@openclaw/openshell-sandbox 2026.9.5 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/secret-file.js

@@ -7,42 +7,19 @@ import { readFileDescriptorBoundedSync } from "./bounded-read.js";
 import { assertAsyncDirectoryGuard, createAsyncDirectoryGuard, inspectDirectoryIdentity } from "./directory-guard.js";
 import { pinNodeDirectoryForMode } from "./directory-mode-node.js";
 import { assertOwnedDirectory } from "./directory-mode-owner.js";
-import { assertNoUnsafeDeviceReadPath } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
-import { resolveHomeRelativePath } from "./home-dir.js";
 import { openPinnedFileSync } from "./pinned-open.js";
 import { runPinnedWriteHelper } from "./pinned-write.js";
 import { ensureTrailingSep } from "./root-context.js";
 import { verifyAtomicWriteResult } from "./root-write-verification.js";
-import { assertSecretFilePreview, resolveSecretReadPolicy, secretPathErrorCode, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
+import { prepareSecretRead, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
 import { serializePathWrite } from "./write-queue.js";
 import { assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 export const PRIVATE_SECRET_DIR_MODE = 0o700;
 export const PRIVATE_SECRET_FILE_MODE = 0o600;
 export function readSecretFileSync(filePath, label, options = {}) {
-    const { resolvedPath, maxBytes } = resolveSecretReadPolicy(filePath, label, options);
-    let rejectSymlink;
-    let previewStat;
-    try {
-        assertNoUnsafeDeviceReadPath(resolvedPath);
-        rejectSymlink = Boolean(options.rejectSymlink);
-        previewStat = inspectFileIdentitySync(() => inspectInput(`${label} file at ${resolvedPath} must not be a symlink.`));
-    }
-    catch (error) {
-        throw secretReadError(error instanceof FsSafeError ? error.code : secretPathErrorCode(error), "inspect", label, resolvedPath, error);
-    }
-    function inspectInput(symlinkMessage) {
-        const stat = rejectSymlink
-            ? fs.lstatSync(resolvedPath, { bigint: true })
-            : fs.statSync(resolvedPath, { bigint: true });
-        if (rejectSymlink && stat.isSymbolicLink()) {
-            throw new FsSafeError("symlink", symlinkMessage);
-        }
-        return stat;
-    }
-    const rejectHardlinks = options.rejectHardlinks !== false;
-    assertSecretFilePreview(previewStat, label, resolvedPath, maxBytes, rejectHardlinks);
+    const { resolvedPath, maxBytes, rejectSymlink, rejectHardlinks, previewStat, inspectInput } = prepareSecretRead(filePath, label, options);
     const opened = openPinnedFileSync({
         filePath: resolvedPath,
         rejectPathSymlink: rejectSymlink,
@@ -53,29 +30,19 @@ export function readSecretFileSync(filePath, label, options = {}) {
     }
     let raw;
     try {
-        const openedIdentity = inspectFileIdentitySync(() => {
-            const stat = fs.fstatSync(opened.fd, { bigint: true });
-            if (!stat.isFile() || (rejectHardlinks && stat.nlink > 1n)) {
-                throw new FsSafeError("path-mismatch", "security validation failed");
-            }
-            return stat;
-        }, previewStat);
-        inspectFileIdentitySync(() => {
-            const stat = fs.lstatSync(opened.path, { bigint: true });
-            if (!stat.isFile() || (rejectHardlinks && stat.nlink > 1n)) {
-                throw new FsSafeError("path-mismatch", "security validation failed");
-            }
-            return stat;
-        }, openedIdentity);
+        // The pin already compared the descriptor and resolved name without yielding.
+        const openedIdentity = inspectFileIdentitySync(() => opened.identity, previewStat);
         inspectFileIdentitySync(() => inspectInput("secret path became a symlink"), openedIdentity);
         raw = readFileDescriptorBoundedSync(opened.fd, maxBytes).toString("utf8");
     }
     catch (error) {
+        try {
+            fs.closeSync(opened.fd);
+        }
+        catch { /* Preserve the read failure. */ }
         throw secretReadError(error instanceof FsSafeError ? error.code : "read-failed", "read", label, resolvedPath, error);
     }
-    finally {
-        fs.closeSync(opened.fd);
-    }
+    fs.closeSync(opened.fd);
     return trimSecretFileContent(raw, label, resolvedPath);
 }
 export function tryReadSecretFileSync(filePath, label, options = {}) {
@@ -313,6 +280,7 @@ async function materializeSecretFileAtomic(params, createOnly) {
         basename: fileName,
         mkdir: false,
         mode,
+        verifyPosixMode: true,
         sync: params.durable !== false,
         overwrite: !createOnly,
         input: { kind: "buffer", data: typeof params.content === "string" ? params.content : Buffer.from(params.content) },

