@openclaw/signal 2026.9.5 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/archive-tar-wasm.js

@@ -0,0 +1,203 @@
+import { classifyArchiveParserError } from "./archive-parser-errors.js";
+import { readFileSync } from "node:fs";
+import { Transform } from "node:stream";
+import { setImmediate } from "node:timers/promises";
+import { ArchiveFormatError } from "./archive-errors.js";
+// Node exposes WebAssembly without DOM globals; keep the private ABI types local.
+const wasm = globalThis.WebAssembly;
+let compiled;
+function instance() {
+    // src tests and dist consumers resolve the same generated package artifact.
+    compiled ??= new wasm.Module(readFileSync(new URL("../dist/archive-parser.wasm", import.meta.url)));
+    if (wasm.Module.imports(compiled).length)
+        throw new Error("TAR WASM unexpectedly requires host imports");
+    return new wasm.Instance(compiled).exports;
+}
+const types = new Map([
+    [0, "File"], [48, "File"], [49, "Link"], [50, "SymbolicLink"],
+    [51, "CharacterDevice"], [52, "BlockDevice"], [53, "Directory"],
+    [54, "FIFO"], [55, "ContiguousFile"], [68, "GNUDumpDir"],
+]);
+const utf8Decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+function parserError(message) {
+    const mapped = classifyArchiveParserError(message);
+    if (mapped)
+        return mapped;
+    return new ArchiveFormatError(message.replace(/^archive-header-invalid:/, "invalid TAR header:"));
+}
+/** One bounded memory domain owns both admission and decompression. Its owner
+ * must join the decoder and parser before disposing this shared instance. */
+export class TarWasmSession {
+    abi;
+    constructor(limits) {
+        this.abi = instance();
+        if (this.abi.init(limits.maxEntries, limits.maxMetaEntryBytes, limits.maxDecodedBytes, limits.maxManifestBytes, Number(process.platform === "win32")) !== 0) {
+            this.dispose();
+            throw new RangeError("invalid TAR parser limits");
+        }
+    }
+    bytes(pointer, length) {
+        const memory = this.abi.memory.buffer;
+        if (!Number.isInteger(pointer) || !Number.isInteger(length) || pointer < 0 || length < 0 ||
+            pointer > memory.byteLength || length > memory.byteLength - pointer) {
+            throw new ArchiveFormatError("invalid TAR WASM memory range");
+        }
+        return new Uint8Array(memory, pointer, length);
+    }
+    text() {
+        const abi = this.abi;
+        return utf8Decoder.decode(this.bytes(abi.text_ptr(), abi.text_len()));
+    }
+    parse(chunk, onMember) {
+        const abi = this.abi;
+        for (let offset = 0; offset < chunk.length; offset += 65536) {
+            const length = Math.min(65536, chunk.length - offset);
+            this.bytes(abi.input_ptr(), length).set(chunk.subarray(offset, offset + length));
+            // A member event can stop before the end of this already-copied inbox.
