squidclaw 3.0.5 → 3.0.6

package/dist/{exec-approvals-cli-DJgyhlQI.js → exec-approvals-cli-DGpM86zY.js}

@@ -2,10 +2,10 @@ import { f as isRich, p as theme } from "./globals-BrhVUl-N.js";
 import "./paths-CHIu6D1E.js";
 import { d as defaultRuntime } from "./subsystem-Bw5n50gj.js";
 import "./boolean-DtWR5bt3.js";
-import "./auth-profiles-CvmKVnsR.js";
-import "./agent-scope-Cq4vDGrK.js";
+import "./auth-profiles-CwmInMDd.js";
+import "./agent-scope-nEVgVklg.js";
 import "./utils-D6vohX1h.js";
-import "./squidclaw-root-BQfLymzj.js";
+import "./squidclaw-root-JXyRbQLJ.js";
 import "./logger-DL3N22PJ.js";
 import "./exec-TSiqsZw1.js";
 import "./registry-BXcl3IkC.js";
@@ -13,26 +13,26 @@ import "./github-copilot-token-CxitgiZA.js";
 import "./host-env-security-lcjXF83D.js";
 import "./version-3so140Zi.js";
 import "./env-vars-mSSOl7Rv.js";
-import "./manifest-registry-7kwtbCH-.js";
+import "./manifest-registry-1ACGW3OR.js";
 import "./message-channel-DqvtYF2o.js";
-import "./client-cfjtRboM.js";
-import "./call-v5CyFgM7.js";
+import "./client-XYT0IAgJ.js";
+import "./call-BSt3WRnY.js";
 import "./pairing-token-B_ig96RO.js";
-import "./net-nlF6thgH.js";
-import "./tailnet-BTCJZWyh.js";
-import "./exec-approvals-allowlist-C9ZJK4Gd.js";
+import "./net-CmP6gw-e.js";
+import "./tailnet-CUG3_Vq2.js";
+import "./exec-approvals-allowlist-DOxIMtXP.js";
 import { n as formatTimeAgo } from "./format-relative-Czf5fUjn.js";
 import { c as readExecApprovalsSnapshot, p as saveExecApprovals } from "./exec-approvals-Db6myg-N.js";
 import { t as formatDocsLink } from "./links-Dye6HsRG.js";
 import "./progress-DuhDspl6.js";
-import { n as callGatewayFromCli } from "./gateway-rpc-CdMQ58t-.js";
-import "./systemd-CD8s-qZ_.js";
-import "./service-D6lUMZKF.js";
+import { n as callGatewayFromCli } from "./gateway-rpc-F18gNFkP.js";
+import "./systemd-BrFu3I64.js";
+import "./service-DsnrBnut.js";
 import { t as renderTable } from "./table-DbDCX_6t.js";
-import { t as describeUnknownError } from "./shared-BpdBkle5.js";
-import { a as resolveNodeId, r as nodesCallOpts } from "./rpc-C4LCuyHT.js";
+import { t as describeUnknownError } from "./shared-tolKQpGA.js";
+import { a as resolveNodeId, r as nodesCallOpts } from "./rpc-B8VkWVmY.js";
 import JSON5 from "json5";
-import fs from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 
 //#region src/cli/exec-approvals-cli.ts
 async function readStdin() {
@@ -329,7 +329,7 @@ function registerExecApprovalsCli(program) {
 			if (!opts.file && !opts.stdin) exitWithError("Provide --file or --stdin.");
 			if (opts.file && opts.stdin) exitWithError("Use either --file or --stdin (not both).");
 			const { source, nodeId, targetLabel, baseHash } = await loadWritableSnapshotTarget(opts);
-			const raw = opts.stdin ? await readStdin() : await fs.readFile(String(opts.file), "utf8");
+			const raw = opts.stdin ? await readStdin() : await fsPromises.readFile(String(opts.file), "utf8");
 			let file;
 			try {
 				file = JSON5.parse(raw);

package/dist/{exec-safe-bin-runtime-policy-CSWN6lxg.js → exec-safe-bin-runtime-policy-DhLi-jyO.js}

@@ -1,5 +1,5 @@
-import { En as resolveSafeBinProfiles, Qt as normalizeTrustedSafeBinDirs, Tn as normalizeSafeBinProfileFixtures, Yt as getTrustedSafeBinDirs, Zt as listWritableExplicitTrustedSafeBinDirs } from "./auth-profiles-CvmKVnsR.js";
-import { i as resolveSafeBins } from "./exec-approvals-allowlist-C9ZJK4Gd.js";
+import { En as resolveSafeBinProfiles, Qt as normalizeTrustedSafeBinDirs, Tn as normalizeSafeBinProfileFixtures, Yt as getTrustedSafeBinDirs, Zt as listWritableExplicitTrustedSafeBinDirs } from "./auth-profiles-CwmInMDd.js";
+import { i as resolveSafeBins } from "./exec-approvals-allowlist-DOxIMtXP.js";
 
 //#region src/infra/exec-safe-bin-runtime-policy.ts
 const INTERPRETER_LIKE_SAFE_BINS = new Set([

package/dist/{fetch-BA3uuEpf.js → fetch-BClIo0ZD.js}

@@ -1,8 +1,8 @@
 import { k as resolvePreferredSquidClawTmpDir } from "./globals-BrhVUl-N.js";
 import { g as resolveStateDir } from "./paths-CHIu6D1E.js";
-import { u as resolveAgentWorkspaceDir } from "./agent-scope-Cq4vDGrK.js";
-import { c as detectMime, l as extensionForMime } from "./image-ops-B2uuLIGD.js";
-import { n as withStrictGuardedFetchMode, t as fetchWithSsrFGuard } from "./fetch-guard-C34T9Lg9.js";
+import { u as resolveAgentWorkspaceDir } from "./agent-scope-nEVgVklg.js";
+import { c as detectMime, l as extensionForMime } from "./image-ops-LFsSCTyI.js";
+import { n as withStrictGuardedFetchMode, t as fetchWithSsrFGuard } from "./fetch-guard-C-CRoLDY.js";
 import path from "node:path";
 
