@lousy-agents/mcp 5.18.0 → 5.18.2

package/dist/mcp-server.js

@@ -6559,7 +6559,7 @@ function escapeJsonPtr(str) {
 
 
 },
-8454(__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
+7489(__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
 // NAMESPACE OBJECT: ../../node_modules/micromark/lib/constructs.js
 var constructs_namespaceObject = {};
 __webpack_require__.r(constructs_namespaceObject);
@@ -26549,8 +26549,6 @@ var external_node_path_ = __webpack_require__(6760);
  * List of known action names for convenience
  */ const KNOWN_ACTIONS = Object.keys(DEFAULT_ACTION_VERSIONS);
 
-// EXTERNAL MODULE: external "node:fs"
-var external_node_fs_ = __webpack_require__(3024);
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/errors.js
 const OPERATIONAL_CODES = new Set([
     "helper-failed",
@@ -26565,42 +26563,20 @@ function categorizeFsSafeError(code) {
 class errors_FsSafeError extends Error {
     code;
     category;
+    details;
     constructor(code, message, options = {}) {
         super(message, options);
         this.name = "FsSafeError";
         this.code = code;
         this.category = categorizeFsSafeError(code);
+        this.details = options.details;
     }
 }
 
 // EXTERNAL MODULE: external "node:crypto"
 var external_node_crypto_ = __webpack_require__(7598);
-// EXTERNAL MODULE: external "node:stream/promises"
-var external_node_stream_promises_ = __webpack_require__(6466);
-// EXTERNAL MODULE: external "node:stream"
-var external_node_stream_ = __webpack_require__(7075);
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/bounded-read-stream.js
-
-
-function createMaxBytesTransform(maxBytes) {
-    let bytes = 0;
-    return new external_node_stream_.Transform({
-        transform(chunk, _encoding, callback) {
-            const buffer = chunk instanceof Buffer ? chunk : Buffer.from(chunk);
-            bytes += buffer.byteLength;
-            if (bytes > maxBytes) {
-                callback(new errors_FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`));
-                return;
-            }
-            callback(null, buffer);
-        },
-    });
-}
-function createBoundedReadStream(opened, maxBytes) {
-    const stream = opened.handle.createReadStream();
-    return maxBytes === undefined ? stream : stream.pipe(createMaxBytesTransform(maxBytes));
-}
-
+// EXTERNAL MODULE: external "node:fs"
+var external_node_fs_ = __webpack_require__(3024);
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/file-identity.js
 
 function isZero(value) {
@@ -26625,86 +26601,11 @@ function file_identity_sameFileIdentity(left, right, platform = process.platform
     return platform === "win32" && (isZero(left.dev) || isZero(right.dev));
 }
 
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/string-coerce.js
-function readStringValue(value) {
-    return typeof value === "string" ? value : undefined;
-}
-function normalizeNullableString(value) {
-    if (typeof value !== "string") {
-        return null;
-    }
-    const trimmed = value.trim();
-    return trimmed ? trimmed : null;
-}
-function normalizeOptionalString(value) {
-    return normalizeNullableString(value) ?? undefined;
-}
-function normalizeStringifiedOptionalString(value) {
-    if (typeof value === "string") {
-        return normalizeOptionalString(value);
-    }
-    if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-        return normalizeOptionalString(String(value));
-    }
-    return undefined;
-}
-function normalizeOptionalLowercaseString(value) {
-    return normalizeOptionalString(value)?.toLowerCase();
-}
-function normalizeLowercaseStringOrEmpty(value) {
-    return normalizeOptionalLowercaseString(value) ?? "";
-}
-function normalizeFastMode(raw) {
-    if (typeof raw === "boolean") {
-        return raw;
-    }
-    if (!raw) {
-        return undefined;
-    }
-    const key = normalizeLowercaseStringOrEmpty(raw);
-    if (["off", "false", "no", "0", "disable", "disabled", "normal"].includes(key)) {
-        return false;
-    }
-    if (["on", "true", "yes", "1", "enable", "enabled", "fast"].includes(key)) {
-        return true;
-    }
-    return undefined;
-}
-function lowercasePreservingWhitespace(value) {
-    return value.toLowerCase();
-}
-function localeLowercasePreservingWhitespace(value) {
-    return value.toLocaleLowerCase();
-}
-function resolvePrimaryStringValue(value) {
-    if (typeof value === "string") {
-        return normalizeOptionalString(value);
-    }
-    if (!value || typeof value !== "object") {
-        return undefined;
-    }
-    return normalizeOptionalString(value.primary);
-}
-function normalizeOptionalThreadValue(value) {
-    if (typeof value === "number") {
-        return Number.isFinite(value) ? Math.trunc(value) : undefined;
-    }
-    return normalizeOptionalString(value);
-}
-function normalizeOptionalStringifiedId(value) {
-    const normalized = normalizeOptionalThreadValue(value);
-    return normalized == null ? undefined : String(normalized);
-}
-function hasNonEmptyString(value) {
-    return normalizeOptionalString(value) !== undefined;
-}
-
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/path.js
 
 
 
 
-
 const NOT_FOUND_CODES = new Set(["ENOENT", "ENOTDIR"]);
 const SYMLINK_OPEN_CODES = new Set(["ELOOP", "EINVAL", "ENOTSUP"]);
 const POSIX_SEPARATOR_CHAR_CODE = 0x2f;
@@ -26716,7 +26617,9 @@ function normalizeWindowsPathForComparison(input) {
             normalized = `\\\\${normalized.slice(4)}`;
         }
     }
-    return normalizeLowercaseStringOrEmpty(normalized.replaceAll("/", "\\"));
+    // Lowercase only: this value feeds Windows containment math, so surrounding
+    // whitespace is part of the path and must not be trimmed away.
+    return normalized.replaceAll("/", "\\").toLowerCase();
 }
 function isNodeError(value) {
     return Boolean(value && typeof value === "object" && "code" in value);
@@ -27215,6 +27118,27 @@ function isSameOrChildPath(candidate, parent) {
     const parentPrefix = parent.endsWith(external_node_path_.sep) ? parent : `${parent}${external_node_path_.sep}`;
     return candidate === parent || candidate.startsWith(parentPrefix);
 }
+async function realpathOrThrowNotFile(target) {
+    try {
+        return external_node_path_.resolve(await promises_.realpath(target));
+    }
+    catch (error) {
+        if (path_isNotFoundPathError(error)) {
+            // A dangling symlink (or a component removed between lstat and
+            // realpath) is not a usable directory component.
+            throw new errors_FsSafeError("not-file", "directory component must be a directory", {
+                cause: error instanceof Error ? error : undefined,
+            });
+        }
+        throw error;
+    }
+}
+/**
+ * Creates each missing path component from `rootReal` down to `targetPath`,
+ * guarding every step. Returns the real (symlink-resolved) path of the final
+ * component so callers can guard/use that path directly instead of
+ * re-deriving it from the original, possibly-symlinked, lexical path.
+ */
 async function mkdirPathComponentsWithGuards(params) {
     const root = external_node_path_.resolve(params.rootReal);
     const rootCanonical = external_node_path_.resolve(await promises_.realpath(root));
@@ -27238,18 +27162,39 @@ async function mkdirPathComponentsWithGuards(params) {
             }
         }
         const stat = await promises_.lstat(next);
-        if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        if (!stat.isSymbolicLink() && !stat.isDirectory()) {
             throw new errors_FsSafeError("not-file", "directory component must be a directory");
         }
         // Node's recursive mkdir follows symlinks in missing components. Build one
         // segment at a time and realpath-check each segment before descending.
-        if (!isSameOrChildPath(external_node_path_.resolve(await promises_.realpath(next)), rootCanonical)) {
+        const nextReal = await realpathOrThrowNotFile(next);
+        if (!isSameOrChildPath(nextReal, rootCanonical)) {
             throw new errors_FsSafeError("outside-workspace", "directory escaped workspace root");
         }
+        if (stat.isSymbolicLink()) {
+            // An existing path component may legitimately be a symlink to a real
+            // directory inside the root (e.g. a skill-bank layout). We already
+            // verified above that it resolves inside the root, so treat the
+            // resolved real path as the directory for the rest of this walk
+            // instead of rejecting it outright. Guard checks from here on operate
+            // on the real (non-symlink) path, preserving TOCTOU protection for
+            // every subsequent segment. Callers that need the final directory
+            // (e.g. to guard it themselves after this function returns) must use
+            // the returned resolved path, not their own lexical parent path.
+            const targetStat = await promises_.stat(nextReal);
+            if (!targetStat.isDirectory()) {
+                throw new errors_FsSafeError("not-file", "directory component must be a directory");
+            }
+            await directory_guard_createAsyncDirectoryGuard(nextReal);
+            await assertAsyncDirectoryGuard(parentGuard);
+            current = nextReal;
+            continue;
+        }
         await directory_guard_createAsyncDirectoryGuard(next);
         await assertAsyncDirectoryGuard(parentGuard);
         current = next;
     }
+    return current;
 }
 
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/guarded-mutation.js
@@ -27515,8 +27460,20 @@ async function resolveOpenedFileRealPathFromParent(handleStat, ioPath) {
     return null;
 }
 
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/pinned-python-config.js
+// EXTERNAL MODULE: external "node:module"
+var external_node_module_ = __webpack_require__(8995);
+// EXTERNAL MODULE: external "node:url"
+var external_node_url_ = __webpack_require__(3136);
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/native-config.js
 let overrideConfig = {};
+let legacyWarningEmitted = false;
+const legacyModeEnvKeys = ["FS_SAFE_PYTHON_MODE", "OPENCLAW_FS_SAFE_PYTHON_MODE"];
+const legacyPathEnvKeys = [
+    "FS_SAFE_PYTHON",
+    "OPENCLAW_FS_SAFE_PYTHON",
+    "OPENCLAW_PINNED_PYTHON",
+    "OPENCLAW_PINNED_WRITE_PYTHON",
+];
 function parseMode(value) {
     if (!value) {
         return undefined;
@@ -27533,682 +27490,495 @@ function parseMode(value) {
     }
     return undefined;
 }
-function configureFsSafePython(config) {
+function configureFsSafeNative(config) {
     overrideConfig = { ...overrideConfig, ...config };
 }
-function getFsSafePythonConfig() {
+function warnLegacyPythonConfiguration(source, mappedMode) {
+    if (legacyWarningEmitted) {
+        return;
+    }
+    legacyWarningEmitted = true;
+    process.emitWarning(`${source} is a deprecated 0.4 compatibility bridge; mapped to native mode ` +
+        `"${mappedMode}". Use configureFsSafeNative({ mode: "${mappedMode}" }) or ` +
+        `FS_SAFE_NATIVE_MODE=${mappedMode}. Python interpreter paths are no longer used.`, { code: "FS_SAFE_PYTHON_DEPRECATED", type: "DeprecationWarning" });
+}
+function readLegacyPythonMode() {
+    const configuredKeys = [...legacyModeEnvKeys, ...legacyPathEnvKeys].filter((key) => process.env[key] !== undefined);
+    if (configuredKeys.length === 0) {
+        return undefined;
+    }
+    const rawMode = legacyModeEnvKeys.map((key) => process.env[key]).find((value) => value !== undefined);
+    const mappedMode = parseMode(rawMode) ?? "auto";
+    warnLegacyPythonConfiguration(`Legacy ${configuredKeys.join(", ")}`, mappedMode);
+    return mappedMode;
+}
+/**
+ * @deprecated Compatibility bridge for 0.4 upgrades. Use configureFsSafeNative.
+ */
+function configureFsSafePython(config) {
+    const mappedMode = config.mode ?? "auto";
+    warnLegacyPythonConfiguration("configureFsSafePython()", mappedMode);
+    if (config.mode !== undefined) {
+        configureFsSafeNative({ mode: config.mode });
+    }
+}
+function getFsSafeNativeConfig() {
+    const legacyMode = readLegacyPythonMode();
     return {
         mode: overrideConfig.mode ??
-            parseMode(process.env.FS_SAFE_PYTHON_MODE) ??
-            parseMode(process.env.OPENCLAW_FS_SAFE_PYTHON_MODE) ??
+            parseMode(process.env.FS_SAFE_NATIVE_MODE) ??
+            parseMode(process.env.OPENCLAW_FS_SAFE_NATIVE_MODE) ??
+            legacyMode ??
             "auto",
-        pythonPath: overrideConfig.pythonPath ??
-            process.env.FS_SAFE_PYTHON ??
-            process.env.OPENCLAW_FS_SAFE_PYTHON ??
-            process.env.OPENCLAW_PINNED_PYTHON ??
-            process.env.OPENCLAW_PINNED_WRITE_PYTHON,
     };
 }
-function canFallbackFromPythonError(error) {
-    const code = error instanceof Error && "code" in error ? error.code : undefined;
-    return (getFsSafePythonConfig().mode !== "require" &&
-        (code === "helper-unavailable" || code === "unsupported-platform"));
+function __resetFsSafeNativeConfigForTest() {
+    overrideConfig = {};
+    legacyWarningEmitted = false;
 }
 
