@openclaw/openshell-sandbox 2026.9.5 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/archive-plan.js

@@ -1,36 +1,45 @@
 import { ArchiveFormatError, ArchiveSecurityError } from "./archive-errors.js";
 import { createArchiveOutputPathTracker, resolveArchiveOutputPath, stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
 import { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError, assertArchiveEntryCountWithinLimit, assertArchiveEntryPathComponentsWithinLimit, createByteBudgetTracker, resolveExtractLimits, } from "./archive-limits.js";
-import { resolveArchiveEntryMode, shouldExtractArchiveEntry } from "./archive-policy.js";
 import { formatErrorDetail } from "./error-detail.js";
-// Inspection and both executors decide over the same admitted identities.
-// A destination is optional only for inspection; writers still prove containment.
-export function createArchiveEntryPlanner(params, archiveKind) {
+// Portable ZIP selects each entry immediately before streaming its payload;
+// manifest-backed routes add declared-byte admission through the planner below.
+export function createArchiveEntrySelector(params) {
     const strip = Math.max(0, Math.floor(params.stripComponents ?? 0));
     const limits = resolveExtractLimits(params.limits);
-    const budget = createByteBudgetTracker(limits);
     const trackOutputPath = createArchiveOutputPathTracker();
     let entryCount = 0;
+    return { limits, select(entry) {
+            assertArchiveEntryCountWithinLimit(++entryCount, limits);
+            validateArchiveEntryPath(entry.path, { escapeLabel: params.escapeLabel });
+            const canonicalPath = stripArchivePath(entry.path, 0);
+            if (!canonicalPath)
+                return null;
+            const relPath = strip === 0 ? canonicalPath : stripArchivePath(canonicalPath, strip);
+            if (!relPath)
+                return null;
+            validateArchiveEntryPath(relPath, { escapeLabel: params.escapeLabel });
+            assertArchiveEntryPathComponentsWithinLimit(relPath, limits);
+            trackOutputPath(relPath, entry.path);
+            if (params.rootDir !== undefined) {
+                resolveArchiveOutputPath({ rootDir: params.rootDir, relPath, originalPath: entry.path,
+                    escapeLabel: params.escapeLabel });
+            }
+            if (!shouldExtractArchiveEntry({ filter: params.entryFilter, onFiltered: params.onFiltered,
+                entry: { path: canonicalPath, kind: entry.kind, size: entry.size } }))
+                return null;
+            return relPath;
+        } };
+}
+// A destination is optional only for inspection; writers still prove containment.
+export function createArchiveEntryPlanner(params, archiveKind) {
+    const { select, limits } = createArchiveEntrySelector(params);
+    const budget = createByteBudgetTracker(limits);
     return (entry) => {
-        assertArchiveEntryCountWithinLimit(++entryCount, limits);
-        validateArchiveEntryPath(entry.path, { escapeLabel: params.escapeLabel });
-        const canonicalPath = stripArchivePath(entry.path, 0);
-        if (!canonicalPath)
-            return null;
-        const relPath = strip === 0 ? canonicalPath : stripArchivePath(canonicalPath, strip);
-        if (!relPath)
-            return null;
-        validateArchiveEntryPath(relPath, { escapeLabel: params.escapeLabel });
-        assertArchiveEntryPathComponentsWithinLimit(relPath, limits);
-        trackOutputPath(relPath, entry.path);
-        if (params.rootDir !== undefined) {
-            resolveArchiveOutputPath({ rootDir: params.rootDir, relPath, originalPath: entry.path,
-                escapeLabel: params.escapeLabel });
-        }
         const kind = entry.kind === "file" || entry.kind === "directory" ? entry.kind
             : entry.kind === "symlink" || entry.kind === "hardlink" ? "symlink" : "other";
-        if (!shouldExtractArchiveEntry({ filter: params.entryFilter, onFiltered: params.onFiltered,
-            entry: { path: canonicalPath, kind, size: entry.size } }))
+        const relPath = select({ path: entry.path, kind, size: entry.size });
+        if (relPath === null)
             return null;
         if (entry.kind === "sparse") {
             throw new ArchiveFormatError(`GNU sparse archive entry is not supported: ${formatErrorDetail(entry.path)}`);
@@ -53,3 +62,58 @@ export function createArchiveEntryPlanner(params, archiveKind) {
             mode: resolveArchiveEntryMode({ kind, archivedMode: entry.mode, policy: params.entryModes }) };
     };
 }
+export function archiveEntryKindFromTarType(type) {
+    if (type === "Directory" || type === "GNUDumpDir")
+        return "directory";
+    if (type === "File" || type === "OldFile" || type === "ContiguousFile")
+        return "file";
+    if (type === "SymbolicLink" || type === "Link")
+        return "symlink";
+    return "other";
+}
+export function resolveArchiveEntryMode(params) {
+    const archivedMode = (params.archivedMode ?? 0) & 0o777;
+    if (params.policy === "preserve") {
+        return params.archivedMode == null ? (params.kind === "directory" ? 0o755 : 0o644) : archivedMode;
+    }
+    if (params.kind === "directory") {
+        return 0o755;
+    }
+    return archivedMode & 0o100 ? 0o755 : 0o644;
+}
+export function resolveArchiveFilteredEntryPolicy(value) {
+    if (value === undefined || value === "reject-archive")
+        return "reject-archive";
+    if (value === "skip-entry")
+        return "skip-entry";
+    throw new RangeError('archive onFiltered must be "reject-archive" or "skip-entry"');
+}
+export function shouldExtractArchiveEntry(params) {
+    const onFiltered = resolveArchiveFilteredEntryPolicy(params.onFiltered);
+    if (!params.filter || params.filter(params.entry) === "extract") {
+        return true;
+    }
+    if (onFiltered === "reject-archive") {
+        throw new ArchiveSecurityError("entry-filtered", `archive entry rejected by filter: ${formatErrorDetail(params.entry.path)}`);
+    }
+    return false;
+}
+const BLOCKED_TAR_ENTRY_TYPES = new Set([
+    "BlockDevice",
+    "CharacterDevice",
+    "FIFO",
+    "Socket",
+]);
+export function createTarEntryPlanner(params) {
+    // Preserve inherited/getter-backed public options and per-entry policy reads.
+    const plan = createArchiveEntryPlanner(params, "tar");
+    return (entry) => {
+        const kind = BLOCKED_TAR_ENTRY_TYPES.has(entry.type) ? "blocked" : archiveEntryKindFromTarType(entry.type);
+        // The public checker accepts structural entry objects, including class getters.
+        return plan({ path: entry.path, kind, size: entry.size, mode: entry.mode });
+    };
+}
+export function createTarEntryPreflightChecker(params) {
+    const plan = createTarEntryPlanner(params);
+    return (entry) => plan(entry) !== null;
+}

