@openclaw/openshell-sandbox 2026.9.4 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/unicode-path.js

@@ -0,0 +1,16 @@
+const NON_ASCII = /[^\x00-\x7f]/;
+export function lowerCaseNfc(value) {
+    return NON_ASCII.test(value) ? value.normalize("NFC").toLowerCase().normalize("NFC") : value.toLowerCase();
+}
+export function maxNormalizedUtf8Bytes(value, includeRaw = false) {
+    // ASCII has identical raw, NFC and NFD forms, with one UTF-8 byte per unit.
+    if (typeof value === "string" && !NON_ASCII.test(value))
+        return value.length;
+    const nfc = value.normalize("NFC");
+    const bytes = Buffer.byteLength(nfc, "utf8");
+    const maximum = includeRaw && nfc !== value ? Math.max(bytes, Buffer.byteLength(value, "utf8")) : bytes;
+    // ASCII NFC output also has identical NFD and one UTF-8 byte per code unit.
+    if (bytes === nfc.length)
+        return maximum;
+    return Math.max(maximum, Buffer.byteLength(value.normalize("NFD"), "utf8"));
+}

package/node_modules/@openclaw/fs-safe/dist/walk.d.ts

@@ -16,6 +16,10 @@ export type WalkDirectoryOptions = {
     include?: (entry: WalkDirectoryEntry) => boolean;
     descend?: (entry: WalkDirectoryEntry) => boolean;
 };
+export type AsyncWalkDirectoryOptions = Omit<WalkDirectoryOptions, "include" | "descend"> & {
+    include?: (entry: WalkDirectoryEntry) => boolean | Promise<boolean>;
+    descend?: (entry: WalkDirectoryEntry) => boolean | Promise<boolean>;
+};
 export type WalkDirectoryFailure = {
     path: string;
     relativePath: string;
@@ -32,6 +36,5 @@ type WalkDirectoryResultWithFailures = WalkDirectoryResult & {
     failedDirs: WalkDirectoryFailure[];
 };
 export declare function walkDirectorySync(rootDir: string, options?: WalkDirectoryOptions): WalkDirectoryResultWithFailures;
-export declare function walkDirectory(rootDir: string, options?: WalkDirectoryOptions): Promise<WalkDirectoryResultWithFailures>;
+export declare function walkDirectory(rootDir: string, options?: AsyncWalkDirectoryOptions): Promise<WalkDirectoryResultWithFailures>;
 export {};
-//# sourceMappingURL=walk.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/walk.js