 //#region src/media/local-roots.ts

package/dist/{fetch-DCLFwngk.js → fetch-BLS7EMnx.js}

@@ -1,8 +1,8 @@
-import { c as resolveAgentWorkspaceDir } from "./run-with-concurrency-D05zyBvx.js";
+import { c as resolveAgentWorkspaceDir } from "./run-with-concurrency-BFR3ReeF.js";
 import { c as resolveStateDir } from "./paths-DA5srn0U.js";
-import { w as resolvePreferredSquidClawTmpDir } from "./subsystem-DwbSi7gL.js";
-import { b as detectMime, x as extensionForMime } from "./image-ops-Dly8SSF7.js";
-import { n as withStrictGuardedFetchMode, t as fetchWithSsrFGuard } from "./fetch-guard-bk7uDnb8.js";
+import { w as resolvePreferredSquidClawTmpDir } from "./subsystem-6v7sWnAD.js";
+import { b as detectMime, x as extensionForMime } from "./image-ops-CdgypS_g.js";
+import { n as withStrictGuardedFetchMode, t as fetchWithSsrFGuard } from "./fetch-guard-D0fXNJls.js";
 import path from "node:path";
 
 //#region src/media/local-roots.ts

package/dist/{fetch-guard-C34T9Lg9.js → fetch-guard-C-CRoLDY.js}

@@ -1,5 +1,5 @@
 import { i as logWarn } from "./logger-DL3N22PJ.js";
-import { i as createPinnedDispatcher, n as SsrFBlockedError, r as closeDispatcher, s as resolvePinnedHostnameWithPolicy, t as hasProxyEnvConfigured } from "./proxy-env-BDzLr-Xu.js";
+import { i as createPinnedDispatcher, n as SsrFBlockedError, r as closeDispatcher, s as resolvePinnedHostnameWithPolicy, t as hasProxyEnvConfigured } from "./proxy-env-DkDM4lyi.js";
 import { t as bindAbortRelay } from "./fetch-timeout-Mawkd1Br.js";
 import { EnvHttpProxyAgent } from "undici";
 

package/dist/{fetch-guard-bk7uDnb8.js → fetch-guard-D0fXNJls.js}

@@ -1,5 +1,5 @@
-import { i as logWarn } from "./logger-CNkhF83z.js";
-import { i as createPinnedDispatcher, n as SsrFBlockedError, r as closeDispatcher, s as resolvePinnedHostnameWithPolicy, t as hasProxyEnvConfigured } from "./proxy-env-BNo93HMb.js";
+import { i as logWarn } from "./logger-CnTSBL7T.js";
+import { i as createPinnedDispatcher, n as SsrFBlockedError, r as closeDispatcher, s as resolvePinnedHostnameWithPolicy, t as hasProxyEnvConfigured } from "./proxy-env-D75CWSOo.js";
 import { t as bindAbortRelay } from "./fetch-timeout-Wgx3OXYj.js";
 import { EnvHttpProxyAgent } from "undici";
 

package/dist/{frontmatter-EuNpTTq9.js → frontmatter-Cq1TcIQ2.js}

@@ -1,7 +1,7 @@
-import { c as parseBooleanValue, n as MANIFEST_KEY, t as LEGACY_MANIFEST_KEYS } from "./legacy-names-CrhimhR4.js";
+import { c as parseBooleanValue, n as MANIFEST_KEY, t as LEGACY_MANIFEST_KEYS } from "./legacy-names-aGJJuzM_.js";
 import path from "node:path";
 import syncFs from "node:fs";
-import json5 from "json5";
+import JSON5 from "json5";
 import YAML from "yaml";
 
 //#region src/shared/config-eval.ts
@@ -258,7 +258,7 @@ function resolveSquidClawManifestBlock(params) {
 	const raw = getFrontmatterString(params.frontmatter, params.key ?? "metadata");
 	if (!raw) return;
 	try {
-		const parsed = json5.parse(raw);
+		const parsed = JSON5.parse(raw);
 		if (!parsed || typeof parsed !== "object") return;
 		const manifestKeys = [MANIFEST_KEY, ...LEGACY_MANIFEST_KEYS];
 		for (const key of manifestKeys) {

