@openclaw/openshell-sandbox 2026.9.5 → 2026.9.7

package/node_modules/@openclaw/fs-safe/dist/archive-plan.js

@@ -1,36 +1,45 @@
 import { ArchiveFormatError, ArchiveSecurityError } from "./archive-errors.js";
 import { createArchiveOutputPathTracker, resolveArchiveOutputPath, stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
 import { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError, assertArchiveEntryCountWithinLimit, assertArchiveEntryPathComponentsWithinLimit, createByteBudgetTracker, resolveExtractLimits, } from "./archive-limits.js";
-import { resolveArchiveEntryMode, shouldExtractArchiveEntry } from "./archive-policy.js";
 import { formatErrorDetail } from "./error-detail.js";
-// Inspection and both executors decide over the same admitted identities.
-// A destination is optional only for inspection; writers still prove containment.
-export function createArchiveEntryPlanner(params, archiveKind) {
+// Portable ZIP selects each entry immediately before streaming its payload;
+// manifest-backed routes add declared-byte admission through the planner below.
+export function createArchiveEntrySelector(params) {
     const strip = Math.max(0, Math.floor(params.stripComponents ?? 0));
     const limits = resolveExtractLimits(params.limits);
-    const budget = createByteBudgetTracker(limits);
     const trackOutputPath = createArchiveOutputPathTracker();
     let entryCount = 0;
+    return { limits, select(entry) {
+            assertArchiveEntryCountWithinLimit(++entryCount, limits);
+            validateArchiveEntryPath(entry.path, { escapeLabel: params.escapeLabel });
+            const canonicalPath = stripArchivePath(entry.path, 0);
+            if (!canonicalPath)
+                return null;
+            const relPath = strip === 0 ? canonicalPath : stripArchivePath(canonicalPath, strip);
+            if (!relPath)
+                return null;
+            validateArchiveEntryPath(relPath, { escapeLabel: params.escapeLabel });
+            assertArchiveEntryPathComponentsWithinLimit(relPath, limits);
+            trackOutputPath(relPath, entry.path);
+            if (params.rootDir !== undefined) {
+                resolveArchiveOutputPath({ rootDir: params.rootDir, relPath, originalPath: entry.path,
+                    escapeLabel: params.escapeLabel });
+            }
+            if (!shouldExtractArchiveEntry({ filter: params.entryFilter, onFiltered: params.onFiltered,
+                entry: { path: canonicalPath, kind: entry.kind, size: entry.size } }))
+                return null;
+            return relPath;
+        } };
+}
+// A destination is optional only for inspection; writers still prove containment.
+export function createArchiveEntryPlanner(params, archiveKind) {
+    const { select, limits } = createArchiveEntrySelector(params);
+    const budget = createByteBudgetTracker(limits);
     return (entry) => {
-        assertArchiveEntryCountWithinLimit(++entryCount, limits);
-        validateArchiveEntryPath(entry.path, { escapeLabel: params.escapeLabel });
-        const canonicalPath = stripArchivePath(entry.path, 0);
-        if (!canonicalPath)
-            return null;
-        const relPath = strip === 0 ? canonicalPath : stripArchivePath(canonicalPath, strip);
-        if (!relPath)
-            return null;
-        validateArchiveEntryPath(relPath, { escapeLabel: params.escapeLabel });
-        assertArchiveEntryPathComponentsWithinLimit(relPath, limits);
-        trackOutputPath(relPath, entry.path);
-        if (params.rootDir !== undefined) {
-            resolveArchiveOutputPath({ rootDir: params.rootDir, relPath, originalPath: entry.path,
-                escapeLabel: params.escapeLabel });
-        }
         const kind = entry.kind === "file" || entry.kind === "directory" ? entry.kind
             : entry.kind === "symlink" || entry.kind === "hardlink" ? "symlink" : "other";
-        if (!shouldExtractArchiveEntry({ filter: params.entryFilter, onFiltered: params.onFiltered,
-            entry: { path: canonicalPath, kind, size: entry.size } }))
+        const relPath = select({ path: entry.path, kind, size: entry.size });
+        if (relPath === null)
             return null;
         if (entry.kind === "sparse") {
             throw new ArchiveFormatError(`GNU sparse archive entry is not supported: ${formatErrorDetail(entry.path)}`);
@@ -53,3 +62,58 @@ export function createArchiveEntryPlanner(params, archiveKind) {
             mode: resolveArchiveEntryMode({ kind, archivedMode: entry.mode, policy: params.entryModes }) };
     };
 }
+export function archiveEntryKindFromTarType(type) {
+    if (type === "Directory" || type === "GNUDumpDir")
+        return "directory";
+    if (type === "File" || type === "OldFile" || type === "ContiguousFile")
+        return "file";
+    if (type === "SymbolicLink" || type === "Link")
+        return "symlink";
+    return "other";
+}
+export function resolveArchiveEntryMode(params) {
+    const archivedMode = (params.archivedMode ?? 0) & 0o777;
+    if (params.policy === "preserve") {
+        return params.archivedMode == null ? (params.kind === "directory" ? 0o755 : 0o644) : archivedMode;
+    }
+    if (params.kind === "directory") {
+        return 0o755;
+    }
+    return archivedMode & 0o100 ? 0o755 : 0o644;
+}
+export function resolveArchiveFilteredEntryPolicy(value) {
+    if (value === undefined || value === "reject-archive")
+        return "reject-archive";
+    if (value === "skip-entry")
+        return "skip-entry";
+    throw new RangeError('archive onFiltered must be "reject-archive" or "skip-entry"');
+}
+export function shouldExtractArchiveEntry(params) {
+    const onFiltered = resolveArchiveFilteredEntryPolicy(params.onFiltered);
+    if (!params.filter || params.filter(params.entry) === "extract") {
+        return true;
+    }
+    if (onFiltered === "reject-archive") {
+        throw new ArchiveSecurityError("entry-filtered", `archive entry rejected by filter: ${formatErrorDetail(params.entry.path)}`);
+    }
+    return false;
+}
+const BLOCKED_TAR_ENTRY_TYPES = new Set([
+    "BlockDevice",
+    "CharacterDevice",
+    "FIFO",
+    "Socket",
+]);
+export function createTarEntryPlanner(params) {
+    // Preserve inherited/getter-backed public options and per-entry policy reads.
+    const plan = createArchiveEntryPlanner(params, "tar");
+    return (entry) => {
+        const kind = BLOCKED_TAR_ENTRY_TYPES.has(entry.type) ? "blocked" : archiveEntryKindFromTarType(entry.type);
+        // The public checker accepts structural entry objects, including class getters.
+        return plan({ path: entry.path, kind, size: entry.size, mode: entry.mode });
+    };
+}
+export function createTarEntryPreflightChecker(params) {
+    const plan = createTarEntryPlanner(params);
+    return (entry) => plan(entry) !== null;
+}

