@openclaw/openshell-sandbox 2026.9.5 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/archive-zip-directory.d.ts

@@ -1,5 +1,5 @@
 import { type ResolvedArchiveExtractLimits } from "./archive-limits.js";
-import type { ArchiveEntryKind } from "./archive-policy.js";
+import type { ArchiveEntryKind } from "./archive-plan.js";
 export type ZipRead = {
     offset: number;
     length: number;
@@ -10,9 +10,12 @@ export type ZipDirectoryEntry = {
     creatorSystem: number;
     externalAttributes: number;
     size: number;
+    compressedSize: number;
+    compressionMethod: number;
+    crc32: number;
     path?: string;
     portableKey: string;
+    portableDirectory: boolean;
     kind: ArchiveEntryKind;
 };
 export declare function scanZipDirectory(size: number, limits: ResolvedArchiveExtractLimits, onEntry?: (entry: ZipDirectoryEntry) => void): ZipScan;
-//# sourceMappingURL=archive-zip-directory.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-zip-directory.js

@@ -19,7 +19,8 @@ function* read(offset, length, bound) {
         zipFormat("truncated record");
     return bytes;
 }
-function endOffset(tail) {
+const END_SIGNATURE = Buffer.from([0x50, 0x4b, 0x05, 0x06]);
+function denseEndOffset(tail) {
     let found = -1;
     for (let offset = tail.length - 22; offset >= 0; offset--) {
         if (tail.readUInt32LE(offset) === 0x06054b50 && offset + 22 + tail.readUInt16LE(offset + 20) === tail.length) {
@@ -32,6 +33,27 @@ function endOffset(tail) {
         zipFormat("end record missing");
     return found;
 }
+function endOffset(tail) {
+    let found = -1;
+    let from = 0;
+    // Sparse signatures use native search; dense attacker-controlled markers
+    // retain the bounded byte scan instead of one native call per marker.
+    for (let candidates = 0; candidates < 16; candidates++) {
+        const offset = tail.indexOf(END_SIGNATURE, from);
+        if (offset < 0 || offset > tail.length - 22) {
+            if (found < 0)
+                zipFormat("end record missing");
+            return found;
+        }
+        if (offset + 22 + tail.readUInt16LE(offset + 20) === tail.length) {
+            if (found !== -1)
+                zipFormat("ambiguous end records");
+            found = offset;
+        }
+        from = offset + 1;
+    }
+    return denseEndOffset(tail);
+}
 function* zip64End(locator, locatorAt, size) {
     const advertised = zipUInt64(locator, 8);
     // Seek the advertised record, or the fixed ordinary record for a prefixed
@@ -224,6 +246,8 @@ export function* scanZipDirectory(size, limits, onEntry) {
         onEntry?.({
             index: count - 1, creatorSystem: central[5], externalAttributes: central.readUInt32LE(38),
             size: values.uncompressed, path: admittedName.path, portableKey: admittedName.portableKey,
+            compressedSize: values.compressed, compressionMethod: central.readUInt16LE(10), crc32: crc,
+            portableDirectory: admittedName.portableDirectory,
             kind: entryKind(central.readUInt32LE(38), admittedName.directory),
         });
         at = next;

package/node_modules/@openclaw/fs-safe/dist/archive-zip-entry.d.ts

@@ -1,8 +1,10 @@
-import { type ArchiveEntryModePolicy } from "./archive-policy.js";
+import { type ArchiveEntryModePolicy, type ArchiveEntryKind } from "./archive-plan.js";
+import type { ZipDirectoryEntry } from "./archive-zip-directory.js";
 export type ZipEntry = {
     name: string;
     dir: boolean;
     unixPermissions?: number | null;
+    dosPermissions?: number | null;
     _data?: {
         crc32?: number;
         uncompressedSize?: number;
@@ -10,12 +12,13 @@ export type ZipEntry = {
     nodeStream?: () => NodeJS.ReadableStream;
     async: (type: "nodebuffer") => Promise<Buffer>;
 };
+/** Internal: register only after the complete decoder/admission association. */
+export declare function registerAdmittedZipEntry(entry: ZipEntry, physical: ZipDirectoryEntry): void;
 export declare function zipEntryIntegrityMetadata(entry: ZipEntry): {
     crc32?: number;
     uncompressedSize?: number;
 } | undefined;
-export declare function hasDeferredEmptyZipData(entry: ZipEntry): boolean;
 export declare function isZipSymlinkEntry(entry: ZipEntry): boolean;
+export declare function zipEntryKind(entry: ZipEntry): ArchiveEntryKind;
 export declare function zipEntryMode(entry: ZipEntry, policy: ArchiveEntryModePolicy | undefined): number;
 export declare function zipEntryDeclaredSize(entry: ZipEntry): number;
-//# sourceMappingURL=archive-zip-entry.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-zip-entry.js

