@lousy-agents/agent-shell 5.19.1 → 5.19.3

package/dist/index.js

@@ -2,7 +2,7 @@
 import { createRequire as __rspack_createRequire } from "node:module";
 const __rspack_createRequire_require = __rspack_createRequire(import.meta.url);
 var __webpack_modules__ = ({
-418(__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
+983(__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
 
 ;// CONCATENATED MODULE: external "node:child_process"
 const external_node_child_process_namespaceObject = __rspack_createRequire_require("node:child_process");
@@ -81,6 +81,9 @@ function defaultExecutor(env) {
 const OPERATIONAL_CODES = new Set([
     "helper-failed",
     "helper-unavailable",
+    "not-empty",
+    "not-found",
+    "not-removable",
     "permission-unverified",
     "timeout",
     "unsupported-platform",
@@ -132,6 +135,7 @@ function file_identity_sameFileIdentity(left, right, platform = process.platform
 
 
 
+
 const NOT_FOUND_CODES = new Set(["ENOENT", "ENOTDIR"]);
 const SYMLINK_OPEN_CODES = new Set(["ELOOP", "EINVAL", "ENOTSUP"]);
 const POSIX_SEPARATOR_CHAR_CODE = 0x2f;
@@ -249,6 +253,9 @@ function splitSafeRelativePath(relativePath) {
         if (segment === "..") {
             throw new FsSafeError("invalid-path", "relative path must not contain '..'");
         }
+        if (isDriveRelativePath(segment)) {
+            throw new FsSafeError("invalid-path", "relative path must not contain a drive letter");
+        }
     }
     return segments;
 }
@@ -261,6 +268,74 @@ function resolveSafeRelativePath(rootDir, relativePath) {
     return target;
 }
 
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/root-errors.js
+
+
+const REMOVE_NOT_EMPTY_CODES = new Set(["ENOTEMPTY", "EEXIST"]);
+function fileNotFoundError(cause) {
+    return cause === undefined
+        ? new errors_FsSafeError("not-found", "file not found")
+        : new errors_FsSafeError("not-found", "file not found", { cause });
+}
+function outsideWorkspaceError() {
+    return new errors_FsSafeError("outside-workspace", "file is outside workspace root");
+}
+function root_errors_directoryComponentNotDirectoryError(cause) {
+    return cause === undefined
+        ? new errors_FsSafeError("not-file", "directory component must be a directory")
+        : new errors_FsSafeError("not-file", "directory component must be a directory", { cause });
+}
+function hardlinkedPathNotAllowedError() {
+    return new errors_FsSafeError("hardlink", "hardlinked path not allowed");
+}
+function isAlreadyExistsError(error) {
+    return hasNodeErrorCode(error, "EEXIST") || /File exists|EEXIST/i.test(String(error));
+}
+function normalizePinnedWriteError(error) {
+    if (error instanceof errors_FsSafeError) {
+        return error;
+    }
+    if (path_isNotFoundPathError(error)) {
+        return fileNotFoundError(error instanceof Error ? error : undefined);
+    }
+    return new errors_FsSafeError("invalid-path", "path is not a regular file under root", {
+        cause: error instanceof Error ? error : undefined,
+    });
+}
+function normalizePinnedPathError(error) {
+    if (error instanceof errors_FsSafeError) {
+        return error;
+    }
+    return new errors_FsSafeError("path-alias", "path is not under root", {
+        cause: error instanceof Error ? error : undefined,
+    });
+}
+function normalizeRemoveGuardError(error) {
+    if (error instanceof errors_FsSafeError) {
+        return error;
+    }
+    if (path_isNotFoundPathError(error)) {
+        return fileNotFoundError(error instanceof Error ? error : undefined);
+    }
+    return normalizePinnedPathError(error);
+}
+function normalizeRemovePathError(error) {
+    if (error instanceof errors_FsSafeError) {
+        return error;
+    }
+    if (!isNodeError(error) || typeof error.code !== "string") {
+        return normalizePinnedPathError(error);
+    }
+    const cause = error instanceof Error ? error : undefined;
+    if (path_isNotFoundPathError(error)) {
+        return fileNotFoundError(cause);
+    }
+    if (REMOVE_NOT_EMPTY_CODES.has(error.code)) {
+        return new errors_FsSafeError("not-empty", "directory is not empty", { cause });
+    }
+    return new errors_FsSafeError("not-removable", "path could not be removed", { cause });
+}
+
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/directory-guard.js
 
 
@@ -268,17 +343,18 @@ function resolveSafeRelativePath(rootDir, relativePath) {
 
 
 
+
 async function directory_guard_createAsyncDirectoryGuard(dir) {
     const stat = await promises_namespaceObject.lstat(dir);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
-        throw new errors_FsSafeError("not-file", "directory component must be a directory");
+        throw root_errors_directoryComponentNotDirectoryError();
     }
     return { dir, realPath: await promises_namespaceObject.realpath(dir), stat };
 }
 async function assertAsyncDirectoryGuard(guard) {
     const stat = await promises_namespaceObject.lstat(guard.dir);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
-        throw new errors_FsSafeError("not-file", "directory component must be a directory");
+        throw root_errors_directoryComponentNotDirectoryError();
     }
     if (!file_identity_sameFileIdentity(stat, guard.stat) || (await promises_namespaceObject.realpath(guard.dir)) !== guard.realPath) {
         throw new errors_FsSafeError("path-mismatch", "directory changed during operation");
@@ -287,14 +363,14 @@ async function assertAsyncDirectoryGuard(guard) {
 function directory_guard_createSyncDirectoryGuard(dir) {
     const stat = fsSync.lstatSync(dir);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
-        throw new FsSafeError("not-file", "directory component must be a directory");
+        throw directoryComponentNotDirectoryError();
     }
     return { dir, realPath: fsSync.realpathSync(dir), stat };
 }
 function directory_guard_assertSyncDirectoryGuard(guard) {
     const stat = fsSync.lstatSync(guard.dir);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
-        throw new FsSafeError("not-file", "directory component must be a directory");
+        throw directoryComponentNotDirectoryError();
     }
     if (!sameFileIdentity(stat, guard.stat) || fsSync.realpathSync(guard.dir) !== guard.realPath) {
         throw new FsSafeError("path-mismatch", "directory changed during operation");
@@ -640,6 +716,7 @@ async function ensureDurableDirectory(options) {
 
 
 
+
 function isSameOrChildPath(candidate, parent) {
     const parentPrefix = parent.endsWith(external_node_path_namespaceObject.sep) ? parent : `${parent}${external_node_path_namespaceObject.sep}`;
     return candidate === parent || candidate.startsWith(parentPrefix);
@@ -652,9 +729,7 @@ async function realpathOrThrowNotFile(target) {
         if (path_isNotFoundPathError(error)) {
             // A dangling symlink (or a component removed between lstat and
             // realpath) is not a usable directory component.
-            throw new errors_FsSafeError("not-file", "directory component must be a directory", {
-                cause: error instanceof Error ? error : undefined,
-            });
+            throw root_errors_directoryComponentNotDirectoryError(error instanceof Error ? error : undefined);
         }
         throw error;
     }
@@ -677,8 +752,8 @@ async function mkdirPathComponentsWithGuards(params) {
     for (const part of relative.split(external_node_path_namespaceObject.sep).filter(Boolean)) {
         const next = external_node_path_namespaceObject.join(current, part);
         const parentGuard = await directory_guard_createAsyncDirectoryGuard(current);
-        await params.beforeComponent?.(next);
         await assertAsyncDirectoryGuard(parentGuard);
+        await params.beforeComponent?.(next);
         try {
             await promises_namespaceObject.mkdir(next);
         }
@@ -689,7 +764,7 @@ async function mkdirPathComponentsWithGuards(params) {
         }
         const stat = await promises_namespaceObject.lstat(next);
         if (!stat.isSymbolicLink() && !stat.isDirectory()) {
-            throw new errors_FsSafeError("not-file", "directory component must be a directory");
+            throw root_errors_directoryComponentNotDirectoryError();
         }
         // Node's recursive mkdir follows symlinks in missing components. Build one
         // segment at a time and realpath-check each segment before descending.
@@ -709,7 +784,7 @@ async function mkdirPathComponentsWithGuards(params) {
             // the returned resolved path, not their own lexical parent path.
             const targetStat = await promises_namespaceObject.stat(nextReal);
             if (!targetStat.isDirectory()) {
-                throw new errors_FsSafeError("not-file", "directory component must be a directory");
+                throw root_errors_directoryComponentNotDirectoryError();
             }
             await directory_guard_createAsyncDirectoryGuard(nextReal);
             await assertAsyncDirectoryGuard(parentGuard);
@@ -801,30 +876,37 @@ function guardedRmSync(params) {
     }), { verifyAfter: params.verifyAfter });
 }
 
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/deny-mutations.js
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/root-path-existing.js
 
 
 
 
-async function pathExists(filePath) {
+function isFilesystemRoot(candidate) {
+    return external_node_path_namespaceObject.parse(candidate).root === candidate;
+}
+async function pathExists(targetPath) {
     try {
-        await promises_namespaceObject.lstat(filePath);
+        await promises_namespaceObject.lstat(targetPath);
         return true;
     }
-    catch (err) {
-        if (!path_isNotFoundPathError(err)) {
-            throw err;
+    catch (error) {
+        if (path_isNotFoundPathError(error)) {
+            return false;
         }
-        return false;
+        throw error;
     }
 }
 async function resolvePathViaExistingAncestor(targetPath) {
     const normalized = external_node_path_namespaceObject.resolve(targetPath);
     let cursor = normalized;
     const missingSuffix = [];
-    while (external_node_path_namespaceObject.dirname(cursor) !== cursor && !(await pathExists(cursor))) {
+    while (!isFilesystemRoot(cursor) && !(await pathExists(cursor))) {
         missingSuffix.unshift(external_node_path_namespaceObject.basename(cursor));
-        cursor = external_node_path_namespaceObject.dirname(cursor);
+        const parent = external_node_path_namespaceObject.dirname(cursor);
+        if (parent === cursor) {
+            break;
+        }
+        cursor = parent;
     }
     if (!(await pathExists(cursor))) {
         return normalized;
@@ -839,7 +921,38 @@ async function resolvePathViaExistingAncestor(targetPath) {
         return normalized;
     }
 }
-async function comparablePaths(rawPath) {
+function root_path_existing_resolvePathViaExistingAncestorSync(targetPath) {
+    const normalized = path.resolve(targetPath);
+    let cursor = normalized;
+    const missingSuffix = [];
+    while (!isFilesystemRoot(cursor) && !fs.existsSync(cursor)) {
+        missingSuffix.unshift(path.basename(cursor));
+        const parent = path.dirname(cursor);
+        if (parent === cursor) {
+            break;
+        }
+        cursor = parent;
+    }
+    if (!fs.existsSync(cursor)) {
+        return normalized;
+    }
+    try {
+        const resolvedAncestor = path.resolve(fs.realpathSync(cursor));
+        return missingSuffix.length === 0
+            ? resolvedAncestor
+            : path.resolve(resolvedAncestor, ...missingSuffix);
+    }
+    catch {
+        return normalized;
+    }
+}
+
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/deny-mutations.js
+
+
+
+
+async function resolveMutationComparablePaths(rawPath) {
     path_assertNoNulPathInput(rawPath, "path contains a NUL byte");
     const resolved = external_node_path_namespaceObject.resolve(rawPath);
     return new Set([resolved, await resolvePathViaExistingAncestor(resolved)]);
@@ -868,9 +981,9 @@ async function assertMutationNotDenied(filePath, policy, options = {}) {
     if (!hasPolicyEntries(policy)) {
         return;
     }
-    const targetPaths = await comparablePaths(filePath);
+    const targetPaths = await resolveMutationComparablePaths(filePath);
     for (const deniedPath of policyPathEntries(policy.paths)) {
-        const deniedPaths = await comparablePaths(deniedPath);
+        const deniedPaths = await resolveMutationComparablePaths(deniedPath);
         for (const target of targetPaths) {
             for (const denied of deniedPaths) {
                 if (isSamePath(denied, target) ||
@@ -881,7 +994,7 @@ async function assertMutationNotDenied(filePath, policy, options = {}) {
         }
     }
     for (const deniedPrefix of policyPathEntries(policy.prefixes)) {
-        const deniedPaths = await comparablePaths(deniedPrefix);
+        const deniedPaths = await resolveMutationComparablePaths(deniedPrefix);
         for (const target of targetPaths) {
             for (const denied of deniedPaths) {
                 if (path_isPathInside(denied, target) ||
@@ -1344,7 +1457,20 @@ async function createNativeExclusiveFile(targetPath, mode) {
     let fd;
     let created;
     try {
-        const opened = binding.openBeneath(parent.fd, basename, nativeOpenFlags(external_node_fs_namespaceObject.constants.O_WRONLY | external_node_fs_namespaceObject.constants.O_CREAT | external_node_fs_namespaceObject.constants.O_EXCL));
+        let opened;
+        try {
+            opened = binding.openBeneath(parent.fd, basename, nativeOpenFlags(external_node_fs_namespaceObject.constants.O_WRONLY | external_node_fs_namespaceObject.constants.O_CREAT | external_node_fs_namespaceObject.constants.O_EXCL));
+        }
+        catch (error) {
+            // The parent open above and every post-create operation remain untagged.
+            // Only this exclusive-open failure has enough provenance for a caller to
+            // classify a Windows lock-file denial without swallowing setup failures.
+            const openError = error;
+            if (process.platform === "win32" && openError.code === "EPERM") {
+                openError.path = targetPath;
+            }
+            throw error;
+        }
         fd = opened.fd;
         external_node_fs_namespaceObject.fchmodSync(fd, mode);
         created = external_node_fs_namespaceObject.fstatSync(fd);
@@ -1398,23 +1524,22 @@ function assertWithinMaxBytes(bytes, maxBytes) {
         throw new errors_FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`);
     }
 }
-async function inputToBuffer(input, maxBytes) {
+async function writeNativeInput(fd, input, maxBytes) {
     if (input.kind === "buffer") {
         const data = typeof input.data === "string"
             ? Buffer.from(input.data, input.encoding ?? "utf8")
             : Buffer.from(input.data);
         assertWithinMaxBytes(data.byteLength, maxBytes);
-        return data;
+        writeNativeFd(fd, data);
+        return;
     }
-    const chunks = [];
     let bytes = 0;
     for await (const chunk of input.stream) {
         const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
         bytes += buffer.byteLength;
         assertWithinMaxBytes(bytes, maxBytes);
-        chunks.push(buffer);
+        writeNativeFd(fd, buffer);
     }
-    return Buffer.concat(chunks, bytes);
 }
 function native_pinned_write_nativeOpenFlags(flags) {
     const closeOnExec = external_node_fs_namespaceObject.constants.O_CLOEXEC;
@@ -1426,7 +1551,6 @@ function sameNativeIdentity(left, right) {
     return left.dev === right.dev && left.ino === right.ino;
 }
 async function runPinnedWriteNative(binding, params) {
-    const data = await inputToBuffer(params.input, params.maxBytes);
     const root = await promises_namespaceObject.open(params.rootPath, external_node_fs_namespaceObject.constants.O_RDONLY |
         (typeof external_node_fs_namespaceObject.constants.O_DIRECTORY === "number" ? external_node_fs_namespaceObject.constants.O_DIRECTORY : 0));
     let parentFd;
@@ -1456,27 +1580,56 @@ async function runPinnedWriteNative(binding, params) {
             !sameNativeIdentity(parentPathStat, parentIdentity)) {
             throw new errors_FsSafeError("path-mismatch", "native write parent changed during resolution");
         }
-        try {
-            await promises_namespaceObject.lstat(external_node_path_namespaceObject.join(parentPath, params.basename));
-            throw Object.assign(new Error("destination already exists"), { code: "EEXIST" });
-        }
-        catch (error) {
-            if (error.code !== "ENOENT") {
-                throw error;
+        if (params.overwrite === false) {
+            try {
+                await promises_namespaceObject.lstat(external_node_path_namespaceObject.join(parentPath, params.basename));
+                throw Object.assign(new Error("destination already exists"), { code: "EEXIST" });
+            }
+            catch (error) {
+                if (error.code !== "ENOENT") {
+                    throw error;
+                }
             }
         }
         tempFd = binding.openBeneath(parentFd, tempName, native_pinned_write_nativeOpenFlags(external_node_fs_namespaceObject.constants.O_WRONLY | external_node_fs_namespaceObject.constants.O_CREAT | external_node_fs_namespaceObject.constants.O_EXCL)).fd;
-        external_node_fs_namespaceObject.fchmodSync(tempFd, params.mode || 0o600);
-        writeNativeFd(tempFd, data);
-        syncNativeFileBestEffort(tempFd);
         tempIdentity = external_node_fs_namespaceObject.fstatSync(tempFd);
-        binding.renameNoReplace(parentFd, tempName, parentFd, params.basename);
+        // Creation is requested at 0600 in the binding, but a restrictive umask
+        // can remove owner access. Keep the unpublished inode private and
+        // reopenable until the published name has been identity-fenced.
+        external_node_fs_namespaceObject.fchmodSync(tempFd, 0o600);
+        await writeNativeInput(tempFd, params.input, params.maxBytes);
+        syncNativeFileBestEffort(tempFd);
+        if (params.overwrite === false) {
+            binding.renameNoReplace(parentFd, tempName, parentFd, params.basename);
+        }
+        else {
+            binding.renameReplace(parentFd, tempName, parentFd, params.basename);
+        }
         renamed = true;
         targetFd = binding.openBeneath(parentFd, params.basename, native_pinned_write_nativeOpenFlags(external_node_fs_namespaceObject.constants.O_RDONLY)).fd;
         const targetIdentity = binding.fstatIdentity(targetFd);
         if (!targetIdentity.isFile || !sameNativeIdentity(tempIdentity, targetIdentity)) {
             throw new errors_FsSafeError("path-mismatch", "native write target changed after rename");
         }
+        // Native exclusive creation starts at 0600. Apply the requested mode only
+        // after reopening and fencing the published name, both so mode 000 stays
+        // verifiable and so broader modes are never exposed before that fence.
+        try {
+            external_node_fs_namespaceObject.fchmodSync(targetFd, params.mode);
+            syncNativeFileBestEffort(targetFd);
+        }
+        catch (error) {
+            external_node_fs_namespaceObject.closeSync(targetFd);
+            targetFd = undefined;
+            removeNativeCreatedFileIfStillPinned({
+                binding,
+                parentPath,
+                parentFd,
+                basename: params.basename,
+                created: tempIdentity,
+            });
+            throw error;
+        }
         syncNativeFileBestEffort(parentFd);
         return { dev: targetIdentity.dev, ino: targetIdentity.ino };
     }
@@ -1613,7 +1766,7 @@ async function readFileDescriptorBounded(fd, maxBytes) {
     });
 }
 /** Sync bounded read from a numeric descriptor. The caller owns the descriptor. */
-function readFileDescriptorBoundedSync(fd, maxBytes) {
+function bounded_read_readFileDescriptorBoundedSync(fd, maxBytes) {
     assertMaxBytes(maxBytes);
     const chunks = [];
     const scratch = createScratchBuffer(maxBytes);
@@ -1628,6 +1781,21 @@ function readFileDescriptorBoundedSync(fd, maxBytes) {
     }
 }
 