@@ -1,6 +1,8 @@
 import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { realpathSync } from "./realpath.js";
+import { pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 function validateWalkBudget(name, value) {
     if (value !== undefined && (!Number.isSafeInteger(value) || value < 0)) {
         throw new RangeError(`${name} must be a non-negative safe integer`);
@@ -14,6 +16,10 @@ function validateWalkOptions(options) {
         throw new TypeError(`invalid walk symlink policy: ${String(options.symlinks)}`);
     }
 }
+function isObjectResult(result) {
+    return result !== null &&
+        (typeof result === "object" || typeof result === "function");
+}
 function kindForDirent(dirent) {
     if (dirent.isDirectory())
         return "directory";
@@ -27,12 +33,11 @@ function shouldStop(result, options) {
     return options.maxEntries !== undefined && result.scannedEntryCount >= Math.max(0, options.maxEntries);
 }
 function buildEntry(params) {
-    const fullPath = path.join(params.dir, params.dirent.name);
-    const relativePath = path.relative(params.rootDir, fullPath) || params.dirent.name;
+    const fullPath = params.fullPath;
     return {
         name: params.dirent.name,
         path: fullPath,
-        relativePath,
+        relativePath: params.relativePath,
         depth: params.depth,
         kind: params.kind ?? kindForDirent(params.dirent),
         dirent: params.dirent,
@@ -47,7 +52,7 @@ function recordFailedDir(result, root, dir, depth, error) {
         error,
     });
 }
-function resolveSyncKind(fullPath, dirent, symlinks) {
+function resolveKind(fullPath, dirent, symlinks) {
     const kind = kindForDirent(dirent);
     if (kind !== "symlink")
         return kind;
@@ -67,29 +72,9 @@ function resolveSyncKind(fullPath, dirent, symlinks) {
     }
     return "other";
 }
-async function resolveAsyncKind(fullPath, dirent, symlinks) {
-    const kind = kindForDirent(dirent);
-    if (kind !== "symlink")
-        return kind;
-    if (symlinks === "skip")
-        return null;
-    if (symlinks === "include")
-        return "symlink";
-    try {
-        const stat = await fs.stat(fullPath);
-        if (stat.isDirectory())
-            return "directory";
-        if (stat.isFile())
-            return "file";
-    }
-    catch {
-        return null;
-    }
-    return "other";
-}
 export function walkDirectorySync(rootDir, options = {}) {
     validateWalkOptions(options);
-    const root = path.resolve(rootDir);
+    const root = resolvePathPreservingWindowsRoot(rootDir);
     const symlinks = options.symlinks ?? "skip";
     const result = {
         entries: [],
@@ -98,12 +83,15 @@ export function walkDirectorySync(rootDir, options = {}) {
         failedDirs: [],
     };
     const visitedDirs = new Set();
-    function visit(dir, depth) {
+    function visit(dir, relativeDir, depth) {
         if (options.maxDepth !== undefined && depth > options.maxDepth)
             return;
         let realDir;
+        const operationPath = pathForWindowsFilesystem(dir);
         try {
-            realDir = fsSync.realpathSync(dir);
+            if (depth > 1 && symlinks !== "follow" && fsSync.lstatSync(operationPath).isSymbolicLink())
+                return;
+            realDir = realpathSync(operationPath);
         }
         catch (error) {
             recordFailedDir(result, root, dir, depth, error);
@@ -114,41 +102,43 @@ export function walkDirectorySync(rootDir, options = {}) {
         visitedDirs.add(realDir);
         let entries;
         try {
-            entries = fsSync.readdirSync(dir, { withFileTypes: true });
+            entries = fsSync.readdirSync(operationPath, { withFileTypes: true });
         }
         catch (error) {
             recordFailedDir(result, root, dir, depth, error);
             return;
         }
+        const childPrefix = dir.endsWith(path.sep) ? dir : `${dir}${path.sep}`;
         for (const dirent of entries) {
             if (shouldStop(result, options)) {
                 result.truncated = true;
                 return;
             }
             result.scannedEntryCount += 1;
-            const fullPath = path.join(dir, dirent.name);
-            const kind = resolveSyncKind(fullPath, dirent, symlinks);
+            const fullPath = childPrefix + dirent.name;
+            const kind = resolveKind(fullPath, dirent, symlinks);
             if (!kind)
                 continue;
-            const entry = buildEntry({ rootDir: root, dir, dirent, depth, kind });
+            const relativePath = relativeDir ? `${relativeDir}${path.sep}${dirent.name}` : dirent.name;
+            const entry = buildEntry({ relativePath, fullPath, dirent, depth, kind });
             if (options.include?.(entry) ?? true) {
                 result.entries.push(entry);
             }
             if (kind === "directory" &&
                 (options.maxDepth === undefined || depth < options.maxDepth) &&
                 (options.descend?.(entry) ?? true)) {
-                visit(fullPath, depth + 1);
+                visit(fullPath, relativePath, depth + 1);
                 if (result.truncated)
                     return;
             }
         }
     }
-    visit(root, 1);
+    visit(root, "", 1);
     return result;
 }
 export async function walkDirectory(rootDir, options = {}) {
     validateWalkOptions(options);
-    const root = path.resolve(rootDir);
+    const root = resolvePathPreservingWindowsRoot(rootDir);
     const symlinks = options.symlinks ?? "skip";
     const result = {
         entries: [],
@@ -157,12 +147,15 @@ export async function walkDirectory(rootDir, options = {}) {
         failedDirs: [],
     };
     const visitedDirs = new Set();
-    async function visit(dir, depth) {
+    async function visit(dir, relativeDir, depth) {
         if (options.maxDepth !== undefined && depth > options.maxDepth)
             return;
         let realDir;
+        const operationPath = pathForWindowsFilesystem(dir);
         try {
-            realDir = await fs.realpath(dir);
+            if (depth > 1 && symlinks !== "follow" && fsSync.lstatSync(operationPath).isSymbolicLink())
+                return;
+            realDir = realpathSync.native(operationPath);
         }
         catch (error) {
             recordFailedDir(result, root, dir, depth, error);
@@ -173,35 +166,42 @@ export async function walkDirectory(rootDir, options = {}) {
         visitedDirs.add(realDir);
         let entries;
         try {
-            entries = await fs.readdir(dir, { withFileTypes: true });
+            entries = await fs.readdir(operationPath, { withFileTypes: true });
         }
         catch (error) {
             recordFailedDir(result, root, dir, depth, error);
             return;
         }
+        const childPrefix = dir.endsWith(path.sep) ? dir : `${dir}${path.sep}`;
         for (const dirent of entries) {
             if (shouldStop(result, options)) {
                 result.truncated = true;
                 return;
             }
             result.scannedEntryCount += 1;
-            const fullPath = path.join(dir, dirent.name);
-            const kind = await resolveAsyncKind(fullPath, dirent, symlinks);
+            const fullPath = childPrefix + dirent.name;
+            const kind = resolveKind(fullPath, dirent, symlinks);
             if (!kind)
                 continue;
-            const entry = buildEntry({ rootDir: root, dir, dirent, depth, kind });
-            if (options.include?.(entry) ?? true) {
+            const relativePath = relativeDir ? `${relativeDir}${path.sep}${dirent.name}` : dirent.name;
+            const entry = buildEntry({ relativePath, fullPath, dirent, depth, kind });
+            const include = options.include;
+            const included = include == null ? true : Reflect.apply(include, options, [entry]);
+            if ((isObjectResult(included) ? await included : included) ?? true) {
                 result.entries.push(entry);
             }
             if (kind === "directory" &&
-                (options.maxDepth === undefined || depth < options.maxDepth) &&
-                (options.descend?.(entry) ?? true)) {
-                await visit(fullPath, depth + 1);
-                if (result.truncated)
-                    return;
+                (options.maxDepth === undefined || depth < options.maxDepth)) {
+                const descend = options.descend;
+                const descended = descend == null ? true : Reflect.apply(descend, options, [entry]);
+                if ((isObjectResult(descended) ? await descended : descended) ?? true) {
+                    await visit(fullPath, relativePath, depth + 1);
+                    if (result.truncated)
+                        return;
+                }
             }
         }
     }
-    await visit(root, 1);
+    await visit(root, "", 1);
     return result;
 }