@@ -1,27 +1,42 @@
-import { resolveArchiveEntryMode, } from "./archive-policy.js";
+import { resolveArchiveEntryMode, } from "./archive-plan.js";
+const admittedMetadata = new WeakMap();
+/** Internal: register only after the complete decoder/admission association. */
+export function registerAdmittedZipEntry(entry, physical) {
+    const mode = physical.creatorSystem === 3 ? physical.externalAttributes >>> 16 : undefined;
+    admittedMetadata.set(entry, { kind: physical.kind, mode, size: physical.size });
+    entry.dir = physical.kind === "directory";
+    // Previously unsupported non-UNIX symlinks must also be recognizable to
+    // public preflight consumers using JSZip's conventional type inspection.
+    entry.unixPermissions = mode ?? (physical.kind === "symlink" ? 0o120000 : null);
+    entry.dosPermissions = physical.creatorSystem === 0 ? physical.externalAttributes & 0x3f : null;
+}
 export function zipEntryIntegrityMetadata(entry) {
     const data = entry._data;
     if (!data || "then" in data)
         return undefined;
     return data;
 }
-export function hasDeferredEmptyZipData(entry) {
-    const data = entry._data;
-    return Boolean(data && "then" in data);
-}
 const ZIP_UNIX_FILE_TYPE_MASK = 0o170000;
 const ZIP_UNIX_SYMLINK_TYPE = 0o120000;
 export function isZipSymlinkEntry(entry) {
-    return (typeof entry.unixPermissions === "number" &&
-        (entry.unixPermissions & ZIP_UNIX_FILE_TYPE_MASK) === ZIP_UNIX_SYMLINK_TYPE);
+    return zipEntryKind(entry) === "symlink";
+}
+export function zipEntryKind(entry) {
+    const metadata = admittedMetadata.get(entry);
+    if (metadata)
+        return metadata.kind;
+    return typeof entry.unixPermissions === "number" &&
+        (entry.unixPermissions & ZIP_UNIX_FILE_TYPE_MASK) === ZIP_UNIX_SYMLINK_TYPE
+        ? "symlink" : entry.dir ? "directory" : "file";
 }
 export function zipEntryMode(entry, policy) {
+    const metadata = admittedMetadata.get(entry);
     return resolveArchiveEntryMode({
         kind: entry.dir ? "directory" : "file",
-        archivedMode: entry.unixPermissions,
+        archivedMode: metadata ? metadata.mode : entry.unixPermissions,
         policy,
     });
 }
 export function zipEntryDeclaredSize(entry) {
-    return Math.max(0, Math.floor(zipEntryIntegrityMetadata(entry)?.uncompressedSize ?? 0));
+    return admittedMetadata.get(entry)?.size ?? Math.max(0, Math.floor(zipEntryIntegrityMetadata(entry)?.uncompressedSize ?? 0));
 }

package/node_modules/@openclaw/fs-safe/dist/archive-zip-integrity.d.ts

@@ -2,4 +2,3 @@ import { Transform } from "node:stream";
 import { type ZipEntry } from "./archive-zip-entry.js";
 export declare function normalizeZipIntegrityError(error: unknown): Error;
 export declare function createZipIntegrityTransform(entry: ZipEntry): Transform;
-//# sourceMappingURL=archive-zip-integrity.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-zip-integrity.js

