@lousy-agents/agent-shell 5.14.8 → 5.14.10

package/dist/index.js

@@ -2,7 +2,7 @@
 import { createRequire as __rspack_createRequire } from "node:module";
 const __rspack_createRequire_require = __rspack_createRequire(import.meta.url);
 var __webpack_modules__ = ({
-391(__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
+145(__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
 
 ;// CONCATENATED MODULE: external "node:child_process"
 const external_node_child_process_namespaceObject = __rspack_createRequire_require("node:child_process");
@@ -275,6 +275,9 @@ function path_isPathInside(root, target) {
     const firstSegment = relative.split(external_node_path_namespaceObject.posix.sep)[0];
     return relative === "" || (firstSegment !== ".." && !external_node_path_namespaceObject.isAbsolute(relative));
 }
+function isPathRelativeEscape(relativePath) {
+    return relativePath === ".." || relativePath.startsWith(`..${external_node_path_namespaceObject.sep}`) || external_node_path_namespaceObject.isAbsolute(relativePath);
+}
 function resolveSafeBaseDir(rootDir) {
     const resolved = path.resolve(rootDir);
     return resolved.endsWith(path.sep) ? resolved : `${resolved}${path.sep}`;
@@ -340,7 +343,7 @@ function splitSafeRelativePath(relativePath) {
 function resolveSafeRelativePath(rootDir, relativePath) {
     const root = path.resolve(rootDir);
     const target = path.resolve(root, ...splitSafeRelativePath(relativePath));
-    if (target !== root && !target.startsWith(root + path.sep)) {
+    if (!path_isPathInside(root, target)) {
         throw new FsSafeError("outside-workspace", "relative path escapes root");
     }
     return target;
@@ -423,17 +426,17 @@ function directory_guard_createNearestExistingSyncDirectoryGuard(rootReal, targe
 
 
 
+
 function isSameOrChildPath(candidate, parent) {
-    return candidate === parent || candidate.startsWith(`${parent}${external_node_path_namespaceObject.sep}`);
-}
-function isPathEscape(relativePath) {
-    return relativePath === ".." || relativePath.startsWith(`..${external_node_path_namespaceObject.sep}`) || external_node_path_namespaceObject.isAbsolute(relativePath);
+    const parentPrefix = parent.endsWith(external_node_path_namespaceObject.sep) ? parent : `${parent}${external_node_path_namespaceObject.sep}`;
+    return candidate === parent || candidate.startsWith(parentPrefix);
 }
 async function mkdirPathComponentsWithGuards(params) {
     const root = external_node_path_namespaceObject.resolve(params.rootReal);
+    const rootCanonical = external_node_path_namespaceObject.resolve(await promises_namespaceObject.realpath(root));
     const target = external_node_path_namespaceObject.resolve(params.targetPath);
     const relative = external_node_path_namespaceObject.relative(root, target);
-    if (isPathEscape(relative)) {
+    if (isPathRelativeEscape(relative)) {
         throw new errors_FsSafeError("outside-workspace", "directory is outside workspace root");
     }
     let current = root;
@@ -456,7 +459,7 @@ async function mkdirPathComponentsWithGuards(params) {
         }
         // Node's recursive mkdir follows symlinks in missing components. Build one
         // segment at a time and realpath-check each segment before descending.
