@openclaw/openshell-sandbox 2026.9.4 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/json-durable-queue.js

@@ -1,24 +1,26 @@
 import fs, {} from "node:fs";
 import path from "node:path";
-import { normalizeMaxBytes } from "./byte-budget.js";
 import { syncDirectory } from "./directory-durability.js";
-import { syncQueueDirectoryCreation } from "./json-durable-queue-directory.js";
-import { getErrorCode, acknowledgeDurableQueueEntry, claimDurableQueueEntry, completeDeliveredQueueEntry, moveDurableQueueEntryToFailed, } from "./json-durable-queue-ownership.js";
+import { queueDirectories } from "./json-durable-queue-directory.js";
+import { getErrorCode, acknowledgeDurableQueueEntry, claimDurableQueueEntry, completeDeliveredQueueEntry, migrateDurableQueueEntry, moveDurableQueueEntryToFailed, validateDurableQueueEntryPaths, } from "./json-durable-queue-ownership.js";
+import { withJsonDurableQueueEntry } from "./json-durable-queue-read.js";
 import { stringifyJsonDocument } from "./json-stringify.js";
-import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { replaceFileAtomicWithDirectorySync } from "./replace-file.js";
 import { assertSafePathSegment } from "./safe-path-segment.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
-export const DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES = 16 * 1024 * 1024;
+import { admitStandalonePublicationPath, assertNoWindowsPathAlias, hasWindowsPathAlias, } from "./windows-path-alias.js";
+export { DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES } from "./json-durable-queue-read.js";
 function assertSafeQueueEntryId(id) {
     assertSafePathSegment(id, { label: "queue entry id" });
 }
 export async function unlinkBestEffort(filePath) {
+    if (hasWindowsPathAlias(filePath, "filesystem"))
+        return;
     await fs.promises.unlink(filePath).catch(() => undefined);
 }
 export async function jsonDurableQueueEntryExists(filePath) {
+    assertNoWindowsPathAlias(filePath);
     try {
-        const stat = await fs.promises.lstat(filePath);
+        const stat = fs.lstatSync(filePath);
         return stat.isFile();
     }
     catch (error) {
@@ -30,7 +32,7 @@ export async function jsonDurableQueueEntryExists(filePath) {
 }
 async function unlinkStaleTmpBestEffort(filePath, now, maxAgeMs) {
     try {
-        const stat = await fs.promises.stat(filePath);
+        const stat = fs.statSync(filePath);
         if (stat.isFile() && now - stat.mtimeMs >= maxAgeMs) {
             await unlinkBestEffort(filePath);
         }
@@ -43,6 +45,7 @@ async function unlinkStaleTmpBestEffort(filePath, now, maxAgeMs) {
 }
 export function resolveJsonDurableQueueEntryPaths(queueDir, id) {
     assertSafeQueueEntryId(id);
+    assertNoWindowsPathAlias(queueDir);
     return {
         jsonPath: path.join(queueDir, `${id}.json`),
         deliveredPath: path.join(queueDir, `${id}.delivered`),
@@ -50,263 +53,75 @@ export function resolveJsonDurableQueueEntryPaths(queueDir, id) {
     };
 }
 export async function ensureJsonDurableQueueDirs(params) {
-    const roots = await queueValidationRoots(params.queueDir, params.failedDir);
-    await ensureJsonDurableQueueDir(params.queueDir, roots.queueRoot);
-    await ensureJsonDurableQueueDir(params.failedDir, roots.failedRoot);
-}
-async function ensureJsonDurableQueueDir(dir, validationRoot) {
-    const root = validationRoot
-        ? validationRoot
-        : queueValidationRoot(dir);
-    await assertNoSymlinkDirectorySegments(root, dir, true);
-    await fs.promises.mkdir(dir, { recursive: true, mode: 0o700 });
-    await assertNoSymlinkDirectorySegments(root, dir, false);
-    await chmodQueueDirectory(dir);
-    await syncQueueDirectoryCreation(dir, root.path);
-}
-async function assertJsonDurableQueueDir(dir, validationRoot) {
-    const root = validationRoot
-        ? validationRoot
-        : queueValidationRoot(dir);
-    await assertNoSymlinkDirectorySegments(root, dir, false);
-}
-function commonPathAncestor(paths) {
-    const resolved = paths.map((entry) => path.resolve(entry));
-    const root = path.parse(resolved[0] ?? process.cwd()).root;
-    const parts = resolved.map((entry) => path.relative(root, entry).split(path.sep));
-    const common = [];
-    for (let index = 0; parts.every((part) => index < part.length); index++) {
