@openclaw/openshell-sandbox 2026.9.5 → 2026.9.7

package/node_modules/@openclaw/fs-safe/dist/advanced.d.ts

@@ -1,13 +1,19 @@
 export { createAsyncLock } from "./async-lock.js";
-export { copyFileHandle, type CopyFileHandleOptions } from "./file-handle-transfer.js";
+export { createDirectory, createDirectorySync, createFileSync, type CreateDirectoryOptions, type CreateFileOptions, type OwnedFileDescriptorSync, } from "./create.js";
+export { copyFileHandle, copyFileDescriptorSync, type CopyFileHandleOptions } from "./file-handle-transfer.js";
+export { sameFileContentsSync, type SameFileContentsOptions } from "./file-contents.js";
 export { overwriteFileHandle, type OverwriteFileHandleOptions } from "./overwrite-file-handle.js";
 export { probePathCaseInsensitiveSync, type ProbePathCaseOptions } from "./path-case.js";
 export { resolvePathPrefixSync, type ResolvedPathPrefix } from "./path-prefix.js";
 export { probePathSuffixAliasesSync, type ProbePathSuffixAliasesOptions } from "./path-suffix-aliases.js";
 export { readDirectoryIdentity, assertDirectoryIdentitySync, type DirectoryIdentity, } from "./directory-guard.js";
-export { stageFileInDirectory, type StagedFile, type StagedFileReceipt, type PublishedFileReceipt, type StagedFilePublication, type StagedFileCleanupReceipt, type StagedFileFailureDetails, } from "./native-staged-file.js";
+export { stageFileInDirectory, } from "./native-staged-file.js";
+export { retainSymlinkInDirectory } from "./native-staged-symlink.js";
+export type { StagedSymlink, StagedSymlinkExpected, StagedSymlinkReceipt, PublishedSymlinkReceipt, StagedSymlinkPublication, StagedSymlinkRemoval, StagedSymlinkCleanupReceipt, StagedSymlinkFailureDetails, } from "./staged-symlink-types.js";
+export type { StagedFile, StagedFileReceipt, PublishedFileReceipt, StagedFilePublication, StagedFileCleanupReceipt, StagedFileFailureDetails, } from "./staged-file-types.js";
 export { readFileDescriptorBounded, readFileDescriptorBoundedSync, readFileHandleBounded, } from "./bounded-read.js";
 export { readFileWindowFully, readFileWindowFullySync, type ReadFileWindowOptions, } from "./positional-read.js";
+export { writeFileWindowFully, type WriteFileWindowOptions } from "./write-file-handle.js";
 export { assertNoUnsafeDeviceReadPath, isUnsafeDeviceReadPath, matchUnsafeDeviceReadPath, type UnsafeDeviceReadPathMatch, type UnsafeDeviceReadPathOptions, type UnsafeDeviceReadPathReason, } from "./device-path.js";
 export { assertAbsolutePathInput, canonicalPathFromExistingAncestor, ensureAbsoluteDirectory, findExistingAncestor, resolveAbsolutePathForRead, resolveAbsolutePathForWrite, type AbsolutePathSymlinkPolicy, type EnsureAbsoluteDirectoryOptions, type EnsureAbsoluteDirectoryResult, type ResolvedAbsolutePath, type ResolvedWritableAbsolutePath, } from "./absolute-path.js";
 export { sameFileIdentity, type FileIdentityStat } from "./file-identity.js";
@@ -29,5 +35,7 @@ export { resolveHomeRelativePath } from "./home-dir.js";
 export { appendRegularFile, appendRegularFileSync, readRegularFile, readRegularFileSync, resolveRegularFileAppendFlags, statRegularFile, statRegularFileSync, type AppendRegularFileOptions, type RegularFileStatResult, } from "./regular-file.js";
 export { buildRandomTempFilePath, sanitizeTempFileName, type TempFile, tempFile, withTempFile, } from "./temp-target.js";
 export { writeSiblingTempFile, writeViaSiblingTempPath, type WriteSiblingTempFileOptions, type WriteSiblingTempFileResult, } from "./sibling-temp.js";
-export { createIcaclsResetCommand, formatIcaclsResetCommand, formatWindowsAclSummary, inspectWindowsAcl, parseIcaclsOutput, resolveWindowsUserPrincipal, summarizeWindowsAcl, type IcaclsResetCommandOptions, type PermissionCommandFailure, type PermissionExec, type WindowsAclEntry, type WindowsAclSummary, } from "./permissions.js";
-//# sourceMappingURL=advanced.d.ts.map
+export { createIcaclsResetCommand, formatIcaclsResetCommand, formatWindowsAclSummary, inspectWindowsAcl, parseIcaclsOutput, resolveWindowsUserPrincipal, summarizeWindowsAcl, type IcaclsResetCommandOptions, type PermissionExec, type WindowsAclEntry, type WindowsAclSummary, } from "./permissions-windows.js";
+export type { PermissionCommandFailure } from "./permission-exec.js";
+export { retainFileInDirectory } from "./retained-file.js";
+export type { RetainedFile, RetainedFileAdmission, RetainedFileExpected, RetainedFileIssue, RetainedFileReceipt, RetainedFileResult, RetainFileInDirectoryOptions, } from "./retained-file-types.js";