@@ -1,6 +1,6 @@
 import { Transform } from "node:stream";
 import { ArchiveFormatError } from "./archive-errors.js";
-import { hasDeferredEmptyZipData, zipEntryIntegrityMetadata, } from "./archive-zip-entry.js";
+import { zipEntryIntegrityMetadata, } from "./archive-zip-entry.js";
 import { updateCrc32 } from "./archive-crc32.js";
 export function normalizeZipIntegrityError(error) {
     if (error instanceof Error &&
@@ -11,9 +11,8 @@ export function normalizeZipIntegrityError(error) {
 }
 export function createZipIntegrityTransform(entry) {
     const metadata = zipEntryIntegrityMetadata(entry);
-    const deferredEmpty = hasDeferredEmptyZipData(entry);
-    const expectedCrc32 = deferredEmpty ? 0 : metadata?.crc32;
-    const expectedSize = deferredEmpty ? 0 : metadata?.uncompressedSize;
+    const expectedCrc32 = metadata?.crc32;
+    const expectedSize = metadata?.uncompressedSize;
     if (typeof expectedCrc32 !== "number" ||
         !Number.isInteger(expectedCrc32) ||
         typeof expectedSize !== "number" ||

package/node_modules/@openclaw/fs-safe/dist/archive-zip-loader.d.ts

@@ -1,7 +1,8 @@
 import type { ZipDirectoryEntry } from "./archive-zip-directory.js";
+import { type ZipEntry } from "./archive-zip-entry.js";
 export type ZipArchiveWithFiles = {
     files: Record<string, unknown>;
 };
+export declare function admittedZipEntries(archive: ZipArchiveWithFiles): readonly ZipEntry[];
 /** Internal: the caller has admitted these unchanged bytes and their metadata. */
 export declare function loadAdmittedZipArchive(buffer: Buffer | Uint8Array, admitted: ZipDirectoryEntry[]): Promise<ZipArchiveWithFiles>;
-//# sourceMappingURL=archive-zip-loader.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-zip-loader.js