package/node_modules/@openclaw/fs-safe/dist/secret-read-async.d.ts

@@ -1,4 +1,3 @@
 import { type SecretFileReadOptions } from "./secret-read-policy.js";
 export declare function readSecretFile(filePath: string, label: string, options?: SecretFileReadOptions): Promise<string>;
 export declare function tryReadSecretFile(filePath: string | undefined, label: string, options?: SecretFileReadOptions): Promise<string | undefined>;
-//# sourceMappingURL=secret-read-async.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secret-read-async.js

@@ -5,32 +5,11 @@ import { assertNoUnsafeDeviceReadPath } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { realpathSync } from "./realpath.js";
-import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
-import { assertSecretFilePreview, resolveSecretReadPolicy, secretPathErrorCode, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { prepareSecretRead, secretPathErrorCode, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export async function readSecretFile(filePath, label, options = {}) {
-    const { resolvedPath, maxBytes } = resolveSecretReadPolicy(filePath, label, options);
-    let rejectSymlink;
-    let previewStat;
-    try {
-        assertNoUnsafeDeviceReadPath(resolvedPath);
-        rejectSymlink = Boolean(options.rejectSymlink);
-        previewStat = inspectFileIdentitySync(() => inspectInput(`${label} file at ${resolvedPath} must not be a symlink.`));
-    }
-    catch (error) {
-        throw secretReadError(error instanceof FsSafeError ? error.code : secretPathErrorCode(error), "inspect", label, resolvedPath, error);
-    }
-    function inspectInput(symlinkMessage) {
-        const stat = rejectSymlink
-            ? fsSync.lstatSync(resolvedPath, { bigint: true })
-            : fsSync.statSync(resolvedPath, { bigint: true });
-        if (rejectSymlink && stat.isSymbolicLink()) {
-            throw new FsSafeError("symlink", symlinkMessage);
-        }
-        return stat;
-    }
-    const rejectHardlinks = options.rejectHardlinks !== false;
-    assertSecretFilePreview(previewStat, label, resolvedPath, maxBytes, rejectHardlinks);
+    const { resolvedPath, maxBytes, rejectHardlinks, previewStat, inspectInput } = prepareSecretRead(filePath, label, options);
     let handle;
     let raw;
     try {
@@ -39,20 +18,20 @@ export async function readSecretFile(filePath, label, options = {}) {
         assertNoUnsafeDeviceReadPath(realPath);
         handle = await fs.open(realPath, resolveReadOpenFlags());
         const openedHandle = handle;
-        const openedStat = await inspectFileIdentity(async () => {
+        const openedStat = inspectFileIdentitySync(() => {
             const stat = fsSync.fstatSync(openedHandle.fd, { bigint: true });
             if (!stat.isFile() || (rejectHardlinks && stat.nlink > 1n)) {
                 throw new FsSafeError("path-mismatch", "security validation failed");
             }
             return stat;
         }, previewStat);
-        await inspectFileIdentity(async () => {
+        inspectFileIdentitySync(() => {
             const stat = fsSync.lstatSync(realPath, { bigint: true });
             if (!stat.isFile())
                 throw new FsSafeError("path-mismatch", "security validation failed");
             return stat;
         }, openedStat);
-        await inspectFileIdentity(() => inspectInput("secret path became a symlink"), openedStat);
+        inspectFileIdentitySync(() => inspectInput("secret path became a symlink"), openedStat);
         raw = (await readFileHandleBounded(handle, maxBytes)).toString("utf8");
     }
     catch (error) {

