@openclaw/openshell-sandbox 2026.9.5 → 2026.9.7

package/node_modules/@openclaw/fs-safe/dist/secret-read-policy.js

@@ -1,10 +1,13 @@
 import { normalizeMaxBytes } from "./byte-budget.js";
 import { resolveHomeRelativePath } from "./home-dir.js";
+import fs, {} from "node:fs";
+import { assertNoUnsafeDeviceReadPath } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export const DEFAULT_SECRET_FILE_MAX_BYTES = 16 * 1024;
 export function secretPathErrorCode(error) {
-    const code = error.code;
+    const code = error?.code;
     return code === "ENOENT" || code === "ENOTDIR" ? "not-found" : "invalid-path";
 }
 export function secretReadError(code, action, label, resolvedPath, error) {
@@ -29,7 +32,7 @@ export function trimSecretFileContent(raw, label, resolvedPath) {
     }
     return secret;
 }
-export function resolveSecretReadPolicy(filePath, label, options) {
+export function prepareSecretRead(filePath, label, options) {
     const trimmedPath = filePath.trim();
     assertNoWindowsPathAlias(trimmedPath, "filesystem", `${label} file path uses a Windows filesystem namespace alias`);
     const resolvedPath = resolveHomeRelativePath(trimmedPath);
@@ -40,5 +43,26 @@ export function resolveSecretReadPolicy(filePath, label, options) {
     const maxBytes = normalizeMaxBytes(options.maxBytes, {
         defaultValue: DEFAULT_SECRET_FILE_MAX_BYTES,
     });
-    return { resolvedPath, maxBytes };
+    let rejectSymlink;
+    let previewStat;
+    try {
+        assertNoUnsafeDeviceReadPath(resolvedPath);
+        rejectSymlink = Boolean(options.rejectSymlink);
+        previewStat = inspectFileIdentitySync(() => inspectInput(`${label} file at ${resolvedPath} must not be a symlink.`));
+    }
+    catch (error) {
+        throw secretReadError(error instanceof FsSafeError ? error.code : secretPathErrorCode(error), "inspect", label, resolvedPath, error);
+    }
+    function inspectInput(symlinkMessage) {
+        const stat = rejectSymlink
+            ? fs.lstatSync(resolvedPath, { bigint: true })
+            : fs.statSync(resolvedPath, { bigint: true });
+        if (rejectSymlink && stat.isSymbolicLink()) {
+            throw new FsSafeError("symlink", symlinkMessage);
+        }
+        return stat;
+    }
+    const rejectHardlinks = options.rejectHardlinks !== false;
+    assertSecretFilePreview(previewStat, label, resolvedPath, maxBytes, rejectHardlinks);
+    return { resolvedPath, maxBytes, rejectSymlink, rejectHardlinks, previewStat, inspectInput };
 }

package/node_modules/@openclaw/fs-safe/dist/secret.d.ts

@@ -1,4 +1,3 @@
 export { createSecretFileAtomic, PRIVATE_SECRET_DIR_MODE, PRIVATE_SECRET_FILE_MODE, readSecretFileSync, tryReadSecretFileSync, writeSecretFileAtomic, } from "./secret-file.js";
 export { DEFAULT_SECRET_FILE_MAX_BYTES, type SecretFileReadOptions } from "./secret-read-policy.js";
 export { readSecretFile, tryReadSecretFile } from "./secret-read-async.js";
-//# sourceMappingURL=secret.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secure-file-windows.d.ts

@@ -1,10 +1,10 @@
 import type { BigIntStats, Stats } from "node:fs";
 import type { PermissionCheck } from "./permissions.js";
 type ExactIdentity = Pick<BigIntStats, "dev" | "ino">;
-export declare function inspectSecureWindowsDescriptor(params: {
+/** Both mechanisms inspect the same borrowed handle; the caller owns its lifetime. */
+export declare function inspectSecureWindowsFile(params: {
     fd: number;
     identity: ExactIdentity;
     stat: Stats;
-}): PermissionCheck;
+}): Promise<PermissionCheck>;
 export {};
-//# sourceMappingURL=secure-file-windows.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secure-file-windows.js