package/node_modules/@openclaw/fs-safe/dist/archive-read.d.ts

@@ -3,4 +3,3 @@ export declare function readArchiveEntry(archivePath: string, entryPath: string,
     maxBytes: number;
     kind?: ArchiveKind;
 }): Promise<Buffer>;
-//# sourceMappingURL=archive-read.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-read.js

@@ -7,11 +7,11 @@ import { readBoundedAsync } from "./bounded-read.js";
 import { ArchiveFormatError, ArchiveSecurityError, isArchiveFormatErrorMessage, } from "./archive-errors.js";
 import { formatErrorDetail } from "./error-detail.js";
 import { stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
-import { assertPortableArchiveKind, resolveArchiveKind } from "./archive-kind.js";
+import { resolveArchiveKind } from "./archive-kind.js";
 import { DEFAULT_MAX_ARCHIVE_BYTES_ZIP, ArchiveLimitError, ARCHIVE_LIMIT_ERROR_CODE, } from "./archive-limits.js";
 import { isGzipBuffer } from "./archive-gzip-tail.js";
 import { inspectTar, replayTar } from "./archive-tar-stream.js";
-import { loadAdmittedZipArchive } from "./archive-zip-loader.js";
+import { loadAdmittedZipArchive, assertZipEntryBinding } from "./archive-zip-loader.js";
 import { createZipIntegrityTransform, normalizeZipIntegrityError, } from "./archive-zip-integrity.js";
 import { FsSafeError } from "./errors.js";
 import { inspectFileIdentity } from "./strict-file-identity.js";
@@ -22,8 +22,6 @@ import { admitZipBuffer } from "./archive-zip-admission.js";
 import { validateNativeZipManifest } from "./archive-zip-manifest.js";
 import { resolveExtractLimits, resolveTarMeterLimits } from "./archive-limits.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
-const ZIP_UNIX_FILE_TYPE_MASK = 0o170000;
-const ZIP_UNIX_SYMLINK_TYPE = 0o120000;
 function canonicalEntryPath(entryPath) {
     validateArchiveEntryPath(entryPath, { escapeLabel: "archive root" });
     return stripArchivePath(entryPath, 0) ?? "";
@@ -94,26 +92,19 @@ async function readArchiveInput(archivePath) {
     }
 }
 async function readZipEntry(buffer, entryPath, maxBytes, admitted) {
-    const archive = await loadAdmittedZipArchive(buffer, admitted);
-    let entry;
-    // JSZip keys retain some aliases and may use Unicode Path metadata. Scan the
-    // effective entries once, after raw ZIP admission has rejected collisions.
-    for (const candidate of Object.values(archive.files)) {
-        if (canonicalEntryPath(candidate.name) !== entryPath)
-            continue;
-        if (entry) {
-            throw new ArchiveSecurityError("entry-path", `archive contains duplicate entry path: ${formatErrorDetail(entryPath)}`);
-        }
-        entry = candidate;
-    }
-    if (!entry || entry.dir) {
+    const { archive, entries } = await loadAdmittedZipArchive(buffer, admitted);
+    const record = entries.get(entryPath);
+    if (!record || record.entry.dir) {
         throw new Error(`archive entry not found: ${formatErrorDetail(entryPath)}`);
     }
-    if (typeof entry.unixPermissions === "number" &&
-        (entry.unixPermissions & ZIP_UNIX_FILE_TYPE_MASK) === ZIP_UNIX_SYMLINK_TYPE) {
+    assertZipEntryBinding(archive, record, entryPath);
+    const { entry, kind } = record;
+    if (kind === "symlink") {
         throw new Error(`archive entry is a link: ${formatErrorDetail(entryPath)}`);
     }
-    const integrity = createZipIntegrityTransform(entry);
+    if (kind !== "file")
+        throw new Error(`archive entry is not a file: ${formatErrorDetail(entryPath)}`);
+    const integrity = createZipIntegrityTransform(record);
     const stream = typeof entry.nodeStream === "function"
         ? entry.nodeStream()
         : Readable.from(await entry.async("nodebuffer"));
@@ -139,11 +130,11 @@ async function readZipEntry(buffer, entryPath, maxBytes, admitted) {
         throw normalizeZipIntegrityError(error);
     }
 }
-async function readTarEntry(archiveBuffer, entryPath, maxBytes) {
+async function readTarEntry(archiveBuffer, entryPath, maxBytes, kind) {
     const seenPaths = new Set();
     let selected;
     const limits = resolveTarMeterLimits();
-    await inspectTar({ archiveBuffer, limits, onMember(info) {
+    await inspectTar({ archiveBuffer, kind, limits, onMember(info) {
             const normalized = canonicalEntryPath(info.path);
             if (seenPaths.has(normalized)) {
                 throw new ArchiveSecurityError("entry-path", `archive contains duplicate entry path: ${formatErrorDetail(normalized)}`);
@@ -159,7 +150,7 @@ async function readTarEntry(archiveBuffer, entryPath, maxBytes) {
     }
     if (selected.size > maxBytes)
         throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.ENTRY_EXTRACTED_SIZE_EXCEEDS_LIMIT);
-    if (!isGzipBuffer(archiveBuffer)) {
+    if (kind === "tar" && !isGzipBuffer(archiveBuffer)) {
         // Complete admission already validated this private snapshot through EOF.
         // Copy the admitted payload so the result cannot expose or mutate its input.
         const end = selected.offset + selected.size;
@@ -170,7 +161,7 @@ async function readTarEntry(archiveBuffer, entryPath, maxBytes) {
         return Buffer.from(archiveBuffer.subarray(selected.offset, end));
     }
     let result;
-    await replayTar({ archiveBuffer, limits, members: [selected], async consume(member, payload) {
+    await replayTar({ archiveBuffer, kind, limits, members: [selected], async consume(member, payload) {
             result = await readAdmittedTarPayload(payload, member.size);
         } });
     return result;
@@ -238,7 +229,6 @@ export async function readArchiveEntry(archivePath, entryPath, options) {
     const native = getNativeBinding();
     if (native)
         return await readNativeBufferEntry(native, buffer, kind, requestedEntry, entryPath, options.maxBytes, zipEntries);
-    assertPortableArchiveKind(kind);
     return kind === "zip" ? await readZipEntry(buffer, requestedEntry, options.maxBytes, zipEntries)
-        : await readTarEntry(buffer, requestedEntry, options.maxBytes);
+        : await readTarEntry(buffer, requestedEntry, options.maxBytes, kind);
 }