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/test-hooks.js
+let test_hooks_fsSafeTestHooks;
+function allowFsSafeTestHooks() {
+    return  false || process.env.VITEST === "true";
+}
+function getFsSafeTestHooks() {
+    return test_hooks_fsSafeTestHooks;
+}
+function __setFsSafeTestHooksForTest(hooks) {
+    if (hooks && !allowFsSafeTestHooks()) {
+        throw new Error("__setFsSafeTestHooksForTest is only available in tests");
+    }
+    test_hooks_fsSafeTestHooks = hooks;
+}
+
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.js
 
 
@@ -1636,6 +1804,7 @@ function readFileDescriptorBoundedSync(fd, maxBytes) {
 
 
 
+
 const MAX_LOCK_PAYLOAD_BYTES = 1024 * 1024;
 const SIDECAR_LOCK_OWNERSHIP_TOKEN_BYTES = 16;
 const SIDECAR_LOCK_OWNERSHIP_TOKEN_BITS = SIDECAR_LOCK_OWNERSHIP_TOKEN_BYTES * 8;
@@ -1686,6 +1855,7 @@ function parseSidecarLockPayload(raw, parser) {
     }
 }
 async function readSidecarLockSnapshot(lockPath, options = {}) {
+    let handle;
     try {
         if (options.lockRoot) {
             const opened = await options.lockRoot.open(relativeSidecarLockPath(options.lockRoot, lockPath));
@@ -1701,9 +1871,44 @@ async function readSidecarLockSnapshot(lockPath, options = {}) {
                 await opened.handle.close().catch(() => undefined);
             }
         }
-        const stat = await promises_namespaceObject.lstat(lockPath);
-        const raw = await promises_namespaceObject.readFile(lockPath, "utf8");
-        return { raw, payload: parseSidecarLockPayload(raw, options.parsePayload), stat };
+        const before = await promises_namespaceObject.lstat(lockPath);
+        if (!before.isFile() || before.isSymbolicLink()) {
+            if (options.rejectNonFile) {
+                throw new errors_FsSafeError("not-file", `sidecar lock is not a regular file: ${lockPath}`);
+            }
+            return null;
+        }
+        await getFsSafeTestHooks()?.beforeSidecarLockSnapshotOpen?.(lockPath);
+        const noFollow = process.platform !== "win32" && typeof external_node_fs_namespaceObject.constants.O_NOFOLLOW === "number"
+            ? external_node_fs_namespaceObject.constants.O_NOFOLLOW
+            : 0;
+        try {
+            handle = await promises_namespaceObject.open(lockPath, external_node_fs_namespaceObject.constants.O_RDONLY |
+                noFollow |
+                (typeof external_node_fs_namespaceObject.constants.O_NONBLOCK === "number" ? external_node_fs_namespaceObject.constants.O_NONBLOCK : 0));
+        }
+        catch (error) {
+            if (options.rejectNonFile && error.code === "ELOOP") {
+                throw new errors_FsSafeError("not-file", `sidecar lock is not a regular file: ${lockPath}`, {
+                    cause: error,
+                });
+            }
+            throw error;
+        }
+        const opened = await handle.stat();
+        if (!opened.isFile()) {
+            if (options.rejectNonFile) {
+                throw new errors_FsSafeError("not-file", `sidecar lock is not a regular file: ${lockPath}`);
+            }
+            return null;
+        }
+        if (!options.allowDescriptorIdentityDrift && !file_identity_sameFileIdentity(before, opened))
+            return null;
+        const raw = (await readFileHandleBounded(handle, MAX_LOCK_PAYLOAD_BYTES)).toString("utf8");
+        const after = await promises_namespaceObject.lstat(lockPath);
+        if (!after.isFile() || !file_identity_sameFileIdentity(before, after))
+            return null;
+        return { raw, payload: parseSidecarLockPayload(raw, options.parsePayload), stat: after };
     }
     catch (err) {
         if (err.code === "ENOENT" ||
@@ -1712,19 +1917,26 @@ async function readSidecarLockSnapshot(lockPath, options = {}) {
         }
         throw err;
     }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
 }
-function readSidecarLockSnapshotSync(lockPath, parsePayload) {
+function readSidecarLockSnapshotSync(lockPath, parsePayload, options = {}) {
     let fd;
     try {
         const before = fsSync.lstatSync(lockPath);
-        if (!before.isFile() || before.isSymbolicLink())
+        if (!before.isFile() || before.isSymbolicLink()) {
+            if (options.rejectNonFile) {
+                throw new FsSafeError("not-file", `sidecar lock is not a regular file: ${lockPath}`);
+            }
             return null;
+        }
         const noFollow = process.platform !== "win32" && typeof fsSync.constants.O_NOFOLLOW === "number"
             ? fsSync.constants.O_NOFOLLOW
             : 0;
         fd = fsSync.openSync(lockPath, fsSync.constants.O_RDONLY | noFollow);
         const opened = fsSync.fstatSync(fd);
-        const raw = fsSync.readFileSync(fd, "utf8");
+        const raw = readFileDescriptorBoundedSync(fd, MAX_LOCK_PAYLOAD_BYTES).toString("utf8");
         const after = fsSync.lstatSync(lockPath);
         if (!sameFileIdentity(before, opened) || !sameFileIdentity(opened, after))
             return null;
@@ -1770,7 +1982,10 @@ function sidecarLockSnapshotMatches(current, observed) {
     return observed.stat !== undefined && current.stat !== undefined;
 }
 async function removeSidecarLockIfUnchanged(lockPath, observed, options = {}) {
-    const current = await readSidecarLockSnapshot(lockPath, options);
+    const current = await readSidecarLockSnapshot(lockPath, {
+        ...options,
+        allowDescriptorIdentityDrift: observed?.ownershipToken !== undefined,
+    });
     if (!current || !observed || !sidecarLockSnapshotMatches(current, observed)) {
         return false;
     }
@@ -1783,7 +1998,10 @@ async function removeSidecarLockIfUnchanged(lockPath, observed, options = {}) {
     return true;
 }
 async function sidecarLockSnapshotStillPresent(lockPath, observed, options = {}) {
-    const current = await readSidecarLockSnapshot(lockPath, options);
+    const current = await readSidecarLockSnapshot(lockPath, {
+        ...options,
+        allowDescriptorIdentityDrift: observed?.ownershipToken !== undefined,
+    });
     return !!current && !!observed && sidecarLockSnapshotMatches(current, observed);
 }
 async function sidecarReclaimGuardExists(pathname) {
@@ -1851,36 +2069,6 @@ async function removeStaleSidecarLockIfAllowed(params) {
     }
 }
 
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/sidecar-lock-handle.js
-
-function createSidecarLockHandle(params) {
-    let released = false;
-    const release = async () => {
-        if (released)
-            return;
-        released = true;
-        await params.release();
-    };
-    return {
-        lockPath: params.lockPath,
-        normalizedTargetPath: params.normalizedTargetPath,
-        verifyStillHeld: params.verifyStillHeld,
-        release,
-        [Symbol.asyncDispose]: release,
-    };
-}
-function createHeldSidecarLockHandle(params) {
-    return createSidecarLockHandle({
-        lockPath: params.held.lockPath,
-        normalizedTargetPath: params.normalizedTargetPath,
-        verifyStillHeld: async () => await sidecarLockSnapshotStillPresent(params.held.lockPath, params.held.snapshot, {
-            lockRoot: params.held.lockRoot,
-            parsePayload: params.held.parsePayload,
-        }),
-        release: params.release,
-    });
-}
-
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/sidecar-lock-policy.js
 
 function computeSidecarLockDelayMs(retry, attempt) {
@@ -1891,7 +2079,23 @@ function computeSidecarLockDelayMs(retry, attempt) {
     const jitter = retry.randomize ? 1 + Math.random() : 1;
     return Math.min(maxTimeout, Math.round(base * jitter));
 }
+// Windows denies access to a lock file while a just-unlinked directory entry
+// is still being torn down, so a contended acquire sees EPERM on a name that is
+// already gone -- both when creating it exclusively and when reading the
+// holder's snapshot. The next attempt succeeds, so this is contention rather
+// than a permission failure. The error must name the lock file itself: the
+// exclusive-create helper opens the parent directory first, and a denial from
+// that setup step carries no teardown evidence and has to reach the caller.
+const maxTransientLockDenials = 8;
+function isTransientLockFileDenial(error, lockPath) {
+    const denial = error;
+    return process.platform === "win32" && denial?.code === "EPERM" && denial.path === lockPath;
+}
 function sidecarLockPayloadIsStale(payload, staleMs, nowMs) {
+    const createdAtMs = sidecarLockPayloadCreatedAtMs(payload);
+    return createdAtMs !== null && nowMs - createdAtMs > staleMs;
+}
+function sidecarLockPayloadCreatedAtMs(payload) {
     const createdAt = payload &&
         typeof payload === "object" &&
         "createdAt" in payload &&
@@ -1899,11 +2103,12 @@ function sidecarLockPayloadIsStale(payload, staleMs, nowMs) {
         ? payload.createdAt
         : "";
     const createdAtMs = Date.parse(createdAt);
-    return Number.isFinite(createdAtMs) && nowMs - createdAtMs > staleMs;
+    return Number.isFinite(createdAtMs) ? createdAtMs : null;
 }
 async function defaultSidecarLockShouldReclaim(params) {
-    if (sidecarLockPayloadIsStale(params.payload, params.staleMs, params.nowMs))
-        return true;
+    const createdAtMs = sidecarLockPayloadCreatedAtMs(params.payload);
+    if (createdAtMs !== null)
+        return params.nowMs - createdAtMs > params.staleMs;
     try {
         return params.nowMs - (await promises_namespaceObject.stat(params.lockPath)).mtimeMs > params.staleMs;
     }
@@ -1912,57 +2117,347 @@ async function defaultSidecarLockShouldReclaim(params) {
     }
 }
 
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/sidecar-lock.js
-
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/sidecar-lock-acquire.js
 
 
 
 
 
