@openclaw/openshell-sandbox 2026.9.4 → 2026.9.5

package/node_modules/@openclaw/fs-safe/dist/directory-mode-node.js

@@ -1,10 +1,10 @@
-import { constants } from "node:fs";
+import fsSync, { constants } from "node:fs";
 import fs from "node:fs/promises";
 import { FsSafeError } from "./errors.js";
-import { inspectDirectoryIdentity } from "./directory-guard.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
+import { inspectDirectoryIdentity, inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
 import { assertOwnedDirectory, ownDirectoryMode } from "./directory-mode-owner.js";
-function searchOnlyFlags() {
+export function nodeDirectorySearchOnlyFlags() {
     if (process.arch !== "x64" && process.arch !== "arm64")
         return undefined;
     // Darwin SDK O_SEARCH = O_EXEC (0x40000000) | O_DIRECTORY, on x64/arm64.
@@ -41,7 +41,7 @@ export async function pinNodeDirectoryForMode(dirPath, options = {}) {
     const handle = await fs.open(dirPath, constants.O_RDONLY | flags).catch(async (error) => {
         if (error.code !== "EACCES")
             throw error;
-        const route = searchOnlyFlags();
+        const route = nodeDirectorySearchOnlyFlags();
         if (!route)
             throw error;
         proc = route.proc;
@@ -49,7 +49,7 @@ export async function pinNodeDirectoryForMode(dirPath, options = {}) {
     });
     try {
         const inspect = async () => {
-            const opened = await inspectFileIdentity(() => handle.stat({ bigint: true }), expected);
+            const opened = await inspectFileIdentity(() => fsSync.fstatSync(handle.fd, { bigint: true }), expected);
             assertOwnedDirectory(expected, opened);
             assertOwner(opened);
             await inspectDirectoryIdentity(dirPath, expected);
@@ -63,8 +63,8 @@ export async function pinNodeDirectoryForMode(dirPath, options = {}) {
             if (namespace.type !== 0x9fa0n) {
                 throw new FsSafeError("path-mismatch", "directory mode requires a trusted procfs fd namespace");
             }
-            const opened = await inspectFileIdentity(() => handle.stat({ bigint: true }), expected);
-            const followed = await inspectFileIdentity(() => fs.stat(procPath, { bigint: true }), expected);
+            const opened = await inspectFileIdentity(() => fsSync.fstatSync(handle.fd, { bigint: true }), expected);
+            const followed = await inspectFileIdentity(() => fsSync.statSync(procPath, { bigint: true }), expected);
             assertOwnedDirectory(opened, followed);
             assertOwner(opened);
             assertOwner(followed);
@@ -91,3 +91,101 @@ export async function pinNodeDirectoryForMode(dirPath, options = {}) {
         throw error;
     }
 }
+/** Synchronous counterpart with the same no-follow, identity, and owner checks. */
+export function pinNodeDirectoryForModeSync(dirPath, options = {}) {
+    const expected = inspectDirectoryIdentitySync(dirPath, options.expectedIdentity);
+    const assertOwner = (stat) => {
+        if (options.ownerUid !== undefined && stat.uid !== BigInt(options.ownerUid)) {
+            throw new FsSafeError("not-owned", "directory mode target must retain its expected owner");
+        }
+    };
+    assertOwner(expected);
+    if (process.platform === "win32") {
+        return {
+            apply: (_mode, check) => {
+                check?.();
+                assertOwner(inspectDirectoryIdentitySync(dirPath, expected));
+                check?.();
+            },
+            close: () => undefined,
+        };
+    }
+    if ([constants.O_DIRECTORY, constants.O_NOFOLLOW, constants.O_NONBLOCK, constants.O_RDONLY]
+        .some((flag) => typeof flag !== "number")) {
+        throw new FsSafeError("helper-unavailable", "no-follow directory mode descriptors are unavailable");
+    }
+    const flags = constants.O_DIRECTORY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+    let fd;
+    let proc = false;
+    try {
+        fd = fsSync.openSync(dirPath, constants.O_RDONLY | flags);
+    }
+    catch (error) {
+        if (error.code !== "EACCES")
+            throw error;
+        const route = nodeDirectorySearchOnlyFlags();
+        if (!route)
+            throw error;
+        proc = route.proc;
+        fd = fsSync.openSync(dirPath, route.flags | flags);
+    }
+    let closed = false;
+    const inspect = () => {
+        if (closed)
+            throw new FsSafeError("path-mismatch", "directory mode descriptor is closed");
+        const stat = inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }), expected);
+        assertOwnedDirectory(expected, stat);
+        assertOwner(stat);
+        inspectDirectoryIdentitySync(dirPath, expected);
+        return Number(stat.mode & 4095n);
+    };
+    const procPath = `/proc/self/fd/${fd}`;
+    const assertProcAuthority = () => {
+        if (fsSync.statfsSync("/proc/self/fd", { bigint: true }).type !== 0x9fa0n) {
+            throw new FsSafeError("path-mismatch", "directory mode requires a trusted procfs fd namespace");
+        }
+        const opened = inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }), expected);
+        const followed = inspectFileIdentitySync(() => fsSync.statSync(procPath, { bigint: true }), expected);
+        assertOwnedDirectory(opened, followed);
+        assertOwner(opened);
+        assertOwner(followed);
+    };
+    try {
+        inspect();
+        return {
+            apply: (mode, check) => {
+                mode &= 0o7777;
+                check?.();
+                const currentMode = inspect();
+                check?.();
+                if (currentMode !== mode) {
+                    if (proc)
+                        assertProcAuthority();
+                    check?.();
+                    inspect();
+                    if (proc)
+                        fsSync.chmodSync(procPath, mode);
+                    else
+                        fsSync.fchmodSync(fd, mode);
+                    if (proc)
+                        assertProcAuthority();
+                }
+                const finalMode = inspect();
+                check?.();
+                if (finalMode !== mode) {
+                    throw new FsSafeError("path-mismatch", "directory final mode could not be verified");
+                }
+            },
+            close: () => {
+                if (closed)
+                    return;
+                closed = true;
+                fsSync.closeSync(fd);
+            },
+        };
+    }
+    catch (error) {
+        fsSync.closeSync(fd);
+        throw error;
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/durability.d.ts