package/node_modules/@openclaw/fs-safe/dist/archive-staging.d.ts

@@ -3,7 +3,6 @@ import { type AsyncDirectoryGuard } from "./directory-guard.js";
 import { type ExtractionDeadline } from "./archive-deadline.js";
 import { ArchiveSecurityError } from "./archive-errors.js";
 export type ArchiveDirectoryGuard = AsyncDirectoryGuard<BigIntStats>;
-export { ArchiveSecurityError, type ArchiveSecurityErrorCode } from "./archive-errors.js";
 export declare function createDirectoryIdentityGuard(dir: string): Promise<ArchiveDirectoryGuard>;
 export declare function assertDirectoryIdentityGuard(guard: ArchiveDirectoryGuard): Promise<void>;
 export declare function prepareArchiveDestinationGuard(destDir: string): Promise<ArchiveDirectoryGuard>;
@@ -29,6 +28,5 @@ export declare function withStagedArchiveDestination<T>(params: {
     stagingDirPrefix?: string;
     run: (stagingDir: string) => Promise<T>;
 }): Promise<T>;
-export { mergeExtractedTreeIntoDestination } from "./archive-merge.js";
 export declare function createArchiveSymlinkTraversalError(originalPath: string): ArchiveSecurityError;
-//# sourceMappingURL=archive-staging.d.ts.map
+export {};

package/node_modules/@openclaw/fs-safe/dist/archive-staging.js

@@ -21,7 +21,6 @@ const ARCHIVE_STAGING_MODE = 0o700;
 function checkExtractionDeadline(deadline) {
     deadline?.check();
 }
-export { ArchiveSecurityError } from "./archive-errors.js";
 function symlinkTraversalError(originalPath) {
     return new ArchiveSecurityError("destination-symlink-traversal", `${ERROR_ARCHIVE_ENTRY_TRAVERSES_SYMLINK}: ${formatErrorDetail(originalPath)}`);
 }
@@ -134,7 +133,9 @@ export async function assertResolvedInsideDestination(params) {
 }
 async function mkdirArchiveOutput(params) {
     try {
-        await params.targetRoot.mkdir(params.relativePath);
+        const relativePath = params.relativePath;
+        // Archive names are literal; retain Root.mkdir's admission without home expansion.
+        await params.targetRoot.mkdir(relativePath === "~" || relativePath.startsWith("~/") ? `./${relativePath}` : relativePath);
     }
     catch (error) {
         if (error instanceof FsSafeError) {
@@ -302,7 +303,6 @@ export async function withStagedArchiveDestination(params) {
         }
     }
 }
-export { mergeExtractedTreeIntoDestination } from "./archive-merge.js";
 export function createArchiveSymlinkTraversalError(originalPath) {
     return symlinkTraversalError(originalPath);
 }

