@openclaw/signal 2026.9.5 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/trash.js

@@ -0,0 +1,219 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { sameFileIdentity } from "./file-identity.js";
+import { guardedRenameSync, guardedRmSync } from "./guarded-mutation.js";
+import { realpathSync } from "./realpath.js";
+import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
+import { getFsSafeTestHooks } from "./test-hooks.js";
+import { hasWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
+const TRASH_DESTINATION_COLLISION_CODES = new Set(["EEXIST", "ENOTEMPTY", "ERR_FS_CP_EEXIST"]);
+const TRASH_DESTINATION_RETRY_LIMIT = 4;
+function getFsErrorCode(error) {
+    if (!error || typeof error !== "object" || !("code" in error)) {
+        return undefined;
+    }
+    const code = error.code;
+    return typeof code === "string" ? code : undefined;
+}
+function isTrashDestinationCollision(error) {
+    const code = getFsErrorCode(error);
+    return Boolean(code && TRASH_DESTINATION_COLLISION_CODES.has(code));
+}
+function isSameOrChildPath(candidate, parent) {
+    return candidate === parent || candidate.startsWith(parent.endsWith(path.sep) ? parent : `${parent}${path.sep}`);
+}
+function assertNoTrashPathAlias(value, label) {
+    if (hasWindowsPathAlias(value, "filesystem")) {
+        throw new Error(`Refusing to trash ${label} using a Windows filesystem namespace alias: ${value}`);
+    }
+}
+function collectAllowedTrashRoots(allowedRoots) {
+    const roots = [...(allowedRoots ?? [os.homedir(), os.tmpdir()])];
+    for (const root of roots)
+        assertNoTrashPathAlias(root, "allowed root");
+    return roots;
+}
+function resolveAllowedTrashRoots(allowedRoots) {
+    const roots = allowedRoots.flatMap((root) => {
+        assertNoTrashPathAlias(root, "allowed root");
+        const lexicalRoot = resolvePathPreservingWindowsRoot(root);
+        assertNoTrashPathAlias(lexicalRoot, "allowed root");
+        let realRoot;
+        try {
+            // Keep both spellings: broken symlink targets cannot be realpathed and
+            // may only compare equal to the caller's lexical allowed root.
+            realRoot = realpathSync.native(root);
+        }
+        catch {
+            return [lexicalRoot];
+        }
+        assertNoTrashPathAlias(realRoot, "allowed root");
+        const resolvedRealRoot = resolvePathPreservingWindowsRoot(realRoot);
+        assertNoTrashPathAlias(resolvedRealRoot, "allowed root");
+        return [resolvedRealRoot, lexicalRoot];
+    });
+    return [...new Set(roots)];
+}
+function resolveTrashTargetPath(targetPath) {
+    assertNoTrashPathAlias(targetPath, "target path");
+    let realPath;
+    try {
+        realPath = realpathSync.native(targetPath);
+    }
+    catch {
+        // Broken symlinks are valid trash targets. Fall back to the lexical path,
+        // then rely on lstat identity so the move renames the symlink itself.
+        const lexicalPath = path.resolve(targetPath);
+        assertNoTrashPathAlias(lexicalPath, "target path");
+        return { path: lexicalPath, resolved: false };
+    }
+    const resolvedPath = path.resolve(realPath);
+    assertNoTrashPathAlias(resolvedPath, "target path");
+    return { path: resolvedPath, resolved: true };
+}
+function assertAllowedTrashTarget(targetPath, allowedRoots) {
+    assertNoTrashPathAlias(targetPath, "target path");
+    const lexicalTarget = path.resolve(targetPath);
+    assertNoTrashPathAlias(lexicalTarget, "target path");
+    const stat = fs.lstatSync(lexicalTarget);
+    const resolvedTarget = resolveTrashTargetPath(targetPath);
+    const resolvedTargetPath = resolvedTarget.path;
+    const isAllowed = resolveAllowedTrashRoots(allowedRoots).some((root) => resolvedTargetPath !== root && isSameOrChildPath(resolvedTargetPath, root));
+    if (!isAllowed) {
+        throw new Error(`Refusing to trash path outside allowed roots: ${targetPath}`);
+    }
+    return {
+        path: lexicalTarget,
+        realPath: resolvedTargetPath,
+        realPathResolved: resolvedTarget.resolved,
+        stat,
+    };
+}
+function assertTrashTargetGuard(guard) {
+    const stat = fs.lstatSync(guard.path);
+    if (!sameFileIdentity(stat, guard.stat)) {
+        throw new Error(`Refusing to trash path after it changed: ${guard.path}`);
+    }
+    const current = resolveTrashTargetPath(guard.path);
+    if (guard.realPathResolved && (!current.resolved || current.path !== guard.realPath)) {
+        throw new Error(`Refusing to trash path after it changed: ${guard.path}`);
+    }
+    if (!guard.realPathResolved && current.resolved) {
+        throw new Error(`Refusing to trash path after it changed: ${guard.path}`);
+    }
+}
+function resolveTrashDir() {
+    const homeDir = os.homedir();
+    assertNoTrashPathAlias(homeDir, "home directory");
+    const trashDir = path.join(homeDir, ".Trash");