package/dist/fs-safe-BPQ-per2.js

@@ -0,0 +1,352 @@
+import { _ as expandHomePrefix } from "./paths-CHIu6D1E.js";
+import { d as hasNodeErrorCode, f as isNotFoundPathError, m as isSymlinkOpenError, p as isPathInside, s as sameFileIdentity } from "./squidclaw-root-JXyRbQLJ.js";
+import { i as logWarn } from "./logger-DL3N22PJ.js";
+import { n as assertNoPathAliasEscape } from "./path-alias-guards-DeOVetT7.js";
+import os from "node:os";
+import path from "node:path";
+import { constants } from "node:fs";
+import fsPromises from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { pipeline } from "node:stream/promises";
+
+//#region src/infra/fs-safe.ts
+var SafeOpenError = class extends Error {
+	constructor(code, message, options) {
+		super(message, options);
+		this.code = code;
+		this.name = "SafeOpenError";
+	}
+};
+const SUPPORTS_NOFOLLOW = process.platform !== "win32" && "O_NOFOLLOW" in constants;
+const OPEN_READ_FLAGS = constants.O_RDONLY | (SUPPORTS_NOFOLLOW ? constants.O_NOFOLLOW : 0);
+const OPEN_WRITE_EXISTING_FLAGS = constants.O_WRONLY | (SUPPORTS_NOFOLLOW ? constants.O_NOFOLLOW : 0);
+const OPEN_WRITE_CREATE_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (SUPPORTS_NOFOLLOW ? constants.O_NOFOLLOW : 0);
+const ensureTrailingSep = (value) => value.endsWith(path.sep) ? value : value + path.sep;
+async function expandRelativePathWithHome(relativePath) {
+	let home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+	try {
+		home = await fsPromises.realpath(home);
+	} catch {}
+	return expandHomePrefix(relativePath, { home });
+}
+async function openVerifiedLocalFile(filePath, options) {
+	try {
+		if ((await fsPromises.lstat(filePath)).isDirectory()) throw new SafeOpenError("not-file", "not a file");
+	} catch (err) {
+		if (err instanceof SafeOpenError) throw err;
+	}
+	let handle;
+	try {
+		handle = await fsPromises.open(filePath, OPEN_READ_FLAGS);
+	} catch (err) {
+		if (isNotFoundPathError(err)) throw new SafeOpenError("not-found", "file not found");
+		if (isSymlinkOpenError(err)) throw new SafeOpenError("symlink", "symlink open blocked", { cause: err });
+		if (hasNodeErrorCode(err, "EISDIR")) throw new SafeOpenError("not-file", "not a file");
+		throw err;
+	}
+	try {
+		const [stat, lstat] = await Promise.all([handle.stat(), fsPromises.lstat(filePath)]);
+		if (lstat.isSymbolicLink()) throw new SafeOpenError("symlink", "symlink not allowed");
+		if (!stat.isFile()) throw new SafeOpenError("not-file", "not a file");
+		if (options?.rejectHardlinks && stat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
+		if (!sameFileIdentity(stat, lstat)) throw new SafeOpenError("path-mismatch", "path changed during read");
+		const realPath = await fsPromises.realpath(filePath);
+		const realStat = await fsPromises.stat(realPath);
+		if (options?.rejectHardlinks && realStat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
+		if (!sameFileIdentity(stat, realStat)) throw new SafeOpenError("path-mismatch", "path mismatch");
+		return {
+			handle,
+			realPath,
+			stat
+		};
+	} catch (err) {
+		await handle.close().catch(() => {});
+		if (err instanceof SafeOpenError) throw err;
+		if (isNotFoundPathError(err)) throw new SafeOpenError("not-found", "file not found");
+		throw err;
+	}
+}
+async function resolvePathWithinRoot(params) {
+	let rootReal;
+	try {
+		rootReal = await fsPromises.realpath(params.rootDir);
+	} catch (err) {
+		if (isNotFoundPathError(err)) throw new SafeOpenError("not-found", "root dir not found");
+		throw err;
+	}
+	const rootWithSep = ensureTrailingSep(rootReal);
+	const expanded = await expandRelativePathWithHome(params.relativePath);
+	const resolved = path.resolve(rootWithSep, expanded);
+	if (!isPathInside(rootWithSep, resolved)) throw new SafeOpenError("outside-workspace", "file is outside workspace root");
+	return {
+		rootReal,
+		rootWithSep,
+		resolved
+	};
+}
+async function openFileWithinRoot(params) {
+	const { rootWithSep, resolved } = await resolvePathWithinRoot(params);
+	let opened;
+	try {
+		opened = await openVerifiedLocalFile(resolved);
+	} catch (err) {
+		if (err instanceof SafeOpenError) {
+			if (err.code === "not-found") throw err;
+			throw new SafeOpenError("invalid-path", "path is not a regular file under root", { cause: err });
+		}
+		throw err;
+	}
+	if (params.rejectHardlinks !== false && opened.stat.nlink > 1) {
+		await opened.handle.close().catch(() => {});
+		throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
+	}
+	if (!isPathInside(rootWithSep, opened.realPath)) {
+		await opened.handle.close().catch(() => {});
+		throw new SafeOpenError("outside-workspace", "file is outside workspace root");
+	}
+	return opened;
+}
+async function readFileWithinRoot(params) {
+	const opened = await openFileWithinRoot({
+		rootDir: params.rootDir,
+		relativePath: params.relativePath,
+		rejectHardlinks: params.rejectHardlinks
+	});
+	try {
+		return await readOpenedFileSafely({
+			opened,
+			maxBytes: params.maxBytes
+		});
+	} finally {
+		await opened.handle.close().catch(() => {});
+	}
+}
+async function readPathWithinRoot(params) {
+	const rootDir = path.resolve(params.rootDir);
+	const candidatePath = path.isAbsolute(params.filePath) ? path.resolve(params.filePath) : path.resolve(rootDir, params.filePath);
+	return await readFileWithinRoot({
+		rootDir,
+		relativePath: path.relative(rootDir, candidatePath),
+		rejectHardlinks: params.rejectHardlinks,
+		maxBytes: params.maxBytes
+	});
+}
+function createRootScopedReadFile(params) {
+	const rootDir = path.resolve(params.rootDir);
+	return async (filePath) => {
+		return (await readPathWithinRoot({
+			rootDir,
+			filePath,
+			rejectHardlinks: params.rejectHardlinks,
+			maxBytes: params.maxBytes
+		})).buffer;
+	};
+}
+async function readLocalFileSafely(params) {
+	const opened = await openVerifiedLocalFile(params.filePath);
+	try {
+		return await readOpenedFileSafely({
+			opened,
+			maxBytes: params.maxBytes
+		});
+	} finally {
+		await opened.handle.close().catch(() => {});
+	}
+}
+async function readOpenedFileSafely(params) {
+	if (params.maxBytes !== void 0 && params.opened.stat.size > params.maxBytes) throw new SafeOpenError("too-large", `file exceeds limit of ${params.maxBytes} bytes (got ${params.opened.stat.size})`);
+	return {
+		buffer: await params.opened.handle.readFile(),
+		realPath: params.opened.realPath,
+		stat: params.opened.stat
+	};
+}
+function emitWriteBoundaryWarning(reason) {
+	logWarn(`security: fs-safe write boundary warning (${reason})`);
+}
+function buildAtomicWriteTempPath(targetPath) {
+	const dir = path.dirname(targetPath);
+	const base = path.basename(targetPath);
+	return path.join(dir, `.${base}.${process.pid}.${randomUUID()}.tmp`);
+}
+async function writeTempFileForAtomicReplace(params) {
+	const tempHandle = await fsPromises.open(params.tempPath, OPEN_WRITE_CREATE_FLAGS, params.mode);
+	try {
+		if (typeof params.data === "string") await tempHandle.writeFile(params.data, params.encoding ?? "utf8");
+		else await tempHandle.writeFile(params.data);
+		return await tempHandle.stat();