 
-
-
-const GLOBAL_STATE_KEY = Symbol.for("fsSafe.sidecarLockManagers");
-function getGlobalManagers() {
-    const globalWithState = globalThis;
-    if (!globalWithState[GLOBAL_STATE_KEY]) {
-        globalWithState[GLOBAL_STATE_KEY] = new Map();
-    }
-    return globalWithState[GLOBAL_STATE_KEY];
-}
-function resolveManagerState(key) {
-    const managers = getGlobalManagers();
-    let state = managers.get(key);
-    if (!state) {
-        state = {
-            cleanupRegistered: false,
-            held: new Map(),
-            reclaimCleanupRegistered: false,
-            reclaimGuards: new Set(),
-        };
-        managers.set(key, state);
+async function resolveNormalizedTargetPath(targetPath) {
+    const resolved = external_node_path_namespaceObject.resolve(targetPath);
+    const dir = external_node_path_namespaceObject.dirname(resolved);
+    await promises_namespaceObject.mkdir(dir, { recursive: true });
+    try {
+        return external_node_path_namespaceObject.join(await promises_namespaceObject.realpath(dir), external_node_path_namespaceObject.basename(resolved));
     }
-    else {
-        // The global manager symbol is shared across package copies and hot reloads.
-        // Backfill state created by fs-safe versions that predate reclaim guards.
-        state.reclaimCleanupRegistered ??= false;
-        state.reclaimGuards ??= new Set();
-        for (const held of state.held.values()) {
-            held.refCount ??= 1;
-        }
+    catch {
+        return resolved;
     }
-    return state;
 }
-function snapshotMatchesSync(lockPath, observed) {
-    let fd;
-    try {
-        const beforeStat = external_node_fs_namespaceObject.lstatSync(lockPath);
-        if (!beforeStat.isFile()) {
-            return false;
+async function acquireSidecarLock(options, context) {
+    context.ensureExitCleanupRegistered();
+    const normalizedTargetPath = await resolveNormalizedTargetPath(options.targetPath);
+    const lockPath = options.lockPath ?? `${normalizedTargetPath}.lock`;
+    const held = context.held.get(normalizedTargetPath);
+    if (held &&
+        options.reentrantOwner !== undefined &&
+        held.reentrantOwner !== undefined &&
+        options.reentrantOwner === held.reentrantOwner) {
+        held.refCount += 1;
+        return context.handleForHeldLock(normalizedTargetPath, held);
+    }
+    const startedAt = Date.now();
+    const retry = options.retry ?? {};
+    const maxRetries = options.timeoutMs === Number.POSITIVE_INFINITY ? undefined : retry.retries;
+    const reclaimGuardPath = `${lockPath}.reclaim`;
+    let ownsReclaimGuard = false;
+    let attempt = 0;
+    // Bounded so a genuine denial still surfaces as EPERM, not a lock timeout.
+    let transientDenials = 0;
+    const withinDenialBudget = () => ++transientDenials <= (/* inlined export .maxTransientLockDenials */8);
+    const waitForRetry = async () => {
+        const elapsed = Date.now() - startedAt;
+        if ((options.timeoutMs !== undefined &&
+            options.timeoutMs !== Number.POSITIVE_INFINITY &&
+            elapsed >= options.timeoutMs) ||
+            (maxRetries !== undefined && attempt >= maxRetries)) {
+            throw Object.assign(new Error(`file lock timeout for ${normalizedTargetPath}`), {
+                code: "file_lock_timeout",
+                lockPath,
+                normalizedTargetPath,
+            });
         }
-        const openFlags = external_node_fs_namespaceObject.constants.O_RDONLY |
-            (process.platform !== "win32" && typeof external_node_fs_namespaceObject.constants.O_NOFOLLOW === "number"
-                ? external_node_fs_namespaceObject.constants.O_NOFOLLOW
+        const remaining = options.timeoutMs === undefined || options.timeoutMs === Number.POSITIVE_INFINITY
+            ? Number.POSITIVE_INFINITY
+            : Math.max(0, options.timeoutMs - elapsed);
+        const delay = Math.min(computeSidecarLockDelayMs(retry, attempt), remaining);
+        attempt += 1;
+        await new Promise((resolve) => setTimeout(resolve, delay));
+    };
+    // Waiting can fail on the caller's own retry or deadline limits. Classifying
+    // a denial as contention must not cost them the original diagnosis, so hand
+    // the denial back when no further attempt can be scheduled.
+    const retryOrRethrowDenial = async (denial) => {
+        try {
+            await waitForRetry();
+        }
+        catch (waitError) {
+            if (waitError.code === "file_lock_timeout")
+                throw denial;
+            throw waitError;
+        }
+    };
+    try {
+        while (true) {
+            if (!ownsReclaimGuard && (await sidecarReclaimGuardExists(reclaimGuardPath))) {
+                await waitForRetry();
+                continue;
+            }
+            let handle = null;
+            let createdSnapshot = null;
+            let lockFileCreateDenied = false;
+            try {
+                const payload = await options.payload();
+                const { raw, ownershipToken } = serializeSidecarLockPayload(payload);
+                if (options.lockRoot) {
+                    const relativeLockPath = relativeSidecarLockPath(options.lockRoot, lockPath);
+                    try {
+                        await options.lockRoot.create(relativeLockPath, raw, { mkdir: true, mode: 0o600 });
+                    }
+                    catch (error) {
+                        if (error instanceof errors_FsSafeError && error.code === "already-exists") {
+                            throw Object.assign(new Error("sidecar lock exists"), { code: "EEXIST" });
+                        }
+                        throw error;
+                    }
+                    createdSnapshot = { raw, payload, ownershipToken };
+                    handle = (await options.lockRoot.open(relativeLockPath)).handle;
+                }
+                else {
+                    try {
+                        handle =
+                            (await createNativeExclusiveFile(lockPath, 0o600)) ??
+                                (await promises_namespaceObject.open(lockPath, "wx"));
+                    }
+                    catch (createError) {
+                        lockFileCreateDenied = isTransientLockFileDenial(createError, lockPath);
+                        throw createError;
+                    }
+                    await handle.writeFile(raw, "utf8");
+                }
+                const snapshot = { raw, payload, stat: await handle.stat(), ownershipToken };
+                const createdHeld = {
+                    refCount: 1,
+                    reentrantOwner: options.reentrantOwner,
+                    handle,
+                    lockPath,
+                    snapshot,
+                    acquiredAt: Date.now(),
+                    metadata: options.metadata ?? {},
+                    lockRoot: options.lockRoot,
+                    parsePayload: options.parsePayload,
+                };
+                context.held.set(normalizedTargetPath, createdHeld);
+                if (ownsReclaimGuard) {
+                    try {
+                        await releaseSidecarReclaimGuard(context.reclaimGuards, reclaimGuardPath);
+                        ownsReclaimGuard = false;
+                    }
+                    catch (err) {
+                        await context.releaseHeldLock(normalizedTargetPath, createdHeld, { force: true });
+                        throw err;
+                    }
+                }
+                const returnedHandle = context.handleForHeldLock(normalizedTargetPath, createdHeld);
+                const interval = options.compromiseCheckIntervalMs;
+                if (options.onCompromised && interval !== undefined && interval > 0) {
+                    createdHeld.compromiseTimer = setInterval(() => {
+                        void returnedHandle.verifyStillHeld().then((stillHeld) => {
+                            if (!stillHeld && createdHeld.compromiseTimer) {
+                                clearInterval(createdHeld.compromiseTimer);
+                                createdHeld.compromiseTimer = undefined;
+                                options.onCompromised?.({ lockPath, normalizedTargetPath });
+                            }
+                        });
+                    }, interval);
+                    createdHeld.compromiseTimer.unref();
+                }
+                return returnedHandle;
+            }
+            catch (err) {
+                if (handle) {
+                    const failedSnapshot = { payload: null };
+                    try {
+                        failedSnapshot.stat = await handle.stat();
+                    }
+                    catch {
+                        // Best-effort cleanup of a failed exclusive create.
+                    }
+                    const current = context.held.get(normalizedTargetPath);
+                    if (current?.handle === handle) {
+                        context.held.delete(normalizedTargetPath);
+                    }
+                    await handle.close().catch(() => undefined);
+                    // The file may be empty or partial JSON, so remove by the identity
+                    // captured from our exclusive handle rather than by pathname alone.
+                    await removeSidecarLockIfUnchanged(lockPath, failedSnapshot, {
+                        lockRoot: options.lockRoot,
+                        parsePayload: options.parsePayload,
+                    });
+                }
+                else if (createdSnapshot) {
+                    await removeSidecarLockIfUnchanged(lockPath, createdSnapshot, {
+                        lockRoot: options.lockRoot,
+                        parsePayload: options.parsePayload,
+                    });
+                }
+                if (lockFileCreateDenied && withinDenialBudget()) {
+                    await retryOrRethrowDenial(err);
+                    continue;
+                }
+                if (err.code !== "EEXIST") {
+                    throw err;
+                }
+                if (ownsReclaimGuard) {
+                    await releaseSidecarReclaimGuard(context.reclaimGuards, reclaimGuardPath);
+                    ownsReclaimGuard = false;
+                    continue;
+                }
+                const nowMs = Date.now();
+                let snapshot;
+                try {
+                    snapshot = await readSidecarLockSnapshot(lockPath, {
+                        lockRoot: options.lockRoot,
+                        parsePayload: options.parsePayload,
+                        rejectNonFile: true,
+                    });
+                }
+                catch (readErr) {
+                    if (!isTransientLockFileDenial(readErr, lockPath) || !withinDenialBudget())
+                        throw readErr;
+                    await retryOrRethrowDenial(readErr);
+                    continue;
+                }
+                if (!snapshot) {
+                    continue;
+                }
+                if (context.held.has(normalizedTargetPath)) {
+                    await waitForRetry();
+                    continue;
+                }
+                const shouldReclaim = options.shouldReclaim ?? defaultSidecarLockShouldReclaim;
+                if (await shouldReclaim({
+                    lockPath,
+                    normalizedTargetPath,
+                    payload: snapshot?.payload ?? null,
+                    staleMs: options.staleMs,
+                    nowMs,
+                    heldByThisProcess: context.held.has(normalizedTargetPath),
+                })) {
+                    if (!(await sidecarLockSnapshotStillPresent(lockPath, snapshot, {
+                        lockRoot: options.lockRoot,
+                        parsePayload: options.parsePayload,
+                    }))) {
+                        continue;
+                    }
+                    const staleRecovery = options.staleRecovery ?? "fail-closed";
+                    if (staleRecovery === "remove-if-unchanged") {
+                        if (!(await tryAcquireSidecarReclaimGuard(context.reclaimGuards, reclaimGuardPath))) {
+                            await waitForRetry();
+                            continue;
+                        }
+                        ownsReclaimGuard = true;
+                        const removal = await removeStaleSidecarLockIfAllowed({
+                            lockPath,
+                            normalizedTargetPath,
+                            snapshot,
+                            shouldRemoveStaleLock: options.shouldRemoveStaleLock,
+                            lockRoot: options.lockRoot,
+                            parsePayload: options.parsePayload,
+                        });
+                        if (removal === "removed" || removal === "changed") {
+                            continue;
+                        }
+                        await releaseSidecarReclaimGuard(context.reclaimGuards, reclaimGuardPath);
+                        ownsReclaimGuard = false;
+                    }
+                    throw Object.assign(new Error(`file lock stale for ${normalizedTargetPath}`), {
+                        code: "file_lock_stale",
+                        lockPath,
+                        normalizedTargetPath,
+                    });
+                }
+                await waitForRetry();
+            }
+        }
+    }
+    finally {
+        if (ownsReclaimGuard) {
+            await releaseSidecarReclaimGuard(context.reclaimGuards, reclaimGuardPath).catch(() => undefined);
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/sidecar-lock-handle.js
+
+function createSidecarLockHandle(params) {
+    let released = false;
+    const release = async () => {
+        if (released)
+            return;
+        released = true;
+        await params.release();
+    };
+    return {
+        lockPath: params.lockPath,
+        normalizedTargetPath: params.normalizedTargetPath,
+        verifyStillHeld: params.verifyStillHeld,
+        release,
+        [Symbol.asyncDispose]: release,
+    };
+}
+function createHeldSidecarLockHandle(params) {
+    return createSidecarLockHandle({
+        lockPath: params.held.lockPath,
+        normalizedTargetPath: params.normalizedTargetPath,
+        verifyStillHeld: async () => await sidecarLockSnapshotStillPresent(params.held.lockPath, params.held.snapshot, {
+            lockRoot: params.held.lockRoot,
+            parsePayload: params.held.parsePayload,
+        }),
+        release: params.release,
+    });
+}
+
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/sidecar-lock.js
+
+
+
+
+
+const GLOBAL_STATE_KEY = Symbol.for("fsSafe.sidecarLockManagers");
+const GLOBAL_CLEANUP_KEY = Symbol.for("fsSafe.sidecarLockCleanupRegistered");
+const GLOBAL_CLEANUP_HANDLER_KEY = Symbol.for("fsSafe.sidecarLockCleanupHandler");
+function getGlobalManagers() {
+    const globalWithState = globalThis;
+    if (!globalWithState[GLOBAL_STATE_KEY]) {
+        globalWithState[GLOBAL_STATE_KEY] = new Map();
+    }
+    return globalWithState[GLOBAL_STATE_KEY];
+}
+function resolveManagerState(key) {
+    const managers = getGlobalManagers();
+    let state = managers.get(key);
+    if (!state) {
+        state = {
+            cleanupRegistered: false,
+            held: new Map(),
+            reclaimCleanupRegistered: false,
+            reclaimGuards: new Set(),
+        };
+        managers.set(key, state);
+    }
+    else {
+        // The global manager symbol is shared across package copies and hot reloads.
+        // Backfill state created by fs-safe versions that predate reclaim guards.
+        state.reclaimCleanupRegistered ??= false;
+        state.reclaimGuards ??= new Set();
+        for (const held of state.held.values()) {
+            held.refCount ??= 1;
+        }
+    }
+    return state;
+}
+function snapshotMatchesSync(lockPath, observed) {
+    let fd;
+    try {
+        const beforeStat = external_node_fs_namespaceObject.lstatSync(lockPath);
+        if (!beforeStat.isFile()) {
+            return false;
+        }
+        const openFlags = external_node_fs_namespaceObject.constants.O_RDONLY |
+            (process.platform !== "win32" && typeof external_node_fs_namespaceObject.constants.O_NOFOLLOW === "number"
+                ? external_node_fs_namespaceObject.constants.O_NOFOLLOW
                 : 0) |
             (typeof external_node_fs_namespaceObject.constants.O_NONBLOCK === "number" ? external_node_fs_namespaceObject.constants.O_NONBLOCK : 0);
         fd = external_node_fs_namespaceObject.openSync(lockPath, openFlags);
@@ -1994,17 +2489,6 @@ function snapshotMatchesSync(lockPath, observed) {
         }
     }
 }
-async function resolveNormalizedTargetPath(targetPath) {
-    const resolved = external_node_path_namespaceObject.resolve(targetPath);
-    const dir = external_node_path_namespaceObject.dirname(resolved);
-    await promises_namespaceObject.mkdir(dir, { recursive: true });
-    try {
-        return external_node_path_namespaceObject.join(await promises_namespaceObject.realpath(dir), external_node_path_namespaceObject.basename(resolved));
-    }
-    catch {
-        return resolved;
-    }
-}
 function releaseAllReclaimGuardsSync(state) {
     for (const reclaimGuardPath of state.reclaimGuards) {
         try {
@@ -2031,6 +2515,19 @@ function releaseAllLocksSync(state) {
     }
     releaseAllReclaimGuardsSync(state);
 }
+function ensureGlobalExitCleanupRegistered() {
+    const globalWithCleanup = globalThis;
+    if (globalWithCleanup[GLOBAL_CLEANUP_KEY])
+        return;
+    globalWithCleanup[GLOBAL_CLEANUP_KEY] = true;
+    const cleanup = () => {
+        for (const state of getGlobalManagers().values()) {
+            releaseAllLocksSync(state);
+        }
+    };
+    globalWithCleanup[GLOBAL_CLEANUP_HANDLER_KEY] = cleanup;
+    process.on("exit", cleanup);
+}
 async function releaseHeldLock(state, normalizedTargetPath, held, options = {}) {
     const current = state.held.get(normalizedTargetPath);
     if (current !== held) {
@@ -2079,217 +2576,18 @@ function handleForHeldLock(state, normalizedTargetPath, held) {
 function createSidecarLockManager(key) {
     const state = resolveManagerState(key);
     function ensureExitCleanupRegistered() {
-        if (!state.cleanupRegistered) {
-            state.cleanupRegistered = true;
-            state.reclaimCleanupRegistered = true;
-            process.on("exit", () => releaseAllLocksSync(state));
-            return;
-        }
-        if (!state.reclaimCleanupRegistered) {
-            state.reclaimCleanupRegistered = true;
-            process.on("exit", () => releaseAllReclaimGuardsSync(state));
-        }
+        state.cleanupRegistered = true;
+        state.reclaimCleanupRegistered = true;
+        ensureGlobalExitCleanupRegistered();
     }
     async function acquire(options) {
-        ensureExitCleanupRegistered();
-        const normalizedTargetPath = await resolveNormalizedTargetPath(options.targetPath);
-        const lockPath = options.lockPath ?? `${normalizedTargetPath}.lock`;
-        const held = state.held.get(normalizedTargetPath);
-        if (held &&
-            options.reentrantOwner !== undefined &&
-            held.reentrantOwner !== undefined &&
-            options.reentrantOwner === held.reentrantOwner) {
-            held.refCount += 1;
-            return handleForHeldLock(state, normalizedTargetPath, held);
-        }
-        const startedAt = Date.now();
-        const retry = options.retry ?? {};
-        const maxRetries = options.timeoutMs === Number.POSITIVE_INFINITY ? undefined : retry.retries;
-        const reclaimGuardPath = `${lockPath}.reclaim`;
-        let ownsReclaimGuard = false;
-        let attempt = 0;
-        const waitForRetry = async () => {
-            const elapsed = Date.now() - startedAt;
-            if ((options.timeoutMs !== undefined &&
-                options.timeoutMs !== Number.POSITIVE_INFINITY &&
-                elapsed >= options.timeoutMs) ||
-                (maxRetries !== undefined && attempt >= maxRetries)) {
-                throw Object.assign(new Error(`file lock timeout for ${normalizedTargetPath}`), {
-                    code: "file_lock_timeout",
-                    lockPath,
-                    normalizedTargetPath,
-                });
-            }
-            const remaining = options.timeoutMs === undefined || options.timeoutMs === Number.POSITIVE_INFINITY
-                ? Number.POSITIVE_INFINITY
-                : Math.max(0, options.timeoutMs - elapsed);
-            const delay = Math.min(computeSidecarLockDelayMs(retry, attempt), remaining);
-            attempt += 1;
-            await new Promise((resolve) => setTimeout(resolve, delay));
-        };
-        try {
-            while (true) {
-                if (!ownsReclaimGuard && (await sidecarReclaimGuardExists(reclaimGuardPath))) {
-                    await waitForRetry();
-                    continue;
-                }
-                let handle = null;
-                try {
-                    const payload = await options.payload();
-                    const { raw, ownershipToken } = serializeSidecarLockPayload(payload);
-                    if (options.lockRoot) {
-                        const relativeLockPath = relativeSidecarLockPath(options.lockRoot, lockPath);
-                        try {
-                            await options.lockRoot.create(relativeLockPath, raw, { mkdir: true, mode: 0o600 });
-                        }
-                        catch (error) {
-                            if (error instanceof errors_FsSafeError && error.code === "already-exists") {
-                                throw Object.assign(new Error("sidecar lock exists"), { code: "EEXIST" });
-                            }
-                            throw error;
-                        }
-                        handle = (await options.lockRoot.open(relativeLockPath)).handle;
-                    }
-                    else {
-                        handle = (await createNativeExclusiveFile(lockPath, 0o600)) ?? await promises_namespaceObject.open(lockPath, "wx");
-                        await handle.writeFile(raw, "utf8");
-                    }
-                    const snapshot = { raw, payload, stat: await handle.stat(), ownershipToken };
-                    const createdHeld = {
-                        refCount: 1,
-                        reentrantOwner: options.reentrantOwner,
-                        handle,
-                        lockPath,
-                        snapshot,
-                        acquiredAt: Date.now(),
-                        metadata: options.metadata ?? {},
-                        lockRoot: options.lockRoot,
-                        parsePayload: options.parsePayload,
-                    };
-                    state.held.set(normalizedTargetPath, createdHeld);
-                    if (ownsReclaimGuard) {
-                        try {
-                            await releaseSidecarReclaimGuard(state.reclaimGuards, reclaimGuardPath);
-                            ownsReclaimGuard = false;
-                        }
-                        catch (err) {
-                            await releaseHeldLock(state, normalizedTargetPath, createdHeld, { force: true });
-                            throw err;
-                        }
-                    }
-                    const returnedHandle = handleForHeldLock(state, normalizedTargetPath, createdHeld);
-                    const interval = options.compromiseCheckIntervalMs;
-                    if (options.onCompromised && interval !== undefined && interval > 0) {
-                        createdHeld.compromiseTimer = setInterval(() => {
-                            void returnedHandle.verifyStillHeld().then((stillHeld) => {
-                                if (!stillHeld && createdHeld.compromiseTimer) {
-                                    clearInterval(createdHeld.compromiseTimer);
-                                    createdHeld.compromiseTimer = undefined;
-                                    options.onCompromised?.({ lockPath, normalizedTargetPath });
-                                }
-                            });
-                        }, interval);
-                        createdHeld.compromiseTimer.unref();
-                    }
-                    return returnedHandle;
-                }
-                catch (err) {
-                    if (handle) {
-                        const failedSnapshot = { payload: null };
-                        try {
-                            failedSnapshot.stat = await handle.stat();
-                        }
-                        catch {
-                            // Best-effort cleanup of a failed exclusive create.
-                        }
-                        const current = state.held.get(normalizedTargetPath);
-                        if (current?.handle === handle) {
-                            state.held.delete(normalizedTargetPath);
-                        }
-                        // If payload serialization/write fails, the file may be empty or
-                        // partial JSON, so remove while our exclusive handle is still open.
-                        if (!options.lockRoot) {
-                            await promises_namespaceObject.rm(lockPath, { force: true }).catch(() => undefined);
-                        }
-                        await handle.close().catch(() => undefined);
-                        // Windows can refuse removing an open file; retry after close but
-                        // only if the path still points at the file identity we created.
-                        await removeSidecarLockIfUnchanged(lockPath, failedSnapshot, {
-                            lockRoot: options.lockRoot,
-                            parsePayload: options.parsePayload,
-                        });
-                    }
-                    if (err.code !== "EEXIST") {
-                        throw err;
-                    }
-                    if (ownsReclaimGuard) {
-                        await releaseSidecarReclaimGuard(state.reclaimGuards, reclaimGuardPath);
-                        ownsReclaimGuard = false;
-                        continue;
-                    }
-                    const nowMs = Date.now();
-                    const snapshot = await readSidecarLockSnapshot(lockPath, {
-                        lockRoot: options.lockRoot,
-                        parsePayload: options.parsePayload,
-                    });
-                    if (!snapshot) {
-                        continue;
-                    }
-                    if (state.held.has(normalizedTargetPath)) {
-                        await waitForRetry();
-                        continue;
-                    }
-                    const shouldReclaim = options.shouldReclaim ?? defaultSidecarLockShouldReclaim;
-                    if (await shouldReclaim({
-                        lockPath,
-                        normalizedTargetPath,
-                        payload: snapshot?.payload ?? null,
-                        staleMs: options.staleMs,
-                        nowMs,
-                        heldByThisProcess: state.held.has(normalizedTargetPath),
-                    })) {
-                        if (!(await sidecarLockSnapshotStillPresent(lockPath, snapshot, {
-                            lockRoot: options.lockRoot,
-                            parsePayload: options.parsePayload,
-                        }))) {
-                            continue;
-                        }
-                        const staleRecovery = options.staleRecovery ?? "fail-closed";
-                        if (staleRecovery === "remove-if-unchanged") {
-                            if (!(await tryAcquireSidecarReclaimGuard(state.reclaimGuards, reclaimGuardPath))) {
-                                await waitForRetry();
-                                continue;
-                            }
-                            ownsReclaimGuard = true;
-                            const removal = await removeStaleSidecarLockIfAllowed({
-                                lockPath,
-                                normalizedTargetPath,
-                                snapshot,
-                                shouldRemoveStaleLock: options.shouldRemoveStaleLock,
-                                lockRoot: options.lockRoot,
-                                parsePayload: options.parsePayload,
-                            });
-                            if (removal === "removed" || removal === "changed") {
-                                continue;
-                            }
-                            await releaseSidecarReclaimGuard(state.reclaimGuards, reclaimGuardPath);
-                            ownsReclaimGuard = false;
-                        }
-                        throw Object.assign(new Error(`file lock stale for ${normalizedTargetPath}`), {
-                            code: "file_lock_stale",
-                            lockPath,
-                            normalizedTargetPath,
-                        });
-                    }
-                    await waitForRetry();
-                }
-            }
-        }
-        finally {
-            if (ownsReclaimGuard) {
-                await releaseSidecarReclaimGuard(state.reclaimGuards, reclaimGuardPath).catch(() => undefined);
-            }
-        }
+        return await acquireSidecarLock(options, {
+            held: state.held,
+            reclaimGuards: state.reclaimGuards,
+            ensureExitCleanupRegistered,
+            handleForHeldLock: (normalizedTargetPath, held) => handleForHeldLock(state, normalizedTargetPath, held),
+            releaseHeldLock: async (normalizedTargetPath, held, releaseOptions) => await releaseHeldLock(state, normalizedTargetPath, held, releaseOptions),
+        });
     }
     async function withLock(options, fn) {
         const lock = await acquire(options);
@@ -2325,21 +2623,6 @@ async function withSidecarLock(targetPath, options, fn) {
     return await manager.withLock({ ...acquireOptions, targetPath }, fn);
 }
 