+            for (let consumed = 0; consumed < length;) {
+                const used = abi.push(consumed, length - consumed);
+                if (used < 0)
+                    throw parserError(this.text());
+                if (used === 0 || used > length - consumed)
+                    throw new ArchiveFormatError("TAR WASM made no progress");
+                consumed += used;
+                const type = abi.member_type();
+                if (type >= 0)
+                    onMember?.({
+                        path: this.text(), type: types.get(type) ?? "Unsupported", size: abi.member_size(),
+                        mode: abi.member_mode(), offset: abi.member_offset(),
+                    });
+            }
+        }
+    }
+    finish() {
+        if (this.abi.finish() !== 0)
+            throw parserError(this.text());
+    }
+    codecError() {
+        const abi = this.abi;
+        return new ArchiveFormatError(utf8Decoder.decode(this.bytes(abi.codec_error_ptr(), abi.codec_error_len())));
+    }
+    async *decode(source, kind, signal) {
+        const abi = this.abi;
+        signal?.throwIfAborted();
+        if (abi.codec_init(kind === "tar-bzip2" ? 1 : 2) !== 0)
+            throw this.codecError();
+        let work = 0;
+        let calls = 0;
+        let unconsumedBoundary = false;
+        const step = (input) => {
+            signal?.throwIfAborted();
+            this.bytes(abi.codec_input_ptr(), input.length).set(input);
+            const result = abi.codec_push(input.length);
+            if (result < 0)
+                throw this.codecError();
+            const consumed = abi.codec_consumed(), produced = abi.codec_produced();
+            if (!Number.isInteger(consumed) || consumed < 0 || consumed > input.length ||
+                !Number.isInteger(produced) || produced < 0 || produced > 65536 ||
+                (result !== 0 && result !== 1) ||
+                (input.length > 0 && consumed === 0 && produced === 0 && (result !== 1 || unconsumedBoundary))) {
+                throw new ArchiveFormatError("compressed TAR WASM made no progress");
+            }
+            if (input.length > 0)
+                unconsumedBoundary = consumed === 0 && produced === 0;
+            work += consumed + produced;
+            calls++;
+            // The parser can grow this same memory, and the next codec call reuses it.
+            return { consumed, output: produced ? Buffer.from(this.bytes(abi.codec_output_ptr(), produced)) : undefined };
+        };
+        const empty = Buffer.alloc(0);
+        // Yield even for output-free skippable frames and arbitrarily small members.
+        const yieldIfNeeded = async () => {
+            if (work >= 256 * 1024 || calls >= 32) {
+                work = 0;
+                calls = 0;
+                await setImmediate(undefined, { signal });
+            }
+            signal?.throwIfAborted();
+        };
+        for await (const chunk of source) {
+            for (let offset = 0; offset < chunk.length;) {
+                const { consumed, output } = step(chunk.subarray(offset, offset + 65536));
+                offset += consumed;
+                if (output)
+                    yield output;
+                await yieldIfNeeded();
+                // A full output window can leave more decoded bytes with no new input.
+                if (output) {
+                    for (;;) {
+                        const drained = step(empty);
+                        if (drained.output)
+                            yield drained.output;
+                        await yieldIfNeeded();
+                        if (!drained.output)
+                            break;
+                    }
+                }
+            }
+        }
+        // Physical EOF, rather than a selected range or TAR EOF, ends the decoder.
+        for (;;) {
+            const drained = step(empty);
+            if (drained.output)
+                yield drained.output;
+            await yieldIfNeeded();
+            if (!drained.output)
+                break;
+        }
+        if (abi.codec_finish() !== 0)
+            throw this.codecError();
+    }
+    dispose() {
+        const abi = this.abi;
+        this.abi = undefined;