@@ -1,4 +1,4 @@
 export { ensureDurableDirectory, pinDirectory, syncDirectory, syncDirectoryBestEffort, syncDirectoryBestEffortSync, syncDirectorySync, type DirectoryReceipt, type DirectorySyncOutcome, type DurableDirectoryReceipt, type EnsureDurableDirectoryOptions, type PinnedDirectory, } from "./directory-durability.js";
 export { isHardlinkFallbackError, publishFileExclusive, type PublishFileExclusiveResult, type PublishFileExclusiveStrategy, type PublishFileExclusiveCleanup, type PublishFileExclusiveDirectorySyncFailure, type PublishFileExclusiveFailureDetails, type PublishFileExclusiveFailurePhase, type PublishFileExclusiveSyncFailurePolicy, } from "./publish-file.js";
-export { sha256File, type Sha256FileInput, type Sha256FileResult, } from "./file-hash.js";
+export { sha256File, sha256FileSync, type Sha256FileInput, type Sha256FileSyncInput, type Sha256FileOptions, type Sha256FileResult, } from "./file-hash.js";
 //# sourceMappingURL=durability.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/durability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"durability.d.ts","sourceRoot":"","sources":["../src/durability.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,aAAa,EACb,uBAAuB,EACvB,2BAA2B,EAC3B,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,EAClC,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,wCAAwC,EAC7C,KAAK,kCAAkC,EACvC,KAAK,gCAAgC,EACrC,KAAK,qCAAqC,GAC3C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,UAAU,EACV,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"durability.d.ts","sourceRoot":"","sources":["../src/durability.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,aAAa,EACb,uBAAuB,EACvB,2BAA2B,EAC3B,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,EAClC,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,wCAAwC,EAC7C,KAAK,kCAAkC,EACvC,KAAK,gCAAgC,EACrC,KAAK,qCAAqC,GAC3C,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC"}