+	} finally {
+		await tempHandle.close().catch(() => {});
+	}
+}
+async function verifyAtomicWriteResult(params) {
+	const rootWithSep = ensureTrailingSep(await fsPromises.realpath(params.rootDir));
+	const opened = await openVerifiedLocalFile(params.targetPath, { rejectHardlinks: true });
+	try {
+		if (!sameFileIdentity(opened.stat, params.expectedStat)) throw new SafeOpenError("path-mismatch", "path changed during write");
+		if (!isPathInside(rootWithSep, opened.realPath)) throw new SafeOpenError("outside-workspace", "file is outside workspace root");
+	} finally {
+		await opened.handle.close().catch(() => {});
+	}
+}
+async function resolveOpenedFileRealPathForHandle(handle, ioPath) {
+	try {
+		return await fsPromises.realpath(ioPath);
+	} catch (err) {
+		if (!isNotFoundPathError(err)) throw err;
+	}
+	const fdCandidates = process.platform === "linux" ? [`/proc/self/fd/${handle.fd}`, `/dev/fd/${handle.fd}`] : process.platform === "win32" ? [] : [`/dev/fd/${handle.fd}`];
+	for (const fdPath of fdCandidates) try {
+		return await fsPromises.realpath(fdPath);
+	} catch {}
+	throw new SafeOpenError("path-mismatch", "unable to resolve opened file path");
+}
+async function openWritableFileWithinRoot(params) {
+	const { rootReal, rootWithSep, resolved } = await resolvePathWithinRoot(params);
+	try {
+		await assertNoPathAliasEscape({
+			absolutePath: resolved,
+			rootPath: rootReal,
+			boundaryLabel: "root"
+		});
+	} catch (err) {
+		throw new SafeOpenError("invalid-path", "path alias escape blocked", { cause: err });
+	}
+	if (params.mkdir !== false) await fsPromises.mkdir(path.dirname(resolved), { recursive: true });
+	let ioPath = resolved;
+	try {
+		const resolvedRealPath = await fsPromises.realpath(resolved);
+		if (!isPathInside(rootWithSep, resolvedRealPath)) throw new SafeOpenError("outside-workspace", "file is outside workspace root");
+		ioPath = resolvedRealPath;
+	} catch (err) {
+		if (err instanceof SafeOpenError) throw err;
+		if (!isNotFoundPathError(err)) throw err;
+	}
+	const fileMode = params.mode ?? 384;
+	let handle;
+	let createdForWrite = false;
+	try {
+		try {
+			handle = await fsPromises.open(ioPath, OPEN_WRITE_EXISTING_FLAGS, fileMode);
+		} catch (err) {
+			if (!isNotFoundPathError(err)) throw err;
+			handle = await fsPromises.open(ioPath, OPEN_WRITE_CREATE_FLAGS, fileMode);
+			createdForWrite = true;
+		}
+	} catch (err) {
+		if (isNotFoundPathError(err)) throw new SafeOpenError("not-found", "file not found");
+		if (isSymlinkOpenError(err)) throw new SafeOpenError("invalid-path", "symlink open blocked", { cause: err });
+		throw err;
+	}
+	let openedRealPath = null;
+	try {
+		const stat = await handle.stat();
+		if (!stat.isFile()) throw new SafeOpenError("invalid-path", "path is not a regular file under root");
+		if (stat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
+		try {
+			const lstat = await fsPromises.lstat(ioPath);
+			if (lstat.isSymbolicLink() || !lstat.isFile()) throw new SafeOpenError("invalid-path", "path is not a regular file under root");
+			if (!sameFileIdentity(stat, lstat)) throw new SafeOpenError("path-mismatch", "path changed during write");
+		} catch (err) {
+			if (!isNotFoundPathError(err)) throw err;
+		}
+		const realPath = await resolveOpenedFileRealPathForHandle(handle, ioPath);
+		openedRealPath = realPath;
+		const realStat = await fsPromises.stat(realPath);
+		if (!sameFileIdentity(stat, realStat)) throw new SafeOpenError("path-mismatch", "path mismatch");
+		if (realStat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
+		if (!isPathInside(rootWithSep, realPath)) throw new SafeOpenError("outside-workspace", "file is outside workspace root");
+		if (params.truncateExisting !== false && !createdForWrite) await handle.truncate(0);
+		return {
+			handle,
+			createdForWrite,
+			openedRealPath: realPath,
+			openedStat: stat
+		};
+	} catch (err) {
+		const cleanupCreatedPath = createdForWrite && err instanceof SafeOpenError;
+		const cleanupPath = openedRealPath ?? ioPath;
+		await handle.close().catch(() => {});
+		if (cleanupCreatedPath) await fsPromises.rm(cleanupPath, { force: true }).catch(() => {});
+		throw err;
+	}
+}
+async function writeFileWithinRoot(params) {
+	const target = await openWritableFileWithinRoot({
+		rootDir: params.rootDir,
+		relativePath: params.relativePath,
+		mkdir: params.mkdir,
+		truncateExisting: false
+	});
+	const destinationPath = target.openedRealPath;
+	const targetMode = target.openedStat.mode & 511;
+	await target.handle.close().catch(() => {});
+	let tempPath = null;
+	try {
+		tempPath = buildAtomicWriteTempPath(destinationPath);
+		const writtenStat = await writeTempFileForAtomicReplace({
+			tempPath,
+			data: params.data,
+			encoding: params.encoding,
+			mode: targetMode || 384
+		});
+		await fsPromises.rename(tempPath, destinationPath);
+		tempPath = null;
+		try {
+			await verifyAtomicWriteResult({
+				rootDir: params.rootDir,
+				targetPath: destinationPath,
+				expectedStat: writtenStat
+			});
+		} catch (err) {
+			emitWriteBoundaryWarning(`post-write verification failed: ${String(err)}`);
+			throw err;
+		}
+	} finally {
+		if (tempPath) await fsPromises.rm(tempPath, { force: true }).catch(() => {});
+	}
+}
+async function copyFileWithinRoot(params) {
+	const source = await openVerifiedLocalFile(params.sourcePath, { rejectHardlinks: params.rejectSourceHardlinks });
+	if (params.maxBytes !== void 0 && source.stat.size > params.maxBytes) {
+		await source.handle.close().catch(() => {});
+		throw new SafeOpenError("too-large", `file exceeds limit of ${params.maxBytes} bytes (got ${source.stat.size})`);
+	}
+	let target = null;
+	let sourceClosedByStream = false;
+	let targetClosedByStream = false;
+	try {
+		target = await openWritableFileWithinRoot({
+			rootDir: params.rootDir,
+			relativePath: params.relativePath,
+			mkdir: params.mkdir
+		});
+		const sourceStream = source.handle.createReadStream();
+		const targetStream = target.handle.createWriteStream();
+		sourceStream.once("close", () => {
+			sourceClosedByStream = true;
+		});
+		targetStream.once("close", () => {
+			targetClosedByStream = true;
+		});
+		await pipeline(sourceStream, targetStream);
+	} catch (err) {
+		if (target?.createdForWrite) await fsPromises.rm(target.openedRealPath, { force: true }).catch(() => {});
+		throw err;
+	} finally {
+		if (!sourceClosedByStream) await source.handle.close().catch(() => {});
+		if (target && !targetClosedByStream) await target.handle.close().catch(() => {});
+	}
+}
+async function writeFileFromPathWithinRoot(params) {
+	await copyFileWithinRoot({
+		sourcePath: params.sourcePath,
+		rootDir: params.rootDir,
+		relativePath: params.relativePath,
+		mkdir: params.mkdir,
+		rejectSourceHardlinks: true
+	});
+}
+
+//#endregion
+export { openWritableFileWithinRoot as a, writeFileFromPathWithinRoot as c, openFileWithinRoot as i, writeFileWithinRoot as l, copyFileWithinRoot as n, readFileWithinRoot as o, createRootScopedReadFile as r, readLocalFileSafely as s, SafeOpenError as t };

