@lousy-agents/mcp 5.22.14 → 5.22.16

package/dist/mcp-server.js

@@ -6559,7 +6559,7 @@ function escapeJsonPtr(str) {
 
 
 },
-8363(__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
+9324(__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
 // NAMESPACE OBJECT: ../../node_modules/micromark/lib/constructs.js
 var constructs_namespaceObject = {};
 __webpack_require__.r(constructs_namespaceObject);
@@ -39512,7 +39512,11 @@ function safeRealpathSync(targetPath, cache) {
         return cached;
     }
     try {
-        const resolved = realpathSync(pathForWindowsFilesystem(targetPath));
+        const ordinary = realpathSync(pathForWindowsFilesystem(targetPath));
+        // Ordinary resolution keeps the caller's letter case. Its result has no symlinks or
+        // dot segments left, so native resolution on POSIX only adopts the on-disk spelling
+        // that root admission compares against. Windows root admission reconciles aliases.
+        const resolved = process.platform === "win32" ? ordinary : realpathSync.native(ordinary);
         cache?.set(targetPath, resolved);
         cache?.set(resolved, resolved);
         return resolved;
@@ -41741,6 +41745,7 @@ function validateDescriptor(value, allowUnknownFlags) {
         typeof value.currentUserSid !== "string" || !SID_RE.test(value.currentUserSid) ||
         (value.currentAppContainerSid != null && (typeof value.currentAppContainerSid !== "string" || !APP_CONTAINER_SID_RE.test(value.currentAppContainerSid))) ||
         typeof value.daclPresent !== "boolean" || typeof value.isLocal !== "boolean" ||
+        (value.isVolumeRoot !== undefined && typeof value.isVolumeRoot !== "boolean") ||
         typeof value.aceListComplete !== "boolean" || !Array.isArray(value.unsupportedAceTypes) ||
         !value.unsupportedAceTypes.every(windows_security_facts_uint32) || !Array.isArray(value.aces) ||
         !value.aces.every(ace => validateAce(ace, allowUnknownFlags))) {
@@ -50139,9 +50144,14 @@ const onCopySourceAdmission = Symbol("onCopySourceAdmission");
 
