@openclaw/signal 2026.9.4 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/root-paths.js

@@ -0,0 +1,296 @@
+import fsSync from "node:fs";
+import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { isNotFoundPathError, isPathInside, } from "./path.js";
+import { realpathSync } from "./realpath.js";
+import { root as openRoot } from "./root.js";
+import { hasWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
+import { resolvePathWithinRoot } from "./root-paths-lexical.js";
+import { resolvePathWithinNormalizedRoot } from "./path-scope-lexical.js";
+import { assertNoSymlinkSegments, ensureDirectoryWithinRoot, resolveNearestExistingPath, } from "./root-directory.js";
+export { resolvePathWithinRoot } from "./root-paths-lexical.js";
+export { ensureDirectoryWithinRoot } from "./root-directory.js";
+function invalidPath(scopeLabel) {
+    return {
+        ok: false,
+        error: `Invalid path: must stay within ${scopeLabel}`,
+    };
+}
+const INVALID_REAL_PATH = Symbol("invalid-real-path");
+async function resolveRealPathIfExists(targetPath) {
+    if (hasWindowsPathAlias(targetPath, "filesystem"))
+        return INVALID_REAL_PATH;
+    try {
+        const realPath = realpathSync.native(pathForWindowsFilesystem(targetPath));
+        return hasWindowsPathAlias(realPath, "filesystem") ? INVALID_REAL_PATH : realPath;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function resolveTrustedRootRealPath(rootDir) {
+    if (hasWindowsPathAlias(rootDir, "filesystem"))
+        return undefined;
+    try {
+        const operationPath = pathForWindowsFilesystem(rootDir);
+        const rootLstat = fsSync.lstatSync(operationPath);
+        if (!rootLstat.isDirectory() || rootLstat.isSymbolicLink()) {
+            return undefined;
+        }
+        const realPath = realpathSync.native(operationPath);
+        return hasWindowsPathAlias(realPath, "filesystem") ? undefined : realPath;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function validateCanonicalPathWithinRoot(params) {
+    try {
+        const operationPath = pathForWindowsFilesystem(params.candidatePath);
+        const candidateLstat = fsSync.lstatSync(operationPath);
+        if (candidateLstat.isSymbolicLink()) {
+            return "invalid";
+        }
+        if (params.expect === "directory" && !candidateLstat.isDirectory()) {
+            return "invalid";
+        }
+        if (params.expect === "file" && !candidateLstat.isFile()) {
+            return "invalid";
+        }
+        if (params.expect === "file" && candidateLstat.nlink > 1) {
+            return "invalid";
+        }
+        const candidateRealPath = realpathSync.native(operationPath);
+        if (hasWindowsPathAlias(candidateRealPath, "filesystem"))
+            return "invalid";
+        return isPathInside(params.rootRealPath, candidateRealPath) ? "ok" : "invalid";
+    }
+    catch (err) {
+        return isNotFoundPathError(err) ? "not-found" : "invalid";
+    }
+}
+export async function resolveWritablePathWithinRoot(params) {
+    const rootDirInput = params.rootDir;
+    const requestedPathInput = params.requestedPath;
+    const scopeLabel = params.scopeLabel;
+    const defaultFileName = params.defaultFileName;
+    const lexical = resolvePathWithinRoot({
+        rootDir: rootDirInput,
+        requestedPath: requestedPathInput,
+        scopeLabel,
+        defaultFileName,
+    });
+    if (!lexical.ok) {
+        return lexical;
+    }
+    const rootDir = resolvePathPreservingWindowsRoot(rootDirInput);
+    const rootRealPath = await resolveTrustedRootRealPath(rootDir);
+    if (!rootRealPath) {
+        return invalidPath(scopeLabel);
+    }
+    const requestedPath = lexical.path;
+    const parentDir = path.dirname(requestedPath);
+    const parentStatus = await validateCanonicalPathWithinRoot({
+        rootRealPath,
+        candidatePath: parentDir,
+        expect: "directory",
+    });
+    if (parentStatus !== "ok") {
+        return invalidPath(scopeLabel);
+    }
+    const targetStatus = await validateCanonicalPathWithinRoot({
+        rootRealPath,
+        candidatePath: requestedPath,
+        expect: "file",
+    });
+    if (targetStatus === "invalid") {
+        return invalidPath(scopeLabel);
+    }
+    return lexical;
+}
+export function resolvePathsWithinRoot(params) {
+    const resolvedPaths = [];
+    let previousRootDir;
+    let previousResolvedRoot = "";
+    for (const raw of params.requestedPaths) {
+        const request = {
+            rootDir: params.rootDir,
+            requestedPath: raw,
+            scopeLabel: params.scopeLabel,
+        };
+        // Each lexical request owns its admitted root without consuming later items.
+        if (typeof request.rootDir !== "string")
+            path.resolve(request.rootDir);
+        if (hasWindowsPathAlias(request.rootDir, "filesystem"))
+            return invalidPath(request.scopeLabel);
+        // Relative roots may follow cwd changes made by an input iterator or getter.
+        const resolvedRoot = process.platform !== "win32" && typeof request.rootDir === "string" &&
+            request.rootDir.startsWith("/") && request.rootDir === previousRootDir
+            ? previousResolvedRoot
+            : resolvePathPreservingWindowsRoot(request.rootDir);
+        previousRootDir = request.rootDir;
+        previousResolvedRoot = resolvedRoot;
+        const pathResult = resolvePathWithinNormalizedRoot(request, resolvedRoot);
+        if (!pathResult.ok) {
+            return { ok: false, error: pathResult.error };
+        }
+        resolvedPaths.push(pathResult.path);
+    }
+    return { ok: true, paths: resolvedPaths };
+}
+export async function resolveExistingPathsWithinRoot(params) {
+    return await resolveCheckedPathsWithinRoot(params, true);
+}
+export async function resolveStrictExistingPathsWithinRoot(params) {
