@openclaw/openshell-sandbox 2026.9.4 → 2026.9.6

package/node_modules/@openclaw/fs-safe/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe",
-  "version": "0.8.5",
+  "version": "0.18.1",
   "description": "Capability-style filesystem roots for Node.js apps that handle untrusted relative paths.",
   "keywords": [
     "filesystem",
@@ -25,9 +25,10 @@
   },
   "files": [
     "dist/archive-parser.wasm",
+    "dist/windows-security-bridge.cs",
+    "dist/windows-security-bridge.ps1",
     "dist/**/*.js",
     "dist/**/*.d.ts",
-    "dist/**/*.d.ts.map",
     "docs/**/*.md",
     "docs/assets/readme-banner.jpg",
     "README.md",
@@ -46,6 +47,14 @@
       "types": "./dist/root.d.ts",
       "default": "./dist/root.js"
     },
+    "./copy": {
+      "types": "./dist/copy.d.ts",
+      "default": "./dist/copy.js"
+    },
+    "./guest": {
+      "types": "./dist/guest.d.ts",
+      "default": "./dist/guest.js"
+    },
     "./config": {
       "types": "./dist/config.d.ts",
       "default": "./dist/config.js"
@@ -126,17 +135,20 @@
   },
   "scripts": {
     "benchmark": "node scripts/benchmark.mjs",
+    "benchmark:methods": "node benchmarks/runner.mjs",
     "benchmark:publish": "pnpm build && node scripts/bench-publish.mjs",
     "build": "node scripts/prepack-build.mjs",
     "lint:file-size": "node scripts/check-file-size.mjs",
     "lint:fs-boundary": "node scripts/check-fs-boundary-primitives.mjs",
     "prepack": "node scripts/prepack-build.mjs",
     "test": "vitest run",
+    "test:bun": "bun node_modules/vitest/vitest.mjs run --config scripts/bun-vitest.config.ts",
+    "test:bun:native": "bun scripts/bun-native-proof.mjs && bun node_modules/vitest/vitest.mjs run --config scripts/bun-native-vitest.config.ts",
     "test:coverage": "vitest run --coverage",
-    "test:coverage:collect": "pnpm build && vitest run --coverage --coverage.reporter=json --coverage.thresholds.lines=0 --coverage.thresholds.functions=0 --coverage.thresholds.statements=0 --coverage.thresholds.branches=0",
+    "test:coverage:collect": "pnpm build && pnpm archive:wasm:allocator-tests && vitest run --coverage --coverage.reporter=json --coverage.thresholds.lines=0 --coverage.thresholds.functions=0 --coverage.thresholds.statements=0 --coverage.thresholds.branches=0",
     "test:coverage:merge": "node scripts/merge-coverage.mjs",
     "test:security": "vitest run test/fs-safe.test.ts test/read-boundary-bypass.test.ts test/write-boundary-bypass.test.ts test/additional-boundary-bypass.test.ts test/adversarial-boundary-payloads.test.ts",
-    "check": "pnpm lint:file-size && pnpm lint:fs-boundary && pnpm build && pnpm docs:check && pnpm test && node scripts/check-pack.mjs",
+    "check": "pnpm lint:file-size && pnpm lint:fs-boundary && pnpm build && pnpm archive:wasm:allocator-tests && pnpm docs:check && pnpm test && node scripts/check-pack.mjs",
     "docs:check": "node scripts/check-doc-examples.mjs",
     "docs:site": "node scripts/build-docs-site.mjs",
     "native:build": "pnpm --filter @openclaw/fs-safe-native-build build",
@@ -153,35 +165,36 @@
     "crabbox:stop": "crabbox stop",
     "crabbox:warmup": "crabbox warmup",
     "archive:wasm": "node scripts/build-archive-wasm.mjs",
+    "archive:wasm:allocator-tests": "node scripts/build-archive-wasm.mjs --allocator-tests",
     "archive:producer-smoke": "node scripts/archive-producer-smoke.mjs"
   },
   "optionalDependencies": {
-    "@openclaw/fs-safe-darwin-arm64": "0.8.5",
-    "@openclaw/fs-safe-darwin-x64": "0.8.5",
-    "@openclaw/fs-safe-linux-arm64-gnu": "0.8.5",
-    "@openclaw/fs-safe-linux-arm64-musl": "0.8.5",
-    "@openclaw/fs-safe-linux-x64-gnu": "0.8.5",
-    "@openclaw/fs-safe-linux-x64-musl": "0.8.5",
-    "@openclaw/fs-safe-win32-x64-msvc": "0.8.5",
-    "jszip": "^3.10.1"
+    "@openclaw/fs-safe-darwin-arm64": "0.18.1",
+    "@openclaw/fs-safe-darwin-x64": "0.18.1",
+    "@openclaw/fs-safe-linux-arm64-gnu": "0.18.1",
+    "@openclaw/fs-safe-linux-arm64-musl": "0.18.1",
+    "@openclaw/fs-safe-linux-x64-gnu": "0.18.1",
+    "@openclaw/fs-safe-linux-x64-musl": "0.18.1",
+    "@openclaw/fs-safe-win32-x64-msvc": "0.18.1",
+    "jszip": "^3.10.2"
   },
   "devDependencies": {
-    "@emnapi/runtime": "2.0.0-alpha.4",
-    "@napi-rs/cli": "3.9.0",
-    "@types/node": "^26.4.1",
-    "@vitest/coverage-v8": "5.0.0",
-    "fast-check": "^4.9.0",
+    "@emnapi/runtime": "2.0.0-alpha.5",
+    "@napi-rs/cli": "3.10.3",
+    "@types/node": "^26.6.1",
+    "@vitest/coverage-v8": "5.0.1",
+    "fast-check": "^4.10.1",
     "istanbul-lib-coverage": "3.2.2",
     "istanbul-lib-report": "3.0.1",
     "istanbul-reports": "3.2.0",
     "sigstore": "5.0.0",
     "tar": "7.5.22",
     "typescript": "^7.0.2",
-    "vite": "8.2.2",
-    "vitest": "^5.0.0"
+    "vite": "8.3.0",
+    "vitest": "^5.0.1"
   },
   "engines": {
     "node": ">=22"
   },
-  "packageManager": "pnpm@11.25.0"
+  "packageManager": "pnpm@12.4.2"
 }