package/node_modules/@openclaw/fs-safe/dist/advanced.js

@@ -2,15 +2,19 @@
 // public subpaths; prefer root/json/store/temp/archive unless you are building a
 // higher-level primitive.
 export { createAsyncLock } from "./async-lock.js";
-export { copyFileHandle } from "./file-handle-transfer.js";
+export { createDirectory, createDirectorySync, createFileSync, } from "./create.js";
+export { copyFileHandle, copyFileDescriptorSync } from "./file-handle-transfer.js";
+export { sameFileContentsSync } from "./file-contents.js";
 export { overwriteFileHandle } from "./overwrite-file-handle.js";
 export { probePathCaseInsensitiveSync } from "./path-case.js";
 export { resolvePathPrefixSync } from "./path-prefix.js";
 export { probePathSuffixAliasesSync } from "./path-suffix-aliases.js";
 export { readDirectoryIdentity, assertDirectoryIdentitySync, } from "./directory-guard.js";
 export { stageFileInDirectory, } from "./native-staged-file.js";
+export { retainSymlinkInDirectory } from "./native-staged-symlink.js";
 export { readFileDescriptorBounded, readFileDescriptorBoundedSync, readFileHandleBounded, } from "./bounded-read.js";
 export { readFileWindowFully, readFileWindowFullySync, } from "./positional-read.js";
+export { writeFileWindowFully } from "./write-file-handle.js";
 export { assertNoUnsafeDeviceReadPath, isUnsafeDeviceReadPath, matchUnsafeDeviceReadPath, } from "./device-path.js";
 export { assertAbsolutePathInput, canonicalPathFromExistingAncestor, ensureAbsoluteDirectory, findExistingAncestor, resolveAbsolutePathForRead, resolveAbsolutePathForWrite, } from "./absolute-path.js";
 export { sameFileIdentity } from "./file-identity.js";
@@ -32,4 +36,5 @@ export { resolveHomeRelativePath } from "./home-dir.js";
 export { appendRegularFile, appendRegularFileSync, readRegularFile, readRegularFileSync, resolveRegularFileAppendFlags, statRegularFile, statRegularFileSync, } from "./regular-file.js";
 export { buildRandomTempFilePath, sanitizeTempFileName, tempFile, withTempFile, } from "./temp-target.js";
 export { writeSiblingTempFile, writeViaSiblingTempPath, } from "./sibling-temp.js";
-export { createIcaclsResetCommand, formatIcaclsResetCommand, formatWindowsAclSummary, inspectWindowsAcl, parseIcaclsOutput, resolveWindowsUserPrincipal, summarizeWindowsAcl, } from "./permissions.js";
+export { createIcaclsResetCommand, formatIcaclsResetCommand, formatWindowsAclSummary, inspectWindowsAcl, parseIcaclsOutput, resolveWindowsUserPrincipal, summarizeWindowsAcl, } from "./permissions-windows.js";
+export { retainFileInDirectory } from "./retained-file.js";

package/node_modules/@openclaw/fs-safe/dist/archive-crc32.d.ts

@@ -1,2 +1 @@
 export declare function updateCrc32(previous: number, buffer: Buffer): number;
-//# sourceMappingURL=archive-crc32.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-deadline.d.ts