@@ -1,171 +1,33 @@
-import { FsSafeError } from "./errors.js";
-import { recordFileObservationFailure } from "./file-observation.js";
+import { fileIdentityMismatchError } from "./strict-file-identity.js";
 import { getNativeBinding } from "./native.js";
+import { getFsSafeNativeConfig } from "./native-config.js";
+import { warnNativeFallback } from "./native-fallback-warning.js";
+import { inspectWindowsDescriptorCommand } from "./windows-security-command.js";
+import { unverified as permissionUnverified, validateSecureWindowsSecurityFacts } from "./windows-security-facts.js";
 const IDENTITY_RE = /^([0-9a-f]{8}):([0-9a-f]{16})$/;
-const SID_RE = /^s-\d+-\d+(?:-\d+)+$/;
-const OWNER_CLASSES = new Set(["current-user", "system", "administrators", "foreign"]);
 const TRUSTED_OWNER_CLASSES = new Set(["current-user", "system", "administrators"]);
-const SYSTEM_SID = "s-1-5-18";
-const ADMINISTRATORS_SID = "s-1-5-32-544";
-const WORLD_SIDS = new Set([
-    "s-1-1-0", "s-1-5-11", "s-1-5-32-545", "s-1-5-7",
-    "s-1-5-32-546", "s-1-5-4", "s-1-5-2",
-]);
-const GENERIC_READ = 0x8000_0000;
-const GENERIC_WRITE = 0x4000_0000;
-const GENERIC_ALL = 0x1000_0000;
-const DELETE_ACCESS = 0x0001_0000;
-const WRITE_DAC = 0x0004_0000;
-const WRITE_OWNER = 0x0008_0000;
-const FILE_READ_DATA = 0x0000_0001;
-const FILE_WRITE_DATA = 0x0000_0002;
-const FILE_APPEND_DATA = 0x0000_0004;
-const FILE_READ_EA = 0x0000_0008;
-const FILE_WRITE_EA = 0x0000_0010;
-const FILE_DELETE_CHILD = 0x0000_0040;
-const FILE_READ_ATTRIBUTES = 0x0000_0080;
-const FILE_WRITE_ATTRIBUTES = 0x0000_0100;
-function permissionUnverified(message, cause) {
-    throw new FsSafeError("permission-unverified", message, cause === undefined ? {} : { cause });
-}
-function identityMismatch() {
-    const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
-    recordFileObservationFailure(error, "identity");
-    throw error;
-}
 function isRecord(value) {
     return typeof value === "object" && value !== null;
 }
-function isUint32(value) {
-    return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 0xffff_ffff;
-}
 function parseIdentity(value) {
     if (typeof value !== "string")
-        identityMismatch();
+        throw fileIdentityMismatchError();
     const match = IDENTITY_RE.exec(value);
     if (!match)
-        identityMismatch();
+        throw fileIdentityMismatchError();
     return {
         dev: BigInt(`0x${match[1]}`),
         ino: BigInt(`0x${match[2]}`),
     };
 }
-function validateFlags(value) {
-    if (!isRecord(value))
-        return false;
-    const raw = value.raw;
-    if (!isUint32(raw) || (raw & ~0xdf) !== 0)
-        return false;
-    const fields = [
-        ["objectInherit", 0x01], ["containerInherit", 0x02],
-        ["noPropagateInherit", 0x04], ["inheritOnly", 0x08], ["inherited", 0x10],
-        ["successfulAccess", 0x40], ["failedAccess", 0x80],
-    ];
-    return fields.every(([field, bit]) => typeof value[field] === "boolean" && value[field] === ((raw & bit) !== 0));
-}
-function validateAce(value) {
-    return isRecord(value) && typeof value.sid === "string" && SID_RE.test(value.sid) &&
-        isUint32(value.mask) && (value.aceType === "allow" || value.aceType === "deny") &&