+        if (abi) {
+            try {
+                abi.codec_dispose();
+            }
+            finally {
+                abi.dispose();
+            }
+        }
+    }
+}
+/** Backpressure-aware transport only; all TAR semantics live in the Rust core. */
+export class TarParserStream extends Transform {
+    onMember;
+    session;
+    ownsSession;
+    constructor(limits, onMember, session) {
+        super();
+        this.onMember = onMember;
+        this.session = session ?? new TarWasmSession(limits);
+        this.ownsSession = session === undefined;
+    }
+    _transform(chunk, _encoding, callback) {
+        try {
+            this.session.parse(chunk, this.onMember);
+            callback(null, chunk);
+        }
+        catch (error) {
+            callback(error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+    _flush(callback) {
+        try {
+            this.session.finish();
+            callback();
+        }
+        catch (error) {
+            callback(error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+    _destroy(error, callback) {
+        try {
+            if (this.ownsSession)
+                this.session.dispose();
+        }
+        catch (cause) {
+            error ??= cause instanceof Error ? cause : new Error(String(cause));
+        }
+        callback(error);
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/archive-zip-admission.d.ts

@@ -0,0 +1,7 @@
+import type { ExtractionDeadline } from "./archive-deadline.js";
+import { type ResolvedArchiveExtractLimits } from "./archive-limits.js";
+import { type ZipDirectoryEntry } from "./archive-zip-directory.js";
+/** Admit physical records before a decoder can normalize or collapse names. */
+export declare function admitZipBuffer(input: Uint8Array, limits: ResolvedArchiveExtractLimits, onEntry?: (entry: ZipDirectoryEntry) => void): number;
+/** The extraction input is private and immutable; read bounded metadata windows. */
+export declare function admitZipFile(archivePath: string, limits: ResolvedArchiveExtractLimits, deadline: ExtractionDeadline, onEntry?: (entry: ZipDirectoryEntry) => void): Promise<number>;

package/node_modules/@openclaw/fs-safe/dist/archive-zip-admission.js

@@ -0,0 +1,96 @@
+import fs from "node:fs";
+import path from "node:path";
+import { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError } from "./archive-limits.js";
+import { openRootFile } from "./root-file.js";
+import { scanZipDirectory } from "./archive-zip-directory.js";
+import { zipFormat } from "./archive-zip-names.js";
+function checkSize(size, limits) {
+    if (size > limits.maxArchiveBytes) {
+        throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.ARCHIVE_SIZE_EXCEEDS_LIMIT);
+    }
+    if (!Number.isSafeInteger(size) || size < 0)
+        zipFormat("invalid archive size");
+}
+/** Admit physical records before a decoder can normalize or collapse names. */
+export function admitZipBuffer(input, limits, onEntry) {
+    checkSize(input.byteLength, limits);
+    const buffer = Buffer.from(input.buffer, input.byteOffset, input.byteLength);
+    const scan = scanZipDirectory(buffer.length, limits, onEntry);
+    let step = scan.next();
+    while (!step.done) {
+        const { offset, length } = step.value;
+        step = scan.next(buffer.subarray(offset, offset + length));
+    }
+    return step.value;
+}
+const METADATA_WINDOW_BYTES = 4096;
+const CACHED_READS_PER_YIELD = 32;
+/** The extraction input is private and immutable; read bounded metadata windows. */
+export async function admitZipFile(archivePath, limits, deadline, onEntry) {
+    deadline.check();
+    const opened = await openRootFile({
+        absolutePath: archivePath, rootPath: path.dirname(archivePath),
+        boundaryLabel: "staged ZIP archive", rejectSymlinks: true, rejectHardlinks: true,
+    });
+    if (!opened.ok)
+        throw opened.error ?? new Error("cannot open staged ZIP archive");
+    try {
+        checkSize(opened.stat.size, limits);
+        const scan = scanZipDirectory(opened.stat.size, limits, onEntry);
+        // Separate windows keep alternating central and local records hot. Never
+        // refill a buffer: the scanner can retain its views after cache eviction.