@@ -9,4 +9,3 @@ export declare function ownExtractionDestinationMutation<T>(deadline: Extraction
 export declare function createPipelineTimeoutError(err: unknown, deadline: ExtractionDeadline): unknown;
 export declare function waitForDeadline<T>(promise: Promise<T>, deadline: ExtractionDeadline): Promise<T>;
 export declare function withExtractionDeadline<T>(timeoutMs: number, label: string, run: (deadline: ExtractionDeadline) => Promise<T>): Promise<T>;
-//# sourceMappingURL=archive-deadline.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-deadline.js

@@ -18,11 +18,13 @@ export function createPipelineTimeoutError(err, deadline) {
     return err;
 }
 export async function waitForDeadline(promise, deadline) {
+    // An elapsed synchronous check must not orphan a later operation rejection.
+    void promise.catch(() => undefined);
     deadline.check();
     if (deadline.signal.aborted) {
         throw deadlineReason(deadline);
     }
-    return await Promise.race([
+    const result = await Promise.race([
         promise,
         new Promise((_, reject) => {
             const abort = () => reject(deadlineReason(deadline));
@@ -33,21 +35,26 @@ export async function waitForDeadline(promise, deadline) {
             promise.then(cleanup, cleanup);
         }),
     ]);
+    deadline.check();
+    return result;
 }
 function createDestinationMutationOwner(check) {
     const active = new Set();
     return {
         ownDestinationMutation: async (run) => {
             check();
-            const operation = Promise.resolve().then(run);
-            const tracked = operation.then(() => undefined, () => undefined);
-            active.add(tracked);
-            void tracked.finally(() => active.delete(tracked));
-            return await operation;
+            const operation = Promise.resolve().then(() => { check(); return run(); });
+            active.add(operation);
+            try {
+                return await operation;
+            }
+            finally {
+                active.delete(operation);
+            }
         },
         waitForDestinationMutations: async () => {
             while (active.size > 0) {
-                await Promise.all(active);
+                await Promise.allSettled(active);
             }
         },
     };
@@ -55,35 +62,27 @@ function createDestinationMutationOwner(check) {
 function createExtractionDeadline(timeoutMs, label) {
     const controller = new AbortController();
     const timeoutError = new Error(`${label} timed out after ${timeoutMs}ms`);
+    const enabled = Number.isFinite(timeoutMs) && timeoutMs > 0;
+    const startedAt = enabled ? performance.now() : 0;
     const check = () => {
+        if (enabled && !controller.signal.aborted && performance.now() - startedAt >= timeoutMs) {
+            controller.abort(timeoutError);
+        }
         if (controller.signal.aborted) {
             throw signalReason(controller.signal, timeoutError);
         }
     };
-    const mutationOwner = createDestinationMutationOwner(check);
-    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
-        return {
-            signal: controller.signal,
-            check,
-            ...mutationOwner,
-            dispose: () => undefined,
-        };
-    }
-    const cancelTimeout = scheduleTimeout(() => {
-        controller.abort(timeoutError);
-    }, timeoutMs);
     return {
         signal: controller.signal,
         check,
-        ...mutationOwner,
-        dispose: cancelTimeout,
+        ...createDestinationMutationOwner(check),
+        dispose: enabled ? scheduleTimeout(() => controller.abort(timeoutError), timeoutMs) : () => undefined,
     };
 }
 export async function withExtractionDeadline(timeoutMs, label, run) {
     const deadline = createExtractionDeadline(timeoutMs, label);
-    const operation = Promise.resolve().then(async () => await run(deadline));
+    const operation = Promise.resolve().then(() => { deadline.check(); return run(deadline); });
     try {
-        deadline.check();
         try {
             return await waitForDeadline(operation, deadline);
         }

package/node_modules/@openclaw/fs-safe/dist/archive-durability.d.ts

@@ -1,6 +1,6 @@
 import { type ExtractionDeadline } from "./archive-deadline.js";
 import { type ArchiveDirectoryGuard } from "./archive-staging.js";
-import type { PublishedWriteIdentity } from "./pinned-write.js";
+import type { PublishedWriteIdentity } from "./pinned-write-types.js";
 import type { Root } from "./root.js";
 export type ArchivePublishedFile = {
     relativePath: string;
@@ -21,4 +21,3 @@ export declare function finalizeArchivePublication(params: {
     durable: boolean;
     deadline?: ExtractionDeadline;
 }): Promise<void>;
-//# sourceMappingURL=archive-durability.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-durability.js