-// EXTERNAL MODULE: external "node:child_process"
-var external_node_child_process_ = __webpack_require__(1421);
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/pinned-python.js
-
-
-
-
-const PINNED_PYTHON_WORKER_SOURCE = String.raw `
-import base64, errno, json, os, secrets, stat, sys
-DIR_FLAGS = os.O_RDONLY
-if hasattr(os, "O_DIRECTORY"): DIR_FLAGS |= os.O_DIRECTORY
-if hasattr(os, "O_NOFOLLOW"): DIR_FLAGS |= os.O_NOFOLLOW
-READ_FLAGS = os.O_RDONLY
-if hasattr(os, "O_NONBLOCK"): READ_FLAGS |= os.O_NONBLOCK
-if hasattr(os, "O_NOFOLLOW"): READ_FLAGS |= os.O_NOFOLLOW
-WRITE_FLAGS = os.O_WRONLY | os.O_CREAT | os.O_EXCL
-if hasattr(os, "O_NOFOLLOW"):
-    WRITE_FLAGS |= os.O_NOFOLLOW
-def split_relative(value):
-    if value in ("", "."):
-        return []
-    if "\x00" in value or value.startswith("/") or value.startswith("//"):
-        raise OSError(errno.EPERM, "invalid relative path")
-    if value.startswith("..\\"):
-        raise OSError(errno.EPERM, "path traversal is not allowed")
-    parts = [part for part in value.split("/") if part and part != "."]
-    for part in parts:
-        if part == "..":
-            raise OSError(errno.EPERM, "path traversal is not allowed")
-    return parts
-def open_dir(path_value, dir_fd=None):
-    return os.open(path_value, DIR_FLAGS, dir_fd=dir_fd)
-def walk_dir(root_fd, segments, mkdir_enabled=False):
-    current_fd = os.dup(root_fd)
-    try:
-        for segment in segments:
-            try:
-                next_fd = open_dir(segment, dir_fd=current_fd)
-            except FileNotFoundError:
-                if not mkdir_enabled:
-                    raise
-                os.mkdir(segment, 0o777, dir_fd=current_fd)
-                next_fd = open_dir(segment, dir_fd=current_fd)
-            os.close(current_fd)
-            current_fd = next_fd
-        return current_fd
-    except Exception:
-        os.close(current_fd)
-        raise
-def parent_and_basename(root_fd, relative):
-    segments = split_relative(relative)
-    if not segments:
-        raise OSError(errno.EPERM, "operation requires a non-root path")
-    parent_fd = walk_dir(root_fd, segments[:-1])
-    return parent_fd, segments[-1]
-def encode_stat(st):
-    mode = st.st_mode
-    return {
-        "dev": st.st_dev,
-        "gid": st.st_gid,
-        "ino": st.st_ino,
-        "isDirectory": stat.S_ISDIR(mode),
-        "isFile": stat.S_ISREG(mode),
-        "isSymbolicLink": stat.S_ISLNK(mode),
-        "mode": mode,
-        "mtimeMs": st.st_mtime * 1000,
-        "nlink": st.st_nlink,
-        "size": st.st_size,
-        "uid": st.st_uid,
-    }
-def reject_unsafe_endpoint(st):
-    mode = st.st_mode
-    if stat.S_ISLNK(mode):
-        raise OSError(errno.ELOOP, "symlink endpoint is not allowed")
-    if stat.S_ISREG(mode) and st.st_nlink > 1:
-        raise OSError(errno.EPERM, "hardlinked file endpoint is not allowed")
-def copy_bytes(source_fd, dest_fd):
-    while True:
-        chunk = os.read(source_fd, 65536)
-        if not chunk:
-            break
-        view = memoryview(chunk)
-        while view:
-            written = os.write(dest_fd, view)
-            if written <= 0:
-                raise OSError(errno.EIO, "short write")
-            view = view[written:]
-def write_all(fd, data):
-    view = memoryview(data)
-    while view:
-        written = os.write(fd, view)
-        if written <= 0:
-            raise OSError(errno.EIO, "short write")
-        view = view[written:]
-def fsync_best_effort(fd):
-    try: os.fsync(fd)
-    except OSError as error:
-        if error.errno != errno.EPERM: raise
-def link_unsupported(exc):
-    unsupported = (errno.EPERM, errno.EOPNOTSUPP, getattr(errno, "ENOTSUP", errno.EOPNOTSUPP))
-    return getattr(exc, "errno", None) in unsupported
-def link_no_replace(name, new_name, source_fd, target_fd):
-    linked = False
-    try:
-        os.link(name, new_name, src_dir_fd=source_fd, dst_dir_fd=target_fd, follow_symlinks=False)
-        linked = True
-        os.unlink(name, dir_fd=source_fd)
-    except Exception:
-        if linked:
-            try: os.unlink(new_name, dir_fd=target_fd)
-            except FileNotFoundError: pass
-        raise
-    os.fsync(source_fd)
-    if source_fd != target_fd:
-        os.fsync(target_fd)
-def copy_file_no_replace(source_parent_fd, source_name, target_parent_fd, basename, mode, expected=None, unlink_source=False):
-    source_fd = os.open(source_name, READ_FLAGS, dir_fd=source_parent_fd)
-    dest_fd = None; success = False; dest_stat = None
-    try:
-        if expected is not None:
-            source_stat = os.fstat(source_fd)
-            if source_stat.st_dev != expected.st_dev or source_stat.st_ino != expected.st_ino:
-                raise RuntimeError("fs-safe-source-mismatch")
-        dest_fd = os.open(basename, WRITE_FLAGS, mode, dir_fd=target_parent_fd)
-        copy_bytes(source_fd, dest_fd)
-        os.fsync(dest_fd)
-        dest_stat = os.fstat(dest_fd)
-        success = True
-    finally:
-        os.close(source_fd)
-        if dest_fd is not None:
-            os.close(dest_fd)
-        if dest_fd is not None and not success:
-            try: os.unlink(basename, dir_fd=target_parent_fd)
-            except FileNotFoundError: pass
-    if unlink_source:
-        try:
-            os.unlink(source_name, dir_fd=source_parent_fd)
-        except Exception:
-            try: os.unlink(basename, dir_fd=target_parent_fd)
-            except FileNotFoundError: pass
-            raise
-    return dest_stat
-def same_identity(left, right):
-    return left.st_dev == right.st_dev and left.st_ino == right.st_ino
-def verify_temp_name(parent_fd, temp_name, expected_stat):
-    current_stat = os.lstat(temp_name, dir_fd=parent_fd)
-    if stat.S_ISLNK(current_stat.st_mode) or not same_identity(current_stat, expected_stat):
-        raise RuntimeError("fs-safe-temp-mismatch")
-def verify_committed_temp(parent_fd, basename, expected_stat):
-    final_stat = os.lstat(basename, dir_fd=parent_fd)
-    if not stat.S_ISLNK(final_stat.st_mode) and same_identity(final_stat, expected_stat):
-        return final_stat
-    try: os.unlink(basename, dir_fd=parent_fd)
-    except FileNotFoundError: pass
-    raise RuntimeError("fs-safe-temp-mismatch")
-def commit_temp_file(parent_fd, temp_name, basename, overwrite, mode, expected_stat):
-    verify_temp_name(parent_fd, temp_name, expected_stat)
-    if overwrite:
-        os.replace(temp_name, basename, src_dir_fd=parent_fd, dst_dir_fd=parent_fd)
-        return verify_committed_temp(parent_fd, basename, expected_stat)
-    else:
-        try:
-            os.link(temp_name, basename, src_dir_fd=parent_fd, dst_dir_fd=parent_fd, follow_symlinks=False)
-            final_stat = verify_committed_temp(parent_fd, basename, expected_stat)
-            os.unlink(temp_name, dir_fd=parent_fd)
-            return final_stat
-        except OSError as exc:
-            if not link_unsupported(exc):
-                raise
-            return copy_file_no_replace(parent_fd, temp_name, parent_fd, basename, mode, expected_stat, True)
-def assert_expected_root(root_fd, payload):
-    if "rootDev" in payload or "rootIno" in payload:
-        root_stat = os.fstat(root_fd)
-        if root_stat.st_dev != int(payload["rootDev"]) or root_stat.st_ino != int(payload["rootIno"]):
-            raise RuntimeError("fs-safe-root-mismatch")
-def stat_path(root_fd, payload):
-    relative = payload.get("relativePath", "")
-    segments = split_relative(relative)
-    if not segments:
-        return encode_stat(os.fstat(root_fd))
-    parent_fd, basename = parent_and_basename(root_fd, relative)
-    try:
-        st = os.lstat(basename, dir_fd=parent_fd)
-        if payload.get("rejectSymlink", True) and stat.S_ISLNK(st.st_mode):
-            raise OSError(errno.ELOOP, "symlink endpoint is not allowed")
-        return encode_stat(st)
-    finally:
-        os.close(parent_fd)
-def readdir_path(root_fd, payload):
-    dir_fd = walk_dir(root_fd, split_relative(payload.get("relativePath", "")))
-    try:
-        names = sorted(os.listdir(dir_fd))
-        if not payload.get("withFileTypes", False):
-            return names
-        entries = []
-        for name in names:
-            st = os.lstat(name, dir_fd=dir_fd)
-            entry = encode_stat(st)
-            entry["name"] = name
-            entries.append(entry)
-        return entries
-    finally:
-        os.close(dir_fd)
-def mkdirp_path(root_fd, payload):
-    dir_fd = walk_dir(root_fd, split_relative(payload.get("relativePath", "")), mkdir_enabled=True)
-    os.close(dir_fd); return None
-def remove_tree(parent_fd, basename):
-    st = os.lstat(basename, dir_fd=parent_fd)
-    if stat.S_ISDIR(st.st_mode) and not stat.S_ISLNK(st.st_mode):
-        dir_fd = open_dir(basename, dir_fd=parent_fd)
-        try:
-            for child in os.listdir(dir_fd):
-                remove_tree(dir_fd, child)
-        finally:
-            os.close(dir_fd)
-        os.rmdir(basename, dir_fd=parent_fd)
-    else:
-        os.unlink(basename, dir_fd=parent_fd)
-def remove_path(root_fd, payload):
-    parent_fd, basename = parent_and_basename(root_fd, payload.get("relativePath", ""))
-    try:
-        try:
-            st = os.lstat(basename, dir_fd=parent_fd)
-        except FileNotFoundError:
-            if payload.get("force", True):
-                return None
-            raise
-        if stat.S_ISDIR(st.st_mode) and not stat.S_ISLNK(st.st_mode):
-            if payload.get("recursive", False):
-                remove_tree(parent_fd, basename)
-            else:
-                os.rmdir(basename, dir_fd=parent_fd)
-        else:
-            os.unlink(basename, dir_fd=parent_fd)
-        return None
-    finally:
-        os.close(parent_fd)
-
-def rename_path(root_fd, payload):
-    from_parent_fd, from_base = parent_and_basename(root_fd, payload["from"])
-    to_parent_fd, to_base = parent_and_basename(root_fd, payload["to"])
-    try:
-        from_stat = os.lstat(from_base, dir_fd=from_parent_fd)
-        reject_unsafe_endpoint(from_stat)
-        overwrite = payload.get("overwrite", True)
-        if not overwrite and stat.S_ISREG(from_stat.st_mode):
-            try:
-                link_no_replace(from_base, to_base, from_parent_fd, to_parent_fd)
-            except OSError as exc:
-                if not link_unsupported(exc):
-                    raise
-                copy_file_no_replace(from_parent_fd, from_base, to_parent_fd, to_base, stat.S_IMODE(from_stat.st_mode), from_stat, True)
-            return None
-        if not overwrite and stat.S_ISDIR(from_stat.st_mode):
-            raise RuntimeError("fs-safe-directory-noreplace-unsupported")
-        if not overwrite:
-            try:
-                os.lstat(to_base, dir_fd=to_parent_fd)
-                raise FileExistsError(errno.EEXIST, "destination exists", to_base)
-            except FileNotFoundError:
-                pass
-        os.rename(from_base, to_base, src_dir_fd=from_parent_fd, dst_dir_fd=to_parent_fd)
-        os.fsync(from_parent_fd)
-        if from_parent_fd != to_parent_fd:
-            os.fsync(to_parent_fd)
-        return None
-    finally:
-        os.close(from_parent_fd)
-        os.close(to_parent_fd)
-
-def create_temp_file(parent_fd, basename, mode):
-    prefix = "." + basename + "."
-    for _ in range(128):
-        candidate = prefix + secrets.token_hex(6) + ".tmp"
-        try:
-            fd = os.open(candidate, WRITE_FLAGS, mode, dir_fd=parent_fd)
-            return candidate, fd
-        except FileExistsError:
-            continue
-    raise RuntimeError("failed to allocate pinned temp file")
-
-def write_path(root_fd, payload):
-    parent_fd = walk_dir(root_fd, split_relative(payload.get("relativeParentPath", "")), bool(payload.get("mkdir", True)))
-    temp_fd = None
-    temp_name = None
-    basename = payload["basename"]
-    mode = int(payload.get("mode", 0o600))
-    overwrite = bool(payload.get("overwrite", True))
-    max_bytes = int(payload.get("maxBytes", -1))
-    data = base64.b64decode(payload.get("base64", ""))
-    try:
-        if max_bytes >= 0 and len(data) > max_bytes:
-            raise RuntimeError("fs-safe-too-large:%d:%d" % (max_bytes, len(data)))
-        if not overwrite:
-            try:
-                os.lstat(basename, dir_fd=parent_fd)
-                raise FileExistsError(errno.EEXIST, "destination exists", basename)
-            except FileNotFoundError:
-                pass
-        temp_name, temp_fd = create_temp_file(parent_fd, basename, mode)
-        os.fchmod(temp_fd, mode)
-        write_all(temp_fd, data)
-        fsync_best_effort(temp_fd)
-        temp_stat = os.fstat(temp_fd)
-        os.close(temp_fd)
-        temp_fd = None
-        result_stat = commit_temp_file(parent_fd, temp_name, basename, overwrite, mode, temp_stat)
-        temp_name = None
-        fsync_best_effort(parent_fd)
-        return {"dev": result_stat.st_dev, "ino": result_stat.st_ino}
-    finally:
-        if temp_fd is not None:
-            os.close(temp_fd)
-        if temp_name is not None:
-            try:
-                os.unlink(temp_name, dir_fd=parent_fd)
-            except FileNotFoundError:
-                pass
-        os.close(parent_fd)
-
-def copy_path(root_fd, payload):
-    source_fd = os.open(payload["sourcePath"], READ_FLAGS)
-    parent_fd = None
-    temp_fd = None
-    temp_name = None
-    try:
-        source_stat = os.fstat(source_fd)
-        if not stat.S_ISREG(source_stat.st_mode):
-            raise RuntimeError("fs-safe-not-file")
-        if source_stat.st_dev != int(payload["sourceDev"]) or source_stat.st_ino != int(payload["sourceIno"]):
-            raise RuntimeError("fs-safe-source-mismatch")
-        basename = payload["basename"]
-        mode = int(payload.get("mode", 0o600))
-        overwrite = bool(payload.get("overwrite", True))
-        max_bytes = int(payload.get("maxBytes", -1))
-        if max_bytes >= 0 and source_stat.st_size > max_bytes:
-            raise RuntimeError("fs-safe-too-large:%d:%d" % (max_bytes, source_stat.st_size))
-        parent_fd = walk_dir(root_fd, split_relative(payload.get("relativeParentPath", "")), bool(payload.get("mkdir", True)))
-        temp_name, temp_fd = create_temp_file(parent_fd, basename, mode)
-        os.fchmod(temp_fd, mode)
-        written_bytes = 0
-        while True:
-            chunk = os.read(source_fd, 65536)
-            if not chunk:
-                break
-            written_bytes += len(chunk)
-            if max_bytes >= 0 and written_bytes > max_bytes:
-                raise RuntimeError("fs-safe-too-large:%d:%d" % (max_bytes, written_bytes))
-            view = memoryview(chunk)
-            while view:
-                written = os.write(temp_fd, view)
-                if written <= 0:
-                    raise OSError(errno.EIO, "short write")
-                view = view[written:]
-        os.fsync(temp_fd)
-        temp_stat = os.fstat(temp_fd)
-        os.close(temp_fd)
-        temp_fd = None
-        result_stat = commit_temp_file(parent_fd, temp_name, basename, overwrite, mode, temp_stat)
-        temp_name = None
-        os.fsync(parent_fd)
-        return {"dev": result_stat.st_dev, "ino": result_stat.st_ino}
-    finally:
-        os.close(source_fd)
-        if temp_fd is not None:
-            os.close(temp_fd)
-        if temp_name is not None and parent_fd is not None:
-            try:
-                os.unlink(temp_name, dir_fd=parent_fd)
-            except FileNotFoundError:
-                pass
-        if parent_fd is not None:
-            os.close(parent_fd)
-
-def run_operation(operation, root_path, payload):
-    root_fd = open_dir(root_path)
-    try:
-        assert_expected_root(root_fd, payload)
-        if operation == "stat":
-            return stat_path(root_fd, payload)
-        if operation == "readdir":
-            return readdir_path(root_fd, payload)
-        if operation == "mkdirp":
-            return mkdirp_path(root_fd, payload)
-        if operation == "remove":
-            return remove_path(root_fd, payload)
-        if operation == "rename":
-            return rename_path(root_fd, payload)
-        if operation == "write":
-            return write_path(root_fd, payload)
-        if operation == "copy":
-            return copy_path(root_fd, payload)
-        raise RuntimeError("unknown operation: " + operation)
-    finally:
-        os.close(root_fd)
-
-for line in sys.stdin:
-    try:
-        request = json.loads(line)
-        result = run_operation(request["operation"], request["rootPath"], request.get("payload") or {})
-        response = {"id": request["id"], "ok": True, "result": result}
-    except Exception as exc:
-        response = {
-            "id": request.get("id") if isinstance(locals().get("request"), dict) else None,
-            "ok": False,
-            "code": exc.__class__.__name__,
-            "errno": getattr(exc, "errno", None),
-            "message": str(exc),
-        }
-    print(json.dumps(response, separators=(",", ":")), flush=True)
-`;
-let nextRequestId = 1;
-let worker = null;
-function __resetPinnedPythonWorkerForTest() {
-    const currentWorker = worker;
-    worker = null;
-    if (!currentWorker) {
-        return;
-    }
-    currentWorker.pending.clear();
-    currentWorker.child.kill("SIGTERM");
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/native.js
+
+
+
+
+
+
+const native_require = (0,external_node_module_.createRequire)(import.meta.url);
+const bundledNativeDirectory = (0,external_node_url_.fileURLToPath)(new URL("../dist/native/", import.meta.url));
+let native_binding;
+let loadError;
+let attempted = false;
+let loadBinding = loadBundledBinding;
+function isMuslFilename(file) {
+    return file.includes("libc.musl-") || file.includes("ld-musl-");
 }
-const PYTHON_CANDIDATE_DEFAULTS = [
-    "/usr/bin/python3",
-    "/opt/homebrew/bin/python3",
-    "/usr/local/bin/python3",
-];
-function canExecute(binPath) {
+function isMuslFromReport() {
     try {
-        external_node_fs_.accessSync(binPath, external_node_fs_.constants.X_OK);
-        return true;
+        if (!process.report || typeof process.report.getReport !== "function")
+            return undefined;
+        const report = process.report.getReport();
+        if (report.header?.glibcVersionRuntime)
+            return false;
+        if (report.sharedObjects?.some(isMuslFilename))
+            return true;
     }
     catch {
-        return false;
+        // Continue with filesystem and ELF inspection.
     }
+    return undefined;
 }
-function resolvePython() {
-    const configured = getFsSafePythonConfig().pythonPath;
-    if (configured) {
-        return configured;
-    }
-    for (const candidate of PYTHON_CANDIDATE_DEFAULTS) {
-        if (canExecute(candidate)) {
-            return candidate;
+function isMuslFromFilesystem() {
+    for (const directory of ["/lib", "/usr/lib"]) {
+        try {
+            if ((0,external_node_fs_.readdirSync)(directory).some(isMuslFilename))
+                return true;
+        }
+        catch {
+            // A missing or unreadable conventional library directory is inconclusive.
         }
     }
-    return "python3";
+    return undefined;
 }
-function assertPinnedHelperSupported() {
-    if (process.platform === "win32") {
-        throw new errors_FsSafeError("unsupported-platform", "fd-relative pinned filesystem operations are not available on Windows");
+function readUInt(buffer, offset, bytes, littleEndian) {
+    if (offset < 0 || offset + bytes > buffer.length)
+        return undefined;
+    if (bytes === 2)
+        return littleEndian ? buffer.readUInt16LE(offset) : buffer.readUInt16BE(offset);
+    if (bytes === 4)
+        return littleEndian ? buffer.readUInt32LE(offset) : buffer.readUInt32BE(offset);
+    const value = littleEndian ? buffer.readBigUInt64LE(offset) : buffer.readBigUInt64BE(offset);
+    return value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : undefined;
+}
+function isMuslFromElfInterpreter() {
+    let fd;
+    try {
+        fd = (0,external_node_fs_.openSync)(process.execPath, "r");
+        const header = Buffer.alloc(64);
+        if ((0,external_node_fs_.readSync)(fd, header, 0, header.length, 0) < 52)
+            return undefined;
+        if (!header.subarray(0, 4).equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46])))
+            return undefined;
+        const elfClass = header[4];
+        const dataEncoding = header[5];
+        if ((elfClass !== 1 && elfClass !== 2) || (dataEncoding !== 1 && dataEncoding !== 2)) {
+            return undefined;
+        }
+        const littleEndian = dataEncoding === 1;
+        const is64Bit = elfClass === 2;
+        const tableOffset = readUInt(header, is64Bit ? 32 : 28, is64Bit ? 8 : 4, littleEndian);
+        const entrySize = readUInt(header, is64Bit ? 54 : 42, 2, littleEndian);
+        const entryCount = readUInt(header, is64Bit ? 56 : 44, 2, littleEndian);
+        if (tableOffset === undefined ||
+            entrySize === undefined ||
+            entryCount === undefined ||
+            entrySize < (is64Bit ? 56 : 32) ||
+            entryCount > 1024) {
+            return undefined;
+        }
+        const programHeader = Buffer.alloc(entrySize);
+        for (let index = 0; index < entryCount; index += 1) {
+            const offset = tableOffset + index * entrySize;
+            if ((0,external_node_fs_.readSync)(fd, programHeader, 0, entrySize, offset) !== entrySize)
+                return undefined;
+            if (readUInt(programHeader, 0, 4, littleEndian) !== 3)
+                continue;
+            const interpreterOffset = readUInt(programHeader, is64Bit ? 8 : 4, is64Bit ? 8 : 4, littleEndian);
+            const interpreterSize = readUInt(programHeader, is64Bit ? 32 : 16, is64Bit ? 8 : 4, littleEndian);
+            if (interpreterOffset === undefined ||
+                interpreterSize === undefined ||
+                interpreterSize < 1 ||
+                interpreterSize > 4096) {
+                return undefined;
+            }
+            const interpreter = Buffer.alloc(interpreterSize);
+            if ((0,external_node_fs_.readSync)(fd, interpreter, 0, interpreterSize, interpreterOffset) !== interpreterSize) {
+                return undefined;
+            }
+            return isMuslFilename(interpreter.toString("utf8"));
+        }
     }
-    if (getFsSafePythonConfig().mode === "off") {
-        throw new errors_FsSafeError("helper-unavailable", "Python helper is disabled");
+    catch {
+        return undefined;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                (0,external_node_fs_.closeSync)(fd);
+            }
+            catch {
+                // Best-effort detection must never turn close failure into import failure.
+            }
+        }
     }
+    return undefined;
 }
-function isSpawnUnavailable(error) {
-    if (!(error instanceof Error)) {
+function isMusl() {
+    if (process.platform !== "linux")
         return false;
+    for (const detector of [isMuslFromReport, isMuslFromFilesystem, isMuslFromElfInterpreter]) {
+        const result = detector();
+        if (result !== undefined)
+            return result;
     }
-    const maybeErrno = error;
-    return (typeof maybeErrno.syscall === "string" &&
-        maybeErrno.syscall.startsWith("spawn") &&
-        ["EACCES", "ENOENT", "ENOEXEC"].includes(maybeErrno.code ?? ""));
+    // Unknown Linux libc: try the glibc binary and let its require fail normally.
+    return false;
 }
-function mapWorkerError(response) {
-    const code = typeof response.code === "string" ? response.code : "";
-    const errno = typeof response.errno === "number" ? response.errno : undefined;
-    const message = typeof response.message === "string" && response.message
-        ? response.message
-        : "pinned helper failed";
-    const tooLarge = message.match(/fs-safe-too-large:(\d+):(\d+)/);
-    if (tooLarge) {
-        const [, limit, got] = tooLarge;
-        return new errors_FsSafeError("too-large", `file exceeds limit of ${limit} bytes (got at least ${got})`);
-    }
-    if (message.includes("fs-safe-not-file")) {
-        return new errors_FsSafeError("not-file", "not a file");
-    }
-    if (message.includes("fs-safe-source-mismatch")) {
-        return new errors_FsSafeError("path-mismatch", "source path changed during copy");
-    }
-    if (message.includes("fs-safe-temp-mismatch")) {
-        return new errors_FsSafeError("path-mismatch", "temp path changed during write");
-    }
-    if (message.includes("fs-safe-root-mismatch")) {
-        return new errors_FsSafeError("path-mismatch", "root path changed during operation");
-    }
-    if (message.includes("fs-safe-directory-noreplace-unsupported")) {
-        return new errors_FsSafeError("invalid-path", "directory moves require overwrite: true");
+function targetFor(platform, arch, musl) {
+    if (platform === "win32" && arch === "x64")
+        return "win32-x64-msvc";
+    if (platform === "darwin" && arch === "x64")
+        return "darwin-x64";
+    if (platform === "darwin" && arch === "arm64")
+        return "darwin-arm64";
+    if (platform === "linux" && (arch === "x64" || arch === "arm64")) {
+        return `linux-${arch}-${musl ? "musl" : "gnu"}`;
     }
-    if (code === "FileNotFoundError" || errno === 2) {
-        return new errors_FsSafeError("not-found", "file not found");
-    }
-    if (code === "FileExistsError" || errno === 17) {
-        return new errors_FsSafeError("already-exists", message);
-    }
-    if (errno === 39) {
-        return new errors_FsSafeError("not-empty", "directory is not empty");
+    return undefined;
+}
+function bundledTarget() {
+    return targetFor(process.platform, process.arch, isMusl());
+}
+function loadBundledBinding() {
+    const target = bundledTarget();
+    if (!target) {
+        throw new Error(`Unsupported OS or architecture: ${process.platform}-${process.arch}`);
     }
-    if (errno === 1 || errno === 13 || errno === 21) {
-        return new errors_FsSafeError("not-removable", "path is not removable under root");
+    return native_require((0,external_node_path_.join)(bundledNativeDirectory, target, "fs-safe-native.node"));
+}
+function __loadBundledNativeForTest() {
+    return loadBundledBinding();
+}
+function __nativeLoaderDetectorsForTest() {
+    return {
+        report: isMuslFromReport(),
+        filesystem: isMuslFromFilesystem(),
+        elfInterpreter: isMuslFromElfInterpreter(),
+    };
+}
+function __nativeTargetForTest(platform, arch, musl = false) {
+    return targetFor(platform, arch, musl);
+}
+function getNativeBinding() {
+    const { mode } = getFsSafeNativeConfig();
+    if (mode === "off")
+        return undefined;
+    if (!attempted) {
+        attempted = true;
+        try {
+            native_binding = loadBinding();
+        }
+        catch (error) {
+            loadError = error;
+        }
     }
-    if (code === "NotADirectoryError" || code === "OSError" || errno === 20 || errno === 40) {
-        return new errors_FsSafeError("path-alias", message);
+    if (native_binding)
+        return native_binding;
+    if (mode === "require") {
+        throw new errors_FsSafeError("helper-unavailable", "native fs-safe helper is unavailable", {
+            cause: loadError,
+        });
     }
-    return new errors_FsSafeError("helper-failed", message);
+    return undefined;
 }
-function rejectPending(error, targetWorker = worker) {
-    if (!targetWorker || worker !== targetWorker) {
-        return;
+function requireNativeBinding() {
+    const native = getNativeBinding();
+    if (!native) {
+        throw new FsSafeError("helper-unavailable", "native fs-safe helper is unavailable", {
+            cause: loadError,
+        });
     }
-    setWorkerRef(targetWorker, false);
-    for (const pending of targetWorker.pending.values()) {
-        pending.reject(error);
+    return native;
+}
+function __setNativeLoaderForTest(loader) {
+    native_binding = undefined;
+    loadError = undefined;
+    attempted = false;
+    loadBinding = loader;
+}
+function __resetNativeLoaderForTest() {
+    native_binding = undefined;
+    loadError = undefined;
+    attempted = false;
+    loadBinding = loadBundledBinding;
+}
+
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/native-operations.js
+
+
+
+
+
+function nativeOpenFlags(flags) {
+    const closeOnExec = external_node_fs_.constants.O_CLOEXEC;
+    return (flags |
+        (closeOnExec ?? 0) |
+        (typeof external_node_fs_.constants.O_NOFOLLOW === "number" ? external_node_fs_.constants.O_NOFOLLOW : 0));
+}
+function writeAll(fd, data) {
+    let offset = 0;
+    while (offset < data.byteLength) {
+        const written = external_node_fs_.writeSync(fd, data, offset, data.byteLength - offset);
+        if (written <= 0) {
+            throw Object.assign(new Error("native file write made no progress"), { code: "EIO" });
+        }
+        offset += written;
     }
-    targetWorker.pending.clear();
-    worker = null;
 }
-function handleWorkerLine(currentWorker, line) {
-    if (worker !== currentWorker || !line.trim()) {
+function wrapNativeFd(fd, containment) {
+    let open = true;
+    return {
+        fd,
+        containment,
+        async close() {
+            if (open) {
+                open = false;
+                external_node_fs_.closeSync(fd);
+            }
+        },
+        async stat() {
+            return external_node_fs_.fstatSync(fd);
+        },
+        async writeFile(data, encoding) {
+            writeAll(fd, Buffer.isBuffer(data) ? data : Buffer.from(data, encoding ?? "utf8"));
+        },
+    };
+}
+function removeNativeCreatedFileIfStillPinned(params) {
+    if (!params.created) {
         return;
     }
-    let decoded;
     try {
-        decoded = JSON.parse(line);
+        const parentPathStat = external_node_fs_.lstatSync(params.parentPath);
+        const parentFdStat = params.binding.fstatIdentity(params.parentFd);
+        const targetPath = external_node_path_.join(params.parentPath, params.basename);
+        const target = external_node_fs_.lstatSync(targetPath);
+        if (!parentPathStat.isSymbolicLink() &&
+            parentPathStat.dev === parentFdStat.dev &&
+            parentPathStat.ino === parentFdStat.ino &&
+            !target.isSymbolicLink() &&
+            file_identity_sameFileIdentity(target, params.created)) {
+            external_node_fs_.rmSync(targetPath);
+        }
     }
     catch {
-        rejectPending(new errors_FsSafeError("helper-failed", `pinned helper returned invalid JSON: ${line}`), currentWorker);
-        return;
+        // Failed cleanup leaves a fail-closed artifact instead of deleting an
+        // unverified pathname.
     }
-    if (typeof decoded !== "object" || decoded === null || !("id" in decoded)) {
-        rejectPending(new errors_FsSafeError("helper-failed", "pinned helper returned invalid response"), currentWorker);
-        return;
+}
+async function createNativeExclusiveFile(targetPath, mode) {
+    const binding = getNativeBinding();
+    if (!binding) {
+        return undefined;
     }
-    const response = decoded;
-    const id = typeof response.id === "number" ? response.id : undefined;
-    if (id === undefined) {
-        return;
+    const parentPath = external_node_path_.dirname(targetPath);
+    const basename = external_node_path_.basename(targetPath);
+    const parent = await promises_.open(parentPath, external_node_fs_.constants.O_RDONLY |
+        (typeof external_node_fs_.constants.O_DIRECTORY === "number" ? external_node_fs_.constants.O_DIRECTORY : 0));
+    let fd;
+    let created;
+    try {
+        const opened = binding.openBeneath(parent.fd, basename, nativeOpenFlags(external_node_fs_.constants.O_WRONLY | external_node_fs_.constants.O_CREAT | external_node_fs_.constants.O_EXCL));
+        fd = opened.fd;
+        external_node_fs_.fchmodSync(fd, mode);
+        created = external_node_fs_.fstatSync(fd);
+        return wrapNativeFd(fd, opened.containment);
     }
-    const pending = currentWorker.pending.get(id);
-    if (!pending) {
-        return;
+    catch (error) {
+        if (fd !== undefined) {
+            try {
+                external_node_fs_.closeSync(fd);
+            }
+            catch {
+                // Preserve the original error.
+            }
+            removeNativeCreatedFileIfStillPinned({
+                binding,
+                parentPath,
+                parentFd: parent.fd,
+                basename,
+                created,
+            });
+        }
+        throw error;
     }
-    currentWorker.pending.delete(id);
-    if (currentWorker.pending.size === 0) {
-        setWorkerRef(currentWorker, false);
+    finally {
+        await parent.close().catch(() => undefined);
     }
-    if (response.ok === true) {
-        pending.resolve(response.result);
-        return;
+}
+function syncNativeFileBestEffort(fd) {
+    try {
+        external_node_fs_.fsyncSync(fd);
+    }
+    catch (error) {
+        if (error.code !== "EPERM") {
+            throw error;
+        }
+    }
+}
+function writeNativeFd(fd, data) {
+    writeAll(fd, data);
+}
+
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/native-pinned-write.js
+
+
+
+
+
+
+function assertWithinMaxBytes(bytes, maxBytes) {
+    if (maxBytes !== undefined && bytes > maxBytes) {
+        throw new errors_FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`);
     }
-    pending.reject(mapWorkerError(decoded));
 }
-function getWorker() {
-    assertPinnedHelperSupported();
-    if (worker) {
-        return worker;
+async function inputToBuffer(input, maxBytes) {
+    if (input.kind === "buffer") {
+        const data = typeof input.data === "string"
+            ? Buffer.from(input.data, input.encoding ?? "utf8")
+            : Buffer.from(input.data);
+        assertWithinMaxBytes(data.byteLength, maxBytes);
+        return data;
     }
-    const child = (0,external_node_child_process_.spawn)(resolvePython(), ["-u", "-c", PINNED_PYTHON_WORKER_SOURCE], {
-        stdio: ["pipe", "pipe", "pipe"],
-    });
-    const currentWorker = { child, pending: new Map(), stderr: "", stdoutBuffer: "" };
-    worker = currentWorker;
-    child.stdout.setEncoding("utf8");
-    child.stderr.setEncoding("utf8");
-    child.stdout.on("data", (chunk) => {
-        if (worker !== currentWorker) {
-            return;
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of input.stream) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += buffer.byteLength;
+        assertWithinMaxBytes(bytes, maxBytes);
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks, bytes);
+}
+function native_pinned_write_nativeOpenFlags(flags) {
+    const closeOnExec = external_node_fs_.constants.O_CLOEXEC;
+    return (flags |
+        (closeOnExec ?? 0) |
+        (typeof external_node_fs_.constants.O_NOFOLLOW === "number" ? external_node_fs_.constants.O_NOFOLLOW : 0));
+}
+function sameNativeIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino;
+}
+async function runPinnedWriteNative(binding, params) {
+    const data = await inputToBuffer(params.input, params.maxBytes);
+    const root = await promises_.open(params.rootPath, external_node_fs_.constants.O_RDONLY |
+        (typeof external_node_fs_.constants.O_DIRECTORY === "number" ? external_node_fs_.constants.O_DIRECTORY : 0));
+    let parentFd;
+    let tempFd;
+    let targetFd;
+    let tempIdentity;
+    let parentPath = params.rootPath;
+    const tempName = `.${params.basename}.${(0,external_node_crypto_.randomUUID)()}.native.tmp`;
+    let renamed = false;
+    try {
+        const rootIdentity = binding.fstatIdentity(root.fd);
+        if (params.rootIdentity && !sameNativeIdentity(params.rootIdentity, rootIdentity)) {
+            throw new errors_FsSafeError("path-mismatch", "root path changed during native write");
+        }
+        if (params.mkdir) {
+            binding.mkdirBeneath(root.fd, params.relativeParentPath, 0o777);
+        }
+        const parentFlags = external_node_fs_.constants.O_RDONLY |
+            (typeof external_node_fs_.constants.O_DIRECTORY === "number" ? external_node_fs_.constants.O_DIRECTORY : 0);
+        parentFd = binding.openBeneath(root.fd, params.relativeParentPath, parentFlags).fd;
+        parentPath = await promises_.realpath(params.relativeParentPath
+            ? external_node_path_.join(params.rootPath, ...params.relativeParentPath.split("/"))
+            : params.rootPath);
+        const parentPathStat = await promises_.lstat(parentPath);
+        const parentIdentity = binding.fstatIdentity(parentFd);
+        if (parentPathStat.isSymbolicLink() ||
+            !sameNativeIdentity(parentPathStat, parentIdentity)) {
+            throw new errors_FsSafeError("path-mismatch", "native write parent changed during resolution");
         }
-        currentWorker.stdoutBuffer += chunk;
-        for (;;) {
-            const newline = currentWorker.stdoutBuffer.indexOf("\n");
-            if (newline < 0) {
-                break;
+        try {
+            await promises_.lstat(external_node_path_.join(parentPath, params.basename));
+            throw Object.assign(new Error("destination already exists"), { code: "EEXIST" });
+        }
+        catch (error) {
+            if (error.code !== "ENOENT") {
+                throw error;
             }
-            const line = currentWorker.stdoutBuffer.slice(0, newline);
-            currentWorker.stdoutBuffer = currentWorker.stdoutBuffer.slice(newline + 1);
-            handleWorkerLine(currentWorker, line);
         }
-    });
-    child.stderr.on("data", (chunk) => {
-        if (worker === currentWorker) {
-            currentWorker.stderr = `${currentWorker.stderr}${chunk}`.slice(-4096);
+        tempFd = binding.openBeneath(parentFd, tempName, native_pinned_write_nativeOpenFlags(external_node_fs_.constants.O_WRONLY | external_node_fs_.constants.O_CREAT | external_node_fs_.constants.O_EXCL)).fd;
+        external_node_fs_.fchmodSync(tempFd, params.mode || 0o600);
+        writeNativeFd(tempFd, data);
+        syncNativeFileBestEffort(tempFd);
+        tempIdentity = external_node_fs_.fstatSync(tempFd);
+        binding.renameNoReplace(parentFd, tempName, parentFd, params.basename);
+        renamed = true;
+        targetFd = binding.openBeneath(parentFd, params.basename, native_pinned_write_nativeOpenFlags(external_node_fs_.constants.O_RDONLY)).fd;
+        const targetIdentity = binding.fstatIdentity(targetFd);
+        if (!targetIdentity.isFile || !sameNativeIdentity(tempIdentity, targetIdentity)) {
+            throw new errors_FsSafeError("path-mismatch", "native write target changed after rename");
         }
-    });
-    child.once("error", (error) => {
-        const mapped = isSpawnUnavailable(error)
-            ? new errors_FsSafeError("helper-unavailable", "Python helper is unavailable", { cause: error })
-            : error instanceof Error
-                ? error
-                : new Error(String(error));
-        rejectPending(mapped, currentWorker);
-    });
-    child.once("close", (code, signal) => {
-        const stderr = currentWorker.stderr.trim();
-        rejectPending(new errors_FsSafeError("helper-failed", stderr || `pinned helper exited with code ${code ?? "null"} (${signal ?? "?"})`), currentWorker);
-    });
-    process.once("exit", () => {
-        child.kill("SIGTERM");
-    });
-    setWorkerRef(currentWorker, false);
-    return currentWorker;
-}
-function setRefable(value, ref) {
-    if (!value) {
-        return;
+        syncNativeFileBestEffort(parentFd);
+        return { dev: targetIdentity.dev, ino: targetIdentity.ino };
     }
-    const method = ref ? "ref" : "unref";
-    const refable = value;
-    refable[method]?.();
-}
-function setWorkerRef(currentWorker, ref) {
-    setRefable(currentWorker.child, ref);
-    setRefable(currentWorker.child.stdin, ref);
-    setRefable(currentWorker.child.stdout, ref);
-    setRefable(currentWorker.child.stderr, ref);
-}
-async function runPinnedPythonOperation(params) {
-    const requestId = nextRequestId++;
-    const currentWorker = getWorker();
-    if (typeof currentWorker.child.stdin?.write !== "function") {
-        throw new errors_FsSafeError("helper-unavailable", "Python helper stdin is unavailable");
-    }
-    setWorkerRef(currentWorker, true);
-    return await new Promise((resolve, reject) => {
-        currentWorker.pending.set(requestId, {
-            reject,
-            resolve: (value) => resolve(value),
-        });
-        const request = JSON.stringify({
-            id: requestId,
-            operation: params.operation,
-            rootPath: params.rootPath,
-            payload: params.payload,
-        });
-        currentWorker.child.stdin.write(`${request}\n`, (error) => {
-            if (error) {
-                currentWorker.pending.delete(requestId);
-                if (currentWorker.pending.size === 0) {
-                    setWorkerRef(currentWorker, false);
-                }
-                reject(error);
-            }
-        });
-    });
-}
-function assertPinnedPythonOperationAvailable() {
-    const currentWorker = getWorker();
-    if (typeof currentWorker.child.stdin?.write !== "function") {
-        throw new errors_FsSafeError("helper-unavailable", "Python helper stdin is unavailable");
+    finally {
+        if (targetFd !== undefined) {
+            external_node_fs_.closeSync(targetFd);
+        }
+        if (tempFd !== undefined) {
+            external_node_fs_.closeSync(tempFd);
+        }
+        if (!renamed && parentFd !== undefined) {
+            removeNativeCreatedFileIfStillPinned({
+                binding,
+                parentPath,
+                parentFd,
+                basename: tempName,
+                created: tempIdentity,
+            });
+        }
+        if (parentFd !== undefined) {
+            external_node_fs_.closeSync(parentFd);
+        }
+        await root.close().catch(() => undefined);
     }
 }
+
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/pinned-operation.js
+
 function validatePinnedOperationPayload(payload) {
     if (typeof payload.relativePath === "string") {
         validatePinnedRelativePath(payload.relativePath);
@@ -28223,9 +27993,6 @@ function validatePinnedOperationPayload(payload) {
         validatePinnedRelativePath(payload.to);
     }
 }
-function isPinnedHelperUnavailable(error) {
-    return error instanceof Error && "code" in error && error.code === "helper-unavailable";
-}
 function validatePinnedRelativePath(relativePath) {
     if (relativePath.length === 0 || relativePath === ".") {
         return;
@@ -28247,47 +28014,91 @@ function validatePinnedRelativePath(relativePath) {
     }
 }
 