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/test-hooks.js
-let test_hooks_fsSafeTestHooks;
-function allowFsSafeTestHooks() {
-    return  false || process.env.VITEST === "true";
-}
-function getFsSafeTestHooks() {
-    return test_hooks_fsSafeTestHooks;
-}
-function __setFsSafeTestHooksForTest(hooks) {
-    if (hooks && !allowFsSafeTestHooks()) {
-        throw new Error("__setFsSafeTestHooksForTest is only available in tests");
-    }
-    test_hooks_fsSafeTestHooks = hooks;
-}
-
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/pinned-write.js
 
 
@@ -2412,7 +2695,7 @@ async function runPinnedWriteHelper(params) {
         return await runPinnedWriteFallback(params);
     }
     const native = getNativeBinding();
-    if (native && params.overwrite === false) {
+    if (native) {
         return await runPinnedWriteNative(native, params);
     }
     return await runPinnedWriteFallback(params);
@@ -2450,6 +2733,7 @@ async function runPinnedWriteFallback(params) {
         parentPath = await mkdirPathComponentsWithGuards({
             rootReal: params.rootPath,
             targetPath: parentPath,
+            beforeComponent: async (componentPath) => await getFsSafeTestHooks()?.beforeRootFallbackMutation?.("mkdir", componentPath),
         });
     }
     const parentGuard = params.mkdir
@@ -2589,77 +2873,135 @@ async function runPinnedWriteFallback(params) {
     return { dev: targetStat.dev, ino: targetStat.ino };
 }
 
-;// CONCATENATED MODULE: external "node:os"
-const external_node_os_namespaceObject = __rspack_createRequire_require("node:os");
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/root-path-existing.js
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/error-detail.js
+const UNSAFE_ERROR_DETAIL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/gu;
+function formatErrorDetail(value) {
+    return value.replace(UNSAFE_ERROR_DETAIL_CHARACTERS, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
 
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/root-path-symlink.js
 
 
 
-function isFilesystemRoot(candidate) {
-    return external_node_path_namespaceObject.parse(candidate).root === candidate;
+
+
+
+function normalizeSymlinkResolutionError(error) {
+    if (isSymlinkOpenError(error)) {
+        throw new errors_FsSafeError("symlink", "symlink path could not be resolved", {
+            cause: error instanceof Error ? error : undefined,
+        });
+    }
+    if (!path_isNotFoundPathError(error))
+        throw error;
 }
-async function root_path_existing_pathExists(targetPath) {
+async function resolveSymlinkHopPath(symlinkPath) {
     try {
-        await promises_namespaceObject.lstat(targetPath);
-        return true;
+        return external_node_path_namespaceObject.resolve(await promises_namespaceObject.realpath(symlinkPath));
     }
     catch (error) {
-        if (path_isNotFoundPathError(error)) {
-            return false;
-        }
-        throw error;
+        normalizeSymlinkResolutionError(error);
+        const linkTarget = await promises_namespaceObject.readlink(symlinkPath);
+        return resolvePathViaExistingAncestor(external_node_path_namespaceObject.resolve(external_node_path_namespaceObject.dirname(symlinkPath), linkTarget));
     }
 }
-async function root_path_existing_resolvePathViaExistingAncestor(targetPath) {
-    const normalized = external_node_path_namespaceObject.resolve(targetPath);
-    let cursor = normalized;
-    const missingSuffix = [];
-    while (!isFilesystemRoot(cursor) && !(await root_path_existing_pathExists(cursor))) {
-        missingSuffix.unshift(external_node_path_namespaceObject.basename(cursor));
-        const parent = external_node_path_namespaceObject.dirname(cursor);
-        if (parent === cursor) {
-            break;
-        }
-        cursor = parent;
-    }
-    if (!(await root_path_existing_pathExists(cursor))) {
-        return normalized;
-    }
+function root_path_symlink_resolveSymlinkHopPathSync(symlinkPath) {
     try {
-        const resolvedAncestor = external_node_path_namespaceObject.resolve(await promises_namespaceObject.realpath(cursor));
-        return missingSuffix.length === 0
-            ? resolvedAncestor
-            : external_node_path_namespaceObject.resolve(resolvedAncestor, ...missingSuffix);
+        return path.resolve(fs.realpathSync(symlinkPath));
     }
-    catch {
-        return normalized;
+    catch (error) {
+        normalizeSymlinkResolutionError(error);
+        const linkTarget = fs.readlinkSync(symlinkPath);
+        return resolvePathViaExistingAncestorSync(path.resolve(path.dirname(symlinkPath), linkTarget));
     }
 }
-function root_path_existing_resolvePathViaExistingAncestorSync(targetPath) {
-    const normalized = path.resolve(targetPath);
-    let cursor = normalized;
-    const missingSuffix = [];
-    while (!isFilesystemRoot(cursor) && !fs.existsSync(cursor)) {
-        missingSuffix.unshift(path.basename(cursor));
-        const parent = path.dirname(cursor);
-        if (parent === cursor) {
-            break;
-        }
-        cursor = parent;
+
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/safe-path-segment.js
+
+const SAFE_PATH_SEGMENT_PATTERN = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;
+const SAFE_DOT_PREFIX_PATH_SEGMENT_PATTERN = /^[A-Za-z0-9._-]+$/;
+// Windows treats "C:name" as relative to the drive's current directory even
+// though path.win32.isAbsolute() reports false.
+const DRIVE_RELATIVE_PREFIX = /^[A-Za-z]:(?![\\/])/;
+const HYPHEN_CHAR_CODE = 0x2d;
+function safe_path_segment_isDriveRelativePath(value) {
+    return DRIVE_RELATIVE_PREFIX.test(value);
+}
+function assertNoDriveRelativePathSegments(value, label) {
+    if (value.split("/").some(safe_path_segment_isDriveRelativePath)) {
+        throw new errors_FsSafeError("invalid-path", `${label} must not contain a drive letter`);
     }
-    if (!fs.existsSync(cursor)) {
-        return normalized;
+    return value;
+}
+function trimHyphenEdges(value) {
+    let start = 0;
+    let end = value.length;
+    while (start < end && value.charCodeAt(start) === HYPHEN_CHAR_CODE) {
+        start += 1;
     }
-    try {
-        const resolvedAncestor = path.resolve(fs.realpathSync(cursor));
-        return missingSuffix.length === 0
-            ? resolvedAncestor
-            : path.resolve(resolvedAncestor, ...missingSuffix);
+    while (end > start && value.charCodeAt(end - 1) === HYPHEN_CHAR_CODE) {
+        end -= 1;
     }
-    catch {
-        return normalized;
+    return start === 0 && end === value.length ? value : value.slice(start, end);
+}
+function isSafePathSegment(segment, options = {}) {
+    return (segment !== "" &&
+        segment !== "." &&
+        segment !== ".." &&
+        !segment.includes("/") &&
+        !segment.includes("\\") &&
+        !segment.includes("\0") &&
+        (options.allowDotPrefix === true || !segment.startsWith(".")) &&
+        (options.allowDotPrefix === true
+            ? SAFE_DOT_PREFIX_PATH_SEGMENT_PATTERN.test(segment)
+            : SAFE_PATH_SEGMENT_PATTERN.test(segment)));
+}
+function assertSafePathSegment(segment, options = {}) {
+    // Validate the exact value callers will later join into paths; trimming here
+    // would let whitespace-padded ids pass and then be used verbatim.
+    if (!isSafePathSegment(segment, options)) {
+        throw new FsSafeError("invalid-path", `${options.label ?? "path segment"} must be a safe path segment`);
+    }
+    return segment;
+}
+function sanitizeSafePathSegment(value, fallback, options = {}) {
+    const sanitized = value
+        .trim()
+        .replace(/[\\/]+/g, "-")
+        .replace(/\0/g, "")
+        .replace(/[^A-Za-z0-9._-]+/g, "-");
+    const trimmed = trimHyphenEdges(sanitized);
+    if (isSafePathSegment(trimmed, options)) {
+        return trimmed;
+    }
+    return assertSafePathSegment(fallback, { ...options, label: "fallback path segment" });
+}
+function assertSafePathPrefix(prefix, options = {}) {
+    // Prefixes are often derived from safe filenames. Normalize harmless
+    // filename characters first, but still reject real path-control bytes.
+    if (prefix.includes("/") || prefix.includes("\\") || prefix.includes("\0")) {
+        return assertSafePathSegment(prefix, {
+            allowDotPrefix: true,
+            ...options,
+            label: options.label ?? "path prefix",
+        });
     }
+    return assertSafePathSegment(prefix.replace(/[^A-Za-z0-9._-]+/g, "-"), {
+        allowDotPrefix: true,
+        ...options,
+        label: options.label ?? "path prefix",
+    });
+}
+
+;// CONCATENATED MODULE: external "node:os"
+const external_node_os_namespaceObject = __rspack_createRequire_require("node:os");
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/short-path.js
+
+
+function shortPath(value) {
+    const home = external_node_os_namespaceObject.homedir();
+    const shortened = value.startsWith(home) ? `~${value.slice(home.length)}` : value;
+    return formatErrorDetail(shortened);
 }
 
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/root-path.js
@@ -2670,6 +3012,10 @@ function root_path_existing_resolvePathViaExistingAncestorSync(targetPath) {
 
 
 
