@openclaw/feishu 2026.9.8 → 2026.10.1-beta.2

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-fallback.js

@@ -1,28 +1,19 @@
 import syncFs, {} from "node:fs";
-import fs, {} from "node:fs/promises";
+import fs from "node:fs/promises";
+import { inspectAtomicIdentity, runAsync, runSync, wait } from "./atomic-io.js";
 import { readBoundedAsync, readBoundedSync } from "./bounded-read.js";
 import { FsSafeError } from "./errors.js";
-import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
-import { readOwnedCopySource, readOwnedCopySourceSync } from "./replace-file-copy-source.js";
+import { readOwnedCopySource } from "./replace-file-copy-source.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { hasErrorCode } from "./file-cleanup.js";
-import { writeAtomicDestination, writeAtomicDestinationSync } from "./replace-file-buffer.js";
+import { writeAtomicDestination } from "./replace-file-buffer.js";
 import { AtomicMutation } from "./replace-file-mutation.js";
-import { captureAtomicDestination, captureAtomicDestinationSync } from "./replace-file-destination.js";
+import { captureAtomicDestination } from "./replace-file-destination.js";
 const SUPPORTS_NOFOLLOW = process.platform !== "win32" && "O_NOFOLLOW" in syncFs.constants;
 const NOFOLLOW = SUPPORTS_NOFOLLOW ? syncFs.constants.O_NOFOLLOW : 0;
 const OPEN_READ_FLAGS = resolveReadOpenFlags();
 const OPEN_READ_WRITE_FLAGS = syncFs.constants.O_RDWR | NOFOLLOW;
 const OPEN_WRITE_EXCLUSIVE_FLAGS = syncFs.constants.O_WRONLY | syncFs.constants.O_CREAT | syncFs.constants.O_EXCL | NOFOLLOW;
-function closeSyncAfterAdmissionFailure(fsModule, fd, error) {
-    try {
-        fsModule.closeSync(fd);
-    }
-    catch {
-        // Preserve the already-selected admission failure.
-    }
-    throw error;
-}
 function admitDestinationKind(pathname, opened, dest, admission) {
     if (admission === "hardlinks") {
         if (pathname.isSymbolicLink() || !pathname.isFile()) {
@@ -37,27 +28,17 @@ function admitDestinationKind(pathname, opened, dest, admission) {
     }
     return pathname;
 }
-function assertDestinationLinks(opened, dest, admission, hardlinks) {
-    if ((admission === "hardlinks" || hardlinks === "reject") && opened.nlink > 1n) {
-        throw new FsSafeError("hardlink", `Hardlinked ${admission === "hardlinks" ? "atomic replace" : "copy fallback"} destination not allowed: ${dest}`);
-    }
-}
-function inspectPinnedDestinationSync(fsModule, fd, dest, admission, hardlinks) {
-    const opened = inspectFileIdentitySync(() => fsModule.fstatSync(fd, { bigint: true }));
-    inspectFileIdentitySync(() => admitDestinationKind(fsModule.lstatSync(dest, { bigint: true }), opened, dest, admission), opened);
-    assertDestinationLinks(opened, dest, admission, hardlinks);
-}
-async function openPinnedDestination(fsModule, dest, admission, hardlinks, mutation) {
+function* openPinnedDestination(io, dest, admission, hardlinks, mutation) {
     let preview;
     try {
-        preview = fsModule === fs ? syncFs.lstatSync(dest) : await fsModule.lstat(dest);
+        preview = yield* io.lstat(dest);
     }
     catch (error) {
         if (hasErrorCode(error, "ENOENT"))
             return null;
         throw error;
     }
-    if (!preview)
+    if (io.asynchronous && !preview)
         return null;
     if (admission === "hardlinks" && (preview.isSymbolicLink() || !preview.isFile()))
         return null;
@@ -65,20 +46,24 @@ async function openPinnedDestination(fsModule, dest, admission, hardlinks, mutat
         throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${dest}`);