package/node_modules/@openclaw/fs-safe/dist/secret-read-policy.d.ts

@@ -1,4 +1,4 @@
-import type { BigIntStats } from "node:fs";
+import { type BigIntStats } from "node:fs";
 import { FsSafeError, type FsSafeErrorCode } from "./errors.js";
 export declare const DEFAULT_SECRET_FILE_MAX_BYTES: number;
 export type SecretFileReadOptions = {
@@ -10,8 +10,11 @@ export declare function secretPathErrorCode(error: unknown): FsSafeErrorCode;
 export declare function secretReadError(code: FsSafeErrorCode, action: "inspect" | "read", label: string, resolvedPath: string, error: unknown): FsSafeError;
 export declare function assertSecretFilePreview(stat: BigIntStats, label: string, resolvedPath: string, maxBytes: number, rejectHardlinks: boolean): void;
 export declare function trimSecretFileContent(raw: string, label: string, resolvedPath: string): string;
-export declare function resolveSecretReadPolicy(filePath: string, label: string, options: SecretFileReadOptions): {
+export declare function prepareSecretRead(filePath: string, label: string, options: SecretFileReadOptions): {
     resolvedPath: string;
     maxBytes: number;
+    rejectSymlink: boolean;
+    rejectHardlinks: boolean;
+    previewStat: BigIntStats;
+    inspectInput: (symlinkMessage: string) => BigIntStats;
 };
-//# sourceMappingURL=secret-read-policy.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secret-read-policy.js

@@ -1,6 +1,9 @@
 import { normalizeMaxBytes } from "./byte-budget.js";
 import { resolveHomeRelativePath } from "./home-dir.js";
+import fs, {} from "node:fs";
+import { assertNoUnsafeDeviceReadPath } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export const DEFAULT_SECRET_FILE_MAX_BYTES = 16 * 1024;
 export function secretPathErrorCode(error) {
@@ -29,7 +32,7 @@ export function trimSecretFileContent(raw, label, resolvedPath) {
     }
     return secret;
 }
-export function resolveSecretReadPolicy(filePath, label, options) {
+export function prepareSecretRead(filePath, label, options) {
     const trimmedPath = filePath.trim();
     assertNoWindowsPathAlias(trimmedPath, "filesystem", `${label} file path uses a Windows filesystem namespace alias`);
     const resolvedPath = resolveHomeRelativePath(trimmedPath);
@@ -40,5 +43,26 @@ export function resolveSecretReadPolicy(filePath, label, options) {
     const maxBytes = normalizeMaxBytes(options.maxBytes, {
         defaultValue: DEFAULT_SECRET_FILE_MAX_BYTES,
     });
-    return { resolvedPath, maxBytes };
+    let rejectSymlink;
+    let previewStat;
+    try {
+        assertNoUnsafeDeviceReadPath(resolvedPath);
+        rejectSymlink = Boolean(options.rejectSymlink);
+        previewStat = inspectFileIdentitySync(() => inspectInput(`${label} file at ${resolvedPath} must not be a symlink.`));
+    }
+    catch (error) {
+        throw secretReadError(error instanceof FsSafeError ? error.code : secretPathErrorCode(error), "inspect", label, resolvedPath, error);
+    }
+    function inspectInput(symlinkMessage) {
+        const stat = rejectSymlink
+            ? fs.lstatSync(resolvedPath, { bigint: true })
+            : fs.statSync(resolvedPath, { bigint: true });
+        if (rejectSymlink && stat.isSymbolicLink()) {
+            throw new FsSafeError("symlink", symlinkMessage);
+        }
+        return stat;
+    }
+    const rejectHardlinks = options.rejectHardlinks !== false;
+    assertSecretFilePreview(previewStat, label, resolvedPath, maxBytes, rejectHardlinks);
+    return { resolvedPath, maxBytes, rejectSymlink, rejectHardlinks, previewStat, inspectInput };
 }