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/file-sync.js
 
+function syncFile(handle) {
+    return typeof handle === "number"
+        ? new Promise((resolve, reject) => external_node_fs_.fsync(handle, error => error ? reject(error) : resolve()))
+        : handle.sync();
+}
 async function syncFileBestEffort(handle) {
     try {
-        await handle.sync();
+        await syncFile(handle);
     }
     catch (error) {
         if (error?.code !== "EPERM")
@@ -50847,6 +50857,7 @@ class NativeStagedFile {
     #verifyMode;
     #state = { status: "open", publication: NOT_PUBLISHED };
     #receipt;
+    #publicationFlush;
     #rejectFinalSymlink = false;
     #unsupportedNoReplace;
     #fallbackCleanup;
@@ -50883,8 +50894,7 @@ class NativeStagedFile {
         const env_1 = { stack: [], error: void 0, hasError: false };
         try {
             const exclusive = params.overwrite === false && params.input.kind === "buffer" && params.input.stageBeforePublish === false;
-            // This owner never escapes. Only the internal verifier borrows its fd;
-            // public descriptor methods remain await-free and cannot race disposal.
+            // This owner never escapes; only the internal verifier borrows its fd.
             const staged = native_staged_file_addDisposableResource(env_1, await NativeStagedFile.create({
                 binding, parentFd, closeParentFd, directory, mode: params.mode, sync: params.sync,
                 // Public staging uses portable names; existing POSIX writes accept literal names.
@@ -50903,9 +50913,10 @@ class NativeStagedFile {
             }
             let published;
             try {
-                published = exclusive
+                const publication = exclusive
                     ? staged.#completePublication(params.basename, false, params.onPublished)
-                    : await staged.publish(params.basename, { overwrite: params.overwrite !== false }, params.onPublished);
+                    : staged.publish(params.basename, { overwrite: params.overwrite !== false }, params.onPublished);
+                published = publication instanceof Promise ? await publication : publication;
             }
             catch (error) {
                 if (!staged.#unsupportedNoReplace || isFsSafeNativeRequired() ||
@@ -51068,29 +51079,21 @@ class NativeStagedFile {
                 restoreCopyMetadata(fd, input.metadata);
             if (this.#verifyMode)
                 this.#assertStagePermissions(fd);
-            if (this.#owner.sync !== false) {
-                if (this.#owner.strictFileSync)
-                    external_node_fs_.fsyncSync(fd);
-                else
-                    syncFileBestEffortSync(fd);
-            }
+            if (this.#owner.sync !== false)
+                await (this.#owner.strictFileSync ? syncFile(fd) : syncFileBestEffort(fd));
             const stat = external_node_fs_.fstatSync(fd, { bigint: true });
             this.#receipt = createStagedFileReceipt(this.#owner.directory, this.#owner.name, stat);
             this.#assertCurrent();
         }
         catch (error) {
             const { receipt: cleanup, error: cleanupError } = this.#finalize();
-            if (cleanupError) {
-                throw stagedFailure("file", new AggregateError([error, cleanupError], "preparation and cleanup failed"), { phase: "prepare", publication: cleanup.publication, cleanup });
-            }
-            if (cleanup.status === "preserved") {
-                throw stagedFailure("file", error, { phase: "prepare", publication: cleanup.publication, cleanup });
+            if (cleanupError || cleanup.status === "preserved") {
+                throw stagedFailure("file", cleanupError
+                    ? new AggregateError([error, cleanupError], "preparation and cleanup failed") : error, { phase: "prepare", publication: cleanup.publication, cleanup });
             }
             throw error;
         }
     }
-    // Keep public descriptor work await-free: each call completes its mutations
-    // before the next invocation, including closure and cached cleanup failures.
     async assertCurrent() {
         this.#assertCurrent();
     }
@@ -51135,7 +51138,8 @@ class NativeStagedFile {
                 }
                 throw error;
             }
-            return this.#completePublication(basename, overwrite, onPublished);
+            const publication = this.#completePublication(basename, overwrite, onPublished);
+            return publication instanceof Promise ? await publication : publication;
         }
         catch (error) {
             if (isMutationAuthorityError(error))
@@ -51161,17 +51165,21 @@ class NativeStagedFile {
             external_node_fs_.fchmodSync(fd, this.#owner.mode);
         // Content was synced during preparation. A lost chmod leaves 0600, no wider
         // than modes retaining owner rw; restrictive modes still need a durable correction.
-        if (this.#owner.sync !== false && ((this.#owner.mode & 0o600) !== 0o600 || (stagedMode & ~this.#owner.mode) !== 0)) {
-            if (this.#owner.strictFileSync)
-                external_node_fs_.fsyncSync(fd);
-            else
-                syncFileBestEffortSync(fd);
-        }
-        if (this.#owner.sync !== false)
-            syncFileBestEffortSync(this.#owner.parentFd);
-        this.#assertNamed(basename, this.#owner.mode);
-        this.#assertDirectory();
-        return receipt;
+        const verify = () => {
+            this.#assertNamed(basename, this.#owner.mode);
+            this.#assertDirectory();
+            return receipt;
+        };
+        if (this.#owner.sync === false)
+            return verify();
+        this.#publicationFlush = Promise.resolve().then(async () => {
+            if ((this.#owner.mode & 0o600) !== 0o600 || (stagedMode & ~this.#owner.mode) !== 0) {
+                await (this.#owner.strictFileSync ? syncFile(fd) : syncFileBestEffort(fd));
+            }
+            await syncFileBestEffort(this.#owner.parentFd);
+            return verify();
+        }).finally(() => { this.#publicationFlush = undefined; });
+        return this.#publicationFlush;
     }
     #finalize() {
         if (this.#state.status === "closed") {
@@ -51226,6 +51234,9 @@ class NativeStagedFile {
         return this.#state;
     }
     async cleanup() {
+        // Native descriptors cannot close or be recycled while libuv is synchronizing them.
+        if (this.#publicationFlush)
+            await this.#publicationFlush.catch(() => { });
         const closed = this.#finalize();
         if (closed.error) {
             throw closed.error;
@@ -53712,8 +53723,8 @@ function pinnedWriteModeAssertion(fd, mode, assertBeforeMutation, privateCreatio
 
