@openclaw/openshell-sandbox 2026.9.5 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/pinned-mutation-admission.js

@@ -7,7 +7,7 @@ import { ordinarySharedAbsoluteInsideRoot, simpleSharedRoute, } from "./pinned-m
 import { resolvePathViaExistingAncestor } from "./root-path-existing.js";
 import { outsideWorkspaceError } from "./root-errors.js";
 import { getFsSafeNativeConfig } from "./native-config.js";
-import { advanceMutationObservation, mutationObservationCurrent, observeMutationPath, mutationDirectoryObservationCurrent, mutationObservationUsesDirectory, missingMutationSegments, nextMissingMutationPath, } from "./pinned-mutation-observation.js";
+import { advanceMutationObservation, mutationObservationCurrent, observeMutationPath, mutationObservationsCurrent, mutationObservationUsesDirectory, missingMutationSegments, nextMissingMutationPath, } from "./pinned-mutation-observation.js";
 export function snapshotPinnedMutationPolicy(denyMutations, mutationSymlinks) {
     if (denyMutations === undefined && mutationSymlinks === undefined)
         return undefined;
@@ -92,10 +92,12 @@ function captureEpoch(rootReal, target, policy, session) {
         return undefined;
     }
 }
-function epochCurrent(epoch) {
+function epochCurrent(epoch, directories) {
     return !process.versions.bun && epoch.mode === epoch.session.nativeMode &&
         getFsSafeNativeConfig().mode === epoch.mode &&
-        epoch.observations.every(mutationObservationCurrent);
+        (directories ? mutationObservationsCurrent(epoch.observations, directories) :
+            epoch.observations.every(mutationObservationCurrent)) &&
+        getFsSafeNativeConfig().mode === epoch.mode;
 }
 function assertCachedNotDenied(target, epoch) {
     if (epoch.paths.some((paths) => paths.some((denied) => isPathInside(denied, target) && isPathInside(target, denied))) ||
@@ -143,10 +145,8 @@ function advanceAuthorizedDirectory(admittedEpoch, admitted, receipt) {
         target,
         observations: Object.freeze(complete),
     });
-    if (!mutationDirectoryObservationCurrent(receipt.parent) ||
-        !mutationDirectoryObservationCurrent(receipt.child) ||
-        !mutationObservationUsesDirectory(target, receipt.child) ||
-        !epochCurrent(next))
+    if (!mutationObservationUsesDirectory(target, receipt.child) ||
+        !epochCurrent(next, [receipt.parent, receipt.child]))
         return undefined;
     assertCachedNotDenied(target.path, next);
     assertCachedNotDenied(receipt.child.path, next);
@@ -165,6 +165,10 @@ export async function preparePinnedWriteMutationAdmission(params) {
         selectedTarget: params.resolvedTargetPath,
         policy,
     });
+    const nativeRoute = sharedRoute ?? (process.platform === "win32" && params.originalPath?.includes("/")
+        ? simpleSharedRoute({ rootReal: params.rootReal, rootIdentity: params.rootIdentity,
+            originalPath: params.originalPath.replaceAll("/", "\\"), selectedTarget: params.resolvedTargetPath, policy })
+        : undefined);
     let pinnedSession;
     let epoch;
     let pending;
@@ -194,13 +198,13 @@ export async function preparePinnedWriteMutationAdmission(params) {
         }
         return current;
     };
-    const beginSharedParentWalk = sharedRoute ? () => {
+    const createSharedParentWalk = (admittedRoute) => {
         const session = Object.freeze({
             kind: "shared",
-            route: sharedRoute.route,
+            route: admittedRoute.route,
             selectedTarget: params.resolvedTargetPath,
             nativeMode: getFsSafeNativeConfig().mode,
-            rootIdentity: sharedRoute.rootIdentity,