-        if (!isSameOrChildPath(external_node_path_namespaceObject.resolve(await promises_namespaceObject.realpath(next)), root)) {
+        if (!isSameOrChildPath(external_node_path_namespaceObject.resolve(await promises_namespaceObject.realpath(next)), rootCanonical)) {
             throw new errors_FsSafeError("outside-workspace", "directory escaped workspace root");
         }
         await directory_guard_createAsyncDirectoryGuard(next);
@@ -589,26 +592,20 @@ function canFallbackFromPythonError(error) {
 
 
 const PINNED_PYTHON_WORKER_SOURCE = String.raw `
-import base64
-import errno
-import json
-import os
-import secrets
-import stat
-import sys
-
+import base64, errno, json, os, secrets, stat, sys
 DIR_FLAGS = os.O_RDONLY
 if hasattr(os, "O_DIRECTORY"):
     DIR_FLAGS |= os.O_DIRECTORY
 if hasattr(os, "O_NOFOLLOW"):
     DIR_FLAGS |= os.O_NOFOLLOW
 READ_FLAGS = os.O_RDONLY
+if hasattr(os, "O_NONBLOCK"):
+    READ_FLAGS |= os.O_NONBLOCK
 if hasattr(os, "O_NOFOLLOW"):
     READ_FLAGS |= os.O_NOFOLLOW
 WRITE_FLAGS = os.O_WRONLY | os.O_CREAT | os.O_EXCL
 if hasattr(os, "O_NOFOLLOW"):
     WRITE_FLAGS |= os.O_NOFOLLOW
-
 def split_relative(value):
     if value in ("", "."):
         return []
@@ -621,10 +618,8 @@ def split_relative(value):
         if part == "..":
             raise OSError(errno.EPERM, "path traversal is not allowed")
     return parts
-
 def open_dir(path_value, dir_fd=None):
     return os.open(path_value, DIR_FLAGS, dir_fd=dir_fd)
-
 def walk_dir(root_fd, segments, mkdir_enabled=False):
     current_fd = os.dup(root_fd)
     try:
@@ -642,14 +637,12 @@ def walk_dir(root_fd, segments, mkdir_enabled=False):
     except Exception:
         os.close(current_fd)
         raise
-
 def parent_and_basename(root_fd, relative):
     segments = split_relative(relative)
     if not segments:
         raise OSError(errno.EPERM, "operation requires a non-root path")
     parent_fd = walk_dir(root_fd, segments[:-1])
     return parent_fd, segments[-1]
-
 def encode_stat(st):
     mode = st.st_mode
     return {
@@ -665,14 +658,108 @@ def encode_stat(st):
         "size": st.st_size,
         "uid": st.st_uid,
     }
-
 def reject_unsafe_endpoint(st):
     mode = st.st_mode
     if stat.S_ISLNK(mode):
         raise OSError(errno.ELOOP, "symlink endpoint is not allowed")
     if stat.S_ISREG(mode) and st.st_nlink > 1:
         raise OSError(errno.EPERM, "hardlinked file endpoint is not allowed")
-
+def copy_bytes(source_fd, dest_fd):
+    while True:
+        chunk = os.read(source_fd, 65536)
+        if not chunk:
+            break
+        view = memoryview(chunk)
+        while view:
+            written = os.write(dest_fd, view)
+            if written <= 0:
+                raise OSError(errno.EIO, "short write")
+            view = view[written:]
+def write_all(fd, data):
+    view = memoryview(data)
+    while view:
+        written = os.write(fd, view)
+        if written <= 0:
+            raise OSError(errno.EIO, "short write")
+        view = view[written:]
+def link_unsupported(exc):
+    unsupported = (errno.EPERM, errno.EOPNOTSUPP, getattr(errno, "ENOTSUP", errno.EOPNOTSUPP))
+    return getattr(exc, "errno", None) in unsupported
+def link_no_replace(name, new_name, source_fd, target_fd):
+    linked = False
+    try:
+        os.link(name, new_name, src_dir_fd=source_fd, dst_dir_fd=target_fd, follow_symlinks=False)
+        linked = True
+        os.unlink(name, dir_fd=source_fd)
+    except Exception:
+        if linked:
+            try: os.unlink(new_name, dir_fd=target_fd)
+            except FileNotFoundError: pass
+        raise
+    os.fsync(source_fd)
+    if source_fd != target_fd:
+        os.fsync(target_fd)
+def copy_file_no_replace(source_parent_fd, source_name, target_parent_fd, basename, mode, expected=None, unlink_source=False):
+    source_fd = os.open(source_name, READ_FLAGS, dir_fd=source_parent_fd)
+    dest_fd = None; success = False; dest_stat = None
+    try:
+        if expected is not None:
+            source_stat = os.fstat(source_fd)
+            if source_stat.st_dev != expected.st_dev or source_stat.st_ino != expected.st_ino:
+                raise RuntimeError("fs-safe-source-mismatch")