package/dist/{fs-safe-DdANjYLv.js → fs-safe-BoB4X3GD.js}

@@ -1,7 +1,7 @@
 import { l as expandHomePrefix } from "./paths-DA5srn0U.js";
-import { D as isNotFoundPathError, E as hasNodeErrorCode, O as isPathInside, S as sameFileIdentity, k as isSymlinkOpenError } from "./workspace-C1XiGBnY.js";
-import { i as logWarn } from "./logger-CNkhF83z.js";
-import { n as assertNoPathAliasEscape } from "./path-alias-guards-VI6pee_i.js";
+import { D as isNotFoundPathError, E as hasNodeErrorCode, O as isPathInside, S as sameFileIdentity, k as isSymlinkOpenError } from "./workspace-kVMIaBrV.js";
+import { i as logWarn } from "./logger-CnTSBL7T.js";
+import { n as assertNoPathAliasEscape } from "./path-alias-guards-DORgbZ1w.js";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";

package/dist/{gateway-cli-CVV2dd-0.js → gateway-cli-BJsxsz40.js}

@@ -2,7 +2,7 @@ import { g as resolveStateDir, i as isNixMode, l as resolveGatewayLockDir, o as
 import { a as logVerbose, d as colorize, f as isRich, g as getResolvedLoggerSettings, h as getLogger, m as getChildLogger, p as theme, s as setVerbose } from "./globals-xfUIfxbE.js";
 import { C as sleep, D as isPlainObject, E as truncateUtf16Safe, S as shortenHomePath, c as ensureDir, r as clamp, y as resolveUserPath } from "./utils-DMGXr25O.js";
 import { a as normalizeElevatedLevel, c as normalizeUsageDisplay, d as supportsXHighThinking, l as normalizeVerboseLevel, n as formatXHighModelHint, o as normalizeReasoningLevel, s as normalizeThinkLevel, t as formatThinkingLevels } from "./thinking-44rmAw5o.js";
-import { $ as normalizeOptionalSessionKey, $n as listDescendantRunsForRequester, $t as sleepWithAbort, A as resolveSessionModelRef, Ar as OPENAI_TTS_VOICES, B as triggerSquidClawRestart, Bt as createOutboundSendDeps$1, Cr as resolveTtsConfig, D as loadSessionEntry, Dn as createReplyDispatcher, Dr as setTtsProvider, Dt as readJsonBodyWithLimit, E as loadCombinedSessionStoreForGateway, En as dispatchInboundMessage, Er as setTtsEnabled, Et as handleSlackHttpRequest, F as isGatewaySigusr1RestartExternallyAllowed, Fr as resetAllLanes, Ft as resolveAgentOutboundTarget, G as summarizeRestartSentinel, H as formatDoctorNonInteractiveHint, Ht as getCliSessionId, I as markGatewaySigusr1RestartHandled, Ir as setCommandLaneConcurrency, It as createOutboundSendDeps, J as normalizeHttpWebhookUrl, Jn as countActiveDescendantRuns, Jt as resolveBootstrapWarningSignaturesSeen, Kn as isAbortRequestText, Kr as enqueueSystemEvent, L as scheduleGatewaySigusr1Restart, Ln as resolveOutboundTarget, Lr as waitForActiveTasks, Lt as applyVerboseOverride, M as consumeGatewaySigusr1RestartAuthorization, Mn as resolveOutboundSessionRoute, Mt as agentCommandFromIngress, N as deferGatewayRestartUntilIdle, Nr as getTotalQueueSize, O as pruneLegacyStoreKeys, On as getTotalPendingReplies, Or as textToSpeech, Ot as requestBodyErrorToText, P as emitGatewayRestart, Pr as markGatewayDraining, Pt as resolveAgentDeliveryPlan, Q as normalizeOptionalAgentId, Qt as computeBackoff, R as setGatewaySigusr1RestartPolicy, Rn as resolveSessionDeliveryTarget, Rr as CommandLane, Rt as parseVerboseOverride, S as canonicalizeSpawnedByForAgent, Sr as resolveTtsAutoMode, T as listSessionsFromStore, Tn as formatZonedTimestamp, Tr as resolveTtsProviderOrder, U as formatRestartSentinelMessage, Ur as stripHeartbeatToken, Ut as setCliSessionId, V as consumeRestartSentinel, Vn as resetDirectoryCache, Vt as runWithModelFallback, Wt as runCliAgent, X as normalizeCronJobPatch, Xr as requestHeartbeatNow, Xt as lookupContextTokens, Y as normalizeCronJobCreate, Yt as applyModelOverrideToSessionEntry, Z as inferLegacyName, Zn as initSubagentRegistry, _ as resolveCronStyleNow, _r as clearBootstrapSnapshot, ai as resolveSendPolicy, an as buildSafeExternalPrompt, ar as buildOutboundSessionContext, at as hasLegacyDeliveryHints, br as isTtsProviderConfigured, ci as DEFAULT_INPUT_MAX_REDIRECTS, cn as isExternalHookSession, cr as getAgentRunContext, ct as persistBrowserProxyFiles, di as extractImageContentFromSource, dr as resolveAgentIdentity, en as resolveSessionAuthProfileOverride, et as normalizeOptionalText, f as runEmbeddedPiAgent, fi as normalizeMimeList, ft as loadSquidClawPlugins, gt as normalizeGroupActivation, h as waitForEmbeddedPiRunEnd, hi as resolveAgentTimeoutMs, hr as resolveUserTimezone, ii as normalizeSendPolicy, ir as clearSessionQueues, it as buildDeliveryFromLegacyPayload, jn as ensureOutboundSessionEntry, jr as getActiveTaskCount, k as resolveGatewaySessionStoreTarget, kr