package/node_modules/@openclaw/fs-safe/dist/windows-command.d.ts

@@ -1,2 +1 @@
 export declare function resolveWindowsSystemCommand(command: string, env?: NodeJS.ProcessEnv): string;
-//# sourceMappingURL=windows-command.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/windows-owner.d.ts

@@ -6,27 +6,23 @@ export type WindowsOwnerExec = (command: string, args: string[]) => Promise<{
 export type WindowsOwnerSummary = {
     sid?: string;
     currentUserSid?: string;
-    principalSids?: Record<string, string>;
-    principalTranslationFailed?: boolean;
+    daclPresent?: boolean;
+    aces?: WindowsOwnerAce[];
+    aclError?: string;
     remote?: boolean;
     trusted?: boolean;
     error?: string;
     errorDetail?: PermissionCommandFailure;
     errorCause?: unknown;
 };
-export declare function resolveWindowsPrincipalSids(params: {
-    principals: string[];
-    known?: Record<string, string>;
-    env?: NodeJS.ProcessEnv;
-    exec: WindowsOwnerExec;
-}): Promise<Record<string, string>>;
-export declare function resolveWindowsCurrentUserSid(params: {
-    env?: NodeJS.ProcessEnv;
-    exec: WindowsOwnerExec;
-}): Promise<string | null>;
+export type WindowsOwnerAce = {
+    sid: string;
+    mask: number;
+    deny: boolean;
+    inheritOnly: boolean;
+};
 export declare function inspectWindowsOwner(params: {
     targetPath: string;
     env?: NodeJS.ProcessEnv;
     exec: WindowsOwnerExec;
 }): Promise<WindowsOwnerSummary>;
-//# sourceMappingURL=windows-owner.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/windows-owner.js

