@remnic/plugin-openclaw 1.0.34 → 1.0.36

package/dist/{chunk-NKVIN6RD.js → chunk-YKV4EFUI.js}

@@ -9,16 +9,30 @@ const realpath = fsReadModule0.realpath;
 const stat = fsReadModule0.stat;
 const writeFile = fsReadModule0.writeFile;
 import path from "path";
+var fatalUtf8Decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
 async function sha256File(filePath) {
   const buf = await fileReader(filePath);
   const sha256 = createHash("sha256").update(buf).digest("hex");
   return { sha256, bytes: buf.byteLength };
 }
-function sha256String(content) {
-  const buf = Buffer.from(content, "utf-8");
+function sha256Bytes(content) {
+  const buf = Buffer.from(content);
   const sha256 = createHash("sha256").update(buf).digest("hex");
   return { sha256, bytes: buf.byteLength };
 }
+function sha256String(content) {
+  return sha256Bytes(Buffer.from(content, "utf-8"));
+}
+async function readUtf8FileStrict(filePath) {
+  const buf = await fileReader(filePath);
+  let content;
+  try {
+    content = fatalUtf8Decoder.decode(buf);
+  } catch {
+    throw new Error(`transfer export requires UTF-8 text files: ${filePath}`);
+  }
+  return { content, ...sha256Bytes(buf) };
+}
 async function writeJsonFile(filePath, value) {
   await mkdir(path.dirname(filePath), { recursive: true });
   await writeFile(filePath, JSON.stringify(value, null, 2) + "\n", "utf-8");
@@ -61,6 +75,69 @@ function toPosixRelPath(absPath, rootDir) {
 function fromPosixRelPath(relPath) {
   return relPath.split("/").join(path.sep);
 }
+async function prepareSafeArchiveRoot(absPath, errorPrefix, argName) {
+  const rootAbs = path.resolve(absPath);
+  await assertIsDirectoryNotSymlink(rootAbs, errorPrefix, argName);
+  return {
+    abs: rootAbs,
+    real: await realpath(rootAbs),
+    errorPrefix,
+    argName
+  };
+}
+function validateArchiveRelativePath(relPath, errorPrefix) {
+  if (relPath.length === 0) {
+    throw new Error(`${errorPrefix}: record path must not be empty`);
+  }
+  if (relPath.includes("\\")) {
+    throw new Error(
+      `${errorPrefix}: record path must use POSIX separators: ${relPath}`
+    );
+  }
+  if (path.posix.isAbsolute(relPath)) {
+    throw new Error(
+      `${errorPrefix}: record path must be relative: ${relPath}`
+    );
+  }
+  const segments = relPath.split("/");
+  if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) {
+    throw new Error(
+      `${errorPrefix}: record path contains unsafe segments: ${relPath}`
+    );
+  }
+  const normalized = path.posix.normalize(relPath);
+  if (normalized === "." || normalized === ".." || normalized.startsWith("../") || path.posix.isAbsolute(normalized)) {
+    throw new Error(
+      `${errorPrefix}: record path escapes target root: ${relPath}`
+    );
+  }
+  return normalized;
+}
+async function resolveSafeArchiveTarget(root, relPath) {
+  const safeRelPath = validateArchiveRelativePath(relPath, root.errorPrefix);
+  const targetAbs = path.resolve(root.abs, fromPosixRelPath(safeRelPath));
+  if (!isPathInsideRoot(root.abs, targetAbs)) {
+    throw new Error(
+      `${root.errorPrefix}: record path escapes target root: ${relPath}`
+    );
+  }
+  const targetStat = await lstat(targetAbs).catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+  if (targetStat?.isSymbolicLink()) {
+    throw new Error(
+      `${root.errorPrefix}: record path targets a symlink: ${relPath}`
+    );
+  }
+  await assertRealpathInsideRoot(
+    root.real,
+    targetAbs,
+    relPath,
+    root.errorPrefix
+  );
+  return targetAbs;
+}
 function isPathInsideRoot(rootReal, absPath) {
   const rel = path.relative(rootReal, absPath);
   if (rel === "") return true;
@@ -103,7 +180,9 @@ async function assertRealpathInsideRoot(rootReal, targetAbs, sourcePath, errorPr
 
 export {
   sha256File,
+  sha256Bytes,
   sha256String,
+  readUtf8FileStrict,
   writeJsonFile,
   readJsonFile,
   listFilesRecursive,
@@ -111,6 +190,9 @@ export {
   fileExists,
   toPosixRelPath,
   fromPosixRelPath,
+  prepareSafeArchiveRoot,
+  validateArchiveRelativePath,
+  resolveSafeArchiveTarget,
   isPathInsideRoot,
   assertIsDirectoryNotSymlink,
   assertRealpathInsideRoot