-        const segment = parts[0]?.[index];
-        if (!segment || !parts.every((part) => part[index] === segment))
-            break;
-        common.push(segment);
-    }
-    return path.join(root, ...common);
-}
-function samePathRoot(paths) {
-    const roots = paths.map((entry) => path.parse(path.resolve(entry)).root);
-    const first = process.platform === "win32" ? roots[0]?.toLowerCase() : roots[0];
-    return roots.every((root) => (process.platform === "win32" ? root.toLowerCase() : root) === first);
-}
-async function queueValidationRoots(queueDir, failedDir) {
-    if (samePathRoot([queueDir, failedDir])) {
-        const common = commonPathAncestor([queueDir, failedDir]);
-        const root = queueValidationRoot(common);
-        return { failedRoot: root, queueRoot: root };
-    }
-    return {
-        failedRoot: queueValidationRoot(failedDir),
-        queueRoot: queueValidationRoot(queueDir),
-    };
-}
-function queueValidationRoot(dir) {
-    return {
-        path: path.parse(path.resolve(dir)).root,
-        allowSymlinkBase: process.platform === "darwin",
-    };
-}
-async function isDarwinSystemAlias(dir, stat) {
-    if (process.platform !== "darwin" || !stat.isSymbolicLink()) {
-        return false;
-    }
-    const resolved = path.resolve(dir);
-    if (resolved !== "/tmp" && resolved !== "/var") {
-        return false;
-    }
-    return await fs.promises.realpath(resolved).then((realPath) => realPath === `/private${resolved}`, () => false);
-}
-async function assertNoSymlinkDirectorySegments(validationRoot, dir, allowMissing) {
-    let base = path.resolve(validationRoot.path);
-    let target = path.resolve(dir);
-    let current = base;
-    let baseStat = await fs.promises.lstat(base);
-    if (baseStat.isSymbolicLink() && validationRoot.allowSymlinkBase) {
-        const relative = path.relative(base, target);
-        if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-            throw new Error(`durable queue path is not a directory: ${dir}`);
-        }
-        base = await fs.promises.realpath(base);
-        target = path.join(base, ...relative.split(path.sep).filter(Boolean));
-        current = base;
-        baseStat = await fs.promises.lstat(base);
-    }
-    if (baseStat.isSymbolicLink() || !baseStat.isDirectory()) {
-        throw new Error(`durable queue path is not a directory: ${dir}`);
-    }
-    const segments = path.relative(base, target).split(path.sep).filter(Boolean);
-    for (let index = 0; index < segments.length; index++) {
-        const segment = segments[index];
-        if (segment === undefined) {
-            continue;
-        }
-        current = path.join(current, segment);
-        let stat;
-        try {
-            stat = await fs.promises.lstat(current);
-        }
-        catch (error) {
-            if (allowMissing && error.code === "ENOENT") {
-                return;
-            }
-            throw error;
-        }
-        if (stat.isSymbolicLink() || !stat.isDirectory()) {
-            if (stat.isSymbolicLink() && validationRoot.allowSymlinkBase) {
-                if (await isDarwinSystemAlias(current, stat)) {
-                    current = await fs.promises.realpath(current);
-                    continue;
-                }
-            }
-            throw new Error(`durable queue path is not a directory: ${dir}`);
-        }
-    }
-}
-async function chmodQueueDirectory(dir) {
-    const noFollow = typeof fs.constants.O_NOFOLLOW === "number" && process.platform !== "win32"
-        ? fs.constants.O_NOFOLLOW
-        : 0;
-    const directoryFlag = typeof fs.constants.O_DIRECTORY === "number" && process.platform !== "win32"
-        ? fs.constants.O_DIRECTORY
-        : 0;
-    if (noFollow || directoryFlag) {
-        let handle;
-        try {
-            handle = await fs.promises.open(dir, fs.constants.O_RDONLY | noFollow | directoryFlag);
-            const stat = await handle.stat();
-            if (!stat.isDirectory()) {
-                throw new Error(`durable queue path is not a directory: ${dir}`);
-            }
-            try {
-                await handle.chmod(0o700);
-            }
-            catch {
-                // Best-effort on platforms that do not enforce POSIX modes.