-        validateFlags(value.flags);
-}
-function canRead(mask) {
-    return (mask & (GENERIC_ALL | GENERIC_READ | FILE_READ_DATA | FILE_READ_EA |
-        FILE_READ_ATTRIBUTES)) !== 0;
-}
-function canWrite(mask) {
-    return (mask & (GENERIC_ALL | GENERIC_WRITE | FILE_WRITE_DATA | FILE_APPEND_DATA |
-        FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES | FILE_DELETE_CHILD | DELETE_ACCESS |
-        WRITE_DAC | WRITE_OWNER)) !== 0;
-}
-function expectedOwnerClass(facts) {
-    if (facts.ownerSid === facts.currentUserSid)
-        return "current-user";
-    if (facts.ownerSid === SYSTEM_SID)
-        return "system";
-    if (facts.ownerSid === ADMINISTRATORS_SID)
-        return "administrators";
-    return "foreign";
-}
-function validateSecurity(value) {
-    if (!isRecord(value))
-        permissionUnverified("Windows descriptor ACL facts were malformed");
-    const facts = value;
-    const booleans = [
-        "worldWritable", "groupWritable", "worldReadable", "groupReadable",
-        "fallbackRequired", "daclPresent", "isLocal", "aceListComplete",
-    ];
-    if (!booleans.every((field) => typeof facts[field] === "boolean") ||
-        typeof facts.ownerSid !== "string" || !SID_RE.test(facts.ownerSid) ||
-        typeof facts.currentUserSid !== "string" || !SID_RE.test(facts.currentUserSid) ||
-        typeof facts.ownerClass !== "string" || !OWNER_CLASSES.has(facts.ownerClass) ||
-        !Array.isArray(facts.unsupportedAceTypes) ||
-        !facts.unsupportedAceTypes.every(isUint32) ||
-        !Array.isArray(facts.aces) || !facts.aces.every(validateAce)) {
-        permissionUnverified("Windows descriptor ACL facts were malformed");
-    }
-    if (facts.ownerClass !== expectedOwnerClass(facts)) {
-        permissionUnverified("Windows descriptor owner facts were inconsistent");
-    }
-    if (facts.fallbackRequired || !facts.isLocal || !facts.aceListComplete ||
-        facts.unsupportedAceTypes.length !== 0) {
-        permissionUnverified("Windows descriptor ACL facts were incomplete or unsupported");
-    }
-    if (!facts.daclPresent && facts.aces.length !== 0) {
-        permissionUnverified("Windows descriptor DACL facts were inconsistent");
-    }
-    return facts;
-}
-function validatePermissionSummary(facts) {
-    let worldReadable = !facts.daclPresent;
-    let worldWritable = !facts.daclPresent;
-    let groupReadable = false;
-    let groupWritable = false;
-    const trustedSids = new Set([facts.currentUserSid, SYSTEM_SID, ADMINISTRATORS_SID]);
-    for (const ace of facts.aces) {
-        if (ace.aceType !== "allow" || ace.flags.inheritOnly || trustedSids.has(ace.sid))
-            continue;
-        const world = WORLD_SIDS.has(ace.sid);
-        if (world) {
-            worldReadable ||= canRead(ace.mask);
-            worldWritable ||= canWrite(ace.mask);
-        }
-        else {
-            groupReadable ||= canRead(ace.mask);
-            groupWritable ||= canWrite(ace.mask);
-        }
-    }
-    if (facts.worldReadable !== worldReadable || facts.worldWritable !== worldWritable ||
-        facts.groupReadable !== groupReadable || facts.groupWritable !== groupWritable) {