+            rootIdentity: admittedRoute.rootIdentity,
             authorizationToken: Object.freeze({}),
         });
         let disposed = false;
@@ -232,20 +236,14 @@ export async function preparePinnedWriteMutationAdmission(params) {
                 if (!reusable || reusable.session !== session ||
                     !reusableSharedCreateRequest(request, reusable) ||
                     !mutationObservationUsesDirectory(reusable.target, parent) ||
-                    !epochCurrent(reusable)) {
+                    !nonzeroDirectoryObservation(parent) || !epochCurrent(reusable, [parent])) {
                     disable();
                     return undefined;
                 }
                 assertCachedNotDenied(request.targetPath, reusable);
                 assertCachedNotDenied(request.mutationPath, reusable);
-                // This is the required end fence. A returned receipt remains usable
-                // only synchronously, while the exact parent identity and spelling
-                // still match the observation captured by this walk.
-                if (!nonzeroDirectoryObservation(parent) ||
-                    !mutationDirectoryObservationCurrent(parent)) {
-                    disable();
-                    return undefined;
-                }
+                // The epoch check ends with the exact parent fence. The receipt is
+                // consumed synchronously before any intervening authority callback.
                 sharedPending = Object.freeze({
                     epoch: reusable,
                     childPath: request.mutationPath,
@@ -320,7 +318,7 @@ export async function preparePinnedWriteMutationAdmission(params) {
                 disable();
             },
         });
-    } : undefined;
+    };
     const mutationAdmission = Object.freeze({
         rejectParentSymlinks: policy.mutationSymlinks === "reject",
         beginParentWalk: route ? () => {
@@ -335,26 +333,22 @@ export async function preparePinnedWriteMutationAdmission(params) {
             pending = undefined;
             return route;
         } : undefined,
-        beginSharedParentWalk,
+        beginSharedParentWalk: sharedRoute ? () => createSharedParentWalk(sharedRoute) : undefined,
+        beginNativeParentWalk: nativeRoute ? () => createSharedParentWalk(nativeRoute) : undefined,
         tryAuthorizeAtParent(request, parent) {
             pending = undefined;
             const reusable = epoch;
             if (!reusable || reusable.session !== pinnedSession ||
                 !reusableRequest(request, reusable) ||
                 !mutationObservationUsesDirectory(reusable.target, parent) ||
-                !epochCurrent(reusable)) {
+                !epochCurrent(reusable, [parent])) {
                 epoch = undefined;
                 return undefined;
             }
             assertCachedNotDenied(request.targetPath, reusable);
             assertCachedNotDenied(request.mutationPath, reusable);
-            // This is the required end fence. The caller can consume the returned
-            // token without awaiting only while the exact pathname, canonical
-            // spelling, descriptor identity, type, mode, and link count still match.
-            if (!mutationDirectoryObservationCurrent(parent)) {
-                epoch = undefined;
-                return undefined;
-            }
+            // The epoch check ends at the exact parent pathname, canonical spelling,
+            // identity, type, mode and link-count fence, with no intervening await.
             if (request.phase === "parent-create") {
                 pending = Object.freeze({
                     epoch: reusable,