+        dest_fd = os.open(basename, WRITE_FLAGS, mode, dir_fd=target_parent_fd)
+        copy_bytes(source_fd, dest_fd)
+        os.fsync(dest_fd)
+        dest_stat = os.fstat(dest_fd)
+        success = True
+    finally:
+        os.close(source_fd)
+        if dest_fd is not None:
+            os.close(dest_fd)
+        if dest_fd is not None and not success:
+            try: os.unlink(basename, dir_fd=target_parent_fd)
+            except FileNotFoundError: pass
+    if unlink_source:
+        try:
+            os.unlink(source_name, dir_fd=source_parent_fd)
+        except Exception:
+            try: os.unlink(basename, dir_fd=target_parent_fd)
+            except FileNotFoundError: pass
+            raise
+    return dest_stat
+def same_identity(left, right):
+    return left.st_dev == right.st_dev and left.st_ino == right.st_ino
+def verify_temp_name(parent_fd, temp_name, expected_stat):
+    current_stat = os.lstat(temp_name, dir_fd=parent_fd)
+    if stat.S_ISLNK(current_stat.st_mode) or not same_identity(current_stat, expected_stat):
+        raise RuntimeError("fs-safe-temp-mismatch")
+def verify_committed_temp(parent_fd, basename, expected_stat):
+    final_stat = os.lstat(basename, dir_fd=parent_fd)
+    if not stat.S_ISLNK(final_stat.st_mode) and same_identity(final_stat, expected_stat):
+        return final_stat
+    try: os.unlink(basename, dir_fd=parent_fd)
+    except FileNotFoundError: pass
+    raise RuntimeError("fs-safe-temp-mismatch")
+def commit_temp_file(parent_fd, temp_name, basename, overwrite, mode, expected_stat):
+    verify_temp_name(parent_fd, temp_name, expected_stat)
+    if overwrite:
+        os.replace(temp_name, basename, src_dir_fd=parent_fd, dst_dir_fd=parent_fd)
+        return verify_committed_temp(parent_fd, basename, expected_stat)
+    else:
+        try:
+            os.link(temp_name, basename, src_dir_fd=parent_fd, dst_dir_fd=parent_fd, follow_symlinks=False)
+            final_stat = verify_committed_temp(parent_fd, basename, expected_stat)
+            os.unlink(temp_name, dir_fd=parent_fd)
+            return final_stat
+        except OSError as exc:
+            if not link_unsupported(exc):
+                raise
+            return copy_file_no_replace(parent_fd, temp_name, parent_fd, basename, mode, expected_stat, True)
+def assert_expected_root(root_fd, payload):
+    if "rootDev" in payload or "rootIno" in payload:
+        root_stat = os.fstat(root_fd)
+        if root_stat.st_dev != int(payload["rootDev"]) or root_stat.st_ino != int(payload["rootIno"]):
+            raise RuntimeError("fs-safe-root-mismatch")
 def stat_path(root_fd, payload):
     relative = payload.get("relativePath", "")
     segments = split_relative(relative)
@@ -686,7 +773,6 @@ def stat_path(root_fd, payload):
         return encode_stat(st)
     finally:
         os.close(parent_fd)
-
 def readdir_path(root_fd, payload):
     dir_fd = walk_dir(root_fd, split_relative(payload.get("relativePath", "")))
     try:
@@ -702,12 +788,9 @@ def readdir_path(root_fd, payload):
         return entries
     finally:
         os.close(dir_fd)
-
 def mkdirp_path(root_fd, payload):
     dir_fd = walk_dir(root_fd, split_relative(payload.get("relativePath", "")), mkdir_enabled=True)
-    os.close(dir_fd)
-    return None
-
+    os.close(dir_fd); return None
 def remove_tree(parent_fd, basename):
     st = os.lstat(basename, dir_fd=parent_fd)
     if stat.S_ISDIR(st.st_mode) and not stat.S_ISLNK(st.st_mode):
@@ -720,7 +803,6 @@ def remove_tree(parent_fd, basename):
         os.rmdir(basename, dir_fd=parent_fd)
     else:
         os.unlink(basename, dir_fd=parent_fd)
-
 def remove_path(root_fd, payload):
     parent_fd, basename = parent_and_basename(root_fd, payload.get("relativePath", ""))
     try:
@@ -747,7 +829,18 @@ def rename_path(root_fd, payload):
     try:
         from_stat = os.lstat(from_base, dir_fd=from_parent_fd)
         reject_unsafe_endpoint(from_stat)
-        if not payload.get("overwrite", True):
+        overwrite = payload.get("overwrite", True)
+        if not overwrite and stat.S_ISREG(from_stat.st_mode):
+            try:
+                link_no_replace(from_base, to_base, from_parent_fd, to_parent_fd)
+            except OSError as exc:
+                if not link_unsupported(exc):
+                    raise
+                copy_file_no_replace(from_parent_fd, from_base, to_parent_fd, to_base, stat.S_IMODE(from_stat.st_mode), from_stat, True)
+            return None
+        if not overwrite and stat.S_ISDIR(from_stat.st_mode):
+            raise RuntimeError("fs-safe-directory-noreplace-unsupported")
+        if not overwrite:
             try:
                 os.lstat(to_base, dir_fd=to_parent_fd)
                 raise FileExistsError(errno.EEXIST, "destination exists", to_base)
@@ -792,19 +885,15 @@ def write_path(root_fd, payload):
             except FileNotFoundError:
                 pass
         temp_name, temp_fd = create_temp_file(parent_fd, basename, mode)
-        view = memoryview(data)
-        while view:
-            written = os.write(temp_fd, view)
-            if written <= 0:
-                raise OSError(errno.EIO, "short write")
-            view = view[written:]
+        os.fchmod(temp_fd, mode)
+        write_all(temp_fd, data)
         os.fsync(temp_fd)
+        temp_stat = os.fstat(temp_fd)
         os.close(temp_fd)
         temp_fd = None
-        os.replace(temp_name, basename, src_dir_fd=parent_fd, dst_dir_fd=parent_fd)
+        result_stat = commit_temp_file(parent_fd, temp_name, basename, overwrite, mode, temp_stat)
         temp_name = None
         os.fsync(parent_fd)
-        result_stat = os.stat(basename, dir_fd=parent_fd, follow_symlinks=False)
         return {"dev": result_stat.st_dev, "ino": result_stat.st_ino}
     finally:
         if temp_fd is not None:
@@ -834,13 +923,8 @@ def copy_path(root_fd, payload):
         if max_bytes >= 0 and source_stat.st_size > max_bytes:
             raise RuntimeError("fs-safe-too-large:%d:%d" % (max_bytes, source_stat.st_size))
         parent_fd = walk_dir(root_fd, split_relative(payload.get("relativeParentPath", "")), bool(payload.get("mkdir", True)))
-        if not overwrite:
-            try:
-                os.lstat(basename, dir_fd=parent_fd)
-                raise FileExistsError(errno.EEXIST, "destination exists", basename)
-            except FileNotFoundError:
-                pass
         temp_name, temp_fd = create_temp_file(parent_fd, basename, mode)
+        os.fchmod(temp_fd, mode)
         written_bytes = 0
         while True:
             chunk = os.read(source_fd, 65536)
@@ -856,12 +940,12 @@ def copy_path(root_fd, payload):
                     raise OSError(errno.EIO, "short write")
                 view = view[written:]
         os.fsync(temp_fd)
+        temp_stat = os.fstat(temp_fd)
         os.close(temp_fd)
         temp_fd = None
-        os.replace(temp_name, basename, src_dir_fd=parent_fd, dst_dir_fd=parent_fd)
+        result_stat = commit_temp_file(parent_fd, temp_name, basename, overwrite, mode, temp_stat)
         temp_name = None
         os.fsync(parent_fd)
-        result_stat = os.stat(basename, dir_fd=parent_fd, follow_symlinks=False)
         return {"dev": result_stat.st_dev, "ino": result_stat.st_ino}
     finally:
         os.close(source_fd)
@@ -878,6 +962,7 @@ def copy_path(root_fd, payload):
 def run_operation(operation, root_path, payload):
     root_fd = open_dir(root_path)
     try:
+        assert_expected_root(root_fd, payload)
         if operation == "stat":
             return stat_path(root_fd, payload)
         if operation == "readdir":
@@ -982,6 +1067,15 @@ function mapWorkerError(response) {
     if (message.includes("fs-safe-source-mismatch")) {
         return new errors_FsSafeError("path-mismatch", "source path changed during copy");
     }
+    if (message.includes("fs-safe-temp-mismatch")) {
+        return new errors_FsSafeError("path-mismatch", "temp path changed during write");
+    }
+    if (message.includes("fs-safe-root-mismatch")) {
+        return new errors_FsSafeError("path-mismatch", "root path changed during operation");
+    }
+    if (message.includes("fs-safe-directory-noreplace-unsupported")) {
+        return new errors_FsSafeError("invalid-path", "directory moves require overwrite: true");
+    }
     if (code === "FileNotFoundError" || errno === 2) {
         return new errors_FsSafeError("not-found", "file not found");