-        permissionUnverified("Windows descriptor ACL summary was inconsistent");
-    }
-}
-export function inspectSecureWindowsDescriptor(params) {
-    let native;
-    try {
-        native = getNativeBinding();
-    }
-    catch (cause) {
-        permissionUnverified("Windows descriptor ACL verification requires the matching native helper", cause);
-    }
-    const inspect = native?.inspectWindowsSecureFileHandle;
-    if (typeof inspect !== "function") {
-        permissionUnverified("Windows descriptor ACL verification requires an up-to-date native helper");
-    }
-    let result;
-    try {
-        result = inspect.call(native, params.fd);
-    }
-    catch (cause) {
-        permissionUnverified("Windows descriptor ACL verification failed", cause);
-    }
+function inspectDescriptorResult(params, result, mechanism) {
     if (!isRecord(result))
         permissionUnverified("Windows descriptor ACL facts were malformed");
     const observed = parseIdentity(result.identity);
     if (observed.dev !== params.identity.dev || observed.ino !== params.identity.ino) {
-        identityMismatch();
+        throw fileIdentityMismatchError();
     }
-    const facts = validateSecurity(result.security);
-    validatePermissionSummary(facts);
+    const facts = validateSecureWindowsSecurityFacts(result.security);
     return {
         ok: true,
         isSymlink: false,
@@ -179,8 +41,39 @@ export function inspectSecureWindowsDescriptor(params) {
         groupReadable: facts.groupReadable,
         ownerSid: facts.ownerSid,
         ownerTrusted: TRUSTED_OWNER_CLASSES.has(facts.ownerClass),
-        aclSummary: `native descriptor owner=${facts.ownerClass} world=` +
+        aclSummary: `${mechanism} descriptor owner=${facts.ownerClass} world=` +
             `${facts.worldReadable ? "r" : "-"}${facts.worldWritable ? "w" : "-"} ` +
             `group=${facts.groupReadable ? "r" : "-"}${facts.groupWritable ? "w" : "-"}`,
     };
 }
+/** Both mechanisms inspect the same borrowed handle; the caller owns its lifetime. */
+export async function inspectSecureWindowsFile(params) {
+    let native;
+    try {
+        native = getNativeBinding();
+    }
+    catch (cause) {
+        permissionUnverified("Windows descriptor ACL verification requires the matching native helper", cause);
+    }
+    const inspect = native?.inspectWindowsSecureFileHandle;
+    const nativeAvailable = typeof inspect === "function";
+    if (!nativeAvailable && getFsSafeNativeConfig().mode === "require") {
+        permissionUnverified("Windows descriptor ACL verification requires an up-to-date native helper");
+    }
+    if (!nativeAvailable) {
+        warnNativeFallback("windows-secure-file", "Windows descriptor ACL inspection uses a slower built-in system command.");
+    }
+    let result;
+    try {
+        if (nativeAvailable) {
+            result = inspect.call(native, params.fd);
+        }
+        else {
+            result = await inspectWindowsDescriptorCommand(params.fd);
+        }
+    }
+    catch (cause) {
+        permissionUnverified("Windows descriptor ACL verification failed", cause);
+    }
+    return inspectDescriptorResult(params, result, nativeAvailable ? "native" : "system-command");
+}