+        const windows = [];
+        let cachedReads = 0;
+        let step = scan.next();
+        while (!step.done) {
+            deadline.check();
+            const { offset, length } = step.value;
+            const cached = windows.findIndex(window => offset >= window.offset &&
+                length <= window.bytes.length - (offset - window.offset));
+            let bytes;
+            if (cached !== -1) {
+                if (++cachedReads >= CACHED_READS_PER_YIELD) {
+                    cachedReads = 0;
+                    await new Promise(resolve => setImmediate(resolve));
+                    deadline.check();
+                }
+                const window = windows[cached];
+                if (cached === 1)
+                    windows.reverse();
+                bytes = window.bytes.subarray(offset - window.offset, offset - window.offset + length);
+            }
+            else {
+                const cacheable = length > 0 && length <= METADATA_WINDOW_BYTES;
+                const capacity = cacheable ? Math.min(METADATA_WINDOW_BYTES, opened.stat.size - offset) : length;
+                const buffer = Buffer.alloc(capacity);
+                let received = 0;
+                while (received < capacity) {
+                    deadline.check();
+                    const count = await new Promise((resolve, reject) => {
+                        fs.read(opened.fd, buffer, received, capacity - received, offset + received, (error, count) => error ? reject(error) : resolve(count));
+                    });
+                    cachedReads = 0;
+                    deadline.check();
+                    if (!count) {
+                        if (received < length)
+                            zipFormat("truncated staged record");
+                        break;
+                    }
+                    received += count;
+                }
+                const filled = buffer.subarray(0, received);
+                bytes = filled.subarray(0, length);
+                if (cacheable) {
+                    windows.unshift({ offset, bytes: filled });
+                    if (windows.length > 2)
+                        windows.pop();
+                }
+            }
+            step = scan.next(bytes);
+        }
+        return step.value;
+    }
+    finally {
+        fs.closeSync(opened.fd);
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/archive-zip-count.d.ts

@@ -0,0 +1 @@
+export declare function readZipCentralDirectoryEntryCount(buffer: Buffer | Uint8Array): number | null;

package/node_modules/@openclaw/fs-safe/dist/archive-zip-count.js

@@ -0,0 +1,160 @@
+// Conservative public count hint; strict admission must not rely on its fallback.
+const ZIP_EOCD_SIGNATURE = 0x06054b50;
+const ZIP_EOCD_SIGNATURE_BYTES = Buffer.from([0x50, 0x4b, 0x05, 0x06]);
+const ZIP64_EOCD_SIGNATURE = 0x06064b50;
+const ZIP64_EOCD_LOCATOR_SIGNATURE = 0x07064b50;
+const ZIP_EOCD_MIN_BYTES = 22;
+const ZIP_EOCD_MAX_COMMENT_BYTES = 0xffff;
+const ZIP64_ENTRY_COUNT_SENTINEL = 0xffff;
+const ZIP64_UINT32_SENTINEL = 0xffffffff;
+const ZIP_CENTRAL_FILE_HEADER_SIGNATURE = 0x02014b50;
+const ZIP_CENTRAL_FILE_HEADER_MIN_BYTES = 46;
+const ZIP_CENTRAL_FILE_HEADER_NAME_LENGTH_OFFSET = 28;
+const ZIP_CENTRAL_FILE_HEADER_EXTRA_LENGTH_OFFSET = 30;
+const ZIP_CENTRAL_FILE_HEADER_COMMENT_LENGTH_OFFSET = 32;
+const ZIP_EOCD_TOTAL_ENTRIES_OFFSET = 10;
+const ZIP_EOCD_CENTRAL_DIRECTORY_SIZE_OFFSET = 12;
+const ZIP_EOCD_CENTRAL_DIRECTORY_OFFSET_OFFSET = 16;
+const ZIP_EOCD_COMMENT_LENGTH_OFFSET = 20;
+const ZIP64_EOCD_LOCATOR_BYTES = 20;
+const ZIP64_EOCD_OFFSET_OFFSET = 8;
+const ZIP64_EOCD_TOTAL_ENTRIES_OFFSET = 32;
+const ZIP64_EOCD_CENTRAL_DIRECTORY_SIZE_OFFSET = 40;
+const ZIP64_EOCD_CENTRAL_DIRECTORY_OFFSET_OFFSET = 48;
+function asBufferView(buffer) {
+    if (Buffer.isBuffer(buffer)) {
+        return buffer;
+    }
+    return Buffer.from(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+}
+function readSafeUInt64LE(buffer, offset) {
+    const value = buffer.readBigUInt64LE(offset);
+    if (value > BigInt(Number.MAX_SAFE_INTEGER)) {
+        return Number.MAX_SAFE_INTEGER;
+    }
+    return Number(value);
+}
+function findZipEndOfCentralDirectory(buffer) {
+    if (buffer.byteLength < ZIP_EOCD_MIN_BYTES) {
+        return -1;
+    }
+    const minOffset = Math.max(0, buffer.byteLength - ZIP_EOCD_MIN_BYTES - ZIP_EOCD_MAX_COMMENT_BYTES);
+    const lastOffset = buffer.byteLength - ZIP_EOCD_MIN_BYTES;
+    if (buffer.readUInt32LE(lastOffset) === ZIP_EOCD_SIGNATURE &&
+        buffer.readUInt16LE(lastOffset + ZIP_EOCD_COMMENT_LENGTH_OFFSET) === 0) {
+        return lastOffset;
+    }
+    const tail = buffer.subarray(minOffset);
+    let from = lastOffset - minOffset - 1;
+    // Keep the latest valid record semantics of this count hint. Bound native
+    // searches so dense false signatures retain the byte scan's cost.
