@openclaw/feishu 2026.9.8 → 2026.10.1-beta.1

package/node_modules/@openclaw/fs-safe/dist/root-write-admission.d.ts

@@ -36,7 +36,7 @@ export type RetainedRootWriteSelection = RootWritePathSelection & Readonly<{
 }>;
 export declare function createRootWriteSelectionForFd(selection: RootWritePathSelection, fd: number): RetainedRootWriteSelection;
 export declare function assertRootWritePathSelectionSync(root: RootContext, selection: RootWritePathSelection): void;
-export declare function assertRootWriteSelectionSync(root: RootContext, selection: RetainedRootWriteSelection, verifyBinding: boolean, fd?: number): void;
+export declare function assertRootWriteSelectionSync(root: RootContext, selection: RetainedRootWriteSelection, fd?: number): void;
 export declare function prepareRootWritePathSelection(params: Omit<RootWritePathSelection, "parentGuard"> & Readonly<{
     preparedParent?: PreparedRootWriteParent;
 }>): Promise<RootWritePathSelection>;
@@ -49,8 +49,8 @@ export declare function refreshRootWritePathSelection(selection: RootWritePathSe
  * Re-authorize a retained shared-JavaScript destination without recapturing
  * either its pathname binding or its exact parent fence.
  */
-export declare function refreshRootWriteSelection(root: RootContext, selection: RetainedRootWriteSelection, verifyBinding: boolean, fd?: number): Promise<void>;
-export declare function refreshRetainedRootWriteAdmission(root: RootContext, selection: RetainedRootWriteSelection, verifyBinding: boolean, fd?: number): Promise<void>;
+export declare function refreshRootWriteSelection(root: RootContext, selection: RetainedRootWriteSelection, fd?: number): Promise<void>;
+export declare function refreshRetainedRootWriteAdmission(root: RootContext, selection: RetainedRootWriteSelection, fd?: number): Promise<void>;
 type GuardedWritePathOptions = {
     relativePath: string;
     denyMutations?: DenyMutationPolicy;

package/node_modules/@openclaw/fs-safe/dist/root-write-admission.js

@@ -92,9 +92,8 @@ export function assertRootWritePathSelectionSync(root, selection) {
     }
     assertSyncDirectoryGuard(selection.parentGuard);
 }
-export function assertRootWriteSelectionSync(root, selection, verifyBinding, fd) {
-    if (verifyBinding)
-        inspectSelectionBindingSync(root, selection, fd);
+export function assertRootWriteSelectionSync(root, selection, fd) {
+    inspectSelectionBindingSync(root, selection, fd);
     assertSyncDirectoryGuard(selection.parentGuard);
 }
 async function authorizeRootWritePathSelection(selection, afterAwait) {
@@ -154,15 +153,14 @@ export async function refreshRootWritePathSelection(selection) {
  * Re-authorize a retained shared-JavaScript destination without recapturing
  * either its pathname binding or its exact parent fence.
  */
-export async function refreshRootWriteSelection(root, selection, verifyBinding, fd) {
+export async function refreshRootWriteSelection(root, selection, fd) {
     await authorizeRootWritePathSelection(selection);
-    if (verifyBinding)
-        inspectSelectionBindingSync(root, selection, fd);
+    inspectSelectionBindingSync(root, selection, fd);
     await assertAsyncDirectoryGuard(selection.parentGuard);
 }
-export async function refreshRetainedRootWriteAdmission(root, selection, verifyBinding, fd) {
+export async function refreshRetainedRootWriteAdmission(root, selection, fd) {
     await getFsSafeTestHooks()?.beforePinnedWriteParentAdmission?.(selection.operationTargetPath);
-    await refreshRootWriteSelection(root, selection, verifyBinding, fd);
+    await refreshRootWriteSelection(root, selection, fd);
 }
 export async function resolveGuardedWritePathInRoot(root, params) {
     const resolvedPath = await resolvePathInRoot(root, params.relativePath, {
@@ -263,9 +261,9 @@ export async function resolvePinnedWriteTargetInRoot(root, relativePath, request
     if (!overwrite) {
         try {
             const existing = fsSync.statSync(resolved);
-            if (!existing.isFile())
+            if (!existing.isFile() && !existing.isDirectory())
                 throw new FsSafeError("not-file", "not a file");
-            if (existing.nlink > 1)
+            if (existing.isFile() && existing.nlink > 1)
                 throw hardlinkedPathNotAllowedError();
             throw new FsSafeError("already-exists", "file already exists");
         }