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/pinned-helper.js
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/bounded-read.js
 
 
-async function runPinnedHelper(operation, rootDir, payload) {
-    validatePinnedOperationPayload(payload);
-    return await runPinnedPythonOperation({
-        operation,
-        rootPath: rootDir,
-        payload,
-    });
-}
-async function helperStat(rootDir, relativePath) {
-    return await runPinnedHelper("stat", rootDir, { relativePath });
+const READ_CHUNK_BYTES = 64 * 1024;
+function assertMaxBytes(maxBytes) {
+    if (maxBytes === Number.POSITIVE_INFINITY) {
+        return;
+    }
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
+        throw new RangeError("maxBytes must be a non-negative safe integer or Infinity");
+    }
 }
-async function helperReaddir(rootDir, relativePath, withFileTypes) {
-    return await runPinnedHelper("readdir", rootDir, {
-        relativePath,
-        withFileTypes,
-    });
+function createScratchBuffer(maxBytes) {
+    const initialReadBytes = Number.isFinite(maxBytes)
+        ? Math.min(READ_CHUNK_BYTES, maxBytes + 1)
+        : READ_CHUNK_BYTES;
+    return Buffer.allocUnsafe(Math.max(1, initialReadBytes));
 }
-
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/pinned-path.js
-
-
-
-function isPinnedPathHelperSpawnError(error) {
-    return canFallbackFromPythonError(error);
+function nextReadLength(total, maxBytes, capacity) {
+    return Number.isFinite(maxBytes)
+        ? Math.min(capacity, maxBytes - total + 1)
+        : capacity;
 }
-async function runPinnedPathHelper(params) {
-    try {
-        await runPinnedHelper(params.operation, params.rootPath, {
-            relativePath: params.relativePath,
-        });
+function appendChunk(params) {
+    const total = params.total + params.bytesRead;
+    if (total > params.maxBytes) {
+        throw new errors_FsSafeError("too-large", `file exceeds limit of ${params.maxBytes} bytes (got at least ${total})`);
     }
-    catch (error) {
-        if (error instanceof errors_FsSafeError) {
-            throw error;
+    params.chunks.push(Buffer.from(params.scratch.subarray(0, params.bytesRead)));
+    return total;
+}
+async function readBoundedAsync(maxBytes, readChunk) {
+    assertMaxBytes(maxBytes);
+    const chunks = [];
+    const scratch = createScratchBuffer(maxBytes);
+    let total = 0;
+    while (true) {
+        const length = nextReadLength(total, maxBytes, scratch.length);
+        const bytesRead = await readChunk(scratch, length);
+        if (bytesRead === 0) {
+            return Buffer.concat(chunks, total);
         }
-        throw new errors_FsSafeError("helper-failed", "pinned path helper failed", {
-            cause: error instanceof Error ? error : undefined,
+        total = appendChunk({ chunks, scratch, bytesRead, total, maxBytes });
+    }
+}
+/**
+ * Reads from the handle's current offset without closing it. A bounded read
+ * consumes at most maxBytes + 1 bytes so growth after an earlier stat cannot
+ * force an unbounded allocation.
+ */
+async function readFileHandleBounded(handle, maxBytes) {
+    return await readBoundedAsync(maxBytes, async (scratch, length) => {
+        return (await handle.read(scratch, 0, length, null)).bytesRead;
+    });
+}
+function readDescriptorChunk(fd, scratch, length) {
+    return new Promise((resolve, reject) => {
+        fs.read(fd, scratch, 0, length, null, (error, bytesRead) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve(bytesRead);
         });
+    });
+}
+/** Async bounded read from a numeric descriptor. The caller owns the descriptor. */
+async function readFileDescriptorBounded(fd, maxBytes) {
+    return await readBoundedAsync(maxBytes, async (scratch, length) => {
+        return await readDescriptorChunk(fd, scratch, length);
+    });
+}
+/** Sync bounded read from a numeric descriptor. The caller owns the descriptor. */
+function readFileDescriptorBoundedSync(fd, maxBytes) {
+    assertMaxBytes(maxBytes);
+    const chunks = [];
+    const scratch = createScratchBuffer(maxBytes);
+    let total = 0;
+    while (true) {
+        const length = nextReadLength(total, maxBytes, scratch.length);
+        const bytesRead = fs.readSync(fd, scratch, 0, length, null);
+        if (bytesRead === 0) {
+            return Buffer.concat(chunks, total);
+        }
+        total = appendChunk({ chunks, scratch, bytesRead, total, maxBytes });
     }
 }
 
@@ -28295,6 +28106,11 @@ async function runPinnedPathHelper(params) {
 
 
 