package/node_modules/@openclaw/fs-safe/dist/durability.js

@@ -1,3 +1,3 @@
 export { ensureDurableDirectory, pinDirectory, syncDirectory, syncDirectoryBestEffort, syncDirectoryBestEffortSync, syncDirectorySync, } from "./directory-durability.js";
 export { isHardlinkFallbackError, publishFileExclusive, } from "./publish-file.js";
-export { sha256File, } from "./file-hash.js";
+export { sha256File, sha256FileSync, } from "./file-hash.js";

package/node_modules/@openclaw/fs-safe/dist/effective-uid.d.ts

@@ -0,0 +1,2 @@
+export declare function resolveEffectiveUid(): number;
+//# sourceMappingURL=effective-uid.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/effective-uid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-uid.d.ts","sourceRoot":"","sources":["../src/effective-uid.ts"],"names":[],"mappings":"AAUA,wBAAgB,mBAAmB,IAAI,MAAM,CAe5C"}

package/node_modules/@openclaw/fs-safe/dist/effective-uid.js

@@ -0,0 +1,25 @@
+function isValidUid(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function unavailable(cause) {
+    return new Error("Effective user identity is unavailable.", {
+        ...(cause === undefined ? {} : { cause }),
+    });
+}
+export function resolveEffectiveUid() {
+    const provider = process.geteuid;
+    if (typeof provider !== "function") {
+        throw unavailable();
+    }
+    let uid;
+    try {
+        uid = provider.call(process);
+    }
+    catch (cause) {
+        throw unavailable(cause);
+    }
+    if (!isValidUid(uid)) {
+        throw unavailable();
+    }
+    return uid;
+}

package/node_modules/@openclaw/fs-safe/dist/error-detail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-detail.d.ts","sourceRoot":"","sources":["../src/error-detail.ts"],"names":[],"mappings":"AAKA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI/C"}
+{"version":3,"file":"error-detail.d.ts","sourceRoot":"","sources":["../src/error-detail.ts"],"names":[],"mappings":"AAMA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM/C"}

package/node_modules/@openclaw/fs-safe/dist/error-detail.js

@@ -1,10 +1,13 @@
 import os from "node:os";
+import path from "node:path";
 const UNSAFE_ERROR_DETAIL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/gu;
 export function formatErrorDetail(value) {
     return value.replace(UNSAFE_ERROR_DETAIL_CHARACTERS, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
 }
 export function shortPath(value) {
     const home = os.homedir();
-    const shortened = value.startsWith(home) ? `~${value.slice(home.length)}` : value;
+    const prefix = home.endsWith(path.sep) ? home : `${home}${path.sep}`;
+    const shortened = value === home ? "~"
+        : value.startsWith(prefix) ? `~${path.sep}${value.slice(prefix.length)}` : value;
     return formatErrorDetail(shortened);
 }

package/node_modules/@openclaw/fs-safe/dist/file-handle-transfer.d.ts

@@ -0,0 +1,14 @@
+import type { FileHandle } from "node:fs/promises";
+export type CopyFileHandleOptions = {
+    maxBytes?: number;
+    signal?: AbortSignal;
+    onChunk?: (chunk: Uint8Array) => void;
+    assertBeforeMutation?: () => void;
+};
+/** Copies caller-owned regular files from offset zero without moving either cursor. */
+export declare function copyFileHandle(source: FileHandle, target: FileHandle, options?: CopyFileHandleOptions): Promise<number>;
+export declare function transferFileHandle(source: FileHandle, target: FileHandle | number, options: CopyFileHandleOptions & {
+    sizeHint: number;
+    targetPosition?: number;
+}): Promise<number>;
+//# sourceMappingURL=file-handle-transfer.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/file-handle-transfer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-handle-transfer.d.ts","sourceRoot":"","sources":["../src/file-handle-transfer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAWnD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;CACnC,CAAC;AAkDF,uFAAuF;AACvF,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,CAAC,CA0CjB;AAGD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,UAAU,GAAG,MAAM,EAC3B,OAAO,EAAE,qBAAqB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/node_modules/@openclaw/fs-safe/dist/file-handle-transfer.js

