wednesdayai 0.5.1-dev.36 → 0.5.1-dev.38

package/dist/entry.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { Ht as isRootVersionInvocation, Rt as hasHelpOrVersion, Vt as isRootHelpInvocation } from "./globals-BRyHSrWD.js";
+import { Ht as isRootVersionInvocation, Rt as hasHelpOrVersion, Vt as isRootHelpInvocation } from "./globals-3lUHnZas.js";
 import { y as resolveRequiredHomeDir } from "./paths-BMo6kTge.js";
 import { t as isValidProfileName } from "./profile-utils-DMZjJPo2.js";
 import { n as resolveProcessScopedMap } from "./plain-object-Doc_YkH1.js";
-import { t as createSubsystemLogger } from "./subsystem-BNf8H-Zm.js";
+import { t as createSubsystemLogger } from "./subsystem-xTuYkxuQ.js";
 import { t as parseBooleanValue } from "./boolean-C71HJEcH.js";
 import { enableCompileCache } from "node:module";
 import { spawn } from "node:child_process";
@@ -381,7 +381,7 @@ if (!isMainModule({
 	}
 	function tryHandleRootHelpFastPath(argv) {
 		if (!isRootHelpInvocation(argv)) return false;
-		import("./program-CiwRqh1J.js").then(({ buildProgram }) => {
+		import("./program-Rzncx3aZ.js").then(({ buildProgram }) => {
 			buildProgram().outputHelp();
 		}).catch((error) => {
 			console.error("[openclaw] Failed to display help:", error instanceof Error ? error.stack ?? error.message : error);
@@ -400,7 +400,7 @@ if (!isMainModule({
 			applyCliProfileEnv({ profile: parsed.profile });
 			process$1.argv = parsed.argv;
 		}
-		if (!tryHandleRootVersionFastPath(process$1.argv) && !tryHandleRootHelpFastPath(process$1.argv)) import("./run-main-CnNc7DLd.js").then(({ runCli }) => runCli(process$1.argv)).then(() => flushStdio()).then(() => process$1.exit(process$1.exitCode ?? 0)).catch(async (error) => {
+		if (!tryHandleRootVersionFastPath(process$1.argv) && !tryHandleRootHelpFastPath(process$1.argv)) import("./run-main-C-PQ_TDh.js").then(({ runCli }) => runCli(process$1.argv)).then(() => flushStdio()).then(() => process$1.exit(process$1.exitCode ?? 0)).catch(async (error) => {
 			console.error("[openclaw] Failed to start CLI:", error instanceof Error ? error.stack ?? error.message : error);
 			await flushStdio();
 			process$1.exit(process$1.exitCode ?? 1);

package/dist/{errors-muW4vMSB.js → errors-CgPgYfWg.js}

@@ -1,4 +1,4 @@
-import { t as redactSensitiveText } from "./redact-BkE4uRXu.js";
+import { t as redactSensitiveText } from "./redact-CysJDryP.js";
 
 //#region src/infra/errors.ts
 function extractErrorCode(err) {

package/dist/{exec-EGo-G7vR.js → exec-DWOKM6EC.js}

@@ -1,5 +1,5 @@
-import { c as shouldLogVerbose, h as getLogger, n as info, o as logVerboseConsole, t as danger, u as warn } from "./globals-BRyHSrWD.js";
-import { m as defaultRuntime, t as createSubsystemLogger } from "./subsystem-BNf8H-Zm.js";
+import { c as shouldLogVerbose, h as getLogger, n as info, o as logVerboseConsole, t as danger, u as warn } from "./globals-3lUHnZas.js";
+import { m as defaultRuntime, t as createSubsystemLogger } from "./subsystem-xTuYkxuQ.js";
 import { t as resolveCommandStdio } from "./spawn-utils-CbEMbWcD.js";
 import { execFile, spawn } from "node:child_process";
 import process from "node:process";

package/dist/{exec-approvals-CImDpHtY.js → exec-approvals-CavJfWPl.js}

@@ -1,6 +1,6 @@
 import { _ as expandHomePrefix } from "./paths-BMo6kTge.js";
-import { t as createSubsystemLogger } from "./subsystem-BNf8H-Zm.js";
-import { t as DEFAULT_AGENT_ID } from "./session-key-BRw3GFxY.js";
+import { t as createSubsystemLogger } from "./subsystem-xTuYkxuQ.js";
+import { t as DEFAULT_AGENT_ID } from "./session-key-Cr27HfX5.js";
 import path, { basename, dirname, join } from "node:path";
 import fs from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";

package/dist/{exec-approvals-allowlist-B3_jgDyG.js → exec-approvals-allowlist-CfzuCK0Q.js}

