openclaw/dist/plugin-sdk/security-runtime.js

Multi-channel AI gateway with extensible messaging integrations

import { i as extractErrorCode } from "../error-coercion-D_-xJ90S.js";
import { p as redactSensitiveText } from "../redact-BtvPPfTi.js";
import { A as writeExternalFileWithinRoot, E as statRegularFileSync, L as sanitizeUntrustedFileName, M as assertNoSymlinkParents, N as assertNoSymlinkParentsSync, T as statRegularFile, _ as readRegularFileSync, a as canonicalPathFromExistingAncestor, b as resolveAbsolutePathForWrite, d as pathExists, f as pathExistsSync, g as readRegularFile, k as withTimeout, n as appendRegularFile, s as findExistingAncestor, t as FsSafeError, u as openLocalFileSafely, w as root, x as resolveLocalPathFromRootsSync, y as resolveAbsolutePathForRead } from "../fs-safe-B6pvPGnf.js";
import { r as isPathInside } from "../path-guards-Cp-mGr3-.js";
import { n as compileSafeRegexDetailed } from "../safe-regex-BQnlv3bA.js";
import { t as formatErrorMessage } from "../errors-Db3Ymjlb.js";
import { n as resolvePreferredOpenClawTmpDir } from "../tmp-openclaw-dir-DnyL0lW9.js";
import { n as replaceFileAtomic, t as movePathWithCopyFallback } from "../replace-file-BAJ-TWzD.js";
import { n as privateFileStoreSync } from "../private-file-store-CaBdNw0y.js";
import { t as safeEqualSecret } from "../secret-equal-DRsL8lKD.js";
import { i as hasProxyEnvConfigured } from "../proxy-env-BepksPz2.js";
import { r as ensurePortAvailable } from "../ports-CU06KPCY.js";
import { t as normalizeHostname } from "../hostname-_16721Le.js";
import { _ as resolvePinnedHostnameWithPolicy, d as isPrivateNetworkAllowedByPolicy, p as matchesHostnameAllowlist, t as SsrFBlockedError } from "../ssrf-0QyXWOVG.js";
import { a as wrapExternalContent, i as truncateSanitizedExternalContent, o as wrapWebContent } from "../external-content-CpqslxXH.js";
import { a as parseAccessGroupAllowFromEntry } from "../allow-from-PKDuk4I7.js";
import { o as resolvePinnedMainDmOwnerFromAllowlist } from "../dm-policy-shared-BrXqldwA.js";
import { n as filterSupplementalContextItems, r as shouldIncludeSupplementalContext, t as evaluateSupplementalContextVisibility } from "../context-visibility-C5CaKMWO.js";
import { t as expandAllowFromWithAccessGroups } from "../access-groups-BuF75RtE.js";
import { t as fileExists } from "../file-access-runtime-CfcyqU8y.js";
import { a as buildUntrustedChannelMetadata, i as buildChannelMetadata, n as resolveExistingPathsWithinRoot, r as resolveStrictExistingPathsWithinRoot, t as pathScope } from "../security-runtime-Ckf0kc0h.js";
export { FsSafeError, SsrFBlockedError, appendRegularFile, assertNoSymlinkParents, assertNoSymlinkParentsSync, buildChannelMetadata, buildUntrustedChannelMetadata, canonicalPathFromExistingAncestor, compileSafeRegexDetailed, ensurePortAvailable, evaluateSupplementalContextVisibility, expandAllowFromWithAccessGroups, extractErrorCode, fileExists, filterSupplementalContextItems, findExistingAncestor, formatErrorMessage, hasProxyEnvConfigured, isPathInside, isPrivateNetworkAllowedByPolicy, matchesHostnameAllowlist, movePathWithCopyFallback, normalizeHostname, openLocalFileSafely, parseAccessGroupAllowFromEntry, pathExists, pathExistsSync, pathScope, privateFileStoreSync, readRegularFile, readRegularFileSync, redactSensitiveText, replaceFileAtomic, resolveAbsolutePathForRead, resolveAbsolutePathForWrite, resolveExistingPathsWithinRoot, resolveLocalPathFromRootsSync, resolvePinnedHostnameWithPolicy, resolvePinnedMainDmOwnerFromAllowlist, resolvePreferredOpenClawTmpDir, resolveStrictExistingPathsWithinRoot, root, safeEqualSecret, sanitizeUntrustedFileName, shouldIncludeSupplementalContext, statRegularFile, statRegularFileSync, truncateSanitizedExternalContent, withTimeout, wrapExternalContent, wrapWebContent, writeExternalFileWithinRoot };