+
+
+
+
+const MAX_LOCK_PAYLOAD_BYTES = 1024 * 1024;
 const SIDECAR_LOCK_OWNERSHIP_TOKEN_BYTES = 16;
 const SIDECAR_LOCK_OWNERSHIP_TOKEN_BITS = SIDECAR_LOCK_OWNERSHIP_TOKEN_BYTES * 8;
 const SIDECAR_LOCK_OWNERSHIP_TOKEN_PREFIX = "\t".repeat(8);
@@ -28318,28 +28134,98 @@ function serializeSidecarLockPayload(payload) {
         ownershipToken,
     };
 }
-async function readSidecarLockSnapshot(lockPath) {
+function relativeSidecarLockPath(lockRoot, lockPath) {
+    const resolved = external_node_path_.resolve(lockPath);
+    const lexicalRelative = external_node_path_.relative(lockRoot.rootDir, resolved);
+    const relative = lexicalRelative !== ".." &&
+        !lexicalRelative.startsWith(`..${external_node_path_.sep}`) &&
+        !external_node_path_.isAbsolute(lexicalRelative)
+        ? lexicalRelative
+        : external_node_path_.relative(lockRoot.rootReal, resolved);
+    if (!relative || relative === ".." || relative.startsWith(`..${external_node_path_.sep}`) || external_node_path_.isAbsolute(relative)) {
+        throw new errors_FsSafeError("outside-workspace", "sidecar lock path is outside lockRoot");
+    }
+    return relative.split(external_node_path_.sep).join(external_node_path_.posix.sep);
+}
+function parseSidecarLockPayload(raw, parser) {
+    if (parser) {
+        return parser(raw);
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function readSidecarLockSnapshot(lockPath, options = {}) {
     try {
+        if (options.lockRoot) {
+            const opened = await options.lockRoot.open(relativeSidecarLockPath(options.lockRoot, lockPath));
+            try {
+                const raw = (await readFileHandleBounded(opened.handle, MAX_LOCK_PAYLOAD_BYTES)).toString("utf8");
+                return {
+                    raw,
+                    payload: parseSidecarLockPayload(raw, options.parsePayload),
+                    stat: opened.stat,
+                };
+            }
+            finally {
+                await opened.handle.close().catch(() => undefined);
+            }
+        }
         const stat = await promises_.lstat(lockPath);
         const raw = await promises_.readFile(lockPath, "utf8");
-        try {
-            const parsed = JSON.parse(raw);
-            const payload = parsed && typeof parsed === "object" && !Array.isArray(parsed)
-                ? parsed
-                : null;
-            return { raw, payload, stat };
-        }
-        catch {
-            return { raw, payload: null, stat };
-        }
+        return { raw, payload: parseSidecarLockPayload(raw, options.parsePayload), stat };
     }
     catch (err) {
-        if (err.code === "ENOENT") {
+        if (err.code === "ENOENT" ||
+            (err instanceof errors_FsSafeError && err.code === "not-found")) {
             return null;
         }
         throw err;
     }
 }
+function readSidecarLockSnapshotSync(lockPath, parsePayload) {
+    let fd;
+    try {
+        const before = fsSync.lstatSync(lockPath);
+        if (!before.isFile() || before.isSymbolicLink())
+            return null;
+        const noFollow = process.platform !== "win32" && typeof fsSync.constants.O_NOFOLLOW === "number"
+            ? fsSync.constants.O_NOFOLLOW
+            : 0;
+        fd = fsSync.openSync(lockPath, fsSync.constants.O_RDONLY | noFollow);
+        const opened = fsSync.fstatSync(fd);
+        const raw = fsSync.readFileSync(fd, "utf8");
+        const after = fsSync.lstatSync(lockPath);
+        if (!sameFileIdentity(before, opened) || !sameFileIdentity(opened, after))
+            return null;
+        return {
+            raw,
+            payload: parseSidecarLockPayload(raw, parsePayload),
+            stat: after,
+            ownershipToken: readSidecarLockOwnershipToken(raw),
+        };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    finally {
+        if (fd !== undefined)
+            fsSync.closeSync(fd);
+    }
+}
+function removeSidecarLockIfUnchangedSync(lockPath, observed) {
+    const current = readSidecarLockSnapshotSync(lockPath);
+    if (!current || !sidecarLockSnapshotMatches(current, observed))
+        return false;
+    fsSync.rmSync(lockPath);
+    return true;
+}
 function sidecarLockSnapshotMatches(current, observed) {
     if (observed.ownershipToken !== undefined) {
         return (current.stat?.isFile() === true &&
@@ -28357,16 +28243,21 @@ function sidecarLockSnapshotMatches(current, observed) {
     }
     return observed.stat !== undefined && current.stat !== undefined;
 }
-async function removeSidecarLockIfUnchanged(lockPath, observed) {
-    const current = await readSidecarLockSnapshot(lockPath);
+async function removeSidecarLockIfUnchanged(lockPath, observed, options = {}) {
+    const current = await readSidecarLockSnapshot(lockPath, options);
     if (!current || !observed || !sidecarLockSnapshotMatches(current, observed)) {
         return false;
     }
-    await promises_.rm(lockPath, { force: true }).catch(() => undefined);
+    if (options.lockRoot) {
+        await options.lockRoot.remove(relativeSidecarLockPath(options.lockRoot, lockPath)).catch(() => undefined);
+    }
+    else {
+        await promises_.rm(lockPath, { force: true }).catch(() => undefined);
+    }
     return true;
 }
-async function sidecarLockSnapshotStillPresent(lockPath, observed) {
-    const current = await readSidecarLockSnapshot(lockPath);
+async function sidecarLockSnapshotStillPresent(lockPath, observed, options = {}) {
+    const current = await readSidecarLockSnapshot(lockPath, options);
     return !!current && !!observed && sidecarLockSnapshotMatches(current, observed);
 }
 async function sidecarReclaimGuardExists(pathname) {
@@ -28402,7 +28293,8 @@ async function removeStaleSidecarLockIfAllowed(params) {
     if (!params.shouldRemoveStaleLock || params.snapshot.raw === undefined) {
         return "not-approved";
     }
-    if (!(await sidecarLockSnapshotStillPresent(params.lockPath, params.snapshot))) {
+    const ioOptions = { lockRoot: params.lockRoot, parsePayload: params.parsePayload };
+    if (!(await sidecarLockSnapshotStillPresent(params.lockPath, params.snapshot, ioOptions))) {
         return "changed";
     }
     if (!(await params.shouldRemoveStaleLock({
@@ -28413,11 +28305,16 @@ async function removeStaleSidecarLockIfAllowed(params) {
     }))) {
         return "not-approved";
     }
-    if (!(await sidecarLockSnapshotStillPresent(params.lockPath, params.snapshot))) {
+    if (!(await sidecarLockSnapshotStillPresent(params.lockPath, params.snapshot, ioOptions))) {
         return "changed";
     }
     try {
-        await promises_.rm(params.lockPath);
+        if (params.lockRoot) {
+            await params.lockRoot.remove(relativeSidecarLockPath(params.lockRoot, params.lockPath));
+        }
+        else {
+            await promises_.rm(params.lockPath);
+        }
         return "removed";
     }
     catch (err) {
@@ -28428,12 +28325,77 @@ async function removeStaleSidecarLockIfAllowed(params) {
     }
 }
 
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/sidecar-lock-handle.js
+
+function createSidecarLockHandle(params) {
+    let released = false;
+    const release = async () => {
+        if (released)
+            return;
+        released = true;
+        await params.release();
+    };
+    return {
+        lockPath: params.lockPath,
+        normalizedTargetPath: params.normalizedTargetPath,
+        verifyStillHeld: params.verifyStillHeld,
+        release,
+        [Symbol.asyncDispose]: release,
+    };
+}
+function createHeldSidecarLockHandle(params) {
+    return createSidecarLockHandle({
+        lockPath: params.held.lockPath,
+        normalizedTargetPath: params.normalizedTargetPath,
+        verifyStillHeld: async () => await sidecarLockSnapshotStillPresent(params.held.lockPath, params.held.snapshot, {
+            lockRoot: params.held.lockRoot,
+            parsePayload: params.held.parsePayload,
+        }),
+        release: params.release,
+    });
+}
+
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/sidecar-lock-policy.js
+
+function computeSidecarLockDelayMs(retry, attempt) {
+    const minTimeout = retry.minTimeout ?? 50;
+    const maxTimeout = retry.maxTimeout ?? 1000;
+    const factor = retry.factor ?? 1;
+    const base = Math.min(maxTimeout, Math.max(minTimeout, minTimeout * factor ** attempt));
+    const jitter = retry.randomize ? 1 + Math.random() : 1;
+    return Math.min(maxTimeout, Math.round(base * jitter));
+}
+function sidecarLockPayloadIsStale(payload, staleMs, nowMs) {
+    const createdAt = payload &&
+        typeof payload === "object" &&
+        "createdAt" in payload &&
+        typeof payload.createdAt === "string"
+        ? payload.createdAt
+        : "";
+    const createdAtMs = Date.parse(createdAt);
+    return Number.isFinite(createdAtMs) && nowMs - createdAtMs > staleMs;
+}
+async function defaultSidecarLockShouldReclaim(params) {
+    if (sidecarLockPayloadIsStale(params.payload, params.staleMs, params.nowMs))
+        return true;
+    try {
+        return params.nowMs - (await promises_.stat(params.lockPath)).mtimeMs > params.staleMs;
+    }
+    catch {
+        return true;
+    }
+}
+
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/sidecar-lock.js
 
 
 
 
 
+
+
+
+
 const GLOBAL_STATE_KEY = Symbol.for("fsSafe.sidecarLockManagers");
 function getGlobalManagers() {
     const globalWithState = globalThis;
@@ -28459,6 +28421,9 @@ function resolveManagerState(key) {
         // Backfill state created by fs-safe versions that predate reclaim guards.
         state.reclaimCleanupRegistered ??= false;
         state.reclaimGuards ??= new Set();
+        for (const held of state.held.values()) {
+            held.refCount ??= 1;
+        }
     }
     return state;
 }
@@ -28514,28 +28479,6 @@ async function resolveNormalizedTargetPath(targetPath) {
         return resolved;
     }
 }
-function computeDelayMs(retry, attempt) {
-    const minTimeout = retry.minTimeout ?? 50;
-    const maxTimeout = retry.maxTimeout ?? 1000;
-    const factor = retry.factor ?? 1;
-    const base = Math.min(maxTimeout, Math.max(minTimeout, minTimeout * factor ** attempt));
-    const jitter = retry.randomize ? 1 + Math.random() : 1;
-    return Math.min(maxTimeout, Math.round(base * jitter));
-}
-async function defaultShouldReclaim(params) {
-    const createdAt = typeof params.payload?.createdAt === "string" ? params.payload.createdAt : "";
-    const createdAtMs = Date.parse(createdAt);
-    if (Number.isFinite(createdAtMs) && params.nowMs - createdAtMs > params.staleMs) {
-        return true;
-    }
-    try {
-        const stat = await promises_.stat(params.lockPath);
-        return params.nowMs - stat.mtimeMs > params.staleMs;
-    }
-    catch {
-        return true;
-    }
-}
 function releaseAllReclaimGuardsSync(state) {
     for (const reclaimGuardPath of state.reclaimGuards) {
         try {
@@ -28551,7 +28494,7 @@ function releaseAllLocksSync(state) {
     for (const [normalizedTargetPath, held] of state.held) {
         void held.handle.close().catch(() => undefined);
         try {
-            if (snapshotMatchesSync(held.lockPath, held.snapshot)) {
+            if (!held.lockRoot && snapshotMatchesSync(held.lockPath, held.snapshot)) {
                 external_node_fs_.rmSync(held.lockPath, { force: true });
             }
         }
@@ -28562,17 +28505,17 @@ function releaseAllLocksSync(state) {
     }
     releaseAllReclaimGuardsSync(state);
 }
-async function releaseHeldLock(state, normalizedTargetPath, held, opts = {}) {
+async function releaseHeldLock(state, normalizedTargetPath, held, options = {}) {
     const current = state.held.get(normalizedTargetPath);
     if (current !== held) {
         return false;
     }
-    if (opts.force) {
-        held.count = 0;
+    if (options.force) {
+        held.refCount = 0;
     }
     else {
-        held.count -= 1;
-        if (held.count > 0) {
+        held.refCount -= 1;
+        if (held.refCount > 0) {
             return false;
         }
     }
@@ -28581,9 +28524,16 @@ async function releaseHeldLock(state, normalizedTargetPath, held, opts = {}) {
         return true;
     }
     state.held.delete(normalizedTargetPath);
+    if (held.compromiseTimer) {
+        clearInterval(held.compromiseTimer);
+        held.compromiseTimer = undefined;
+    }
     held.releasePromise = (async () => {
         await held.handle.close().catch(() => undefined);
-        await removeSidecarLockIfUnchanged(held.lockPath, held.snapshot);
+        await removeSidecarLockIfUnchanged(held.lockPath, held.snapshot, {
+            lockRoot: held.lockRoot,
+            parsePayload: held.parsePayload,
+        });
     })();
     try {
         await held.releasePromise;
@@ -28593,6 +28543,13 @@ async function releaseHeldLock(state, normalizedTargetPath, held, opts = {}) {
         held.releasePromise = undefined;
     }
 }
+function handleForHeldLock(state, normalizedTargetPath, held) {
+    return createHeldSidecarLockHandle({
+        normalizedTargetPath,
+        held,
+        release: async () => await releaseHeldLock(state, normalizedTargetPath, held),
+    });
+}
 function createSidecarLockManager(key) {
     const state = resolveManagerState(key);
     function ensureExitCleanupRegistered() {
@@ -28612,15 +28569,12 @@ function createSidecarLockManager(key) {
         const normalizedTargetPath = await resolveNormalizedTargetPath(options.targetPath);
         const lockPath = options.lockPath ?? `${normalizedTargetPath}.lock`;
         const held = state.held.get(normalizedTargetPath);
-        if (held && options.allowReentrant) {
-            held.count += 1;
-            const release = () => releaseHeldLock(state, normalizedTargetPath, held).then(() => undefined);
-            return {
-                lockPath,
-                normalizedTargetPath,
-                release,
-                [Symbol.asyncDispose]: release,
-            };
+        if (held &&
+            options.reentrantOwner !== undefined &&
+            held.reentrantOwner !== undefined &&
+            options.reentrantOwner === held.reentrantOwner) {
+            held.refCount += 1;
+            return handleForHeldLock(state, normalizedTargetPath, held);
         }
         const startedAt = Date.now();
         const retry = options.retry ?? {};
@@ -28643,7 +28597,7 @@ function createSidecarLockManager(key) {
             const remaining = options.timeoutMs === undefined || options.timeoutMs === Number.POSITIVE_INFINITY
                 ? Number.POSITIVE_INFINITY
                 : Math.max(0, options.timeoutMs - elapsed);
-            const delay = Math.min(computeDelayMs(retry, attempt), remaining);
+            const delay = Math.min(computeSidecarLockDelayMs(retry, attempt), remaining);
             attempt += 1;
             await new Promise((resolve) => setTimeout(resolve, delay));
         };
@@ -28655,18 +28609,36 @@ function createSidecarLockManager(key) {
                 }
                 let handle = null;
                 try {
-                    handle = await promises_.open(lockPath, "wx");
                     const payload = await options.payload();
                     const { raw, ownershipToken } = serializeSidecarLockPayload(payload);
-                    await handle.writeFile(raw, "utf8");
+                    if (options.lockRoot) {
+                        const relativeLockPath = relativeSidecarLockPath(options.lockRoot, lockPath);
+                        try {
+                            await options.lockRoot.create(relativeLockPath, raw, { mkdir: true, mode: 0o600 });
+                        }
+                        catch (error) {
+                            if (error instanceof errors_FsSafeError && error.code === "already-exists") {
+                                throw Object.assign(new Error("sidecar lock exists"), { code: "EEXIST" });
+                            }
+                            throw error;
+                        }
+                        handle = (await options.lockRoot.open(relativeLockPath)).handle;
+                    }
+                    else {
+                        handle = (await createNativeExclusiveFile(lockPath, 0o600)) ?? await promises_.open(lockPath, "wx");
+                        await handle.writeFile(raw, "utf8");
+                    }
                     const snapshot = { raw, payload, stat: await handle.stat(), ownershipToken };
                     const createdHeld = {
-                        count: 1,
+                        refCount: 1,
+                        reentrantOwner: options.reentrantOwner,
                         handle,
                         lockPath,
                         snapshot,
                         acquiredAt: Date.now(),
                         metadata: options.metadata ?? {},
+                        lockRoot: options.lockRoot,
+                        parsePayload: options.parsePayload,
                     };
                     state.held.set(normalizedTargetPath, createdHeld);
                     if (ownsReclaimGuard) {
@@ -28679,13 +28651,21 @@ function createSidecarLockManager(key) {
                             throw err;
                         }
                     }
-                    const release = () => releaseHeldLock(state, normalizedTargetPath, createdHeld).then(() => undefined);
-                    return {
-                        lockPath,
-                        normalizedTargetPath,
-                        release,
-                        [Symbol.asyncDispose]: release,
-                    };
+                    const returnedHandle = handleForHeldLock(state, normalizedTargetPath, createdHeld);
+                    const interval = options.compromiseCheckIntervalMs;
+                    if (options.onCompromised && interval !== undefined && interval > 0) {
+                        createdHeld.compromiseTimer = setInterval(() => {
+                            void returnedHandle.verifyStillHeld().then((stillHeld) => {
+                                if (!stillHeld && createdHeld.compromiseTimer) {
+                                    clearInterval(createdHeld.compromiseTimer);
+                                    createdHeld.compromiseTimer = undefined;
+                                    options.onCompromised?.({ lockPath, normalizedTargetPath });
+                                }
+                            });
+                        }, interval);
+                        createdHeld.compromiseTimer.unref();
+                    }
+                    return returnedHandle;
                 }
                 catch (err) {
                     if (handle) {
@@ -28702,11 +28682,16 @@ function createSidecarLockManager(key) {
                         }
                         // If payload serialization/write fails, the file may be empty or
                         // partial JSON, so remove while our exclusive handle is still open.
-                        await promises_.rm(lockPath, { force: true }).catch(() => undefined);
+                        if (!options.lockRoot) {
+                            await promises_.rm(lockPath, { force: true }).catch(() => undefined);
+                        }
                         await handle.close().catch(() => undefined);
                         // Windows can refuse removing an open file; retry after close but
                         // only if the path still points at the file identity we created.
-                        await removeSidecarLockIfUnchanged(lockPath, failedSnapshot);
+                        await removeSidecarLockIfUnchanged(lockPath, failedSnapshot, {
+                            lockRoot: options.lockRoot,
+                            parsePayload: options.parsePayload,
+                        });
                     }
                     if (err.code !== "EEXIST") {
                         throw err;
@@ -28717,11 +28702,18 @@ function createSidecarLockManager(key) {
                         continue;
                     }
                     const nowMs = Date.now();
-                    const snapshot = await readSidecarLockSnapshot(lockPath);
+                    const snapshot = await readSidecarLockSnapshot(lockPath, {
+                        lockRoot: options.lockRoot,
+                        parsePayload: options.parsePayload,
+                    });
                     if (!snapshot) {
                         continue;
                     }
-                    const shouldReclaim = options.shouldReclaim ?? defaultShouldReclaim;
+                    if (state.held.has(normalizedTargetPath)) {
+                        await waitForRetry();
+                        continue;
+                    }
+                    const shouldReclaim = options.shouldReclaim ?? defaultSidecarLockShouldReclaim;
                     if (await shouldReclaim({
                         lockPath,
                         normalizedTargetPath,
@@ -28730,7 +28722,10 @@ function createSidecarLockManager(key) {
                         nowMs,
                         heldByThisProcess: state.held.has(normalizedTargetPath),
                     })) {
-                        if (!(await sidecarLockSnapshotStillPresent(lockPath, snapshot))) {
+                        if (!(await sidecarLockSnapshotStillPresent(lockPath, snapshot, {
+                            lockRoot: options.lockRoot,
+                            parsePayload: options.parsePayload,
+                        }))) {
                             continue;
                         }
                         const staleRecovery = options.staleRecovery ?? "fail-closed";
@@ -28745,6 +28740,8 @@ function createSidecarLockManager(key) {
                                 normalizedTargetPath,
                                 snapshot,
                                 shouldRemoveStaleLock: options.shouldRemoveStaleLock,
+                                lockRoot: options.lockRoot,
+                                parsePayload: options.parsePayload,
                             });
                             if (removal === "removed" || removal === "changed") {
                                 continue;
@@ -28832,6 +28829,7 @@ function __setFsSafeTestHooksForTest(hooks) {
 
 
 