package/node_modules/@openclaw/fs-safe/dist/archive-read.d.ts

@@ -3,4 +3,3 @@ export declare function readArchiveEntry(archivePath: string, entryPath: string,
     maxBytes: number;
     kind?: ArchiveKind;
 }): Promise<Buffer>;
-//# sourceMappingURL=archive-read.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-read.js

@@ -7,12 +7,13 @@ import { readBoundedAsync } from "./bounded-read.js";
 import { ArchiveFormatError, ArchiveSecurityError, isArchiveFormatErrorMessage, } from "./archive-errors.js";
 import { formatErrorDetail } from "./error-detail.js";
 import { stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
-import { assertPortableArchiveKind, resolveArchiveKind } from "./archive-kind.js";
+import { resolveArchiveKind } from "./archive-kind.js";
 import { DEFAULT_MAX_ARCHIVE_BYTES_ZIP, ArchiveLimitError, ARCHIVE_LIMIT_ERROR_CODE, } from "./archive-limits.js";
 import { isGzipBuffer } from "./archive-gzip-tail.js";
 import { inspectTar, replayTar } from "./archive-tar-stream.js";
 import { loadAdmittedZipArchive } from "./archive-zip-loader.js";
 import { createZipIntegrityTransform, normalizeZipIntegrityError, } from "./archive-zip-integrity.js";
+import { isZipSymlinkEntry, zipEntryKind } from "./archive-zip-entry.js";
 import { FsSafeError } from "./errors.js";
 import { inspectFileIdentity } from "./strict-file-identity.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
@@ -22,8 +23,6 @@ import { admitZipBuffer } from "./archive-zip-admission.js";
 import { validateNativeZipManifest } from "./archive-zip-manifest.js";
 import { resolveExtractLimits, resolveTarMeterLimits } from "./archive-limits.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
-const ZIP_UNIX_FILE_TYPE_MASK = 0o170000;
-const ZIP_UNIX_SYMLINK_TYPE = 0o120000;
 function canonicalEntryPath(entryPath) {
     validateArchiveEntryPath(entryPath, { escapeLabel: "archive root" });
     return stripArchivePath(entryPath, 0) ?? "";
@@ -109,10 +108,11 @@ async function readZipEntry(buffer, entryPath, maxBytes, admitted) {
     if (!entry || entry.dir) {
         throw new Error(`archive entry not found: ${formatErrorDetail(entryPath)}`);
     }
-    if (typeof entry.unixPermissions === "number" &&
-        (entry.unixPermissions & ZIP_UNIX_FILE_TYPE_MASK) === ZIP_UNIX_SYMLINK_TYPE) {
+    if (isZipSymlinkEntry(entry)) {
         throw new Error(`archive entry is a link: ${formatErrorDetail(entryPath)}`);
     }
+    if (zipEntryKind(entry) !== "file")
+        throw new Error(`archive entry is not a file: ${formatErrorDetail(entryPath)}`);
     const integrity = createZipIntegrityTransform(entry);
     const stream = typeof entry.nodeStream === "function"
         ? entry.nodeStream()
@@ -139,11 +139,11 @@ async function readZipEntry(buffer, entryPath, maxBytes, admitted) {
         throw normalizeZipIntegrityError(error);
     }
 }
-async function readTarEntry(archiveBuffer, entryPath, maxBytes) {
+async function readTarEntry(archiveBuffer, entryPath, maxBytes, kind) {
     const seenPaths = new Set();
     let selected;
     const limits = resolveTarMeterLimits();
-    await inspectTar({ archiveBuffer, limits, onMember(info) {
+    await inspectTar({ archiveBuffer, kind, limits, onMember(info) {
             const normalized = canonicalEntryPath(info.path);
             if (seenPaths.has(normalized)) {
                 throw new ArchiveSecurityError("entry-path", `archive contains duplicate entry path: ${formatErrorDetail(normalized)}`);
@@ -159,7 +159,7 @@ async function readTarEntry(archiveBuffer, entryPath, maxBytes) {
     }
     if (selected.size > maxBytes)
         throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.ENTRY_EXTRACTED_SIZE_EXCEEDS_LIMIT);
-    if (!isGzipBuffer(archiveBuffer)) {
+    if (kind === "tar" && !isGzipBuffer(archiveBuffer)) {
         // Complete admission already validated this private snapshot through EOF.
         // Copy the admitted payload so the result cannot expose or mutate its input.
         const end = selected.offset + selected.size;
@@ -170,7 +170,7 @@ async function readTarEntry(archiveBuffer, entryPath, maxBytes) {
         return Buffer.from(archiveBuffer.subarray(selected.offset, end));
     }
     let result;
-    await replayTar({ archiveBuffer, limits, members: [selected], async consume(member, payload) {
+    await replayTar({ archiveBuffer, kind, limits, members: [selected], async consume(member, payload) {
             result = await readAdmittedTarPayload(payload, member.size);
         } });
     return result;
@@ -238,7 +238,6 @@ export async function readArchiveEntry(archivePath, entryPath, options) {
     const native = getNativeBinding();
     if (native)
         return await readNativeBufferEntry(native, buffer, kind, requestedEntry, entryPath, options.maxBytes, zipEntries);
-    assertPortableArchiveKind(kind);
     return kind === "zip" ? await readZipEntry(buffer, requestedEntry, options.maxBytes, zipEntries)
-        : await readTarEntry(buffer, requestedEntry, options.maxBytes);
+        : await readTarEntry(buffer, requestedEntry, options.maxBytes, kind);
 }

package/node_modules/@openclaw/fs-safe/dist/archive-staging.d.ts

@@ -31,4 +31,3 @@ export declare function withStagedArchiveDestination<T>(params: {
 }): Promise<T>;
 export { mergeExtractedTreeIntoDestination } from "./archive-merge.js";
 export declare function createArchiveSymlinkTraversalError(originalPath: string): ArchiveSecurityError;
-//# sourceMappingURL=archive-staging.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-tar-stream.d.ts