as OPENAI_TTS_MODELS, li as DEFAULT_INPUT_TIMEOUT_MS, ln as createReplyPrefixOptions, lr as onAgentEvent, lt as getPluginToolMeta, m as getActiveEmbeddedRunCount, mn as buildHistoryContextFromEntries, n as buildBareSessionResetPrompt, ni as getAcpSessionManager, nr as resolveAnnounceTargetFromKey, nt as normalizeRequiredName, oi as DEFAULT_INPUT_IMAGE_MAX_BYTES, on as detectSuspiciousPatterns, or as clearAgentRunContext, ot as stripLegacyDeliveryFields, p as abortEmbeddedPiRun, pi as resolveInputFileLimits, pt as createPluginRuntime, q as writeRestartSentinel, qn as stopSubagentsForRequester, qr as isSystemEventContextChanged, ri as resolveAgentSessionDirs, rr as readLatestAssistantReply, rt as migrateLegacyCronPayload, si as DEFAULT_INPUT_IMAGE_MIMES, sn as getHookType, sr as emitAgentEvent, st as applyBrowserProxyPaths, ti as ACP_SESSION_IDENTITY_RENDERER_VERSION, tn as resolveAgentAvatar, tr as runSubagentAnnounceFlow, tt as normalizePayloadToSystemText, ui as extractFileContentFromSource, un as unbindThreadBindingsBySessionKey, ur as registerAgentRunContext, ut as resolvePluginTools, v as applyToolPolicyPipeline, vr as getTtsProvider, vt as loadProviderUsageSummary, w as listAgentsForGateway, wr as resolveTtsPrefsPath, wt as resolveAgentOutboundIdentity, x as createSquidClawTools, xr as resolveTtsApiKey, y as buildDefaultToolPolicyPipelineSteps, yr as isTtsEnabled, z as setPreRestartDeferralCheck, zn as resolveOutboundChannelPlugin, zr as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, zt as createDefaultDeps } from "./reply-lnANjYYy.js";
+import { $ as normalizeOptionalSessionKey, $n as listDescendantRunsForRequester, $t as sleepWithAbort, A as resolveSessionModelRef, Ar as OPENAI_TTS_VOICES, B as triggerSquidClawRestart, Bt as createOutboundSendDeps$1, Cr as resolveTtsConfig, D as loadSessionEntry, Dn as createReplyDispatcher, Dr as setTtsProvider, Dt as readJsonBodyWithLimit, E as loadCombinedSessionStoreForGateway, En as dispatchInboundMessage, Er as setTtsEnabled, Et as handleSlackHttpRequest, F as isGatewaySigusr1RestartExternallyAllowed, Fr as resetAllLanes, Ft as resolveAgentOutboundTarget, G as summarizeRestartSentinel, H as formatDoctorNonInteractiveHint, Ht as getCliSessionId, I as markGatewaySigusr1RestartHandled, Ir as setCommandLaneConcurrency, It as createOutboundSendDeps, J as normalizeHttpWebhookUrl, Jn as countActiveDescendantRuns, Jt as resolveBootstrapWarningSignaturesSeen, Kn as isAbortRequestText, Kr as enqueueSystemEvent, L as scheduleGatewaySigusr1Restart, Ln as resolveOutboundTarget, Lr as waitForActiveTasks, Lt as applyVerboseOverride, M as consumeGatewaySigusr1RestartAuthorization, Mn as resolveOutboundSessionRoute, Mt as agentCommandFromIngress, N as deferGatewayRestartUntilIdle, Nr as getTotalQueueSize, O as pruneLegacyStoreKeys, On as getTotalPendingReplies, Or as textToSpeech, Ot as requestBodyErrorToText, P as emitGatewayRestart, Pr as markGatewayDraining, Pt as resolveAgentDeliveryPlan, Q as normalizeOptionalAgentId, Qt as computeBackoff, R as setGatewaySigusr1RestartPolicy, Rn as resolveSessionDeliveryTarget, Rr as CommandLane, Rt as parseVerboseOverride, S as canonicalizeSpawnedByForAgent, Sr as resolveTtsAutoMode, T as listSessionsFromStore, Tn as formatZonedTimestamp, Tr as resolveTtsProviderOrder, U as formatRestartSentinelMessage, Ur as stripHeartbeatToken, Ut as setCliSessionId, V as consumeRestartSentinel, Vn as resetDirectoryCache, Vt as runWithModelFallback, Wt as runCliAgent, X as normalizeCronJobPatch, Xr as requestHeartbeatNow, Xt as lookupContextTokens, Y as normalizeCronJobCreate, Yt as applyModelOverrideToSessionEntry, Z as inferLegacyName, Zn as initSubagentRegistry, _ as resolveCronStyleNow, _r as clearBootstrapSnapshot, ai as resolveSendPolicy, an as buildSafeExternalPrompt, ar as buildOutboundSessionContext, at as hasLegacyDeliveryHints, br as isTtsProviderConfigured, ci as DEFAULT_INPUT_MAX_REDIRECTS, cn as isExternalHookSession, cr as getAgentRunContext, ct as persistBrowserProxyFiles, di as extractImageContentFromSource, dr as resolveAgentIdentity, en as resolveSessionAuthProfileOverride, et as normalizeOptionalText, f as runEmbeddedPiAgent, fi as normalizeMimeList, ft as loadSquidClawPlugins, gt as normalizeGroupActivation, h as waitForEmbeddedPiRunEnd, hi as resolveAgentTimeoutMs, hr as resolveUserTimezone, ii as normalizeSendPolicy, ir as clearSessionQueues, it as buildDeliveryFromLegacyPayload, jn as ensureOutboundSessionEntry, jr as getActiveTaskCount, k as