package/node_modules/@openclaw/fs-safe/dist/secret.d.ts

@@ -1,4 +1,3 @@
 export { createSecretFileAtomic, PRIVATE_SECRET_DIR_MODE, PRIVATE_SECRET_FILE_MODE, readSecretFileSync, tryReadSecretFileSync, writeSecretFileAtomic, } from "./secret-file.js";
 export { DEFAULT_SECRET_FILE_MAX_BYTES, type SecretFileReadOptions } from "./secret-read-policy.js";
 export { readSecretFile, tryReadSecretFile } from "./secret-read-async.js";
-//# sourceMappingURL=secret.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secure-file-windows.d.ts

@@ -1,10 +1,10 @@
 import type { BigIntStats, Stats } from "node:fs";
 import type { PermissionCheck } from "./permissions.js";
 type ExactIdentity = Pick<BigIntStats, "dev" | "ino">;
-export declare function inspectSecureWindowsDescriptor(params: {
+/** Both mechanisms inspect the same borrowed handle; the caller owns its lifetime. */
+export declare function inspectSecureWindowsFile(params: {
     fd: number;
     identity: ExactIdentity;
     stat: Stats;
-}): PermissionCheck;
+}): Promise<PermissionCheck>;
 export {};
-//# sourceMappingURL=secure-file-windows.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secure-file-windows.js