@@ -1,3 +1,4 @@
+import type { ArchiveKind } from "./archive-kind.js";
 import type { TarMeterLimits } from "./archive-limits.js";
 import { type AdmittedTarMember } from "./archive-tar-wasm.js";
 /** Buffers are private immutable snapshots, just like the staged file route. */
@@ -11,6 +12,7 @@ type TarInput = {
 export declare function inspectTar(params: TarInput & {
     limits: TarMeterLimits;
     signal?: AbortSignal;
+    kind?: Exclude<ArchiveKind, "zip">;
     onMember?: (entry: AdmittedTarMember) => void;
 }): Promise<void>;
 /** Replay in physical order, retaining at most one decoded chunk. Every range
@@ -18,8 +20,8 @@ export declare function inspectTar(params: TarInput & {
 export declare function replayTar<T extends AdmittedTarMember>(params: TarInput & {
     limits: TarMeterLimits;
     signal?: AbortSignal;
+    kind?: Exclude<ArchiveKind, "zip">;
     members: readonly T[];
     consume(member: T, payload: AsyncIterable<Buffer>): Promise<void>;
 }): Promise<void>;
 export {};
-//# sourceMappingURL=archive-tar-stream.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-tar-stream.js

@@ -1,10 +1,10 @@
 import fs from "node:fs";
 import { Readable, Writable } from "node:stream";
-import { pipeline } from "node:stream/promises";
+import { finished, pipeline } from "node:stream/promises";
 import { createGunzip } from "node:zlib";
 import { GzipInput, isGzipBuffer, validateGzipBufferTail, validateGzipContainerTail } from "./archive-gzip-tail.js";
 import { ArchiveFormatError } from "./archive-errors.js";
-import { TarParserStream } from "./archive-tar-wasm.js";
+import { TarParserStream, TarWasmSession } from "./archive-tar-wasm.js";
 import { readFileWindowFully } from "./positional-read.js";
 function* bufferChunks(buffer) {
     for (let offset = 0; offset < buffer.length; offset += 65536)
@@ -23,45 +23,64 @@ async function gzipFile(filePath) {
 }
 async function withTarStream(params, consume) {
     const buffer = params.archiveBuffer;
-    const gzip = buffer !== undefined ? isGzipBuffer(buffer) : await gzipFile(params.archivePath);
-    const parser = new TarParserStream(params.limits, params.onMember);
-    const input = buffer !== undefined
-        ? Readable.from(bufferChunks(buffer), { objectMode: false, highWaterMark: 65536 })
-        : fs.createReadStream(params.archivePath, { highWaterMark: 65536 });
-    // Match the WASM input window for both staged files and buffered reads.
-    const decoder = gzip ? createGunzip({ chunkSize: 65536 }) : undefined;
-    const gzipInput = decoder ? new GzipInput(decoder) : undefined;
-    const destroy = (error) => {
-        input.destroy(error);
-        gzipInput?.destroy(error);
-        decoder?.destroy(error);
-        parser.destroy(error);
-    };
-    const pumps = decoder && gzipInput
-        ? [pipeline(decoder, parser, { signal: params.signal }), pipeline(input, gzipInput, { signal: params.signal })]
-        : [pipeline(input, parser, { signal: params.signal })];
-    // Either pump tears down both routes; join every pump even after the first failure.
-    const settled = Promise.all(pumps.map((pump) => pump.then(() => undefined, (cause) => {
-        const error = cause instanceof Error ? cause : new Error(String(cause));
-        destroy(error);
-        return error;
-    }))).then((errors) => errors.find((error) => error !== undefined));
+    const kind = params.kind ?? "tar";
+    const gzip = kind === "tar" && (buffer !== undefined ? isGzipBuffer(buffer) : await gzipFile(params.archivePath));