@@ -0,0 +1,135 @@
+import { normalizeMaxBytes } from "./byte-budget.js";
+import { FsSafeError } from "./errors.js";
+import { assertSynchronousCallbackResult, composeMutationAssertions, rethrowMutationAuthorityError, } from "./mutation-authority.js";
+import { writeAllToFile } from "./write-file-handle.js";
+import { inspectFileIdentity } from "./strict-file-identity.js";
+const NO_CALLBACK_ARGUMENTS = Object.freeze([]);
+function defineReceiverValue(receiver, key, value) {
+    Object.defineProperty(receiver, key, {
+        value, enumerable: true, writable: true, configurable: true,
+    });
+}
+function copyTransferReceiver(options, maxBytes, sizeHint, signal, onChunk, assertBeforeMutation) {
+    const receiver = {};
+    const spreadSource = Object(options);
+    // Preserve the former late object-spread boundary, including proxy traps and
+    // unrelated getter failures. Authority-bearing values stay on their early
+    // snapshots, while descriptors still run in original own-key order.
+    for (const key of Reflect.ownKeys(spreadSource)) {
+        if (!Object.getOwnPropertyDescriptor(spreadSource, key)?.enumerable)
+            continue;
+        let value;
+        switch (key) {
+            case "maxBytes":
+                value = maxBytes;
+                break;
+            case "signal":
+                value = signal;
+                break;
+            case "onChunk":
+                value = onChunk;
+                break;
+            case "assertBeforeMutation":
+                value = assertBeforeMutation;
+                break;
+            default: value = Reflect.get(spreadSource, key);
+        }
+        // Create a data property so an enumerable __proto__ key cannot alter the
+        // ordinary receiver prototype, matching object spread.
+        defineReceiverValue(receiver, key, value);
+    }
+    // Match the explicit fields that followed the former spread. Updating an
+    // existing key retains its original position; absent keys append in order.
+    defineReceiverValue(receiver, "maxBytes", maxBytes);
+    defineReceiverValue(receiver, "sizeHint", sizeHint);
+    defineReceiverValue(receiver, "targetPosition", 0);
+    defineReceiverValue(receiver, "assertBeforeMutation", assertBeforeMutation);
+    return receiver;
+}
+/** Copies caller-owned regular files from offset zero without moving either cursor. */
+export async function copyFileHandle(source, target, options = {}) {
+    // Snapshot caller-owned options before the first await. This preserves
+    // inherited/non-enumerable callbacks and prevents accessor mutation from
+    // replacing cancellation or mutation authority mid-transfer.
+    const signal = options.signal;
+    signal?.throwIfAborted();
+    const maxBytes = normalizeMaxBytes(options.maxBytes);
+    const onChunk = options.onChunk;
+    const assertBeforeMutation = composeMutationAssertions(undefined, options.assertBeforeMutation);
+    const sourceStat = await inspectFileIdentity(() => {
+        signal?.throwIfAborted();
+        return source.stat({ bigint: true });
+    });
+    signal?.throwIfAborted();
+    if (!sourceStat.isFile())
+        throw new FsSafeError("not-file", "copy source handle must be a regular file");
+    if (maxBytes !== undefined && Number.isFinite(maxBytes) && sourceStat.size > BigInt(maxBytes)) {
+        throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes`);
+    }
+    const targetStat = await inspectFileIdentity(() => {
+        signal?.throwIfAborted();
+        return target.stat({ bigint: true });
+    });
+    signal?.throwIfAborted();
+    if (!targetStat.isFile())
+        throw new FsSafeError("not-file", "copy target handle must be a regular file");
+    if (sourceStat.dev === targetStat.dev && sourceStat.ino === targetStat.ino) {
+        throw new FsSafeError("path-alias", "copy source and target handles refer to the same file");
+    }
+    const sizeHint = Number(sourceStat.size);
+    const callbackThis = copyTransferReceiver(options, maxBytes, sizeHint, signal, onChunk, assertBeforeMutation);
+    const beforeWrite = () => {
+        signal?.throwIfAborted();
+        assertBeforeMutation?.();
+    };
+    return await transferFileHandleCore(source, target, sizeHint, maxBytes, 0, signal, onChunk, beforeWrite, callbackThis).catch(rethrowMutationAuthorityError);
+}
+// Root.copyIn supplies already-admitted identities and retains its owned target cursor.
+export function transferFileHandle(source, target, options) {
+    try {
+        const maxBytes = options.maxBytes;
+        const sizeHint = options.sizeHint;
+        const targetPosition = options.targetPosition;
+        const signal = options.signal;
+        const onChunk = options.onChunk;
+        const assertBeforeMutation = options.assertBeforeMutation;
+        const beforeWrite = signal === undefined && assertBeforeMutation === undefined
+            ? undefined
+            : () => {
+                signal?.throwIfAborted();
+                if (assertBeforeMutation) {
+                    Reflect.apply(assertBeforeMutation, options, NO_CALLBACK_ARGUMENTS);
+                }
+            };
+        return transferFileHandleCore(source, target, sizeHint, maxBytes, targetPosition, signal, onChunk, beforeWrite, options);
+    }
+    catch (error) {
+        // Keep the former async-function contract for synchronous option getters.
+        return Promise.reject(error);
+    }
+}
+async function transferFileHandleCore(source, target, sizeHint, maxBytes, targetPosition, signal, onChunk, beforeWrite, callbackThis) {
+    const limit = maxBytes ?? Infinity;
+    const buffer = Buffer.allocUnsafe(Math.min(512 * 1024, Math.max(64 * 1024, sizeHint), limit + 1));
+    let position = 0;
+    while (true) {
+        signal?.throwIfAborted();
+        const { bytesRead } = await source.read(buffer, 0, Math.min(buffer.length, limit - position + 1), position);
+        signal?.throwIfAborted();
+        if (bytesRead > limit - position) {
+            throw new FsSafeError("too-large", `file exceeds limit of ${limit} bytes`);
+        }
+        if (bytesRead === 0)
+            return position;
+        const chunk = buffer.subarray(0, bytesRead);
+        if (onChunk) {
+            const returned = Function.prototype.call.call(onChunk, callbackThis, chunk);
+            assertSynchronousCallbackResult(returned, "onChunk");
+        }
+        await writeAllToFile(target, chunk, {
+            position: targetPosition === undefined ? undefined : targetPosition + position,
+            assertBeforeMutation: beforeWrite,
+        });
+        position += bytesRead;
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/file-hash.d.ts