@@ -1,30 +1,12 @@
 import { FsSafeError } from "./errors.js";
 import { recordFileObservationFailure } from "./file-observation.js";
 import { getNativeBinding } from "./native.js";
+import { getFsSafeNativeConfig } from "./native-config.js";
+import { warnNativeFallback } from "./native-fallback-warning.js";
+import { inspectWindowsDescriptorCommand } from "./windows-security-command.js";
+import { validateSecureWindowsSecurityFacts } from "./windows-security-facts.js";
 const IDENTITY_RE = /^([0-9a-f]{8}):([0-9a-f]{16})$/;
-const SID_RE = /^s-\d+-\d+(?:-\d+)+$/;
-const OWNER_CLASSES = new Set(["current-user", "system", "administrators", "foreign"]);
 const TRUSTED_OWNER_CLASSES = new Set(["current-user", "system", "administrators"]);
-const SYSTEM_SID = "s-1-5-18";
-const ADMINISTRATORS_SID = "s-1-5-32-544";
-const WORLD_SIDS = new Set([
-    "s-1-1-0", "s-1-5-11", "s-1-5-32-545", "s-1-5-7",
-    "s-1-5-32-546", "s-1-5-4", "s-1-5-2",
-]);
-const GENERIC_READ = 0x8000_0000;
-const GENERIC_WRITE = 0x4000_0000;
-const GENERIC_ALL = 0x1000_0000;
-const DELETE_ACCESS = 0x0001_0000;
-const WRITE_DAC = 0x0004_0000;
-const WRITE_OWNER = 0x0008_0000;
-const FILE_READ_DATA = 0x0000_0001;
-const FILE_WRITE_DATA = 0x0000_0002;
-const FILE_APPEND_DATA = 0x0000_0004;
-const FILE_READ_EA = 0x0000_0008;
-const FILE_WRITE_EA = 0x0000_0010;
-const FILE_DELETE_CHILD = 0x0000_0040;
-const FILE_READ_ATTRIBUTES = 0x0000_0080;
-const FILE_WRITE_ATTRIBUTES = 0x0000_0100;
 function permissionUnverified(message, cause) {
     throw new FsSafeError("permission-unverified", message, cause === undefined ? {} : { cause });
 }
@@ -36,9 +18,6 @@ function identityMismatch() {
 function isRecord(value) {
     return typeof value === "object" && value !== null;
 }
-function isUint32(value) {
-    return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 0xffff_ffff;
-}
 function parseIdentity(value) {
     if (typeof value !== "string")
         identityMismatch();
@@ -50,122 +29,14 @@ function parseIdentity(value) {
         ino: BigInt(`0x${match[2]}`),
     };
 }
-function validateFlags(value) {
-    if (!isRecord(value))
-        return false;
-    const raw = value.raw;
-    if (!isUint32(raw) || (raw & ~0xdf) !== 0)
-        return false;
-    const fields = [
-        ["objectInherit", 0x01], ["containerInherit", 0x02],
-        ["noPropagateInherit", 0x04], ["inheritOnly", 0x08], ["inherited", 0x10],
-        ["successfulAccess", 0x40], ["failedAccess", 0x80],
-    ];
-    return fields.every(([field, bit]) => typeof value[field] === "boolean" && value[field] === ((raw & bit) !== 0));
-}
-function validateAce(value) {
-    return isRecord(value) && typeof value.sid === "string" && SID_RE.test(value.sid) &&
-        isUint32(value.mask) && (value.aceType === "allow" || value.aceType === "deny") &&
-        validateFlags(value.flags);
-}
-function canRead(mask) {
-    return (mask & (GENERIC_ALL | GENERIC_READ | FILE_READ_DATA | FILE_READ_EA |
-        FILE_READ_ATTRIBUTES)) !== 0;
-}
-function canWrite(mask) {
-    return (mask & (GENERIC_ALL | GENERIC_WRITE | FILE_WRITE_DATA | FILE_APPEND_DATA |
-        FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES | FILE_DELETE_CHILD | DELETE_ACCESS |
-        WRITE_DAC | WRITE_OWNER)) !== 0;
-}
-function expectedOwnerClass(facts) {
-    if (facts.ownerSid === facts.currentUserSid)
-        return "current-user";
-    if (facts.ownerSid === SYSTEM_SID)
-        return "system";
-    if (facts.ownerSid === ADMINISTRATORS_SID)
-        return "administrators";
-    return "foreign";
-}
-function validateSecurity(value) {
-    if (!isRecord(value))
-        permissionUnverified("Windows descriptor ACL facts were malformed");
-    const facts = value;
-    const booleans = [
-        "worldWritable", "groupWritable", "worldReadable", "groupReadable",
-        "fallbackRequired", "daclPresent", "isLocal", "aceListComplete",
-    ];
-    if (!booleans.every((field) => typeof facts[field] === "boolean") ||
-        typeof facts.ownerSid !== "string" || !SID_RE.test(facts.ownerSid) ||
-        typeof facts.currentUserSid !== "string" || !SID_RE.test(facts.currentUserSid) ||
-        typeof facts.ownerClass !== "string" || !OWNER_CLASSES.has(facts.ownerClass) ||
-        !Array.isArray(facts.unsupportedAceTypes) ||
-        !facts.unsupportedAceTypes.every(isUint32) ||
-        !Array.isArray(facts.aces) || !facts.aces.every(validateAce)) {
-        permissionUnverified("Windows descriptor ACL facts were malformed");
-    }
-    if (facts.ownerClass !== expectedOwnerClass(facts)) {
