openclaw/dist/plugin-sdk/security-runtime.js

Multi-channel AI gateway with extensible messaging integrations

import { i as extractErrorCode } from "../error-coercion-1P2One0X.mjs";
import { A as withTimeout, D as statRegularFileSync, E as statRegularFile, _ as readRegularFileSync, a as canonicalPathFromExistingAncestor, b as resolveAbsolutePathForWrite, d as pathExists, f as pathExistsSync, g as readRegularFile, j as writeExternalFileWithinRoot, n as appendRegularFile, s as findExistingAncestor, t as FsSafeError, u as openLocalFileSafely, w as root, x as resolveLocalPathFromRootsSync, y as resolveAbsolutePathForRead } from "../fs-safe-CS1DrPTK.mjs";
import { _ as redactSensitiveText, et as compileSafeRegexDetailed } from "../redact-BEIE6NCT.mjs";
import { r as isPathInside } from "../path-guards-CH7noY0Z.mjs";
import { t as formatErrorMessage } from "../errors-BSdPMFao.mjs";
import { n as resolvePreferredOpenClawTmpDir } from "../tmp-openclaw-dir-BSb3HetY.mjs";
import { t as normalizeHostname } from "../hostname-KSsoqRD2.mjs";
import { i as hasProxyEnvConfigured } from "../proxy-env-DxV5eJIK.mjs";
import { _ as resolvePinnedHostnameWithPolicy, d as isPrivateNetworkAllowedByPolicy, p as matchesHostnameAllowlist, t as SsrFBlockedError } from "../ssrf-D5TD9F1s.mjs";
import { a as parseAccessGroupAllowFromEntry } from "../allow-from-lzM6Rg-R.mjs";
import { n as privateFileStoreSync } from "../private-file-store-DM0i141q.mjs";
import { a as wrapExternalContent, i as truncateSanitizedExternalContent, o as wrapWebContent } from "../external-content-CmQTCbqd.mjs";
import { t as safeEqualSecret } from "../secret-equal-DRsL8lKD.mjs";
import { n as filterSupplementalContextItems, r as shouldIncludeSupplementalContext, t as evaluateSupplementalContextVisibility } from "../context-visibility-C5CaKMWO.mjs";
import { i as resolvePinnedMainDmOwnerFromAllowlist } from "../dm-policy-shared-B8LDOuKc.mjs";
import { r as ensurePortAvailable } from "../ports-CWfLl4I4.mjs";
import { t as expandAllowFromWithAccessGroups } from "../access-groups-Dho8uZoB.mjs";
import { i as fileExists, n as assertNoSymlinkParentsSync, t as assertNoSymlinkParents } from "../file-access-runtime-ISL--r1N.mjs";
import { a as resolveStrictExistingPathsWithinRoot, c as buildUntrustedChannelMetadata, i as resolveExistingPathsWithinRoot, n as pathScope, o as sanitizeUntrustedFileName, r as replaceFileAtomic, s as buildChannelMetadata, t as movePathWithCopyFallback } from "../security-runtime-9ynw5sNI.mjs";
export { FsSafeError, SsrFBlockedError, appendRegularFile, assertNoSymlinkParents, assertNoSymlinkParentsSync, buildChannelMetadata, buildUntrustedChannelMetadata, canonicalPathFromExistingAncestor, compileSafeRegexDetailed, ensurePortAvailable, evaluateSupplementalContextVisibility, expandAllowFromWithAccessGroups, extractErrorCode, fileExists, filterSupplementalContextItems, findExistingAncestor, formatErrorMessage, hasProxyEnvConfigured, isPathInside, isPrivateNetworkAllowedByPolicy, matchesHostnameAllowlist, movePathWithCopyFallback, normalizeHostname, openLocalFileSafely, parseAccessGroupAllowFromEntry, pathExists, pathExistsSync, pathScope, privateFileStoreSync, readRegularFile, readRegularFileSync, redactSensitiveText, replaceFileAtomic, resolveAbsolutePathForRead, resolveAbsolutePathForWrite, resolveExistingPathsWithinRoot, resolveLocalPathFromRootsSync, resolvePinnedHostnameWithPolicy, resolvePinnedMainDmOwnerFromAllowlist, resolvePreferredOpenClawTmpDir, resolveStrictExistingPathsWithinRoot, root, safeEqualSecret, sanitizeUntrustedFileName, shouldIncludeSupplementalContext, statRegularFile, statRegularFileSync, truncateSanitizedExternalContent, withTimeout, wrapExternalContent, wrapWebContent, writeExternalFileWithinRoot };