package/node_modules/@openclaw/fs-safe/dist/secure-file.d.ts

@@ -29,4 +29,3 @@ export type SecureFileReadResult = {
     permissions?: PermissionCheck;
 };
 export declare function readSecureFile(options: SecureFileReadOptions): Promise<SecureFileReadResult>;
-//# sourceMappingURL=secure-file.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secure-file.js

@@ -12,8 +12,8 @@ import { formatPermissionErrorDetail } from "./permission-exec.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { realpathSync } from "./realpath.js";
 import { inspectPathPermissions, isGroupReadable, isGroupWritable, isWorldReadable, isWorldWritable, modeBits, } from "./permissions.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
-import { inspectSecureWindowsDescriptor } from "./secure-file-windows.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { inspectSecureWindowsFile } from "./secure-file-windows.js";
 import { scheduleTimeout } from "./timing.js";
 import { anchorWindowsDriveRelativePath, assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 function snapshotTrustedDirs(dirs) {
@@ -139,9 +139,9 @@ async function openSecureHandle(options, maxBytes) {
         if (!openedStat.isFile()) {
             throw new FsSafeError("not-file", `${label(options)} must be a file: ${options.filePath}`);
         }
-        const openedIdentity = await inspectFileIdentity(() => fsSync.fstatSync(handle.fd, { bigint: true }));
+        const openedIdentity = inspectFileIdentitySync(() => fsSync.fstatSync(handle.fd, { bigint: true }));
         assertNotHardlinked(options, openedIdentity);
-        await inspectFileIdentity(async () => {
+        inspectFileIdentitySync(() => {
             const pathStat = options.trust?.allowSymlink
                 ? fsSync.statSync(options.filePath, { bigint: true })
                 : fsSync.lstatSync(options.filePath, { bigint: true });
@@ -153,7 +153,7 @@ async function openSecureHandle(options, maxBytes) {
         }, openedIdentity);
         const realPath = realpathSync.native(options.filePath);
         assertNoWindowsPathAlias(realPath, "filesystem", `${label(options)} resolved path uses a Windows filesystem namespace alias`);
-        await inspectFileIdentity(() => {
+        inspectFileIdentitySync(() => {
             const realPathStat = fsSync.statSync(realPath, { bigint: true });
             assertNotHardlinked(options, realPathStat);
             return realPathStat;
@@ -168,11 +168,11 @@ async function openSecureHandle(options, maxBytes) {
         throw err;
     }
 }
-async function assertTrustedDirs(options, realPath) {
+function assertTrustedDirs(options, realPath) {
     if (!options.trust?.trustedDirs || options.trust.trustedDirs.length === 0) {
         return;
     }
-    const trusted = await Promise.all(options.trust.trustedDirs.map(async (dir) => {
+    const trusted = options.trust.trustedDirs.map((dir) => {
         let realPath;
         try {
             realPath = realpathSync.native(dir);
@@ -182,7 +182,7 @@ async function assertTrustedDirs(options, realPath) {
         }
         assertNoWindowsPathAlias(realPath, "filesystem", "trusted directory uses a Windows filesystem namespace alias");
         return realPath;
-    }));
+    });
     if (!trusted.some((dir) => isPathInside(dir, realPath))) {
         throw new FsSafeError("outside-workspace", `${label(options)} is outside trustedDirs: ${realPath}`);
     }
@@ -202,14 +202,15 @@ function inspectOpenedPermissions(stat, platform) {
         groupReadable: isGroupReadable(bits),
     };
 }
-async function assertSecurePermissions(options, stat, realPath, identity, fd) {
+async function assertSecurePermissions(options, opened, fd) {
+    const { pathStat: stat, realPath, identity } = opened;
     if (options.permissions?.allowInsecure) {
         return undefined;
     }
     const platform = options.inject?.platform ?? process.platform;
     const permissions = platform === "win32"
         ? process.platform === "win32"
-            ? inspectSecureWindowsDescriptor({ fd, identity, stat })
+            ? await inspectSecureWindowsFile({ fd, identity, stat })
             : await inspectPathPermissions(realPath, options.inject)
         : inspectOpenedPermissions(stat, platform);
     const reason = permissions.error ? `: ${formatPermissionErrorDetail(permissions.error)}` : "";
@@ -281,10 +282,10 @@ export async function readSecureFile(options) {
     assertNoWindowsPathAlias(options.filePath, "filesystem", `${label(options)} path uses a Windows filesystem namespace alias`);
     const opened = await openSecureHandle(options, maxBytes);
     try {
-        await assertTrustedDirs(options, opened.realPath);
-        const permissions = await assertSecurePermissions(options, opened.pathStat, opened.realPath, opened.identity, opened.handle.fd);
+        assertTrustedDirs(options, opened.realPath);
+        const permissions = await assertSecurePermissions(options, opened, opened.handle.fd);
         const buffer = await readHandleWithTimeout(opened.handle, options.io?.timeoutMs, maxBytes);
-        const finalIdentity = await inspectFileIdentity(() => fsSync.fstatSync(opened.handle.fd, { bigint: true }), opened.identity);
+        const finalIdentity = inspectFileIdentitySync(() => fsSync.fstatSync(opened.handle.fd, { bigint: true }), opened.identity);
         if (!finalIdentity.isFile()) {
             throw new FsSafeError("not-file", `${label(options)} must remain a file: ${options.filePath}`);
         }

package/node_modules/@openclaw/fs-safe/dist/secure-temp-dir.d.ts

@@ -27,4 +27,3 @@ export type ResolveSecureTempRootOptions = {
     warningPrefix?: string;
 };
 export declare function resolveSecureTempRoot(options: ResolveSecureTempRootOptions): string;
-//# sourceMappingURL=secure-temp-dir.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secure-temp-dir.js