@@ -1,57 +1,140 @@
 import { ArchiveFormatError, ArchiveSecurityError } from "./archive-errors.js";
 import { validateArchiveEntryPath } from "./archive-entry.js";
-import { isZipSymlinkEntry } from "./archive-zip-entry.js";
+import { registerAdmittedZipEntry } from "./archive-zip-entry.js";
 import { zipPathKey } from "./archive-zip-names.js";
+const orderedEntries = new WeakMap();
+export function admittedZipEntries(archive) {
+    return orderedEntries.get(archive) ?? disagreement();
+}
+function disagreement() {
+    throw new ArchiveFormatError("ZIP decoder disagrees with admitted directory metadata");
+}
+function collision() {
+    throw new ArchiveSecurityError("entry-path", "zip archive contains duplicate or colliding entry names");
+}
+function matchesData(value, physical) {
+    if (!value || typeof value !== "object")
+        return false;
+    const data = value;
+    return Number.isInteger(data.crc32) && data.crc32 >= -0x80000000 && data.crc32 <= 0xffffffff &&
+        (data.crc32 >>> 0) === physical.crc32 && data.uncompressedSize === physical.size &&
+        data.compressedSize === physical.compressedSize && typeof data.getContentWorker === "function" &&
+        data.compression?.magic === String.fromCharCode(physical.compressionMethod & 255, physical.compressionMethod >>> 8);
+}
 /** Internal: the caller has admitted these unchanged bytes and their metadata. */
 export async function loadAdmittedZipArchive(buffer, admitted) {
+    const physicalByPath = new Map();
+    for (const entry of admitted) {
+        if (physicalByPath.has(entry.portableKey))
+            collision();
+        physicalByPath.set(entry.portableKey, entry);
+    }
     const JSZip = await importOptionalJsZip();
-    let archive;
+    const archive = new JSZip();
+    const originalFile = archive.file;
+    const originalDescriptor = Object.getOwnPropertyDescriptor(archive, "file");
+    const inserted = new Map();
+    const remaining = new Map(physicalByPath);
+    // JSZip's fileAdd can misclassify UNIX type bits as directories, rename an
+    // entry, and erase its payload. Intercept only this private instance's load.
+    Object.defineProperty(archive, "file", { configurable: true, writable: true,
+        value: function (...args) {
+            if (args.length === 1)
+                return originalFile.apply(this, args);
+            const [name, data, options] = args;
+            if (this !== archive || args.length !== 3 || typeof name !== "string" || !options || typeof options !== "object")
+                disagreement();
+            validateArchiveEntryPath(name);
+            const key = zipPathKey(name);
+            const physical = remaining.get(key);
+            if (!physical) {
+                if (physicalByPath.has(key))
+                    collision();
+                disagreement();
+            }
+            const fields = options;
+            const unixMode = physical.creatorSystem === 3 ? physical.externalAttributes >>> 16 : null;
+            const dosMode = physical.creatorSystem === 0 ? physical.externalAttributes & 0x3f : null;
+            const decoderDirectory = Boolean(physical.externalAttributes & 0x10) || physical.portableDirectory;
+            if (physical.index !== inserted.size || fields.unixPermissions !== unixMode || fields.dosPermissions !== dosMode ||
+                fields.dir !== decoderDirectory || !matchesData(data, physical))
+                disagreement();
+            const result = originalFile.call(this, name, data, {
+                ...fields, dir: false, unixPermissions: null, dosPermissions: null, createFolders: false,
+            });
+            const entry = archive.files[name];
+            if (!entry || typeof entry !== "object" || inserted.has(entry))
+                disagreement();
+            // fileAdd also substitutes an empty promise for declared-zero contents.
+            // Retain the original decoder object so size/CRC checks still read bytes.
+            entry._data = data;
+            inserted.set(entry, { physical, data });
+            remaining.delete(key);
+            return result;
+        },
+    });
     try {
-        archive = await JSZip.loadAsync(buffer);
+        const loaded = await archive.loadAsync(buffer, { createFolders: false });
+        if (loaded !== archive)
+            disagreement();
     }
     catch (error) {
+        if (error instanceof ArchiveFormatError || error instanceof ArchiveSecurityError)
+            throw error;
         throw new ArchiveFormatError(`invalid ZIP archive: ${error instanceof Error ? error.message : String(error)}`, { cause: error instanceof Error ? error : undefined });
     }
-    const names = Object.keys(archive.files);
-    if (names.length !== admitted.length) {
-        throw new ArchiveSecurityError("entry-path", "zip archive contains duplicate or colliding entry names");
-    }
-    // Object key order is not central-directory order (numeric names reorder).
-    // Use the admitted portable interpretation, including legacy UTF-8 decoding.
-    const physicalByPath = new Map();
-    for (const entry of admitted) {
-        physicalByPath.set(entry.portableKey, entry);
+    finally {
+        if (originalDescriptor)
+            Object.defineProperty(archive, "file", originalDescriptor);
+        else
+            Reflect.deleteProperty(archive, "file");
     }
+    const names = Object.keys(archive.files);
+    if (names.length !== admitted.length)
+        collision();
+    const normalized = [];
     for (const name of names) {
         validateArchiveEntryPath(name);
-        const key = zipPathKey(name);
-        const physical = physicalByPath.get(key);
         const entry = archive.files[name];
-        const entryName = entry.name;
-        let entryKey = key;
-        if (entryName !== name) {
-            validateArchiveEntryPath(entryName);
-            entryKey = zipPathKey(entryName);
-        }
-        const kind = isZipSymlinkEntry(entry) ? "symlink" : entry.dir ? "directory" : "file";
-        if (!physical || entryKey !== key || kind !== physical.kind) {
-            throw new ArchiveFormatError("ZIP decoder disagrees with admitted directory metadata");
-        }
-        physicalByPath.delete(key);
+        if (!entry || typeof entry.name !== "string")
+            disagreement();
+        validateArchiveEntryPath(entry.name);
+        const insertion = inserted.get(entry);
+        if (!insertion || zipPathKey(name) !== insertion.physical.portableKey || zipPathKey(entry.name) !== insertion.physical.portableKey ||
+            entry.dir !== false || entry.unixPermissions !== null || entry.dosPermissions !== null ||
+            entry._data !== insertion.data || !matchesData(entry._data, insertion.physical))
+            disagreement();
+        normalized[insertion.physical.index] = [name, entry, insertion.physical];
+        inserted.delete(entry);
     }
-    if (physicalByPath.size) {
-        throw new ArchiveFormatError("ZIP decoder disagrees with admitted directory metadata");
+    if (remaining.size || inserted.size)
+        disagreement();
+    const files = Object.create(null);
+    const entries = [];
+    for (const [name, entry, physical] of normalized) {
+        const appendSlash = physical.kind === "directory" && !name.endsWith("/");
+        const normalizedName = appendSlash ? `${name}/` : name;
+        if (Object.hasOwn(files, normalizedName))
+            collision();
+        if (appendSlash) {
+            entry.name = `${entry.name}/`;
+        }
+        files[normalizedName] = entry;
+        registerAdmittedZipEntry(entry, physical);
+        entries.push(entry);
     }
+    archive.files = files;
+    orderedEntries.set(archive, entries);
     return archive;
 }
 async function importOptionalJsZip() {
     try {
         const module = await import("jszip");
         const candidate = typeof module === "function" ? module : module.default;
-        if ((typeof candidate !== "object" && typeof candidate !== "function") ||
-            candidate === null ||
-            typeof candidate.loadAsync !== "function") {
-            throw new Error('Optional archive dependency "jszip" does not expose loadAsync().');
+        if (typeof candidate !== "function" ||
+            typeof candidate.prototype?.file !== "function" ||
+            typeof candidate.prototype?.loadAsync !== "function") {
+            throw new Error('Optional archive dependency "jszip" does not expose its constructor, file(), and loadAsync().');
         }
         return candidate;
     }