package/node_modules/@openclaw/fs-safe/dist/safe-path-segment.d.ts

@@ -8,5 +8,4 @@ export declare function trimHyphenEdges(value: string): string;
 export declare function isSafePathSegment(segment: string, options?: SafePathSegmentOptions): boolean;
 export declare function assertSafePathSegment(segment: string, options?: SafePathSegmentOptions): string;
 export declare function normalizeSafePathSegment(value: string): string;
-export declare function sanitizeSafePathSegment(value: string): string | undefined;
 export declare function assertSafePathPrefix(prefix: string, options?: SafePathSegmentOptions): string;

package/node_modules/@openclaw/fs-safe/dist/safe-path-segment.js

@@ -58,10 +58,6 @@ export function normalizeSafePathSegment(value) {
         .replace(/[^A-Za-z0-9._-]+/g, "-");
     return trimHyphenEdges(sanitized);
 }
-export function sanitizeSafePathSegment(value) {
-    const trimmed = normalizeSafePathSegment(value);
-    return isSafePathSegment(trimmed, { allowDotPrefix: true }) ? trimmed : undefined;
-}
 export function assertSafePathPrefix(prefix, options = {}) {
     // Prefixes are often derived from safe filenames. Normalize harmless
     // filename characters first, but still reject real path-control bytes.