@@ -3,15 +3,10 @@ import { tmpdir as getOsTmpDir } from "node:os";
 import path from "node:path";
 import { directoryEntryPath } from "./directory-entry-path.js";
 import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
+import { hasNodeErrorCode } from "./path.js";
 import { assertSafePathSegment } from "./safe-path-segment.js";
 import { assertNoWindowsPathAlias, pathForWindowsFilesystem } from "./windows-path-alias.js";
 import { captureSecureTempRepairAdapter, repairSecureTempDirectory, secureTempDirectoryReceipt, } from "./secure-temp-repair.js";
-function isNodeErrorWithCode(err, code) {
-    return (typeof err === "object" &&
-        err !== null &&
-        "code" in err &&
-        err.code === code);
-}
 export function resolveSecureTempRoot(options) {
     const { fallbackPrefix: prefix, accessSync: suppliedAccess, lstatSync: suppliedLstat, mkdirSync: suppliedMkdir, descriptor: suppliedDescriptor, getuid: suppliedGetuid, tmpdir: suppliedTmpdir, platform: suppliedPlatform, preferredDir, skipPreferredOnWindows, warn: suppliedWarn, warningPrefix: suppliedWarningPrefix, unsafeFallbackLabel: suppliedFallbackLabel, } = options;
     const platform = suppliedPlatform ?? process.platform;
@@ -87,7 +82,7 @@ export function resolveSecureTempRoot(options) {
             candidate = lstatSync(candidatePath);
         }
         catch (error) {
-            return { kind: isNodeErrorWithCode(error, "ENOENT") ? "missing" : "invalid", error };
+            return { kind: hasNodeErrorCode(error, "ENOENT") ? "missing" : "invalid", error };
         }
         let receipt;
         try {

package/node_modules/@openclaw/fs-safe/dist/secure-temp-repair.d.ts

@@ -32,4 +32,3 @@ export declare function secureTempDirectoryReceipt(stat: ExactDirectoryStat, uid
 /** No pathname chmod, search-only descriptors, procfs, or reopening fallback. */
 export declare function repairSecureTempDirectory(candidate: string, expected: SecureTempDirectoryReceipt, uid: number, adapter: SecureTempRepairAdapter, access: () => void, repaired: () => void, finalize?: boolean): void;
 export {};
-//# sourceMappingURL=secure-temp-repair.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secure-temp-repair.js

@@ -14,9 +14,13 @@ export function captureSecureTempRepairAdapter(supplied, hasLegacyFsHooks) {
     }
     return { lstatSync, fstatSync, openSync, fchmodSync, closeSync, flags: O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_NONBLOCK };
 }
+// Node exposes stat identity through BigInt64Array; a high OS bit can be negative.
+// Preserve raw values and existing positive adapter receipts, never normalize them.
+const MIN_NODE_STAT_IDENTITY = -(1n << 63n);
 export function secureTempDirectoryReceipt(stat, uid) {
     const { dev, ino, uid: owner, mode } = stat;
-    if (typeof dev !== "bigint" || dev < 0n || typeof ino !== "bigint" || ino <= 0n ||
+    if (typeof dev !== "bigint" || dev < MIN_NODE_STAT_IDENTITY ||
+        typeof ino !== "bigint" || ino < MIN_NODE_STAT_IDENTITY || ino === 0n ||
         typeof owner !== "bigint" || owner !== BigInt(uid) || typeof mode !== "bigint" ||
         mode < 0n || mode > 0xffffffffn || (mode & 61440n) !== 16384n ||
         stat.isDirectory() !== true || stat.isSymbolicLink() !== false) {

package/node_modules/@openclaw/fs-safe/dist/sibling-staged-file.d.ts

@@ -15,4 +15,3 @@ export declare function writeCallbackSibling<T>(params: {
     filePath: string;
     result: T;
 }>;
-//# sourceMappingURL=sibling-staged-file.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/sibling-staged-file.js