+    assertNoTrashPathAlias(trashDir, "trash directory");
+    fs.mkdirSync(recursiveMkdirPath(trashDir), { recursive: true, mode: 0o700 });
+    const trashDirStat = fs.lstatSync(trashDir);
+    if (!trashDirStat.isDirectory() || trashDirStat.isSymbolicLink()) {
+        throw new Error(`Refusing to use non-directory/symlink trash directory: ${trashDir}`);
+    }
+    const realHome = path.resolve(realpathSync.native(homeDir));
+    const resolvedTrashDir = path.resolve(realpathSync.native(trashDir));
+    assertNoTrashPathAlias(realHome, "home directory");
+    assertNoTrashPathAlias(resolvedTrashDir, "trash directory");
+    if (resolvedTrashDir === realHome || !isSameOrChildPath(resolvedTrashDir, realHome)) {
+        throw new Error(`Trash directory escaped home directory: ${trashDir}`);
+    }
+    return resolvedTrashDir;
+}
+function trashBaseName(targetPath) {
+    assertNoTrashPathAlias(targetPath, "target path");
+    const resolvedTargetPath = path.resolve(targetPath);
+    assertNoTrashPathAlias(resolvedTargetPath, "target path");
+    if (resolvedTargetPath === path.parse(resolvedTargetPath).root) {
+        throw new Error(`Refusing to trash root path: ${targetPath}`);
+    }
+    const base = path.basename(resolvedTargetPath).replace(/[\\/]+/g, "");
+    if (!base) {
+        throw new Error(`Unable to derive safe trash basename for: ${targetPath}`);
+    }
+    return base;
+}
+function resolveContainedPath(root, leaf) {
+    assertNoTrashPathAlias(root, "destination root");
+    assertNoTrashPathAlias(leaf, "destination name");
+    const resolvedRoot = path.resolve(root);
+    const resolvedPath = path.resolve(resolvedRoot, leaf);
+    assertNoTrashPathAlias(resolvedRoot, "destination root");
+    assertNoTrashPathAlias(resolvedPath, "destination path");
+    if (!isSameOrChildPath(resolvedPath, resolvedRoot) || resolvedPath === resolvedRoot) {
+        throw new Error(`Trash destination escaped trash directory: ${resolvedPath}`);
+    }
+    return resolvedPath;
+}
+function reserveTrashDestination(trashDir, base, timestamp) {
+    assertNoTrashPathAlias(trashDir, "trash directory");
+    assertNoTrashPathAlias(base, "destination name");
+    const containerPrefix = resolveContainedPath(trashDir, `.fs-safe-trash-${timestamp}-`);
+    const container = fs.mkdtempSync(containerPrefix);
+    const resolvedContainer = path.resolve(container);
+    const resolvedTrashDir = path.resolve(trashDir);
+    assertNoTrashPathAlias(resolvedContainer, "destination container");
+    assertNoTrashPathAlias(resolvedTrashDir, "trash directory");
+    if (resolvedContainer === resolvedTrashDir ||
+        !isSameOrChildPath(resolvedContainer, resolvedTrashDir)) {
+        throw new Error(`Trash destination escaped trash directory: ${container}`);
+    }
+    return resolveContainedPath(container, base);
+}
+function copyTrashTargetSync(target, dest) {
+    if (target.stat.isSymbolicLink()) {
+        const linkTarget = fs.readlinkSync(target.path);
+        assertNoTrashPathAlias(linkTarget, "symlink target");
+        assertTrashTargetGuard(target);
+        fs.symlinkSync(linkTarget, dest);
+        return;
+    }
+    fs.cpSync(target.path, dest, { recursive: true, force: false, errorOnExist: true });
+}
+function movePathToDestination(target, dest) {
+    getFsSafeTestHooks()?.beforeTrashMove?.(target.path, dest);
+    assertTrashTargetGuard(target);
+    try {
+        guardedRenameSync({ from: target.path, to: dest });
+        return true;
+    }
+    catch (error) {
+        if (getFsErrorCode(error) !== "EXDEV") {
+            if (isTrashDestinationCollision(error)) {
+                return false;
+            }
+            throw error;
+        }
+    }
+    try {
+        assertTrashTargetGuard(target);
+        copyTrashTargetSync(target, dest);
+        assertTrashTargetGuard(target);
+        guardedRmSync({ target: target.path, recursive: true, force: false, verifyAfter: false });
+        return true;
+    }
+    catch (error) {
+        if (isTrashDestinationCollision(error)) {
+            return false;
+        }
+        throw error;
+    }
+}
+export async function movePathToTrash(targetPath, options = {}) {
+    // Avoid resolving external trash helpers through the service PATH during cleanup.
+    assertNoTrashPathAlias(targetPath, "target path");
+    const allowedRoots = collectAllowedTrashRoots(options.allowedRoots);
+    const base = trashBaseName(targetPath);
+    const target = assertAllowedTrashTarget(targetPath, allowedRoots);
+    const trashDir = resolveTrashDir();
+    const timestamp = Date.now();
+    for (let attempt = 0; attempt < TRASH_DESTINATION_RETRY_LIMIT; attempt += 1) {
+        const dest = reserveTrashDestination(trashDir, base, timestamp);
+        if (movePathToDestination(target, dest)) {
+            return dest;
+        }
+    }
+    throw new Error(`Unable to choose a unique trash destination for ${targetPath}`);
+}