@@ -1,5 +1,6 @@
-import { formatPermissionErrorDetail, getPermissionCommandFailure, } from "./permission-exec.js";
+import { formatCaughtPermissionFailure, getPermissionCommandFailure, } from "./permission-exec.js";
 import { resolveWindowsSystemCommand } from "./windows-command.js";
+import { hasWindowsPathAlias } from "./windows-path-alias.js";
 const SID_RE = /^\*?s-\d+-\d+(-\d+)+$/i;
 const TRUSTED_OWNER_SIDS = new Set(["s-1-5-18", "s-1-5-32-544"]);
 function normalizeSid(value) {
@@ -13,6 +14,7 @@ function windowsOwnerQueryCommand(targetPath) {
     const encodedPath = Buffer.from(targetPath, "utf8").toString("base64");
     return [
         "$ErrorActionPreference='Stop'",
+        "$env:PSModulePath=[IO.Path]::Combine($PSHOME,'Modules')",
         `$p=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encodedPath}'))`,
         "$sections=[System.Security.AccessControl.AccessControlSections]::Access -bor [System.Security.AccessControl.AccessControlSections]::Owner",
         "$acl=if([IO.Directory]::Exists($p)){[IO.Directory]::GetAccessControl($p,$sections)}else{[IO.File]::GetAccessControl($p,$sections)}",
@@ -23,67 +25,34 @@ function windowsOwnerQueryCommand(targetPath) {
         "$driveRoot=if($extendedDrive){$p.Substring(4,3)}else{$root}",
         "$namespacePath=$p.StartsWith('\\\\')",
         "$remote=($namespacePath -and -not $extendedDrive) -or ([IO.DriveInfo]::new($driveRoot).DriveType -eq [IO.DriveType]::Network)",
-        "$rules=$acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier])",
-        "$principalSids=@($rules|ForEach-Object {$identity=$_.IdentityReference;$sid=$identity.Value;@{name=$sid;sid=$sid};try{@{name=$identity.Translate([System.Security.Principal.NTAccount]).Value;sid=$sid}}catch{}})",
-        "@{ownerSid=$ownerSid;currentUserSid=$currentSid;principalSids=$principalSids;principalTranslationFailed=$false;remote=$remote}|ConvertTo-Json -Depth 4 -Compress",
+        // Emit only ASCII SID and numeric facts: console encodings can replace both
+        // Unicode pathnames and account names before JavaScript receives the bytes.
+        "$raw=[System.Security.AccessControl.RawSecurityDescriptor]::new($acl.GetSecurityDescriptorBinaryForm(),0)",
+        "$dacl=$raw.DiscretionaryAcl;$complete=$true",
+        "$aces=@(foreach($ace in $dacl){if($ace -isnot [System.Security.AccessControl.CommonAce] -or $ace.IsCallback -or [int]$ace.AceType -notin @(0,1)){$complete=$false;continue};@{sid=$ace.SecurityIdentifier.Value;mask=([long]$ace.AccessMask -band 4294967295);deny=([int]$ace.AceType -eq 1);inheritOnly=([int]$ace.AceFlags -band 8) -ne 0}})",
+        "@{ownerSid=$ownerSid;currentUserSid=$currentSid;daclPresent=($null -ne $dacl);aces=$aces;complete=$complete;remote=$remote}|Microsoft.PowerShell.Utility\\ConvertTo-Json -Depth 4 -Compress",
     ].join(";");
 }
-function windowsPrincipalQueryCommand(principals) {
-    const encodedPrincipals = Buffer.from(JSON.stringify(principals), "utf8").toString("base64");
-    return [
-        "$ErrorActionPreference='Stop'",
-        `$names=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encodedPrincipals}'))|ConvertFrom-Json`,
-        "$rows=@($names|ForEach-Object {@{name=$_;sid=(New-Object System.Security.Principal.NTAccount($_)).Translate([System.Security.Principal.SecurityIdentifier]).Value}})",
-        "ConvertTo-Json -InputObject $rows -Compress",
-    ].join(";");
-}
-function parsePrincipalSidRows(value) {
-    const rows = Array.isArray(value) ? value : value ? [value] : [];
-    const result = {};
-    for (const row of rows) {
-        if (!row || typeof row !== "object") {
-            continue;
-        }
-        const name = "name" in row && typeof row.name === "string" ? row.name.trim() : "";
-        const sid = "sid" in row && typeof row.sid === "string" ? normalizeSid(row.sid) : "";
-        if (name && SID_RE.test(sid)) {
-            result[name.toLowerCase()] = sid;
-        }
-    }
-    return result;
-}
-export async function resolveWindowsPrincipalSids(params) {
-    const principals = [...new Set(params.principals.map((value) => value.trim()).filter(Boolean))];
-    const known = Object.fromEntries(Object.entries(params.known ?? {}).map(([name, sid]) => [name.toLowerCase(), normalizeSid(sid)]));