+    const session = new TarWasmSession(params.limits);
     try {
-        const result = await consume(parser);
-        const error = await settled;
-        if (error)
-            throw error;
-        if (gzipInput) {
-            if (buffer !== undefined)
-                await validateGzipBufferTail(buffer, gzipInput.tailOffset, params.signal);
-            else
-                await validateGzipContainerTail(params.archivePath, gzipInput.tailOffset, params.signal);
+        const parser = new TarParserStream(params.limits, params.onMember, session);
+        const input = buffer !== undefined
+            ? Readable.from(bufferChunks(buffer), { objectMode: false, highWaterMark: 65536 })
+            : fs.createReadStream(params.archivePath, { highWaterMark: 65536 });
+        // Match the WASM input window for both staged files and buffered reads.
+        const decoder = gzip ? createGunzip({ chunkSize: 65536 }) : undefined;
+        const gzipInput = decoder ? new GzipInput(decoder) : undefined;
+        const destroy = (error) => {
+            input.destroy(error);
+            gzipInput?.destroy(error);
+            decoder?.destroy(error);
+            parser.destroy(error);
+        };
+        // A pipeline with an async-generator stage can settle before its file's
+        // asynchronous close. Join the actual close events before freeing WASM.
+        const closed = Promise.all([input, parser, ...(decoder ? [decoder] : []), ...(gzipInput ? [gzipInput] : [])].map(stream => {
+            const closing = new Promise(resolve => { stream.once("close", resolve); });
+            return finished(stream, { cleanup: true }).then(() => undefined, (cause) => cause instanceof Error ? cause : new Error(String(cause))).then(async (error) => { await closing; return error; });
+        }));
+        const pumps = decoder && gzipInput
+            ? [pipeline(decoder, parser, { signal: params.signal }), pipeline(input, gzipInput, { signal: params.signal })]
+            : kind !== "tar"
+                ? [pipeline(input, (source) => session.decode(source, kind, params.signal), parser, { signal: params.signal })]
+                : [pipeline(input, parser, { signal: params.signal })];
+        // Either pump tears down both routes; join every pump even after the first failure.
+        const settled = Promise.all(pumps.map((pump) => pump.then(() => undefined, (cause) => {
+            const error = cause instanceof Error ? cause : new Error(String(cause));
+            destroy(error);
+            return error;
+        }))).then((errors) => errors.find((error) => error !== undefined));
+        try {
+            const result = await consume(parser);
+            const error = await settled;
+            if (error)
+                throw error;
+            const closeError = (await closed).find(error => error !== undefined);
+            if (closeError)
+                throw closeError;
+            if (gzipInput) {
+                if (buffer !== undefined)
+                    await validateGzipBufferTail(buffer, gzipInput.tailOffset, params.signal);
+                else
+                    await validateGzipContainerTail(params.archivePath, gzipInput.tailOffset, params.signal);
+            }
+            return result;
+        }
+        finally {
+            destroy();
+            await settled;
+            await closed;
         }
-        return result;
     }
     finally {
-        destroy();
-        await settled;
+        session.dispose();
     }
 }
 export async function inspectTar(params) {