resolveGatewaySessionStoreTarget, kr as OPENAI_TTS_MODELS, li as DEFAULT_INPUT_TIMEOUT_MS, ln as createReplyPrefixOptions, lr as onAgentEvent, lt as getPluginToolMeta, m as getActiveEmbeddedRunCount, mn as buildHistoryContextFromEntries, n as buildBareSessionResetPrompt, ni as getAcpSessionManager, nr as resolveAnnounceTargetFromKey, nt as normalizeRequiredName, oi as DEFAULT_INPUT_IMAGE_MAX_BYTES, on as detectSuspiciousPatterns, or as clearAgentRunContext, ot as stripLegacyDeliveryFields, p as abortEmbeddedPiRun, pi as resolveInputFileLimits, pt as createPluginRuntime, q as writeRestartSentinel, qn as stopSubagentsForRequester, qr as isSystemEventContextChanged, ri as resolveAgentSessionDirs, rr as readLatestAssistantReply, rt as migrateLegacyCronPayload, si as DEFAULT_INPUT_IMAGE_MIMES, sn as getHookType, sr as emitAgentEvent, st as applyBrowserProxyPaths, ti as ACP_SESSION_IDENTITY_RENDERER_VERSION, tn as resolveAgentAvatar, tr as runSubagentAnnounceFlow, tt as normalizePayloadToSystemText, ui as extractFileContentFromSource, un as unbindThreadBindingsBySessionKey, ur as registerAgentRunContext, ut as resolvePluginTools, v as applyToolPolicyPipeline, vr as getTtsProvider, vt as loadProviderUsageSummary, w as listAgentsForGateway, wr as resolveTtsPrefsPath, wt as resolveAgentOutboundIdentity, x as createSquidClawTools, xr as resolveTtsApiKey, y as buildDefaultToolPolicyPipelineSteps, yr as isTtsEnabled, z as setPreRestartDeferralCheck, zn as resolveOutboundChannelPlugin, zr as DEFAULT_HEARTBEAT_ACK_MAX_CHARS, zt as createDefaultDeps } from "./reply-LaODRY80.js";
 import { A as resolveDefaultAgentWorkspaceDir, C as DEFAULT_SOUL_FILENAME, E as ensureAgentWorkspace, O as isWorkspaceOnboardingCompleted, S as DEFAULT_MEMORY_FILENAME, T as DEFAULT_USER_FILENAME, a as resolveAgentDir, b as DEFAULT_IDENTITY_FILENAME, c as resolveAgentModelFallbacksOverride, d as resolveDefaultAgentId, g as DEFAULT_AGENTS_FILENAME, i as resolveAgentConfig, j as resolveWorkspaceTemplateDir, l as resolveAgentSkillsFilter, m as resolveSessionAgentId, n as listAgentEntries, r as listAgentIds, u as resolveAgentWorkspaceDir, v as DEFAULT_BOOTSTRAP_FILENAME, w as DEFAULT_TOOLS_FILENAME, x as DEFAULT_MEMORY_ALT_FILENAME, y as DEFAULT_HEARTBEAT_FILENAME } from "./agent-scope-C1XMay0T.js";
 import { a as setConsoleSubsystemFilter, d as defaultRuntime, n as runtimeForLogger, o as setConsoleTimestampPrefix, t as createSubsystemLogger } from "./subsystem-DC87CPVS.js";
 import { C as isCronRunSessionKey, E as parseAgentSessionKey, T as isSubagentSessionKey, _ as normalizeAccountId$1, c as normalizeAgentId, g as DEFAULT_ACCOUNT_ID, h as toAgentStoreSessionKey, l as normalizeMainKey, m as toAgentRequestSessionKey, o as classifySessionKeyShape, r as buildAgentMainSessionKey, t as DEFAULT_AGENT_ID, u as resolveAgentIdFromSessionKey } from "./session-key-CIXZm7v4.js";
@@ -103,7 +103,7 @@ import { t as listAgentWorkspaceDirs } from "./workspace-dirs-B2dNahfe.js";
 import { f as isKnownSecretTargetId, n as GATEWAY_AUTH_SURFACE_PATHS, r as evaluateGatewayAuthSurfaceStates } from "./runtime-config-collectors-CuQEWwhf.js";
 import "./command-secret-targets-HkRLTNEi.js";
 import { c as hasNonzeroUsage, i as loadSessionUsageTimeSeries, n as loadCostUsageSummary, r as loadSessionCostSummary, s as deriveSessionTotalTokens, t as discoverAllSessions } from "./session-cost-usage-B4DbYmaL.js";
-import { C as normalizeControlUiBasePath, S as buildControlUiAvatarUrl, c as handleReset, w as resolveAssistantAvatarUrl, x as CONTROL_UI_AVATAR_PREFIX } from "./onboard-helpers-R4b3Kr01.js";
+import { C as normalizeControlUiBasePath, S as buildControlUiAvatarUrl, c as handleReset, w as resolveAssistantAvatarUrl, x as CONTROL_UI_AVATAR_PREFIX } from "./onboard-helpers-DKMtUE3F.js";
 import "./prompt-style-BoYH_ODs.js";
 import "./pairing-labels-Bh4U5HqY.js";
 import { n as formatTokenCount, r as formatUsd } from "./usage-format-CpAFclrX.js";
@@ -125,7 +125,7 @@ import { n as DEFAULT_GATEWAY_HTTP_TOOL_DENY } from "./dangerous-tools-D0u9YNYf.
 import { n as inheritOptionFromParent } from "./command-options-D0bXi5Pl.js";
 import { t as WizardCancelledError } from "./prompts-knTF_LVq.js";
 import { t as resolveChannelDefaultAccountId } from "./helpers-CvsgDup6.js";
-import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, t as applyAgentConfig } from "./agents.config-DF51cWyU.js";
+import { a as pruneAgentConfig, i as loadAgentIdentity, r as findAgentEntryIndex, t as applyAgentConfig } from "./agents.config-DFuCqhIm.js";