+    return await resolveCheckedPathsWithinRoot(params, false);
+}
+export function pathScope(rootDir, options) {
+    const label = options.label;
+    const base = { rootDir, scopeLabel: label };
+    return {
+        rootDir,
+        label,
+        resolve: (requestedPath, pathOptions) => resolvePathWithinRoot({
+            ...base,
+            requestedPath,
+            defaultFileName: pathOptions?.defaultName,
+        }),
+        resolveAll: (requestedPaths) => resolvePathsWithinRoot({
+            ...base,
+            requestedPaths,
+        }),
+        existing: (requestedPaths) => resolveExistingPathsWithinRoot({
+            ...base,
+            requestedPaths,
+        }),
+        files: (requestedPaths) => resolveStrictExistingPathsWithinRoot({
+            ...base,
+            requestedPaths,
+        }),
+        writable: (requestedPath, pathOptions) => resolveWritablePathWithinRoot({
+            ...base,
+            requestedPath,
+            defaultFileName: pathOptions?.defaultName,
+        }),
+        ensureDir: (requestedPath, pathOptions) => ensureDirectoryWithinRoot({
+            ...base,
+            requestedPath,
+            defaultDirName: pathOptions?.defaultName,
+            mode: pathOptions?.mode,
+        }),
+    };
+}
+async function resolveCheckedPathsWithinRoot(params, allowMissingFallback) {
+    const rootDirInput = params.rootDir;
+    const scopeLabel = params.scopeLabel;
+    if (hasWindowsPathAlias(rootDirInput, "filesystem")) {
+        return invalidPath(scopeLabel);
+    }
+    const requestedPaths = [...params.requestedPaths];
+    const rootDir = resolvePathPreservingWindowsRoot(rootDirInput);
+    if (hasWindowsPathAlias(rootDir, "filesystem"))
+        return invalidPath(scopeLabel);
+    const rootRealPathResult = await resolveRealPathIfExists(rootDir);
+    if (rootRealPathResult === INVALID_REAL_PATH)
+        return invalidPath(scopeLabel);
+    const rootRealPath = rootRealPathResult;
+    const root = rootRealPath ? await openRoot(rootDir) : undefined;
+    const isInRoot = (relativePath) => Boolean(relativePath) &&
+        relativePath !== ".." &&
+        !relativePath.startsWith(`..${path.sep}`) &&
+        !path.isAbsolute(relativePath);
+    const resolveExistingRelativePath = async (requestedPath) => {
+        const raw = requestedPath.trim();
+        const lexicalPathResult = resolvePathWithinRoot({
+            rootDir,
+            requestedPath,
+            scopeLabel,
+        });
+        if (lexicalPathResult.ok) {
+            return {
+                ok: true,
+                relativePath: path.relative(rootDir, lexicalPathResult.path),
+                fallbackPath: lexicalPathResult.path,
+            };
+        }
+        if (!rootRealPath ||
+            !raw ||
+            !path.isAbsolute(raw) ||
+            hasWindowsPathAlias(raw, "filesystem")) {
+            return lexicalPathResult;
+        }
+        try {
+            const resolvedExistingPath = realpathSync.native(pathForWindowsFilesystem(raw));
+            if (hasWindowsPathAlias(resolvedExistingPath, "filesystem")) {
+                return lexicalPathResult;
+            }
+            const relativePath = path.relative(rootRealPath, resolvedExistingPath);
+            if (!isInRoot(relativePath)) {
+                return lexicalPathResult;
+            }
+            return {
+                ok: true,
+                relativePath,
+                fallbackPath: resolvedExistingPath,
+            };
+        }
+        catch {
+            return lexicalPathResult;
+        }
+    };
+    const resolvedPaths = [];
+    for (const raw of requestedPaths) {
+        const pathResult = await resolveExistingRelativePath(raw);
+        if (!pathResult.ok) {
+            return { ok: false, error: pathResult.error };
+        }
+        let opened;
+        try {
+            if (!root) {
+                throw new FsSafeError("not-found", "root dir not found");
+            }
+            opened = await root.open(pathResult.relativePath);
+            resolvedPaths.push(opened.realPath);
+        }
+        catch (err) {
+            if (allowMissingFallback && err instanceof FsSafeError && err.code === "not-found") {
+                if (!rootRealPath) {
+                    resolvedPaths.push(pathResult.fallbackPath);
+                    continue;
+                }
+                try {
+                    await assertNoSymlinkSegments({
+                        rootDir,
+                        targetPath: pathResult.fallbackPath,
+                        scopeLabel,
+                    });
+                    const existingPath = await resolveNearestExistingPath(pathResult.fallbackPath);
+                    const existingRealPath = realpathSync.native(pathForWindowsFilesystem(existingPath));
+                    if (hasWindowsPathAlias(existingRealPath, "filesystem") ||
+                        !isPathInside(rootRealPath, existingRealPath)) {
+                        return invalidPath(scopeLabel);
+                    }
+                }
+                catch {
+                    return invalidPath(scopeLabel);
+                }
+                resolvedPaths.push(pathResult.fallbackPath);
+                continue;
+            }
+            if (err instanceof FsSafeError && err.code === "outside-workspace") {
+                return {
+                    ok: false,
+                    error: `File is outside ${scopeLabel}`,
+                };
+            }
+            return {
+                ok: false,
+                error: `Invalid path: must stay within ${scopeLabel} and be a regular non-symlink file`,
+            };
+        }
+        finally {
+            await opened?.handle.close().catch(() => { });
+        }
+    }
+    return { ok: true, paths: resolvedPaths };
+}