-    const unresolved = principals.filter((principal) => !known[principal.toLowerCase()]);
-    if (unresolved.length === 0) {
-        return known;
-    }
-    const command = resolveWindowsSystemCommand(String.raw `WindowsPowerShell\v1.0\powershell.exe`, params.env);
-    const { stdout } = await params.exec(command, [
-        "-NoLogo",
-        "-NoProfile",
-        "-NonInteractive",
-        "-EncodedCommand",
-        encodePowerShellCommand(windowsPrincipalQueryCommand(unresolved)),
-    ]);
-    const resolved = { ...known, ...parsePrincipalSidRows(JSON.parse(stdout.trim())) };
-    if (principals.some((principal) => !resolved[principal.toLowerCase()])) {
-        throw new Error("Windows ACL principal translation returned incomplete SID data");
+function parseWindowsAclFacts(parsed) {
+    if (parsed.complete !== true || typeof parsed.daclPresent !== "boolean" || !Array.isArray(parsed.aces)) {
+        return { aclError: "Windows ACL query returned incomplete descriptor data" };
     }
-    return resolved;
-}
-export async function resolveWindowsCurrentUserSid(params) {
-    try {
-        const { stdout, stderr } = await params.exec(resolveWindowsSystemCommand("whoami.exe", params.env), ["/user", "/fo", "csv", "/nh"]);
-        const match = `${stdout}\n${stderr}`.match(/\*?S-\d+-\d+(?:-\d+)+/i);
-        return match ? normalizeSid(match[0]) : null;
-    }
-    catch {
-        return null;
+    const aces = [];
+    for (const row of parsed.aces) {
+        if (!row || typeof row !== "object" || typeof row.sid !== "string" || !SID_RE.test(row.sid) ||
+            typeof row.mask !== "number" || !Number.isInteger(row.mask) || row.mask < 0 || row.mask > 0xffff_ffff ||
+            typeof row.deny !== "boolean" || typeof row.inheritOnly !== "boolean") {
+            return { aclError: "Windows ACL query returned invalid access-rule data" };
+        }
+        aces.push({ sid: normalizeSid(row.sid), mask: row.mask, deny: row.deny, inheritOnly: row.inheritOnly });
     }
+    return { daclPresent: parsed.daclPresent, aces };
 }
 export async function inspectWindowsOwner(params) {
+    if (hasWindowsPathAlias(params.targetPath, "filesystem", "win32")) {
+        const error = new Error("Path uses a Windows filesystem namespace alias");
+        return { error: String(error), errorCause: error };
+    }
     let command = "";
     let startedAt = performance.now();
     try {
@@ -96,7 +65,11 @@ export async function inspectWindowsOwner(params) {
             "-EncodedCommand",
             encodePowerShellCommand(windowsOwnerQueryCommand(params.targetPath)),
         ]);
-        const parsed = JSON.parse(stdout.trim());
+        const value = JSON.parse(stdout.trim());
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+            return { error: "Windows owner query returned invalid SID data" };
+        }
+        const parsed = value;
         const ownerSid = typeof parsed.ownerSid === "string" && SID_RE.test(parsed.ownerSid)
             ? normalizeSid(parsed.ownerSid)
             : undefined;
@@ -106,19 +79,21 @@ export async function inspectWindowsOwner(params) {
         if (!ownerSid || !currentUserSid) {
             return { error: "Windows owner query returned invalid SID data" };
         }
-        const remote = parsed.remote === true;
+        const remote = parsed.remote;
+        if (typeof remote !== "boolean") {
+            return { error: "Windows owner query returned invalid locality data" };
+        }
         return {
             sid: ownerSid,
             currentUserSid,
-            principalSids: parsePrincipalSidRows(parsed.principalSids),
-            principalTranslationFailed: parsed.principalTranslationFailed === true,
+            ...parseWindowsAclFacts(parsed),
             remote,
             trusted: !remote && (ownerSid === currentUserSid || TRUSTED_OWNER_SIDS.has(ownerSid)),
         };
     }
     catch (err) {
         return {
-            error: formatPermissionErrorDetail(String(err)),
+            error: formatCaughtPermissionFailure(err),
             errorDetail: getPermissionCommandFailure(err, command, performance.now() - startedAt),
             errorCause: err,
         };