-        permissionUnverified("Windows descriptor owner facts were inconsistent");
-    }
-    if (facts.fallbackRequired || !facts.isLocal || !facts.aceListComplete ||
-        facts.unsupportedAceTypes.length !== 0) {
-        permissionUnverified("Windows descriptor ACL facts were incomplete or unsupported");
-    }
-    if (!facts.daclPresent && facts.aces.length !== 0) {
-        permissionUnverified("Windows descriptor DACL facts were inconsistent");
-    }
-    return facts;
-}
-function validatePermissionSummary(facts) {
-    let worldReadable = !facts.daclPresent;
-    let worldWritable = !facts.daclPresent;
-    let groupReadable = false;
-    let groupWritable = false;
-    const trustedSids = new Set([facts.currentUserSid, SYSTEM_SID, ADMINISTRATORS_SID]);
-    for (const ace of facts.aces) {
-        if (ace.aceType !== "allow" || ace.flags.inheritOnly || trustedSids.has(ace.sid))
-            continue;
-        const world = WORLD_SIDS.has(ace.sid);
-        if (world) {
-            worldReadable ||= canRead(ace.mask);
-            worldWritable ||= canWrite(ace.mask);
-        }
-        else {
-            groupReadable ||= canRead(ace.mask);
-            groupWritable ||= canWrite(ace.mask);
-        }
-    }
-    if (facts.worldReadable !== worldReadable || facts.worldWritable !== worldWritable ||
-        facts.groupReadable !== groupReadable || facts.groupWritable !== groupWritable) {
-        permissionUnverified("Windows descriptor ACL summary was inconsistent");
-    }
-}
-export function inspectSecureWindowsDescriptor(params) {
-    let native;
-    try {
-        native = getNativeBinding();
-    }
-    catch (cause) {
-        permissionUnverified("Windows descriptor ACL verification requires the matching native helper", cause);
-    }
-    const inspect = native?.inspectWindowsSecureFileHandle;
-    if (typeof inspect !== "function") {
-        permissionUnverified("Windows descriptor ACL verification requires an up-to-date native helper");
-    }
-    let result;
-    try {
-        result = inspect.call(native, params.fd);
-    }
-    catch (cause) {
-        permissionUnverified("Windows descriptor ACL verification failed", cause);
-    }
+function inspectDescriptorResult(params, result, mechanism) {
     if (!isRecord(result))
         permissionUnverified("Windows descriptor ACL facts were malformed");
     const observed = parseIdentity(result.identity);
     if (observed.dev !== params.identity.dev || observed.ino !== params.identity.ino) {
         identityMismatch();
     }
-    const facts = validateSecurity(result.security);
-    validatePermissionSummary(facts);
+    const facts = validateSecureWindowsSecurityFacts(result.security);
     return {
         ok: true,
         isSymlink: false,
@@ -179,8 +50,39 @@ export function inspectSecureWindowsDescriptor(params) {
         groupReadable: facts.groupReadable,
         ownerSid: facts.ownerSid,
         ownerTrusted: TRUSTED_OWNER_CLASSES.has(facts.ownerClass),
-        aclSummary: `native descriptor owner=${facts.ownerClass} world=` +
+        aclSummary: `${mechanism} descriptor owner=${facts.ownerClass} world=` +
             `${facts.worldReadable ? "r" : "-"}${facts.worldWritable ? "w" : "-"} ` +
             `group=${facts.groupReadable ? "r" : "-"}${facts.groupWritable ? "w" : "-"}`,
     };
 }
+/** Both mechanisms inspect the same borrowed handle; the caller owns its lifetime. */
+export async function inspectSecureWindowsFile(params) {
+    let native;
+    try {
+        native = getNativeBinding();
+    }
+    catch (cause) {
+        permissionUnverified("Windows descriptor ACL verification requires the matching native helper", cause);
+    }
+    const inspect = native?.inspectWindowsSecureFileHandle;
+    const nativeAvailable = typeof inspect === "function";
+    if (!nativeAvailable && getFsSafeNativeConfig().mode === "require") {
+        permissionUnverified("Windows descriptor ACL verification requires an up-to-date native helper");
+    }
+    if (!nativeAvailable) {
+        warnNativeFallback("windows-secure-file", "Windows descriptor ACL inspection uses a slower built-in system command.");
+    }
+    let result;
+    try {
+        if (nativeAvailable) {
+            result = inspect.call(native, params.fd);
+        }
+        else {
+            result = await inspectWindowsDescriptorCommand(params.fd);
+        }
+    }
+    catch (cause) {
+        permissionUnverified("Windows descriptor ACL verification failed", cause);
+    }
+    return inspectDescriptorResult(params, result, nativeAvailable ? "native" : "system-command");
+}