package/node_modules/@openclaw/fs-safe/dist/types.d.ts

@@ -0,0 +1,22 @@
+export type FastPathMode = "auto" | "never" | "require";
+export type SafeEncoding = BufferEncoding | null;
+export type PathStat = {
+    dev: number;
+    gid: number;
+    ino: number;
+    isDirectory: boolean;
+    isFile: boolean;
+    isSymbolicLink: boolean;
+    mode: number;
+    mtimeMs: number;
+    nlink: number;
+    size: number;
+    uid: number;
+};
+export type DirEntry = PathStat & {
+    name: string;
+};
+export type BasePathOptions = {
+    rootDir: string;
+    relativePath: string;
+};

package/node_modules/@openclaw/fs-safe/dist/types.js

@@ -0,0 +1 @@
+export {};

package/node_modules/@openclaw/fs-safe/dist/unicode-path.d.ts

@@ -0,0 +1,2 @@
+export declare function lowerCaseNfc(value: string): string;
+export declare function maxNormalizedUtf8Bytes(value: string, includeRaw?: boolean): number;

package/node_modules/@openclaw/fs-safe/dist/unicode-path.js

@@ -0,0 +1,16 @@
+const NON_ASCII = /[^\x00-\x7f]/;
+export function lowerCaseNfc(value) {
+    return NON_ASCII.test(value) ? value.normalize("NFC").toLowerCase().normalize("NFC") : value.toLowerCase();
+}
+export function maxNormalizedUtf8Bytes(value, includeRaw = false) {
+    // ASCII has identical raw, NFC and NFD forms, with one UTF-8 byte per unit.
+    if (typeof value === "string" && !NON_ASCII.test(value))
+        return value.length;
+    const nfc = value.normalize("NFC");
+    const bytes = Buffer.byteLength(nfc, "utf8");
+    const maximum = includeRaw && nfc !== value ? Math.max(bytes, Buffer.byteLength(value, "utf8")) : bytes;
+    // ASCII NFC output also has identical NFD and one UTF-8 byte per code unit.
+    if (bytes === nfc.length)
+        return maximum;
+    return Math.max(maximum, Buffer.byteLength(value.normalize("NFD"), "utf8"));
+}

package/node_modules/@openclaw/fs-safe/dist/walk.d.ts

@@ -0,0 +1,40 @@
+import fsSync from "node:fs";
+export type WalkEntryKind = "file" | "directory" | "symlink" | "other";
+export type WalkSymlinkPolicy = "skip" | "follow" | "include";
+export type WalkDirectoryEntry = {
+    name: string;
+    path: string;
+    relativePath: string;
+    depth: number;
+    kind: WalkEntryKind;
+    dirent: fsSync.Dirent;
+};
+export type WalkDirectoryOptions = {
+    maxDepth?: number;
+    maxEntries?: number;
+    symlinks?: WalkSymlinkPolicy;
+    include?: (entry: WalkDirectoryEntry) => boolean;
+    descend?: (entry: WalkDirectoryEntry) => boolean;
+};
+export type AsyncWalkDirectoryOptions = Omit<WalkDirectoryOptions, "include" | "descend"> & {
+    include?: (entry: WalkDirectoryEntry) => boolean | Promise<boolean>;
+    descend?: (entry: WalkDirectoryEntry) => boolean | Promise<boolean>;
+};
+export type WalkDirectoryFailure = {
+    path: string;
+    relativePath: string;
+    depth: number;
+    error: unknown;
+};
+export type WalkDirectoryResult = {
+    entries: WalkDirectoryEntry[];
+    scannedEntryCount: number;
+    truncated: boolean;
+    failedDirs?: WalkDirectoryFailure[];
+};
+type WalkDirectoryResultWithFailures = WalkDirectoryResult & {
+    failedDirs: WalkDirectoryFailure[];
+};
+export declare function walkDirectorySync(rootDir: string, options?: WalkDirectoryOptions): WalkDirectoryResultWithFailures;
+export declare function walkDirectory(rootDir: string, options?: AsyncWalkDirectoryOptions): Promise<WalkDirectoryResultWithFailures>;
+export {};