+
 function pinned_write_byteLength(input, encoding) {
     return typeof input === "string"
         ? Buffer.byteLength(input, encoding ?? "utf8")
@@ -28846,7 +28844,7 @@ function assertSafeBasename(basename) {
         throw new errors_FsSafeError("invalid-path", "invalid target path");
     }
 }
-function assertWithinMaxBytes(bytes, maxBytes) {
+function pinned_write_assertWithinMaxBytes(bytes, maxBytes) {
     if (maxBytes !== undefined && bytes > maxBytes) {
         throw new errors_FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`);
     }
@@ -28866,7 +28864,7 @@ async function writeStreamToHandle(stream, handle, maxBytes) {
     for await (const chunk of stream) {
         const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
         bytes += buffer.byteLength;
-        assertWithinMaxBytes(bytes, maxBytes);
+        pinned_write_assertWithinMaxBytes(bytes, maxBytes);
         let offset = 0;
         while (offset < buffer.byteLength) {
             const { bytesWritten } = await handle.write(buffer, offset, buffer.byteLength - offset);
@@ -28877,74 +28875,21 @@ async function writeStreamToHandle(stream, handle, maxBytes) {
         }
     }
 }
-async function inputToBase64(input, maxBytes) {
-    if (input.kind === "buffer") {
-        assertWithinMaxBytes(pinned_write_byteLength(input.data, input.encoding), maxBytes);
-        return (typeof input.data === "string"
-            ? Buffer.from(input.data, input.encoding ?? "utf8")
-            : input.data).toString("base64");
-    }
-    const chunks = [];
-    let bytes = 0;
-    for await (const chunk of input.stream) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        bytes += buffer.byteLength;
-        assertWithinMaxBytes(bytes, maxBytes);
-        chunks.push(buffer);
-    }
-    return Buffer.concat(chunks, bytes).toString("base64");
-}
 async function runPinnedWriteHelper(params) {
     assertSafeBasename(params.basename);
     validatePinnedOperationPayload({
         relativeParentPath: params.relativeParentPath,
     });
-    // The Python helper deliberately enforces the strict post-rename inode
-    // contract. The explicit compatibility policy therefore uses the guarded
-    // Node fallback, where content verification can replace that one check.
+    // The explicit compatibility policy uses the guarded Node fallback, where
+    // content verification can replace the strict post-rename inode check.
     if (params.onRenameIdentityMismatch === "verify-content") {
         return await runPinnedWriteFallback(params);
     }
-    if (getFsSafePythonConfig().mode === "off") {
-        return await runPinnedWriteFallback(params);
-    }
-    if (params.input.kind === "stream") {
-        try {
-            assertPinnedPythonOperationAvailable();
-        }
-        catch (error) {
-            if (canFallbackFromPythonError(error)) {
-                return await runPinnedWriteFallback(params);
-            }
-            throw error;
-        }
-    }
-    const input = params.input.kind === "stream"
-        ? { kind: "buffer", data: Buffer.from(await inputToBase64(params.input, params.maxBytes), "base64") }
-        : params.input;
-    const payload = {
-        base64: await inputToBase64(input, params.maxBytes),
-        basename: params.basename,
-        maxBytes: params.maxBytes ?? -1,
-        mkdir: params.mkdir,
-        mode: params.mode || 0o600,
-        overwrite: params.overwrite !== false,
-        relativeParentPath: params.relativeParentPath,
-        ...(params.rootIdentity ? { rootDev: params.rootIdentity.dev, rootIno: params.rootIdentity.ino } : {}),
-    };
-    try {
-        return await runPinnedPythonOperation({
-            operation: "write",
-            rootPath: params.rootPath,
-            payload,
-        });
-    }
-    catch (error) {
-        if (canFallbackFromPythonError(error)) {
-            return await runPinnedWriteFallback({ ...params, input });
-        }
-        throw error;
+    const native = getNativeBinding();
+    if (native && params.overwrite === false) {
+        return await runPinnedWriteNative(native, params);
     }
+    return await runPinnedWriteFallback(params);
 }
 async function runPinnedWriteWithRenamePolicy(params) {
     const { targetPath, renameIdentity, ...writeParams } = params;
@@ -28967,34 +28912,19 @@ async function runPinnedWriteWithRenamePolicy(params) {
         onRenameIdentityMismatch: "verify-content",
     }));
 }
-async function runPinnedCopyHelper(params) {
-    assertSafeBasename(params.basename);
-    validatePinnedOperationPayload({
-        relativeParentPath: params.relativeParentPath,
-    });
-    return await runPinnedPythonOperation({
-        operation: "copy",
-        rootPath: params.rootPath,
-        payload: {
-            basename: params.basename,
-            maxBytes: params.maxBytes ?? -1,
-            mkdir: params.mkdir,
-            mode: params.mode || 0o600,
-            overwrite: params.overwrite !== false,
-            relativeParentPath: params.relativeParentPath,
-            ...(params.rootIdentity ? { rootDev: params.rootIdentity.dev, rootIno: params.rootIdentity.ino } : {}),
-            sourceDev: params.sourceIdentity.dev,
-            sourceIno: params.sourceIdentity.ino,
-            sourcePath: params.sourcePath,
-        },
-    });
-}
 async function runPinnedWriteFallback(params) {
-    const parentPath = params.relativeParentPath
+    let parentPath = params.relativeParentPath
         ? external_node_path_.join(params.rootPath, ...params.relativeParentPath.split("/"))
         : params.rootPath;
     if (params.mkdir) {
-        await mkdirPathComponentsWithGuards({ rootReal: params.rootPath, targetPath: parentPath });
+        // mkdirPathComponentsWithGuards may resolve the final component through
+        // an in-root symlink (e.g. a skill-bank layout). Use its returned real
+        // path for the subsequent guard and target path so we don't re-check the
+        // original, possibly-symlinked, lexical path and reject it outright.
+        parentPath = await mkdirPathComponentsWithGuards({
+            rootReal: params.rootPath,
+            targetPath: parentPath,
+        });
     }
     const parentGuard = params.mkdir
         ? await directory_guard_createAsyncDirectoryGuard(parentPath)
@@ -29010,8 +28940,9 @@ async function runPinnedWriteFallback(params) {
         });
         let created = true;
         try {
+            await handle.chmod(params.mode);
             if (params.input.kind === "buffer") {
-                assertWithinMaxBytes(pinned_write_byteLength(params.input.data, params.input.encoding), params.maxBytes);
+                pinned_write_assertWithinMaxBytes(pinned_write_byteLength(params.input.data, params.input.encoding), params.maxBytes);
                 if (typeof params.input.data === "string") {
                     await handle.writeFile(params.input.data, params.input.encoding ?? "utf8");
                 }
@@ -29049,8 +28980,9 @@ async function runPinnedWriteFallback(params) {
     let renamed = false;
     try {
         handle = await promises_.open(tempPath, tempFlags, params.mode);
+        await handle.chmod(params.mode);
         if (params.input.kind === "buffer") {
-            assertWithinMaxBytes(pinned_write_byteLength(params.input.data, params.input.encoding), params.maxBytes);
+            pinned_write_assertWithinMaxBytes(pinned_write_byteLength(params.input.data, params.input.encoding), params.maxBytes);
             if (typeof params.input.data === "string") {
                 await handle.writeFile(params.input.data, params.input.encoding ?? "utf8");
             }
@@ -29133,12 +29065,85 @@ async function runPinnedWriteFallback(params) {
 
 // EXTERNAL MODULE: external "node:os"
 var external_node_os_ = __webpack_require__(8161);
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/root-path-existing.js
+
+
+
+
+function isFilesystemRoot(candidate) {
+    return external_node_path_.parse(candidate).root === candidate;
+}
+async function root_path_existing_pathExists(targetPath) {
+    try {
+        await promises_.lstat(targetPath);
+        return true;
+    }
+    catch (error) {
+        if (path_isNotFoundPathError(error)) {
+            return false;
+        }
+        throw error;
+    }
+}
+async function root_path_existing_resolvePathViaExistingAncestor(targetPath) {
+    const normalized = external_node_path_.resolve(targetPath);
+    let cursor = normalized;
+    const missingSuffix = [];
+    while (!isFilesystemRoot(cursor) && !(await root_path_existing_pathExists(cursor))) {
+        missingSuffix.unshift(external_node_path_.basename(cursor));
+        const parent = external_node_path_.dirname(cursor);
+        if (parent === cursor) {
+            break;
+        }
+        cursor = parent;
+    }
+    if (!(await root_path_existing_pathExists(cursor))) {
+        return normalized;
+    }
+    try {
+        const resolvedAncestor = external_node_path_.resolve(await promises_.realpath(cursor));
+        return missingSuffix.length === 0
+            ? resolvedAncestor
+            : external_node_path_.resolve(resolvedAncestor, ...missingSuffix);
+    }
+    catch {
+        return normalized;
+    }
+}
+function root_path_existing_resolvePathViaExistingAncestorSync(targetPath) {
+    const normalized = path.resolve(targetPath);
+    let cursor = normalized;
+    const missingSuffix = [];
+    while (!isFilesystemRoot(cursor) && !fs.existsSync(cursor)) {
+        missingSuffix.unshift(path.basename(cursor));
+        const parent = path.dirname(cursor);
+        if (parent === cursor) {
+            break;
+        }
+        cursor = parent;
+    }
+    if (!fs.existsSync(cursor)) {
+        return normalized;
+    }
+    try {
+        const resolvedAncestor = path.resolve(fs.realpathSync(cursor));
+        return missingSuffix.length === 0
+            ? resolvedAncestor
+            : path.resolve(resolvedAncestor, ...missingSuffix);
+    }
+    catch {
+        return normalized;
+    }
+}
+
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/root-path.js
 
 
 
 
 
+
+
 const ROOT_PATH_ALIAS_POLICIES = {
     strict: Object.freeze({
         allowFinalSymlinkForUnlink: false,
@@ -29154,7 +29159,7 @@ async function resolveRootPath(params) {
     const absolutePath = external_node_path_.resolve(params.absolutePath);
     const rootCanonicalPath = params.rootCanonicalPath
         ? external_node_path_.resolve(params.rootCanonicalPath)
-        : await root_path_resolvePathViaExistingAncestor(rootPath);
+        : await root_path_existing_resolvePathViaExistingAncestor(rootPath);
     const context = createBoundaryResolutionContext({
         resolveParams: params,
         rootPath,
@@ -29216,15 +29221,40 @@ function isPromiseLike(value) {
         typeof value.then === "function");
 }
 function createLexicalTraversalState(params) {
-    const relative = external_node_path_.relative(params.rootPath, params.absolutePath);
+    const rawAbsolutePath = params.params.absolutePath;
+    const rawRelativePath = rawPathRelativeToRoot(params.rootPath, rawAbsolutePath);
+    const relative = rawRelativePath ?? external_node_path_.relative(params.rootPath, params.absolutePath);
     return {
-        segments: relative.split(external_node_path_.sep).filter(Boolean),
+        segments: splitTraversalSegments(relative),
         allowFinalSymlink: params.params.policy?.allowFinalSymlinkForUnlink === true,
         canonicalCursor: params.rootCanonicalPath,
         lexicalCursor: params.rootPath,
         preserveFinalSymlink: false,
     };
 }
+function splitTraversalSegments(value) {
+    return value
+        .split(process.platform === "win32" ? /[\\/]+/ : /\/+/)
+        .filter((segment) => Boolean(segment) && segment !== ".");
+}
+function rawPathRelativeToRoot(rootPath, candidatePath) {
+    if (!external_node_path_.isAbsolute(candidatePath)) {
+        return undefined;
+    }
+    const root = external_node_path_.resolve(rootPath);
+    const candidate = process.platform === "win32"
+        ? candidatePath.replaceAll("/", external_node_path_.sep)
+        : candidatePath;
+    if (candidate === root) {
+        return "";
+    }
+    const rootWithSep = root.endsWith(external_node_path_.sep) ? root : `${root}${external_node_path_.sep}`;
+    const candidatePrefix = candidate.slice(0, rootWithSep.length);
+    const prefixMatches = process.platform === "win32"
+        ? candidatePrefix.toLowerCase() === rootWithSep.toLowerCase()
+        : candidatePrefix === rootWithSep;
+    return prefixMatches ? candidate.slice(rootWithSep.length) : undefined;
+}
 function assertLexicalCursorInsideBoundary(params) {
     assertInsideBoundary({
         boundaryLabel: params.params.boundaryLabel,
@@ -29235,13 +29265,15 @@ function assertLexicalCursorInsideBoundary(params) {
 }
 function applyMissingSuffixToCanonicalCursor(params) {
     const missingSuffix = params.state.segments.slice(params.missingFromIndex);
-    params.state.canonicalCursor = external_node_path_.resolve(params.state.canonicalCursor, ...missingSuffix);
-    assertLexicalCursorInsideBoundary({
-        params: params.params,
-        rootCanonicalPath: params.rootCanonicalPath,
-        candidatePath: params.state.canonicalCursor,
-        absolutePath: params.absolutePath,
-    });
+    for (const segment of missingSuffix) {
+        advanceCanonicalCursorForSegment({
+            state: params.state,
+            segment,
+            rootCanonicalPath: params.rootCanonicalPath,
+            params: params.params,
+            absolutePath: params.absolutePath,
+        });
+    }
 }
 function advanceCanonicalCursorForSegment(params) {
     params.state.canonicalCursor = external_node_path_.resolve(params.state.canonicalCursor, params.segment);
@@ -29357,11 +29389,20 @@ function resolveAndApplySymlinkHop(params) {
         boundaryLabel: params.boundaryLabel,
     });
 }
+function applyParentTraversalStep(params) {
+    params.state.lexicalCursor = external_node_path_.resolve(params.state.lexicalCursor, "..");
+    advanceCanonicalCursorForSegment({
+        state: params.state,
+        segment: "..",
+        rootCanonicalPath: params.rootCanonicalPath,
+        params: params.resolveParams,
+        absolutePath: params.absolutePath,
+    });
+}
 function* iterateLexicalTraversal(state) {
     for (let idx = 0; idx < state.segments.length; idx += 1) {
         const segment = state.segments[idx] ?? "";
         const isLast = idx === state.segments.length - 1;
-        state.lexicalCursor = external_node_path_.join(state.lexicalCursor, segment);
         yield { idx, segment, isLast };
     }
 }
@@ -29374,6 +29415,14 @@ async function resolveRootPathLexicalAsync(params) {
         absolutePath: params.absolutePath,
     };
     for (const { idx, segment, isLast } of iterateLexicalTraversal(state)) {
+        if (segment === "..") {
+            applyParentTraversalStep({
+                ...sharedStepParams,
+                resolveParams: params.params,
+            });
+            continue;
+        }
+        state.lexicalCursor = external_node_path_.join(state.lexicalCursor, segment);
         const stat = await readLexicalStat({
             ...sharedStepParams,
             missingFromIndex: idx,
@@ -29401,7 +29450,7 @@ async function resolveRootPathLexicalAsync(params) {
             resolveLinkCanonical: (cursor) => resolveSymlinkHopPath(cursor),
         });
     }
-    const kind = await getPathKind(params.absolutePath, state.preserveFinalSymlink);
+    const kind = await getPathKind(state.canonicalCursor, state.preserveFinalSymlink);
     return finalizeLexicalResolution({
         ...params,
         state,
@@ -29413,6 +29462,15 @@ function resolveRootPathLexicalSync(params) {
     for (let idx = 0; idx < state.segments.length; idx += 1) {
         const segment = state.segments[idx] ?? "";
         const isLast = idx === state.segments.length - 1;
+        if (segment === "..") {
+            applyParentTraversalStep({
+                state,
+                rootCanonicalPath: params.rootCanonicalPath,
+                resolveParams: params.params,
+                absolutePath: params.absolutePath,
+            });
+            continue;
+        }
         state.lexicalCursor = path.join(state.lexicalCursor, segment);
         const maybeStat = readLexicalStat({
             state,
@@ -29454,7 +29512,7 @@ function resolveRootPathLexicalSync(params) {
             throw new Error("Unexpected async symlink resolution");
         }
     }
-    const kind = getPathKindSync(params.absolutePath, state.preserveFinalSymlink);
+    const kind = getPathKindSync(state.canonicalCursor, state.preserveFinalSymlink);
     return finalizeLexicalResolution({
         ...params,
         state,
@@ -29523,7 +29581,7 @@ async function resolveOutsideLexicalCanonicalPathAsync(params) {
     if (path_isPathInside(params.rootPath, params.absolutePath)) {
         return undefined;
     }
-    return await root_path_resolvePathViaExistingAncestor(params.absolutePath);
+    return await root_path_existing_resolvePathViaExistingAncestor(params.absolutePath);
 }
 function resolveOutsideLexicalCanonicalPathSync(params) {
     if (isPathInside(params.rootPath, params.absolutePath)) {
@@ -29570,60 +29628,6 @@ function buildResolvedRootPath(params) {
         kind: params.kind.kind,
     };
 }
-async function root_path_resolvePathViaExistingAncestor(targetPath) {
-    const normalized = external_node_path_.resolve(targetPath);
-    let cursor = normalized;
-    const missingSuffix = [];
-    while (!isFilesystemRoot(cursor) && !(await root_path_pathExists(cursor))) {
-        missingSuffix.unshift(external_node_path_.basename(cursor));
-        const parent = external_node_path_.dirname(cursor);
-        if (parent === cursor) {
-            break;
-        }
-        cursor = parent;
-    }
-    if (!(await root_path_pathExists(cursor))) {
-        return normalized;
-    }
-    try {
-        const resolvedAncestor = external_node_path_.resolve(await promises_.realpath(cursor));
-        if (missingSuffix.length === 0) {
-            return resolvedAncestor;
-        }
-        return external_node_path_.resolve(resolvedAncestor, ...missingSuffix);
-    }
-    catch {
-        return normalized;
-    }
-}
-function resolvePathViaExistingAncestorSync(targetPath) {
-    const normalized = path.resolve(targetPath);
-    let cursor = normalized;
-    const missingSuffix = [];
-    while (!isFilesystemRoot(cursor) && !fs.existsSync(cursor)) {
-        missingSuffix.unshift(path.basename(cursor));
-        const parent = path.dirname(cursor);
-        if (parent === cursor) {
-            break;
-        }
-        cursor = parent;
-    }
-    if (!fs.existsSync(cursor)) {
-        return normalized;
-    }
-    try {
-        // Keep sync behavior aligned with async (`fsp.realpath`) to avoid
-        // platform-specific canonical alias drift (notably on Windows).
-        const resolvedAncestor = path.resolve(fs.realpathSync(cursor));
-        if (missingSuffix.length === 0) {
-            return resolvedAncestor;
-        }
-        return path.resolve(resolvedAncestor, ...missingSuffix);
-    }
-    catch {
-        return normalized;
-    }
-}
 async function getPathKind(absolutePath, preserveFinalSymlink) {
     try {
         const stat = preserveFinalSymlink
@@ -29691,21 +29695,6 @@ function shortPath(value) {
     }
     return value;
 }
-function isFilesystemRoot(candidate) {
-    return external_node_path_.parse(candidate).root === candidate;
-}
-async function root_path_pathExists(targetPath) {
-    try {
-        await promises_.lstat(targetPath);
-        return true;
-    }
-    catch (error) {
-        if (path_isNotFoundPathError(error)) {
-            return false;
-        }
-        throw error;
-    }
-}
 async function resolveSymlinkHopPath(symlinkPath) {
     try {
         return external_node_path_.resolve(await promises_.realpath(symlinkPath));
@@ -29716,7 +29705,7 @@ async function resolveSymlinkHopPath(symlinkPath) {
         }
         const linkTarget = await promises_.readlink(symlinkPath);
         const linkAbsolute = external_node_path_.resolve(external_node_path_.dirname(symlinkPath), linkTarget);
-        return root_path_resolvePathViaExistingAncestor(linkAbsolute);
+        return root_path_existing_resolvePathViaExistingAncestor(linkAbsolute);
     }
 }
 function resolveSymlinkHopPathSync(symlinkPath) {
@@ -29751,7 +29740,7 @@ async function assertNoPathAliasEscape(params) {
         return;
     }
     await assertNoHardlinkedFinalPath({
-        filePath: resolved.absolutePath,
+        filePath: resolved.canonicalPath,
         root: resolved.rootPath,
         boundaryLabel: params.boundaryLabel,
         allowFinalHardlinkForUnlink: params.policy?.allowFinalHardlinkForUnlink,
@@ -29785,8 +29774,80 @@ function path_policy_shortPath(value) {
     return value;
 }
 