-            }
-            return;
-        }
-        finally {
-            try {
-                await handle?.close();
-            }
-            catch {
-                // Best-effort cleanup after chmod/open failures.
-            }
-        }
-    }
-    const stat = await fs.promises.lstat(dir);
-    if (stat.isSymbolicLink() || !stat.isDirectory()) {
-        throw new Error(`durable queue path is not a directory: ${dir}`);
-    }
-    try {
-        await fs.promises.chmod(dir, 0o700);
-    }
-    catch {
-        // Best-effort on platforms that do not enforce POSIX modes.
-    }
+    const queueDir = params.queueDir;
+    const failedDir = params.failedDir;
+    assertNoWindowsPathAlias(queueDir);
+    assertNoWindowsPathAlias(failedDir);
+    const directories = await queueDirectories(queueDir, failedDir);
+    await directories.queue.ensure();
+    await directories.failed.ensure();
 }
 export async function writeJsonDurableQueueEntry(params) {
+    await writeQueueEntry(params);
+}
+async function writeQueueEntry(params, beforeRename) {
+    const filePath = admitStandalonePublicationPath(params.filePath);
+    const entry = params.entry;
+    const tempPrefix = params.tempPrefix;
     await replaceFileAtomicWithDirectorySync({
-        filePath: params.filePath,
-        content: stringifyJsonDocument(params.entry, null, 2),
+        filePath,
+        content: stringifyJsonDocument(entry, null, 2),
         mode: 0o600,
-        tempPrefix: params.tempPrefix,
+        tempPrefix,
         syncTempFile: true,
+        beforeRename,
     }, syncDirectory);
 }
-async function inspectQueueEntry(inspect, maxBytes, expected) {
-    let inspectionFailed = false;
-    try {
-        return await inspectFileIdentity(async () => {
-            try {
-                const stat = await inspect();
-                if (stat.isSymbolicLink() || !stat.isFile()) {
-                    throw new Error("queue entry is not a regular file");
-                }
-                if (stat.nlink > 1n)
-                    throw new Error("queue entry hardlinks are not allowed");
-                if (stat.size > maxBytes)
-                    throw new Error(`queue entry exceeds ${maxBytes} bytes`);
-                return stat;
-            }
-            catch (error) {
-                inspectionFailed = true;
-                throw error;
-            }
-        }, expected);
-    }
-    catch (error) {
-        // Translate only the identity helper's rejection, never inspection errors.
-        if (inspectionFailed)
-            throw error;
-        throw new Error("queue entry changed during read", { cause: error });
-    }
-}
-async function readBoundedUtf8File(params) {
-    const inspectPath = () => fs.promises.lstat(params.filePath, { bigint: true });
-    const initialStat = await inspectQueueEntry(inspectPath, params.maxBytes);
-    const handle = await fs.promises.open(params.filePath, resolveReadOpenFlags());
-    try {
-        const openedStat = await inspectQueueEntry(() => handle.stat({ bigint: true }), params.maxBytes, initialStat);
-        await inspectQueueEntry(inspectPath, params.maxBytes, openedStat);
-        const chunks = [];
-        const scratch = Buffer.allocUnsafe(Math.min(64 * 1024, params.maxBytes + 1));
-        let total = 0;
-        while (true) {
-            const { bytesRead } = await handle.read(scratch, 0, scratch.length, null);
-            if (bytesRead === 0) {
-                return Buffer.concat(chunks, total).toString("utf8");
-            }
-            total += bytesRead;
-            if (total > params.maxBytes) {
-                throw new Error(`queue entry exceeds ${params.maxBytes} bytes`);
-            }
-            chunks.push(Buffer.from(scratch.subarray(0, bytesRead)));
-        }
-    }
-    finally {
-        await handle.close();
-    }
-}
 export async function readJsonDurableQueueEntry(filePath, options = {}) {
-    return JSON.parse(await readBoundedUtf8File({
-        filePath,
-        maxBytes: normalizeMaxBytes(options.maxBytes, {
-            defaultValue: DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES,
-        }),
-    }));