package/node_modules/@openclaw/fs-safe/dist/pinned-mutation-observation.d.ts

@@ -6,6 +6,11 @@ export type MutationIdentity = Readonly<{
     nlink: bigint;
 }>;
 declare const checkedDirectoryObservation: unique symbol;
+export type MutationDirectoryCurrent = Readonly<{
+    canonicalPath: string;
+    identity: MutationIdentity;
+}>;
+export type MutationDirectoryObserver = () => MutationDirectoryCurrent | undefined;
 export type MutationDirectoryObservation = Readonly<{
     path: string;
     canonicalPath: string;
@@ -24,11 +29,10 @@ export type MutationPathObservation = Readonly<{
 }>;
 export declare function missingMutationSegments(observation: MutationPathObservation): number;
 export declare function nextMissingMutationPath(observation: MutationPathObservation): string | undefined;
-export declare function checkedMutationDirectory(pathname: string, canonicalPath: string, stat: BigIntStats): MutationDirectoryObservation;
-export declare function mutationDirectoryObservationCurrent(observation: MutationDirectoryObservation): boolean;
+export declare function checkedMutationDirectory(pathname: string, canonicalPath: string, stat: Pick<BigIntStats, "dev" | "ino" | "mode" | "nlink">, observeCurrent?: MutationDirectoryObserver): MutationDirectoryObservation;
 export declare function mutationObservationUsesDirectory(observation: MutationPathObservation, directory: MutationDirectoryObservation): boolean;
 export declare function observeMutationPath(pathname: string): MutationPathObservation | undefined;
 export declare function mutationObservationCurrent(observation: MutationPathObservation): boolean;
+export declare function mutationObservationsCurrent(observations: readonly MutationPathObservation[], directories: readonly MutationDirectoryObservation[]): boolean;
 export declare function advanceMutationObservation(observation: MutationPathObservation, parent: MutationDirectoryObservation, child: MutationDirectoryObservation): MutationPathObservation | undefined;
 export {};
-//# sourceMappingURL=pinned-mutation-observation.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/pinned-mutation-observation.js

@@ -4,6 +4,7 @@ import { isNotFoundPathError } from "./path.js";
 import { realpathSync } from "./realpath.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
 const checkedDirectoryObservation = Symbol("checked mutation directory observation");
+const directoryObservers = new WeakMap();
 function identity(stat) {
     return Object.freeze({ dev: stat.dev, ino: stat.ino, mode: stat.mode, nlink: stat.nlink });
 }
@@ -17,8 +18,7 @@ function directoryMode(mode) {
 }
 function absent(pathname) {
     try {
-        fs.lstatSync(pathname);
-        return false;
+        return fs.lstatSync(pathname, { throwIfNoEntry: false }) === undefined;
     }
     catch (error) {
         // ENOTDIR is incomplete evidence, not a missing child of a directory.
@@ -35,35 +35,25 @@ export function nextMissingMutationPath(observation) {
 // Callers may construct this only from their just-completed exact pathname and
 // canonical fences. The private brand prevents unverified structural objects
 // from advancing an admission epoch.
-export function checkedMutationDirectory(pathname, canonicalPath, stat) {
-    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+export function checkedMutationDirectory(pathname, canonicalPath, stat, observeCurrent) {
+    if (!directoryMode(stat.mode)) {
         throw new TypeError("mutation directory evidence must describe a real directory");
     }
-    return Object.freeze({
+    const observation = Object.freeze({
         path: pathname,
         canonicalPath,
         identity: identity(stat),
         [checkedDirectoryObservation]: true,
     });
+    if (observeCurrent)
+        directoryObservers.set(observation, observeCurrent);
+    return observation;
 }
 function checkedDirectory(observation) {
     return observation[checkedDirectoryObservation] === true &&
         path.isAbsolute(observation.path) && path.isAbsolute(observation.canonicalPath) &&
         directoryMode(observation.identity.mode);
 }
-export function mutationDirectoryObservationCurrent(observation) {
-    if (!checkedDirectory(observation))
-        return false;
-    try {