@@ -78,7 +78,7 @@ export async function finalizeArchivePublication(params) {
                     const env_1 = { stack: [], error: void 0, hasError: false };
                     try {
                         await assertGuards(file.guards);
-                        const opened = __addDisposableResource(env_1, await params.targetRoot.open(file.relativePath, { hardlinks: "reject", symlinks: "reject" })
+                        const opened = __addDisposableResource(env_1, await params.targetRoot.open(`./${file.relativePath}`, { hardlinks: "reject", symlinks: "reject" })
                             .catch((error) => {
                             if (error instanceof FsSafeError && (error.code === "hardlink" || error.code === "path-alias")) {
                                 throw createArchiveSymlinkTraversalError(file.relativePath);

package/node_modules/@openclaw/fs-safe/dist/archive-entry.d.ts

@@ -11,4 +11,3 @@ export declare function resolveArchiveOutputPath(params: {
     originalPath: string;
     escapeLabel?: string;
 }): string;
-//# sourceMappingURL=archive-entry.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-errors.d.ts

@@ -10,4 +10,3 @@ export declare class ArchiveFormatError extends Error {
 }
 export declare function isArchiveFormatErrorMessage(message: string): boolean;
 export declare function isArchiveTarPathErrorMessage(message: string): boolean;
-//# sourceMappingURL=archive-errors.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-gzip-tail.d.ts

@@ -18,4 +18,3 @@ export declare class GzipInput extends Writable {
 /** Check the immutable staged suffix from the first unused physical byte,
  * including later chunks the decoder may have consumed, before returning. */
 export declare function validateGzipContainerTail(filePath: string, consumed: number, signal?: AbortSignal): Promise<void>;
-//# sourceMappingURL=archive-gzip-tail.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-input.d.ts

@@ -16,4 +16,3 @@ export declare function stageArchiveFileForExtraction(params: {
     limits: ResolvedArchiveExtractLimits;
     deadline: ExtractionDeadline;
 }): Promise<StagedArchiveFile>;
-//# sourceMappingURL=archive-input.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-kind.d.ts

@@ -4,6 +4,4 @@ type ResolvePackedRootDirOptions = {
     rootMarkers?: string[];
 };
 export declare function resolvePackedRootDir(extractDir: string, options?: ResolvePackedRootDirOptions): Promise<string>;
-export declare function assertPortableArchiveKind(kind: ArchiveKind): void;
 export {};
-//# sourceMappingURL=archive-kind.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-kind.js

@@ -1,29 +1,23 @@
 import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { FsSafeError } from "./errors.js";
 import { getNativeBinding } from "./native.js";
 import { normalizeLowercaseStringOrEmpty } from "./string-coerce.js";
 const TAR_SUFFIXES = [".tgz", ".tar.gz", ".tar"];
-const NATIVE_TAR_SUFFIXES = [
+const COMPRESSED_TAR_SUFFIXES = [
     { suffixes: [".tbz2", ".tbz", ".tar.bz2"], kind: "tar-bzip2" },
     { suffixes: [".tzst", ".tar.zst", ".tar.zstd"], kind: "tar-zstd" },
 ];
-function requireNativeArchiveKind(kind) {
-    if (!getNativeBinding()) {
-        throw new FsSafeError("helper-unavailable", `${kind} archives require the matching optional native platform package; ` +
-            "install @openclaw/fs-safe with optional dependencies enabled on a supported platform and use FS_SAFE_NATIVE_MODE=auto or require");
-    }
-    return kind;
-}
 export function resolveArchiveKind(filePath) {
     const lower = normalizeLowercaseStringOrEmpty(filePath);
     if (lower.endsWith(".zip")) {
         return "zip";
     }
-    for (const { suffixes, kind } of NATIVE_TAR_SUFFIXES) {
+    for (const { suffixes, kind } of COMPRESSED_TAR_SUFFIXES) {
         if (suffixes.some((suffix) => lower.endsWith(suffix))) {
-            return requireNativeArchiveKind(kind);
+            // Preserve strict require diagnostics even when only resolving a suffix.
+            getNativeBinding();
+            return kind;
         }
     }
     if (TAR_SUFFIXES.some((suffix) => lower.endsWith(suffix))) {
@@ -75,9 +69,3 @@ export async function resolvePackedRootDir(extractDir, options) {
     }
     return path.join(extractDir, onlyDir);
 }
-export function assertPortableArchiveKind(kind) {
-    if (kind === "tar-zstd" || kind === "tar-bzip2") {
-        throw new FsSafeError("helper-unavailable", `${kind} archives require the matching optional native platform package; ` +
-            "install @openclaw/fs-safe with optional dependencies enabled on a supported platform and use FS_SAFE_NATIVE_MODE=auto or require");
-    }
-}