+
+
+
+
 const ROOT_PATH_ALIAS_POLICIES = {
     strict: Object.freeze({
         allowFinalSymlinkForUnlink: false,
@@ -2681,11 +3027,20 @@ const ROOT_PATH_ALIAS_POLICIES = {
     }),
 };
 async function resolveRootPath(params) {
+    try {
+        return await resolveRootPathInternal(params);
+    }
+    catch (error) {
+        throw sanitizeRootPathError(error);
+    }
+}
+async function resolveRootPathInternal(params) {
+    assertValidRootPathInputs(params);
     const rootPath = external_node_path_namespaceObject.resolve(params.rootPath);
     const absolutePath = external_node_path_namespaceObject.resolve(params.absolutePath);
     const rootCanonicalPath = params.rootCanonicalPath
         ? external_node_path_namespaceObject.resolve(params.rootCanonicalPath)
-        : await root_path_existing_resolvePathViaExistingAncestor(rootPath);
+        : await resolvePathViaExistingAncestor(rootPath);
     const context = createBoundaryResolutionContext({
         resolveParams: params,
         rootPath,
@@ -2711,6 +3066,15 @@ async function resolveRootPath(params) {
     });
 }
 function resolveRootPathSync(params) {
+    try {
+        return resolveRootPathSyncInternal(params);
+    }
+    catch (error) {
+        throw sanitizeRootPathError(error);
+    }
+}
+function resolveRootPathSyncInternal(params) {
+    assertValidRootPathInputs(params);
     const rootPath = path.resolve(params.rootPath);
     const absolutePath = path.resolve(params.absolutePath);
     const rootCanonicalPath = params.rootCanonicalPath
@@ -2740,6 +3104,29 @@ function resolveRootPathSync(params) {
         rootCanonicalPath: context.rootCanonicalPath,
     });
 }
+function sanitizeRootPathError(error) {
+    if (error instanceof Error) {
+        error.message = formatErrorDetail(error.message);
+    }
+    return error;
+}
+function assertValidRootPathInputs(params) {
+    path_assertNoNulPathInput(params.rootPath, "root path contains a NUL byte");
+    path_assertNoNulPathInput(params.absolutePath, "absolute path contains a NUL byte");
+    assertNoEmbeddedDriveRelativeSegment(params.rootPath, "root path");
+    assertNoEmbeddedDriveRelativeSegment(params.absolutePath, "absolute path");
+    if (params.rootCanonicalPath !== undefined) {
+        path_assertNoNulPathInput(params.rootCanonicalPath, "canonical root path contains a NUL byte");
+        assertNoEmbeddedDriveRelativeSegment(params.rootCanonicalPath, "canonical root path");
+    }
+}
+function assertNoEmbeddedDriveRelativeSegment(filePath, label) {
+    if (process.platform !== "win32") {
+        return;
+    }
+    const root = external_node_path_namespaceObject.parse(filePath).root;
+    assertNoDriveRelativePathSegments(filePath.slice(root.length).replaceAll("\\", "/"), label);
+}
 function isPromiseLike(value) {
     return Boolean(value &&
         (typeof value === "object" || typeof value === "function") &&
@@ -2758,6 +3145,15 @@ function createLexicalTraversalState(params) {
         preserveFinalSymlink: false,
     };
 }
+function createLexicalTraversalContext(params) {
+    return {
+        state: createLexicalTraversalState(params),
+        resolveParams: params.params,
+        rootPath: params.rootPath,
+        rootCanonicalPath: params.rootCanonicalPath,
+        absolutePath: params.absolutePath,
+    };
+}
 function splitTraversalSegments(value) {
     return value
         .split(process.platform === "win32" ? /[\\/]+/ : /\/+/)
@@ -2781,149 +3177,97 @@ function rawPathRelativeToRoot(rootPath, candidatePath) {
         : candidatePrefix === rootWithSep;
     return prefixMatches ? candidate.slice(rootWithSep.length) : undefined;
 }
-function assertLexicalCursorInsideBoundary(params) {
+function assertLexicalCursorInsideBoundary(context, candidatePath) {
     assertInsideBoundary({
-        boundaryLabel: params.params.boundaryLabel,
-        rootCanonicalPath: params.rootCanonicalPath,
-        candidatePath: params.candidatePath,
-        absolutePath: params.absolutePath,
+        boundaryLabel: context.resolveParams.boundaryLabel,
+        rootCanonicalPath: context.rootCanonicalPath,
+        candidatePath,
+        absolutePath: context.absolutePath,
     });
 }
-function applyMissingSuffixToCanonicalCursor(params) {
-    const missingSuffix = params.state.segments.slice(params.missingFromIndex);
+function applyMissingSuffixToCanonicalCursor(context, missingFromIndex) {
+    const missingSuffix = context.state.segments.slice(missingFromIndex);
     for (const segment of missingSuffix) {
-        advanceCanonicalCursorForSegment({
-            state: params.state,
-            segment,
-            rootCanonicalPath: params.rootCanonicalPath,
-            params: params.params,
-            absolutePath: params.absolutePath,
-        });
+        advanceCanonicalCursorForSegment(context, segment);
     }
 }
-function advanceCanonicalCursorForSegment(params) {
-    params.state.canonicalCursor = external_node_path_namespaceObject.resolve(params.state.canonicalCursor, params.segment);
-    assertLexicalCursorInsideBoundary({
-        params: params.params,
-        rootCanonicalPath: params.rootCanonicalPath,
-        candidatePath: params.state.canonicalCursor,
-        absolutePath: params.absolutePath,
-    });
+function advanceCanonicalCursorForSegment(context, segment) {
+    context.state.canonicalCursor = external_node_path_namespaceObject.resolve(context.state.canonicalCursor, segment);
+    assertLexicalCursorInsideBoundary(context, context.state.canonicalCursor);
 }
-function finalizeLexicalResolution(params) {
-    assertLexicalCursorInsideBoundary({
-        params: params.params,
-        rootCanonicalPath: params.rootCanonicalPath,
-        candidatePath: params.state.canonicalCursor,
-        absolutePath: params.absolutePath,
-    });
+function finalizeLexicalResolution(context, kind) {
+    assertLexicalCursorInsideBoundary(context, context.state.canonicalCursor);
     return buildResolvedRootPath({
-        absolutePath: params.absolutePath,
-        canonicalPath: params.state.canonicalCursor,
-        rootPath: params.rootPath,
-        rootCanonicalPath: params.rootCanonicalPath,
-        kind: params.kind,
+        absolutePath: context.absolutePath,
+        canonicalPath: context.state.canonicalCursor,
+        rootPath: context.rootPath,
+        rootCanonicalPath: context.rootCanonicalPath,
+        kind,
     });
 }
-function handleLexicalLstatFailure(params) {
-    if (!path_isNotFoundPathError(params.error)) {
+function handleLexicalLstatFailure(context, error, missingFromIndex) {
+    if (!path_isNotFoundPathError(error)) {
         return false;
     }
-    applyMissingSuffixToCanonicalCursor({
-        state: params.state,
-        missingFromIndex: params.missingFromIndex,
-        rootCanonicalPath: params.rootCanonicalPath,
-        params: params.resolveParams,
-        absolutePath: params.absolutePath,
-    });
+    applyMissingSuffixToCanonicalCursor(context, missingFromIndex);
     return true;
 }
-function handleLexicalStatReadFailure(params) {
-    if (handleLexicalLstatFailure({
-        error: params.error,
-        state: params.state,
-        missingFromIndex: params.missingFromIndex,
-        rootCanonicalPath: params.rootCanonicalPath,
-        resolveParams: params.resolveParams,
-        absolutePath: params.absolutePath,
-    })) {
+function handleLexicalStatReadFailure(context, error, missingFromIndex) {
+    if (handleLexicalLstatFailure(context, error, missingFromIndex)) {
         return null;
     }
-    throw params.error;
+    throw error;
 }
-function handleLexicalStatDisposition(params) {
+function handleLexicalStatDisposition(context, params) {
     if (!params.isSymbolicLink) {
-        advanceCanonicalCursorForSegment({
-            state: params.state,
-            segment: params.segment,
-            rootCanonicalPath: params.rootCanonicalPath,
-            params: params.resolveParams,
-            absolutePath: params.absolutePath,
-        });
+        advanceCanonicalCursorForSegment(context, params.segment);
         return "continue";
     }
-    if (params.state.allowFinalSymlink && params.isLast) {
-        params.state.preserveFinalSymlink = true;
-        advanceCanonicalCursorForSegment({
-            state: params.state,
-            segment: params.segment,
-            rootCanonicalPath: params.rootCanonicalPath,
-            params: params.resolveParams,
-            absolutePath: params.absolutePath,
-        });
+    if (context.resolveParams.rejectSymlinks === true && params.isLast) {
+        throw new errors_FsSafeError("symlink", "symlink path component not allowed");
+    }
+    if (context.state.allowFinalSymlink && params.isLast) {
+        context.state.preserveFinalSymlink = true;
+        advanceCanonicalCursorForSegment(context, params.segment);
         return "break";
     }
     return "resolve-link";
 }
-function applyResolvedSymlinkHop(params) {
-    if (!path_isPathInside(params.rootCanonicalPath, params.linkCanonical)) {
+function applyResolvedSymlinkHop(context, linkCanonical) {
+    if (!path_isPathInside(context.rootCanonicalPath, linkCanonical)) {
         throw symlinkEscapeError({
-            boundaryLabel: params.boundaryLabel,
-            rootCanonicalPath: params.rootCanonicalPath,
-            symlinkPath: params.state.lexicalCursor,
+            boundaryLabel: context.resolveParams.boundaryLabel,
+            rootCanonicalPath: context.rootCanonicalPath,
+            symlinkPath: context.state.lexicalCursor,
         });
     }
-    params.state.canonicalCursor = params.linkCanonical;
-    params.state.lexicalCursor = params.linkCanonical;
+    context.state.canonicalCursor = linkCanonical;
+    context.state.lexicalCursor = linkCanonical;
 }
-function readLexicalStat(params) {
+function readLexicalStat(context, params) {
     try {
-        const stat = params.read(params.state.lexicalCursor);
+        const stat = params.read(context.state.lexicalCursor);
         if (isPromiseLike(stat)) {
-            return Promise.resolve(stat).catch((error) => handleLexicalStatReadFailure({ ...params, error }));
+            return Promise.resolve(stat).catch((error) => handleLexicalStatReadFailure(context, error, params.missingFromIndex));
         }
         return stat;
     }
     catch (error) {
-        return handleLexicalStatReadFailure({ ...params, error });
+        return handleLexicalStatReadFailure(context, error, params.missingFromIndex);
     }
 }
-function resolveAndApplySymlinkHop(params) {
-    const linkCanonical = params.resolveLinkCanonical(params.state.lexicalCursor);
+function resolveAndApplySymlinkHop(context, params) {
+    const linkCanonical = params.resolveLinkCanonical(context.state.lexicalCursor);
     if (isPromiseLike(linkCanonical)) {
-        return Promise.resolve(linkCanonical).then((value) => applyResolvedSymlinkHop({
-            state: params.state,
-            linkCanonical: value,
-            rootCanonicalPath: params.rootCanonicalPath,
-            boundaryLabel: params.boundaryLabel,
-        }));
+        return Promise.resolve(linkCanonical).then((value) => {
+            applyResolvedSymlinkHop(context, value);
+        });
     }
-    applyResolvedSymlinkHop({
-        state: params.state,
-        linkCanonical,
-        rootCanonicalPath: params.rootCanonicalPath,
-        boundaryLabel: params.boundaryLabel,
-    });
+    applyResolvedSymlinkHop(context, linkCanonical);
 }
-function applyParentTraversalStep(params) {
-    params.state.lexicalCursor = external_node_path_namespaceObject.resolve(params.state.lexicalCursor, "..");
-    advanceCanonicalCursorForSegment({
-        state: params.state,
-        segment: "..",
-        rootCanonicalPath: params.rootCanonicalPath,
-        params: params.resolveParams,
-        absolutePath: params.absolutePath,
-    });
+function applyParentTraversalStep(context) {
+    context.state.lexicalCursor = external_node_path_namespaceObject.resolve(context.state.lexicalCursor, "..");
+    advanceCanonicalCursorForSegment(context, "..");
 }
 function* iterateLexicalTraversal(state) {
     for (let idx = 0; idx < state.segments.length; idx += 1) {
@@ -2933,32 +3277,22 @@ function* iterateLexicalTraversal(state) {
     }
 }
 async function resolveRootPathLexicalAsync(params) {
-    const state = createLexicalTraversalState(params);
-    const sharedStepParams = {
-        state,
-        rootCanonicalPath: params.rootCanonicalPath,
-        resolveParams: params.params,
-        absolutePath: params.absolutePath,
-    };
+    const context = createLexicalTraversalContext(params);
+    const { state } = context;
     for (const { idx, segment, isLast } of iterateLexicalTraversal(state)) {
         if (segment === "..") {
-            applyParentTraversalStep({
-                ...sharedStepParams,
-                resolveParams: params.params,
-            });
+            applyParentTraversalStep(context);
             continue;
         }
         state.lexicalCursor = external_node_path_namespaceObject.join(state.lexicalCursor, segment);
-        const stat = await readLexicalStat({
-            ...sharedStepParams,
+        const stat = await readLexicalStat(context, {
             missingFromIndex: idx,
             read: (cursor) => promises_namespaceObject.lstat(cursor),
         });
         if (!stat) {
             break;
         }
-        const disposition = handleLexicalStatDisposition({
-            ...sharedStepParams,
+        const disposition = handleLexicalStatDisposition(context, {
             isSymbolicLink: stat.isSymbolicLink(),
             segment,
             isLast,
@@ -2969,41 +3303,29 @@ async function resolveRootPathLexicalAsync(params) {
         if (disposition === "break") {
             break;
         }
-        await resolveAndApplySymlinkHop({
-            state,
-            rootCanonicalPath: params.rootCanonicalPath,
-            boundaryLabel: params.params.boundaryLabel,
+        await resolveAndApplySymlinkHop(context, {
             resolveLinkCanonical: (cursor) => resolveSymlinkHopPath(cursor),
         });
-    }
-    const kind = await getPathKind(state.canonicalCursor, state.preserveFinalSymlink);
-    return finalizeLexicalResolution({
-        ...params,
-        state,
-        kind,
-    });
+        if (context.resolveParams.rejectSymlinks === true) {
+            throw new errors_FsSafeError("symlink", "symlink path component not allowed");
+        }
+    }
+    const kind = await getPathKind(state.canonicalCursor, state.preserveFinalSymlink);
+    return finalizeLexicalResolution(context, kind);
 }
 function resolveRootPathLexicalSync(params) {
-    const state = createLexicalTraversalState(params);
+    const context = createLexicalTraversalContext(params);
+    const { state } = context;
     for (let idx = 0; idx < state.segments.length; idx += 1) {
         const segment = state.segments[idx] ?? "";
         const isLast = idx === state.segments.length - 1;
         if (segment === "..") {
-            applyParentTraversalStep({
-                state,
-                rootCanonicalPath: params.rootCanonicalPath,
-                resolveParams: params.params,
-                absolutePath: params.absolutePath,
-            });
+            applyParentTraversalStep(context);
             continue;
         }
         state.lexicalCursor = path.join(state.lexicalCursor, segment);
-        const maybeStat = readLexicalStat({
-            state,
+        const maybeStat = readLexicalStat(context, {
             missingFromIndex: idx,
-            rootCanonicalPath: params.rootCanonicalPath,
-            resolveParams: params.params,
-            absolutePath: params.absolutePath,
             read: (cursor) => fs.lstatSync(cursor),
         });
         if (isPromiseLike(maybeStat)) {
@@ -3013,14 +3335,10 @@ function resolveRootPathLexicalSync(params) {
         if (!stat) {
             break;
         }
-        const disposition = handleLexicalStatDisposition({
-            state,
+        const disposition = handleLexicalStatDisposition(context, {
             isSymbolicLink: stat.isSymbolicLink(),
             segment,
             isLast,
-            rootCanonicalPath: params.rootCanonicalPath,
-            resolveParams: params.params,
-            absolutePath: params.absolutePath,
         });
         if (disposition === "continue") {
             continue;
@@ -3028,22 +3346,18 @@ function resolveRootPathLexicalSync(params) {
         if (disposition === "break") {
             break;
         }
-        const maybeApplied = resolveAndApplySymlinkHop({
-            state,
-            rootCanonicalPath: params.rootCanonicalPath,
-            boundaryLabel: params.params.boundaryLabel,
+        const maybeApplied = resolveAndApplySymlinkHop(context, {
             resolveLinkCanonical: (cursor) => resolveSymlinkHopPathSync(cursor),
         });
         if (isPromiseLike(maybeApplied)) {
             throw new Error("Unexpected async symlink resolution");
         }
+        if (context.resolveParams.rejectSymlinks === true) {
+            throw new FsSafeError("symlink", "symlink path component not allowed");
+        }
     }
     const kind = getPathKindSync(state.canonicalCursor, state.preserveFinalSymlink);
-    return finalizeLexicalResolution({
-        ...params,
-        state,
-        kind,
-    });
+    return finalizeLexicalResolution(context, kind);
 }
 function resolveCanonicalOutsideLexicalPath(params) {
     return params.outsideLexicalCanonicalPath ?? params.absolutePath;
@@ -3107,7 +3421,7 @@ async function resolveOutsideLexicalCanonicalPathAsync(params) {
     if (path_isPathInside(params.rootPath, params.absolutePath)) {
         return undefined;
     }
-    return await root_path_existing_resolvePathViaExistingAncestor(params.absolutePath);
+    return await resolvePathViaExistingAncestor(params.absolutePath);
 }
 function resolveOutsideLexicalCanonicalPathSync(params) {
     if (isPathInside(params.rootPath, params.absolutePath)) {
@@ -3214,39 +3528,6 @@ function pathEscapeError(params) {
 function symlinkEscapeError(params) {
     return new Error(`Symlink escapes ${params.boundaryLabel} (${shortPath(params.rootCanonicalPath)}): ${shortPath(params.symlinkPath)}`);
 }
-function shortPath(value) {
-    const home = external_node_os_namespaceObject.homedir();
-    if (value.startsWith(home)) {
-        return `~${value.slice(home.length)}`;
-    }
-    return value;
-}
-async function resolveSymlinkHopPath(symlinkPath) {
-    try {
-        return external_node_path_namespaceObject.resolve(await promises_namespaceObject.realpath(symlinkPath));
-    }
-    catch (error) {
-        if (!path_isNotFoundPathError(error)) {
-            throw error;
-        }
-        const linkTarget = await promises_namespaceObject.readlink(symlinkPath);
-        const linkAbsolute = external_node_path_namespaceObject.resolve(external_node_path_namespaceObject.dirname(symlinkPath), linkTarget);
-        return root_path_existing_resolvePathViaExistingAncestor(linkAbsolute);
-    }
-}
-function resolveSymlinkHopPathSync(symlinkPath) {
-    try {
-        return path.resolve(fs.realpathSync(symlinkPath));
-    }
-    catch (error) {
-        if (!isNotFoundPathError(error)) {
-            throw error;
-        }
-        const linkTarget = fs.readlinkSync(symlinkPath);
-        const linkAbsolute = path.resolve(path.dirname(symlinkPath), linkTarget);
-        return resolvePathViaExistingAncestorSync(linkAbsolute);
-    }
-}
 