     }
@@ -999,19 +1093,19 @@ function mapWorkerError(response) {
     }
     return new errors_FsSafeError("helper-failed", message);
 }
-function rejectPending(error) {
-    if (!worker) {
+function rejectPending(error, targetWorker = worker) {
+    if (!targetWorker || worker !== targetWorker) {
         return;
     }
-    setWorkerRef(worker, false);
-    for (const pending of worker.pending.values()) {
+    setWorkerRef(targetWorker, false);
+    for (const pending of targetWorker.pending.values()) {
         pending.reject(error);
     }
-    worker.pending.clear();
+    targetWorker.pending.clear();
     worker = null;
 }
-function handleWorkerLine(line) {
-    if (!worker || !line.trim()) {
+function handleWorkerLine(currentWorker, line) {
+    if (worker !== currentWorker || !line.trim()) {
         return;
     }
     let decoded;
@@ -1019,11 +1113,11 @@ function handleWorkerLine(line) {
         decoded = JSON.parse(line);
     }
     catch {
-        rejectPending(new errors_FsSafeError("helper-failed", `pinned helper returned invalid JSON: ${line}`));
+        rejectPending(new errors_FsSafeError("helper-failed", `pinned helper returned invalid JSON: ${line}`), currentWorker);
         return;
     }
     if (typeof decoded !== "object" || decoded === null || !("id" in decoded)) {
-        rejectPending(new errors_FsSafeError("helper-failed", "pinned helper returned invalid response"));
+        rejectPending(new errors_FsSafeError("helper-failed", "pinned helper returned invalid response"), currentWorker);
         return;
     }
     const response = decoded;
@@ -1031,13 +1125,13 @@ function handleWorkerLine(line) {
     if (id === undefined) {
         return;
     }
-    const pending = worker.pending.get(id);
+    const pending = currentWorker.pending.get(id);
     if (!pending) {
         return;
     }
-    worker.pending.delete(id);
-    if (worker.pending.size === 0) {
-        setWorkerRef(worker, false);
+    currentWorker.pending.delete(id);
+    if (currentWorker.pending.size === 0) {
+        setWorkerRef(currentWorker, false);
     }
     if (response.ok === true) {
         pending.resolve(response.result);
@@ -1053,28 +1147,28 @@ function getWorker() {
     const child = (0,external_node_child_process_namespaceObject.spawn)(resolvePython(), ["-u", "-c", PINNED_PYTHON_WORKER_SOURCE], {
         stdio: ["pipe", "pipe", "pipe"],
     });
-    worker = { child, pending: new Map(), stderr: "", stdoutBuffer: "" };
+    const currentWorker = { child, pending: new Map(), stderr: "", stdoutBuffer: "" };
+    worker = currentWorker;
     child.stdout.setEncoding("utf8");
     child.stderr.setEncoding("utf8");
     child.stdout.on("data", (chunk) => {
-        const current = worker;
-        if (!current) {
+        if (worker !== currentWorker) {
             return;
         }
-        current.stdoutBuffer += chunk;
+        currentWorker.stdoutBuffer += chunk;
         for (;;) {
-            const newline = current.stdoutBuffer.indexOf("\n");
+            const newline = currentWorker.stdoutBuffer.indexOf("\n");
             if (newline < 0) {
                 break;
             }
-            const line = current.stdoutBuffer.slice(0, newline);
-            current.stdoutBuffer = current.stdoutBuffer.slice(newline + 1);
-            handleWorkerLine(line);
+            const line = currentWorker.stdoutBuffer.slice(0, newline);
+            currentWorker.stdoutBuffer = currentWorker.stdoutBuffer.slice(newline + 1);
+            handleWorkerLine(currentWorker, line);
         }
     });
     child.stderr.on("data", (chunk) => {
-        if (worker) {
-            worker.stderr = `${worker.stderr}${chunk}`.slice(-4096);
+        if (worker === currentWorker) {
+            currentWorker.stderr = `${currentWorker.stderr}${chunk}`.slice(-4096);
         }
     });
     child.once("error", (error) => {
@@ -1083,17 +1177,17 @@ function getWorker() {
             : error instanceof Error
                 ? error
                 : new Error(String(error));
-        rejectPending(mapped);
+        rejectPending(mapped, currentWorker);
     });
     child.once("close", (code, signal) => {
-        const stderr = worker?.stderr.trim();