@@ -1,4 +1,4 @@
-import { Da as resolveAllowlistCandidatePath, Ea as matchAllowlist, Fa as isShellWrapperExecutable, Ma as extractShellWrapperInlineCommand, Oa as resolveCommandResolutionFromArgv, Pa as isDispatchWrapperExecutable, Ra as unwrapKnownDispatchWrapperInvocation, Sa as isWindowsPlatform, Ta as DEFAULT_SAFE_BINS, Wa as SAFE_BIN_PROFILES, ba as analyzeShellCommand, ha as isTrustedSafeBinPath, va as validateSafeBinArgv, wa as splitCommandChain, za as unwrapKnownShellMultiplexerInvocation } from "./config-2hPOvE4Z.js";
+import { Da as resolveAllowlistCandidatePath, Ea as matchAllowlist, Fa as isShellWrapperExecutable, Ma as extractShellWrapperInlineCommand, Oa as resolveCommandResolutionFromArgv, Pa as isDispatchWrapperExecutable, Ra as unwrapKnownDispatchWrapperInvocation, Sa as isWindowsPlatform, Ta as DEFAULT_SAFE_BINS, Wa as SAFE_BIN_PROFILES, ba as analyzeShellCommand, ha as isTrustedSafeBinPath, va as validateSafeBinArgv, wa as splitCommandChain, za as unwrapKnownShellMultiplexerInvocation } from "./config-D--rwfpd.js";
 import path from "node:path";
 
 //#region src/infra/exec-approvals-allowlist.ts

package/dist/{exec-approvals-cli-C6AHbPh4.js → exec-approvals-cli-uvLKhEsP.js}

@@ -1,34 +1,34 @@
-import { f as isRich, p as theme } from "./globals-BRyHSrWD.js";
+import { f as isRich, p as theme } from "./globals-3lUHnZas.js";
 import "./paths-BMo6kTge.js";
-import { m as defaultRuntime } from "./subsystem-BNf8H-Zm.js";
+import { m as defaultRuntime } from "./subsystem-xTuYkxuQ.js";
 import "./boolean-C71HJEcH.js";
-import "./config-2hPOvE4Z.js";
+import "./config-D--rwfpd.js";
 import "./version-D_9__Xw6.js";
-import "./agent-scope-BXqrHhZ0.js";
-import "./exec-EGo-G7vR.js";
+import "./agent-scope-BZ0wFh-U.js";
+import "./exec-DWOKM6EC.js";
 import "./github-copilot-token-CvN6iidT.js";
-import "./pid-alive-TVJ4mVal.js";
+import "./pid-alive-DIe5jzmE.js";
 import "./static-app-DG39qMau.js";
 import "./retry-policy-BIRWkDiU.js";
-import "./tailnet-CBZAvwAf.js";
-import "./ws-BafnkIRl.js";
+import "./tailnet-B5JdDATD.js";
+import "./ws-Dnz-ugxp.js";
 import "./task-run-types-CXp-wZyE.js";
-import "./exec-approvals-allowlist-B3_jgDyG.js";
-import "./client-x4GnolXm.js";
-import "./call-C4ArH9Si.js";
+import "./exec-approvals-allowlist-CfzuCK0Q.js";
+import "./client-DsaKKPz1.js";
+import "./call-BY-wbSIJ.js";
 import "./pairing-token-D1vOP4TH.js";
 import { n as formatTimeAgo } from "./format-relative-BwbQjKKI.js";
-import { h as saveExecApprovals, l as readExecApprovalsSnapshot } from "./exec-approvals-CImDpHtY.js";
-import { t as formatDocsLink } from "./links-BRY-h8H0.js";
-import "./progress-80iGSJGv.js";
-import { n as callGatewayFromCli } from "./gateway-rpc-DogQQ77j.js";
-import "./service-DMkBvr4B.js";
-import "./systemd-CyRDQg6V.js";
-import { t as renderTable } from "./table-BRTxbR4E.js";
-import { t as describeUnknownError } from "./shared-COhRUP1S.js";
-import { a as resolveNodeId, r as nodesCallOpts } from "./rpc-C7VnW-Aw.js";
+import { h as saveExecApprovals, l as readExecApprovalsSnapshot } from "./exec-approvals-CavJfWPl.js";
+import { t as formatDocsLink } from "./links-CPIBVJ0k.js";
+import "./progress-DGJz2cvq.js";
+import { n as callGatewayFromCli } from "./gateway-rpc-CIkWW5n2.js";
+import "./service-DoOh34VG.js";
+import "./systemd-DCrSOh9E.js";
+import { t as renderTable } from "./table-Buk61GwP.js";
+import { t as describeUnknownError } from "./shared-DCN12ugV.js";
+import { a as resolveNodeId, r as nodesCallOpts } from "./rpc-Bg0RuGsL.js";
 import JSON5 from "json5";
-import fs from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 
 //#region src/cli/exec-approvals-cli.ts
 async function readStdin() {
@@ -325,7 +325,7 @@ function registerExecApprovalsCli(program) {
 			if (!opts.file && !opts.stdin) exitWithError("Provide --file or --stdin.");
 			if (opts.file && opts.stdin) exitWithError("Use either --file or --stdin (not both).");
 			const { source, nodeId, targetLabel, baseHash } = await loadWritableSnapshotTarget(opts);
-			const raw = opts.stdin ? await readStdin() : await fs.readFile(String(opts.file), "utf8");
+			const raw = opts.stdin ? await readStdin() : await fsPromises.readFile(String(opts.file), "utf8");
 			let file;
 			try {
 				file = JSON5.parse(raw);

