity): Stats | BigIntStats;
+export declare function assertDirectoryObservationGuardSync(guard: DirectoryObservationGuard): void;
 //# sourceMappingURL=directory-guard.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/directory-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"directory-guard.d.ts","sourceRoot":"","sources":["../src/directory-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AASlD,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,KAAK,GAAG,WAAW,GAAG,KAAK,IAAI;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,CAAC,CAAC;CACT,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,mBAAmB,CAAC,KAAK,GAAG,WAAW,CAAC,CAAC;AAE9E,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;CACb,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;AAC7H,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AACnH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAStH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAU5F;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAMxE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAQxE;AAED,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AACxH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAqBzJ,wBAAgB,uCAAuC,CACrD,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,kBAAkB,CAcpB;AAGD,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAM7H"}
+{"version":3,"file":"directory-guard.d.ts","sourceRoot":"","sources":["../src/directory-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAelD,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,KAAK,GAAG,WAAW,GAAG,KAAK,IAAI;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,CAAC,CAAC;CACT,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,mBAAmB,CAAC,KAAK,GAAG,WAAW,CAAC,CAAC;AAE9E,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC,CAAC;AAEH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAGnF;AAED,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACvE,IAAI,CAaN;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;AACpJ,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AACnH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AActH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB5F;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CASxE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,kBAAkB,GAAG,sBAAsB,GAAG,IAAI,CAsBjG;AAED,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AACxH,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAuBzJ,wBAAgB,uCAAuC,CACrD,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,kBAAkB,CAgBpB;AAGD,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAM7H;AAOD,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,GACxB,WAAW,CAAC;AACf,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,GAC3B,KAAK,CAAC;AAaT,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC,EAC3C,OAAO,CAAC,EAAE,WAAW,EACrB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,WAAW,CAMb;AAkBD,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnG,wBAAgB,+BAA+B,CAC7C,WAAW,EAAE,sBAAsB,EACnC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,yBAAyB,CAK3B;AAID,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,sBAAsB,CAOxB;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,iBAAiB,GAC1B,KAAK,GAAG,WAAW,CAOrB;AAED,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,yBAAyB,GAAG,IAAI,CAU1F"}

package/node_modules/@openclaw/fs-safe/dist/directory-guard.js

@@ -2,46 +2,105 @@ import fsSync from "node:fs";
 import path from "node:path";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentity } from "./file-identity.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { isNotFoundPathError } from "./path.js";
 import { directoryComponentNotDirectoryError } from "./root-errors.js";
+import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
+import { realpathSync } from "./realpath.js";
+import { directoryEntryPath } from "./directory-entry-path.js";
+import { assertStatObservationSync, inspectStatObservationSync, } from "./stat-observation.js";
+export async function readDirectoryIdentity(dir) {
+    const guard = await createAsyncDirectoryGuard(dir, { bigint: true });
+    return Object.freeze({ dev: guard.stat.dev, ino: guard.stat.ino, realPath: guard.realPath });
+}
+export function assertDirectoryIdentitySync(observedPath, expected) {
+    const operationPath = directoryOperationPath(observedPath);
+    const expectedDev = expected.dev;
+    const expectedIno = expected.ino;
+    const expectedRealPath = expected.realPath;
+    if (expectedRealPath !== undefined)
+        assertNoWindowsPathAlias(expectedRealPath, "filesystem");
+    inspectDirectoryIdentityAtPathSync(operationPath, { dev: expectedDev, ino: expectedIno });
+    if (expectedRealPath === undefined)
+        return;
+    const realPath = realpathSync.native(operationPath);
+    assertNoWindowsPathAlias(realPath, "filesystem");
+    if (realPath !== expectedRealPath) {
+        throw new FsSafeError("path-mismatch", "directory changed during operation");
+    }
+}
 export async function createAsyncDirectoryGuard(dir, options) {
-    const stat = options?.bigint ? await inspectDirectoryIdentity(dir) : fsSync.lstatSync(dir);
+    const operationPath = directoryOperationPath(dir);