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/path-policy.js
 
@@ -3290,14 +3571,8 @@ async function assertNoHardlinkedFinalPath(params) {
         return;
     }
     if (stat.nlink > 1) {
-        throw new Error(`Hardlinked path is not allowed under ${params.boundaryLabel} (${path_policy_shortPath(params.root)}): ${path_policy_shortPath(params.filePath)}`);
-    }
-}
-function path_policy_shortPath(value) {
-    if (value.startsWith(external_node_os_namespaceObject.homedir())) {
-        return `~${value.slice(external_node_os_namespaceObject.homedir().length)}`;
+        throw new Error(`Hardlinked path is not allowed under ${params.boundaryLabel} (${shortPath(params.root)}): ${shortPath(params.filePath)}`);
     }
-    return value;
 }
 
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/string-coerce.js
@@ -3379,6 +3654,10 @@ function hasNonEmptyString(value) {
 
 
 const ENCODED_FILE_URL_SEPARATOR_RE = /%(?:2f|5c)/i;
+const FILE_URL_PREFIX_RE = /^file:\/\//i;
+function isFileUrl(input) {
+    return FILE_URL_PREFIX_RE.test(input);
+}
 function isLocalFileUrlHost(hostname) {
     const normalized = normalizeLowercaseStringOrEmpty(hostname);
     return normalized === "" || normalized === "localhost";
@@ -3409,7 +3688,7 @@ function assertNoWindowsNetworkPath(filePath, label = "Path") {
         throw new Error(`${label} cannot use Windows network paths: ${filePath}`);
     }
 }
-function safeFileURLToPath(fileUrl) {
+function safeFileURLToPath(fileUrl, platform = process.platform) {
     let parsed;
     try {
         parsed = new external_node_url_namespaceObject.URL(fileUrl);
@@ -3426,13 +3705,15 @@ function safeFileURLToPath(fileUrl) {
     if (hasEncodedFileUrlSeparator(parsed.pathname)) {
         throw new Error(`file:// URLs cannot encode path separators: ${fileUrl}`);
     }
-    const filePath = (0,external_node_url_namespaceObject.fileURLToPath)(parsed);
-    assertNoWindowsNetworkPath(filePath, "Local file URL");
+    const filePath = (0,external_node_url_namespaceObject.fileURLToPath)(parsed, { windows: platform === "win32" });
+    if (isWindowsNetworkPath(filePath, platform)) {
+        throw new Error(`Local file URL cannot use Windows network paths: ${filePath}`);
+    }
     return filePath;
 }
-function trySafeFileURLToPath(fileUrl) {
+function trySafeFileURLToPath(fileUrl, platform = process.platform) {
     try {
-        return safeFileURLToPath(fileUrl);
+        return safeFileURLToPath(fileUrl, platform);
     }
     catch {
         return undefined;
@@ -3442,7 +3723,7 @@ function basenameFromMediaSource(source) {
     if (!source) {
         return undefined;
     }
-    if (source.startsWith("file://")) {
+    if (isFileUrl(source)) {
         const filePath = trySafeFileURLToPath(source);
         return filePath ? path.basename(filePath) || undefined : undefined;
     }
@@ -3527,11 +3808,11 @@ function trimTrailingWindowsIgnoredChars(value) {
     }
     return end === value.length ? value : value.slice(0, end);
 }
-function candidateReadPaths(filePath) {
-    if (!filePath.startsWith("file://")) {
+function candidateReadPaths(filePath, platform) {
+    if (!isFileUrl(filePath)) {
         return [filePath];
     }
-    const parsed = trySafeFileURLToPath(filePath);
+    const parsed = trySafeFileURLToPath(filePath, platform);
     return parsed === undefined ? [filePath] : [filePath, parsed];
 }
 function normalizePosixPath(filePath, cwd) {
@@ -3574,7 +3855,7 @@ function matchWindowsDeviceReadPath(filePath) {
 }
 function matchUnsafeDeviceReadPath(filePath, options = {}) {
     const platform = options.platform ?? process.platform;
-    for (const candidate of candidateReadPaths(filePath)) {
+    for (const candidate of candidateReadPaths(filePath, platform)) {
         const match = platform === "win32"
             ? matchWindowsDeviceReadPath(candidate)
             : matchPosixDeviceReadPath(candidate, options.cwd);
@@ -3611,23 +3892,6 @@ async function read_opened_file_readOpenedFileSafely(params) {
     };
 }
 
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/path-stat.js
-function pathStatFromStats(stat) {
-    return {
-        dev: Number(stat.dev),
-        gid: Number(stat.gid),
-        ino: Number(stat.ino),
-        isDirectory: stat.isDirectory(),
-        isFile: stat.isFile(),
-        isSymbolicLink: stat.isSymbolicLink(),
-        mode: stat.mode,
-        mtimeMs: stat.mtimeMs,
-        nlink: stat.nlink,
-        size: stat.size,
-        uid: stat.uid,
-    };
-}
-
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/home-dir.js
 
 
@@ -3750,10 +4014,19 @@ function resolveOsHomeRelativePath(input, opts) {
 
 
 
+
+
+
 const ensureTrailingSep = (value) => value.endsWith(external_node_path_namespaceObject.sep) ? value : value + external_node_path_namespaceObject.sep;
 function assertValidRootRelativePath(relativePath) {
     path_assertNoNulPathInput(relativePath, "relative path contains a NUL byte");
 }
+function assertValidRootDestinationPath(relativePath) {
+    assertValidRootRelativePath(relativePath);
+    if (safe_path_segment_isDriveRelativePath(relativePath)) {
+        throw new errors_FsSafeError("invalid-path", "relative path must not start with a drive letter");
+    }
+}
 let cachedHomePath;
 async function expandRelativePathWithHome(relativePath) {
     const rawHome = process.env.HOME || process.env.USERPROFILE || external_node_os_namespaceObject.homedir();
@@ -3772,12 +4045,14 @@ async function expandRelativePathWithHome(relativePath) {
 async function resolveRootContext(rootDir) {
     path_assertNoNulPathInput(rootDir, "root dir contains a NUL byte");
     let rootReal;
+    let rootIdentity;
     try {
         rootReal = await promises_namespaceObject.realpath(rootDir);
         const rootStat = await promises_namespaceObject.stat(rootReal);
         if (!rootStat.isDirectory()) {
             throw new errors_FsSafeError("invalid-path", "root dir is not a directory");
         }
+        rootIdentity = { dev: rootStat.dev, ino: rootStat.ino };
     }
     catch (err) {
         if (err instanceof errors_FsSafeError) {
@@ -3790,16 +4065,37 @@ async function resolveRootContext(rootDir) {
     }
     return {
         rootDir: external_node_path_namespaceObject.resolve(rootDir),
+        rootIdentity,
         rootReal,
         rootWithSep: ensureTrailingSep(rootReal),
     };
 }
+async function assertRootIdentityCurrent(root) {
+    let current;
+    try {
+        current = await promises_namespaceObject.lstat(root.rootReal);
+    }
+    catch (error) {
+        throw new errors_FsSafeError("path-mismatch", "root path changed during operation", {
+            cause: error instanceof Error ? error : undefined,
+        });
+    }
+    if (current.isSymbolicLink() ||
+        !current.isDirectory() ||
+        !file_identity_sameFileIdentity(current, root.rootIdentity)) {
+        throw new errors_FsSafeError("path-mismatch", "root path changed during operation");
+    }
+}
 async function resolvePathInRoot(root, relativePath, options) {
     assertValidRootRelativePath(relativePath);
+    await assertRootIdentityCurrent(root);
     const expanded = await expandRelativePathWithHome(relativePath);
     const resolved = external_node_path_namespaceObject.resolve(root.rootWithSep, expanded);
     if (!path_isPathInside(root.rootWithSep, resolved)) {
-        throw new errors_FsSafeError("outside-workspace", "file is outside workspace root");
+        throw outsideWorkspaceError();
+    }
+    if (options?.rejectUnsafeDeviceReads === true) {
+        assertNoUnsafeDeviceReadPath(resolved);
     }
     const rawAbsolutePath = external_node_path_namespaceObject.isAbsolute(expanded)
         ? expanded
@@ -3811,9 +4107,18 @@ async function resolvePathInRoot(root, relativePath, options) {
             rootCanonicalPath: root.rootReal,
             boundaryLabel: "root",
             policy: options?.allowFinalSymlink ? ROOT_PATH_ALIAS_POLICIES.unlinkTarget : undefined,
+            rejectSymlinks: options?.rejectSymlinks,
         });
     }
     catch (error) {
+        if (error instanceof errors_FsSafeError && error.code === "symlink") {
+            throw error;
+        }
+        if (hasNodeErrorCode(error, "ENAMETOOLONG")) {
+            throw new errors_FsSafeError("invalid-path", "relative path is too long", {
+                cause: error instanceof Error ? error : undefined,
+            });
+        }
         const code = options?.aliasErrorCode ?? "outside-workspace";
         throw new errors_FsSafeError(code, code === "path-alias" ? "path alias escape blocked" : "file is outside workspace root", {
             cause: error instanceof Error ? error : undefined,
@@ -3825,29 +4130,6 @@ async function resolvePathWithinRoot(params) {
     return await resolvePathInRoot(await resolveRootContext(params.rootDir), params.relativePath);
 }
 