package/node_modules/@openclaw/fs-safe/dist/archive-limits.d.ts

@@ -54,4 +54,3 @@ export declare function createByteBudgetTracker(limits: ResolvedArchiveExtractLi
 export declare function createExtractBudgetTransform(params: {
     onChunkBytes: (bytes: number) => void;
 }): Transform;
-//# sourceMappingURL=archive-limits.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-merge.d.ts

@@ -14,10 +14,9 @@ type MergeParams = {
 type GuardedMergeParams = Pick<MergeParams, "sourceDir" | "deadline"> & {
     destinationGuard: ArchiveDirectoryGuard;
 };
-export declare function mergePlannedArchiveIntoDestination(params: GuardedMergeParams & {
-    entries: readonly ArchivePublicationEntry[];
+export declare function withStagedArchivePublication(params: Omit<GuardedMergeParams, "sourceDir"> & {
     durable?: boolean;
-}): Promise<void>;
+    entryUmask?: number;
+}, extract: (stagingDir: string) => Promise<readonly ArchivePublicationEntry[]>): Promise<void>;
 export declare function mergeExtractedTreeIntoDestination(params: MergeParams): Promise<void>;
 export {};
-//# sourceMappingURL=archive-merge.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-merge.js

@@ -2,22 +2,34 @@ import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { ownExtractionDestinationMutation } from "./archive-deadline.js";
-import { assertDirectoryIdentityGuard, assertResolvedInsideDestination, createDirectoryIdentityGuard, createArchiveSymlinkTraversalError, preparePrivateArchiveOutputPath, } from "./archive-staging.js";
-import {} from "./directory-mode-owner.js";
+import { assertDirectoryIdentityGuard, assertResolvedInsideDestination, createDirectoryIdentityGuard, createArchiveSymlinkTraversalError, preparePrivateArchiveOutputPath, withStagedArchiveDestination, } from "./archive-staging.js";
 import { pinNodeDirectoryForMode } from "./directory-mode-node.js";
+import { assertSyncDirectoryGuard, inspectDirectoryIdentitySync } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { formatErrorDetail } from "./error-detail.js";
-import { isPathInside } from "./path.js";
+import { isNotFoundPathError, isPathInside } from "./path.js";
 import { rootFromDirectoryGuard } from "./root-impl.js";
+import { admitPathInsideRoot } from "./root-boundary.js";
 import { realpathSync } from "./realpath.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
-import { onCopyPublication } from "./copy-publication.js";
+import { onCopyPublication, onCopySourceAdmission } from "./copy-publication.js";
 import { syncFileBestEffortSync } from "./file-sync.js";
 import { finalizeArchivePublication } from "./archive-durability.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
-export async function mergePlannedArchiveIntoDestination(params) {
-    assertMergePathInputs(params);
-    await mergeTree(params, params.entries, params.durable === true);
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+export async function withStagedArchivePublication(params, extract) {
+    await withStagedArchiveDestination({
+        destinationRealDir: params.destinationGuard.realPath,
+        run: async (stagingPath) => {
+            const sourceDir = realpathSync.native(stagingPath);
+            const entries = await extract(sourceDir);
+            params.deadline?.check();
+            const mergeParams = { ...params, sourceDir };
+            assertMergePathInputs(mergeParams);
+            await mergeTree(mergeParams, entries, params.durable === true, params.entryUmask);
+            params.deadline?.check();
+        },
+    });
 }
 export async function mergeExtractedTreeIntoDestination(params) {
     const sourceDir = params.sourceDir;
@@ -34,7 +46,7 @@ function assertMergePathInputs(params) {
     assertNoWindowsPathAlias(params.destinationGuard.dir);
     assertNoWindowsPathAlias(params.destinationGuard.realPath);
 }
-async function mergeTree(params, publication, durable = true) {
+async function mergeTree(params, publication, durable = true, entryUmask = 0) {
     const publishedFiles = [];
     const publishedDirectories = [];
     const check = () => params.deadline?.check();
@@ -58,6 +70,33 @@ async function mergeTree(params, publication, durable = true) {
         plan.set(stagedPath, entry);
     }
     const ancestors = [];
+    const sourceAncestors = [];
+    const assertSourceDirectory = (guard, canonical = false) => {
+        try {
+            // Child receipts already retain canonical ancestry. An exact no-follow
+            // observation checks each named association without re-running realpath.
+            if (canonical)
+                assertSyncDirectoryGuard(guard);
+            else
+                inspectDirectoryIdentitySync(guard.dir, guard.stat);
+        }
+        catch (error) {
+            if (error instanceof FsSafeError || isNotFoundPathError(error)) {
+                throw createArchiveSymlinkTraversalError(path.relative(params.sourceDir, guard.dir));
+            }
+            throw error;
+        }
+        check();
+    };
+    const assertSourceFrontier = () => {
+        const current = sourceAncestors.at(-1);
+        if (current)
+            assertSourceDirectory(current);
+    };
+    const assertSourceAncestors = () => {
+        for (const ancestor of sourceAncestors)
+            assertSourceDirectory(ancestor);