+    const stat = options?.bigint
+        ? inspectDirectoryIdentityAtPathSync(operationPath, undefined, options.initial)
+        : fsSync.lstatSync(operationPath);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
         throw directoryComponentNotDirectoryError();
     }
-    return { dir, realPath: fsSync.realpathSync.native(dir), stat };
+    const realPath = realpathSync.native(operationPath);
+    assertNoWindowsPathAlias(realPath, "filesystem");
+    return { dir, realPath, stat };
 }
 export async function assertAsyncDirectoryGuard(guard) {
-    const stat = typeof guard.stat.dev === "bigint" && typeof guard.stat.ino === "bigint"
-        ? await inspectDirectoryIdentity(guard.dir, { dev: guard.stat.dev, ino: guard.stat.ino })
-        : fsSync.lstatSync(guard.dir);
+    const dir = guard.dir;
+    const operationPath = directoryOperationPath(dir);
+    const expectedRealPath = guard.realPath;
+    assertNoWindowsPathAlias(expectedRealPath, "filesystem");
+    const expectedStat = guard.stat;
+    const expectedIdentity = { dev: expectedStat.dev, ino: expectedStat.ino };
+    const stat = typeof expectedIdentity.dev === "bigint" && typeof expectedIdentity.ino === "bigint"
+        ? inspectDirectoryIdentityAtPathSync(operationPath, {
+            dev: expectedIdentity.dev,
+            ino: expectedIdentity.ino,
+        })
+        : fsSync.lstatSync(operationPath);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
         throw directoryComponentNotDirectoryError();
     }
-    if (!sameFileIdentity(stat, guard.stat) || fsSync.realpathSync.native(guard.dir) !== guard.realPath) {
+    if (!sameFileIdentity(stat, expectedIdentity)) {
+        throw new FsSafeError("path-mismatch", "directory changed during operation");
+    }
+    const realPath = realpathSync.native(operationPath);
+    assertNoWindowsPathAlias(realPath, "filesystem");
+    if (realPath !== expectedRealPath) {
         throw new FsSafeError("path-mismatch", "directory changed during operation");
     }
 }
 export function createSyncDirectoryGuard(dir) {
-    const stat = fsSync.lstatSync(dir);
+    const operationPath = directoryOperationPath(dir);
+    const stat = fsSync.lstatSync(operationPath);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
         throw directoryComponentNotDirectoryError();
     }
-    return { dir, realPath: fsSync.realpathSync(dir), stat };
+    const realPath = realpathSync(operationPath);
+    assertNoWindowsPathAlias(realPath, "filesystem");
+    return { dir, realPath, stat };
 }
 export function assertSyncDirectoryGuard(guard) {
-    const stat = fsSync.lstatSync(guard.dir);
+    const dir = guard.dir;
+    const operationPath = directoryOperationPath(dir);
+    const expectedRealPath = guard.realPath;
+    assertNoWindowsPathAlias(expectedRealPath, "filesystem");
+    const expectedStat = guard.stat;
+    const expectedIdentity = { dev: expectedStat.dev, ino: expectedStat.ino };
+    const stat = typeof expectedIdentity.dev === "bigint" && typeof expectedIdentity.ino === "bigint"
+        ? inspectDirectoryIdentityAtPathSync(operationPath, { dev: expectedIdentity.dev, ino: expectedIdentity.ino })
+        : fsSync.lstatSync(operationPath);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
         throw directoryComponentNotDirectoryError();
     }
-    if (!sameFileIdentity(stat, guard.stat) || fsSync.realpathSync(guard.dir) !== guard.realPath) {
+    const realPath = typeof expectedIdentity.ino === "bigint"
+        ? realpathSync.native(operationPath) : realpathSync(operationPath);
+    assertNoWindowsPathAlias(realPath, "filesystem");
+    if (!sameFileIdentity(stat, expectedIdentity) || realPath !== expectedRealPath) {
         throw new FsSafeError("path-mismatch", "directory changed during operation");
     }
 }
 export async function createNearestExistingDirectoryGuard(rootReal, targetPath, options = { bigint: false }) {
-    let current = path.resolve(targetPath);
-    const root = path.resolve(rootReal);
+    assertNoWindowsPathAlias(rootReal, "filesystem");
+    assertNoWindowsPathAlias(targetPath, "filesystem");
+    let current = resolvePathPreservingWindowsRoot(targetPath);
+    const root = resolvePathPreservingWindowsRoot(rootReal);
     while (current !== root) {
         try {
             return await createAsyncDirectoryGuard(current, options);
@@ -56,8 +115,10 @@ export async function createNearestExistingDirectoryGuard(rootReal, targetPath,
     return await createAsyncDirectoryGuard(root, options);
 }
 export function createNearestExistingSyncDirectoryGuard(rootReal, targetPath) {
-    let current = path.resolve(targetPath);
-    const root = path.resolve(rootReal);
+    assertNoWindowsPathAlias(rootReal, "filesystem");
+    assertNoWindowsPathAlias(targetPath, "filesystem");
+    let current = resolvePathPreservingWindowsRoot(targetPath);
+    const root = resolvePathPreservingWindowsRoot(rootReal);
     while (current !== root) {
         try {
             return createSyncDirectoryGuard(current);
@@ -73,10 +134,77 @@ export function createNearestExistingSyncDirectoryGuard(rootReal, targetPath) {
 }
 // Recovery receipts must retain every identity bit, including on Windows.