 
 // Node has no portable no-replace rename. Publish the completed stage by link,
-// then remove its verified temporary name without yielding.
-function publishCopyStage(params) {
+// then remove its verified temporary name after any descriptor handoff.
+async function publishCopyStage(params) {
     const { identity, temporaryPath, targetPath } = params;
     const assertCurrent = () => {
         directory_guard_assertSyncDirectoryGuard(params.parentGuard);
@@ -53767,13 +53778,23 @@ function publishCopyStage(params) {
             }
         }
         else {
-            const parent = external_node_fs_.lstatSync(external_node_path_.dirname(temporaryPath), { bigint: true });
-            const current = external_node_fs_.lstatSync(temporaryPath, { bigint: true });
-            if (parent.isSymbolicLink() || !parent.isDirectory() ||
-                !file_identity_sameFileIdentityForCleanup(parent, params.parentGuard.stat) ||
-                current.isSymbolicLink() || !current.isFile() ||
-                !file_identity_sameFileIdentityForCleanup(current, identity)) {
-                throw new errors_FsSafeError("path-mismatch", "published copy temporary name changed before cleanup");
+            const verifyPair = () => {
+                directory_guard_assertSyncDirectoryGuard(params.parentGuard);
+                const parent = external_node_fs_.lstatSync(external_node_path_.dirname(temporaryPath), { bigint: true });
+                const current = external_node_fs_.lstatSync(temporaryPath, { bigint: true });
+                const target = external_node_fs_.lstatSync(targetPath, { bigint: true });
+                if (parent.isSymbolicLink() || !parent.isDirectory() ||
+                    !file_identity_sameFileIdentityForCleanup(parent, params.parentGuard.stat) ||
+                    current.isSymbolicLink() || !current.isFile() || current.nlink !== 2n ||
+                    target.isSymbolicLink() || !target.isFile() || target.nlink !== 2n ||
+                    !file_identity_sameFileIdentityForCleanup(current, identity) || !file_identity_sameFileIdentityForCleanup(target, identity)) {
+                    throw new errors_FsSafeError("path-mismatch", "published copy temporary name changed before cleanup");
+                }
+            };
+            verifyPair();
+            if (params.beforeTemporaryUnlink) {
+                await params.beforeTemporaryUnlink();
+                verifyPair();
             }
             // This removes the stage's name, never the published destination or source.
             external_node_fs_.unlinkSync(temporaryPath);
@@ -53846,6 +53867,40 @@ function publishThroughPlaceholder(params, assertCurrent) {
     }
 }
 
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/publication-handle.js
+
+
+
+
+
+
+/** Pin the published name before releasing a descriptor opened through its stage. */
+async function openPublicationHandle(targetPath, identity) {
+    const flags = read_open_flags_resolveReadOpenFlags();
+    const handle = await promises_.open(targetPath, flags).catch(async (error) => {
+        // Restrictive final modes must not be widened just to inspect publication.
+        if (!hasErrorCode(error, "EACCES") || (process.arch !== "x64" && process.arch !== "arm64"))
+            throw error;
+        const metadataFlag = process.platform === "linux" ? 0x200000 : undefined; // O_PATH
+        if (metadataFlag === undefined)
+            throw error;
+        return promises_.open(targetPath, metadataFlag | external_node_fs_.constants.O_NOFOLLOW);
+    });
+    try {
+        const opened = external_node_fs_.fstatSync(handle.fd, { bigint: true });
+        const named = external_node_fs_.lstatSync(targetPath, { bigint: true });
+        if (!opened.isFile() || !named.isFile() || named.isSymbolicLink() ||
+            !file_identity_sameFileIdentityForCleanup(opened, identity) || !file_identity_sameFileIdentityForCleanup(named, identity)) {
+            throw new errors_FsSafeError("path-mismatch", "publication descriptor handoff identity changed");
+        }
+        return handle;
+    }
+    catch (error) {
+        await handle.close().catch(() => undefined);
+        throw error;
+    }
+}
+
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/pinned-write-staged.js
 