package/node_modules/@openclaw/fs-safe/dist/walk.js

@@ -0,0 +1,207 @@
+import fsSync from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { realpathSync } from "./realpath.js";
+import { pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
+function validateWalkBudget(name, value) {
+    if (value !== undefined && (!Number.isSafeInteger(value) || value < 0)) {
+        throw new RangeError(`${name} must be a non-negative safe integer`);
+    }
+}
+function validateWalkOptions(options) {
+    validateWalkBudget("maxDepth", options.maxDepth);
+    validateWalkBudget("maxEntries", options.maxEntries);
+    if (options.symlinks !== undefined &&
+        !["skip", "follow", "include"].includes(options.symlinks)) {
+        throw new TypeError(`invalid walk symlink policy: ${String(options.symlinks)}`);
+    }
+}
+function isObjectResult(result) {
+    return result !== null &&
+        (typeof result === "object" || typeof result === "function");
+}
+function kindForDirent(dirent) {
+    if (dirent.isDirectory())
+        return "directory";
+    if (dirent.isFile())
+        return "file";
+    if (dirent.isSymbolicLink())
+        return "symlink";
+    return "other";
+}
+function shouldStop(result, options) {
+    return options.maxEntries !== undefined && result.scannedEntryCount >= Math.max(0, options.maxEntries);
+}
+function buildEntry(params) {
+    const fullPath = params.fullPath;
+    return {
+        name: params.dirent.name,
+        path: fullPath,
+        relativePath: params.relativePath,
+        depth: params.depth,
+        kind: params.kind ?? kindForDirent(params.dirent),
+        dirent: params.dirent,
+    };
+}
+function recordFailedDir(result, root, dir, depth, error) {
+    const relativePath = path.relative(root, dir);
+    result.failedDirs.push({
+        path: dir,
+        relativePath,
+        depth: relativePath === "" ? 0 : depth - 1,
+        error,
+    });
+}
+function resolveKind(fullPath, dirent, symlinks) {
+    const kind = kindForDirent(dirent);
+    if (kind !== "symlink")
+        return kind;
+    if (symlinks === "skip")
+        return null;
+    if (symlinks === "include")
+        return "symlink";
+    try {
+        const stat = fsSync.statSync(fullPath);
+        if (stat.isDirectory())
+            return "directory";
+        if (stat.isFile())
+            return "file";
+    }
+    catch {
+        return null;
+    }
+    return "other";
+}
+export function walkDirectorySync(rootDir, options = {}) {
+    validateWalkOptions(options);
+    const root = resolvePathPreservingWindowsRoot(rootDir);
+    const symlinks = options.symlinks ?? "skip";
+    const result = {
+        entries: [],
+        scannedEntryCount: 0,
+        truncated: false,
+        failedDirs: [],
+    };
+    const visitedDirs = new Set();
+    function visit(dir, relativeDir, depth) {
+        if (options.maxDepth !== undefined && depth > options.maxDepth)
+            return;
+        let realDir;
+        const operationPath = pathForWindowsFilesystem(dir);
+        try {
+            if (depth > 1 && symlinks !== "follow" && fsSync.lstatSync(operationPath).isSymbolicLink())
+                return;
+            realDir = realpathSync(operationPath);
+        }
+        catch (error) {
+            recordFailedDir(result, root, dir, depth, error);
+            return;
+        }
+        if (visitedDirs.has(realDir))
+            return;
+        visitedDirs.add(realDir);
+        let entries;
+        try {
+            entries = fsSync.readdirSync(operationPath, { withFileTypes: true });
+        }
+        catch (error) {
+            recordFailedDir(result, root, dir, depth, error);
+            return;
+        }
+        const childPrefix = dir.endsWith(path.sep) ? dir : `${dir}${path.sep}`;
+        for (const dirent of entries) {
+            if (shouldStop(result, options)) {