package/dist/{exec-safe-bin-runtime-policy-h4hE5cjd.js → exec-safe-bin-runtime-policy-CY75nr5s.js}

@@ -1,5 +1,5 @@
-import { Ga as normalizeSafeBinProfileFixtures, Ka as resolveSafeBinProfiles, _a as normalizeTrustedSafeBinDirs, ga as listWritableExplicitTrustedSafeBinDirs, ma as getTrustedSafeBinDirs } from "./config-2hPOvE4Z.js";
-import { i as resolveSafeBins } from "./exec-approvals-allowlist-B3_jgDyG.js";
+import { Ga as normalizeSafeBinProfileFixtures, Ka as resolveSafeBinProfiles, _a as normalizeTrustedSafeBinDirs, ga as listWritableExplicitTrustedSafeBinDirs, ma as getTrustedSafeBinDirs } from "./config-D--rwfpd.js";
+import { i as resolveSafeBins } from "./exec-approvals-allowlist-CfzuCK0Q.js";
 
 //#region src/infra/exec-safe-bin-runtime-policy.ts
 const INTERPRETER_LIKE_SAFE_BINS = new Set([

package/dist/{extension-relay-auth-D49uIEqs.js → extension-relay-auth-CEkGLele.js}

@@ -1,8 +1,8 @@
-import { X as isPathInside, Y as isNotFoundPathError, kt as resolvePreferredOpenClawTmpDir } from "./globals-BRyHSrWD.js";
-import { c as loadConfig } from "./config-2hPOvE4Z.js";
-import { i as openFileWithinRoot, t as SafeOpenError } from "./fs-safe-db4fkk2l.js";
+import { X as isPathInside, Y as isNotFoundPathError, kt as resolvePreferredOpenClawTmpDir } from "./globals-3lUHnZas.js";
+import { c as loadConfig } from "./config-D--rwfpd.js";
+import { i as openFileWithinRoot, t as SafeOpenError } from "./fs-safe-sWugzmbo.js";
 import path from "node:path";
-import fs from "node:fs/promises";
+import fsPromises from "node:fs/promises";
 import { createHmac } from "node:crypto";
 