     }
     mutation?.assert();
-    const handle = await fsModule.open(dest, admission === "restore" ? OPEN_READ_WRITE_FLAGS : OPEN_READ_FLAGS);
+    const file = yield* io.open(dest, admission === "restore" ? OPEN_READ_WRITE_FLAGS : OPEN_READ_FLAGS);
     try {
-        if (fsModule === fs)
-            inspectPinnedDestinationSync(syncFs, handle.fd, dest, admission, hardlinks);
-        else {
-            const opened = await inspectFileIdentity(() => handle.stat({ bigint: true }));
-            await inspectFileIdentity(async () => admitDestinationKind(await fsModule.lstat(dest, { bigint: true }), opened, dest, admission), opened);
-            assertDestinationLinks(opened, dest, admission, hardlinks);
+        const synchronous = io.asyncFs === fs;
+        const openedInspection = inspectAtomicIdentity(io, () => file.statExact(), undefined, synchronous);
+        const opened = (io.asynchronous && !synchronous ? (yield openedInspection) : openedInspection);
+        const currentInspection = inspectAtomicIdentity(io, () => io.lstatExact(dest), opened, synchronous, stat => admitDestinationKind(stat, opened, dest, admission));
+        if (io.asynchronous && !synchronous)
+            yield currentInspection;
+        if ((admission === "hardlinks" || hardlinks === "reject") && opened.nlink > 1n) {
+            throw new FsSafeError("hardlink", `Hardlinked ${admission === "hardlinks" ? "atomic replace" : "copy fallback"} destination not allowed: ${dest}`);
         }
-        return handle;
+        return file;
     }
     catch (error) {
         try {
-            await handle.close();
+            const closing = file.close();
+            if (io.asynchronous)
+                yield closing;
         }
         catch {
             // Preserve the already-selected admission failure.
@@ -86,72 +71,40 @@ async function openPinnedDestination(fsModule, dest, admission, hardlinks, mutat
         throw error;
     }
 }
-function openPinnedDestinationSync(fsModule, dest, admission, hardlinks, mutation) {
-    let preview;
-    try {
-        preview = fsModule.lstatSync(dest);
-    }
-    catch (error) {
-        if (hasErrorCode(error, "ENOENT"))
-            return null;
-        throw error;
-    }
-    if (admission === "hardlinks" && (preview.isSymbolicLink() || !preview.isFile()))
-        return null;
-    if (admission === "restore" && preview.isSymbolicLink()) {
-        throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${dest}`);
-    }
-    mutation?.assert();
-    const fd = fsModule.openSync(dest, admission === "restore" ? OPEN_READ_WRITE_FLAGS : OPEN_READ_FLAGS);
-    try {
-        inspectPinnedDestinationSync(fsModule, fd, dest, admission, hardlinks);
-        return fd;
-    }
-    catch (error) {
-        closeSyncAfterAdmissionFailure(fsModule, fd, error);
-    }
-}
-export async function assertDestinationHardlinkPolicy(fsModule, dest, policy) {
+export function* assertDestinationHardlinkPolicy(io, dest, policy) {
     if (policy !== "reject")
         return;
-    const handle = await openPinnedDestination(fsModule, dest, "hardlinks");
-    if (!handle)
+    const file = yield* openPinnedDestination(io, dest, "hardlinks");
+    if (!file)
         return;
     try {
-        await handle.close();
+        const closing = file.close();
+        if (io.asynchronous)
+            yield closing;
     }
-    catch {
-        // The asynchronous admission pin has best-effort close semantics.
+    catch (error) {
+        // Only asynchronous admission pins have best-effort successful close.