package/node_modules/@openclaw/fs-safe/dist/secret-file.js

@@ -7,6 +7,7 @@ import { readFileDescriptorBoundedSync } from "./bounded-read.js";
 import { assertAsyncDirectoryGuard, createAsyncDirectoryGuard, inspectDirectoryIdentity } from "./directory-guard.js";
 import { pinNodeDirectoryForMode, assertOwnedDirectory } from "./directory-mode-node.js";
 import { FsSafeError } from "./errors.js";
+import { hasNodeErrorCode } from "./path.js";
 import { openPinnedFileSync } from "./pinned-open.js";
 import { runPinnedWriteHelper } from "./pinned-write.js";
 import { ensureTrailingSep } from "./root-context.js";
@@ -14,7 +15,7 @@ import { verifyAtomicWriteResult } from "./root-write-verification.js";
 import { prepareSecretRead, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
 import { serializePathWrite } from "./write-queue.js";
-import { assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
+import { assertNoWindowsPathAlias, isForeignWindowsShareOrDevicePath, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 export const PRIVATE_SECRET_DIR_MODE = 0o700;
 export const PRIVATE_SECRET_FILE_MODE = 0o600;
 export function readSecretFileSync(filePath, label, options = {}) {
@@ -62,7 +63,8 @@ function isRelativeEscape(relativePath) {
 }
 function assertPathWithinRoot(rootDir, targetPath) {
     const relative = path.relative(rootDir, targetPath);
-    if (!relative || isRelativeEscape(relative)) {
+    // path.relative folds Unicode case on Windows, so it alone could admit another host.
+    if (!relative || isRelativeEscape(relative) || isForeignWindowsShareOrDevicePath(targetPath, [rootDir])) {
         throw new Error(`Private secret path must stay under ${rootDir}.`);
     }
 }
@@ -172,9 +174,8 @@ async function ensurePrivateDirectory(rootDir, targetDir, mode) {
                 break;
             }
             catch (error) {
-                if (!error || typeof error !== "object" || !("code" in error) || error.code !== "ENOENT") {
+                if (!hasNodeErrorCode(error, "ENOENT"))
                     throw error;
-                }
                 await assertAsyncDirectoryGuard(parentGuard);
                 created = await createPrivateDirectory(current, mode);
                 // EEXIST grants no initialization authority; both outcomes need fresh type checks.
@@ -212,8 +213,11 @@ function snapshotSecretFileWriteParams(params) {
         durable: params.durable,
     };
 }
-async function secretFileWriteQueueKey(filePath) {
+async function secretFileWriteQueueKey(rootDir, filePath) {
+    assertNoWindowsPathAlias(rootDir, "filesystem", "private secret root uses a Windows filesystem namespace alias");
     assertNoWindowsPathAlias(filePath, "filesystem", "private secret path uses a Windows filesystem namespace alias");
+    // Canonicalizing an outside path would probe it first; a foreign share contacts its host.
+    assertPathWithinRoot(resolvePathPreservingWindowsRoot(rootDir), path.resolve(filePath));
     try {
         return await canonicalPathFromExistingAncestor(filePath);
     }
@@ -271,9 +275,8 @@ async function materializeSecretFileAtomic(params, createOnly) {
         }
     }
     catch (error) {
-        if (!error || typeof error !== "object" || !("code" in error) || error.code !== "ENOENT") {
+        if (!hasNodeErrorCode(error, "ENOENT"))
             throw error;
-        }
     }
     await assertAsyncDirectoryGuard(rootGuard);
     await assertAsyncDirectoryGuard(parentGuard);
@@ -310,7 +313,7 @@ async function materializeSecretFileAtomic(params, createOnly) {
 }
 export async function writeSecretFileAtomic(params) {
     const ownedParams = snapshotSecretFileWriteParams(params);
-    const canonicalPath = await secretFileWriteQueueKey(ownedParams.filePath);
+    const canonicalPath = await secretFileWriteQueueKey(ownedParams.rootDir, ownedParams.filePath);
     await serializePathWrite(canonicalPath, async () => {
         await materializeSecretFileAtomic(ownedParams, false);
     });
@@ -318,7 +321,7 @@ export async function writeSecretFileAtomic(params) {
 export async function createSecretFileAtomic(params) {
     try {
         const ownedParams = snapshotSecretFileWriteParams(params);
-        const canonicalPath = await secretFileWriteQueueKey(ownedParams.filePath);
+        const canonicalPath = await secretFileWriteQueueKey(ownedParams.rootDir, ownedParams.filePath);
         await serializePathWrite(canonicalPath, async () => {
             await materializeSecretFileAtomic(ownedParams, true);
         });

package/node_modules/@openclaw/fs-safe/dist/secure-temp-dir.d.ts

@@ -8,8 +8,6 @@ type SecureDirStat = {
 };
 export type ResolveSecureTempRootOptions = {
     accessSync?: (path: string, mode?: number) => void;
-    /** @deprecated Unused. Repairs require descriptor-bound chmod. */
-    chmodSync?: (path: string, mode: number) => void;
     descriptor?: SecureTempRootDescriptorAdapter;
     fallbackPrefix: string;
     getuid?: () => number | undefined;

package/node_modules/@openclaw/fs-safe/dist/sibling-staged-file.js

@@ -2,6 +2,7 @@ import { syncFileBestEffort } from "./file-sync.js";
 import fsSync, {} from "node:fs";
 import fs, {} from "node:fs/promises";
 import path from "node:path";
+import { assertExclusiveCreateLeaf } from "./exclusive-create.js";
 import { assertDirectoryIdentitySync, createAsyncDirectoryGuard, } from "./directory-guard.js";
 import { syncDirectoryBestEffort } from "./directory-durability.js";
 import { isWindowsReservedDeviceName } from "./device-path.js";
@@ -184,6 +185,7 @@ export async function writeCallbackSibling(params) {
             }
         }
         else {
+            assertExclusiveCreateLeaf(tempPath);
             result = await Reflect.apply(write, params, [tempPath]);
         }
         assertParent();