package/node_modules/@openclaw/fs-safe-darwin-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-darwin-arm64",
-  "version": "0.8.5",
+  "version": "0.18.1",
   "description": "macOS arm64 native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-darwin-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-darwin-x64",
-  "version": "0.8.5",
+  "version": "0.18.1",
   "description": "macOS x64 native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-arm64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-arm64-gnu",
-  "version": "0.8.5",
+  "version": "0.18.1",
   "description": "Linux arm64 glibc native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-arm64-musl/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-arm64-musl",
-  "version": "0.8.5",
+  "version": "0.18.1",
   "description": "Linux arm64 musl native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-x64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-x64-gnu",
-  "version": "0.8.5",
+  "version": "0.18.1",
   "description": "Linux x64 glibc native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-x64-musl/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-x64-musl",
-  "version": "0.8.5",
+  "version": "0.18.1",
   "description": "Linux x64 musl native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-win32-x64-msvc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-win32-x64-msvc",
-  "version": "0.8.5",
+  "version": "0.18.1",
   "description": "Windows x64 MSVC native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/jszip/.github/FUNDING.yml

@@ -0,0 +1 @@
+github: Stuk

package/node_modules/jszip/.github/actions/setup/action.yml

@@ -0,0 +1,23 @@
+name: Set up workspace
+description: Sets up the workspace by installing Node.js and dependencies.
+
+inputs:
+  node-version:
+    description: The Node.js version to install.
+    required: false
+    default: "lts/*"
+
+runs:
+  using: composite
+  steps:
+    - name: Install Node.js
+      uses: actions/setup-node@v4
+      with:
+          node-version: ${{ inputs.node-version }}
+          cache: npm
+
+    - name: Install dependencies
+      # Because the lockfile is not compatible between all supported Node.js versions we need to run `npm install`.
+      # When support for older versions of Node.js is dropped, this can be changed to `npm ci`.
+      run: npm install
+      shell: bash

package/node_modules/jszip/.github/workflows/benchmark.yml

@@ -0,0 +1,38 @@
+name: Benchmark
+on:
+  push:
+    branches: [main]
+jobs:
+  benchmark:
+    name: Run benchmark
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up workspace
+        uses: ./.github/actions/setup
+
+      - name: Install browsers
+        run: npx playwright install --with-deps
+
+      - name: Run benchmark
+        run: npm run benchmark | tee benchmark.txt
+
+      - name: Download previous benchmark data
+        uses: actions/cache@v4
+        with:
+          path: ./cache
+          key: ${{ runner.os }}-benchmark
+
+      - name: Store benchmark result
+        uses: benchmark-action/github-action-benchmark@v1
+        with:
+          tool: benchmarkjs
+          output-file-path: benchmark.txt
+          external-data-json-path: ./cache/benchmark-data.json
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          alert-threshold: 150%
+          comment-on-alert: true
+          fail-on-alert: true
+          alert-comment-cc-users: "@Stuk"