+    };
     const assertGuards = async () => {
         await assertDirectoryIdentityGuard(destinationGuard);
         check();
@@ -72,15 +111,21 @@ async function mergeTree(params, publication, durable = true) {
     };
     const walk = async (sourceDir) => {
         await assertGuards();
+        assertSourceFrontier();
         const entries = await fs.readdir(sourceDir, { withFileTypes: true });
         check();
+        if (entries.length === 0) {
+            await assertGuards();
+            assertSourceFrontier();
+        }
         for (const entry of entries) {
             await assertGuards();
+            assertSourceFrontier();
             const sourcePath = path.join(sourceDir, entry.name);
             const relPath = path.relative(params.sourceDir, sourcePath);
             const originalPath = relPath.split(path.sep).join("/");
             const destinationPath = path.join(destinationDir, relPath);
-            const sourceStat = fsSync.lstatSync(sourcePath);
+            const sourceStat = inspectFileIdentitySync(() => fsSync.lstatSync(sourcePath, { bigint: true }));
             check();
             if (sourceStat.isSymbolicLink())
                 throw createArchiveSymlinkTraversalError(originalPath);
@@ -96,68 +141,99 @@ async function mergeTree(params, publication, durable = true) {
             if (plan && ((planned && planned.kind !== kind) || (!planned && kind === "file"))) {
                 throw new FsSafeError("path-mismatch", "archive staging disagrees with the admitted publication plan");
             }
-            const mode = plan ? planned?.mode ?? 0o755 : sourceStat.mode & 0o777;
+            let mode = plan ? (planned?.mode ?? 0o755) & ~entryUmask : Number(sourceStat.mode & 511n);
             await preparePrivateArchiveOutputPath({
                 destinationDir, destinationRealDir, deadline: params.deadline,
                 relPath, outPath: destinationPath, originalPath, isDirectory: kind === "directory",
             }, assertGuards, destinationGuard);
             check();
             if (kind === "directory") {
-                // Ownership spans open, descendants, finalization and close, including timeout.
-                await ownExtractionDestinationMutation(params.deadline, async () => {
-                    await assertGuards();
-                    const owner = await pinNodeDirectoryForMode(destinationPath).catch((error) => {
-                        if (error instanceof FsSafeError && (error.code === "not-file" || error.code === "path-mismatch")) {
-                            throw createArchiveSymlinkTraversalError(originalPath);
-                        }
-                        throw error;
-                    });
-                    try {
-                        check();
-                        const guard = await createDirectoryIdentityGuard(destinationPath);
-                        check();
-                        await owner.verify(check);
-                        ancestors.push({ guard, owner });
-                        try {
-                            await walk(sourcePath);
-                            if (publication) {
-                                await assertGuards();
-                                publishedDirectories.push({ guard, mode, parents: ancestors.slice(0, -1).map((ancestor) => ancestor.guard) });
-                                return;
+                // Retain the observation made before output preparation: recapturing
+                // here could silently authorize a replacement source directory.
+                sourceAncestors.push({ dir: sourcePath, realPath: sourceReal, stat: sourceStat });
+                try {
+                    // Ownership spans open, descendants, finalization and close, including timeout.
+                    await ownExtractionDestinationMutation(params.deadline, async () => {
+                        await assertGuards();
+                        assertSourceFrontier();
+                        const owner = await pinNodeDirectoryForMode(destinationPath).catch((error) => {
+                            if (error instanceof FsSafeError && (error.code === "not-file" || error.code === "path-mismatch")) {
+                                throw createArchiveSymlinkTraversalError(originalPath);
                             }
-                            await getFsSafeTestHooks()?.beforeArchiveOutputMutation?.("chmod", destinationPath);
+                            throw error;
+                        });
+                        try {
                             check();
-                            await assertGuards();
-                            // Do not recursively verify this owner from inside its serialized apply.
-                            ancestors.pop();
-                            await owner.apply(mode, { check, beforeChmod: async () => {
-                                    await assertGuards();
-                                    await assertDirectoryIdentityGuard(guard);
-                                    check();
-                                    await assertResolvedInsideDestination({
-                                        destinationRealDir, targetPath: destinationPath, originalPath,
-                                    });