-        const stat = inspectFileIdentitySync(() => fs.lstatSync(observation.path, { bigint: true }));
-        return stat.isDirectory() && !stat.isSymbolicLink() &&
-            sameIdentity(observation.identity, stat) &&
-            realpathSync.native(observation.path) === observation.canonicalPath;
-    }
-    catch {
-        return false;
-    }
-}
 export function mutationObservationUsesDirectory(observation, directory) {
     return checkedDirectory(directory) &&
         observation.ancestor === directory.path &&
@@ -118,6 +108,79 @@ export function mutationObservationCurrent(observation) {
         return false;
     }
 }
+// Share only ordinary spelling observations collected in this synchronous
+// phase. Aliases retain their independent raw/canonical binding checks, and no
+// fact escapes this call or crosses an authority callback or mutation.
+export function mutationObservationsCurrent(observations, directories) {
+    const groups = new Map();
+    const groupFor = (pathname) => {
+        let group = groups.get(pathname);
+        if (!group) {
+            group = { observations: [], directories: [] };
+            groups.set(pathname, group);
+        }
+        return group;
+    };
+    try {
+        for (const observation of observations) {
+            if (observation.ancestor !== observation.canonicalAncestor) {
+                if (!mutationObservationCurrent(observation))
+                    return false;
+            }
+            else {
+                groupFor(observation.ancestor).observations.push(observation);
+            }
+        }
+        for (const directory of directories) {
+            if (!checkedDirectory(directory))
+                return false;
+            groupFor(directory.path).directories.push(directory);
+        }
+        const current = (pathname, group) => {
+            const missing = new Set(group.observations.flatMap((observation) => {
+                const next = nextMissingMutationPath(observation);
+                return next === undefined ? [] : [next];
+            }));
+            // Exact directory roles are the end fence. Observe missing children
+            // before refreshing that parent, matching the ordered admission fence.
+            if (group.directories.length && ![...missing].every(absent))
+                return false;
+            const observed = group.directories.length
+                ? directoryObservers.get(group.directories[0])?.() : undefined;
+            const stat = observed?.identity ??
+                inspectFileIdentitySync(() => fs.lstatSync(pathname, { bigint: true }));
+            const canonical = observed?.canonicalPath ?? realpathSync.native(pathname);
+            const isDirectory = directoryMode(stat.mode);
+            if (!group.observations.every((observation) => canonical === observation.canonicalAncestor &&
+                sameIdentity(observation.entry, stat, isDirectory) &&
+                sameIdentity(observation.identity, stat, isDirectory) &&
+                (missingMutationSegments(observation) === 0 || isDirectory)))
+                return false;
+            if (!group.directories.every((directory) => isDirectory &&
+                sameIdentity(directory.identity, stat) && canonical === directory.canonicalPath))
+                return false;
+            return group.directories.length > 0 || [...missing].every(absent);
+        };
+        for (const [pathname, group] of groups) {
+            if (!group.directories.length && !current(pathname, group))
+                return false;
+        }
+        // Preserve the supplied parent/child order, even when a directory also
+        // appeared earlier as the Root or a denied path's nearest ancestor.
+        const checked = new Set();
+        for (const directory of directories) {
+            if (checked.has(directory.path))
+                continue;
+            if (!current(directory.path, groups.get(directory.path)))
+                return false;
+            checked.add(directory.path);
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 // This is deliberately a pure tentative update. The immediately following
 // parent authorization validates the complete epoch once before reusing it.
 export function advanceMutationObservation(observation, parent, child) {