-        rejectPending(new errors_FsSafeError("helper-failed", stderr || `pinned helper exited with code ${code ?? "null"} (${signal ?? "?"})`));
+        const stderr = currentWorker.stderr.trim();
+        rejectPending(new errors_FsSafeError("helper-failed", stderr || `pinned helper exited with code ${code ?? "null"} (${signal ?? "?"})`), currentWorker);
     });
     process.once("exit", () => {
         child.kill("SIGTERM");
     });
-    setWorkerRef(worker, false);
-    return worker;
+    setWorkerRef(currentWorker, false);
+    return currentWorker;
 }
 function setRefable(value, ref) {
     if (!value) {
@@ -1159,9 +1253,7 @@ function validatePinnedOperationPayload(payload) {
     }
 }
 function isPinnedHelperUnavailable(error) {
-    return error instanceof Error &&
-        "code" in error &&
-        error.code === "helper-unavailable";
+    return error instanceof Error && "code" in error && error.code === "helper-unavailable";
 }
 function validatePinnedRelativePath(relativePath) {
     if (relativePath.length === 0 || relativePath === ".") {
@@ -1259,29 +1351,21 @@ function assertWithinMaxBytes(bytes, maxBytes) {
         throw new errors_FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`);
     }
 }
-function pinned_write_createMaxBytesTransform(maxBytes) {
-    if (maxBytes === undefined) {
-        return undefined;
-    }
+async function writeStreamToHandle(stream, handle, maxBytes) {
     let bytes = 0;
-    return new external_node_stream_namespaceObject.Transform({
-        transform(chunk, _encoding, callback) {
-            bytes += chunk.byteLength;
-            if (bytes > maxBytes) {
-                callback(new errors_FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`));
-                return;
+    for await (const chunk of stream) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += buffer.byteLength;
+        assertWithinMaxBytes(bytes, maxBytes);
+        let offset = 0;
+        while (offset < buffer.byteLength) {
+            const { bytesWritten } = await handle.write(buffer, offset, buffer.byteLength - offset);
+            if (bytesWritten <= 0) {
+                throw new errors_FsSafeError("helper-failed", "fallback stream write made no progress");
             }
-            callback(null, chunk);
-        },
-    });
-}
-async function pipelineWithMaxBytes(stream, destination, maxBytes) {
-    const limiter = pinned_write_createMaxBytesTransform(maxBytes);
-    if (limiter) {
-        await (0,external_node_stream_promises_namespaceObject.pipeline)(stream, limiter, destination);
-        return;
+            offset += bytesWritten;
+        }
     }
-    await (0,external_node_stream_promises_namespaceObject.pipeline)(stream, destination);
 }
 async function inputToBase64(input, maxBytes) {
     if (input.kind === "buffer") {
@@ -1306,7 +1390,7 @@ async function runPinnedWriteHelper(params) {
         relativeParentPath: params.relativeParentPath,
     });
     if (getFsSafePythonConfig().mode === "off") {
-        return await runPinnedWriteFallback(params);
+        return await runPinnedWriteFallbackOrThrow(params);
     }
     if (params.input.kind === "stream") {
         try {
@@ -1314,7 +1398,7 @@ async function runPinnedWriteHelper(params) {
         }
         catch (error) {
             if (canFallbackFromPythonError(error)) {
-                return await runPinnedWriteFallback(params);
+                return await runPinnedWriteFallbackOrThrow(params, error);
             }
             throw error;
         }
@@ -1327,6 +1411,7 @@ async function runPinnedWriteHelper(params) {
         mode: params.mode || 0o600,
         overwrite: params.overwrite !== false,
         relativeParentPath: params.relativeParentPath,
+        ...(params.rootIdentity ? { rootDev: params.rootIdentity.dev, rootIno: params.rootIdentity.ino } : {}),
     };
     try {
         return await runPinnedPythonOperation({
@@ -1337,7 +1422,7 @@ async function runPinnedWriteHelper(params) {
     }
     catch (error) {
         if (canFallbackFromPythonError(error)) {
-            return await runPinnedWriteFallback(params);
+            return await runPinnedWriteFallbackOrThrow(params, error);
         }
         throw error;