package/dist/{chunk-SSFTU6LP.js → chunk-ZS6VABML.js}

@@ -2,7 +2,7 @@ import {
   getKey,
   readHeader,
   secureStoreDir
-} from "./chunk-CXM7EBAO.js";
+} from "./chunk-MXFJXUHC.js";
 import {
   open,
   seal
@@ -122,7 +122,7 @@ async function loadKdfSection(memoryDir) {
   try {
     const header = await readHeader(memoryDir);
     if (header !== null) {
-      const { decodeMetadataSalt } = await import("./metadata-JAGIWHEA.js");
+      const { decodeMetadataSalt } = await import("./metadata-WK2TRPYZ.js");
       const salt2 = decodeMetadataSalt(header.metadata);
       const kdf = header.metadata.kdf;
       const json2 = JSON.stringify({
@@ -134,9 +134,9 @@ async function loadKdfSection(memoryDir) {
     }
   } catch {
   }
-  const { generateSalt } = await import("./cipher-VHAFCG7Z.js");
+  const { generateSalt } = await import("./cipher-E23BHBSO.js");
   const salt = generateSalt();
-  const { DEFAULT_ARGON2ID_PARAMS } = await import("./kdf-H5B23ZM2.js");
+  const { DEFAULT_ARGON2ID_PARAMS } = await import("./kdf-RXKIWHRU.js");
   const json = JSON.stringify({
     algorithm: "argon2id",
     params: DEFAULT_ARGON2ID_PARAMS,

package/dist/{cipher-VHAFCG7Z.js → cipher-E23BHBSO.js}

@@ -11,7 +11,7 @@ import {
   parseEnvelope,
   seal
 } from "./chunk-YGGGUTG3.js";
-import "./chunk-MLKGABMK.js";
+import "./chunk-I2KLQ2HA.js";
 export {
   AES_KEY_LENGTH,
   AUTH_TAG_LENGTH,

package/dist/{consolidation-undo-5ZSX4MWO.js → consolidation-undo-FKJZCJHS.js}

@@ -1,7 +1,7 @@
 import {
   getVersion
-} from "./chunk-6OJAU466.js";
-import "./chunk-MLKGABMK.js";
+} from "./chunk-QMUQV5NP.js";
+import "./chunk-I2KLQ2HA.js";
 
 // ../remnic-core/src/consolidation-undo.ts
 import path from "path";

package/dist/contradiction-review-WJRWNQ5N.js

@@ -0,0 +1,29 @@
+import {
+  computeMemoryContentHash,
+  computePairId,
+  deferPair,
+  isCoolingDown,
+  isDefaultReviewNamespace,
+  listPairs,
+  memoryHashesChanged,
+  migrateUnscopedPairsToNamespace,
+  readPair,
+  resolvePair,
+  writePair,
+  writePairs
+} from "./chunk-YJYZMLD5.js";
+import "./chunk-I2KLQ2HA.js";
+export {
+  computeMemoryContentHash,
+  computePairId,
+  deferPair,
+  isCoolingDown,
+  isDefaultReviewNamespace,
+  listPairs,
+  memoryHashesChanged,
+  migrateUnscopedPairsToNamespace,
+  readPair,
+  resolvePair,
+  writePair,
+  writePairs
+};

package/dist/contradiction-scan-5X423QGT.js

@@ -0,0 +1,12 @@
+import {
+  ACTIVE_STATUSES,
+  runContradictionScan
+} from "./chunk-JC3FCKYL.js";
+import "./chunk-YJYZMLD5.js";
+import "./chunk-3A5ELHTT.js";
+import "./chunk-UFU5GGGA.js";
+import "./chunk-I2KLQ2HA.js";
+export {
+  ACTIVE_STATUSES,
+  runContradictionScan
+};

package/dist/{dreams-ledger-3I52ISYR.js → dreams-ledger-KDX44I7R.js}

@@ -1,4 +1,4 @@
-import "./chunk-MLKGABMK.js";
+import "./chunk-I2KLQ2HA.js";
 
 // ../remnic-core/src/maintenance/dreams-ledger.ts
 import path from "path";

package/dist/{engine-57HLTQBN.js → engine-5P774HTZ.js}

@@ -1,15 +1,15 @@
 import {
   CompoundingEngine,
   defaultTierMigrationCycleBudget
-} from "./chunk-7NMHI4IC.js";
-import "./chunk-EXDYWXMB.js";
-import "./chunk-ZXLYEVOP.js";
-import "./chunk-6OJAU466.js";
+} from "./chunk-BLC3RQNV.js";
+import "./chunk-4XDQ3KEC.js";
+import "./chunk-G3CZA4SD.js";
+import "./chunk-QMUQV5NP.js";
 import "./chunk-RKR6PTPA.js";
 import "./chunk-UFU5GGGA.js";
 import "./chunk-YGGGUTG3.js";
-import "./chunk-TDRJVMUP.js";
-import "./chunk-MLKGABMK.js";
+import "./chunk-EH4AXGRO.js";
+import "./chunk-I2KLQ2HA.js";
 export {
   CompoundingEngine,
   defaultTierMigrationCycleBudget

package/dist/{extraction-judge-telemetry-GHOTVYMP.js → extraction-judge-telemetry-O4ZVGLTU.js}