+                result.truncated = true;
+                return;
+            }
+            result.scannedEntryCount += 1;
+            const fullPath = childPrefix + dirent.name;
+            const kind = resolveKind(fullPath, dirent, symlinks);
+            if (!kind)
+                continue;
+            const relativePath = relativeDir ? `${relativeDir}${path.sep}${dirent.name}` : dirent.name;
+            const entry = buildEntry({ relativePath, fullPath, dirent, depth, kind });
+            if (options.include?.(entry) ?? true) {
+                result.entries.push(entry);
+            }
+            if (kind === "directory" &&
+                (options.maxDepth === undefined || depth < options.maxDepth) &&
+                (options.descend?.(entry) ?? true)) {
+                visit(fullPath, relativePath, depth + 1);
+                if (result.truncated)
+                    return;
+            }
+        }
+    }
+    visit(root, "", 1);
+    return result;
+}
+export async function walkDirectory(rootDir, options = {}) {
+    validateWalkOptions(options);
+    const root = resolvePathPreservingWindowsRoot(rootDir);
+    const symlinks = options.symlinks ?? "skip";
+    const result = {
+        entries: [],
+        scannedEntryCount: 0,
+        truncated: false,
+        failedDirs: [],
+    };
+    const visitedDirs = new Set();
+    async function visit(dir, relativeDir, depth) {
+        if (options.maxDepth !== undefined && depth > options.maxDepth)
+            return;
+        let realDir;
+        const operationPath = pathForWindowsFilesystem(dir);
+        try {
+            if (depth > 1 && symlinks !== "follow" && fsSync.lstatSync(operationPath).isSymbolicLink())
+                return;
+            realDir = realpathSync.native(operationPath);
+        }
+        catch (error) {
+            recordFailedDir(result, root, dir, depth, error);
+            return;
+        }
+        if (visitedDirs.has(realDir))
+            return;
+        visitedDirs.add(realDir);
+        let entries;
+        try {
+            entries = await fs.readdir(operationPath, { withFileTypes: true });
+        }
+        catch (error) {
+            recordFailedDir(result, root, dir, depth, error);
+            return;
+        }
+        const childPrefix = dir.endsWith(path.sep) ? dir : `${dir}${path.sep}`;
+        for (const dirent of entries) {
+            if (shouldStop(result, options)) {
+                result.truncated = true;
+                return;
+            }
+            result.scannedEntryCount += 1;
+            const fullPath = childPrefix + dirent.name;
+            const kind = resolveKind(fullPath, dirent, symlinks);
+            if (!kind)
+                continue;
+            const relativePath = relativeDir ? `${relativeDir}${path.sep}${dirent.name}` : dirent.name;
+            const entry = buildEntry({ relativePath, fullPath, dirent, depth, kind });
+            const include = options.include;
+            const included = include == null ? true : Reflect.apply(include, options, [entry]);
+            if ((isObjectResult(included) ? await included : included) ?? true) {
+                result.entries.push(entry);
+            }
+            if (kind === "directory" &&
+                (options.maxDepth === undefined || depth < options.maxDepth)) {
+                const descend = options.descend;
+                const descended = descend == null ? true : Reflect.apply(descend, options, [entry]);
+                if ((isObjectResult(descended) ? await descended : descended) ?? true) {
+                    await visit(fullPath, relativePath, depth + 1);
+                    if (result.truncated)
+                        return;
+                }
+            }
+        }
+    }
+    await visit(root, "", 1);
+    return result;
+}