     }
@@ -1357,22 +1442,29 @@ async function runPinnedCopyHelper(params) {
             mode: params.mode || 0o600,
             overwrite: params.overwrite !== false,
             relativeParentPath: params.relativeParentPath,
+            ...(params.rootIdentity ? { rootDev: params.rootIdentity.dev, rootIno: params.rootIdentity.ino } : {}),
             sourceDev: params.sourceIdentity.dev,
             sourceIno: params.sourceIdentity.ino,
             sourcePath: params.sourcePath,
         },
     });
 }
+async function runPinnedWriteFallbackOrThrow(params, cause) {
+    if (process.platform !== "win32") {
+        throw new errors_FsSafeError("helper-unavailable", "Python helper is required for pinned writes on this platform", { cause });
+    }
+    return await runPinnedWriteFallback(params);
+}
 async function runPinnedWriteFallback(params) {
     const parentPath = params.relativeParentPath
         ? external_node_path_namespaceObject.join(params.rootPath, ...params.relativeParentPath.split("/"))
         : params.rootPath;
-    const parentGuard = await directory_guard_createNearestExistingDirectoryGuard(params.rootPath, parentPath);
     if (params.mkdir) {
-        await withAsyncDirectoryGuards([parentGuard], async () => {
-            await promises_namespaceObject.mkdir(parentPath, { recursive: true });
-        });
+        await mkdirPathComponentsWithGuards({ rootReal: params.rootPath, targetPath: parentPath });
     }
+    const parentGuard = params.mkdir
+        ? await directory_guard_createAsyncDirectoryGuard(parentPath)
+        : await directory_guard_createNearestExistingDirectoryGuard(params.rootPath, parentPath);
     const targetPath = external_node_path_namespaceObject.join(parentPath, params.basename);
     if (params.overwrite === false) {
         let handle = await withAsyncDirectoryGuards([parentGuard], async () => await promises_namespaceObject.open(targetPath, external_node_fs_namespaceObject.constants.O_WRONLY | external_node_fs_namespaceObject.constants.O_CREAT | external_node_fs_namespaceObject.constants.O_EXCL, params.mode), {
@@ -1394,7 +1486,7 @@ async function runPinnedWriteFallback(params) {
                 }
             }
             else {
-                await pipelineWithMaxBytes(params.input.stream, handle.createWriteStream(), params.maxBytes);
+                await writeStreamToHandle(params.input.stream, handle, params.maxBytes);
             }
             const stat = await handle.stat();
             created = false;
@@ -1415,7 +1507,9 @@ async function runPinnedWriteFallback(params) {
             ? external_node_fs_namespaceObject.constants.O_NOFOLLOW
             : 0);
     let handle;
-    let handleClosedByStream = false;
+    let tempStat;
+    let targetStat;
+    let renamed = false;
     try {
         handle = await promises_namespaceObject.open(tempPath, tempFlags, params.mode);
         if (params.input.kind === "buffer") {
@@ -1428,29 +1522,36 @@ async function runPinnedWriteFallback(params) {
             }
         }
         else {
-            const writable = handle.createWriteStream();
-            writable.once("close", () => {
-                handleClosedByStream = true;
-            });
-            await pipelineWithMaxBytes(params.input.stream, writable, params.maxBytes);
+            await writeStreamToHandle(params.input.stream, handle, params.maxBytes);
         }
-        if (!handleClosedByStream) {
-            await handle.close().catch(() => undefined);
-            handle = undefined;
+        tempStat = await handle.stat();
+        const tempPathStat = await promises_namespaceObject.lstat(tempPath);
+        if (tempPathStat.isSymbolicLink() || !file_identity_sameFileIdentity(tempPathStat, tempStat)) {
+            throw new errors_FsSafeError("path-mismatch", "fallback temp path changed during write");
         }
+        const expectedTempStat = tempStat;
+        await handle.close().catch(() => undefined);
+        handle = undefined;
         await withAsyncDirectoryGuards([parentGuard], async () => {
             await promises_namespaceObject.rename(tempPath, targetPath);
+            renamed = true;
+            targetStat = await promises_namespaceObject.lstat(targetPath);