+    for (let candidates = 0; candidates < 16 && from >= 0; candidates += 1) {
+        const found = tail.lastIndexOf(ZIP_EOCD_SIGNATURE_BYTES, from);
+        if (found < 0)
+            return -1;
+        const offset = minOffset + found;
+        const commentLength = buffer.readUInt16LE(offset + ZIP_EOCD_COMMENT_LENGTH_OFFSET);
+        if (offset + ZIP_EOCD_MIN_BYTES + commentLength === buffer.byteLength)
+            return offset;
+        from = found - 1;
+    }
+    for (let offset = minOffset + from; offset >= minOffset; offset -= 1) {
+        if (buffer.readUInt32LE(offset) !== ZIP_EOCD_SIGNATURE) {
+            continue;
+        }
+        const commentLength = buffer.readUInt16LE(offset + ZIP_EOCD_COMMENT_LENGTH_OFFSET);
+        if (offset + ZIP_EOCD_MIN_BYTES + commentLength === buffer.byteLength) {
+            return offset;
+        }
+    }
+    return -1;
+}
+function readZip64CentralDirectoryInfo(buffer, eocdOffset) {
+    const locatorOffset = eocdOffset - ZIP64_EOCD_LOCATOR_BYTES;
+    if (locatorOffset < 0 || buffer.readUInt32LE(locatorOffset) !== ZIP64_EOCD_LOCATOR_SIGNATURE) {
+        return null;
+    }
+    const zip64EocdOffset = readSafeUInt64LE(buffer, locatorOffset + ZIP64_EOCD_OFFSET_OFFSET);
+    if (zip64EocdOffset < 0 ||
+        zip64EocdOffset + ZIP64_EOCD_CENTRAL_DIRECTORY_OFFSET_OFFSET + 8 > buffer.byteLength ||
+        buffer.readUInt32LE(zip64EocdOffset) !== ZIP64_EOCD_SIGNATURE) {
+        return null;
+    }
+    return {
+        declaredEntryCount: readSafeUInt64LE(buffer, zip64EocdOffset + ZIP64_EOCD_TOTAL_ENTRIES_OFFSET),
+        centralDirectorySize: readSafeUInt64LE(buffer, zip64EocdOffset + ZIP64_EOCD_CENTRAL_DIRECTORY_SIZE_OFFSET),
+        centralDirectoryOffset: readSafeUInt64LE(buffer, zip64EocdOffset + ZIP64_EOCD_CENTRAL_DIRECTORY_OFFSET_OFFSET),
+        endOfCentralDirectoryOffset: eocdOffset,
+    };
+}
+function readZipCentralDirectoryInfo(buffer) {
+    const eocdOffset = findZipEndOfCentralDirectory(buffer);
+    if (eocdOffset < 0) {
+        return null;
+    }
+    const declaredEntryCount = buffer.readUInt16LE(eocdOffset + ZIP_EOCD_TOTAL_ENTRIES_OFFSET);
+    const centralDirectorySize = buffer.readUInt32LE(eocdOffset + ZIP_EOCD_CENTRAL_DIRECTORY_SIZE_OFFSET);
+    const centralDirectoryOffset = buffer.readUInt32LE(eocdOffset + ZIP_EOCD_CENTRAL_DIRECTORY_OFFSET_OFFSET);
+    const usesZip64 = declaredEntryCount === ZIP64_ENTRY_COUNT_SENTINEL ||
+        centralDirectorySize === ZIP64_UINT32_SENTINEL ||
+        centralDirectoryOffset === ZIP64_UINT32_SENTINEL;
+    if (usesZip64) {
+        return (readZip64CentralDirectoryInfo(buffer, eocdOffset) ?? {
+            declaredEntryCount,
+            centralDirectoryOffset,
+            centralDirectorySize,
+            endOfCentralDirectoryOffset: eocdOffset,
+        });
+    }
+    return {