@@ -2,7 +2,7 @@ import { syncFileBestEffort } from "./file-sync.js";
 import fsSync, {} from "node:fs";
 import fs, {} from "node:fs/promises";
 import path from "node:path";
-import { assertAsyncDirectoryGuard, assertDirectoryIdentitySync, createAsyncDirectoryGuard, } from "./directory-guard.js";
+import { assertDirectoryIdentitySync, createAsyncDirectoryGuard, } from "./directory-guard.js";
 import { syncDirectoryBestEffort } from "./directory-durability.js";
 import { isWindowsReservedDeviceName } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
@@ -10,7 +10,7 @@ import { getNativeBinding } from "./native.js";
 import { handoffPrivateProducerFile, } from "./private-producer-handoff.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { rootFromDirectoryGuard } from "./root-impl.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { registerTempPathForExit } from "./temp-cleanup.js";
 import { createOwnedTempFile } from "./temp-target.js";
 import { serializePathWrite } from "./write-queue.js";
@@ -52,8 +52,8 @@ function assertRegularFile(stat) {
         throw new FsSafeError("hardlink", "sibling temp must have exactly one link");
     }
 }
-async function inspectStage(inspect, expected) {
-    return await inspectFileIdentity(async () => {
+function inspectStage(inspect, expected) {
+    return inspectFileIdentitySync(() => {
         const stat = inspect();
         assertRegularFile(stat);
         return stat;
@@ -67,12 +67,7 @@ function aggregateErrors(errors, message) {
 // Own the workspace before the producer can leave partial output. The finished
 // file still enters the ordinary sibling admission and publication lifecycle.
 async function writeIsolatedProducer(params) {
-    const tempPath = params.tempPath;
-    const write = params.write;
-    const writeReceiver = params.writeReceiver;
-    const parentGuard = params.parentGuard;
-    const assertParent = params.assertParent;
-    const syncTempFile = params.syncTempFile;
+    const { tempPath, write, writeReceiver, parentGuard, assertParent, syncTempFile } = params;
     assertParent();
     const targetRoot = rootFromDirectoryGuard(parentGuard);
     // Select the handoff before invoking the producer. Missing required native
@@ -150,7 +145,9 @@ export async function writeCallbackSibling(params) {
     const syncTempFile = params.syncTempFile;
     const syncParentDir = params.syncParentDir;
     const guard = await createAsyncDirectoryGuard(parent, { bigint: true });
-    const assertParent = () => assertAsyncDirectoryGuard(guard);
+    const assertParent = () => assertDirectoryIdentitySync(parent, {
+        dev: guard.stat.dev, ino: guard.stat.ino, realPath: guard.realPath,
+    });
     let handle;
     let identity;
     let unregister;
@@ -158,10 +155,10 @@ export async function writeCallbackSibling(params) {
     let renamed = false;
     let failure;
     const inspectPath = (pathname, expected) => inspectStage(() => fsSync.lstatSync(pathname, { bigint: true }), expected);
-    const assertCurrent = async (pathname) => {
-        await assertParent();
-        const opened = await inspectStage(() => fsSync.fstatSync(handle.fd, { bigint: true }), identity);
-        const current = await inspectPath(pathname, opened);
+    const assertCurrent = (pathname) => {
+        assertParent();
+        const opened = inspectStage(() => fsSync.fstatSync(handle.fd, { bigint: true }), identity);
+        const current = inspectPath(pathname, opened);
         if (maxBytes !== undefined &&
             (opened.size > maxBytes || current.size > maxBytes)) {
             throw new FsSafeError("too-large", `sibling temp exceeds maxBytes (${maxBytes})`);
@@ -176,11 +173,7 @@ export async function writeCallbackSibling(params) {
                 writeReceiver: params,
                 parentGuard: guard,
                 syncTempFile: syncTempFile,
-                assertParent: () => assertDirectoryIdentitySync(parent, {
-                    dev: guard.stat.dev,
-                    ino: guard.stat.ino,
-                    realPath: guard.realPath,
-                }),