 //#region src/browser/constants.ts
@@ -56,28 +56,28 @@ function invalidPath(scopeLabel) {
 }
 async function resolveRealPathIfExists(targetPath) {
 	try {
-		return await fs.realpath(targetPath);
+		return await fsPromises.realpath(targetPath);
 	} catch {
 		return;
 	}
 }
 async function resolveTrustedRootRealPath(rootDir) {
 	try {
-		const rootLstat = await fs.lstat(rootDir);
+		const rootLstat = await fsPromises.lstat(rootDir);
 		if (!rootLstat.isDirectory() || rootLstat.isSymbolicLink()) return;
-		return await fs.realpath(rootDir);
+		return await fsPromises.realpath(rootDir);
 	} catch {
 		return;
 	}
 }
 async function validateCanonicalPathWithinRoot(params) {
 	try {
-		const candidateLstat = await fs.lstat(params.candidatePath);
+		const candidateLstat = await fsPromises.lstat(params.candidatePath);
 		if (candidateLstat.isSymbolicLink()) return "invalid";
 		if (params.expect === "directory" && !candidateLstat.isDirectory()) return "invalid";
 		if (params.expect === "file" && !candidateLstat.isFile()) return "invalid";
 		if (params.expect === "file" && candidateLstat.nlink > 1) return "invalid";
-		const candidateRealPath = await fs.realpath(params.candidatePath);
+		const candidateRealPath = await fsPromises.realpath(params.candidatePath);
 		return isPathInside(params.rootRealPath, candidateRealPath) ? "ok" : "invalid";
 	} catch (err) {
 		return isNotFoundPathError(err) ? "not-found" : "invalid";
@@ -155,7 +155,7 @@ async function resolveCheckedPathsWithinRoot(params) {
 		};
 		if (!rootRealPath || !raw || !path.isAbsolute(raw)) return lexicalPathResult;
 		try {
-			const resolvedExistingPath = await fs.realpath(raw);
+			const resolvedExistingPath = await fsPromises.realpath(raw);
 			const relativePath = path.relative(rootRealPath, resolvedExistingPath);
 			if (!isInRoot(relativePath)) return lexicalPathResult;
 			return {

package/dist/extensionAPI.js

@@ -7,7 +7,7 @@ import "./github-copilot-token-BJeEWDJb.js";
 import "./send-CGdfXpKz.js";
 import "./send-B_ZucklA.js";
 import "./tokens-D81t1pbF.js";
-import { a as resolveAgentTimeoutMs, t as runEmbeddedPiAgent } from "./pi-embedded-BzjQS2tl.js";
+import { a as resolveAgentTimeoutMs, t as runEmbeddedPiAgent } from "./pi-embedded-BAKd4NmP.js";
 import "./sessions-DpewQpWj.js";
 import "./diagnostic-events-DMwgeRgr.js";
 import "./diagnostic-XckGznW_.js";
@@ -16,8 +16,8 @@ import "./redact-DsVjtfGq.js";
 import "./command-queue-K_AfPnin.js";
 import "./fetch-EMfyKQ8c.js";
 import "./pi-model-discovery-DvJxbshP.js";
-import "./chat-content-Cafge7N8.js";
-import "./chrome-H5-7mQ4m.js";
+import "./chat-content-01nUeO9I.js";
+import "./chrome-kwiyU0Mr.js";
 import "./json-files-BATYfXx7.js";
 import "./path-alias-guards-DQnGmIZb.js";
 import "./errors-CwBnqLdW.js";
@@ -26,7 +26,7 @@ import "./proxy-env-Bs474VeG.js";
 import "./store-C61Zp9wj.js";
 import "./fetch-guard-BEeIyqsn.js";
 import "./thinking-BOHpxvdU.js";
-import "./audio-transcription-runner-CoyogVcx.js";
+import "./audio-transcription-runner-B-MEt_yD.js";
 import "./api-key-rotation-CzNIm6xw.js";
 import "./chunk-B1kH1hpV.js";
 import "./markdown-tables-D9rvkGhN.js";
@@ -35,10 +35,10 @@ import "./render-DSLzcBxk.js";
 import "./commands-registry-HSwuwV_9.js";
 import "./user-run-recording-B2ufmO0r.js";
 import "./recorder-BOR-jLfu.js";
-import "./agent-turn-runner-JxDS9bU_.js";
+import "./agent-turn-runner-CiEPY6RO.js";
 import "./skill-commands-Bcc0IOwG.js";
 import "./outbound-message-hooks-DYzUasBA.js";
-import "./deliver-x22mTRDq.js";
+import "./deliver-CgFkiA4Z.js";
 import "./fetch-wfPHbAnw.js";
 import "./tables-CNp0EK8h.js";
 import "./send-D6i2jgso.js";