package/node_modules/@openclaw/fs-safe/dist/archive-tar-wasm.d.ts

@@ -1,18 +1,29 @@
 import { Transform, type TransformCallback } from "node:stream";
 import type { TarMeterLimits } from "./archive-limits.js";
-import type { TarEntryInfo } from "./archive-tar.js";
+import type { TarEntryInfo } from "./archive-plan.js";
 export type AdmittedTarMember = TarEntryInfo & {
     offset: number;
 };
-/** Backpressure-aware transport only; all TAR semantics live in the Rust core. */
-export declare class TarParserStream extends Transform {
-    private readonly onMember?;
+/** One bounded memory domain owns both admission and decompression. Its owner
+ * must join the decoder and parser before disposing this shared instance. */
+export declare class TarWasmSession {
     private abi;
-    constructor(limits: TarMeterLimits, onMember?: ((entry: AdmittedTarMember) => void) | undefined);
+    constructor(limits: TarMeterLimits);
     private bytes;
     private text;
+    parse(chunk: Buffer, onMember?: (entry: AdmittedTarMember) => void): void;
+    finish(): void;
+    private codecError;
+    decode(source: AsyncIterable<Buffer>, kind: "tar-zstd" | "tar-bzip2", signal?: AbortSignal): AsyncGenerator<Buffer>;
+    dispose(): void;
+}
+/** Backpressure-aware transport only; all TAR semantics live in the Rust core. */
+export declare class TarParserStream extends Transform {
+    private readonly onMember?;
+    private readonly session;
+    private readonly ownsSession;
+    constructor(limits: TarMeterLimits, onMember?: ((entry: AdmittedTarMember) => void) | undefined, session?: TarWasmSession);
     _transform(chunk: Buffer, _encoding: BufferEncoding, callback: TransformCallback): void;
     _flush(callback: TransformCallback): void;
     _destroy(error: Error | null, callback: (error: Error | null) => void): void;
 }
-//# sourceMappingURL=archive-tar-wasm.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-tar-wasm.js