package/node_modules/@openclaw/fs-safe/dist/archive-tar-stream.d.ts

@@ -1,3 +1,4 @@
+import type { ArchiveKind } from "./archive-kind.js";
 import type { TarMeterLimits } from "./archive-limits.js";
 import { type AdmittedTarMember } from "./archive-tar-wasm.js";
 /** Buffers are private immutable snapshots, just like the staged file route. */
@@ -11,6 +12,7 @@ type TarInput = {
 export declare function inspectTar(params: TarInput & {
     limits: TarMeterLimits;
     signal?: AbortSignal;
+    kind?: Exclude<ArchiveKind, "zip">;
     onMember?: (entry: AdmittedTarMember) => void;
 }): Promise<void>;
 /** Replay in physical order, retaining at most one decoded chunk. Every range
@@ -18,8 +20,8 @@ export declare function inspectTar(params: TarInput & {
 export declare function replayTar<T extends AdmittedTarMember>(params: TarInput & {
     limits: TarMeterLimits;
     signal?: AbortSignal;
+    kind?: Exclude<ArchiveKind, "zip">;
     members: readonly T[];
     consume(member: T, payload: AsyncIterable<Buffer>): Promise<void>;
 }): Promise<void>;
 export {};
-//# sourceMappingURL=archive-tar-stream.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-tar-stream.js

@@ -1,10 +1,10 @@
 import fs from "node:fs";
 import { Readable, Writable } from "node:stream";
-import { pipeline } from "node:stream/promises";
+import { finished, pipeline } from "node:stream/promises";
 import { createGunzip } from "node:zlib";
 import { GzipInput, isGzipBuffer, validateGzipBufferTail, validateGzipContainerTail } from "./archive-gzip-tail.js";
 import { ArchiveFormatError } from "./archive-errors.js";
-import { TarParserStream } from "./archive-tar-wasm.js";
+import { TarParserStream, TarWasmSession } from "./archive-tar-wasm.js";
 import { readFileWindowFully } from "./positional-read.js";
 function* bufferChunks(buffer) {
     for (let offset = 0; offset < buffer.length; offset += 65536)
@@ -23,45 +23,64 @@ async function gzipFile(filePath) {
 }
 async function withTarStream(params, consume) {
     const buffer = params.archiveBuffer;
-    const gzip = buffer !== undefined ? isGzipBuffer(buffer) : await gzipFile(params.archivePath);
-    const parser = new TarParserStream(params.limits, params.onMember);
-    const input = buffer !== undefined
-        ? Readable.from(bufferChunks(buffer), { objectMode: false, highWaterMark: 65536 })
-        : fs.createReadStream(params.archivePath, { highWaterMark: 65536 });
-    // Match the WASM input window for both staged files and buffered reads.
-    const decoder = gzip ? createGunzip({ chunkSize: 65536 }) : undefined;
-    const gzipInput = decoder ? new GzipInput(decoder) : undefined;
-    const destroy = (error) => {
-        input.destroy(error);
-        gzipInput?.destroy(error);
-        decoder?.destroy(error);
-        parser.destroy(error);
-    };
-    const pumps = decoder && gzipInput
-        ? [pipeline(decoder, parser, { signal: params.signal }), pipeline(input, gzipInput, { signal: params.signal })]
-        : [pipeline(input, parser, { signal: params.signal })];
-    // Either pump tears down both routes; join every pump even after the first failure.
-    const settled = Promise.all(pumps.map((pump) => pump.then(() => undefined, (cause) => {
-        const error = cause instanceof Error ? cause : new Error(String(cause));
-        destroy(error);
-        return error;
-    }))).then((errors) => errors.find((error) => error !== undefined));
+    const kind = params.kind ?? "tar";
+    const gzip = kind === "tar" && (buffer !== undefined ? isGzipBuffer(buffer) : await gzipFile(params.archivePath));