package/dist/{fetch-Ciq99DHJ.js → fetch-BBi5dEoV.js}

@@ -1,12 +1,12 @@
-import { c as resolveAgentWorkspaceDir } from "./agent-scope-cTY4-zRz.js";
-import { l as resolveStateDir } from "./paths-BIDPYPVC.js";
-import { mt as resolvePreferredOpenClawTmpDir } from "./subsystem-BOg9wqSC.js";
+import { c as resolveAgentWorkspaceDir } from "./agent-scope-CoIdVzmg.js";
+import { l as resolveStateDir } from "./paths-B_gs59ga.js";
+import { mt as resolvePreferredOpenClawTmpDir } from "./subsystem-DynBFcQj.js";
 import { n as resolveProcessScopedMap } from "./plain-object-Doc_YkH1.js";
-import { _ as runExec } from "./workspace-D8z8s1Xz.js";
-import { U as loadConfig } from "./model-selection-BJZFC8fA.js";
-import { t as redactSensitiveText } from "./redact-BkE4uRXu.js";
-import { n as formatErrorChainMessage } from "./errors-muW4vMSB.js";
-import { n as withStrictGuardedFetchMode, s as resolveNetworkSsrFPolicy, t as fetchWithSsrFGuard } from "./fetch-guard-DaJwMbcY.js";
+import { _ as runExec } from "./workspace-xnzx7wEV.js";
+import { U as loadConfig } from "./model-selection-B7FYf8Fo.js";
+import { t as redactSensitiveText } from "./redact-CysJDryP.js";
+import { n as formatErrorChainMessage } from "./errors-CgPgYfWg.js";
+import { n as withStrictGuardedFetchMode, s as resolveNetworkSsrFPolicy, t as fetchWithSsrFGuard } from "./fetch-guard-BcLYPGi1.js";
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs/promises";

package/dist/{fetch-B9Tca1cY.js → fetch-BrwJHFZR.js}

@@ -1,4 +1,4 @@
-import { a as bindAbortRelay } from "./fetch-guard-DaJwMbcY.js";
+import { a as bindAbortRelay } from "./fetch-guard-BcLYPGi1.js";
 
 //#region src/infra/fetch.ts
 const wrapFetchWithAbortSignalMarker = Symbol.for("openclaw.fetch.abort-signal-wrapped");

package/dist/{fetch-BZPOzq9L.js → fetch-CLk1nKmU.js}

@@ -1,13 +1,13 @@
-import { kt as resolvePreferredOpenClawTmpDir } from "./globals-BRyHSrWD.js";
+import { kt as resolvePreferredOpenClawTmpDir } from "./globals-3lUHnZas.js";
 import { g as resolveStateDir } from "./paths-BMo6kTge.js";
 import { n as resolveProcessScopedMap } from "./plain-object-Doc_YkH1.js";
-import { c as loadConfig } from "./config-2hPOvE4Z.js";
-import { u as resolveAgentWorkspaceDir } from "./agent-scope-BXqrHhZ0.js";
+import { c as loadConfig } from "./config-D--rwfpd.js";
+import { u as resolveAgentWorkspaceDir } from "./agent-scope-BZ0wFh-U.js";
 import { n as redactSensitiveText } from "./redact-OtHqr7lm.js";
 import { r as formatErrorChainMessage } from "./errors-zRgI_PDI.js";
-import { c as detectMime, l as extensionForMime } from "./image-ops-BFv9Aw5H.js";
+import { c as detectMime, l as extensionForMime } from "./image-ops-C0np5f9V.js";
 import { t as resolveNetworkSsrFPolicy } from "./ssrf-config-qRiQMP-8.js";
-import { n as withStrictGuardedFetchMode, t as fetchWithSsrFGuard } from "./fetch-guard-laNnWRKl.js";
+import { n as withStrictGuardedFetchMode, t as fetchWithSsrFGuard } from "./fetch-guard-TJQinE0a.js";
 import path from "node:path";
 
 //#region src/media/local-roots.ts

package/dist/{fetch-guard-DaJwMbcY.js → fetch-guard-BcLYPGi1.js}

@@ -1,5 +1,5 @@
-import { S as logWarn, x as logInfo } from "./workspace-D8z8s1Xz.js";
-import { c as resolvePinnedHostnameWithPolicy, i as createPinnedDispatcher, n as SsrFBlockedError, o as isPrivateIpAddress, r as closeDispatcher, t as hasProxyEnvConfigured } from "./proxy-env-DXcKRnns.js";
+import { S as logWarn, x as logInfo } from "./workspace-xnzx7wEV.js";
+import { c as resolvePinnedHostnameWithPolicy, i as createPinnedDispatcher, n as SsrFBlockedError, o as isPrivateIpAddress, r as closeDispatcher, t as hasProxyEnvConfigured } from "./proxy-env-DrmTb0QW.js";
 import { EnvHttpProxyAgent, FormData, ProxyAgent, fetch as fetch$1 } from "undici";
 