@@ -1,6 +1,7 @@
 import { classifyArchiveParserError } from "./archive-parser-errors.js";
 import { readFileSync } from "node:fs";
 import { Transform } from "node:stream";
+import { setImmediate } from "node:timers/promises";
 import { ArchiveFormatError } from "./archive-errors.js";
 // Node exposes WebAssembly without DOM globals; keep the private ABI types local.
 const wasm = globalThis.WebAssembly;
@@ -24,17 +25,14 @@ function parserError(message) {
         return mapped;
     return new ArchiveFormatError(message.replace(/^archive-header-invalid:/, "invalid TAR header:"));
 }
-/** Backpressure-aware transport only; all TAR semantics live in the Rust core. */
-export class TarParserStream extends Transform {
-    onMember;
+/** One bounded memory domain owns both admission and decompression. Its owner
+ * must join the decoder and parser before disposing this shared instance. */
+export class TarWasmSession {
     abi;
-    constructor(limits, onMember) {
-        super();
-        this.onMember = onMember;
+    constructor(limits) {
         this.abi = instance();
         if (this.abi.init(limits.maxEntries, limits.maxMetaEntryBytes, limits.maxDecodedBytes, limits.maxManifestBytes, Number(process.platform === "win32")) !== 0) {
-            this.abi.dispose();
-            this.abi = undefined;
+            this.dispose();
             throw new RangeError("invalid TAR parser limits");
         }
     }
@@ -50,28 +48,133 @@ export class TarParserStream extends Transform {
         const abi = this.abi;
         return utf8Decoder.decode(this.bytes(abi.text_ptr(), abi.text_len()));
     }
-    _transform(chunk, _encoding, callback) {
-        try {
-            const abi = this.abi;
-            for (let offset = 0; offset < chunk.length; offset += 65536) {
-                const length = Math.min(65536, chunk.length - offset);
-                this.bytes(abi.input_ptr(), length).set(chunk.subarray(offset, offset + length));
-                // A member event can stop before the end of this already-copied inbox.
-                for (let consumed = 0; consumed < length;) {
-                    const used = abi.push(consumed, length - consumed);
-                    if (used < 0)
-                        throw parserError(this.text());
-                    if (used === 0 || used > length - consumed)
-                        throw new ArchiveFormatError("TAR WASM made no progress");
-                    consumed += used;
-                    const type = abi.member_type();
-                    if (type >= 0)
-                        this.onMember?.({
-                            path: this.text(), type: types.get(type) ?? "Unsupported", size: abi.member_size(),
-                            mode: abi.member_mode(), offset: abi.member_offset(),
-                        });
+    parse(chunk, onMember) {
+        const abi = this.abi;
+        for (let offset = 0; offset < chunk.length; offset += 65536) {
+            const length = Math.min(65536, chunk.length - offset);
+            this.bytes(abi.input_ptr(), length).set(chunk.subarray(offset, offset + length));
+            // A member event can stop before the end of this already-copied inbox.
+            for (let consumed = 0; consumed < length;) {
+                const used = abi.push(consumed, length - consumed);
+                if (used < 0)
+                    throw parserError(this.text());
+                if (used === 0 || used > length - consumed)
+                    throw new ArchiveFormatError("TAR WASM made no progress");
+                consumed += used;
+                const type = abi.member_type();
+                if (type >= 0)
+                    onMember?.({
+                        path: this.text(), type: types.get(type) ?? "Unsupported", size: abi.member_size(),
+                        mode: abi.member_mode(), offset: abi.member_offset(),
+                    });
+            }
+        }
+    }
+    finish() {
+        if (this.abi.finish() !== 0)
+            throw parserError(this.text());
+    }
+    codecError() {
+        const abi = this.abi;
+        return new ArchiveFormatError(utf8Decoder.decode(this.bytes(abi.codec_error_ptr(), abi.codec_error_len())));
+    }
+    async *decode(source, kind, signal) {
+        const abi = this.abi;
+        signal?.throwIfAborted();
+        if (abi.codec_init(kind === "tar-bzip2" ? 1 : 2) !== 0)
+            throw this.codecError();
+        let work = 0;
+        let calls = 0;