@@ -1,10 +1,17 @@
 import type { FileHandle } from "node:fs/promises";
 import { type NativeBinding } from "./native.js";
 export type Sha256FileInput = string | FileHandle;
+export type Sha256FileSyncInput = string | number;
+export type Sha256FileOptions = {
+    maxBytes?: number;
+    signal?: AbortSignal;
+};
 export type Sha256FileResult = {
     bytes: number;
     digest: string;
 };
-export declare function hashFileHandle(handle: FileHandle, native?: NativeBinding | undefined): Promise<Sha256FileResult>;
-export declare function sha256File(input: Sha256FileInput): Promise<Sha256FileResult>;
+export declare function hashFileHandle(handle: FileHandle, native?: NativeBinding | undefined, { maxBytes, signal }?: Sha256FileOptions): Promise<Sha256FileResult>;
+export declare function sha256File(input: Sha256FileInput, options?: Sha256FileOptions): Promise<Sha256FileResult>;
+/** Hash synchronously from offset zero, retaining ownership and position of a borrowed fd. */
+export declare function sha256FileSync(input: Sha256FileSyncInput, options?: Sha256FileOptions): Sha256FileResult;
 //# sourceMappingURL=file-hash.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/file-hash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-hash.d.ts","sourceRoot":"","sources":["../src/file-hash.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAInE,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,UAAU,CAAC;AAElD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,EAClB,MAAM,GAAE,aAAa,GAAG,SAA8B,GACrD,OAAO,CAAC,gBAAgB,CAAC,CAoB3B;AA+CD,wBAAsB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAElF"}
+{"version":3,"file":"file-hash.d.ts","sourceRoot":"","sources":["../src/file-hash.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAKnE,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,UAAU,CAAC;AAClD,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,CAAC;AAElD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,EAClB,MAAM,GAAE,aAAa,GAAG,SAA8B,EACtD,EAAE,QAAmB,EAAE,MAAM,EAAE,GAAE,iBAAsB,GACtD,OAAO,CAAC,gBAAgB,CAAC,CAwD3B;AA0DD,wBAAsB,UAAU,CAC9B,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AAwDD,8FAA8F;AAC9F,wBAAgB,cAAc,CAC5B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,GAAE,iBAAsB,GAC9B,gBAAgB,CAMlB"}