+    const session = new TarWasmSession(params.limits);
     try {
-        const result = await consume(parser);
-        const error = await settled;
-        if (error)
-            throw error;
-        if (gzipInput) {
-            if (buffer !== undefined)
-                await validateGzipBufferTail(buffer, gzipInput.tailOffset, params.signal);
-            else
-                await validateGzipContainerTail(params.archivePath, gzipInput.tailOffset, params.signal);
+        const parser = new TarParserStream(params.limits, params.onMember, session);
+        const input = buffer !== undefined
+            ? Readable.from(bufferChunks(buffer), { objectMode: false, highWaterMark: 65536 })
+            : fs.createReadStream(params.archivePath, { highWaterMark: 65536 });
+        // Match the WASM input window for both staged files and buffered reads.
+        const decoder = gzip ? createGunzip({ chunkSize: 65536 }) : undefined;
+        const gzipInput = decoder ? new GzipInput(decoder) : undefined;
+        const destroy = (error) => {
+            input.destroy(error);
+            gzipInput?.destroy(error);
+            decoder?.destroy(error);
+            parser.destroy(error);
+        };
+        // A pipeline with an async-generator stage can settle before its file's
+        // asynchronous close. Join the actual close events before freeing WASM.
+        const closed = Promise.all([input, parser, ...(decoder ? [decoder] : []), ...(gzipInput ? [gzipInput] : [])].map(stream => {
+            const closing = new Promise(resolve => { stream.once("close", resolve); });
+            return finished(stream, { cleanup: true }).then(() => undefined, (cause) => cause instanceof Error ? cause : new Error(String(cause))).then(async (error) => { await closing; return error; });
+        }));
+        const pumps = decoder && gzipInput
+            ? [pipeline(decoder, parser, { signal: params.signal }), pipeline(input, gzipInput, { signal: params.signal })]
+            : kind !== "tar"
+                ? [pipeline(input, (source) => session.decode(source, kind, params.signal), parser, { signal: params.signal })]
+                : [pipeline(input, parser, { signal: params.signal })];
+        // Either pump tears down both routes; join every pump even after the first failure.
+        const settled = Promise.all(pumps.map((pump) => pump.then(() => undefined, (cause) => {
+            const error = cause instanceof Error ? cause : new Error(String(cause));
+            destroy(error);
+            return error;
+        }))).then((errors) => errors.find((error) => error !== undefined));
+        try {
+            const result = await consume(parser);
+            const error = await settled;
+            if (error)
+                throw error;
+            const closeError = (await closed).find(error => error !== undefined);
+            if (closeError)
+                throw closeError;
+            if (gzipInput) {
+                if (buffer !== undefined)
+                    await validateGzipBufferTail(buffer, gzipInput.tailOffset, params.signal);
+                else
+                    await validateGzipContainerTail(params.archivePath, gzipInput.tailOffset, params.signal);
+            }
+            return result;
+        }
+        finally {
+            destroy();
+            await settled;
+            await closed;
         }
-        return result;
     }
     finally {
-        destroy();
-        await settled;
+        session.dispose();
     }
 }
 export async function inspectTar(params) {