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/root-errors.js
-
-
-function isAlreadyExistsError(error) {
-    return hasNodeErrorCode(error, "EEXIST") || /File exists|EEXIST/i.test(String(error));
-}
-function normalizePinnedWriteError(error) {
-    if (error instanceof errors_FsSafeError) {
-        return error;
-    }
-    return new errors_FsSafeError("invalid-path", "path is not a regular file under root", {
-        cause: error instanceof Error ? error : undefined,
-    });
-}
-function normalizePinnedPathError(error) {
-    if (error instanceof errors_FsSafeError) {
-        return error;
-    }
-    return new errors_FsSafeError("path-alias", "path is not under root", {
-        cause: error instanceof Error ? error : undefined,
-    });
-}
-
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/json-stringify.js
 function stringifyJsonDocument(value, replacer, space) {
     const text = JSON.stringify(value, replacer, space);
@@ -3882,6 +4164,17 @@ function limitEntry(relativePath) {
     return { relativePath, kind: "truncated", size: 0 };
 }
 async function* walkRoot(root, relativePath, options) {
+    if (!["skip", "follow-within-root"].includes(options.symlinkPolicy)) {
+        throw new TypeError(`invalid root walk symlink policy: ${String(options.symlinkPolicy)}`);
+    }
+    if (options.limitBehavior !== undefined &&
+        !["truncate", "throw"].includes(options.limitBehavior)) {
+        throw new TypeError(`invalid root walk limit behavior: ${String(options.limitBehavior)}`);
+    }
+    if (options.onDirectoryError !== undefined &&
+        !["throw", "skip-and-report"].includes(options.onDirectoryError)) {
+        throw new TypeError(`invalid root walk directory error behavior: ${String(options.onDirectoryError)}`);
+    }
     const maxDepth = validateBudget("maxDepth", options.maxDepth);
     const maxEntries = validateBudget("maxEntries", options.maxEntries);
     const visitedDirectories = new Set();
@@ -3909,17 +4202,21 @@ async function* walkRoot(root, relativePath, options) {
                 return;
             }
             visitedDirectories.add(resolvedDirectory.canonicalPath);
+            options.signal?.throwIfAborted();
             const listingDirectory = external_node_path_namespaceObject.relative(root.rootReal, resolvedDirectory.canonicalPath)
                 .split(external_node_path_namespaceObject.sep)
                 .join(external_node_path_namespaceObject.posix.sep);
             entries = await root.list(listingDirectory, { withFileTypes: true });
         }
         catch (error) {
+            // Cancellation is never a recoverable directory read failure.
+            options.signal?.throwIfAborted();
             if ((options.onDirectoryError ?? "throw") === "throw")
                 throw error;
             yield { relativePath: directory, kind: "directory-error", size: 0, error };
             return;
         }
+        options.signal?.throwIfAborted();
         for (const entry of entries) {
             options.signal?.throwIfAborted();
             const child = directory
@@ -4100,11 +4397,11 @@ function logWarn(message) {
     }
 }
 const SUPPORTS_NOFOLLOW = process.platform !== "win32" && "O_NOFOLLOW" in external_node_fs_namespaceObject.constants;
-const NONBLOCK_OPEN_FLAG = "O_NONBLOCK" in external_node_fs_namespaceObject.constants ? external_node_fs_namespaceObject.constants.O_NONBLOCK : 0;
-const OPEN_READ_FLAGS = external_node_fs_namespaceObject.constants.O_RDONLY | (SUPPORTS_NOFOLLOW ? external_node_fs_namespaceObject.constants.O_NOFOLLOW : 0);
-const OPEN_READ_NONBLOCK_FLAGS = OPEN_READ_FLAGS | NONBLOCK_OPEN_FLAG;
-const OPEN_READ_FOLLOW_FLAGS = external_node_fs_namespaceObject.constants.O_RDONLY;
-const OPEN_READ_FOLLOW_NONBLOCK_FLAGS = OPEN_READ_FOLLOW_FLAGS | NONBLOCK_OPEN_FLAG;
+const NONBLOCK_OPEN_FLAG = process.platform !== "win32" && "O_NONBLOCK" in external_node_fs_namespaceObject.constants ? external_node_fs_namespaceObject.constants.O_NONBLOCK : 0;
+const OPEN_READ_FLAGS = external_node_fs_namespaceObject.constants.O_RDONLY |
+    (SUPPORTS_NOFOLLOW ? external_node_fs_namespaceObject.constants.O_NOFOLLOW : 0) |
+    NONBLOCK_OPEN_FLAG;
+const OPEN_READ_FOLLOW_FLAGS = external_node_fs_namespaceObject.constants.O_RDONLY | NONBLOCK_OPEN_FLAG;
 const OPEN_WRITE_EXISTING_FLAGS = external_node_fs_namespaceObject.constants.O_WRONLY | (SUPPORTS_NOFOLLOW ? external_node_fs_namespaceObject.constants.O_NOFOLLOW : 0);
 const OPEN_WRITE_CREATE_FLAGS = external_node_fs_namespaceObject.constants.O_WRONLY |
     external_node_fs_namespaceObject.constants.O_CREAT |
@@ -4117,6 +4414,21 @@ const OPEN_APPEND_CREATE_FLAGS = external_node_fs_namespaceObject.constants.O_RD
     external_node_fs_namespaceObject.constants.O_EXCL |
     (SUPPORTS_NOFOLLOW ? external_node_fs_namespaceObject.constants.O_NOFOLLOW : 0);
 const DEFAULT_ROOT_MAX_BYTES = 16 * 1024 * 1024;
+function pathStatFromStats(stat) {
+    return {
+        dev: Number(stat.dev),
+        gid: Number(stat.gid),
+        ino: Number(stat.ino),
+        isDirectory: stat.isDirectory(),
+        isFile: stat.isFile(),
+        isSymbolicLink: stat.isSymbolicLink(),
+        mode: stat.mode,
+        mtimeMs: stat.mtimeMs,
+        nlink: stat.nlink,
+        size: stat.size,
+        uid: stat.uid,
+    };
+}
 function openResult(params) {
     return {
         handle: params.handle,
@@ -4129,11 +4441,15 @@ function openResult(params) {
 async function openVerifiedLocalFile(filePath, options) {
     assertNoUnsafeDeviceReadPath(filePath);
     const fsSafeTestHooks = getFsSafeTestHooks();
+    let preOpenStat;
     // Reject directories before opening so we never surface EISDIR to callers (e.g. tool
     // results that get sent to messaging channels). See openclaw/openclaw#31186.
     try {
-        const preStat = await promises_namespaceObject.lstat(filePath);
-        if (preStat.isDirectory()) {
+        preOpenStat = await promises_namespaceObject.lstat(filePath);
+        if (preOpenStat.isSymbolicLink() && options?.symlinks !== "follow-within-root") {
+            throw new errors_FsSafeError("symlink", "symlink not allowed");
+        }
+        if (!preOpenStat.isFile() && !preOpenStat.isSymbolicLink()) {
             throw new errors_FsSafeError("not-file", "not a file");
         }
         await fsSafeTestHooks?.afterPreOpenLstat?.(filePath);
@@ -4147,12 +4463,8 @@ async function openVerifiedLocalFile(filePath, options) {
     let handle;
     try {
         const openFlags = options?.symlinks === "follow-within-root"
-            ? options?.nonBlockingRead
-                ? OPEN_READ_FOLLOW_NONBLOCK_FLAGS
-                : OPEN_READ_FOLLOW_FLAGS
-            : options?.nonBlockingRead
-                ? OPEN_READ_NONBLOCK_FLAGS
-                : OPEN_READ_FLAGS;
+            ? OPEN_READ_FOLLOW_FLAGS
+            : OPEN_READ_FLAGS;
         await fsSafeTestHooks?.beforeOpen?.(filePath, openFlags);
         handle = await promises_namespaceObject.open(filePath, openFlags);
         try {
@@ -4165,7 +4477,7 @@ async function openVerifiedLocalFile(filePath, options) {
     }
     catch (err) {
         if (path_isNotFoundPathError(err)) {
-            throw new errors_FsSafeError("not-found", "file not found");
+            throw fileNotFoundError();
         }
         if (isSymlinkOpenError(err)) {
             throw new errors_FsSafeError("symlink", "symlink open blocked", { cause: err });
@@ -4181,8 +4493,13 @@ async function openVerifiedLocalFile(filePath, options) {
         if (!stat.isFile()) {
             throw new errors_FsSafeError("not-file", "not a file");
         }
+        if (preOpenStat &&
+            !preOpenStat.isSymbolicLink() &&
+            !file_identity_sameFileIdentity(stat, preOpenStat)) {
+            throw new errors_FsSafeError("path-mismatch", "path changed before open");
+        }
         if (options?.hardlinks === "reject" && stat.nlink > 1) {
-            throw new errors_FsSafeError("hardlink", "hardlinked path not allowed");
+            throw hardlinkedPathNotAllowedError();
         }
         if (options?.symlinks === "follow-within-root") {
             const pathStat = await promises_namespaceObject.stat(filePath);
@@ -4202,7 +4519,7 @@ async function openVerifiedLocalFile(filePath, options) {
         const realPath = await resolveOpenedFileRealPathForHandle(handle, filePath);
         const realStat = await promises_namespaceObject.stat(realPath);
         if (options?.hardlinks === "reject" && realStat.nlink > 1) {
-            throw new errors_FsSafeError("hardlink", "hardlinked path not allowed");
+            throw hardlinkedPathNotAllowedError();
         }
         if (!file_identity_sameFileIdentity(stat, realStat)) {
             throw new errors_FsSafeError("path-mismatch", "path mismatch");
@@ -4215,17 +4532,19 @@ async function openVerifiedLocalFile(filePath, options) {
             throw err;
         }
         if (path_isNotFoundPathError(err)) {
-            throw new errors_FsSafeError("not-found", "file not found");
+            throw fileNotFoundError();
         }
         throw err;
     }
 }
 class RootHandle {
+    rootIdentity;
     rootDir;
     rootReal;
     rootWithSep;
     defaults;
     constructor(context, defaults = {}) {
+        this.rootIdentity = context.rootIdentity;
         this.rootDir = context.rootDir;
         this.rootReal = context.rootReal;
         this.rootWithSep = context.rootWithSep;
@@ -4234,11 +4553,19 @@ class RootHandle {
     get context() {
         return {
             rootDir: this.rootDir,
+            rootIdentity: this.rootIdentity,
             rootReal: this.rootReal,
             rootWithSep: this.rootWithSep,
         };
     }
+    mutationOptions(options) {
+        return {
+            ...options,
+            denyMutations: mergeDenyMutationPolicies(this.defaults.denyMutations, options.denyMutations),
+        };
+    }
     async resolve(relativePath) {
+        assertValidRootDestinationPath(relativePath);
         return (await resolvePathInRoot(this.context, relativePath, { allowFinalSymlink: true })).resolved;
     }
     async open(relativePath, options = {}) {
@@ -4278,67 +4605,67 @@ class RootHandle {
         };
     }
     async openWritable(relativePath, options = {}) {
+        assertValidRootDestinationPath(relativePath);
         const writeMode = options.writeMode ?? "replace";
         return await openWritableFileInRoot(this.context, {
             relativePath,
             mkdir: this.defaults.mkdir,
             mode: this.defaults.mode,
-            ...options,
-            denyMutations: mergeDenyMutationPolicies(this.defaults.denyMutations, options.denyMutations),
+            ...this.mutationOptions(options),
             append: writeMode === "append",
             truncateExisting: writeMode === "replace",
         });
     }
     async append(relativePath, data, options = {}) {
+        assertValidRootDestinationPath(relativePath);
         await appendFileInRoot(this.context, {
             relativePath,
             data,
             mkdir: this.defaults.mkdir,
             mode: this.defaults.mode,
-            ...options,
-            denyMutations: mergeDenyMutationPolicies(this.defaults.denyMutations, options.denyMutations),
+            ...this.mutationOptions(options),
         });
     }
     async remove(relativePath, options = {}) {
         assertValidRootRelativePath(relativePath);
         await removePathInRoot(this.context, {
             relativePath,
-            denyMutations: mergeDenyMutationPolicies(this.defaults.denyMutations, options.denyMutations),
+            ...this.mutationOptions(options),
         });
     }
     async mkdir(relativePath, options = {}) {
-        assertValidRootRelativePath(relativePath);
+        assertValidRootDestinationPath(relativePath);
         await mkdirPathInRoot(this.context, {
             relativePath,
-            denyMutations: mergeDenyMutationPolicies(this.defaults.denyMutations, options.denyMutations),
+            ...this.mutationOptions(options),
         });
     }
     async ensureRoot(options = {}) {
         await mkdirPathInRoot(this.context, {
             relativePath: "",
             allowRoot: true,
-            denyMutations: mergeDenyMutationPolicies(this.defaults.denyMutations, options.denyMutations),
+            ...this.mutationOptions(options),
         });
     }
     async write(relativePath, data, options = {}) {
+        assertValidRootDestinationPath(relativePath);
         await writeFileInRoot(this.context, {
             relativePath,
             data,
             mkdir: this.defaults.mkdir,
             mode: this.defaults.mode,
             renameIdentity: this.defaults.renameIdentity,
-            ...options,
-            denyMutations: mergeDenyMutationPolicies(this.defaults.denyMutations, options.denyMutations),
+            ...this.mutationOptions(options),
         });
     }
     async create(relativePath, data, options = {}) {
+        assertValidRootDestinationPath(relativePath);
         await writeFileInRoot(this.context, {
             relativePath,
             data,
             mkdir: this.defaults.mkdir,
             mode: this.defaults.mode,
-            ...options,
-            denyMutations: mergeDenyMutationPolicies(this.defaults.denyMutations, options.denyMutations),
+            ...this.mutationOptions(options),
             overwrite: false,
         });
     }
@@ -4353,15 +4680,14 @@ class RootHandle {
         await this.create(relativePath, trailingNewline ? `${json}\n` : json, writeOptions);
     }
     async copyIn(relativePath, sourcePath, options = {}) {
-        assertValidRootRelativePath(relativePath);
+        assertValidRootDestinationPath(relativePath);
         await copyFileInRoot(this.context, {
             sourcePath,
             relativePath,
             maxBytes: this.defaults.maxBytes,
             mkdir: this.defaults.mkdir,
             mode: this.defaults.mode,
-            ...options,
-            denyMutations: mergeDenyMutationPolicies(this.defaults.denyMutations, options.denyMutations),
+            ...this.mutationOptions(options),
         });
     }
     async exists(relativePath) {
@@ -4388,9 +4714,9 @@ class RootHandle {
     }
     async move(fromRelative, toRelative, options = {}) {
         assertValidRootRelativePath(fromRelative);
-        assertValidRootRelativePath(toRelative);
+        assertValidRootDestinationPath(toRelative);
         validatePinnedOperationPayload({ from: fromRelative, to: toRelative });
-        const denyMutations = mergeDenyMutationPolicies(this.defaults.denyMutations, options.denyMutations);
+        const { denyMutations } = this.mutationOptions(options);
         await assertMoveMutationAllowed(this.context, {
             fromRelative,
             toRelative,
@@ -4422,6 +4748,8 @@ async function root_impl_root(rootDir, defaults = {}) {
 async function openFileInRoot(root, params) {
     const { rootWithSep, resolved } = await resolvePathInRoot(root, params.relativePath, {
         allowFinalSymlink: true,
+        rejectUnsafeDeviceReads: true,
+        rejectSymlinks: params.symlinks !== "follow-within-root",
     });
     let opened;
     try {
@@ -4438,11 +4766,11 @@ async function openFileInRoot(root, params) {
     }
     if (params.hardlinks !== "allow" && opened.stat.nlink > 1) {
         await opened.handle.close().catch(() => { });
-        throw new errors_FsSafeError("hardlink", "hardlinked path not allowed");
+        throw hardlinkedPathNotAllowedError();
     }
     if (!path_isPathInside(rootWithSep, opened.realPath)) {
         await opened.handle.close().catch(() => { });
-        throw new errors_FsSafeError("outside-workspace", "file is outside workspace root");
+        throw outsideWorkspaceError();
     }
     return opened;
 }
@@ -4524,33 +4852,47 @@ async function verifyAtomicWriteResult(params) {
             throw new errors_FsSafeError("path-mismatch", "path changed during write");
         }
         if (!path_isPathInside(params.root.rootWithSep, opened.realPath)) {
-            throw new errors_FsSafeError("outside-workspace", "file is outside workspace root");
+            throw outsideWorkspaceError();
         }
     }
     finally {
         await opened.handle.close().catch(() => { });
     }
 }
-async function openWritableFileInRoot(root, params) {
-    const { rootReal, rootWithSep, resolved } = await resolvePathInRoot(root, params.relativePath, { aliasErrorCode: "path-alias" });
-    await assertMutationNotDenied(resolved, params.denyMutations);
-    try {
-        await assertNoPathAliasEscape({
-            absolutePath: resolved,
-            rootPath: rootReal,
-            boundaryLabel: "root",
-        });
-    }
-    catch (err) {
-        throw new errors_FsSafeError("path-alias", "path alias escape blocked", { cause: err });
+async function resolveGuardedWritePathInRoot(root, params) {
+    const resolvedPath = await resolvePathInRoot(root, params.relativePath, {
+        aliasErrorCode: "path-alias",
+        allowFinalSymlink: params.allowFinalSymlink,
+    });
+    await assertMutationNotDenied(resolvedPath.resolved, params.denyMutations, params.protectDeniedAncestors ? { protectAncestors: true } : undefined);
+    if (await (params.shouldAssertNoPathAlias?.(resolvedPath) ?? true)) {
+        try {
+            await assertNoPathAliasEscape({
+                absolutePath: resolvedPath.resolved,
+                rootPath: resolvedPath.rootReal,
+                boundaryLabel: "root",
+            });
+        }
+        catch (error) {
+            throw new errors_FsSafeError("path-alias", "path alias escape blocked", {
+                cause: error instanceof Error ? error : undefined,
+            });
+        }
     }
+    return resolvedPath;
+}
+async function openWritableFileInRoot(root, params) {
+    const { rootReal, rootWithSep, resolved } = await resolveGuardedWritePathInRoot(root, {
+        relativePath: params.relativePath,
+        denyMutations: params.denyMutations,
+    });
     let ioPath = params.mkdir === false
         ? resolved
         : await prepareRootWriteTarget(rootReal, resolved);
     try {
         const resolvedRealPath = await promises_namespaceObject.realpath(ioPath);
         if (!path_isPathInside(rootWithSep, resolvedRealPath)) {
-            throw new errors_FsSafeError("outside-workspace", "file is outside workspace root");
+            throw outsideWorkspaceError();
         }
         ioPath = resolvedRealPath;
     }
@@ -4581,7 +4923,7 @@ async function openWritableFileInRoot(root, params) {
     }
     catch (err) {
         if (path_isNotFoundPathError(err)) {
-            throw new errors_FsSafeError("not-found", "file not found");
+            throw fileNotFoundError();
         }
         if (isSymlinkOpenError(err)) {
             throw new errors_FsSafeError("symlink", "symlink open blocked", { cause: err });
@@ -4592,13 +4934,17 @@ async function openWritableFileInRoot(root, params) {
         throw err;
     }
     let realPathForCleanup = null;
+    let createdIdentity = null;
     try {
         const stat = await handle.stat();
+        if (createdForWrite) {
+            createdIdentity = stat;
+        }
         if (!stat.isFile()) {
-            throw new errors_FsSafeError("invalid-path", "path is not a regular file under root");
+            throw new errors_FsSafeError("not-file", "path is not a regular file under root");
         }
         if (stat.nlink > 1) {
-            throw new errors_FsSafeError("hardlink", "hardlinked path not allowed");
+            throw hardlinkedPathNotAllowedError();
         }
         try {
             const lstat = await promises_namespaceObject.lstat(ioPath);
@@ -4621,10 +4967,10 @@ async function openWritableFileInRoot(root, params) {
             throw new errors_FsSafeError("path-mismatch", "path mismatch");
         }
         if (realStat.nlink > 1) {