-// EXTERNAL MODULE: external "node:url"
-var external_node_url_ = __webpack_require__(3136);
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/string-coerce.js
+function readStringValue(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function normalizeNullableString(value) {
+    if (typeof value !== "string") {
+        return null;
+    }
+    const trimmed = value.trim();
+    return trimmed ? trimmed : null;
+}
+function normalizeOptionalString(value) {
+    return normalizeNullableString(value) ?? undefined;
+}
+function normalizeStringifiedOptionalString(value) {
+    if (typeof value === "string") {
+        return normalizeOptionalString(value);
+    }
+    if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+        return normalizeOptionalString(String(value));
+    }
+    return undefined;
+}
+function normalizeOptionalLowercaseString(value) {
+    return normalizeOptionalString(value)?.toLowerCase();
+}
+function normalizeLowercaseStringOrEmpty(value) {
+    return normalizeOptionalLowercaseString(value) ?? "";
+}
+function normalizeFastMode(raw) {
+    if (typeof raw === "boolean") {
+        return raw;
+    }
+    if (!raw) {
+        return undefined;
+    }
+    const key = normalizeLowercaseStringOrEmpty(raw);
+    if (["off", "false", "no", "0", "disable", "disabled", "normal"].includes(key)) {
+        return false;
+    }
+    if (["on", "true", "yes", "1", "enable", "enabled", "fast"].includes(key)) {
+        return true;
+    }
+    return undefined;
+}
+function lowercasePreservingWhitespace(value) {
+    return value.toLowerCase();
+}
+function localeLowercasePreservingWhitespace(value) {
+    return value.toLocaleLowerCase();
+}
+function resolvePrimaryStringValue(value) {
+    if (typeof value === "string") {
+        return normalizeOptionalString(value);
+    }
+    if (!value || typeof value !== "object") {
+        return undefined;
+    }
+    return normalizeOptionalString(value.primary);
+}
+function normalizeOptionalThreadValue(value) {
+    if (typeof value === "number") {
+        return Number.isFinite(value) ? Math.trunc(value) : undefined;
+    }
+    return normalizeOptionalString(value);
+}
+function normalizeOptionalStringifiedId(value) {
+    const normalized = normalizeOptionalThreadValue(value);
+    return normalized == null ? undefined : String(normalized);
+}
+function hasNonEmptyString(value) {
+    return normalizeOptionalString(value) !== undefined;
+}
+
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/local-file-access.js
 
 
@@ -29918,6 +29979,28 @@ const WINDOWS_RESERVED_DEVICE_NAMES = new Set([
     "LPT²",
     "LPT³",
 ]);
+const WINDOWS_SEPARATOR_CHAR_CODE = 0x5c;
+const WINDOWS_IGNORED_SPACE_CHAR_CODE = 0x20;
+const WINDOWS_IGNORED_DOT_CHAR_CODE = 0x2e;
+function trimTrailingWindowsSeparators(value) {
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === WINDOWS_SEPARATOR_CHAR_CODE) {
+        end -= 1;
+    }
+    return end === value.length ? value : value.slice(0, end);
+}
+function trimTrailingWindowsIgnoredChars(value) {
+    let end = value.length;
+    while (end > 0) {
+        const charCode = value.charCodeAt(end - 1);
+        if (charCode !== WINDOWS_IGNORED_SPACE_CHAR_CODE &&
+            charCode !== WINDOWS_IGNORED_DOT_CHAR_CODE) {
+            break;
+        }
+        end -= 1;
+    }
+    return end === value.length ? value : value.slice(0, end);
+}
 function candidateReadPaths(filePath) {
     if (!filePath.startsWith("file://")) {
         return [filePath];
@@ -29946,10 +30029,10 @@ function matchPosixDeviceReadPath(filePath, cwd) {
     return undefined;
 }
 function normalizeWindowsDeviceBaseName(filePath) {
-    const normalized = filePath.replace(/\//g, "\\").replace(/[\\]+$/g, "");
+    const normalized = trimTrailingWindowsSeparators(filePath.replace(/\//g, "\\"));
     const lastSegment = normalized.split("\\").filter(Boolean).at(-1) ?? normalized;
     const withoutStream = lastSegment.split(":")[0] ?? lastSegment;
-    const withoutTrailingIgnoredChars = withoutStream.replace(/[ .]+$/g, "");
+    const withoutTrailingIgnoredChars = trimTrailingWindowsIgnoredChars(withoutStream);
     return (withoutTrailingIgnoredChars.split(".")[0] ?? withoutTrailingIgnoredChars).toUpperCase();
 }
 function matchWindowsDeviceReadPath(filePath) {
@@ -29984,94 +30067,6 @@ function assertNoUnsafeDeviceReadPath(filePath, options) {
     }
 }
 
-;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/bounded-read.js
-
-
-const READ_CHUNK_BYTES = 64 * 1024;
-function assertMaxBytes(maxBytes) {
-    if (maxBytes === Number.POSITIVE_INFINITY) {
-        return;
-    }
-    if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
-        throw new RangeError("maxBytes must be a non-negative safe integer or Infinity");
-    }
-}
-function createScratchBuffer(maxBytes) {
-    const initialReadBytes = Number.isFinite(maxBytes)
-        ? Math.min(READ_CHUNK_BYTES, maxBytes + 1)
-        : READ_CHUNK_BYTES;
-    return Buffer.allocUnsafe(Math.max(1, initialReadBytes));
-}
-function nextReadLength(total, maxBytes, capacity) {
-    return Number.isFinite(maxBytes)
-        ? Math.min(capacity, maxBytes - total + 1)
-        : capacity;
-}
-function appendChunk(params) {
-    const total = params.total + params.bytesRead;
-    if (total > params.maxBytes) {
-        throw new errors_FsSafeError("too-large", `file exceeds limit of ${params.maxBytes} bytes (got at least ${total})`);
-    }
-    params.chunks.push(Buffer.from(params.scratch.subarray(0, params.bytesRead)));
-    return total;
-}
-async function readBoundedAsync(maxBytes, readChunk) {
-    assertMaxBytes(maxBytes);
-    const chunks = [];
-    const scratch = createScratchBuffer(maxBytes);
-    let total = 0;
-    while (true) {
-        const length = nextReadLength(total, maxBytes, scratch.length);
-        const bytesRead = await readChunk(scratch, length);
-        if (bytesRead === 0) {
-            return Buffer.concat(chunks, total);
-        }
-        total = appendChunk({ chunks, scratch, bytesRead, total, maxBytes });
-    }
-}
-/**
- * Reads from the handle's current offset without closing it. A bounded read
- * consumes at most maxBytes + 1 bytes so growth after an earlier stat cannot
- * force an unbounded allocation.
- */
-async function readFileHandleBounded(handle, maxBytes) {
-    return await readBoundedAsync(maxBytes, async (scratch, length) => {
-        return (await handle.read(scratch, 0, length, null)).bytesRead;
-    });
-}
-function readDescriptorChunk(fd, scratch, length) {
-    return new Promise((resolve, reject) => {
-        fs.read(fd, scratch, 0, length, null, (error, bytesRead) => {
-            if (error) {
-                reject(error);
-                return;
-            }
-            resolve(bytesRead);
-        });
-    });
-}
-/** Async bounded read from a numeric descriptor. The caller owns the descriptor. */
-async function readFileDescriptorBounded(fd, maxBytes) {
-    return await readBoundedAsync(maxBytes, async (scratch, length) => {
-        return await readDescriptorChunk(fd, scratch, length);
-    });
-}
-/** Sync bounded read from a numeric descriptor. The caller owns the descriptor. */
-function readFileDescriptorBoundedSync(fd, maxBytes) {
-    assertMaxBytes(maxBytes);
-    const chunks = [];
-    const scratch = createScratchBuffer(maxBytes);
-    let total = 0;
-    while (true) {
-        const length = nextReadLength(total, maxBytes, scratch.length);
-        const bytesRead = fs.readSync(fd, scratch, 0, length, null);
-        if (bytesRead === 0) {
-            return Buffer.concat(chunks, total);
-        }
-        total = appendChunk({ chunks, scratch, bytesRead, total, maxBytes });
-    }
-}
-
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/read-opened-file.js
 
 
@@ -30084,6 +30079,7 @@ async function read_opened_file_readOpenedFileSafely(params) {
         : await readFileHandleBounded(params.opened.handle, params.maxBytes);
     return {
         buffer,
+        containment: params.opened.containment,
         realPath: params.opened.realPath,
         stat: params.opened.stat,
     };
@@ -30227,6 +30223,7 @@ function resolveOsHomeRelativePath(input, opts) {
 
 
 
+
 const ensureTrailingSep = (value) => value.endsWith(external_node_path_.sep) ? value : value + external_node_path_.sep;
 function assertValidRootRelativePath(relativePath) {
     path_assertNoNulPathInput(relativePath, "relative path contains a NUL byte");
@@ -30271,13 +30268,31 @@ async function resolveRootContext(rootDir) {
         rootWithSep: ensureTrailingSep(rootReal),
     };
 }
-async function resolvePathInRoot(root, relativePath) {
+async function resolvePathInRoot(root, relativePath, options) {
     assertValidRootRelativePath(relativePath);
     const expanded = await expandRelativePathWithHome(relativePath);
     const resolved = external_node_path_.resolve(root.rootWithSep, expanded);
     if (!path_isPathInside(root.rootWithSep, resolved)) {
         throw new errors_FsSafeError("outside-workspace", "file is outside workspace root");
     }
+    const rawAbsolutePath = external_node_path_.isAbsolute(expanded)
+        ? expanded
+        : `${root.rootWithSep}${expanded}`;
+    try {
+        await resolveRootPath({
+            absolutePath: rawAbsolutePath,
+            rootPath: root.rootReal,
+            rootCanonicalPath: root.rootReal,
+            boundaryLabel: "root",
+            policy: options?.allowFinalSymlink ? ROOT_PATH_ALIAS_POLICIES.unlinkTarget : undefined,
+        });
+    }
+    catch (error) {
+        const code = options?.aliasErrorCode ?? "outside-workspace";
+        throw new errors_FsSafeError(code, code === "path-alias" ? "path alias escape blocked" : "file is outside workspace root", {
+            cause: error instanceof Error ? error : undefined,
+        });
+    }
     return { rootReal: root.rootReal, rootWithSep: root.rootWithSep, resolved };
 }
 async function resolvePathWithinRoot(params) {
@@ -30316,14 +30331,143 @@ function stringifyJsonDocument(value, replacer, space) {
     return text;
 }
 
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/root-walk.js
+
+
+
+function validateBudget(name, value) {
+    if (value === undefined)
+        return Number.POSITIVE_INFINITY;
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new RangeError(`${name} must be a non-negative safe integer`);
+    }
+    return value;
+}
+function entryKind(entry) {
+    if (entry.isSymbolicLink)
+        return "symlink";
+    if (entry.isDirectory)
+        return "directory";
+    if (entry.isFile)
+        return "file";
+    return "other";
+}
+function limitEntry(relativePath) {
+    return { relativePath, kind: "truncated", size: 0 };
+}
+async function* walkRoot(root, relativePath, options) {
+    const maxDepth = validateBudget("maxDepth", options.maxDepth);
+    const maxEntries = validateBudget("maxEntries", options.maxEntries);
+    const visitedDirectories = new Set();
+    let examined = 0;
+    const onLimit = (atPath) => {
+        if ((options.limitBehavior ?? "truncate") === "throw") {
+            throw new errors_FsSafeError("too-large", `root walk budget exceeded at ${atPath || "."}`);
+        }
+        return limitEntry(atPath);
+    };
+    async function* visit(directory, depth) {
+        options.signal?.throwIfAborted();
+        let entries;
+        try {
+            const resolvedDirectory = await resolveRootPath({
+                absolutePath: external_node_path_.resolve(root.rootReal, directory),
+                rootPath: root.rootReal,
+                rootCanonicalPath: root.rootReal,
+                boundaryLabel: "root walk",
+            });
+            if (!resolvedDirectory.exists || resolvedDirectory.kind !== "directory") {
+                throw new errors_FsSafeError("not-file", `root walk path is not a directory: ${directory || "."}`);
+            }
+            if (visitedDirectories.has(resolvedDirectory.canonicalPath)) {
+                return;
+            }
+            visitedDirectories.add(resolvedDirectory.canonicalPath);
+            const listingDirectory = external_node_path_.relative(root.rootReal, resolvedDirectory.canonicalPath)
+                .split(external_node_path_.sep)
+                .join(external_node_path_.posix.sep);
+            entries = await root.list(listingDirectory, { withFileTypes: true });
+        }
+        catch (error) {
+            if ((options.onDirectoryError ?? "throw") === "throw")
+                throw error;
+            yield { relativePath: directory, kind: "directory-error", size: 0, error };
+            return;
+        }
+        for (const entry of entries) {
+            options.signal?.throwIfAborted();
+            const child = directory
+                ? external_node_path_.posix.join(directory.split(external_node_path_.sep).join(external_node_path_.posix.sep), entry.name)
+                : entry.name;
+            if (examined >= maxEntries) {
+                yield onLimit(child);
+                return;
+            }
+            examined += 1;
+            let kind = entryKind(entry);
+            let size = entry.size;
+            if (kind === "symlink") {
+                if (options.symlinkPolicy === "skip") {
+                    continue;
+                }
+                const resolved = await resolveRootPath({
+                    absolutePath: external_node_path_.resolve(root.rootReal, child),
+                    rootPath: root.rootReal,
+                    rootCanonicalPath: root.rootReal,
+                    boundaryLabel: "root walk",
+                });
+                if (!resolved.exists) {
+                    continue;
+                }
+                kind = resolved.kind === "directory" ? "directory" : resolved.kind === "file" ? "file" : "other";
+                size = entry.size;
+            }
+            const walkEntry = { relativePath: child, kind, size };
+            const filterResult = options.entryFilter?.(walkEntry) ?? "include";
+            if (!["include", "skip", "skip-subtree"].includes(filterResult)) {
+                throw new TypeError(`invalid root walk entryFilter result: ${String(filterResult)}`);
+            }
+            if (filterResult === "include") {
+                yield walkEntry;
+            }
+            if (kind !== "directory") {
+                continue;
+            }
+            if (filterResult === "skip-subtree") {
+                continue;
+            }
+            if (depth >= maxDepth) {
+                yield onLimit(child);
+                return;
+            }
+            yield* visit(child, depth + 1);
+        }
+    }
+    yield* visit(relativePath, 0);
+}
+
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/temp-cleanup.js
 
+
 const tempCleanupEntries = new Map();
 let cleanupRegistered = false;
+function pathStillMatchesReceipt(entry) {
+    if (!entry.identity) {
+        return false;
+    }
+    try {
+        return file_identity_sameFileIdentity(external_node_fs_.lstatSync(entry.path), entry.identity);
+    }
+    catch (error) {
+        return error.code === "ENOENT";
+    }
+}
 function cleanupRegisteredTempPathsSync() {
     for (const entry of tempCleanupEntries.values()) {
         try {
-            external_node_fs_.rmSync(entry.path, { force: true, recursive: entry.recursive });
+            if (pathStillMatchesReceipt(entry)) {
+                external_node_fs_.rmSync(entry.path, { force: true, recursive: entry.recursive });
+            }
         }
         catch {
             // Process-exit cleanup is best-effort.
@@ -30336,13 +30480,27 @@ function registerTempPathForExit(tempPath, options) {
         cleanupRegistered = true;
         process.once("exit", cleanupRegisteredTempPathsSync);
     }
-    tempCleanupEntries.set(tempPath, {
+    const entry = {
         path: tempPath,
         recursive: options?.recursive === true,
-    });
-    return () => {
+        identity: options?.identity,
+    };
+    if (!entry.identity) {
+        try {
+            entry.identity = external_node_fs_.lstatSync(tempPath);
+        }
+        catch {
+            // Callers that register before creation set the identity after opening.
+        }
+    }
+    tempCleanupEntries.set(tempPath, entry);
+    const unregister = (() => {
         tempCleanupEntries.delete(tempPath);
+    });
+    unregister.setIdentity = (identity) => {
+        entry.identity = identity;
     };
+    return unregister;
 }
 function __cleanupRegisteredTempPathsForTest() {
     cleanupRegisteredTempPathsSync();
@@ -30353,7 +30511,9 @@ function __cleanupRegisteredTempPathForTest(tempPath) {
         return;
     }
     try {
-        fsSync.rmSync(entry.path, { force: true, recursive: entry.recursive });
+        if (pathStillMatchesReceipt(entry)) {
+            fsSync.rmSync(entry.path, { force: true, recursive: entry.recursive });
+        }
     }
     finally {
         tempCleanupEntries.delete(tempPath);
@@ -30404,9 +30564,6 @@ async function serializePathWrite(key, run) {
 
 
 
-
-
-
 
 
 