package/node_modules/@openclaw/fs-safe/dist/secure-file.d.ts

@@ -29,4 +29,3 @@ export type SecureFileReadResult = {
     permissions?: PermissionCheck;
 };
 export declare function readSecureFile(options: SecureFileReadOptions): Promise<SecureFileReadResult>;
-//# sourceMappingURL=secure-file.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secure-file.js

@@ -12,8 +12,8 @@ import { formatPermissionErrorDetail } from "./permission-exec.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { realpathSync } from "./realpath.js";
 import { inspectPathPermissions, isGroupReadable, isGroupWritable, isWorldReadable, isWorldWritable, modeBits, } from "./permissions.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
-import { inspectSecureWindowsDescriptor } from "./secure-file-windows.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { inspectSecureWindowsFile } from "./secure-file-windows.js";
 import { scheduleTimeout } from "./timing.js";
 import { anchorWindowsDriveRelativePath, assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 function snapshotTrustedDirs(dirs) {
@@ -139,9 +139,9 @@ async function openSecureHandle(options, maxBytes) {
         if (!openedStat.isFile()) {
             throw new FsSafeError("not-file", `${label(options)} must be a file: ${options.filePath}`);
         }
-        const openedIdentity = await inspectFileIdentity(() => fsSync.fstatSync(handle.fd, { bigint: true }));
+        const openedIdentity = inspectFileIdentitySync(() => fsSync.fstatSync(handle.fd, { bigint: true }));
         assertNotHardlinked(options, openedIdentity);
-        await inspectFileIdentity(async () => {
+        inspectFileIdentitySync(() => {
             const pathStat = options.trust?.allowSymlink
                 ? fsSync.statSync(options.filePath, { bigint: true })
                 : fsSync.lstatSync(options.filePath, { bigint: true });
@@ -153,7 +153,7 @@ async function openSecureHandle(options, maxBytes) {
         }, openedIdentity);
         const realPath = realpathSync.native(options.filePath);
         assertNoWindowsPathAlias(realPath, "filesystem", `${label(options)} resolved path uses a Windows filesystem namespace alias`);
-        await inspectFileIdentity(() => {
+        inspectFileIdentitySync(() => {
             const realPathStat = fsSync.statSync(realPath, { bigint: true });
             assertNotHardlinked(options, realPathStat);
             return realPathStat;
@@ -168,11 +168,11 @@ async function openSecureHandle(options, maxBytes) {
         throw err;
     }
 }
-async function assertTrustedDirs(options, realPath) {
+function assertTrustedDirs(options, realPath) {
     if (!options.trust?.trustedDirs || options.trust.trustedDirs.length === 0) {
         return;
     }
-    const trusted = await Promise.all(options.trust.trustedDirs.map(async (dir) => {
+    const trusted = options.trust.trustedDirs.map((dir) => {
         let realPath;
         try {
             realPath = realpathSync.native(dir);
@@ -182,7 +182,7 @@ async function assertTrustedDirs(options, realPath) {
         }
         assertNoWindowsPathAlias(realPath, "filesystem", "trusted directory uses a Windows filesystem namespace alias");
         return realPath;
-    }));
+    });
     if (!trusted.some((dir) => isPathInside(dir, realPath))) {
         throw new FsSafeError("outside-workspace", `${label(options)} is outside trustedDirs: ${realPath}`);
     }
@@ -209,7 +209,7 @@ async function assertSecurePermissions(options, stat, realPath, identity, fd) {
     const platform = options.inject?.platform ?? process.platform;
     const permissions = platform === "win32"
         ? process.platform === "win32"
-            ? inspectSecureWindowsDescriptor({ fd, identity, stat })
+            ? await inspectSecureWindowsFile({ fd, identity, stat })
             : await inspectPathPermissions(realPath, options.inject)
         : inspectOpenedPermissions(stat, platform);
     const reason = permissions.error ? `: ${formatPermissionErrorDetail(permissions.error)}` : "";
@@ -281,10 +281,10 @@ export async function readSecureFile(options) {
     assertNoWindowsPathAlias(options.filePath, "filesystem", `${label(options)} path uses a Windows filesystem namespace alias`);
     const opened = await openSecureHandle(options, maxBytes);
     try {
-        await assertTrustedDirs(options, opened.realPath);
+        assertTrustedDirs(options, opened.realPath);
         const permissions = await assertSecurePermissions(options, opened.pathStat, opened.realPath, opened.identity, opened.handle.fd);
         const buffer = await readHandleWithTimeout(opened.handle, options.io?.timeoutMs, maxBytes);
-        const finalIdentity = await inspectFileIdentity(() => fsSync.fstatSync(opened.handle.fd, { bigint: true }), opened.identity);
+        const finalIdentity = inspectFileIdentitySync(() => fsSync.fstatSync(opened.handle.fd, { bigint: true }), opened.identity);
         if (!finalIdentity.isFile()) {
             throw new FsSafeError("not-file", `${label(options)} must remain a file: ${options.filePath}`);
         }