package/node_modules/@openclaw/fs-safe/dist/windows-command.d.ts

@@ -0,0 +1 @@
+export declare function resolveWindowsSystemCommand(command: string, env?: NodeJS.ProcessEnv): string;

package/node_modules/@openclaw/fs-safe/dist/windows-command.js

@@ -0,0 +1,34 @@
+import path from "node:path";
+function getEnvValueCaseInsensitive(env, name) {
+    const direct = env[name];
+    if (direct !== undefined) {
+        return direct;
+    }
+    const lower = name.toLowerCase();
+    for (const [key, value] of Object.entries(env)) {
+        if (key.toLowerCase() === lower) {
+            return value;
+        }
+    }
+    return undefined;
+}
+function normalizeWindowsInstallRoot(value) {
+    const trimmed = value?.trim();
+    if (!trimmed || !path.win32.isAbsolute(trimmed)) {
+        return null;
+    }
+    let end = trimmed.length;
+    while (end > 0 && (trimmed[end - 1] === "\\" || trimmed[end - 1] === "/")) {
+        end -= 1;
+    }
+    return trimmed.slice(0, end);
+}
+function resolveWindowsSystemRoot(env) {
+    const source = env ?? process.env;
+    return (normalizeWindowsInstallRoot(getEnvValueCaseInsensitive(source, "SystemRoot")) ??
+        normalizeWindowsInstallRoot(getEnvValueCaseInsensitive(source, "WINDIR")) ??
+        "C:\\Windows");
+}
+export function resolveWindowsSystemCommand(command, env) {
+    return path.win32.join(resolveWindowsSystemRoot(env), "System32", command);
+}