@@ -30437,6 +30594,7 @@ const DEFAULT_ROOT_MAX_BYTES = 16 * 1024 * 1024;
 function openResult(params) {
     return {
         handle: params.handle,
+        containment: "best-effort",
         realPath: params.realPath,
         stat: params.stat,
         [Symbol.asyncDispose]: () => params.handle.close().catch(() => undefined),
@@ -30555,7 +30713,7 @@ class RootHandle {
         };
     }
     async resolve(relativePath) {
-        return (await resolvePathInRoot(this.context, relativePath)).resolved;
+        return (await resolvePathInRoot(this.context, relativePath, { allowFinalSymlink: true })).resolved;
     }
     async open(relativePath, options = {}) {
         return await openFileInRoot(this.context, {
@@ -30694,58 +30852,34 @@ class RootHandle {
     }
     async stat(relativePath) {
         assertValidRootRelativePath(relativePath);
-        try {
-            return await helperStat(this.rootReal, relativePath);
-        }
-        catch (error) {
-            if (canFallbackFromPythonError(error)) {
-                return await statPathFallback(this.context, relativePath);
-            }
-            throw error;
-        }
+        validatePinnedOperationPayload({ relativePath });
+        return await statPathFallback(this.context, relativePath);
     }
     async list(relativePath, options = {}) {
         assertValidRootRelativePath(relativePath);
-        try {
-            return options.withFileTypes === true
-                ? await helperReaddir(this.rootReal, relativePath, true)
-                : await helperReaddir(this.rootReal, relativePath, false);
-        }
-        catch (error) {
-            if (canFallbackFromPythonError(error)) {
-                return await listPathFallback(this.context, relativePath, options.withFileTypes === true);
-            }
-            throw error;
-        }
+        validatePinnedOperationPayload({ relativePath });
+        return await listPathFallback(this.context, relativePath, options.withFileTypes === true);
     }
     async move(fromRelative, toRelative, options = {}) {
         assertValidRootRelativePath(fromRelative);
         assertValidRootRelativePath(toRelative);
+        validatePinnedOperationPayload({ from: fromRelative, to: toRelative });
         const denyMutations = mergeDenyMutationPolicies(this.defaults.denyMutations, options.denyMutations);
         await assertMoveMutationAllowed(this.context, {
             fromRelative,
             toRelative,
             denyMutations,
         });
-        try {
-            await runPinnedHelper("rename", this.rootReal, {
-                from: fromRelative,
-                overwrite: options.overwrite ?? false,
-                to: toRelative,
-            });
-        }
-        catch (error) {
-            if (canFallbackFromPythonError(error)) {
-                await movePathFallback(this.context, {
-                    fromRelative,
-                    denyMutations,
-                    overwrite: options.overwrite ?? false,
-                    toRelative,
-                });
-                return;
-            }
-            throw error;
-        }
+        await movePathFallback(this.context, {
+            fromRelative,
+            denyMutations,
+            overwrite: options.overwrite ?? false,
+            toRelative,
+        });
+    }
+    walk(relativePath, options) {
+        assertValidRootRelativePath(relativePath);
+        return walkRoot(this, relativePath, options);
     }
 }
 function readDefaults(defaults) {
@@ -30760,7 +30894,9 @@ async function root_impl_root(rootDir, defaults = {}) {
     return new RootHandle(await resolveRootContext(rootDir), defaults);
 }
 async function openFileInRoot(root, params) {
-    const { rootWithSep, resolved } = await resolvePathInRoot(root, params.relativePath);
+    const { rootWithSep, resolved } = await resolvePathInRoot(root, params.relativePath, {
+        allowFinalSymlink: true,
+    });
     let opened;
     try {
         opened = await openVerifiedLocalFile(resolved, {
@@ -30831,6 +30967,15 @@ function buildAtomicWriteTempPath(targetPath) {
 function rootWriteQueueKey(root, relativePath) {
     return `${root.rootReal}\0${relativePath}`;
 }
+async function prepareRootWriteTarget(rootReal, targetPath) {
+    const parentPath = await mkdirPathComponentsWithGuards({
+        rootReal,
+        targetPath: external_node_path_.dirname(targetPath),
+    });
+    // Continue through the guarded walk's real parent instead of re-entering
+    // the original path through a symlinked component.
+    return external_node_path_.join(parentPath, external_node_path_.basename(targetPath));
+}
 async function writeTempFileForAtomicReplace(params) {
     const tempHandle = await promises_.open(params.tempPath, OPEN_WRITE_CREATE_FLAGS, params.mode);
     try {
@@ -30861,7 +31006,7 @@ async function verifyAtomicWriteResult(params) {
     }
 }
 async function openWritableFileInRoot(root, params) {
-    const { rootReal, rootWithSep, resolved } = await resolvePathInRoot(root, params.relativePath);
+    const { rootReal, rootWithSep, resolved } = await resolvePathInRoot(root, params.relativePath, { aliasErrorCode: "path-alias" });
     await assertMutationNotDenied(resolved, params.denyMutations);
     try {
         await assertNoPathAliasEscape({
@@ -30873,15 +31018,11 @@ async function openWritableFileInRoot(root, params) {
     catch (err) {
         throw new errors_FsSafeError("path-alias", "path alias escape blocked", { cause: err });
     }
-    if (params.mkdir !== false) {
-        const parentGuard = await directory_guard_createNearestExistingDirectoryGuard(rootReal, external_node_path_.dirname(resolved));
-        await withAsyncDirectoryGuards([parentGuard], async () => {
-            await promises_.mkdir(external_node_path_.dirname(resolved), { recursive: true });
-        });
-    }
-    let ioPath = resolved;
+    let ioPath = params.mkdir === false
+        ? resolved
+        : await prepareRootWriteTarget(rootReal, resolved);
     try {
-        const resolvedRealPath = await promises_.realpath(resolved);
+        const resolvedRealPath = await promises_.realpath(ioPath);
         if (!path_isPathInside(rootWithSep, resolvedRealPath)) {
             throw new errors_FsSafeError("outside-workspace", "file is outside workspace root");
         }
@@ -30966,6 +31107,7 @@ async function openWritableFileInRoot(root, params) {
         }
         return {
             handle,
+            containment: "best-effort",
             createdForWrite,
             realPath,
             stat,
@@ -31021,44 +31163,22 @@ async function appendFileInRoot(root, params) {
     }
 }
 async function removePathInRoot(root, params) {
+    validatePinnedOperationPayload({ relativePath: params.relativePath });
     const resolved = await resolvePinnedRemovePathInRoot(root, params.relativePath, params.denyMutations);
-    if (process.platform === "win32") {
-        await removePathFallback(resolved);
-        return;
-    }
     try {
-        await runPinnedPathHelper({
-            operation: "remove",
-            rootPath: resolved.rootReal,
-            relativePath: resolved.relativePosix,
-        });
+        await removePathFallback(resolved);
     }
     catch (error) {
-        if (isPinnedPathHelperSpawnError(error)) {
-            await removePathFallback(resolved);
-            return;
-        }
         throw normalizePinnedPathError(error);
     }
 }
 async function mkdirPathInRoot(root, params) {
+    validatePinnedOperationPayload({ relativePath: params.relativePath });
     const resolved = await resolvePinnedPathInRoot(root, params);
-    if (process.platform === "win32") {
-        await mkdirPathFallback(resolved);
-        return;
-    }
     try {
-        await runPinnedPathHelper({
-            operation: "mkdirp",
-            rootPath: resolved.rootReal,
-            relativePath: resolved.relativePosix,
-        });
+        await mkdirPathFallback(resolved);
     }
     catch (error) {
-        if (isPinnedPathHelperSpawnError(error)) {
-            await mkdirPathFallback(resolved);
-            return;
-        }
         throw normalizePinnedPathError(error);
     }
 }
@@ -31124,49 +31244,25 @@ async function copyFileInRoot(root, params) {
         throw new errors_FsSafeError("too-large", `file exceeds limit of ${params.maxBytes} bytes (got ${source.stat.size})`);
     }
     try {
-        if (process.platform === "win32") {
-            await serializePathWrite(rootWriteQueueKey(root, params.relativePath), async () => {
-                await copyFileFallback(root, params, source);
-            });
-            return;
-        }
         const pinned = await resolvePinnedWriteTargetInRoot(root, params.relativePath, params.mode, params.denyMutations);
         await serializePathWrite(pinned.targetPath, async () => {
-            let identity;
+            await assertCopySourceCurrent(source);
+            const identity = await runPinnedWriteHelper({
+                rootPath: pinned.rootReal,
+                relativeParentPath: pinned.relativeParentPath,
+                basename: pinned.basename,
+                mkdir: params.mkdir !== false,
+                mode: pinned.mode,
+                overwrite: true,
+                maxBytes: params.maxBytes,
+                input: { kind: "stream", stream: source.handle.createReadStream() },
+            });
             try {
-                if (getFsSafePythonConfig().mode === "off") {
-                    await copyFileFallback(root, params, source);
-                    return;
-                }
-                identity = await runPinnedCopyHelper({
-                    rootPath: pinned.rootReal,
-                    relativeParentPath: pinned.relativeParentPath,
-                    basename: pinned.basename,
-                    mkdir: params.mkdir !== false,
-                    mode: pinned.mode,
-                    overwrite: true,
-                    maxBytes: params.maxBytes,
-                    sourcePath: source.realPath,
-                    sourceIdentity: { dev: source.stat.dev, ino: source.stat.ino },
-                });
+                await assertCopySourcePathCurrent(source);
             }
             catch (error) {
-                if (canFallbackFromPythonError(error)) {
-                    await copyFileFallback(root, params, source);
-                    return;
-                }
-                throw normalizePinnedWriteError(error);
-            }
-            try {
-                await verifyAtomicWriteResult({
-                    root,
-                    targetPath: pinned.targetPath,
-                    expectedIdentity: identity,
-                });
-            }
-            catch (err) {
-                emitWriteBoundaryWarning(`post-copy verification failed: ${String(err)}`);
-                throw err;
+                await removeCopyTargetIfUnchanged(pinned.targetPath, identity).catch(() => undefined);
+                throw error;
             }
         });
     }
@@ -31174,8 +31270,33 @@ async function copyFileInRoot(root, params) {
         await source.handle.close().catch(() => { });
     }
 }
+async function assertCopySourceCurrent(source) {
+    const opened = await source.handle.stat();
+    if (!file_identity_sameFileIdentity(opened, source.stat)) {
+        throw new errors_FsSafeError("path-mismatch", "copy source descriptor changed");
+    }
+    await assertCopySourcePathCurrent(source);
+}
+async function assertCopySourcePathCurrent(source) {
+    const current = await promises_.lstat(source.realPath);
+    if (current.isSymbolicLink() || !current.isFile() || !file_identity_sameFileIdentity(current, source.stat)) {
+        throw new errors_FsSafeError("path-mismatch", "copy source path changed");
+    }
+}
+async function removeCopyTargetIfUnchanged(targetPath, identity) {
+    const parentGuard = await directory_guard_createAsyncDirectoryGuard(external_node_path_.dirname(targetPath));
+    const current = await promises_.lstat(targetPath);
+    if (current.isSymbolicLink() || !file_identity_sameFileIdentity(current, identity)) {
+        return;
+    }
+    await withAsyncDirectoryGuards([parentGuard], async () => {
+        await promises_.rm(targetPath);
+    });
+}
 async function resolvePinnedWriteTargetInRoot(root, relativePath, requestedMode, denyMutations) {
-    const { rootReal, rootWithSep, resolved } = await resolvePathInRoot(root, relativePath);
+    const { rootReal, rootWithSep, resolved } = await resolvePathInRoot(root, relativePath, {
+        aliasErrorCode: "path-alias",
+    });
     await assertMutationNotDenied(resolved, denyMutations);
     try {
         await assertNoPathAliasEscape({
@@ -31277,8 +31398,11 @@ async function resolvePinnedRootPathInRoot(root, params) {
     const rootReal = root.rootReal;
     let resolved;
     try {
+        const expandedPath = await expandRelativePathWithHome(params.relativePath);
         resolved = await resolveRootPath({
-            absolutePath: external_node_path_.resolve(rootReal, await expandRelativePathWithHome(params.relativePath)),
+            absolutePath: external_node_path_.isAbsolute(expandedPath)
+                ? expandedPath
+                : `${ensureTrailingSep(rootReal)}${expandedPath}`,
             rootPath: rootReal,
             rootCanonicalPath: rootReal,
             boundaryLabel: "root",
@@ -31349,35 +31473,51 @@ async function listPathFallback(root, relativePath, withFileTypes) {
     }
 }
 async function assertMoveMutationAllowed(root, params) {
-    const source = await resolvePathInRoot(root, params.fromRelative);
+    const source = await resolvePathInRoot(root, params.fromRelative, {
+        aliasErrorCode: "path-alias",
+        allowFinalSymlink: true,
+    });
     await assertMutationNotDenied(source.resolved, params.denyMutations, { protectAncestors: true });
-    const target = await resolvePathInRoot(root, params.toRelative);
+    const target = await resolvePathInRoot(root, params.toRelative, {
+        aliasErrorCode: "path-alias",
+        allowFinalSymlink: true,
+    });
     await assertMutationNotDenied(target.resolved, params.denyMutations, { protectAncestors: true });
 }
 async function movePathFallback(root, params) {
-    const source = await resolvePathInRoot(root, params.fromRelative);
+    const source = await resolvePathInRoot(root, params.fromRelative, {
+        aliasErrorCode: "path-alias",
+        allowFinalSymlink: true,
+    });
     await assertMutationNotDenied(source.resolved, params.denyMutations, { protectAncestors: true });
     await resolvePinnedRootPathInRoot(root, {
         relativePath: params.fromRelative,
         policy: PATH_ALIAS_POLICIES.strict,
     });
-    const target = await resolvePathInRoot(root, params.toRelative);
+    const target = await resolvePathInRoot(root, params.toRelative, {
+        aliasErrorCode: "path-alias",
+        allowFinalSymlink: true,
+    });
     await assertMutationNotDenied(target.resolved, params.denyMutations, { protectAncestors: true });
     await resolvePinnedRootPathInRoot(root, {
         relativePath: params.toRelative,
         policy: PATH_ALIAS_POLICIES.unlinkTarget,
     });
-    try {
-        await assertNoPathAliasEscape({
-            absolutePath: target.resolved,
-            rootPath: target.rootReal,
-            boundaryLabel: "root",
-        });
-    }
-    catch (error) {
-        throw new errors_FsSafeError("path-alias", "path alias escape blocked", {
-            cause: error instanceof Error ? error : undefined,
-        });
+    const targetStat = await promises_.lstat(target.resolved).catch(() => undefined);
+    const replacesFinalSymlink = process.platform !== "win32" && params.overwrite && targetStat?.isSymbolicLink() === true;
+    if (!replacesFinalSymlink) {
+        try {
+            await assertNoPathAliasEscape({
+                absolutePath: target.resolved,
+                rootPath: target.rootReal,
+                boundaryLabel: "root",
+            });
+        }
+        catch (error) {
+            throw new errors_FsSafeError("path-alias", "path alias escape blocked", {
+                cause: error instanceof Error ? error : undefined,
+            });
+        }
     }
     let sourceStat;
     try {
@@ -31464,6 +31604,7 @@ async function writeFileFallback(root, params) {
             encoding: params.encoding,
             mode: mode || 0o600,
         });
+        unregisterTempPath.setIdentity(writtenStat);
         const commitTempPath = tempPath;
         await withAsyncDirectoryGuards([destinationGuard], async () => {
             await promises_.rename(commitTempPath, destinationPath);
@@ -31491,7 +31632,9 @@ async function writeFileFallback(root, params) {
     }
 }
 async function writeMissingFileFallback(root, params) {
-    const { rootReal, resolved } = await resolvePathInRoot(root, params.relativePath);
+    const { rootReal, resolved } = await resolvePathInRoot(root, params.relativePath, {
+        aliasErrorCode: "path-alias",
+    });
     await assertMutationNotDenied(resolved, params.denyMutations);
     try {
         await assertNoPathAliasEscape({
@@ -31503,14 +31646,14 @@ async function writeMissingFileFallback(root, params) {
     catch (err) {
         throw new errors_FsSafeError("path-alias", "path alias escape blocked", { cause: err });
     }
-    if (params.mkdir !== false) {
-        await promises_.mkdir(external_node_path_.dirname(resolved), { recursive: true });
-    }
-    const parentGuard = await directory_guard_createAsyncDirectoryGuard(external_node_path_.dirname(resolved));
+    const targetPath = params.mkdir === false
+        ? resolved
+        : await prepareRootWriteTarget(rootReal, resolved);
+    const parentGuard = await directory_guard_createAsyncDirectoryGuard(external_node_path_.dirname(targetPath));
     let created = false;
     try {
         const { handle, writtenStat } = await withAsyncDirectoryGuards([parentGuard], async () => {
-            const handle = await promises_.open(resolved, OPEN_WRITE_CREATE_FLAGS, params.mode ?? 0o600);
+            const handle = await promises_.open(targetPath, OPEN_WRITE_CREATE_FLAGS, params.mode ?? 0o600);
             created = true;
             try {
                 if (typeof params.data === "string") {
@@ -31534,7 +31677,7 @@ async function writeMissingFileFallback(root, params) {
         await handle.close();
         await verifyAtomicWriteResult({
             root,
-            targetPath: resolved,
+            targetPath,
             expectedIdentity: writtenStat,
         });
         created = false;
@@ -31549,87 +31692,102 @@ async function writeMissingFileFallback(root, params) {
     }
     finally {
         if (created) {
-            await promises_.rm(resolved, { force: true }).catch(() => undefined);
+            await promises_.rm(targetPath, { force: true }).catch(() => undefined);
         }
     }
 }
-async function copyFileFallback(root, params, source) {
-    let target = null;
-    let sourceClosedByStream = false;
-    let targetClosedByUs = false;
-    let tempHandle = null;
-    let tempPath = null;
-    let unregisterTempPath = null;
-    let tempClosedByStream = false;
-    try {
-        target = await openWritableFileInRoot(root, {
-            relativePath: params.relativePath,
-            mkdir: params.mkdir,
-            mode: params.mode,
-            denyMutations: params.denyMutations,
-            truncateExisting: false,
-        });
-        const destinationPath = target.realPath;
-        const mode = params.mode ?? (target.stat.mode & 0o777);
-        await target.handle.close().catch(() => { });
-        targetClosedByUs = true;
-        const destinationGuard = await directory_guard_createAsyncDirectoryGuard(external_node_path_.dirname(destinationPath));
-        tempPath = buildAtomicWriteTempPath(destinationPath);
-        unregisterTempPath = registerTempPathForExit(tempPath);
-        tempHandle = await promises_.open(tempPath, OPEN_WRITE_CREATE_FLAGS, mode || 0o600);
-        const sourceStream = createBoundedReadStream(source, params.maxBytes);
-        const targetStream = tempHandle.createWriteStream();
-        sourceStream.once("close", () => {
-            sourceClosedByStream = true;
-        });
-        targetStream.once("close", () => {
-            tempClosedByStream = true;
-        });
-        await (0,external_node_stream_promises_.pipeline)(sourceStream, targetStream);
-        const writtenStat = await promises_.stat(tempPath);
-        if (!tempClosedByStream) {
-            await tempHandle.close().catch(() => { });
-            tempClosedByStream = true;
-        }
-        tempHandle = null;
-        const commitTempPath = tempPath;
-        await withAsyncDirectoryGuards([destinationGuard], async () => {
-            await promises_.rename(commitTempPath, destinationPath);
-        });
-        tempPath = null;
-        unregisterTempPath();
-        unregisterTempPath = null;
-        try {
-            await verifyAtomicWriteResult({
-                root,
-                targetPath: destinationPath,
-                expectedIdentity: writtenStat,
-            });
+
+;// CONCATENATED MODULE: ../core/src/gateways/read-file-no-follow.ts
+/**
+ * Atomic file read with symlink and size protection.
+ */ 
+
+function isEloopError(error) {
+    return error instanceof Error && "code" in error && error.code === "ELOOP";
+}
+async function openWithoutFollowingSymlinks(filePath, safePath) {
+    const hasNoFollow = typeof external_node_fs_.constants.O_NOFOLLOW === "number" && external_node_fs_.constants.O_NOFOLLOW !== 0;
+    if (!hasNoFollow) {
+        const stats = await (0,promises_.lstat)(filePath);
+        if (stats.isSymbolicLink()) {
+            throw new Error(`Symlinks are not allowed: ${safePath}`);
         }
-        catch (err) {
-            emitWriteBoundaryWarning(`post-copy verification failed: ${String(err)}`);
-            throw err;
+        return (0,promises_.open)(filePath, external_node_fs_.constants.O_RDONLY);
+    }
+    try {
+        return await (0,promises_.open)(filePath, external_node_fs_.constants.O_RDONLY | external_node_fs_.constants.O_NOFOLLOW);
+    } catch (error) {
+        if (isEloopError(error)) {
+            throw new Error(`Symlinks are not allowed: ${safePath}`);
         }
+        throw error;
     }
-    catch (err) {
-        if (target?.createdForWrite) {
-            await promises_.rm(target.realPath, { force: true }).catch(() => { });
+}
+/**
+ * Reads a file atomically with symlink and size protection.
+ *
+ * Uses `O_NOFOLLOW` (where available) to atomically reject symlinks at
+ * the kernel level, eliminating the TOCTOU window between `lstat()` and
+ * `readFile()`. Falls back to `lstat()` on platforms without `O_NOFOLLOW`.
+ * Validates file size via `fstat()` on the opened file descriptor so the
+ * size check and the read operate on the same inode.
+ */ async function read_file_no_follow_readFileNoFollow(filePath, maxBytes) {
+    const safePath = JSON.stringify(filePath);
+    const fh = await openWithoutFollowingSymlinks(filePath, safePath);
+    try {
+        const fdStats = await fh.stat();
+        if (fdStats.size > maxBytes) {
+            throw new Error(`File ${safePath} exceeds size limit (${fdStats.size} bytes > ${maxBytes} bytes)`);
         }
-        throw err;
+        return await fh.readFile("utf-8");
+    } finally{
+        await fh.close();
     }
-    finally {
-        if (!sourceClosedByStream) {
-            await source.handle.close().catch(() => { });
+}
+
+;// CONCATENATED MODULE: ../core/src/gateways/symlink-path-guard.ts
+/**
+ * Path-segment symlink rejection helpers for root-bounded FS ops.
+ */ 
+
+
+function isEnoentError(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function symlinkNotAllowedError(relativePath) {
+    return new Error(`Symlinks are not allowed: path contains symbolic link: ${JSON.stringify(relativePath)}`, {
+        cause: new errors_FsSafeError("symlink", "symlink not allowed")
+    });
+}
+async function lstatIfExists(path) {
+    try {
+        return await (0,promises_.lstat)(path);
+    } catch (error) {
+        if (isEnoentError(error)) {
+            return undefined;
         }
-        if (tempHandle && !tempClosedByStream) {
-            await tempHandle.close().catch(() => { });
+        throw error;
+    }
+}
+/**
+ * Walk path segments under rootPath and reject any symbolic-link component.
+ * Stops at the first missing segment (ENOENT).
+ */ async function rejectSymlinkSegments(rootPath, relativeFromRoot, onSymlink) {
+    if (!relativeFromRoot) {
+        return;
+    }
+    let currentPath = rootPath;
+    for (const segment of relativeFromRoot.split(external_node_path_.sep)){
+        if (!segment || segment === ".") {
+            continue;
         }
-        if (tempPath) {
-            await promises_.rm(tempPath, { force: true }).catch(() => { });
+        currentPath = (0,external_node_path_.join)(currentPath, segment);
+        const stats = await lstatIfExists(currentPath);
+        if (stats === undefined) {
+            return;
         }
-        unregisterTempPath?.();
-        if (target && !targetClosedByUs) {
-            await target.handle.close().catch(() => { });
+        if (stats.isSymbolicLink()) {
+            throw onSymlink(currentPath);
         }
     }
 }
@@ -31641,6 +31799,8 @@ async function copyFileFallback(root, params, source) {
 
 
 