+    return await withJsonDurableQueueEntry(filePath, options, async (entry) => entry);
+}
+async function migrateClaimedQueueEntry(params) {
+    await migrateDurableQueueEntry(params.paths, params.identity, params.releaseReadPin, async (filePath, beforePublish) => {
+        await writeQueueEntry({ filePath, entry: params.entry, tempPrefix: params.tempPrefix }, beforePublish);
+    });
 }
 export async function ackJsonDurableQueueEntry(paths) {
     await acknowledgeDurableQueueEntry(paths);
 }
 export async function loadJsonDurableQueueEntry(params) {
+    const pathsInput = params.paths;
+    const paths = validateDurableQueueEntryPaths(pathsInput);
+    const claimedPath = await claimDurableQueueEntry(paths);
+    if (!claimedPath)
+        return null;
+    const readOptions = { maxBytes: params.maxBytes };
+    let processingStarted = false;
     try {
-        const claimedPath = await claimDurableQueueEntry(params.paths);
-        if (!claimedPath)
-            return null;
-        const raw = await readJsonDurableQueueEntry(claimedPath, {
-            maxBytes: params.maxBytes,
+        return await withJsonDurableQueueEntry(claimedPath, readOptions, async (raw, identity, releaseReadPin) => {
+            processingStarted = true;
+            const read = params.read;
+            const result = read ? await Reflect.apply(read, params, [raw, paths.jsonPath]) : { entry: raw };
+            if (result.migrated) {
+                await migrateClaimedQueueEntry({
+                    paths, identity, releaseReadPin, entry: result.entry, tempPrefix: params.tempPrefix,
+                });
+            }
+            return result.entry;
         });
-        const result = params.read ? await params.read(raw, params.paths.jsonPath) : { entry: raw };
-        if (result.migrated) {
-            await writeJsonDurableQueueEntry({
-                filePath: claimedPath,
-                entry: result.entry,
-                tempPrefix: params.tempPrefix,
-            });
-        }
-        return result.entry;
     }
     catch (error) {
-        if (getErrorCode(error) === "ENOENT") {
+        if (!processingStarted && getErrorCode(error) === "ENOENT") {
             return null;
         }
         throw error;
     }
 }
 export async function loadPendingJsonDurableQueueEntries(options) {
+    const queueDir = options.queueDir;
+    assertNoWindowsPathAlias(queueDir);
     let files;
     try {
-        files = await fs.promises.readdir(options.queueDir);
+        files = await fs.promises.readdir(queueDir);
     }
     catch (error) {
         if (getErrorCode(error) === "ENOENT") {
@@ -318,10 +133,17 @@ export async function loadPendingJsonDurableQueueEntries(options) {
     for (const file of files) {
         if (file.endsWith(".delivered")) {
             const id = file.slice(0, -".delivered".length);
-            await completeDeliveredQueueEntry(resolveJsonDurableQueueEntryPaths(options.queueDir, id));
+            try {
+                assertSafeQueueEntryId(id);
+            }
+            catch {
+                continue;
+            }
+            const paths = validateDurableQueueEntryPaths(resolveJsonDurableQueueEntryPaths(queueDir, id));
+            await completeDeliveredQueueEntry(paths);
         }
         else if (options.cleanupTmpMaxAgeMs !== undefined && file.endsWith(".tmp")) {
-            await unlinkStaleTmpBestEffort(path.join(options.queueDir, file), now, options.cleanupTmpMaxAgeMs);
+            await unlinkStaleTmpBestEffort(path.join(queueDir, file), now, options.cleanupTmpMaxAgeMs);
         }
     }
     const ids = [];
@@ -348,36 +170,46 @@ export async function loadPendingJsonDurableQueueEntries(options) {
     }
     const entries = [];
     for (const id of ids) {
-        const paths = resolveJsonDurableQueueEntryPaths(options.queueDir, id);
+        const paths = validateDurableQueueEntryPaths(resolveJsonDurableQueueEntryPaths(queueDir, id));
         const claimedPath = await claimDurableQueueEntry(paths, { skipUnowned: true });
         if (!claimedPath)
             continue;
-        let result;
+        let migrationStarted = false;
         try {