 
@@ -53867,6 +53922,7 @@ function publishThroughPlaceholder(params, assertCurrent) {
 
 
 
+
 
 
 async function runPinnedStagedWrite(params, parentPath, parentGuard) {
@@ -53884,6 +53940,7 @@ async function runPinnedStagedWrite(params, parentPath, parentGuard) {
     let handle;
     let tempIdentity;
     let readHandle;
+    let handoffCloseFailure;
     let renamed = false;
     const completeCreate = params.overwrite === false && params.input.kind !== "file" && params.input.stageBeforePublish === true;
     let receipt;
@@ -53938,11 +53995,15 @@ async function runPinnedStagedWrite(params, parentPath, parentGuard) {
             }), external_node_path_.basename(tempPath), external_node_fs_.fstatSync(handle.fd, { bigint: true }));
         }
         let verifiedIdentity = expectedTempStat;
+        // Keep unreadable modes supported where Node has no read-free file open.
+        const canHandoff = process.platform !== "win32" &&
+            ((params.mode & 0o400) !== 0 ||
+                (process.platform === "linux" && (process.arch === "x64" || process.arch === "arm64")));
         phase = "publish";
         await withAsyncDirectoryGuards([parentGuard], async () => {
             assertFinalSymlinkRejected(targetPath, params.rejectFinalSymlink);
             if (params.overwrite === false) {
-                publishCopyStage({
+                await publishCopyStage({
                     temporaryPath: tempPath, targetPath, fd: handle.fd,
                     identity: tempIdentity, parentGuard,
                     assertBeforeMutation,
@@ -53956,6 +54017,18 @@ async function runPinnedStagedWrite(params, parentPath, parentGuard) {
                             publication = Object.freeze({ status: "published", staged: receipt, basename: params.basename, overwrite: false });
                         params.onPublished?.(identity);
                     },
+                    beforeTemporaryUnlink: !canHandoff ? undefined : async () => {
+                        readHandle = await openPublicationHandle(targetPath, expectedTempStat);
+                        // Keep the destination pinned while closing the stage's NFS dentry.
+                        const stagedHandle = handle;
+                        handle = undefined;
+                        try {
+                            await stagedHandle.close();
+                        }
+                        catch (error) {
+                            handoffCloseFailure = { error };
+                        }
+                    },
                 });
             }
             else {
@@ -53983,6 +54056,7 @@ async function runPinnedStagedWrite(params, parentPath, parentGuard) {
                     throw new errors_FsSafeError("path-mismatch", "fallback target changed during write");
                 }
                 const expectedHash = sha256Hex(params.input.data, params.input.encoding);
+                await readHandle?.close();
                 readHandle = await promises_.open(targetPath, read_open_flags_resolveReadOpenFlags());
                 const readHandleStat = external_node_fs_.fstatSync(readHandle.fd, { bigint: true });
                 const actualHash = sha256Hex(await readFileHandleBounded(readHandle, Infinity));
@@ -54021,7 +54095,11 @@ async function runPinnedStagedWrite(params, parentPath, parentGuard) {
                         pathname: tempPath, handle, identity: tempIdentity, parentGuard, throwOnCleanupError: true,
                     }) : "not-needed";
                 },
-                close: [async () => { await readHandle?.close(); }, async () => { await handle?.close(); }],
+                close: [async () => { await readHandle?.close(); }, async () => {
+                        await handle?.close();
+                        if (handoffCloseFailure)
+                            throw handoffCloseFailure.error;
+                    }],
             });
         }
         else
@@ -109900,4 +109978,4 @@ if (installedChunkData !== 0) { // 0 means "already installed".'
 // module factories are used so entry inlining is disabled
 // startup
 // Load entry module and return exports
-var __webpack_exports__ = __webpack_require__(8363);
+var __webpack_exports__ = __webpack_require__(9324);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@lousy-agents/mcp",
-    "version": "5.22.14",
+    "version": "5.22.16",
     "description": "MCP server for lousy-agents - provides AI coding assistant tools via the Model Context Protocol",
     "type": "module",
     "repository": {