package/node_modules/@openclaw/fs-safe/dist/secure-temp-dir.d.ts

@@ -27,4 +27,3 @@ export type ResolveSecureTempRootOptions = {
     warningPrefix?: string;
 };
 export declare function resolveSecureTempRoot(options: ResolveSecureTempRootOptions): string;
-//# sourceMappingURL=secure-temp-dir.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secure-temp-repair.d.ts

@@ -32,4 +32,3 @@ export declare function secureTempDirectoryReceipt(stat: ExactDirectoryStat, uid
 /** No pathname chmod, search-only descriptors, procfs, or reopening fallback. */
 export declare function repairSecureTempDirectory(candidate: string, expected: SecureTempDirectoryReceipt, uid: number, adapter: SecureTempRepairAdapter, access: () => void, repaired: () => void, finalize?: boolean): void;
 export {};
-//# sourceMappingURL=secure-temp-repair.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secure-temp-repair.js

@@ -14,9 +14,13 @@ export function captureSecureTempRepairAdapter(supplied, hasLegacyFsHooks) {
     }
     return { lstatSync, fstatSync, openSync, fchmodSync, closeSync, flags: O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_NONBLOCK };
 }
+// Node exposes stat identity through BigInt64Array; a high OS bit can be negative.
+// Preserve raw values and existing positive adapter receipts, never normalize them.
+const MIN_NODE_STAT_IDENTITY = -(1n << 63n);
 export function secureTempDirectoryReceipt(stat, uid) {
     const { dev, ino, uid: owner, mode } = stat;
-    if (typeof dev !== "bigint" || dev < 0n || typeof ino !== "bigint" || ino <= 0n ||
+    if (typeof dev !== "bigint" || dev < MIN_NODE_STAT_IDENTITY ||
+        typeof ino !== "bigint" || ino < MIN_NODE_STAT_IDENTITY || ino === 0n ||
         typeof owner !== "bigint" || owner !== BigInt(uid) || typeof mode !== "bigint" ||
         mode < 0n || mode > 0xffffffffn || (mode & 61440n) !== 16384n ||
         stat.isDirectory() !== true || stat.isSymbolicLink() !== false) {

package/node_modules/@openclaw/fs-safe/dist/sibling-staged-file.d.ts

@@ -15,4 +15,3 @@ export declare function writeCallbackSibling<T>(params: {
     filePath: string;
     result: T;
 }>;
-//# sourceMappingURL=sibling-staged-file.d.ts.map