-            throw new errors_FsSafeError("hardlink", "hardlinked path not allowed");
+            throw hardlinkedPathNotAllowedError();
         }
         if (!path_isPathInside(rootWithSep, realPath)) {
-            throw new errors_FsSafeError("outside-workspace", "file is outside workspace root");
+            throw outsideWorkspaceError();
         }
         // Truncate only after boundary and identity checks complete. This avoids
         // irreversible side effects if a symlink target changes before validation.
@@ -4644,8 +4990,8 @@ async function openWritableFileInRoot(root, params) {
         const cleanupCreatedPath = createdForWrite && err instanceof errors_FsSafeError;
         const cleanupPath = realPathForCleanup ?? ioPath;
         await handle.close().catch(() => { });
-        if (cleanupCreatedPath) {
-            await promises_namespaceObject.rm(cleanupPath, { force: true }).catch(() => { });
+        if (cleanupCreatedPath && createdIdentity) {
+            await removePathIfIdentityUnchanged(cleanupPath, createdIdentity).catch(() => { });
         }
         throw err;
     }
@@ -4690,7 +5036,11 @@ async function appendFileInRoot(root, params) {
 }
 async function removePathInRoot(root, params) {
     validatePinnedOperationPayload({ relativePath: params.relativePath });
-    const resolved = await resolvePinnedRemovePathInRoot(root, params.relativePath, params.denyMutations);
+    const resolved = await resolvePinnedPathInRoot(root, {
+        relativePath: params.relativePath,
+        denyMutations: params.denyMutations,
+        remove: true,
+    });
     try {
         await removePathFallback(resolved);
     }
@@ -4709,15 +5059,16 @@ async function mkdirPathInRoot(root, params) {
     }
 }
 async function writeFileInRoot(root, params) {
-    if (process.platform === "win32") {
-        await serializePathWrite(rootWriteQueueKey(root, params.relativePath), async () => {
+    await serializePathWrite(rootWriteQueueKey(root, params.relativePath), async () => {
+        if (process.platform === "win32" &&
+            (params.renameIdentity === "verify-content-with-lock" || !getNativeBinding())) {
             await writeFileFallback(root, params);
+            return;
+        }
+        const pinned = await resolvePinnedWriteTargetInRoot(root, params.relativePath, params.mode, params.denyMutations);
+        await serializePathWrite(pinned.targetPath, async () => {
+            await commitPinnedWriteInRoot(root, pinned, params);
         });
-        return;
-    }
-    const pinned = await resolvePinnedWriteTargetInRoot(root, params.relativePath, params.mode, params.denyMutations);
-    await serializePathWrite(pinned.targetPath, async () => {
-        await commitPinnedWriteInRoot(root, pinned, params);
     });
 }
 async function commitPinnedWriteInRoot(root, pinned, params) {
@@ -4733,6 +5084,7 @@ async function commitPinnedWriteInRoot(root, pinned, params) {
             mode: params.mode ?? pinned.mode,
             overwrite: params.overwrite,
             input: { kind: "buffer", data: params.data, encoding: params.encoding },
+            rootIdentity: root.rootIdentity,
         });
     }
     catch (error) {
@@ -4770,26 +5122,35 @@ async function copyFileInRoot(root, params) {
         throw new errors_FsSafeError("too-large", `file exceeds limit of ${params.maxBytes} bytes (got ${source.stat.size})`);
     }
     try {
-        const pinned = await resolvePinnedWriteTargetInRoot(root, params.relativePath, params.mode, params.denyMutations);
-        await serializePathWrite(pinned.targetPath, async () => {
-            await assertCopySourceCurrent(source);
-            const identity = await runPinnedWriteHelper({
-                rootPath: pinned.rootReal,
-                relativeParentPath: pinned.relativeParentPath,
-                basename: pinned.basename,
-                mkdir: params.mkdir !== false,
-                mode: pinned.mode,
-                overwrite: true,
-                maxBytes: params.maxBytes,
-                input: { kind: "stream", stream: source.handle.createReadStream() },
+        await serializePathWrite(rootWriteQueueKey(root, params.relativePath), async () => {
+            const pinned = await resolvePinnedWriteTargetInRoot(root, params.relativePath, params.mode, params.denyMutations);
+            await serializePathWrite(pinned.targetPath, async () => {
+                await assertCopySourceCurrent(source);
+                let identity;
+                try {
+                    identity = await runPinnedWriteHelper({
+                        rootPath: pinned.rootReal,
+                        relativeParentPath: pinned.relativeParentPath,
+                        basename: pinned.basename,
+                        mkdir: params.mkdir !== false,
+                        mode: pinned.mode,
+                        overwrite: true,
+                        maxBytes: params.maxBytes,
+                        input: { kind: "stream", stream: source.handle.createReadStream() },
+                        rootIdentity: root.rootIdentity,
+                    });
+                }
+                catch (error) {
+                    throw normalizePinnedWriteError(error);
+                }
+                try {
+                    await assertCopySourcePathCurrent(source);
+                }
+                catch (error) {
+                    await removePathIfIdentityUnchanged(pinned.targetPath, identity).catch(() => undefined);
+                    throw error;
+                }
             });
-            try {
-                await assertCopySourcePathCurrent(source);
-            }
-            catch (error) {
-                await removeCopyTargetIfUnchanged(pinned.targetPath, identity).catch(() => undefined);
-                throw error;
-            }
         });
     }
     finally {
@@ -4809,7 +5170,7 @@ async function assertCopySourcePathCurrent(source) {
         throw new errors_FsSafeError("path-mismatch", "copy source path changed");
     }
 }
-async function removeCopyTargetIfUnchanged(targetPath, identity) {
+async function removePathIfIdentityUnchanged(targetPath, identity) {
     const parentGuard = await directory_guard_createAsyncDirectoryGuard(external_node_path_namespaceObject.dirname(targetPath));
     const current = await promises_namespaceObject.lstat(targetPath);
     if (current.isSymbolicLink() || !file_identity_sameFileIdentity(current, identity)) {
@@ -4820,25 +5181,15 @@ async function removeCopyTargetIfUnchanged(targetPath, identity) {
     });
 }
 async function resolvePinnedWriteTargetInRoot(root, relativePath, requestedMode, denyMutations) {
-    const { rootReal, rootWithSep, resolved } = await resolvePathInRoot(root, relativePath, {
-        aliasErrorCode: "path-alias",
+    const { rootReal, rootWithSep, resolved } = await resolveGuardedWritePathInRoot(root, {
+        relativePath,
+        denyMutations,
     });
-    await assertMutationNotDenied(resolved, denyMutations);
-    try {
-        await assertNoPathAliasEscape({
-            absolutePath: resolved,
-            rootPath: rootReal,
-            boundaryLabel: "root",
-        });
-    }
-    catch (err) {
-        throw new errors_FsSafeError("path-alias", "path alias escape blocked", { cause: err });
-    }
     // resolvePathInRoot already enforces isPathInside, so any actual escape
     // is rejected upstream.
     const relativeResolved = external_node_path_namespaceObject.relative(rootReal, resolved);
     if (external_node_path_namespaceObject.isAbsolute(relativeResolved)) {
-        throw new errors_FsSafeError("outside-workspace", "file is outside workspace root");
+        throw outsideWorkspaceError();
     }
     const relativePosix = relativeResolved
         ? relativeResolved.split(external_node_path_namespaceObject.sep).join(external_node_path_namespaceObject.posix.sep)
@@ -4853,11 +5204,12 @@ async function resolvePinnedWriteTargetInRoot(root, relativePath, requestedMode,
             relativePath,
             hardlinks: "reject",
             nonBlockingRead: true,
+            symlinks: "follow-within-root",
         });
         try {
             mode = requestedMode ?? (opened.stat.mode & 0o777);
             if (!path_isPathInside(rootWithSep, opened.realPath)) {
-                throw new errors_FsSafeError("outside-workspace", "file is outside workspace root");
+                throw outsideWorkspaceError();
             }
         }
         finally {
@@ -4881,17 +5233,9 @@ async function resolvePinnedPathInRoot(root, params) {
     return await resolvePinnedOperationPathInRoot(root, {
         allowRoot: params.allowRoot,
         denyMutations: params.denyMutations,
-        protectDenyMutationAncestors: false,
+        protectDenyMutationAncestors: params.remove === true,
         relativePath: params.relativePath,
-        policy: PATH_ALIAS_POLICIES.strict,
-    });
-}
-async function resolvePinnedRemovePathInRoot(root, relativePath, denyMutations) {
-    return await resolvePinnedOperationPathInRoot(root, {
-        denyMutations,
-        protectDenyMutationAncestors: true,
-        relativePath,
-        policy: PATH_ALIAS_POLICIES.unlinkTarget,
+        policy: params.remove ? PATH_ALIAS_POLICIES.unlinkTarget : PATH_ALIAS_POLICIES.strict,
     });
 }
 async function resolvePinnedOperationPathInRoot(root, params) {
@@ -4909,11 +5253,11 @@ async function resolvePinnedOperationPathInRoot(root, params) {
         relativeResolved === "." ||
         firstSegment === ".." ||
         external_node_path_namespaceObject.isAbsolute(relativeResolved)) {
-        throw new errors_FsSafeError("outside-workspace", "file is outside workspace root");
+        throw outsideWorkspaceError();
     }
     const relativePosix = relativeResolved.split(external_node_path_namespaceObject.sep).join(external_node_path_namespaceObject.posix.sep);
     if (!path_isPathInside(resolved.rootWithSep, resolved.canonicalPath)) {
-        throw new errors_FsSafeError("outside-workspace", "file is outside workspace root");
+        throw outsideWorkspaceError();
     }
     await assertMutationNotDenied(resolved.canonicalPath, params.denyMutations, {
         protectAncestors: params.protectDenyMutationAncestors,
@@ -4921,6 +5265,7 @@ async function resolvePinnedOperationPathInRoot(root, params) {
     return { rootReal: resolved.rootReal, resolved: resolved.canonicalPath, relativePosix };
 }
 async function resolvePinnedRootPathInRoot(root, params) {
+    await assertRootIdentityCurrent(root);
     const rootReal = root.rootReal;
     let resolved;
     try {
@@ -4945,11 +5290,25 @@ async function resolvePinnedRootPathInRoot(root, params) {
         canonicalPath: resolved.canonicalPath,
     };
 }
+async function prepareRemoveGuard(targetPath) {
+    try {
+        const guard = await directory_guard_createAsyncDirectoryGuard(external_node_path_namespaceObject.dirname(targetPath));
+        await getFsSafeTestHooks()?.beforeRootFallbackMutation?.("remove", targetPath);
+        await assertAsyncDirectoryGuard(guard);
+        return guard;
+    }
+    catch (error) {
+        throw normalizeRemoveGuardError(error);
+    }
+}
 async function removePathFallback(resolved) {
-    const guard = await directory_guard_createAsyncDirectoryGuard(external_node_path_namespaceObject.dirname(resolved.resolved));
-    await getFsSafeTestHooks()?.beforeRootFallbackMutation?.("remove", resolved.resolved);
-    await assertAsyncDirectoryGuard(guard);
-    await ((await promises_namespaceObject.lstat(resolved.resolved)).isDirectory() ? promises_namespaceObject.rmdir(resolved.resolved) : promises_namespaceObject.rm(resolved.resolved));
+    const guard = await prepareRemoveGuard(resolved.resolved);
+    try {
+        await ((await promises_namespaceObject.lstat(resolved.resolved)).isDirectory() ? promises_namespaceObject.rmdir(resolved.resolved) : promises_namespaceObject.rm(resolved.resolved));
+    }
+    catch (error) {
+        throw normalizeRemovePathError(error);
+    }
     await assertAsyncDirectoryGuard(guard).catch(() => undefined);
 }
 async function mkdirPathFallback(resolved) {
@@ -4961,13 +5320,13 @@ async function mkdirPathFallback(resolved) {
 async function statPathFallback(root, relativePath) {
     const resolved = await resolvePinnedPathInRoot(root, { relativePath, allowRoot: true });
     try {
-        return pathStatFromStats(await promises_namespaceObject.lstat(resolved.resolved));
+        const stat = pathStatFromStats(await promises_namespaceObject.lstat(resolved.resolved));
+        await assertRootIdentityCurrent(root);
+        return stat;
     }
     catch (error) {
         if (path_isNotFoundPathError(error)) {
-            throw new errors_FsSafeError("not-found", "file not found", {
-                cause: error instanceof Error ? error : undefined,
-            });
+            throw fileNotFoundError(error instanceof Error ? error : undefined);
         }
         throw error;
     }
@@ -4978,6 +5337,7 @@ async function listPathFallback(root, relativePath, withFileTypes) {
         const names = await promises_namespaceObject.readdir(resolved.resolved);
         const sortedNames = names.toSorted();
         if (!withFileTypes) {
+            await assertRootIdentityCurrent(root);
             return sortedNames;
         }
         const entries = [];
@@ -4987,6 +5347,7 @@ async function listPathFallback(root, relativePath, withFileTypes) {
                 ...pathStatFromStats(await promises_namespaceObject.lstat(external_node_path_namespaceObject.join(resolved.resolved, name))),
             });
         }
+        await assertRootIdentityCurrent(root);
         return entries;
     }
     catch (error) {
@@ -4999,6 +5360,8 @@ async function listPathFallback(root, relativePath, withFileTypes) {
     }
 }
 async function assertMoveMutationAllowed(root, params) {
+    // Keep this preflight separate from the pinned resolutions in movePathFallback:
+    // mutation denials must take precedence over source alias or identity failures.
     const source = await resolvePathInRoot(root, params.fromRelative, {
         aliasErrorCode: "path-alias",
         allowFinalSymlink: true,
@@ -5020,40 +5383,29 @@ async function movePathFallback(root, params) {
         relativePath: params.fromRelative,
         policy: PATH_ALIAS_POLICIES.strict,
     });
-    const target = await resolvePathInRoot(root, params.toRelative, {
-        aliasErrorCode: "path-alias",
-        allowFinalSymlink: true,
-    });
-    await assertMutationNotDenied(target.resolved, params.denyMutations, { protectAncestors: true });
-    await resolvePinnedRootPathInRoot(root, {
+    const target = await resolveGuardedWritePathInRoot(root, {
         relativePath: params.toRelative,
-        policy: PATH_ALIAS_POLICIES.unlinkTarget,
-    });
-    const targetStat = await promises_namespaceObject.lstat(target.resolved).catch(() => undefined);
-    const replacesFinalSymlink = process.platform !== "win32" && params.overwrite && targetStat?.isSymbolicLink() === true;
-    if (!replacesFinalSymlink) {
-        try {
-            await assertNoPathAliasEscape({
-                absolutePath: target.resolved,
-                rootPath: target.rootReal,
-                boundaryLabel: "root",
-            });
-        }
-        catch (error) {
-            throw new errors_FsSafeError("path-alias", "path alias escape blocked", {
-                cause: error instanceof Error ? error : undefined,
+        denyMutations: params.denyMutations,
+        allowFinalSymlink: true,
+        protectDeniedAncestors: true,
+        shouldAssertNoPathAlias: async (resolvedTarget) => {
+            await resolvePinnedRootPathInRoot(root, {
+                relativePath: params.toRelative,
+                policy: PATH_ALIAS_POLICIES.unlinkTarget,
             });
-        }
-    }
+            const targetStat = await promises_namespaceObject.lstat(resolvedTarget.resolved).catch(() => undefined);
+            return !(process.platform !== "win32" &&
+                params.overwrite &&
+                targetStat?.isSymbolicLink() === true);
+        },
+    });
     let sourceStat;
     try {
         sourceStat = await promises_namespaceObject.lstat(source.resolved);
     }
     catch (error) {
         if (path_isNotFoundPathError(error)) {
-            throw new errors_FsSafeError("not-found", "file not found", {
-                cause: error instanceof Error ? error : undefined,
-            });
+            throw fileNotFoundError(error instanceof Error ? error : undefined);
         }
         throw error;
     }
@@ -5061,7 +5413,7 @@ async function movePathFallback(root, params) {
         throw new errors_FsSafeError("symlink", "symlink not allowed");
     }
     if (sourceStat.isFile() && sourceStat.nlink > 1) {
-        throw new errors_FsSafeError("hardlink", "hardlinked path not allowed");
+        throw hardlinkedPathNotAllowedError();
     }
     if (!params.overwrite && sourceStat.isDirectory()) {
         throw new errors_FsSafeError("invalid-path", "directory moves require overwrite: true");
@@ -5090,9 +5442,7 @@ async function movePathFallback(root, params) {
     }
     catch (error) {
         if (path_isNotFoundPathError(error)) {
-            throw new errors_FsSafeError("not-found", "file not found", {
-                cause: error instanceof Error ? error : undefined,
-            });
+            throw fileNotFoundError(error instanceof Error ? error : undefined);
         }
         if (hasNodeErrorCode(error, "EEXIST")) {
             throw new errors_FsSafeError("already-exists", "destination exists", {
@@ -5158,30 +5508,22 @@ async function writeFileFallback(root, params) {
     }
 }
 async function writeMissingFileFallback(root, params) {
-    const { rootReal, resolved } = await resolvePathInRoot(root, params.relativePath, {
-        aliasErrorCode: "path-alias",
+    const { rootReal, resolved } = await resolveGuardedWritePathInRoot(root, {
+        relativePath: params.relativePath,
+        denyMutations: params.denyMutations,
     });
-    await assertMutationNotDenied(resolved, params.denyMutations);
-    try {
-        await assertNoPathAliasEscape({
-            absolutePath: resolved,
-            rootPath: rootReal,
-            boundaryLabel: "root",
-        });
-    }
-    catch (err) {
-        throw new errors_FsSafeError("path-alias", "path alias escape blocked", { cause: err });
-    }
     const targetPath = params.mkdir === false
         ? resolved
         : await prepareRootWriteTarget(rootReal, resolved);
     const parentGuard = await directory_guard_createAsyncDirectoryGuard(external_node_path_namespaceObject.dirname(targetPath));
     let created = false;
+    let createdIdentity;
     try {
         const { handle, writtenStat } = await withAsyncDirectoryGuards([parentGuard], async () => {
             const handle = await promises_namespaceObject.open(targetPath, OPEN_WRITE_CREATE_FLAGS, params.mode ?? 0o600);
             created = true;
             try {
+                createdIdentity = await handle.stat();
                 if (typeof params.data === "string") {
                     await handle.writeFile(params.data, params.encoding ?? "utf8");
                 }
@@ -5217,8 +5559,8 @@ async function writeMissingFileFallback(root, params) {
         throw err;
     }
     finally {
-        if (created) {
-            await promises_namespaceObject.rm(targetPath, { force: true }).catch(() => undefined);
+        if (created && createdIdentity) {
+            await removePathIfIdentityUnchanged(targetPath, createdIdentity).catch(() => undefined);
         }
     }
 }
@@ -16388,4 +16730,4 @@ if (installedChunkData !== 0) { // 0 means "already installed".'
 // module factories are used so entry inlining is disabled
 // startup
 // Load entry module and return exports
-var __webpack_exports__ = __webpack_require__(418);
+var __webpack_exports__ = __webpack_require__(983);