package/node_modules/@openclaw/fs-safe/dist/sibling-temp.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import { assertAsyncDirectoryGuard, createAsyncDirectoryGuard } from "./directory-guard.js";
 import { fitFileNameToPortableComponent, sanitizeUntrustedFileName } from "./filename.js";
 import { applyDirectoryMode } from "./replace-file-descriptor.js";
+import { AtomicIo, runAsync } from "./atomic-io.js";
 import { realpathSync } from "./realpath.js";
 import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
 import { root } from "./root.js";
@@ -12,7 +13,7 @@ import { resolveSecureTempRoot } from "./secure-temp-dir.js";
 import { resolveCallbackTempPath, writeCallbackSibling } from "./sibling-staged-file.js";
 import { tempFile } from "./temp-target.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
-import { assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
+import { assertNoWindowsPathAlias, isForeignWindowsShareOrDevicePath, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 function buildTempName(tempPrefix) {
     const safePrefix = assertSafePathPrefix(tempPrefix ?? ".fs-safe-stream", {
         label: "sibling temp prefix",
@@ -35,12 +36,11 @@ export async function writeSiblingTempFile(options) {
     const syncParentDir = options.syncParentDir === true;
     await fs.mkdir(recursiveMkdirPath(dir), { recursive: true, mode: dirMode });
     if (chmodDir) {
-        await applyDirectoryMode({
-            fsModule: fs,
+        await runAsync(applyDirectoryMode(AtomicIo.async(fs), {
             dirPath: dir,
             mode: dirMode,
             ignoreChmodError: true,
-        });
+        }));
     }
     return await writeCallbackSibling({
         tempDir: dir,
@@ -83,6 +83,9 @@ export async function writeViaSiblingTempPath(params) {
     assertNoWindowsPathAlias(rootDir, "filesystem", "sibling temp root uses a Windows filesystem namespace alias");
     const requestedTargetPath = path.resolve(targetPathInput);
     assertNoWindowsPathAlias(requestedTargetPath, "filesystem", "sibling temp target uses a Windows filesystem namespace alias");
+    if (isForeignWindowsShareOrDevicePath(requestedTargetPath, [resolvePathPreservingWindowsRoot(rootDirInput), rootDir])) {
+        throw new Error("Target path is outside the allowed root");
+    }
     let targetPath;
     try {
         const realDir = realpathSync.native(path.dirname(requestedTargetPath));

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-acquire.js

@@ -5,6 +5,7 @@ import { fileObservation } from "./file-observation.js";
 import { readFileHandleBounded } from "./bounded-read.js";
 import { openSidecarRoot } from "./sidecar-lock-root.js";
 import { createNativeExclusiveFile } from "./native-operations.js";
+import { assertExclusiveCreateLeaf } from "./exclusive-create.js";
 import { sidecarLockRetryDelay, sidecarLockTimeout, isTransientLockFileDenial, maxTransientLockDenials, validateSidecarLockStaleMs, validateSidecarLockRetryOptions, validateSidecarLockCompromiseCheckIntervalMs, validateSidecarLockTimeoutMs, } from "./sidecar-lock-policy.js";
 import { relativeSidecarLockPath, removeSidecarLockIfUnchanged, serializeSidecarLockPayload, sidecarReclaimGuardExists, } from "./sidecar-lock-reclaim.js";
 import { awaitSidecarAdmissionBoundary, conditionalSidecarLockParser, observeHeldSidecarParser, observeSidecarLockParser, runSidecarAdmissionBoundary, } from "./sidecar-lock-admission-parser.js";
@@ -278,15 +279,21 @@ export async function acquireSidecarLock(options, context) {
                     handle = opened.handle;
                 }
                 else {
-                    try {
-                        handle =
-                            (await createNativeExclusiveFile(lockPath, 0o600)) ??
-                                (await fs.open(lockPath, "wx", 0o600));
-                    }
-                    catch (createError) {
+                    const failedOpen = (createError) => {
                         lockFileCreateDenied = isTransientLockFileDenial(createError, lockPath);
                         exclusiveCreateConflict = createError.code === "EEXIST";
                         throw createError;
+                    };
+                    handle = await createNativeExclusiveFile(lockPath, 0o600).catch(failedOpen) ?? null;
+                    if (!handle) {
+                        try {
+                            assertExclusiveCreateLeaf(lockPath);
+                        }
+                        catch (error) {
+                            exclusiveCreateConflict = error.code === "EEXIST";
+                            throw error;
+                        }
+                        handle = await fs.open(lockPath, "wx", 0o600).catch(failedOpen);
                     }
                     await handle.writeFile(raw, "utf8");
                 }