 export async function inspectDirectoryIdentity(dir, expected) {
-    return await inspectFileIdentity(async () => {
-        const stat = fsSync.lstatSync(dir, { bigint: true });
+    const operationPath = directoryOperationPath(dir);
+    const expectedIdentity = expected === undefined
+        ? undefined
+        : { dev: expected.dev, ino: expected.ino };
+    return inspectDirectoryIdentityAtPathSync(operationPath, expectedIdentity);
+}
+function directoryOperationPath(dir) {
+    assertNoWindowsPathAlias(dir, "filesystem");
+    return pathForWindowsFilesystem(directoryEntryPath(dir));
+}
+export function observeDirectoryIdentitySync(dir, options) {
+    const entryPath = directoryOperationPath(dir);
+    const stat = options?.bigint
+        ? fsSync.lstatSync(entryPath, { bigint: true })
+        : fsSync.lstatSync(entryPath);
+    if (stat.isSymbolicLink() || !stat.isDirectory())
+        throw directoryComponentNotDirectoryError();
+    return stat;
+}
+export function inspectDirectoryIdentitySync(dir, expected, initial, platform = process.platform) {
+    const operationPath = directoryOperationPath(dir);
+    const expectedIdentity = expected === undefined
+        ? undefined
+        : { dev: expected.dev, ino: expected.ino };
+    return inspectDirectoryIdentityAtPathSync(operationPath, expectedIdentity, initial, platform);
+}
+function inspectDirectoryIdentityAtPathSync(operationPath, expected, initial, platform = process.platform) {
+    return inspectFileIdentitySync(() => {
+        // Traversal can supply the first exact observation. A bounded retry still
+        // uses the admitted operation path and retains every known identity bit.
+        const stat = initial ?? fsSync.lstatSync(operationPath, { bigint: true });
+        initial = undefined;
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw directoryComponentNotDirectoryError();
+        return stat;
+    }, expected, platform);
+}
+export function extendDirectoryObservationGuard(observation, dir, realPath) {
+    const guard = observation;
+    guard.dir = dir;
+    guard.realPath = realPath;
+    return guard;
+}
+// Only stat/list receipts use this metadata fast path. Recovery and publication
+// callers retain the BigIntStats contract of inspectDirectoryIdentitySync.
+export function inspectDirectoryObservationSync(dir, expected) {
+    const entryPath = directoryOperationPath(dir);
+    return inspectStatObservationSync(bigint => {
+        const stat = bigint ? fsSync.lstatSync(entryPath, { bigint: true }) : fsSync.lstatSync(entryPath);
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw directoryComponentNotDirectoryError();
+        return stat;
+    }, expected);
+}
+export function assertDirectoryObservationSync(dir, expected) {
+    const entryPath = directoryOperationPath(dir);
+    return assertStatObservationSync(bigint => {
+        const stat = bigint ? fsSync.lstatSync(entryPath, { bigint: true }) : fsSync.lstatSync(entryPath);
         if (stat.isSymbolicLink() || !stat.isDirectory())
             throw directoryComponentNotDirectoryError();
         return stat;
     }, expected);
 }
+export function assertDirectoryObservationGuardSync(guard) {
+    const dir = guard.dir;
+    const expectedRealPath = guard.realPath;
+    assertNoWindowsPathAlias(expectedRealPath, "filesystem");
+    assertDirectoryObservationSync(dir, guard.identity);
+    const realPath = realpathSync.native(directoryOperationPath(dir));
+    assertNoWindowsPathAlias(realPath, "filesystem");
+    if (realPath !== expectedRealPath) {
+        throw new FsSafeError("path-mismatch", "directory changed during operation");
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/directory-mode-node.d.ts

@@ -1,8 +1,20 @@
 import { type BigIntStats } from "node:fs";
 import { type DirectoryModeOwner } from "./directory-mode-owner.js";
+export declare function nodeDirectorySearchOnlyFlags(): {
+    flags: number;
+    proc: boolean;
+} | undefined;
 /** Real Node only: injected filesystem adapters must retain descriptor-chmod semantics. */
 export declare function pinNodeDirectoryForMode(dirPath: string, options?: {
     expectedIdentity?: BigIntStats;
     ownerUid?: number;
 }): Promise<DirectoryModeOwner>;
+/** Synchronous counterpart with the same no-follow, identity, and owner checks. */
+export declare function pinNodeDirectoryForModeSync(dirPath: string, options?: {
+    expectedIdentity?: BigIntStats;
+    ownerUid?: number;
+}): {
+    apply(mode: number, check?: () => void): void;
+    close(): void;
+};
 //# sourceMappingURL=directory-mode-node.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/directory-mode-node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"directory-mode-node.d.ts","sourceRoot":"","sources":["../src/directory-mode-node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAKtD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAW5G,2FAA2F;AAC3F,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClE,OAAO,CAAC,kBAAkB,CAAC,CAsE7B"}
+{"version":3,"file":"directory-mode-node.d.ts","sourceRoot":"","sources":["../src/directory-mode-node.ts"],"names":[],"mappings":"AAAA,OAAe,EAAa,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAK9D,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE5G,wBAAgB,4BAA4B,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAO3F;AAED,2FAA2F;AAC3F,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClE,OAAO,CAAC,kBAAkB,CAAC,CAsE7B;AAED,mFAAmF;AACnF,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClE;IAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAAC,KAAK,IAAI,IAAI,CAAA;CAAE,CAsFlE"}