 //#region src/infra/net/ssrf-config.ts

package/dist/{fetch-guard-laNnWRKl.js → fetch-guard-TJQinE0a.js}

@@ -1,5 +1,5 @@
-import { a as logInfo, o as logWarn } from "./exec-EGo-G7vR.js";
-import { c as resolvePinnedHostnameWithPolicy, i as createPinnedDispatcher, n as SsrFBlockedError, o as isPrivateIpAddress, r as closeDispatcher, t as hasProxyEnvConfigured } from "./proxy-env-BcMrDxNo.js";
+import { a as logInfo, o as logWarn } from "./exec-DWOKM6EC.js";
+import { c as resolvePinnedHostnameWithPolicy, i as createPinnedDispatcher, n as SsrFBlockedError, o as isPrivateIpAddress, r as closeDispatcher, t as hasProxyEnvConfigured } from "./proxy-env-t-re7bCo.js";
 import { t as bindAbortRelay } from "./fetch-timeout-1Rifi233.js";
 import { EnvHttpProxyAgent, FormData, ProxyAgent, fetch } from "undici";
 

package/dist/{frontmatter-BzlMEBkz.js → frontmatter-DQTIIgFI.js}

@@ -1,7 +1,7 @@
-import { s as parseBooleanValue, t as readManifestNamespace } from "./legacy-names-CRCLZarD.js";
+import { s as parseBooleanValue, t as readManifestNamespace } from "./legacy-names-D7ywm6_7.js";
 import path from "node:path";
-import fs from "node:fs";
-import json5 from "json5";
+import syncFs from "node:fs";
+import JSON5 from "json5";
 import YAML from "yaml";
 
 //#region src/shared/config-eval.ts
@@ -92,7 +92,7 @@ function hasBinary(bin) {
 	for (const part of parts) for (const ext of extensions) {
 		const candidate = path.join(part, bin + ext);
 		try {
-			fs.accessSync(candidate, fs.constants.X_OK);
+			syncFs.accessSync(candidate, syncFs.constants.X_OK);
 			hasBinaryCache.set(bin, true);
 			return true;
 		} catch {}
@@ -258,7 +258,7 @@ function resolveOpenClawManifestBlock(params) {
 	const raw = getFrontmatterString(params.frontmatter, params.key ?? "metadata");
 	if (!raw) return;
 	try {
-		const parsed = json5.parse(raw);
+		const parsed = JSON5.parse(raw);
 		if (!parsed || typeof parsed !== "object") return;
 		return readManifestNamespace(parsed);
 	} catch {

package/dist/{fs-safe-CDfp5e8Q.js → fs-safe-CRbowDkj.js}

@@ -1,11 +1,11 @@
-import { u as expandHomePrefix } from "./paths-BIDPYPVC.js";
-import { B as hasNodeErrorCode, H as isPathInside, I as sameFileIdentity, U as isSymlinkOpenError, V as isNotFoundPathError } from "./subsystem-BOg9wqSC.js";
-import { S as logWarn } from "./workspace-D8z8s1Xz.js";
-import { n as assertNoPathAliasEscape } from "./path-alias-guards-BV6CR8H3.js";
+import { u as expandHomePrefix } from "./paths-B_gs59ga.js";
+import { B as hasNodeErrorCode, H as isPathInside, I as sameFileIdentity, U as isSymlinkOpenError, V as isNotFoundPathError } from "./subsystem-DynBFcQj.js";
+import { S as logWarn } from "./workspace-xnzx7wEV.js";
+import { n as assertNoPathAliasEscape } from "./path-alias-guards-nWrE5acE.js";
 import path from "node:path";
 import { constants } from "node:fs";
 import os from "node:os";
-import fs$1 from "node:fs/promises";
+import fs from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { pipeline } from "node:stream/promises";
 