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.d.ts

@@ -23,9 +23,6 @@ export declare function serializeSidecarLockPayload(payload: Record<string, unkn
 };
 export declare function relativeSidecarLockPath(lockRoot: Root, lockPath: string): string;
 export declare function parseSidecarLockPayload(raw: string, parser?: (raw: string) => unknown): unknown;
-export declare function readSidecarLockSnapshot(lockPath: string, options?: Parameters<typeof readSidecarLockRawSnapshot>[1] & {
-    parsePayload?: (raw: string) => unknown;
-}): Promise<SidecarLockSnapshot | null>;
 export declare function readSidecarLockRawSnapshot(lockPath: string, options?: {
     lockRoot?: Root;
     rejectNonFile?: boolean;

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.js

@@ -63,14 +63,6 @@ export function parseSidecarLockPayload(raw, parser) {
         return null;
     }
 }
-function missingSnapshotPath(error) {
-    if (error.code === "ENOENT")
-        return null;
-    throw error;
-}
-export async function readSidecarLockSnapshot(lockPath, options = {}) {
-    return parseSidecarLockSnapshot(await readSidecarLockRawSnapshot(lockPath, options), options.parsePayload);
-}
 async function readSidecarLockComparisonSnapshot(lockPath, options) {
     const snapshot = await readSidecarLockRawSnapshot(lockPath, options);
     const parsePayload = options?.parsePayload;
@@ -97,13 +89,7 @@ export async function readSidecarLockRawSnapshot(lockPath, options = {}) {
                 await opened.handle.close().catch(() => undefined);
             }
         }
-        let before;
-        try {
-            before = fsSync.lstatSync(lockPath, { bigint: true });
-        }
-        catch (error) {
-            before = missingSnapshotPath(error);
-        }
+        const before = lstatSidecarLockSync(lockPath);
         if (!before)
             return null;
         if (!before.isFile() || before.isSymbolicLink()) {
@@ -142,13 +128,7 @@ export async function readSidecarLockRawSnapshot(lockPath, options = {}) {
         if (!options.allowDescriptorIdentityDrift && !sameFileIdentity(before, opened))
             return null;
         const raw = (await readFileHandleBounded(handle, MAX_LOCK_PAYLOAD_BYTES)).toString("utf8");
-        let after;
-        try {
-            after = fsSync.lstatSync(lockPath, { bigint: true });
-        }
-        catch (error) {
-            after = missingSnapshotPath(error);
-        }
+        const after = lstatSidecarLockSync(lockPath);
         if (!after || !after.isFile() || !sameFileIdentity(before, after))
             return null;
         return { raw, stat: after };
@@ -162,7 +142,9 @@ function lstatSidecarLockSync(lockPath) {
         return fsSync.lstatSync(lockPath, { bigint: true });
     }
     catch (error) {
-        return missingSnapshotPath(error);
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
     }
 }
 export function readSidecarLockSnapshotSync(lockPath, parsePayload, options = {}) {