-            const raw = await readJsonDurableQueueEntry(claimedPath, { maxBytes: options.maxBytes });
-            result = options.read ? await options.read(raw, paths.jsonPath) : { entry: raw };
+            const entry = await withJsonDurableQueueEntry(claimedPath, { maxBytes: options.maxBytes }, async (raw, identity, releaseReadPin) => {
+                const read = options.read;
+                const result = read ? await Reflect.apply(read, options, [raw, paths.jsonPath]) : { entry: raw };
+                if (result.migrated) {
+                    migrationStarted = true;
+                    await migrateClaimedQueueEntry({
+                        paths, identity, releaseReadPin, entry: result.entry, tempPrefix: options.tempPrefix,
+                    });
+                }
+                return result.entry;
+            });
+            entries.push(entry);
         }
-        catch {
+        catch (error) {
+            if (migrationStarted)
+                throw error;
             continue;
         }
-        if (result.migrated) {
-            await writeJsonDurableQueueEntry({
-                filePath: claimedPath,
-                entry: result.entry,
-                tempPrefix: options.tempPrefix,
-            });
-        }
-        entries.push(result.entry);
     }
     return entries;
 }
 export async function moveJsonDurableQueueEntryToFailed(params) {
-    assertSafeQueueEntryId(params.id);
-    const roots = await queueValidationRoots(params.queueDir, params.failedDir);
-    await assertJsonDurableQueueDir(params.queueDir, roots.queueRoot);
-    await ensureJsonDurableQueueDir(params.failedDir, roots.failedRoot);
+    const id = params.id;
+    const queueDir = params.queueDir;
+    const failedDir = params.failedDir;
+    assertSafeQueueEntryId(id);
+    assertNoWindowsPathAlias(queueDir);
+    assertNoWindowsPathAlias(failedDir);
+    const directories = await queueDirectories(queueDir, failedDir);
+    await directories.queue.assert();
+    await directories.failed.ensure();
+    const paths = validateDurableQueueEntryPaths(resolveJsonDurableQueueEntryPaths(queueDir, id));
     await moveDurableQueueEntryToFailed({
-        paths: resolveJsonDurableQueueEntryPaths(params.queueDir, params.id),
-        failedPath: path.join(params.failedDir, `${params.id}.json`),
+        paths,
+        failedPath: path.join(failedDir, `${id}.json`),
     });
 }

package/node_modules/@openclaw/fs-safe/dist/json-store.d.ts

@@ -6,4 +6,3 @@ export type JsonStoreOptions<T> = JsonFileStoreOptions & {
 };
 export type { JsonFileStoreOptions, JsonStore, JsonStoreLockOptions };
 export declare function jsonStore<T>(options: JsonStoreOptions<T>): JsonStore<T>;
-//# sourceMappingURL=json-store.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/json-store.js

@@ -1,8 +1,11 @@
 import path from "node:path";
 import { fileStore } from "./file-store.js";
 import {} from "./json-document-store.js";
+import { admitStandalonePublicationPath, assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export function jsonStore(options) {
-    const filePath = path.resolve(options.filePath);
+    const filePathInput = admitStandalonePublicationPath(options.filePath);
+    const filePath = path.resolve(filePathInput);
+    assertNoWindowsPathAlias(filePath);
     return fileStore({
         rootDir: path.dirname(filePath),
         private: true,

package/node_modules/@openclaw/fs-safe/dist/json-stringify.d.ts

@@ -1,2 +1 @@
 export declare function stringifyJsonDocument(value: unknown, replacer?: Parameters<typeof JSON.stringify>[1], space?: Parameters<typeof JSON.stringify>[2]): string;
-//# sourceMappingURL=json-stringify.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/json.d.ts

@@ -47,4 +47,3 @@ export declare function readJsonIfExists<T>(filePath: string, options?: ReadJson
 export declare function readJsonSync<T = unknown>(filePath: string, options?: ReadJsonOptions): T;
 export type WriteJsonOptions = Pick<WriteTextAtomicOptions, "dirMode" | "durable" | "mode" | "trailingNewline">;
 export declare function writeJson(filePath: string, value: unknown, options?: WriteJsonOptions): Promise<void>;
-//# sourceMappingURL=json.d.ts.map