+        let unconsumedBoundary = false;
+        const step = (input) => {
+            signal?.throwIfAborted();
+            this.bytes(abi.codec_input_ptr(), input.length).set(input);
+            const result = abi.codec_push(input.length);
+            if (result < 0)
+                throw this.codecError();
+            const consumed = abi.codec_consumed(), produced = abi.codec_produced();
+            if (!Number.isInteger(consumed) || consumed < 0 || consumed > input.length ||
+                !Number.isInteger(produced) || produced < 0 || produced > 65536 ||
+                (result !== 0 && result !== 1) ||
+                (input.length > 0 && consumed === 0 && produced === 0 && (result !== 1 || unconsumedBoundary))) {
+                throw new ArchiveFormatError("compressed TAR WASM made no progress");
+            }
+            if (input.length > 0)
+                unconsumedBoundary = consumed === 0 && produced === 0;
+            work += consumed + produced;
+            calls++;
+            // The parser can grow this same memory, and the next codec call reuses it.
+            return { consumed, output: produced ? Buffer.from(this.bytes(abi.codec_output_ptr(), produced)) : undefined };
+        };
+        const empty = Buffer.alloc(0);
+        // Yield even for output-free skippable frames and arbitrarily small members.
+        const yieldIfNeeded = async () => {
+            if (work >= 256 * 1024 || calls >= 32) {
+                work = 0;
+                calls = 0;
+                await setImmediate(undefined, { signal });
+            }
+            signal?.throwIfAborted();
+        };
+        for await (const chunk of source) {
+            for (let offset = 0; offset < chunk.length;) {
+                const { consumed, output } = step(chunk.subarray(offset, offset + 65536));
+                offset += consumed;
+                if (output)
+                    yield output;
+                await yieldIfNeeded();
+                // A full output window can leave more decoded bytes with no new input.
+                if (output) {
+                    for (;;) {
+                        const drained = step(empty);
+                        if (drained.output)
+                            yield drained.output;
+                        await yieldIfNeeded();
+                        if (!drained.output)
+                            break;
+                    }
                 }
             }
+        }
+        // Physical EOF, rather than a selected range or TAR EOF, ends the decoder.
+        for (;;) {
+            const drained = step(empty);
+            if (drained.output)
+                yield drained.output;
+            await yieldIfNeeded();
+            if (!drained.output)
+                break;
+        }
+        if (abi.codec_finish() !== 0)
+            throw this.codecError();
+    }
+    dispose() {
+        const abi = this.abi;
+        this.abi = undefined;
+        if (abi) {
+            try {
+                abi.codec_dispose();
+            }
+            finally {
+                abi.dispose();
+            }
+        }
+    }
+}
+/** Backpressure-aware transport only; all TAR semantics live in the Rust core. */
+export class TarParserStream extends Transform {
+    onMember;
+    session;
+    ownsSession;
+    constructor(limits, onMember, session) {
+        super();
+        this.onMember = onMember;
+        this.session = session ?? new TarWasmSession(limits);
+        this.ownsSession = session === undefined;
+    }
+    _transform(chunk, _encoding, callback) {
+        try {
+            this.session.parse(chunk, this.onMember);
             callback(null, chunk);
         }
         catch (error) {
@@ -80,8 +183,7 @@ export class TarParserStream extends Transform {
     }
     _flush(callback) {
         try {
-            if (this.abi.finish() !== 0)
-                throw parserError(this.text());
+            this.session.finish();
             callback();
         }
         catch (error) {
@@ -90,14 +192,12 @@ export class TarParserStream extends Transform {
     }
     _destroy(error, callback) {
         try {
-            this.abi?.dispose();
+            if (this.ownsSession)
+                this.session.dispose();
         }
         catch (cause) {
             error ??= cause instanceof Error ? cause : new Error(String(cause));
         }
-        finally {
-            this.abi = undefined;
-        }
         callback(error);
     }
 }