package/node_modules/@openclaw/fs-safe/dist/staged-file-settlement.d.ts

@@ -1,8 +1,9 @@
 import type { BigIntStats } from "node:fs";
 import { FsSafeError } from "./errors.js";
+import type { StagedSymlinkFailureDetails } from "./staged-symlink-types.js";
 import type { StagedFileCleanupReceipt, StagedFileFailureDetails, StagedFilePublication, StagedFileReceipt } from "./staged-file-types.js";
 export declare function createStagedFileReceipt(directory: StagedFileReceipt["directory"], temporaryBasename: string, stat: BigIntStats): StagedFileReceipt;
-export declare function stagedFileFailure(error: unknown, details: StagedFileFailureDetails): FsSafeError;
+export declare function stagedFailure(kind: "file" | "symlink", error: unknown, details: StagedFileFailureDetails | StagedSymlinkFailureDetails): FsSafeError;
 /** Finish owned cleanup and every close before surfacing publication evidence. */
 export declare function settleStagedFile(params: {
     temporaryBasename: string;

package/node_modules/@openclaw/fs-safe/dist/staged-file-settlement.js

@@ -10,11 +10,16 @@ export function createStagedFileReceipt(directory, temporaryBasename, stat) {
         }),
     });
 }
-export function stagedFileFailure(error, details) {
-    const code = error instanceof FsSafeError
-        ? error.code
-        : error?.code === "EEXIST" ? "already-exists" : "helper-failed";
-    return new FsSafeError(code, `staged file ${details.phase} failed`, { cause: error, details });
+export function stagedFailure(kind, error, details) {
+    let code = "helper-failed";
+    try {
+        code = error instanceof FsSafeError ? error.code
+            : error?.code === "EEXIST" ? "already-exists" : "helper-failed";
+    }
+    catch {
+        // Uninspectable error metadata must not interrupt terminal settlement.
+    }
+    return new FsSafeError(code, `staged ${kind} ${details.phase} failed`, { cause: error, details });
 }
 /** Finish owned cleanup and every close before surfacing publication evidence. */
 export async function settleStagedFile(params) {
@@ -49,7 +54,7 @@ export async function settleStagedFile(params) {
         status,
         resources,
     });
-    throw stagedFileFailure(error, {
+    throw stagedFailure("file", error, {
         phase: params.failure ? params.phase : "cleanup",
         publication: params.publication,
         cleanup,

package/node_modules/@openclaw/fs-safe/dist/temp-cleanup.js

@@ -53,14 +53,7 @@ export function registerTempPathForExit(tempPath, options) {
         singleLinkFile: options?.singleLinkFile,
         cleanupSync: options?.cleanupSync,
     };
-    if (!entry.identity && !entry.cleanupSync) {
-        try {
-            entry.identity = fsSync.lstatSync(tempPath, { bigint: true });
-        }
-        catch {
-            // Callers that register before creation set the identity after opening.
-        }
-    }
+    // Only the caller's receipt or cleanup callback grants removal authority.
     tempCleanupEntries.set(tempPath, entry);
     const unregister = (() => {
         if (tempCleanupEntries.get(tempPath) === entry)

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-child-admission.d.ts

@@ -20,4 +20,4 @@ export declare function validateInitialTempWorkspaceChild(stat: BigIntStats, own
 export declare function childHasRequestedMode(stat: BigIntStats | Stats, mode: number): boolean;
 export declare function admitTempWorkspaceChild(dir: string, expected: BigIntStats, parent: TempWorkspaceRootAdmission, mode: number): Promise<void> | undefined;
 export declare function admitTempWorkspaceChildSync(dir: string, expected: BigIntStats, parent: TempWorkspaceRootAdmission, mode: number): void;
-export declare function validateAdmittedTempWorkspaceChild(current: TempWorkspaceIdentityStat, ownerUid: number | undefined, mode: number): TempWorkspaceIdentityStat;
+export declare function validateAdmittedTempWorkspaceChild(current: TempWorkspaceIdentityStat, ownerUid: number | undefined, mode: number): void;