package/node_modules/@openclaw/fs-safe/dist/archive-zip-manifest.d.ts

@@ -2,4 +2,3 @@ import type { NativeArchiveEntry } from "./native-binding.js";
 import type { ZipDirectoryEntry } from "./archive-zip-directory.js";
 /** Associate all native entries with physical admission before exposing any. */
 export declare function validateNativeZipManifest(manifest: NativeArchiveEntry[], admitted: ZipDirectoryEntry[]): void;
-//# sourceMappingURL=archive-zip-manifest.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-zip-names.d.ts

@@ -12,6 +12,6 @@ export declare function admitZipNames(params: {
 }): {
     path?: string;
     portableKey: string;
+    portableDirectory: boolean;
     directory: boolean;
 };
-//# sourceMappingURL=archive-zip-names.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-zip-names.js

@@ -50,9 +50,12 @@ export function zipPathKey(name) {
 function originalName(name, rawName, flags) {
     // ASCII path syntax is encoding-independent. Do not reinterpret legacy bytes
     // as UTF-8 (native ZIP uses CP437); the selected decoder still validates its name.
-    validateArchiveEntryPath(rawName.replace(/[\x80-\xff]/g, "_"));
+    const asciiName = rawName.replace(/[\x80-\xff]/g, "_");
+    validateArchiveEntryPath(asciiName);
     if (!(flags & 0x800))
         return undefined;
+    if (asciiName === rawName && !types.isSharedArrayBuffer(name.buffer))
+        return rawName;
     const decoded = utf8(name);
     validateArchiveEntryPath(decoded);
     return decoded;
@@ -102,7 +105,9 @@ export function admitZipNames(params) {
         interpretations.some((value) => /[/\\]$/.test(value) !== directory)) {
         zipFormat("conflicting terminal directory markers");
     }
-    const interpretationKey = interpretations.length ? zipPathKey(interpretations[0]) : undefined;
+    const firstInterpretation = interpretations[0];
+    const interpretationKey = firstInterpretation === undefined ? undefined
+        : firstInterpretation === centralRaw ? centralKey : zipPathKey(firstInterpretation);
     if (interpretations.some((value) => value !== interpretations[0] && zipPathKey(value) !== interpretationKey)) {
         zipFormat("conflicting Unicode name interpretations");
     }
@@ -130,9 +135,15 @@ export function admitZipNames(params) {
     // Unflagged legacy names can decode differently and need their own key.
     const portableKey = portablePath === centralRaw ? centralKey
         : interpretations.includes(portablePath) ? interpretationKey : zipPathKey(portablePath);
+    // JSZip prioritizes flagged local UTF-8 and checks a central Unicode field
+    // against local bytes. Canonically equal names can end in different separators.
+    const decoderPath = flags & 0x800 ? localUtf8
+        : centralUnicode !== undefined && (sameName || centralField.readUInt32LE(1) === updateCrc32(0, local))
+            ? centralUnicode : local.toString("utf8");
     return {
         path,
         portableKey,
+        portableDirectory: decoderPath.endsWith("/"),
         directory,
     };
 }