package/node_modules/@openclaw/fs-safe/dist/file-hash.js

@@ -1,73 +1,180 @@
 import { createHash } from "node:crypto";
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
+import { normalizeMaxBytes } from "./byte-budget.js";
 import { FsSafeError } from "./errors.js";
 import { getNativeBinding } from "./native.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
-export async function hashFileHandle(handle, native = getNativeBinding()) {
-    const stat = await handle.stat();
+import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
+export async function hashFileHandle(handle, native = getNativeBinding(), { maxBytes = Infinity, signal } = {}) {
+    signal?.throwIfAborted();
+    const stat = fsSync.fstatSync(handle.fd);
     if (!stat.isFile()) {
         throw new FsSafeError("not-file", "SHA-256 input is not a regular file");
     }
+    if (stat.size > maxBytes) {
+        throw new FsSafeError("too-large", `SHA-256 input exceeds ${maxBytes} bytes`);
+    }
     if (native) {
-        return await native.sha256File(handle.fd);
+        // A completed N-API task can mask later aborts on the same signal.
+        const nativeSignal = signal ? AbortSignal.any([signal]) : undefined;
+        try {
+            const result = await native.sha256File(handle.fd, Number.isFinite(maxBytes) ? maxBytes : undefined, nativeSignal);
+            signal?.throwIfAborted();
+            return result;
+        }
+        catch (error) {
+            // N-API settles only after compute stops; never race descriptor cleanup.
+            signal?.throwIfAborted();
+            if (error?.code === "too-large") {
+                throw new FsSafeError("too-large", `SHA-256 input exceeds ${maxBytes} bytes`, { cause: error });
+            }
+            throw error;
+        }
+        finally {
+            // Node retains composite signals while N-API's abort listener is attached.
+            if (nativeSignal)
+                nativeSignal.onabort = null;
+        }
     }
     const hash = createHash("sha256");
-    const buffer = Buffer.allocUnsafe(64 * 1024);
+    let buffer = Buffer.allocUnsafe(Math.min(256 * 1024, Math.max(1, stat.size + 1), maxBytes + 1));
     let position = 0;
     while (true) {
-        const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);
+        signal?.throwIfAborted();
+        const length = Math.min(buffer.length, maxBytes - position + 1);
+        const { bytesRead } = await handle.read(buffer, 0, length, position);
+        signal?.throwIfAborted();
+        if (bytesRead > maxBytes - position) {
+            throw new FsSafeError("too-large", `SHA-256 input exceeds ${maxBytes} bytes`);
+        }
         if (bytesRead === 0) {
             return { bytes: position, digest: hash.digest("hex") };
         }
         hash.update(buffer.subarray(0, bytesRead));
         position += bytesRead;
+        // A full small buffer can mean growth or a virtual file with an unhelpful size.
+        if (bytesRead === buffer.length && buffer.length < 64 * 1024) {
+            buffer = Buffer.allocUnsafe(Math.min(64 * 1024, maxBytes + 1));
+        }
     }
 }
-async function hashPath(filePath) {
-    const before = await inspectFileIdentity(async () => {
-        const stat = await fs.lstat(filePath, { bigint: true });
-        if (stat.isSymbolicLink()) {
-            throw new FsSafeError("symlink", "SHA-256 path must not be a symbolic link");
-        }
-        if (!stat.isFile()) {
-            throw new FsSafeError("not-file", "SHA-256 path is not a regular file");
-        }
-        return stat;
-    });
+function hashPathIdentity(filePath, afterOpen = false) {
+    const stat = fsSync.lstatSync(filePath, { bigint: true });
+    if (afterOpen && (stat.isSymbolicLink() || !stat.isFile())) {
+        throw new FsSafeError("path-mismatch", "SHA-256 path changed while opening");
+    }
+    if (stat.isSymbolicLink()) {
+        throw new FsSafeError("symlink", "SHA-256 path must not be a symbolic link");
+    }
+    if (!stat.isFile()) {
+        throw new FsSafeError("not-file", "SHA-256 path is not a regular file");
+    }
+    return stat;
+}
+function hashDescriptorIdentity(fd) {
+    const stat = fsSync.fstatSync(fd, { bigint: true });
+    if (!stat.isFile()) {
+        throw new FsSafeError("not-file", "SHA-256 path is not a regular file");
+    }
+    return stat;
+}
+function rethrowHashOpenError(error) {
+    if (error?.code === "ELOOP") {
+        throw new FsSafeError("symlink", "SHA-256 path must not be a symbolic link", {
+            cause: error,
+        });
+    }
+    throw error;
+}
+async function hashPath(filePath, options) {
+    assertNoWindowsPathAlias(filePath, "filesystem", "SHA-256 path uses a Windows filesystem namespace alias");