package/node_modules/@openclaw/fs-safe/dist/windows-path-alias.d.ts

@@ -0,0 +1,39 @@
+import { FsSafeError } from "./errors.js";
+export type WindowsPathAliasKind = "filesystem" | "relative";
+/**
+ * Capture an ordinary Windows drive-relative path without normalizing its raw
+ * suffix. This is only for public APIs whose existing contract accepts such
+ * paths; callers must still run namespace-alias admission on the result.
+ */
+export declare function anchorWindowsDriveRelativePath(value: string): string;
+/**
+ * Resolve a path without letting Node erase the separator from an exact
+ * extended-length drive root such as `\\?\C:\`. Bare `\\?\C:` input remains
+ * unchanged so the surrounding alias admission rejects it.
+ */
+export declare function resolvePathPreservingWindowsRoot(value: string): string;
+/**
+ * Preserve a namespaced drive root after a caller has already resolved the
+ * input. This lets admission fast paths keep exactly one live path.resolve
+ * call while retaining the same root-repair behavior as the general helper.
+ */
+export declare function repairResolvedWindowsRoot(value: string, resolved: string): string;
+/**
+ * Resolve path segments against a base while preserving a namespaced drive
+ * root when Node normalizes a legitimate rooted input back to that root.
+ * Raw bare namespace drives stay bare so admission checks still reject them.
+ */
+export declare function resolvePathFromBasePreservingWindowsRoot(base: string, ...segments: string[]): string;
+/**
+ * Adapt an admitted namespaced drive root for Node's Windows filesystem layer.
+ * Node removes the root separator from these paths during filesystem dispatch,
+ * so use the equivalent ordinary drive root for the operation. This is not an
+ * admission check: callers must validate attacker-controlled input first.
+ */
+export declare function pathForWindowsFilesystem(value: string): string;
+/** Returns true when a Windows pathname can address an alternate filesystem namespace. */
+export declare function hasWindowsPathAlias(value: string, kind: WindowsPathAliasKind, platform?: NodeJS.Platform | string): boolean;
+export declare function assertNoWindowsPathAliasForPlatform(value: string, kind: WindowsPathAliasKind, message: string, platform: NodeJS.Platform | string | undefined): void;
+export declare function assertNoWindowsPathAlias(value: string, kind?: WindowsPathAliasKind, message?: string, platform?: NodeJS.Platform | string): void;
+export declare function isWindowsPathAliasError(error: unknown): error is FsSafeError;
+export declare function admitStandalonePublicationPath(value: string, message?: string): string;