package/node_modules/@openclaw/fs-safe/dist/windows-owner.d.ts

@@ -0,0 +1,28 @@
+import { type PermissionCommandFailure } from "./permission-exec.js";
+export type WindowsOwnerExec = (command: string, args: string[]) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+export type WindowsOwnerSummary = {
+    sid?: string;
+    currentUserSid?: string;
+    daclPresent?: boolean;
+    aces?: WindowsOwnerAce[];
+    aclError?: string;
+    remote?: boolean;
+    trusted?: boolean;
+    error?: string;
+    errorDetail?: PermissionCommandFailure;
+    errorCause?: unknown;
+};
+export type WindowsOwnerAce = {
+    sid: string;
+    mask: number;
+    deny: boolean;
+    inheritOnly: boolean;
+};
+export declare function inspectWindowsOwner(params: {
+    targetPath: string;
+    env?: NodeJS.ProcessEnv;
+    exec: WindowsOwnerExec;
+}): Promise<WindowsOwnerSummary>;

package/node_modules/@openclaw/fs-safe/dist/windows-owner.js

@@ -0,0 +1,101 @@
+import { formatCaughtPermissionFailure, getPermissionCommandFailure, } from "./permission-exec.js";
+import { resolveWindowsSystemCommand } from "./windows-command.js";
+import { hasWindowsPathAlias } from "./windows-path-alias.js";
+const SID_RE = /^\*?s-\d+-\d+(-\d+)+$/i;
+const TRUSTED_OWNER_SIDS = new Set(["s-1-5-18", "s-1-5-32-544"]);
+function normalizeSid(value) {
+    const normalized = value.trim().toLowerCase();
+    return normalized.startsWith("*") ? normalized.slice(1) : normalized;
+}
+function encodePowerShellCommand(source) {
+    return Buffer.from(source, "utf16le").toString("base64");
+}
+function windowsOwnerQueryCommand(targetPath) {
+    const encodedPath = Buffer.from(targetPath, "utf8").toString("base64");
+    return [
+        "$ErrorActionPreference='Stop'",
+        "$env:PSModulePath=[IO.Path]::Combine($PSHOME,'Modules')",
+        `$p=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encodedPath}'))`,
+        "$sections=[System.Security.AccessControl.AccessControlSections]::Access -bor [System.Security.AccessControl.AccessControlSections]::Owner",
+        "$acl=if([IO.Directory]::Exists($p)){[IO.Directory]::GetAccessControl($p,$sections)}else{[IO.File]::GetAccessControl($p,$sections)}",
+        "$ownerSid=$acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value",
+        "$currentSid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value",
+        "$root=[IO.Path]::GetPathRoot($p)",
+        "$extendedDrive=$p.Length -ge 7 -and $p.StartsWith('\\\\?\\') -and [char]::IsLetter($p[4]) -and $p[5] -eq ':' -and $p[6] -eq '\\'",
+        "$driveRoot=if($extendedDrive){$p.Substring(4,3)}else{$root}",
+        "$namespacePath=$p.StartsWith('\\\\')",
+        "$remote=($namespacePath -and -not $extendedDrive) -or ([IO.DriveInfo]::new($driveRoot).DriveType -eq [IO.DriveType]::Network)",
+        // Emit only ASCII SID and numeric facts: console encodings can replace both
+        // Unicode pathnames and account names before JavaScript receives the bytes.
+        "$raw=[System.Security.AccessControl.RawSecurityDescriptor]::new($acl.GetSecurityDescriptorBinaryForm(),0)",
+        "$dacl=$raw.DiscretionaryAcl;$complete=$true",
+        "$aces=@(foreach($ace in $dacl){if($ace -isnot [System.Security.AccessControl.CommonAce] -or $ace.IsCallback -or [int]$ace.AceType -notin @(0,1)){$complete=$false;continue};@{sid=$ace.SecurityIdentifier.Value;mask=([long]$ace.AccessMask -band 4294967295);deny=([int]$ace.AceType -eq 1);inheritOnly=([int]$ace.AceFlags -band 8) -ne 0}})",