package/node_modules/@openclaw/fs-safe/dist/root-public-types.d.ts

@@ -0,0 +1,11 @@
+export type { OpenResult, WritableOpenResult, } from "./root-impl.js";
+export type { HardlinkPolicy, RootAppendOptions, RootCopyOptions, RootCopySource, RootCreateJsonOptions, RootCreateOptions, RootCreateStreamOptions, RootDefaults, RootMkdirOptions, RootMoveOptions, RootOpenOptions, RootOpenWritableOptions, RootOptions, RootReadOptions, RootRemoveOptions, RootWriteJsonOptions, RootWriteOptions, WritableOpenMode, } from "./root-options.js";
+export type { DenyMutationPolicy } from "./deny-mutations.js";
+export type { RenameIdentityPolicy } from "./pinned-write-types.js";
+export type { MutationSymlinkPolicy, SymlinkPolicy, } from "./root-symlink-policy.js";
+export type { ReadResult } from "./read-opened-file.js";
+export type { RootCopyPublicationReceipt } from "./copy-publication.js";
+export type { CopyCloneMode } from "./copy-policy.js";
+export type { RootEntriesOptions } from "./root-entries.js";
+export type { ContainmentGuarantee } from "./containment.js";
+export type { RootWalkDataEntry, RootWalkDataEntryKind, RootWalkDirectoryErrorBehavior, RootWalkEntry, RootWalkEntryFilter, RootWalkEntryFilterResult, RootWalkEntryKind, RootWalkLimitBehavior, RootWalkOptions, RootWalkSymlinkPolicy, } from "./root-walk.js";