@@ -25,19 +25,19 @@ const ensureTrailingSep = (value) => value.endsWith(path.sep) ? value : value +
 async function expandRelativePathWithHome(relativePath) {
 	let home = process.env.HOME || process.env.USERPROFILE || os.homedir();
 	try {
-		home = await fs$1.realpath(home);
+		home = await fs.realpath(home);
 	} catch {}
 	return expandHomePrefix(relativePath, { home });
 }
 async function openVerifiedLocalFile(filePath, options) {
 	try {
-		if ((await fs$1.lstat(filePath)).isDirectory()) throw new SafeOpenError("not-file", "not a file");
+		if ((await fs.lstat(filePath)).isDirectory()) throw new SafeOpenError("not-file", "not a file");
 	} catch (err) {
 		if (err instanceof SafeOpenError) throw err;
 	}
 	let handle;
 	try {
-		handle = await fs$1.open(filePath, OPEN_READ_FLAGS);
+		handle = await fs.open(filePath, OPEN_READ_FLAGS);
 	} catch (err) {
 		if (isNotFoundPathError(err)) throw new SafeOpenError("not-found", "file not found");
 		if (isSymlinkOpenError(err)) throw new SafeOpenError("symlink", "symlink open blocked", { cause: err });
@@ -45,13 +45,13 @@ async function openVerifiedLocalFile(filePath, options) {
 		throw err;
 	}
 	try {
-		const [stat, lstat] = await Promise.all([handle.stat(), fs$1.lstat(filePath)]);
+		const [stat, lstat] = await Promise.all([handle.stat(), fs.lstat(filePath)]);
 		if (lstat.isSymbolicLink()) throw new SafeOpenError("symlink", "symlink not allowed");
 		if (!stat.isFile()) throw new SafeOpenError("not-file", "not a file");
 		if (options?.rejectHardlinks && stat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
 		if (!sameFileIdentity(stat, lstat)) throw new SafeOpenError("path-mismatch", "path changed during read");
-		const realPath = await fs$1.realpath(filePath);
-		const realStat = await fs$1.stat(realPath);
+		const realPath = await fs.realpath(filePath);
+		const realStat = await fs.stat(realPath);
 		if (options?.rejectHardlinks && realStat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
 		if (!sameFileIdentity(stat, realStat)) throw new SafeOpenError("path-mismatch", "path mismatch");
 		return {
@@ -69,7 +69,7 @@ async function openVerifiedLocalFile(filePath, options) {
 async function resolvePathWithinRoot(params) {
 	let rootReal;
 	try {
-		rootReal = await fs$1.realpath(params.rootDir);
+		rootReal = await fs.realpath(params.rootDir);
 	} catch (err) {
 		if (isNotFoundPathError(err)) throw new SafeOpenError("not-found", "root dir not found");
 		throw err;
@@ -170,7 +170,7 @@ function buildAtomicWriteTempPath(targetPath) {
 	return path.join(dir, `.${base}.${process.pid}.${randomUUID()}.tmp`);
 }
 async function writeTempFileForAtomicReplace(params) {
-	const tempHandle = await fs$1.open(params.tempPath, OPEN_WRITE_CREATE_FLAGS, params.mode);
+	const tempHandle = await fs.open(params.tempPath, OPEN_WRITE_CREATE_FLAGS, params.mode);
 	try {
 		if (typeof params.data === "string") await tempHandle.writeFile(params.data, params.encoding ?? "utf8");
 		else await tempHandle.writeFile(params.data);
@@ -180,7 +180,7 @@ async function writeTempFileForAtomicReplace(params) {
 	}
 }
 async function verifyAtomicWriteResult(params) {
-	const rootWithSep = ensureTrailingSep(await fs$1.realpath(params.rootDir));
+	const rootWithSep = ensureTrailingSep(await fs.realpath(params.rootDir));
 	const opened = await openVerifiedLocalFile(params.targetPath, { rejectHardlinks: true });
 	try {
 		if (!sameFileIdentity(opened.stat, params.expectedStat)) throw new SafeOpenError("path-mismatch", "path changed during write");
@@ -191,13 +191,13 @@ async function verifyAtomicWriteResult(params) {
 }
 async function resolveOpenedFileRealPathForHandle(handle, ioPath) {
 	try {
-		return await fs$1.realpath(ioPath);
+		return await fs.realpath(ioPath);
 	} catch (err) {
 		if (!isNotFoundPathError(err)) throw err;
 	}
 	const fdCandidates = process.platform === "linux" ? [`/proc/self/fd/${handle.fd}`, `/dev/fd/${handle.fd}`] : process.platform === "win32" ? [] : [`/dev/fd/${handle.fd}`];
 	for (const fdPath of fdCandidates) try {