+        declaredEntryCount,
+        centralDirectoryOffset,
+        centralDirectorySize,
+        endOfCentralDirectoryOffset: eocdOffset,
+    };
+}
+function countZipCentralDirectoryHeaders(buffer, info) {
+    const start = info.centralDirectoryOffset;
+    const declaredEnd = start + info.centralDirectorySize;
+    const scanEnd = info.endOfCentralDirectoryOffset;
+    if (!Number.isSafeInteger(start) ||
+        !Number.isSafeInteger(declaredEnd) ||
+        !Number.isSafeInteger(scanEnd) ||
+        start < 0 ||
+        declaredEnd < start ||
+        scanEnd < start ||
+        scanEnd > buffer.byteLength) {
+        return null;
+    }
+    let offset = start;
+    let count = 0;
+    while (offset < scanEnd) {
+        if (scanEnd - offset < ZIP_CENTRAL_FILE_HEADER_MIN_BYTES) {
+            break;
+        }
+        if (buffer.readUInt32LE(offset) !== ZIP_CENTRAL_FILE_HEADER_SIGNATURE) {
+            break;
+        }
+        const nameLength = buffer.readUInt16LE(offset + ZIP_CENTRAL_FILE_HEADER_NAME_LENGTH_OFFSET);
+        const extraLength = buffer.readUInt16LE(offset + ZIP_CENTRAL_FILE_HEADER_EXTRA_LENGTH_OFFSET);
+        const commentLength = buffer.readUInt16LE(offset + ZIP_CENTRAL_FILE_HEADER_COMMENT_LENGTH_OFFSET);
+        const nextOffset = offset + ZIP_CENTRAL_FILE_HEADER_MIN_BYTES + nameLength + extraLength + commentLength;
+        if (nextOffset <= offset || nextOffset > scanEnd) {
+            return null;
+        }
+        count += 1;
+        offset = nextOffset;
+    }
+    return count > 0 || info.declaredEntryCount === 0 ? count : null;
+}
+export function readZipCentralDirectoryEntryCount(buffer) {
+    const view = asBufferView(buffer);
+    const info = readZipCentralDirectoryInfo(view);
+    if (!info) {
+        return null;
+    }
+    const countedEntryCount = countZipCentralDirectoryHeaders(view, info);
+    return countedEntryCount === null
+        ? info.declaredEntryCount
+        : Math.max(info.declaredEntryCount, countedEntryCount);
+}

package/node_modules/@openclaw/fs-safe/dist/archive-zip-directory.d.ts

@@ -0,0 +1,21 @@
+import { type ResolvedArchiveExtractLimits } from "./archive-limits.js";
+import type { ArchiveEntryKind } from "./archive-plan.js";
+export type ZipRead = {
+    offset: number;
+    length: number;
+};
+export type ZipScan = Generator<ZipRead, number, Buffer>;
+export type ZipDirectoryEntry = {
+    index: number;
+    creatorSystem: number;
+    externalAttributes: number;
+    size: number;
+    compressedSize: number;
+    compressionMethod: number;
+    crc32: number;
+    path?: string;
+    portableKey: string;
+    portableDirectory: boolean;
+    kind: ArchiveEntryKind;
+};
+export declare function scanZipDirectory(size: number, limits: ResolvedArchiveExtractLimits, onEntry?: (entry: ZipDirectoryEntry) => void): ZipScan;