package/node_modules/@openclaw/fs-safe/dist/root-public-types.js

@@ -0,0 +1 @@
+export {};

package/node_modules/@openclaw/fs-safe/dist/root-read-admission.d.ts

@@ -0,0 +1,25 @@
+import { type BigIntStats } from "node:fs";
+import type { FileHandle } from "node:fs/promises";
+import { type RootContext } from "./root-context.js";
+import type { HardlinkPolicy } from "./root-options.js";
+import type { SymlinkPolicy } from "./root-symlink-policy.js";
+export declare function inspectOpenedPathIdentitySync(filePath: string, symlinks: SymlinkPolicy | undefined): BigIntStats;
+type OwnedRootReadHandle = {
+    handle: FileHandle;
+    stat: {
+        nlink: number;
+    };
+};
+export declare function admitRootReadHandle<T extends OwnedRootReadHandle>(params: {
+    root: RootContext;
+    filePath: string;
+    opened: T;
+    identity: BigIntStats;
+    hardlinks?: HardlinkPolicy;
+    symlinks?: SymlinkPolicy;
+    beforeFinalFence?: (filePath: string, handle: FileHandle) => Promise<void> | void;
+    afterPathIdentityCheck?: (filePath: string, handle: FileHandle) => void;
+}): Promise<T & {
+    realPath: string;
+}>;
+export {};

package/node_modules/@openclaw/fs-safe/dist/root-read-admission.js

@@ -0,0 +1,86 @@
+import fsSync, {} from "node:fs";
+import { FsSafeError } from "./errors.js";
+import { openedPathResolutionError, recordOpenedFileFailure } from "./opened-file-failure.js";
+import { isNotFoundPathError } from "./path.js";
+import { admitPathInsideRoot } from "./root-boundary.js";
+import { assertRootIdentityCurrentSync } from "./root-context.js";
+import { fileNotFoundError, hardlinkedPathNotAllowedError, outsideWorkspaceError } from "./root-errors.js";
+import { realpathSync } from "./realpath.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
+function resolveFinalOpenedRealPath(filePath) {
+    try {
+        return realpathSync.native(filePath);
+    }
+    catch (error) {
+        // Windows can report a deleted-but-open file through either resolver
+        // failure. Only the same-descriptor unlink proof may consume this receipt.
+        if (process.platform === "win32" && error instanceof Error &&
+            ["EPERM", "EBADF"].includes(error.code ?? "")) {
+            throw openedPathResolutionError(error);
+        }
+        throw error;
+    }
+}
+export function inspectOpenedPathIdentitySync(filePath, symlinks) {
+    const stat = symlinks === "follow-within-root"
+        ? fsSync.statSync(filePath, { bigint: true })
+        : fsSync.lstatSync(filePath, { bigint: true });
+    if (stat.isSymbolicLink() && symlinks !== "follow-within-root") {
+        throw new FsSafeError("symlink", "symlink not allowed");
+    }
+    return stat;
+}
+export async function admitRootReadHandle(params) {
+    try {
+        if (params.hardlinks !== "allow" && params.opened.stat.nlink > 1) {
+            throw hardlinkedPathNotAllowedError();
+        }
+        if (params.beforeFinalFence) {
+            await params.beforeFinalFence(params.filePath, params.opened.handle);
+        }
+        try {
+            assertRootIdentityCurrentSync(params.root);
+            let realPath;
+            try {
+                const current = inspectFileIdentitySync(() => inspectOpenedPathIdentitySync(params.filePath, params.symlinks), params.identity);
+                if (params.hardlinks !== "allow" && current.nlink > 1n)
+                    throw hardlinkedPathNotAllowedError();
+                const canonicalPath = resolveFinalOpenedRealPath(params.filePath);
+                assertNoWindowsPathAlias(canonicalPath, "filesystem", "resolved file path uses a Windows filesystem namespace alias");
+                const admittedRealPath = admitPathInsideRoot({
+                    rootPath: params.root.rootReal,
+                    candidatePath: canonicalPath,
+                    rootIdentity: params.root.rootIdentity,
+                });
+                if (!admittedRealPath) {
+                    throw openedPathResolutionError(outsideWorkspaceError());
+                }
+                // This is a fresh no-follow observation even when canonicalPath and
+                // filePath have the same spelling; realpath may have raced a replacement.
+                const canonical = inspectFileIdentitySync(() => inspectOpenedPathIdentitySync(canonicalPath, undefined), params.identity);
+                if (params.hardlinks !== "allow" && canonical.nlink > 1n)
+                    throw hardlinkedPathNotAllowedError();
+                realPath = admittedRealPath.path;
+            }
+            catch (error) {
+                throw isNotFoundPathError(error)
+                    ? openedPathResolutionError(fileNotFoundError())
+                    : error;
+            }
+            params.afterPathIdentityCheck?.(params.filePath, params.opened.handle);
+            assertRootIdentityCurrentSync(params.root);
+            return { ...params.opened, realPath };
+        }
+        catch (error) {
+            if (params.identity.nlink <= 1n) {
+                await recordOpenedFileFailure(error, params.opened.handle, params.filePath, params.identity);
+            }
+            throw error;
+        }
+    }
+    catch (error) {
+        await params.opened.handle.close().catch(() => { });
+        throw error;
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/root-remove-identity.d.ts