-                                    check();
-                                } });
+                            const guard = await createDirectoryIdentityGuard(destinationPath);
                             check();
-                            await assertGuards();
+                            await owner.verify(check);
+                            ancestors.push({ guard, owner });
+                            try {
+                                await walk(sourcePath);
+                                if (publication) {
+                                    await assertGuards();
+                                    assertSourceAncestors();
+                                    publishedDirectories.push({ guard, mode, parents: ancestors.slice(0, -1).map((ancestor) => ancestor.guard) });
+                                    return;
+                                }
+                                await getFsSafeTestHooks()?.beforeArchiveOutputMutation?.("chmod", destinationPath);
+                                check();
+                                await assertGuards();
+                                // Do not recursively verify this owner from inside its serialized apply.
+                                ancestors.pop();
+                                await owner.apply(mode, { check, beforeChmod: async () => {
+                                        await assertGuards();
+                                        assertSourceAncestors();
+                                        await assertDirectoryIdentityGuard(guard);
+                                        check();
+                                        await assertResolvedInsideDestination({
+                                            destinationRealDir, targetPath: destinationPath, originalPath,
+                                        });
+                                        check();
+                                    } });
+                                check();
+                                await assertGuards();
+                                assertSourceAncestors();
+                            }
+                            finally {
+                                if (ancestors.at(-1)?.owner === owner)
+                                    ancestors.pop();
+                            }
                         }
                         finally {
-                            if (ancestors.at(-1)?.owner === owner)
-                                ancestors.pop();
+                            await owner.close();
                         }
-                    }
-                    finally {
-                        await owner.close();
-                    }
-                });
+                    });
+                }
+                finally {
+                    sourceAncestors.pop();
+                }
             }
             else {
                 await ownExtractionDestinationMutation(params.deadline, async () => {
                     await assertGuards();
                     try {
                         const options = {
-                            mkdir: true, mode, durable: publication ? false : true,
+                            mkdir: false, mode, durable: publication ? false : true,
+                            [onCopySourceAdmission]: (identity, realPath) => {
+                                assertSourceDirectory(sourceGuard, true);
+                                assertSourceFrontier();
+                                inspectFileIdentitySync(() => identity, sourceStat);
+                                if (!admitPathInsideRoot({
+                                    rootPath: sourceGuard.realPath, candidatePath: realPath, rootIdentity: sourceGuard.stat,
+                                }))
+                                    throw createArchiveSymlinkTraversalError(originalPath);
+                                // Public merge permissions come from the admitted descriptor;
+                                // extraction keeps the separately admitted publication plan.
+                                if (!plan)
+                                    mode = Number(identity.mode & 511n);
+                                return { mode, verify() {
+                                        // Only copy publication boundaries scan the active chain.
+                                        // Destination mkdir callbacks must not multiply this work.
+                                        assertSourceDirectory(sourceGuard, true);
+                                        assertSourceAncestors();
+                                    } };
+                            },
                         };
                         if (publication && durable) {
                             options[onCopyPublication] = async (fd, identity) => {
@@ -174,7 +250,7 @@ async function mergeTree(params, publication, durable = true) {
                                 }
                             };
                         }
-                        await targetRoot.copyIn(relPath, sourcePath, options);
+                        await targetRoot.copyIn(`./${relPath}`, sourcePath, options);
                         check();
                         await assertGuards();
                         await assertResolvedInsideDestination({