+    const before = await inspectFileIdentity(() => hashPathIdentity(filePath));
     let handle;
     try {
+        options.signal?.throwIfAborted();
         handle = await fs.open(filePath, resolveReadOpenFlags());
     }
     catch (error) {
-        if (error?.code === "ELOOP") {
-            throw new FsSafeError("symlink", "SHA-256 path must not be a symbolic link", {
-                cause: error,
-            });
-        }
-        throw error;
+        rethrowHashOpenError(error);
     }
     try {
-        const opened = await inspectFileIdentity(async () => {
-            const stat = await handle.stat({ bigint: true });
-            if (!stat.isFile()) {
-                throw new FsSafeError("not-file", "SHA-256 path is not a regular file");
-            }
-            return stat;
-        }, before);
-        await inspectFileIdentity(async () => {
-            const stat = await fs.lstat(filePath, { bigint: true });
-            if (stat.isSymbolicLink() || !stat.isFile()) {
-                throw new FsSafeError("path-mismatch", "SHA-256 path changed while opening");
-            }
-            return stat;
-        }, opened);
-        return await hashFileHandle(handle);
+        options.signal?.throwIfAborted();
+        const opened = await inspectFileIdentity(() => hashDescriptorIdentity(handle.fd), before);
+        await inspectFileIdentity(() => hashPathIdentity(filePath, true), opened);
+        return await hashFileHandle(handle, getNativeBinding(), options);
     }
     finally {
         await handle.close().catch(() => undefined);
     }
 }
-export async function sha256File(input) {
-    return typeof input === "string" ? await hashPath(input) : await hashFileHandle(input);
+export async function sha256File(input, options = {}) {
+    options.signal?.throwIfAborted();
+    const normalized = { maxBytes: normalizeMaxBytes(options.maxBytes), signal: options.signal };
+    return typeof input === "string"
+        ? await hashPath(input, normalized)
+        : await hashFileHandle(input, getNativeBinding(), normalized);
+}
+function hashDescriptorSync(fd, { maxBytes = Infinity, signal }) {
+    signal?.throwIfAborted();
+    const stat = fsSync.fstatSync(fd);
+    if (!stat.isFile()) {
+        throw new FsSafeError("not-file", "SHA-256 input is not a regular file");
+    }
+    if (stat.size > maxBytes) {
+        throw new FsSafeError("too-large", `SHA-256 input exceeds ${maxBytes} bytes`);
+    }
+    const hash = createHash("sha256");
+    let buffer = Buffer.allocUnsafe(Math.min(256 * 1024, Math.max(1, stat.size + 1), maxBytes + 1));
+    let position = 0;
+    while (true) {
+        signal?.throwIfAborted();
+        const length = Math.min(buffer.length, maxBytes - position + 1);
+        const bytesRead = fsSync.readSync(fd, buffer, 0, length, position);
+        signal?.throwIfAborted();
+        if (bytesRead > maxBytes - position) {
+            throw new FsSafeError("too-large", `SHA-256 input exceeds ${maxBytes} bytes`);
+        }
+        if (bytesRead === 0) {
+            return { bytes: position, digest: hash.digest("hex") };
+        }
+        hash.update(buffer.subarray(0, bytesRead));
+        position += bytesRead;
+        if (bytesRead === buffer.length && buffer.length < 64 * 1024) {
+            buffer = Buffer.allocUnsafe(Math.min(64 * 1024, maxBytes + 1));
+        }
+    }
+}
+function hashPathSync(filePath, options) {
+    assertNoWindowsPathAlias(filePath, "filesystem", "SHA-256 path uses a Windows filesystem namespace alias");
+    const before = inspectFileIdentitySync(() => hashPathIdentity(filePath));
+    let fd;
+    try {
+        options.signal?.throwIfAborted();
+        fd = fsSync.openSync(filePath, resolveReadOpenFlags());
+    }
+    catch (error) {
+        rethrowHashOpenError(error);
+    }
+    try {
+        options.signal?.throwIfAborted();
+        const opened = inspectFileIdentitySync(() => hashDescriptorIdentity(fd), before);
+        inspectFileIdentitySync(() => hashPathIdentity(filePath, true), opened);
+        return hashDescriptorSync(fd, options);
+    }
+    finally {
+        try {
+            fsSync.closeSync(fd);
+        }
+        catch { /* Preserve the hashing outcome. */ }
+    }
+}
+/** Hash synchronously from offset zero, retaining ownership and position of a borrowed fd. */
+export function sha256FileSync(input, options = {}) {
+    options.signal?.throwIfAborted();
+    const normalized = { maxBytes: normalizeMaxBytes(options.maxBytes), signal: options.signal };
+    return typeof input === "string"
+        ? hashPathSync(input, normalized)
+        : hashDescriptorSync(input, normalized);
 }