package/node_modules/@openclaw/fs-safe/dist/archive-zip-preflight.d.ts

@@ -3,4 +3,3 @@ import { type ZipArchiveWithFiles } from "./archive-zip-loader.js";
 export { readZipCentralDirectoryEntryCount } from "./archive-zip-count.js";
 export type { ZipArchiveWithFiles } from "./archive-zip-loader.js";
 export declare function loadZipArchiveWithPreflight(buffer: Buffer | Uint8Array, limits?: ArchiveExtractLimits): Promise<ZipArchiveWithFiles>;
-//# sourceMappingURL=archive-zip-preflight.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive.d.ts

@@ -1,15 +1,17 @@
-import type { ExtractArchiveOptions } from "./archive-options.js";
-export type { ArchiveLogger, ExtractArchiveOptions } from "./archive-options.js";
-export type { ArchiveEntryFilter, ArchiveEntryKind, ArchiveEntryModePolicy, ArchiveFilteredEntryPolicy, } from "./archive-policy.js";
+import { type ExtractArchiveOptions, type ArchivePlanEntry } from "./archive-plan.js";
+export type { ArchiveLogger, ExtractArchiveOptions } from "./archive-plan.js";
+export type { ArchiveEntryFilter, ArchiveEntryKind, ArchiveEntryModePolicy, ArchiveFilteredEntryPolicy, } from "./archive-plan.js";
 export { isWindowsDrivePath, normalizeArchiveEntryPath, resolveArchiveOutputPath, stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
 export { resolveArchiveKind, resolvePackedRootDir, type ArchiveKind } from "./archive-kind.js";
 export { readArchiveEntry } from "./archive-read.js";
-export { inspectTarArchive, type InspectTarArchiveOptions, type InspectedTarEntry } from "./archive-tar-inspect.js";
 export { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError, DEFAULT_MAX_ARCHIVE_BYTES_ZIP, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_EXTRACTED_BYTES, DEFAULT_MAX_ENTRY_BYTES, DEFAULT_MAX_META_ENTRY_BYTES, DEFAULT_MAX_ENTRY_PATH_COMPONENTS, type ArchiveExtractLimits, type ArchiveLimitErrorCode, } from "./archive-limits.js";
 export { ArchiveFormatError, type ArchiveFormatErrorCode } from "./archive-errors.js";
 export { ArchiveSecurityError, type ArchiveSecurityErrorCode } from "./archive-staging.js";
 export { createArchiveSymlinkTraversalError, mergeExtractedTreeIntoDestination, prepareArchiveDestinationDir, prepareArchiveOutputPath, withStagedArchiveDestination, } from "./archive-staging.js";
-export { createTarEntryPreflightChecker, type TarEntryInfo } from "./archive-tar.js";
+export { createTarEntryPreflightChecker, type TarEntryInfo } from "./archive-plan.js";
 export { loadZipArchiveWithPreflight, readZipCentralDirectoryEntryCount, type ZipArchiveWithFiles, } from "./archive-zip-preflight.js";
 export declare function extractArchive(params: ExtractArchiveOptions): Promise<void>;
-//# sourceMappingURL=archive.d.ts.map
+export type InspectTarArchiveOptions = Pick<ExtractArchiveOptions, "archivePath" | "timeoutMs" | "limits" | "entryFilter" | "onFiltered">;
+export type InspectedTarEntry = Readonly<Pick<ArchivePlanEntry, "path" | "kind" | "size">>;
+/** Complete TAR/gzip admission and zero-strip extraction policy, without output writes. */
+export declare function inspectTarArchive(params: InspectTarArchiveOptions): Promise<readonly InspectedTarEntry[]>;