+                assertParent,
             });
             result = isolated.result;
             cleanupWorkspace = isolated.cleanupWorkspace;
@@ -193,13 +186,10 @@ export async function writeCallbackSibling(params) {
         else {
             result = await Reflect.apply(write, params, [tempPath]);
         }
-        await assertParent();
-        if (handle) {
-            const opened = await inspectStage(() => fsSync.fstatSync(handle.fd, { bigint: true }), identity);
-            await inspectPath(tempPath, opened);
-        }
-        else {
-            const before = await inspectPath(tempPath);
+        assertParent();
+        let expected = identity;
+        if (!handle) {
+            expected = inspectPath(tempPath);
             try {
                 // No create/truncate flags; O_NONBLOCK also bounds a FIFO swap during open.
                 const access = syncTempFile ? fsSync.constants.O_RDWR : fsSync.constants.O_RDONLY;
@@ -211,12 +201,14 @@ export async function writeCallbackSibling(params) {
                 }
                 throw error;
             }
-            const opened = await inspectStage(() => fsSync.fstatSync(handle.fd, { bigint: true }), before);
-            await inspectPath(tempPath, opened);
+        }
+        const opened = inspectStage(() => fsSync.fstatSync(handle.fd, { bigint: true }), expected);
+        inspectPath(tempPath, opened);
+        if (!identity) {
             identity = opened;
             unregister = registerTempPathForExit(tempPath, { identity, singleLinkFile: true });
         }
-        await assertParent();
+        assertParent();
         if (cleanupWorkspace) {
             const cleanup = cleanupWorkspace;
             cleanupWorkspace = undefined;
@@ -233,7 +225,7 @@ export async function writeCallbackSibling(params) {
             throw new FsSafeError("invalid-path", "final path must differ from the sibling temp path");
         }
         await serializePathWrite(filePath, async () => {
-            await assertCurrent(tempPath);
+            assertCurrent(tempPath);
             if (mode !== undefined) {
                 try {
                     await handle.chmod(mode);
@@ -242,20 +234,21 @@ export async function writeCallbackSibling(params) {
                     if (!ignoreModeError)
                         throw error;
                 }
+                assertCurrent(tempPath);
             }
             if (syncTempFile) {
-                await assertCurrent(tempPath);
                 await syncFileBestEffort(handle);
+                assertCurrent(tempPath);
             }
-            await assertCurrent(tempPath);
             await fs.rename(tempPath, filePath);
             // A later verification failure never authorizes rollback of the final name.
             renamed = true;
             unregister();
-            await assertCurrent(filePath);
-            if (syncParentDir)
+            assertCurrent(filePath);
+            if (syncParentDir) {
                 await syncDirectoryBestEffort(parent);
-            await assertCurrent(filePath);
+                assertCurrent(filePath);
+            }
         });
         return { filePath, result };
     }
@@ -276,9 +269,9 @@ export async function writeCallbackSibling(params) {
         try {
             if (!renamed && identity) {
                 try {
-                    await assertParent();
-                    await inspectStage(() => fsSync.fstatSync(handle.fd, { bigint: true }), identity);
-                    await inspectPath(tempPath, identity);
+                    assertParent();
+                    inspectStage(() => fsSync.fstatSync(handle.fd, { bigint: true }), identity);
+                    inspectPath(tempPath, identity);
                     await fs.unlink(tempPath);
                     unregister?.();
                 }

package/node_modules/@openclaw/fs-safe/dist/sibling-temp.d.ts

@@ -26,4 +26,3 @@ export declare function writeViaSiblingTempPath(params: {
     fallbackFileName?: string;
     tempPrefix?: string;
 }): Promise<void>;
-//# sourceMappingURL=sibling-temp.d.ts.map