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-child-admission.js

@@ -105,10 +105,7 @@ async function initializeTempWorkspaceChildMode(dir, expected, parent, mode) {
     try {
         await owner.apply(mode, { check: parent.assertCurrent });
         const current = inspectDirectoryIdentitySync(dir, expected);
-        assertTempWorkspaceChildState(current, parent.ownerUid);
-        if (!childHasRequestedMode(current, mode)) {
-            throw new FsSafeError("path-mismatch", "temp workspace final mode could not be verified");
-        }
+        validateAdmittedTempWorkspaceChild(current, parent.ownerUid, mode);
         parent.assertCurrent();
     }
     finally {
@@ -131,10 +128,7 @@ export function admitTempWorkspaceChildSync(dir, expected, parent, mode) {
     try {
         owner.apply(mode, parent.assertCurrent);
         const current = inspectDirectoryIdentitySync(dir, expected);
-        assertTempWorkspaceChildState(current, parent.ownerUid);
-        if (!childHasRequestedMode(current, mode)) {
-            throw new FsSafeError("path-mismatch", "temp workspace final mode could not be verified");
-        }
+        validateAdmittedTempWorkspaceChild(current, parent.ownerUid, mode);
         parent.assertCurrent();
     }
     finally {
@@ -146,5 +140,4 @@ export function validateAdmittedTempWorkspaceChild(current, ownerUid, mode) {
     if (!childHasRequestedMode(current, mode)) {
         throw new FsSafeError("path-mismatch", "temp workspace final mode could not be verified");
     }
-    return current;
 }

package/node_modules/@openclaw/fs-safe/dist/text-atomic.d.ts

@@ -3,12 +3,7 @@ export type WriteTextAtomicOptions = Pick<ReplaceFileAtomicOptions, "beforeRenam
     mode?: number;
     dirMode?: number;
     trailingNewline?: boolean;
-    /**
-     * When false, skip the temp-file and parent-directory fsync calls while
-     * preserving the temp-file replace/rename behavior.
-     *
-     * Defaults to true.
-     */
+    /** Defaults to true; false skips file and parent fsync without changing replacement. */
     durable?: boolean;
 };
 export declare function writeTextAtomic(filePath: string, content: string, options?: WriteTextAtomicOptions): Promise<void>;

package/node_modules/@openclaw/fs-safe/dist/trash.js

@@ -7,7 +7,7 @@ import { guardedRenameSync, guardedRmSync } from "./guarded-mutation.js";
 import { realpathSync } from "./realpath.js";
 import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
-import { hasWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
+import { hasWindowsPathAlias, isForeignWindowsShareOrDevicePath, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 const TRASH_DESTINATION_COLLISION_CODES = new Set(["EEXIST", "ENOTEMPTY", "ERR_FS_CP_EEXIST"]);
 const TRASH_DESTINATION_RETRY_LIMIT = 4;
 function getFsErrorCode(error) {
@@ -93,6 +93,10 @@ function assertAllowedTrashTarget(targetPath, allowedRoots) {
     assertNoTrashPathAlias(targetPath, "target path");
     const lexicalTarget = path.resolve(targetPath);
     assertNoTrashPathAlias(lexicalTarget, "target path");
+    const resolvedRoots = resolveAllowedTrashRoots(allowedRoots);
+    if (isForeignWindowsShareOrDevicePath(lexicalTarget, [...allowedRoots, ...resolvedRoots])) {
+        throw new Error(`Refusing to trash path outside allowed roots: ${targetPath}`);
+    }
     const stat = fs.lstatSync(lexicalTarget);
     const resolvedTarget = resolveTrashTargetPath(targetPath);
     const resolvedTargetPath = resolvedTarget.path;
@@ -100,7 +104,7 @@ function assertAllowedTrashTarget(targetPath, allowedRoots) {
     // Admit the directory entry only when its parent really stays inside an
     // allowed root. Do not admit it because the symlink target is inside.
     const resolvedParent = resolveTrashEntryParent(lexicalTarget, targetPath);
-    const isAllowed = resolveAllowedTrashRoots(allowedRoots).some((root) => isSameOrChildPath(resolvedParent, root));
+    const isAllowed = resolvedRoots.some((root) => isSameOrChildPath(resolvedParent, root));
     if (!isAllowed) {
         throw new Error(`Refusing to trash path outside allowed roots: ${targetPath}`);
     }