@@ -5,7 +5,7 @@ import {
   recordJudgeVerdict
 } from "./chunk-5ZW5XJQ6.js";
 import "./chunk-UFU5GGGA.js";
-import "./chunk-MLKGABMK.js";
+import "./chunk-I2KLQ2HA.js";
 export {
   EXTRACTION_JUDGE_VERDICT_CATEGORY,
   judgeTelemetryPath,

package/dist/{fallback-llm-33SPYXQY.js → fallback-llm-43UMEXNJ.js}

@@ -1,10 +1,10 @@
 import {
   FallbackLlmClient
-} from "./chunk-7NUFIRM3.js";
+} from "./chunk-SWOYEQN2.js";
 import "./chunk-3A5ELHTT.js";
 import "./chunk-UFU5GGGA.js";
-import "./chunk-TDRJVMUP.js";
-import "./chunk-MLKGABMK.js";
+import "./chunk-EH4AXGRO.js";
+import "./chunk-I2KLQ2HA.js";
 export {
   FallbackLlmClient
 };

package/dist/{first-start-migration-I24M2JEE.js → first-start-migration-H2SAXAGR.js}

@@ -5,11 +5,11 @@ import {
   applyUtilityPromotionRuntimePolicy,
   decideTierTransition,
   loadUtilityRuntimeValues
-} from "./chunk-7OQEPGQF.js";
-import "./chunk-4G2XCSD2.js";
+} from "./chunk-LZCGPRHS.js";
+import "./chunk-BZ4EYURA.js";
 import "./chunk-3G7FAF6S.js";
-import "./chunk-5LE4HTVL.js";
-import "./chunk-MLKGABMK.js";
+import "./chunk-25J4PXDH.js";
+import "./chunk-I2KLQ2HA.js";
 
 // ../remnic-core/src/maintenance/first-start-migration.ts
 import path from "path";

package/dist/{forget-NI4RBDPB.js → forget-ZECIDNL5.js}

@@ -1,4 +1,4 @@
-import "./chunk-MLKGABMK.js";
+import "./chunk-I2KLQ2HA.js";
 
 // ../remnic-core/src/maintenance/forget.ts
 var ForgetMemoryNotFoundError = class extends Error {

package/dist/{fs-utils-PZRI2HDZ.js → fs-utils-OYXSZSVV.js}

@@ -6,13 +6,18 @@ import {
   fromPosixRelPath,
   isPathInsideRoot,
   listFilesRecursive,
+  prepareSafeArchiveRoot,
   readJsonFile,
+  readUtf8FileStrict,
+  resolveSafeArchiveTarget,
+  sha256Bytes,
   sha256File,
   sha256String,
   toPosixRelPath,
+  validateArchiveRelativePath,
   writeJsonFile
-} from "./chunk-NKVIN6RD.js";
-import "./chunk-MLKGABMK.js";
+} from "./chunk-YKV4EFUI.js";
+import "./chunk-I2KLQ2HA.js";
 export {
   assertIsDirectoryNotSymlink,
   assertRealpathInsideRoot,
@@ -21,9 +26,14 @@ export {
   fromPosixRelPath,
   isPathInsideRoot,
   listFilesRecursive,
+  prepareSafeArchiveRoot,
   readJsonFile,
+  readUtf8FileStrict,
+  resolveSafeArchiveTarget,
+  sha256Bytes,
   sha256File,
   sha256String,
   toPosixRelPath,
+  validateArchiveRelativePath,
   writeJsonFile
 };

package/dist/{graph-edge-decay-5CVKWBYH.js → graph-edge-decay-24ZKD5QL.js}

@@ -1,6 +1,3 @@
-import {
-  isSafeRouteNamespace
-} from "./chunk-FQRSVYY4.js";
 import {
   DEFAULT_DECAY_FLOOR,
   DEFAULT_DECAY_PER_WINDOW,
@@ -11,8 +8,11 @@ import {
   readEdgeConfidence,
   readEdgesStrict,
   withGraphWriteLock
-} from "./chunk-3GUF7RQI.js";
-import "./chunk-MLKGABMK.js";
+} from "./chunk-IO5WWY6A.js";
+import {
+  isSafeRouteNamespace
+} from "./chunk-TH5FF5SC.js";
+import "./chunk-I2KLQ2HA.js";
 
 // ../remnic-core/src/maintenance/graph-edge-decay.ts
 import * as fsReadModule0 from "fs/promises";