package/node_modules/@openclaw/fs-safe/dist/archive-tar-wasm.d.ts

@@ -1,18 +1,29 @@
 import { Transform, type TransformCallback } from "node:stream";
 import type { TarMeterLimits } from "./archive-limits.js";
-import type { TarEntryInfo } from "./archive-tar.js";
+import type { TarEntryInfo } from "./archive-plan.js";
 export type AdmittedTarMember = TarEntryInfo & {
     offset: number;
 };
-/** Backpressure-aware transport only; all TAR semantics live in the Rust core. */
-export declare class TarParserStream extends Transform {
-    private readonly onMember?;
+/** One bounded memory domain owns both admission and decompression. Its owner
+ * must join the decoder and parser before disposing this shared instance. */
+export declare class TarWasmSession {
     private abi;
-    constructor(limits: TarMeterLimits, onMember?: ((entry: AdmittedTarMember) => void) | undefined);
+    constructor(limits: TarMeterLimits);
     private bytes;
     private text;
+    parse(chunk: Buffer, onMember?: (entry: AdmittedTarMember) => void): void;
+    finish(): void;
+    private codecError;
+    decode(source: AsyncIterable<Buffer>, kind: "tar-zstd" | "tar-bzip2", signal?: AbortSignal): AsyncGenerator<Buffer>;
+    dispose(): void;
+}
+/** Backpressure-aware transport only; all TAR semantics live in the Rust core. */
+export declare class TarParserStream extends Transform {
+    private readonly onMember?;
+    private readonly session;
+    private readonly ownsSession;
+    constructor(limits: TarMeterLimits, onMember?: ((entry: AdmittedTarMember) => void) | undefined, session?: TarWasmSession);
     _transform(chunk: Buffer, _encoding: BufferEncoding, callback: TransformCallback): void;
     _flush(callback: TransformCallback): void;
     _destroy(error: Error | null, callback: (error: Error | null) => void): void;
 }
-//# sourceMappingURL=archive-tar-wasm.d.ts.map