package/node_modules/@openclaw/fs-safe/dist/windows-path-alias.js

@@ -0,0 +1,122 @@
+import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { hasWindowsDrivePrefix, rootedWindowsDriveColonIndex, windowsNamespaceMarker, } from "./windows-path-syntax.js";
+function isBareWindowsNamespaceDrive(value) {
+    return value.length === 6 && windowsNamespaceMarker(value) !== undefined &&
+        hasWindowsDrivePrefix(value, 4);
+}
+/**
+ * Capture an ordinary Windows drive-relative path without normalizing its raw
+ * suffix. This is only for public APIs whose existing contract accepts such
+ * paths; callers must still run namespace-alias admission on the result.
+ */
+export function anchorWindowsDriveRelativePath(value) {
+    if (process.platform !== "win32" || path.isAbsolute(value))
+        return value;
+    if (!hasWindowsDrivePrefix(value)) {
+        return value;
+    }
+    const drive = value.slice(0, 2);
+    const base = path.resolve(drive);
+    return `${base}${path.sep}${value.slice(2)}`;
+}
+/**
+ * Resolve a path without letting Node erase the separator from an exact
+ * extended-length drive root such as `\\?\C:\`. Bare `\\?\C:` input remains
+ * unchanged so the surrounding alias admission rejects it.
+ */
+export function resolvePathPreservingWindowsRoot(value) {
+    if (value.length === 7 &&
+        process.platform === "win32" &&
+        rootedWindowsDriveColonIndex(value) === 5) {
+        return value.includes("/") ? value.replaceAll("/", "\\") : value;
+    }
+    const resolved = path.resolve(value);
+    return repairResolvedWindowsRoot(value, resolved);
+}
+/**
+ * Preserve a namespaced drive root after a caller has already resolved the
+ * input. This lets admission fast paths keep exactly one live path.resolve
+ * call while retaining the same root-repair behavior as the general helper.
+ */
+export function repairResolvedWindowsRoot(value, resolved) {
+    if (resolved.length === 6 &&
+        process.platform === "win32" &&
+        isBareWindowsNamespaceDrive(resolved) &&
+        !hasWindowsPathAlias(value, "filesystem")) {
+        return `${resolved}\\`;
+    }
+    return resolved;
+}
+/**
+ * Resolve path segments against a base while preserving a namespaced drive
+ * root when Node normalizes a legitimate rooted input back to that root.
+ * Raw bare namespace drives stay bare so admission checks still reject them.
+ */
+export function resolvePathFromBasePreservingWindowsRoot(base, ...segments) {
+    const resolved = path.resolve(base, ...segments);
+    if (resolved.length !== 6 ||
+        process.platform !== "win32" ||
+        !isBareWindowsNamespaceDrive(resolved)) {
+        return resolved;
+    }
+    if (hasWindowsPathAlias(base, "filesystem") ||
+        segments.some((segment) => hasWindowsPathAlias(segment, "filesystem"))) {
+        return resolved;
+    }
+    return `${resolved}\\`;
+}
+/**
+ * Adapt an admitted namespaced drive root for Node's Windows filesystem layer.
+ * Node removes the root separator from these paths during filesystem dispatch,
+ * so use the equivalent ordinary drive root for the operation. This is not an
+ * admission check: callers must validate attacker-controlled input first.
+ */
+export function pathForWindowsFilesystem(value) {
+    if (process.platform !== "win32" ||
+        rootedWindowsDriveColonIndex(value) !== 5) {
+        return value;
+    }
+    if (value.length === 7) {
+        return `${value[4]}:\\`;
+    }
+    const resolved = path.resolve(value);
+    if (isBareWindowsNamespaceDrive(resolved) &&
+        !hasWindowsPathAlias(value, "filesystem")) {
+        return `${resolved[4]}:\\`;
+    }
+    return value;
+}
+/** Returns true when a Windows pathname can address an alternate filesystem namespace. */
+export function hasWindowsPathAlias(value, kind, platform = process.platform) {
+    if (platform !== "win32")
+        return false;
+    const firstColon = value.indexOf(":");
+    if (firstColon === -1)
+        return false;
+    if (kind === "relative")
+        return true;
+    return firstColon !== rootedWindowsDriveColonIndex(value) || value.indexOf(":", firstColon + 1) !== -1;
+}
+export function assertNoWindowsPathAliasForPlatform(value, kind, message, platform) {
+    if (hasWindowsPathAlias(value, kind, platform)) {
+        throw new FsSafeError("invalid-path", message, {
+            details: { reason: "windows-path-alias" },
+        });
+    }
+}
+export function assertNoWindowsPathAlias(value, kind = "filesystem", message = "path uses a Windows filesystem namespace alias", platform = process.platform) {
+    if (hasWindowsPathAlias(value, kind, platform)) {
+        throw new FsSafeError("invalid-path", message, {
+            details: { reason: "windows-path-alias" },
+        });
+    }
+}
+export function isWindowsPathAliasError(error) {
+    return error instanceof FsSafeError && error.details?.reason === "windows-path-alias";
+}
+export function admitStandalonePublicationPath(value, message) {
+    const admittedPath = anchorWindowsDriveRelativePath(value);
+    assertNoWindowsPathAlias(admittedPath, "filesystem", message);
+    return admittedPath;
+}