+
+
 /**
  * Checks if a file or directory exists.
  */ async function file_system_utils_fileExists(path) {
@@ -31652,28 +31812,34 @@ async function copyFileFallback(root, params, source) {
     }
 }
 function isPathWithinRoot(rootPath, candidatePath) {
-    return candidatePath === rootPath || candidatePath.startsWith(`${rootPath}${external_node_path_.sep}`);
+    if (candidatePath === rootPath) {
+        return true;
+    }
+    // When root is `/` (or `C:\`), appending sep would yield `//` / `C:\\` and
+    // incorrectly reject every in-root path. Use root as the prefix when it
+    // already ends with the separator.
+    const prefix = rootPath.endsWith(external_node_path_.sep) ? rootPath : `${rootPath}${external_node_path_.sep}`;
+    return candidatePath.startsWith(prefix);
 }
 function mapFsSafeError(error, relativePath) {
-    if (error instanceof errors_FsSafeError) {
-        switch(error.code){
-            case "outside-workspace":
-            case "invalid-path":
-                throw new Error(`Resolved path is outside target directory: ${relativePath}`, {
-                    cause: error
-                });
-            case "path-alias":
-            case "symlink":
-                throw new Error(`Symlinks are not allowed: path contains symbolic link: ${relativePath}`, {
-                    cause: error
-                });
-            case "too-large":
-                throw new Error(`File ${relativePath} exceeds size limit: ${error.message}`, {
-                    cause: error
-                });
-            default:
-                throw error;
-        }
+    if (!(error instanceof errors_FsSafeError)) {
+        throw error;
+    }
+    const safePath = JSON.stringify(relativePath);
+    if (error.code === "outside-workspace" || error.code === "invalid-path") {
+        throw new Error(`Resolved path is outside target directory: ${safePath}`, {
+            cause: error
+        });
+    }
+    if (error.code === "path-alias" || error.code === "symlink") {
+        throw new Error(`Symlinks are not allowed: path contains symbolic link: ${safePath}`, {
+            cause: error
+        });
+    }
+    if (error.code === "too-large") {
+        throw new Error(`File ${safePath} exceeds size limit: ${error.message}`, {
+            cause: error
+        });
     }
     throw error;
 }
@@ -31684,8 +31850,20 @@ async function createSafeRoot(targetDir, maxBytes) {
         symlinks: "reject"
     });
 }
+/**
+ * fs-safe 0.5 exists/stat/list canonicalize through in-root symlinks; open/read
+ * still honor symlinks:"reject". Enforce reject on every root-bounded op.
+ */ async function assertNoSymlinksWithinRoot(targetDir, relativePath) {
+    if (!relativePath) {
+        return;
+    }
+    const absolutePath = await file_system_utils_resolvePathWithinRoot(targetDir, relativePath);
+    const rootPath = await (0,promises_.realpath)(targetDir);
+    await rejectSymlinkSegments(rootPath, (0,external_node_path_.relative)(rootPath, absolutePath), ()=>symlinkNotAllowedError(relativePath));
+}
 async function file_system_utils_readTextWithinRoot(targetDir, relativePath, maxBytes) {
     try {
+        await assertNoSymlinksWithinRoot(targetDir, relativePath);
         const safeRoot = await createSafeRoot(targetDir, maxBytes);
         return await safeRoot.readText(relativePath, {
             maxBytes
@@ -31696,6 +31874,7 @@ async function file_system_utils_readTextWithinRoot(targetDir, relativePath, max
 }
 async function file_system_utils_listDirectoryWithinRoot(targetDir, relativePath) {
     try {
+        await assertNoSymlinksWithinRoot(targetDir, relativePath);
         const safeRoot = await createSafeRoot(targetDir);
         const entries = await safeRoot.list(relativePath, {
             withFileTypes: true
@@ -31715,6 +31894,7 @@ function toSafeDirEntry(entry) {
 }
 async function file_system_utils_pathExistsWithinRoot(targetDir, relativePath) {
     try {
+        await assertNoSymlinksWithinRoot(targetDir, relativePath);
         const safeRoot = await createSafeRoot(targetDir);
         return await safeRoot.exists(relativePath);
     } catch (error) {
@@ -31731,6 +31911,7 @@ async function file_system_utils_pathExistsWithinRoot(targetDir, relativePath) {
 }
 async function file_system_utils_statWithinRoot(targetDir, relativePath) {
     try {
+        await assertNoSymlinksWithinRoot(targetDir, relativePath);
         const safeRoot = await createSafeRoot(targetDir);
         return await safeRoot.stat(relativePath);
     } catch (error) {
@@ -31757,26 +31938,7 @@ async function file_system_utils_statWithinRoot(targetDir, relativePath) {
     if (!isPathWithinRoot(rootPath, absolutePath)) {
         throw new Error(`Resolved path is outside target directory: ${absolutePath}`);
     }
-    const relativePath = (0,external_node_path_.relative)(rootPath, absolutePath);
-    if (!relativePath || relativePath === ".") {
-        return;
-    }
-    const segments = relativePath.split(external_node_path_.sep);
-    let currentPath = rootPath;
-    for (const segment of segments){
-        currentPath = (0,external_node_path_.join)(currentPath, segment);
-        try {
-            const stats = await (0,promises_.lstat)(currentPath);
-            if (stats.isSymbolicLink()) {
-                throw new Error(`Path contains symbolic link: ${currentPath}`);
-            }
-        } catch (error) {
-            if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-                return;
-            }
-            throw error;
-        }
-    }
+    await rejectSymlinkSegments(rootPath, (0,external_node_path_.relative)(rootPath, absolutePath), (segmentPath)=>new Error(`Path contains symbolic link: ${segmentPath}`));
 }
 /**
  * Resolves a relative path under targetDir and validates it does not pass through symlinks.
@@ -31793,44 +31955,6 @@ async function file_system_utils_statWithinRoot(targetDir, relativePath) {
         throw new Error(`${context} exceeds size limit (${fileStats.size} bytes > ${maxBytes} bytes)`);
     }
 }
-/**
- * Reads a file atomically with symlink and size protection.
- *
- * Uses `O_NOFOLLOW` (where available) to atomically reject symlinks at
- * the kernel level, eliminating the TOCTOU window between `lstat()` and
- * `readFile()`. Falls back to `lstat()` on platforms without `O_NOFOLLOW`.
- * Validates file size via `fstat()` on the opened file descriptor so the
- * size check and the read operate on the same inode.
- */ async function file_system_utils_readFileNoFollow(filePath, maxBytes) {
-    const hasNoFollow = typeof external_node_fs_.constants.O_NOFOLLOW === "number" && external_node_fs_.constants.O_NOFOLLOW !== 0;
-    const safePath = JSON.stringify(filePath);
-    let fh;
-    if (hasNoFollow) {
-        try {
-            fh = await (0,promises_.open)(filePath, external_node_fs_.constants.O_RDONLY | external_node_fs_.constants.O_NOFOLLOW);
-        } catch (error) {
-            if (error instanceof Error && "code" in error && error.code === "ELOOP") {
-                throw new Error(`Symlinks are not allowed: ${safePath}`);
-            }
-            throw error;
-        }
-    } else {
-        const stats = await (0,promises_.lstat)(filePath);
-        if (stats.isSymbolicLink()) {
-            throw new Error(`Symlinks are not allowed: ${safePath}`);
-        }
-        fh = await (0,promises_.open)(filePath, external_node_fs_.constants.O_RDONLY);
-    }
-    try {
-        const fdStats = await fh.stat();
-        if (fdStats.size > maxBytes) {
-            throw new Error(`File ${safePath} exceeds size limit (${fdStats.size} bytes > ${maxBytes} bytes)`);
-        }
-        return await fh.readFile("utf-8");
-    } finally{
-        await fh.close();
-    }
-}
 
 ;// CONCATENATED MODULE: ../core/src/gateways/agent-file-gateway.ts
 /**
@@ -33199,8 +33323,6 @@ function _parseInput(input) {
 }
 
 
-// EXTERNAL MODULE: external "node:module"
-var external_node_module_ = __webpack_require__(8995);
 // EXTERNAL MODULE: ../../node_modules/jiti/dist/jiti.cjs
 var jiti = __webpack_require__(3273);
 ;// CONCATENATED MODULE: ../../node_modules/jiti/lib/jiti.mjs
@@ -34845,8 +34967,9 @@ async function readVersionFileContent(targetDir, relativePath) {
                 continue;
             }
             if (await file_system_utils_pathExistsWithinRoot(targetDir, pmConfig.manifestFile)) {
-                const lockfilePath = pmConfig.lockfile ? await file_system_utils_resolveSafePath(targetDir, pmConfig.lockfile) : undefined;
-                const hasLockfile = lockfilePath ? await file_system_utils_pathExistsWithinRoot(targetDir, pmConfig.lockfile) : false;
+                const { lockfile } = pmConfig;
+                const lockfilePath = lockfile ? await file_system_utils_resolveSafePath(targetDir, lockfile) : undefined;
+                const hasLockfile = lockfilePath && lockfile ? await file_system_utils_pathExistsWithinRoot(targetDir, lockfile) : false;
                 if (pmConfig.requiresLockfile && !hasLockfile) {
                     continue;
                 }
@@ -34863,8 +34986,9 @@ async function readVersionFileContent(targetDir, relativePath) {
         const packageManagers = [];
         for (const pmConfig of otherPackageManagers){
             if (await file_system_utils_pathExistsWithinRoot(targetDir, pmConfig.manifestFile)) {
-                const lockfilePath = pmConfig.lockfile ? await file_system_utils_resolveSafePath(targetDir, pmConfig.lockfile) : undefined;
-                const hasLockfile = lockfilePath ? await file_system_utils_pathExistsWithinRoot(targetDir, pmConfig.lockfile) : false;
+                const { lockfile } = pmConfig;
+                const lockfilePath = lockfile ? await file_system_utils_resolveSafePath(targetDir, lockfile) : undefined;
+                const hasLockfile = lockfilePath && lockfile ? await file_system_utils_pathExistsWithinRoot(targetDir, lockfile) : false;
                 if (pmConfig.requiresLockfile && !hasLockfile) {
                     continue;
                 }
@@ -34885,6 +35009,8 @@ async function readVersionFileContent(targetDir, relativePath) {
     return new FileSystemEnvironmentGateway(cwd);
 }
 
+// EXTERNAL MODULE: external "node:child_process"
+var external_node_child_process_ = __webpack_require__(1421);
 ;// CONCATENATED MODULE: ../core/src/gateways/github-ruleset-gateway.ts
 /**
  * Gateway for interacting with GitHub repository rulesets via Octokit.
@@ -35024,11 +35150,18 @@ function defaultExec(command, args, options) {
             throw new Error("Not authenticated");
         }
         try {
-            await this.octokit.rest.repos.createRepoRuleset({
+            const params = {
                 owner,
                 repo,
-                ...payload
-            });
+                name: payload.name,
+                enforcement: payload.enforcement,
+                target: payload.target,
+                // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
+                bypass_actors: payload.bypass_actors,
+                conditions: payload.conditions,
+                rules: payload.rules
+            };
+            await this.octokit.rest.repos.createRepoRuleset(params);
         } catch (error) {
             const details = formatOctokitError(error);
             throw new Error(`Failed to create ruleset for ${owner}/${repo}: ${details}`);
@@ -37364,7 +37497,7 @@ const PackageJsonSchema = schemas_object({
         const packageJsonPath = (0,external_node_path_.join)(targetDir, "package.json");
         let content;
         try {
-            content = await file_system_utils_readFileNoFollow(packageJsonPath, MAX_PACKAGE_JSON_BYTES);
+            content = await read_file_no_follow_readFileNoFollow(packageJsonPath, MAX_PACKAGE_JSON_BYTES);
         } catch (error) {
             const code = error instanceof Error && "code" in error ? error.code : undefined;
             if (code !== "ENOENT") {
@@ -57350,120 +57483,6 @@ function lib_isUint8Array(value) {
  */
 const remark = unified().use(remarkParse).use(remarkStringify).freeze()
 
-;// CONCATENATED MODULE: ../core/src/gateways/markdown-ast-gateway.ts
-/**
- * Gateway for parsing Markdown files into AST using remark.
- * Extracts structural features like headings, code blocks, and paragraphs.
- */ 
-
-
-/** Maximum instruction file size: 1 MB */ const markdown_ast_gateway_MAX_INSTRUCTION_FILE_BYTES = 1_048_576;
-/**
- * Remark-based implementation of the Markdown AST gateway.
- */ class RemarkMarkdownAstGateway {
-    async parseFile(filePath) {
-        const content = await file_system_utils_readFileNoFollow(filePath, markdown_ast_gateway_MAX_INSTRUCTION_FILE_BYTES);
-        return this.parseContent(content);
-    }
-    parseContent(content) {
-        const processor = remark();
-        const ast = processor.parse(content);
-        const headings = [];
-        const codeBlocks = [];
-        const inlineCodes = [];
-        lib_visit(ast, "heading", (node)=>{
-            const text = this.extractHeadingText(node);
-            headings.push({
-                text,
-                depth: node.depth,
-                position: {
-                    line: node.position?.start.line ?? 0
-                }
-            });
-        });
-        // Track code blocks with their node index in root children
-        for(let i = 0; i < ast.children.length; i++){
-            const child = ast.children[i];
-            if (child.type === "code") {
-                const codeNode = child;
-                codeBlocks.push({
-                    value: codeNode.value,
-                    lang: codeNode.lang ?? undefined,
-                    position: {
-                        line: codeNode.position?.start.line ?? 0
-                    },
-                    nodeIndex: i
-                });
-            }
-        }
-        lib_visit(ast, "inlineCode", (node)=>{
-            inlineCodes.push({
-                value: node.value,
-                position: {
-                    line: node.position?.start.line ?? 0
-                }
-            });
-        });
-        return {
-            headings,
-            codeBlocks,
-            inlineCodes,
-            ast
-        };
-    }
-    findConditionalKeywordsInProximity(structure, codeBlockNodeIndex, proximityWindow, keywords) {
-        const ast = structure.ast;
-        const endIndex = Math.min(ast.children.length, codeBlockNodeIndex + 1 + proximityWindow);
-        for(let i = codeBlockNodeIndex + 1; i < endIndex; i++){
-            const sibling = ast.children[i];
-            const text = extractTextFromNode(sibling);
-            const lowerText = text.toLowerCase();
-            for (const keyword of keywords){
-                if (containsWordBoundary(lowerText, keyword.toLowerCase())) {
-                    return true;
-                }
-            }
-        }
-        return false;
-    }
-    extractHeadingText(node) {
-        const parts = [];
-        lib_visit(node, "text", (textNode)=>{
-            parts.push(textNode.value);
-        });
-        return parts.join("");
-    }
-}
-/**
- * Checks if text contains a keyword at a word boundary (safe string matching, no regex).
- */ function containsWordBoundary(text, keyword) {
-    const index = text.indexOf(keyword);
-    if (index === -1) {
-        return false;
-    }
-    const charBefore = index > 0 ? text[index - 1] : " ";
-    const charAfter = index + keyword.length < text.length ? text[index + keyword.length] : " ";
-    const isWordBoundaryBefore = !/[a-z0-9]/i.test(charBefore);
-    const isWordBoundaryAfter = !/[a-z0-9]/i.test(charAfter);
-    return isWordBoundaryBefore && isWordBoundaryAfter;
-}
-/**
- * Extracts plain text content from any AST node recursively.
- */ function extractTextFromNode(node) {
-    if (node.value && typeof node.value === "string") {
-        return node.value;
-    }
-    if (Array.isArray(node.children)) {
-        return node.children.map((child)=>extractTextFromNode(child)).join(" ");
-    }
-    return "";
-}
-/**
- * Creates and returns the default Markdown AST gateway.
- */ function createMarkdownAstGateway() {
-    return new RemarkMarkdownAstGateway();
-}
-
 ;// CONCATENATED MODULE: ../core/src/entities/instruction-quality.ts
 /**
  * Core domain entities for instruction quality analysis.
@@ -57515,6 +57534,9 @@ const HEADING_PATTERN_DESCRIPTIONS = new Map(Object.entries(HEADING_PATTERN_DESC
  * Orchestrates discovery, AST parsing, and scoring of feedback loop documentation.
  */ 
 
+/** Type guard narrowing an `unknown` AST child to {@link AstNodeLike}. */ function isAstNodeLike(node) {
+    return typeof node === "object" && node !== null && "type" in node && typeof node.type === "string";
+}
 /** Maximum number of raw heading pattern entries accepted before deduplication. */ const MAX_RAW_HEADING_PATTERNS = 1000;
 /** Maximum number of heading patterns accepted in a single execute() call. */ const MAX_HEADING_PATTERNS = 50;
 /** Maximum character length for a single heading pattern. */ const analyze_instruction_quality_MAX_PATTERN_LENGTH = 200;
@@ -57870,6 +57892,9 @@ const HEADING_PATTERN_DESCRIPTIONS = new Map(Object.entries(HEADING_PATTERN_DESC
         return parts.join(" ");
     }
     collectText(node, parts) {
+        if (!isAstNodeLike(node)) {
+            return;
+        }
         if (node.type === "text" && typeof node.value === "string") {
             parts.push(node.value);
         }
@@ -58016,6 +58041,124 @@ const HEADING_PATTERN_DESCRIPTIONS = new Map(Object.entries(HEADING_PATTERN_DESC
     }
 }
 
+;// CONCATENATED MODULE: ../core/src/gateways/markdown-ast-gateway.ts
+/**
+ * Gateway for parsing Markdown files into AST using remark.
+ * Extracts structural features like headings, code blocks, and paragraphs.
+ */ 
+
+
+
+/** Maximum instruction file size: 1 MB */ const markdown_ast_gateway_MAX_INSTRUCTION_FILE_BYTES = 1_048_576;
+/**
+ * Remark-based implementation of the Markdown AST gateway.
+ */ class RemarkMarkdownAstGateway {
+    async parseFile(filePath) {
+        const content = await read_file_no_follow_readFileNoFollow(filePath, markdown_ast_gateway_MAX_INSTRUCTION_FILE_BYTES);
+        return this.parseContent(content);
+    }
+    parseContent(content) {
+        const processor = remark();
+        const ast = processor.parse(content);
+        const headings = [];
+        const codeBlocks = [];
+        const inlineCodes = [];
+        lib_visit(ast, "heading", (node)=>{
+            const text = this.extractHeadingText(node);
+            headings.push({
+                text,
+                depth: node.depth,
+                position: {
+                    line: node.position?.start.line ?? 0
+                }
+            });
+        });
+        // Track code blocks with their node index in root children
+        for(let i = 0; i < ast.children.length; i++){
+            const child = ast.children[i];
+            if (child.type === "code") {
+                const codeNode = child;
+                codeBlocks.push({
+                    value: codeNode.value,
+                    lang: codeNode.lang ?? undefined,
+                    position: {
+                        line: codeNode.position?.start.line ?? 0
+                    },
+                    nodeIndex: i
+                });
+            }
+        }
+        lib_visit(ast, "inlineCode", (node)=>{
+            inlineCodes.push({
+                value: node.value,
+                position: {
+                    line: node.position?.start.line ?? 0
+                }
+            });
+        });
+        return {
+            headings,
+            codeBlocks,
+            inlineCodes,
+            ast
+        };
+    }
+    findConditionalKeywordsInProximity(structure, codeBlockNodeIndex, proximityWindow, keywords) {
+        const ast = structure.ast;
+        const endIndex = Math.min(ast.children.length, codeBlockNodeIndex + 1 + proximityWindow);
+        for(let i = codeBlockNodeIndex + 1; i < endIndex; i++){
+            const sibling = ast.children[i];
+            const text = extractTextFromNode(sibling);
+            const lowerText = text.toLowerCase();
+            for (const keyword of keywords){
+                if (containsWordBoundary(lowerText, keyword.toLowerCase())) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    extractHeadingText(node) {
+        const parts = [];
+        lib_visit(node, "text", (textNode)=>{
+            parts.push(textNode.value);
+        });
+        return parts.join("");
+    }
+}
+/**
+ * Checks if text contains a keyword at a word boundary (safe string matching, no regex).
+ */ function containsWordBoundary(text, keyword) {
+    const index = text.indexOf(keyword);
+    if (index === -1) {
+        return false;
+    }
+    const charBefore = index > 0 ? text[index - 1] : " ";
+    const charAfter = index + keyword.length < text.length ? text[index + keyword.length] : " ";
+    const isWordBoundaryBefore = !/[a-z0-9]/i.test(charBefore);
+    const isWordBoundaryAfter = !/[a-z0-9]/i.test(charAfter);
+    return isWordBoundaryBefore && isWordBoundaryAfter;
+}
+/**
+ * Extracts plain text content from any AST node recursively.
+ */ function extractTextFromNode(node) {
+    if (!isAstNodeLike(node)) {
+        return "";
+    }
+    if (node.value && typeof node.value === "string") {
+        return node.value;
+    }
+    if (Array.isArray(node.children)) {
+        return node.children.map((child)=>extractTextFromNode(child)).join(" ");
+    }
+    return "";
+}
+/**
+ * Creates and returns the default Markdown AST gateway.
+ */ function createMarkdownAstGateway() {
+    return new RemarkMarkdownAstGateway();
+}
+
 ;// CONCATENATED MODULE: ./src/tools/analyze-instruction-quality.ts
 /**
  * MCP tool handler for analyzing instruction quality.
@@ -69893,4 +70036,4 @@ if (installedChunkData !== 0) { // 0 means "already installed".'
 // module factories are used so entry inlining is disabled
 // startup
 // Load entry module and return exports
-var __webpack_exports__ = __webpack_require__(8454);
+var __webpack_exports__ = __webpack_require__(7489);