+            if (targetStat.isSymbolicLink() || !file_identity_sameFileIdentity(targetStat, expectedTempStat)) {
+                throw new errors_FsSafeError("path-mismatch", "fallback target changed during write");
+            }
         });
     }
     catch (error) {
-        if (handle && !handleClosedByStream) {
-            await handle.close().catch(() => undefined);
+        await handle?.close().catch(() => undefined);
+        if (!renamed) {
+            await promises_namespaceObject.rm(tempPath, { force: true }).catch(() => undefined);
         }
-        await promises_namespaceObject.rm(tempPath, { force: true }).catch(() => undefined);
         throw error;
     }
-    const stat = await promises_namespaceObject.stat(targetPath);
-    return { dev: stat.dev, ino: stat.ino };
+    if (!targetStat) {
+        throw new errors_FsSafeError("path-mismatch", "fallback target was not verified");
+    }
+    return { dev: targetStat.dev, ino: targetStat.ino };
 }
 
 ;// CONCATENATED MODULE: external "node:os"
@@ -1989,7 +2090,7 @@ function relativeInsideRoot(rootPath, targetPath) {
     if (!relative || relative === ".") {
         return "";
     }
-    if (relative.startsWith("..") || external_node_path_namespaceObject.isAbsolute(relative)) {
+    if (isPathRelativeEscape(relative)) {
         return "";
     }
     return relative;
@@ -2340,6 +2441,15 @@ function __setFsSafeTestHooksForTest(hooks) {
     test_hooks_fsSafeTestHooks = hooks;
 }
 
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/json-stringify.js
+function stringifyJsonDocument(value, replacer, space) {
+    const text = JSON.stringify(value, replacer, space);
+    if (typeof text !== "string") {
+        throw new TypeError("value is not representable as a JSON document");
+    }
+    return text;
+}
+
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/temp-cleanup.js
 
 const tempCleanupEntries = new Map();
@@ -2427,6 +2537,7 @@ async function serializePathWrite(key, run) {
 
 
 
+
 
 
 function logWarn(message) {
@@ -2667,12 +2778,12 @@ class RootHandle {
     }
     async writeJson(relativePath, data, options = {}) {
         const { replacer, space, trailingNewline = true, ...writeOptions } = options;
-        const json = JSON.stringify(data, replacer, space);
+        const json = stringifyJsonDocument(data, replacer, space);
         await this.write(relativePath, trailingNewline ? `${json}\n` : json, writeOptions);
     }
     async createJson(relativePath, data, options = {}) {
         const { replacer, space, trailingNewline = true, ...writeOptions } = options;
-        const json = JSON.stringify(data, replacer, space);
+        const json = stringifyJsonDocument(data, replacer, space);
         await this.create(relativePath, trailingNewline ? `${json}\n` : json, writeOptions);
     }
     async copyIn(relativePath, sourcePath, options = {}) {
@@ -3457,6 +3568,9 @@ async function movePathFallback(root, params) {
     if (sourceStat.isFile() && sourceStat.nlink > 1) {
         throw new errors_FsSafeError("hardlink", "hardlinked path not allowed");
     }
+    if (!params.overwrite && sourceStat.isDirectory()) {
+        throw new errors_FsSafeError("invalid-path", "directory moves require overwrite: true");
+    }
     if (!params.overwrite) {
         try {
             await promises_namespaceObject.lstat(target.resolved);
@@ -14782,4 +14896,4 @@ if (installedChunkData !== 0) { // 0 means "already installed".'
 // module factories are used so entry inlining is disabled
 // startup
 // Load entry module and return exports
-var __webpack_exports__ = __webpack_require__(391);
+var __webpack_exports__ = __webpack_require__(145);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@lousy-agents/agent-shell",
-    "version": "5.14.8",
+    "version": "5.14.10",
     "description": "A flight recorder for npm script execution",
     "type": "module",
     "repository": {
@@ -36,7 +36,7 @@
         "build": "rspack build --config rspack.config.ts && chmod +x dist/index.js"
     },
     "dependencies": {
-        "@openclaw/fs-safe": "0.2.4",
+        "@openclaw/fs-safe": "0.2.6",
         "zod": "4.4.3"
     },
     "peerDependencies": {