package/node_modules/@openclaw/fs-safe/dist/windows-path-syntax.d.ts

@@ -0,0 +1,5 @@
+export declare function isWindowsSeparator(value: string, offset: number): boolean;
+export declare function hasWindowsDrivePrefix(value: string, offset?: number): boolean;
+/** Classify a raw prefix without normalizing any path components. */
+export declare function windowsNamespaceMarker(value: string): "." | "?" | undefined;
+export declare function rootedWindowsDriveColonIndex(value: string): number;

package/node_modules/@openclaw/fs-safe/dist/windows-path-syntax.js

@@ -0,0 +1,21 @@
+export function isWindowsSeparator(value, offset) {
+    const code = value.charCodeAt(offset);
+    return code === 0x2f || code === 0x5c;
+}
+export function hasWindowsDrivePrefix(value, offset = 0) {
+    const letter = value.charCodeAt(offset) | 0x20;
+    return letter >= 0x61 && letter <= 0x7a && value.charCodeAt(offset + 1) === 0x3a;
+}
+/** Classify a raw prefix without normalizing any path components. */
+export function windowsNamespaceMarker(value) {
+    const marker = value[2];
+    return (marker === "." || marker === "?") &&
+        isWindowsSeparator(value, 0) && isWindowsSeparator(value, 1) &&
+        isWindowsSeparator(value, 3) ? marker : undefined;
+}
+export function rootedWindowsDriveColonIndex(value) {
+    const colon = hasWindowsDrivePrefix(value)
+        ? 1
+        : windowsNamespaceMarker(value) !== undefined && hasWindowsDrivePrefix(value, 4) ? 5 : -1;
+    return colon >= 0 && isWindowsSeparator(value, colon + 1) ? colon : -1;
+}