@@ -0,0 +1,14 @@
+import type { BigIntStats } from "node:fs";
+type ExactDirectoryIdentity = Readonly<Pick<BigIntStats, "dev" | "ino">>;
+export type RemovalDirectoryAssertion = Readonly<{
+    path: string;
+    dev: bigint;
+    ino: bigint;
+    numericDev?: number;
+    numericIno?: number;
+    platform: NodeJS.Platform;
+    realPath?: string;
+}>;
+export declare function createRemovalDirectoryAssertion(path: string, identity: ExactDirectoryIdentity, realPath?: string, platform?: NodeJS.Platform): RemovalDirectoryAssertion;
+export declare function assertRemovalDirectoryCurrent(assertion: RemovalDirectoryAssertion): void;
+export {};

package/node_modules/@openclaw/fs-safe/dist/root-remove-identity.js

@@ -0,0 +1,87 @@
+import fsSync from "node:fs";
+import { inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { realpathSync } from "./realpath.js";
+import { directoryComponentNotDirectoryError, errorCauseOptions } from "./root-errors.js";
+const MAX_SAFE_DIRECTORY_IDENTITY = BigInt(Number.MAX_SAFE_INTEGER);
+function identityMismatch(cause) {
+    return new FsSafeError("path-mismatch", "removal ancestor identity changed or could not be verified", errorCauseOptions(cause));
+}
+function safeIdentityNumber(value) {
+    if (value < 0n || value > MAX_SAFE_DIRECTORY_IDENTITY)
+        return undefined;
+    return Number(value);
+}
+export function createRemovalDirectoryAssertion(path, identity, realPath, platform = process.platform) {
+    const dev = safeIdentityNumber(identity.dev);
+    const ino = safeIdentityNumber(identity.ino);
+    const numeric = dev !== undefined && ino !== undefined &&
+        (platform !== "win32" || (dev !== 0 && ino !== 0));
+    return Object.freeze({
+        path,
+        dev: identity.dev,
+        ino: identity.ino,
+        numericDev: numeric ? dev : undefined,
+        numericIno: numeric ? ino : undefined,
+        platform,
+        realPath,
+    });
+}
+function assertDirectoryType(stat) {
+    if (typeof stat?.isDirectory !== "function" || typeof stat.isSymbolicLink !== "function") {
+        throw identityMismatch();
+    }
+    if (stat.isSymbolicLink() || !stat.isDirectory())
+        throw directoryComponentNotDirectoryError();
+}
+function assertExactObservation(stat, expected, platform) {
+    assertDirectoryType(stat);
+    if (typeof stat.dev !== "bigint" || typeof stat.ino !== "bigint")
+        throw identityMismatch();
+    if (platform === "win32" && (stat.dev === 0n || stat.ino === 0n))
+        throw identityMismatch();
+    if (stat.dev !== expected.dev || stat.ino !== expected.ino)
+        throw identityMismatch();
+}
+function assertNumericObservation(assertion) {
+    const stat = fsSync.lstatSync(assertion.path);
+    assertDirectoryType(stat);
+    if (!Number.isSafeInteger(stat.dev) || stat.dev < 0 ||
+        !Number.isSafeInteger(stat.ino) || stat.ino < 0) {
+        throw identityMismatch();
+    }
+    let unknown = false;
+    const observedDev = stat.dev;
+    const expectedDev = assertion.numericDev;
+    if (assertion.platform === "win32" && observedDev === 0) {
+        unknown = true;
+    }
+    else if (observedDev !== expectedDev) {
+        // Reject a known mismatch before considering an unknown companion field.
+        throw identityMismatch();
+    }
+    const observedIno = stat.ino;
+    const expectedIno = assertion.numericIno;
+    if (assertion.platform === "win32" && observedIno === 0) {
+        unknown = true;
+    }
+    else if (observedIno !== expectedIno) {
+        throw identityMismatch();
+    }
+    if (unknown) {
+        // The numeric lstat is the first observation. Permit one exact retry only,
+        // retaining every known component and the original exact admission receipt.
+        assertExactObservation(fsSync.lstatSync(assertion.path, { bigint: true }), assertion, assertion.platform);
+    }
+}
+export function assertRemovalDirectoryCurrent(assertion) {
+    if (assertion.numericDev !== undefined && assertion.numericIno !== undefined) {
+        assertNumericObservation(assertion);
+    }
+    else {
+        inspectDirectoryIdentitySync(assertion.path, assertion, undefined, assertion.platform);
+    }
+    if (assertion.realPath !== undefined && realpathSync.native(assertion.path) !== assertion.realPath) {
+        throw identityMismatch();
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/root-remove-receipt.d.ts