package/node_modules/@openclaw/fs-safe/dist/file-lock-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-lock-sync.d.ts","sourceRoot":"","sources":["../src/file-lock-sync.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EASL,KAAK,wBAAwB,EAC9B,MAAM,2BAA2B,CAAC;AASnC,OAAO,KAAK,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,yBAAyB,CAAC;AAIjC,MAAM,MAAM,0BAA0B,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,uBAAuB,CAAC;IAChC,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,QAAQ,CAAC;IACxB,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,iBAAiB,EAAE,KAAK,CAAC;KAC1B,KAAK,OAAO,CAAC;IACd,qBAAqB,CAAC,EAAE,CAAC,QAAQ,EAAE,wBAAwB,KAAK,OAAO,CAAC;IACxE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,0BAA0B,KAAK,IAAI,CAAC;IAC3D,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,IAAI,OAAO,CAAC;IAC3B,OAAO,IAAI,IAAI,CAAC;IAChB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;CAC1B,CAAC;AAoJF,wBAAgB,mBAAmB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,CAAC,QAAQ,CAAC,GAC5C,kBAAkB,CAwMpB;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,CAAC,QAAQ,CAAC,EAC7C,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAOH"}
+{"version":3,"file":"file-lock-sync.d.ts","sourceRoot":"","sources":["../src/file-lock-sync.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EASL,KAAK,wBAAwB,EAC9B,MAAM,2BAA2B,CAAC;AAWnC,OAAO,KAAK,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,yBAAyB,CAAC;AAQjC,MAAM,MAAM,0BAA0B,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,uBAAuB,CAAC;IAChC,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,QAAQ,CAAC;IACxB,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,iBAAiB,EAAE,KAAK,CAAC;KAC1B,KAAK,OAAO,CAAC;IACd,qBAAqB,CAAC,EAAE,CAAC,QAAQ,EAAE,wBAAwB,KAAK,OAAO,CAAC;IACxE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,0BAA0B,KAAK,IAAI,CAAC;IAC3D,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,IAAI,OAAO,CAAC;IAC3B,OAAO,IAAI,IAAI,CAAC;IAChB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;CAC1B,CAAC;AA8JF,wBAAgB,mBAAmB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,CAAC,QAAQ,CAAC,GAC5C,kBAAkB,CA4NpB;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,CAAC,QAAQ,CAAC,EAC7C,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAOH"}