package/node_modules/@openclaw/fs-safe/dist/archive-zip-admission.d.ts

@@ -5,4 +5,3 @@ import { type ZipDirectoryEntry } from "./archive-zip-directory.js";
 export declare function admitZipBuffer(input: Uint8Array, limits: ResolvedArchiveExtractLimits, onEntry?: (entry: ZipDirectoryEntry) => void): number;
 /** The extraction input is private and immutable; read bounded metadata windows. */
 export declare function admitZipFile(archivePath: string, limits: ResolvedArchiveExtractLimits, deadline: ExtractionDeadline, onEntry?: (entry: ZipDirectoryEntry) => void): Promise<number>;
-//# sourceMappingURL=archive-zip-admission.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-zip-count.d.ts

@@ -1,2 +1 @@
 export declare function readZipCentralDirectoryEntryCount(buffer: Buffer | Uint8Array): number | null;
-//# sourceMappingURL=archive-zip-count.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-zip-count.js

@@ -1,5 +1,6 @@
 // Conservative public count hint; strict admission must not rely on its fallback.
 const ZIP_EOCD_SIGNATURE = 0x06054b50;
+const ZIP_EOCD_SIGNATURE_BYTES = Buffer.from([0x50, 0x4b, 0x05, 0x06]);
 const ZIP64_EOCD_SIGNATURE = 0x06064b50;
 const ZIP64_EOCD_LOCATOR_SIGNATURE = 0x07064b50;
 const ZIP_EOCD_MIN_BYTES = 22;
@@ -38,7 +39,26 @@ function findZipEndOfCentralDirectory(buffer) {
         return -1;
     }
     const minOffset = Math.max(0, buffer.byteLength - ZIP_EOCD_MIN_BYTES - ZIP_EOCD_MAX_COMMENT_BYTES);
-    for (let offset = buffer.byteLength - ZIP_EOCD_MIN_BYTES; offset >= minOffset; offset -= 1) {
+    const lastOffset = buffer.byteLength - ZIP_EOCD_MIN_BYTES;
+    if (buffer.readUInt32LE(lastOffset) === ZIP_EOCD_SIGNATURE &&
+        buffer.readUInt16LE(lastOffset + ZIP_EOCD_COMMENT_LENGTH_OFFSET) === 0) {
+        return lastOffset;
+    }
+    const tail = buffer.subarray(minOffset);
+    let from = lastOffset - minOffset - 1;
+    // Keep the latest valid record semantics of this count hint. Bound native
+    // searches so dense false signatures retain the byte scan's cost.
+    for (let candidates = 0; candidates < 16 && from >= 0; candidates += 1) {
+        const found = tail.lastIndexOf(ZIP_EOCD_SIGNATURE_BYTES, from);
+        if (found < 0)
+            return -1;
+        const offset = minOffset + found;
+        const commentLength = buffer.readUInt16LE(offset + ZIP_EOCD_COMMENT_LENGTH_OFFSET);
+        if (offset + ZIP_EOCD_MIN_BYTES + commentLength === buffer.byteLength)
+            return offset;
+        from = found - 1;
+    }
+    for (let offset = minOffset + from; offset >= minOffset; offset -= 1) {
         if (buffer.readUInt32LE(offset) !== ZIP_EOCD_SIGNATURE) {
             continue;
         }