package/node_modules/@openclaw/fs-safe/dist/pinned-mutation-shared-route.d.ts

@@ -9,6 +9,7 @@ type SharedMutationPolicy = Readonly<{
     denyMutations?: DenyMutationPolicy;
     mutationSymlinks?: MutationSymlinkPolicy;
 }>;
+export declare function ordinaryWindowsSegments(relativePath: string): boolean;
 export declare function ordinarySharedAbsoluteInsideRoot(rootReal: string, candidatePath: string, rootIdentity: ExactRootIdentity): boolean;
 export declare function simpleSharedRoute(params: {
     rootReal: string;
@@ -21,4 +22,3 @@ export declare function simpleSharedRoute(params: {
     rootIdentity: ExactRootIdentity;
 } | undefined;
 export {};
-//# sourceMappingURL=pinned-mutation-shared-route.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/pinned-mutation-shared-route.js

@@ -7,7 +7,7 @@ function windowsReservedDeviceSegment(segment) {
     const stem = segment.slice(0, extension < 0 ? segment.length : extension).toUpperCase();
     return WINDOWS_RESERVED_DEVICE_NAMES.has(stem);
 }
-function ordinaryWindowsSegments(relativePath) {
+export function ordinaryWindowsSegments(relativePath) {
     if (relativePath === "" || relativePath.includes("/") || relativePath.includes("\0"))
         return false;
     const segments = relativePath.split("\\");

package/node_modules/@openclaw/fs-safe/dist/pinned-open.d.ts

@@ -5,6 +5,7 @@ export type PinnedOpenSyncResult = {
     path: string;
     fd: number;
     stat: fs.Stats;
+    identity: fs.BigIntStats;
 } | {
     ok: false;
     reason: PinnedOpenSyncFailureReason;
@@ -27,4 +28,3 @@ export declare function openPinnedFileSync(params: {
     ioFs?: PinnedOpenSyncFs;
     finalAdmission?: PinnedOpenSyncFinalAdmission;
 }): PinnedOpenSyncResult;
-//# sourceMappingURL=pinned-open.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/pinned-open.js

@@ -63,7 +63,7 @@ export function openPinnedFileSync(params) {
             preRealpathIdentity: pathIdentity,
             descriptorIdentity: identity,
         }) ?? realPath;
-        const opened = { ok: true, path: admittedPath, fd, stat: openedStat };
+        const opened = { ok: true, path: admittedPath, fd, stat: openedStat, identity };
         fd = null;
         return opened;
     }
@@ -77,7 +77,12 @@ export function openPinnedFileSync(params) {
     }
     finally {
         if (fd !== null) {
-            ioFs.closeSync(fd);
+            try {
+                ioFs.closeSync(fd);
+            }
+            catch {
+                // Preserve the failed admission result; success transfers fd above.
+            }
         }
     }
 }

package/node_modules/@openclaw/fs-safe/dist/pinned-operation.d.ts

@@ -1,2 +1 @@
-export declare function validatePinnedOperationPayload(payload: Record<string, unknown>): void;
-//# sourceMappingURL=pinned-operation.d.ts.map
+export declare function validatePinnedRelativePath(relativePath: unknown): void;

package/node_modules/@openclaw/fs-safe/dist/pinned-operation.js

@@ -1,19 +1,7 @@
 import { FsSafeError } from "./errors.js";
-export function validatePinnedOperationPayload(payload) {
-    if (typeof payload.relativePath === "string") {
-        validatePinnedRelativePath(payload.relativePath);
-    }
-    if (typeof payload.relativeParentPath === "string") {
-        validatePinnedRelativePath(payload.relativeParentPath);
-    }
-    if (typeof payload.from === "string") {
-        validatePinnedRelativePath(payload.from);
-    }
-    if (typeof payload.to === "string") {
-        validatePinnedRelativePath(payload.to);
-    }
-}
-function validatePinnedRelativePath(relativePath) {
+export function validatePinnedRelativePath(relativePath) {
+    if (typeof relativePath !== "string")
+        return;
     if (relativePath.length === 0 || relativePath === ".") {
         return;
     }
@@ -21,7 +9,6 @@ function validatePinnedRelativePath(relativePath) {
         throw new FsSafeError("invalid-path", "relative path contains a NUL byte");
     }
     if (relativePath.startsWith("/") ||
-        relativePath.startsWith("//") ||
         relativePath === ".." ||
         relativePath.startsWith("../") ||
         relativePath.startsWith("..\\")) {

package/node_modules/@openclaw/fs-safe/dist/pinned-write-input.d.ts

@@ -0,0 +1,3 @@
+import type { FileHandle } from "node:fs/promises";
+import type { PinnedWriteInput } from "./pinned-write-types.js";
+export declare function writePinnedInput(target: FileHandle | number, input: PinnedWriteInput, maxBytes?: number, assertBeforeMutation?: () => void): Promise<void>;