-		return await fs$1.realpath(fdPath);
+		return await fs.realpath(fdPath);
 	} catch {}
 	throw new SafeOpenError("path-mismatch", "unable to resolve opened file path");
 }
@@ -212,10 +212,10 @@ async function openWritableFileWithinRoot(params) {
 	} catch (err) {
 		throw new SafeOpenError("invalid-path", "path alias escape blocked", { cause: err });
 	}
-	if (params.mkdir !== false) await fs$1.mkdir(path.dirname(resolved), { recursive: true });
+	if (params.mkdir !== false) await fs.mkdir(path.dirname(resolved), { recursive: true });
 	let ioPath = resolved;
 	try {
-		const resolvedRealPath = await fs$1.realpath(resolved);
+		const resolvedRealPath = await fs.realpath(resolved);
 		if (!isPathInside(rootWithSep, resolvedRealPath)) throw new SafeOpenError("outside-workspace", "file is outside workspace root");
 		ioPath = resolvedRealPath;
 	} catch (err) {
@@ -227,10 +227,10 @@ async function openWritableFileWithinRoot(params) {
 	let createdForWrite = false;
 	try {
 		try {
-			handle = await fs$1.open(ioPath, OPEN_WRITE_EXISTING_FLAGS, fileMode);
+			handle = await fs.open(ioPath, OPEN_WRITE_EXISTING_FLAGS, fileMode);
 		} catch (err) {
 			if (!isNotFoundPathError(err)) throw err;
-			handle = await fs$1.open(ioPath, OPEN_WRITE_CREATE_FLAGS, fileMode);
+			handle = await fs.open(ioPath, OPEN_WRITE_CREATE_FLAGS, fileMode);
 			createdForWrite = true;
 		}
 	} catch (err) {
@@ -244,7 +244,7 @@ async function openWritableFileWithinRoot(params) {
 		if (!stat.isFile()) throw new SafeOpenError("invalid-path", "path is not a regular file under root");
 		if (stat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
 		try {
-			const lstat = await fs$1.lstat(ioPath);
+			const lstat = await fs.lstat(ioPath);
 			if (lstat.isSymbolicLink() || !lstat.isFile()) throw new SafeOpenError("invalid-path", "path is not a regular file under root");
 			if (!sameFileIdentity(stat, lstat)) throw new SafeOpenError("path-mismatch", "path changed during write");
 		} catch (err) {
@@ -252,7 +252,7 @@ async function openWritableFileWithinRoot(params) {
 		}
 		const realPath = await resolveOpenedFileRealPathForHandle(handle, ioPath);
 		openedRealPath = realPath;
-		const realStat = await fs$1.stat(realPath);
+		const realStat = await fs.stat(realPath);
 		if (!sameFileIdentity(stat, realStat)) throw new SafeOpenError("path-mismatch", "path mismatch");
 		if (realStat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
 		if (!isPathInside(rootWithSep, realPath)) throw new SafeOpenError("outside-workspace", "file is outside workspace root");
@@ -267,7 +267,7 @@ async function openWritableFileWithinRoot(params) {
 		const cleanupCreatedPath = createdForWrite && err instanceof SafeOpenError;
 		const cleanupPath = openedRealPath ?? ioPath;
 		await handle.close().catch(() => {});
-		if (cleanupCreatedPath) await fs$1.rm(cleanupPath, { force: true }).catch(() => {});
+		if (cleanupCreatedPath) await fs.rm(cleanupPath, { force: true }).catch(() => {});
 		throw err;
 	}
 }
@@ -290,7 +290,7 @@ async function writeFileWithinRoot(params) {
 			encoding: params.encoding,
 			mode: targetMode || 384
 		});
-		await fs$1.rename(tempPath, destinationPath);
+		await fs.rename(tempPath, destinationPath);
 		tempPath = null;
 		try {
 			await verifyAtomicWriteResult({
@@ -303,7 +303,7 @@ async function writeFileWithinRoot(params) {
 			throw err;
 		}
 	} finally {
-		if (tempPath) await fs$1.rm(tempPath, { force: true }).catch(() => {});
+		if (tempPath) await fs.rm(tempPath, { force: true }).catch(() => {});
 	}
 }
 async function copyFileWithinRoot(params) {
@@ -331,7 +331,7 @@ async function copyFileWithinRoot(params) {
 		});
 		await pipeline(sourceStream, targetStream);
 	} catch (err) {
-		if (target?.createdForWrite) await fs$1.rm(target.openedRealPath, { force: true }).catch(() => {});
+		if (target?.createdForWrite) await fs.rm(target.openedRealPath, { force: true }).catch(() => {});
 		throw err;
 	} finally {
 		if (!sourceClosedByStream) await source.handle.close().catch(() => {});