@@ -0,0 +1,16 @@
+import type { BigIntStats } from "node:fs";
+export type CapturedRemovalDirectory = Readonly<{
+    path: string;
+    stat: BigIntStats;
+}>;
+export declare class RemovalPathReceipts {
+    private rootStat;
+    private directories;
+    readonly observeRoot: (stat: BigIntStats) => void;
+    observeDirectory(dir: string, stat: BigIntStats): void;
+    complete(rootReal: string, targetPath: string): {
+        rootStat: BigIntStats;
+        parent: CapturedRemovalDirectory | undefined;
+        directories: readonly CapturedRemovalDirectory[];
+    } | undefined;
+}

package/node_modules/@openclaw/fs-safe/dist/root-remove-receipt.js

@@ -0,0 +1,37 @@
+import path from "node:path";
+import { isPathInside } from "./path.js";
+// Private to a single nonrecursive removal. No observations are shared across
+// operations, and a lexical observation never stands in for an unvisited alias
+// target on the final canonical chain.
+export class RemovalPathReceipts {
+    rootStat;
+    directories;
+    observeRoot = (stat) => { this.rootStat = stat; };
+    observeDirectory(dir, stat) {
+        // Retain the first object if raw traversal revisits the same spelling.
+        const directories = this.directories ??= new Map();
+        if (!directories.has(dir))
+            directories.set(dir, { path: dir, stat });
+    }
+    complete(rootReal, targetPath) {
+        const parentPath = path.dirname(targetPath);
+        if (!this.rootStat || !isPathInside(rootReal, parentPath))
+            return undefined;
+        const directories = [];
+        let current = parentPath;
+        while (current !== rootReal) {
+            // Exact spelling is intentional: case/namespace aliases and symlink hops
+            // that did not visit the complete canonical chain use fresh admission.
+            const directory = this.directories?.get(current);
+            if (!directory)
+                return undefined;
+            directories.push(directory);
+            const parent = path.dirname(current);
+            if (parent === current)
+                return undefined;
+            current = parent;
+        }
+        directories.reverse();
+        return { rootStat: this.rootStat, parent: directories.at(-1), directories };
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/root-remove.d.ts

@@ -0,0 +1,6 @@
+import { type RootContext } from "./root-context.js";
+import type { RootRemoveOptions } from "./root-options.js";
+import type { RemovalPathReceipts } from "./root-remove-receipt.js";
+export declare const nonrecursiveRemovalKind: unique symbol;
+export declare function validateRemoveOptions(options: RootRemoveOptions): void;
+export declare function removePathInRootFallback(root: RootContext, targetPath: string, options: RootRemoveOptions, receipts?: RemovalPathReceipts): Promise<void>;