package/node_modules/@openclaw/fs-safe/dist/pinned-write-input.js

@@ -0,0 +1,35 @@
+import { types } from "node:util";
+import { snapshotByteView } from "./byte-view.js";
+import { writeCopyFileToFd } from "./copy-file-input.js";
+import { FsSafeError } from "./errors.js";
+import { writeAllToFile } from "./write-file-handle.js";
+const isUint8Array = types.isUint8Array;
+function streamChunkBytes(chunk) {
+    if (Buffer.isBuffer(chunk))
+        return chunk;
+    if (!isUint8Array(chunk))
+        return Buffer.from(chunk);
+    return snapshotByteView(chunk);
+}
+export async function writePinnedInput(target, input, maxBytes, assertBeforeMutation) {
+    if (input.kind === "file") {
+        await writeCopyFileToFd(typeof target === "number" ? target : target.fd, input, maxBytes, assertBeforeMutation);
+        return;
+    }
+    let bytes = 0;
+    const write = async (data) => {
+        bytes += data.byteLength;
+        if (maxBytes !== undefined && bytes > maxBytes) {
+            throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`);
+        }
+        await writeAllToFile(target, data, { assertBeforeMutation });
+    };
+    if (input.kind === "buffer") {
+        await write(typeof input.data === "string" ? Buffer.from(input.data, input.encoding ?? "utf8") : input.data);
+    }
+    else {
+        for await (const chunk of input.stream) {
+            await write(streamChunkBytes(chunk));
+        }
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/pinned-write-mode.d.ts

@@ -0,0 +1,4 @@
+import type { FileHandle } from "node:fs/promises";
+export declare function assertPinnedWriteMode(fd: number, mode: number, privateCreation?: boolean): void;
+export declare function preparePinnedWriteMode(handle: FileHandle, createdMode: number, assertBeforeMutation?: () => void, privateCreation?: boolean): Promise<(() => void) | undefined>;
+export declare function pinnedWriteModeAssertion(fd: number, mode: number, assertBeforeMutation?: () => void, privateCreation?: boolean): () => void;

package/node_modules/@openclaw/fs-safe/dist/pinned-write-mode.js

@@ -0,0 +1,31 @@
+import fs from "node:fs";
+import { FsSafeError } from "./errors.js";
+import { assertSynchronousCallbackResult } from "./mutation-authority.js";
+import { assertPrivateCreationFile } from "./creation-boundary.js";
+export function assertPinnedWriteMode(fd, mode, privateCreation = false) {
+    if (process.platform === "win32")
+        return;
+    const stat = fs.fstatSync(fd, { bigint: true });
+    if (privateCreation)
+        assertPrivateCreationFile(stat, fd);
+    if (Number(stat.mode & 4095n) !== mode) {
+        throw new FsSafeError("insecure-permissions", "filesystem did not enforce the requested file mode");
+    }
+}
+export async function preparePinnedWriteMode(handle, createdMode, assertBeforeMutation, privateCreation = false) {
+    if (process.platform === "win32")
+        return assertBeforeMutation;
+    assertSynchronousCallbackResult(assertBeforeMutation?.(), "assertBeforeMutation");
+    if (createdMode !== 0o600) {
+        if (privateCreation)
+            assertPrivateCreationFile(fs.fstatSync(handle.fd, { bigint: true }), handle.fd);
+        await handle.chmod(0o600);
+    }
+    return pinnedWriteModeAssertion(handle.fd, 0o600, assertBeforeMutation, privateCreation);
+}
+export function pinnedWriteModeAssertion(fd, mode, assertBeforeMutation, privateCreation = false) {
+    return () => {
+        assertSynchronousCallbackResult(assertBeforeMutation?.(), "assertBeforeMutation");
+        assertPinnedWriteMode(fd, mode, privateCreation);
+    };
+}

package/node_modules/@openclaw/fs-safe/dist/pinned-write-staged.d.ts

@@ -0,0 +1,5 @@
+import { type BigIntStats } from "node:fs";
+import type { AsyncDirectoryGuard } from "./directory-guard.js";
+import { type FileIdentityStat } from "./file-identity.js";
+import type { PinnedWriteParams } from "./pinned-write-types.js";
+export declare function runPinnedStagedWrite(params: PinnedWriteParams, parentPath: string, parentGuard: AsyncDirectoryGuard<BigIntStats>): Promise<FileIdentityStat>;