package/node_modules/jszip/.github/workflows/main.yml

@@ -0,0 +1,55 @@
+name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up workspace
+        uses: ./.github/actions/setup
+
+      - name: Run linter
+        run: npm run lint
+
+  test-node:
+    name: Test on Node.js ${{ matrix.node-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up workspace
+        uses: ./.github/actions/setup
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Run tests
+        run: npm run test-node
+
+  test-browser:
+    name: Test in browser
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up workspace
+        uses: ./.github/actions/setup
+
+      - name: Install browsers
+        run: npx playwright install --with-deps
+
+      - name: Run tests
+        run: npm run test-browser
+

package/node_modules/jszip/CHANGES.md

@@ -4,6 +4,12 @@ layout: default
 section: main
 ---
 
+### v3.10.2 2026-09-09
+
+- Fix cross-realm binary type detection in `getTypeOf`. Fixes [#759](https://github.com/Stuk/jszip/issues/759) (see [#578](https://github.com/Stuk/jszip/pull/578))
+- Add missing types for `JSZip.defaults`. Fixes [#690](https://github.com/Stuk/jszip/issues/690) (see [#927](https://github.com/Stuk/jszip/pull/927))
+- Fix Blob support in Node.js 18 and up. Fixes [#941](https://github.com/Stuk/jszip/issues/941) (see [#955](https://github.com/Stuk/jszip/pull/955))
+
 ### v3.10.1 2022-08-02
 
 - Add sponsorship files.

package/node_modules/jszip/dist/jszip.js

@@ -1,6 +1,6 @@
 /*!
 
-JSZip v3.10.1 - A JavaScript class for generating and reading zip files
+JSZip v3.10.2 - A JavaScript class for generating and reading zip files
 <http://stuartk.com/jszip>
 
 (c) 2009-2016 Stuart Knightley <stuart [at] stuartk.com>
@@ -1057,7 +1057,7 @@ JSZip.defaults = require("./defaults");
 
 // TODO find a better way to handle this version,
 // a require('package.json').version doesn't work with webpack, see #327
-JSZip.version = "3.10.1";
+JSZip.version = "3.10.2";
 
 JSZip.loadAsync = function (content, options) {
     return new JSZip().loadAsync(content, options);
@@ -3390,16 +3390,17 @@ exports.getTypeOf = function(input) {
     if (typeof input === "string") {
         return "string";
     }
-    if (Object.prototype.toString.call(input) === "[object Array]") {
+    var proto = Object.prototype.toString.call(input);
+    if (proto === "[object Array]") {
         return "array";
     }
     if (support.nodebuffer && nodejsUtils.isBuffer(input)) {
         return "nodebuffer";
     }
-    if (support.uint8array && input instanceof Uint8Array) {
+    if (support.uint8array && proto === "[object Uint8Array]") {
         return "uint8array";
     }
-    if (support.arraybuffer && input instanceof ArrayBuffer) {
+    if (support.arraybuffer && proto === "[object ArrayBuffer]") {
         return "arraybuffer";
     }
 };
@@ -3492,21 +3493,29 @@ exports.prepareContent = function(name, inputData, isBinary, isOptimizedBinarySt
 
         var isBlob = support.blob && (data instanceof Blob || ["[object File]", "[object Blob]"].indexOf(Object.prototype.toString.call(data)) !== -1);
 
-        if (isBlob && typeof FileReader !== "undefined") {
-            return new external.Promise(function (resolve, reject) {
-                var reader = new FileReader();
-
-                reader.onload = function(e) {
-                    resolve(e.target.result);
-                };
-                reader.onerror = function(e) {
-                    reject(e.target.error);
-                };
-                reader.readAsArrayBuffer(data);
-            });
-        } else {
-            return data;
+        if (isBlob) {
+            if (typeof Blob.prototype.arrayBuffer !== "undefined") {
+                return data.arrayBuffer();
+            } else if (typeof FileReader !== "undefined") {
+                return new external.Promise(function (resolve, reject) {
+                    var reader = new FileReader();
+
+                    reader.onload = function(e) {
+                        resolve(e.target.result);
+                    };
+                    reader.onerror = function(e) {
+                        reject(e.target.error);
+                    };
+                    reader.readAsArrayBuffer(data);
+                });
+            } else {
+                return external.Promise.reject(
+                    new Error(name + " is a Blob, but we have no way of reading it.")
+                );
+            }
         }
+
+        return data;
     });
 
     return promise.then(function(data) {