 import { t as isWithinDir } from "./path-safety-BWiXz6D4.js";
 import "./install-safe-path-iCmVuopp.js";
 import "./skill-scanner-rdr9cQew.js";
@@ -139,27 +139,27 @@ import "./service-DWcwQCyr.js";
 import "./lifecycle-core-C3gBUQyA.js";
 import "./systemd-hints-BylRxjER.js";
 import { t as parsePort$1 } from "./parse-port-OBGBQwYB.js";
-import { n as addGatewayServiceCommands } from "./daemon-cli-Doz3CsCY.js";
+import { n as addGatewayServiceCommands } from "./daemon-cli-B7j3r4qt.js";
 import "./diagnostics-DvOqta_6.js";
 import "./table-BPiDGg8F.js";
 import { n as resolveWideAreaDiscoveryDomain, r as writeWideAreaGatewayZone } from "./widearea-dns-CrTl2Q0i.js";
 import { i as toOptionString, n as extractGatewayMiskeys, r as maybeExplainGatewayServiceStop, t as describeUnknownError } from "./shared-DEKzP77M.js";
 import { a as probeGateway, n as collectEnabledInsecureOrDangerousFlags } from "./audit-Gy15uq75.js";
 import { t as discoverGatewayBeacons } from "./bonjour-discovery-Clx6InvU.js";
-import { n as getStatusSummary, r as pickGatewaySelfPresence } from "./status-DWG2unIb.js";
-import { a as styleHealthChannelLine, c as setHeartbeatsEnabled, l as startHeartbeatRunner, n as getHealthSnapshot, s as runHeartbeatOnce, t as formatHealthChannelLines, u as isCronSystemEvent } from "./health-CHe6jetL.js";
+import { n as getStatusSummary, r as pickGatewaySelfPresence } from "./status-FEZLL4zc.js";
+import { a as styleHealthChannelLine, c as setHeartbeatsEnabled, l as startHeartbeatRunner, n as getHealthSnapshot, s as runHeartbeatOnce, t as formatHealthChannelLines, u as isCronSystemEvent } from "./health-CrEBegrW.js";
 import { a as resolveControlUiRootSync, i as resolveControlUiRootOverrideSync, t as ensureControlUiAssetsBuilt } from "./control-ui-assets-Bz7TCLpb.js";
 import { h as normalizeUpdateChannel, l as DEFAULT_PACKAGE_CHANNEL, n as checkUpdateStatus, o as resolveNpmChannelTag, r as compareSemverStrings } from "./channel-account-context-e4ysObLI.js";
 import { a as resolveCommandSecretsFromActiveRuntimeSnapshot, i as prepareSecretsRuntimeSnapshot, n as clearSecretsRuntimeSnapshot, r as getActiveSecretsRuntimeSnapshot, t as activateSecretsRuntimeSnapshot } from "./runtime-DNEPlni4.js";
 import "./onboarding.secret-input-CpbcFdVE.js";
-import { t as runOnboardingWizard } from "./onboarding-D8yzBiwp.js";
-import { a as sendApnsAlert, c as parseMessageWithAttachments, d as shouldLogWs, f as summarizeAgentEventForWsLog, i as resolveApnsAuthConfigFromEnv, l as formatForLog, n as normalizeApnsEnvironment, o as sendApnsBackgroundWake, p as setGatewayWsLogStyle, s as normalizeRpcAttachmentsToChatAttachments, t as loadApnsRegistration, u as logWs } from "./push-apns-C7qyD1SB.js";
+import { t as runOnboardingWizard } from "./onboarding-gTeRtrT0.js";
+import { a as sendApnsAlert, c as parseMessageWithAttachments, d as shouldLogWs, f as summarizeAgentEventForWsLog, i as resolveApnsAuthConfigFromEnv, l as formatForLog, n as normalizeApnsEnvironment, o as sendApnsBackgroundWake, p as setGatewayWsLogStyle, s as normalizeRpcAttachmentsToChatAttachments, t as loadApnsRegistration, u as logWs } from "./push-apns-Bmzz46UG.js";
 import { T as resolveGmailHookRuntimeConfig, _ as buildGogWatchServeArgs, i as ensureTailscaleEndpoint, v as buildGogWatchStartArgs } from "./gmail-setup-utils-CDJE1jBL.js";
 import { n as isNodeCommandAllowed, r as resolveNodeCommandAllowlist } from "./node-command-policy-Bfp1jHbs.js";
 import "./node-service-BA4mUxAW.js";
 import "./status.update-BNODJGA9.js";
 import { t as installSkill } from "./skills-install-C4ILNl_z.js";
-import { t as runGatewayUpdate } from "./update-runner-CBzd_nJ6.js";
+import { t as runGatewayUpdate } from "./update-runner-DVgVKydP.js";
 import { i as shouldIncludeHook, r as resolveHookConfig, t as loadWorkspaceHookEntries } from "./workspace-B-k5DNiQ.js";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import * as fsSync from "node:fs";
@@ -13817,7 +13817,7 @@ const nodeHandlers = {
 		const p = params;
 		const payloadJSON = typeof p.payloadJSON === "string" ? p.payloadJSON : p.payload !== void 0 ? JSON.stringify(p.payload) : null;
 		await respondUnavailableOnThrow(respond, async () => {
-			const { handleNodeEvent } = await import("./server-node-events-CZSHLRjW.js");
+			const { handleNodeEvent } = await import("./server-node-events-BZFU_fm1.js");
 			const nodeId = client?.connect?.device?.id ?? client?.connect?.client?.id ?? "node";
 			await handleNodeEvent({
 				deps: context.deps,