package/node_modules/@openclaw/fs-safe/dist/archive-parser-errors.d.ts

@@ -1,2 +1 @@
 export declare function classifyArchiveParserError(message: string, options?: ErrorOptions): Error | undefined;
-//# sourceMappingURL=archive-parser-errors.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-plan.d.ts

@@ -1,5 +1,6 @@
 import type { ArchiveKind } from "./archive-kind.js";
-import type { ExtractArchiveOptions } from "./archive-options.js";
+import { type ResolvedArchiveExtractLimits, type ArchiveExtractLimits } from "./archive-limits.js";
+import type { ExtractionDeadline } from "./archive-deadline.js";
 export type ArchiveMemberKind = "file" | "directory" | "symlink" | "hardlink" | "blocked" | "sparse" | "other";
 export type ArchivePlanEntry = {
     path: string;
@@ -11,10 +12,74 @@ export type ArchivePlanOptions = Pick<ExtractArchiveOptions, "stripComponents" |
     rootDir?: string;
     escapeLabel?: string;
 };
+export declare function createArchiveEntrySelector(params: ArchivePlanOptions): {
+    limits: ResolvedArchiveExtractLimits;
+    select(entry: {
+        path: string;
+        kind: ArchiveEntryKind;
+        size: number;
+    }): string | null;
+};
 export declare function createArchiveEntryPlanner(params: ArchivePlanOptions, archiveKind: ArchiveKind): (entry: {
     path: string;
     kind: ArchiveMemberKind;
     size: number;
     mode?: number;
 }) => ArchivePlanEntry | null;
-//# sourceMappingURL=archive-plan.d.ts.map
+export type ArchiveEntryKind = "file" | "directory" | "symlink" | "other";
+export type ArchiveEntryModePolicy = "clamp" | "preserve";
+export type ArchiveFilteredEntryPolicy = "reject-archive" | "skip-entry";
+export type ArchiveEntryFilter = (entry: {
+    /** Validated canonical archive path before stripping: / separators, no empty or . components. */
+    path: string;
+    kind: ArchiveEntryKind;
+    size: number;
+}) => "extract" | "skip";
+export declare function archiveEntryKindFromTarType(type: string): ArchiveEntryKind;
+export declare function resolveArchiveEntryMode(params: {
+    kind: "file" | "directory";
+    archivedMode?: number | null;
+    policy?: ArchiveEntryModePolicy;
+}): number;
+export declare function resolveArchiveFilteredEntryPolicy(value: unknown): ArchiveFilteredEntryPolicy;
+export declare function shouldExtractArchiveEntry(params: {
+    filter?: ArchiveEntryFilter;
+    onFiltered?: ArchiveFilteredEntryPolicy;
+    entry: Parameters<ArchiveEntryFilter>[0];
+}): boolean;
+export type TarEntryInfo = {
+    path: string;
+    type: string;
+    size: number;
+    mode?: number;
+};
+export declare function createTarEntryPlanner(params: ArchivePlanOptions): (entry: TarEntryInfo) => ArchivePlanEntry | null;
+export declare function createTarEntryPreflightChecker(params: Omit<ArchivePlanOptions & {
+    rootDir: string;
+}, "entryModes">): (entry: TarEntryInfo) => boolean;
+export type ArchiveLogger = {
+    info?: (message: string) => void;
+    warn?: (message: string) => void;
+};
+export type ExtractArchiveOptions = {
+    archivePath: string;
+    destDir: string;
+    timeoutMs: number;
+    /** Sync published files and directories before returning. Defaults to false. */
+    durable?: boolean;
+    kind?: ArchiveKind;
+    stripComponents?: number;
+    tarGzip?: boolean;
+    limits?: ArchiveExtractLimits;
+    logger?: ArchiveLogger;
+    entryModes?: ArchiveEntryModePolicy;
+    /** Remove these rwx bits from final entry modes. Defaults to zero. */
+    entryUmask?: number;
+    entryFilter?: ArchiveEntryFilter;
+    onFiltered?: ArchiveFilteredEntryPolicy;
+};
+/** Private executors receive owned options and an already-staged archive path. */
+export type StagedArchiveExtractOptions = Pick<ExtractArchiveOptions, "archivePath" | "destDir" | "durable" | "stripComponents" | "entryModes" | "entryUmask" | "entryFilter" | "onFiltered"> & {
+    limits: ResolvedArchiveExtractLimits;
+    deadline: ExtractionDeadline;
+};