+        "@{ownerSid=$ownerSid;currentUserSid=$currentSid;daclPresent=($null -ne $dacl);aces=$aces;complete=$complete;remote=$remote}|Microsoft.PowerShell.Utility\\ConvertTo-Json -Depth 4 -Compress",
+    ].join(";");
+}
+function parseWindowsAclFacts(parsed) {
+    if (parsed.complete !== true || typeof parsed.daclPresent !== "boolean" || !Array.isArray(parsed.aces)) {
+        return { aclError: "Windows ACL query returned incomplete descriptor data" };
+    }
+    const aces = [];
+    for (const row of parsed.aces) {
+        if (!row || typeof row !== "object" || typeof row.sid !== "string" || !SID_RE.test(row.sid) ||
+            typeof row.mask !== "number" || !Number.isInteger(row.mask) || row.mask < 0 || row.mask > 0xffff_ffff ||
+            typeof row.deny !== "boolean" || typeof row.inheritOnly !== "boolean") {
+            return { aclError: "Windows ACL query returned invalid access-rule data" };
+        }
+        aces.push({ sid: normalizeSid(row.sid), mask: row.mask, deny: row.deny, inheritOnly: row.inheritOnly });
+    }
+    return { daclPresent: parsed.daclPresent, aces };
+}
+export async function inspectWindowsOwner(params) {
+    if (hasWindowsPathAlias(params.targetPath, "filesystem", "win32")) {
+        const error = new Error("Path uses a Windows filesystem namespace alias");
+        return { error: String(error), errorCause: error };
+    }
+    let command = "";
+    let startedAt = performance.now();
+    try {
+        command = resolveWindowsSystemCommand(String.raw `WindowsPowerShell\v1.0\powershell.exe`, params.env);
+        startedAt = performance.now();
+        const { stdout } = await params.exec(command, [
+            "-NoLogo",
+            "-NoProfile",
+            "-NonInteractive",
+            "-EncodedCommand",
+            encodePowerShellCommand(windowsOwnerQueryCommand(params.targetPath)),
+        ]);
+        const value = JSON.parse(stdout.trim());
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+            return { error: "Windows owner query returned invalid SID data" };
+        }
+        const parsed = value;
+        const ownerSid = typeof parsed.ownerSid === "string" && SID_RE.test(parsed.ownerSid)
+            ? normalizeSid(parsed.ownerSid)
+            : undefined;
+        const currentUserSid = typeof parsed.currentUserSid === "string" && SID_RE.test(parsed.currentUserSid)
+            ? normalizeSid(parsed.currentUserSid)
+            : undefined;
+        if (!ownerSid || !currentUserSid) {
+            return { error: "Windows owner query returned invalid SID data" };
+        }
+        const remote = parsed.remote;
+        if (typeof remote !== "boolean") {
+            return { error: "Windows owner query returned invalid locality data" };
+        }
+        return {
+            sid: ownerSid,
+            currentUserSid,
+            ...parseWindowsAclFacts(parsed),
+            remote,
+            trusted: !remote && (ownerSid === currentUserSid || TRUSTED_OWNER_SIDS.has(ownerSid)),
+        };
+    }
+    catch (err) {
+        return {
+            error: formatCaughtPermissionFailure(err),
+            errorDetail: getPermissionCommandFailure(err, command, performance.now() - startedAt),
+            errorCause: err,
+        };
+    }
+}