+        if (!io.asynchronous)
+            throw error;
     }
 }
-export function assertDestinationHardlinkPolicySync(fsModule, dest, policy) {
-    if (policy !== "reject")
-        return;
-    const fd = openPinnedDestinationSync(fsModule, dest, "hardlinks");
-    if (fd !== null)
-        fsModule.closeSync(fd);
-}
-function restoreReadOptions(stat, maxBytes) {
-    return {
-        initialSize: Number.isSafeInteger(stat.size) && stat.size >= 0 ? stat.size : undefined,
-        createLimitError: () => new FsSafeError("too-large", `Atomic replace restore snapshot exceeds maxRestoreBytes (${maxBytes})`),
-    };
-}
-async function readRestoreSnapshot(handle, maxBytes, stat) {
-    let position = 0;
-    return await readBoundedAsync(maxBytes, async (buffer, length) => {
-        const { bytesRead } = await handle.read(buffer, 0, length, position);
-        position += bytesRead;
-        return bytesRead;
-    }, restoreReadOptions(stat, maxBytes));
-}
-function readRestoreSnapshotSync(fsModule, fd, maxBytes, stat) {
+function* readRestoreSnapshot(io, file, maxBytes, stat) {
     let position = 0;
-    return readBoundedSync(maxBytes, (buffer, length) => {
-        const bytesRead = fsModule.readSync(fd, buffer, 0, length, position);
+    function* read(buffer, length) {
+        const result = file.read(buffer, 0, length, position);
+        const bytesRead = io.asynchronous
+            ? (yield result).bytesRead
+            : result;
         position += bytesRead;
         return bytesRead;
-    }, restoreReadOptions(stat, maxBytes));
+    }
+    const options = {
+        initialSize: Number.isSafeInteger(stat.size) && stat.size >= 0 ? stat.size : undefined,
+        createLimitError: () => new FsSafeError("too-large", `Atomic replace restore snapshot exceeds maxRestoreBytes (${maxBytes})`),
+    };
+    return io.asynchronous
+        ? yield* wait(readBoundedAsync(maxBytes, (buffer, length) => runAsync(read(buffer, length)), options))
+        : readBoundedSync(maxBytes, (buffer, length) => runSync(read(buffer, length)), options);
 }
 function restoreFailure(writeError, cleanup, restoreError) {
     const primary = writeError instanceof Error ? writeError : new Error(String(writeError));
@@ -163,25 +116,29 @@ function restoreFailure(writeError, cleanup, restoreError) {
         ? `Atomic copy fallback failed; original destination restored: ${primary.message}`
         : `Atomic copy fallback failed and original restoration failed: ${primary.message}`, { cause, details });
 }
-async function replacePinnedWithRestore(fsModule, handle, replacement, maxRestoreBytes, replacementMode, destination, mutation) {
-    const originalStat = fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
+function* replacePinnedWithRestore(io, file, replacement, maxRestoreBytes, replacementMode, destination, mutation) {
+    const originalStat = yield* file.stat();
     const originalMode = originalStat.mode;
-    const original = await readRestoreSnapshot(handle, maxRestoreBytes, originalStat);
+    const original = yield* readRestoreSnapshot(io, file, maxRestoreBytes, originalStat);
     try {
-        await writeAtomicDestination(handle, replacement, destination?.beforeWrite, destination?.assertBeforeMutation, destination?.writing);
+        yield* writeAtomicDestination(file, replacement, destination);
         if (destination)
-            await destination.verify();
-        await handle.chmod(replacementMode);
-        await handle.sync();
+            yield* destination.verify();
+        const chmod = file.chmod(replacementMode);
+        if (io.asynchronous)
+            yield chmod;
+        yield* file.sync();
     }
     catch (writeError) {
         mutation.rethrowRefusal();
         try {
-            await writeAtomicDestination(handle, original, destination?.beforeRestore, destination?.assertBeforeMutation, destination?.writing);
+            yield* writeAtomicDestination(file, original, destination, true);
             if (destination)
-                await destination.verifyRestore();
-            await handle.chmod(originalMode);
-            await handle.sync();
+                yield* destination.verify(true);
+            const chmod = file.chmod(originalMode);
+            if (io.asynchronous)
+                yield chmod;
+            yield* file.sync();
             throw restoreFailure(writeError, "restored");
         }
         catch (restoreError) {
@@ -193,61 +150,31 @@ async function replacePinnedWithRestore(fsModule, handle, replacement, maxRestor
         }
     }
 }
-function replacePinnedWithRestoreSync(fsModule, fd, replacement, maxRestoreBytes, replacementMode, fchmodSync, destination, mutation) {
-    const originalStat = fsModule.fstatSync(fd);
-    const originalMode = originalStat.mode;
-    const original = readRestoreSnapshotSync(fsModule, fd, maxRestoreBytes, originalStat);
-    try {
-        writeAtomicDestinationSync(fsModule, fd, replacement, destination?.beforeWrite, destination?.writing);
-        destination?.verify();
-        fchmodSync?.(fd, replacementMode);
-        fsModule.fsyncSync(fd);
-    }
-    catch (writeError) {
-        mutation?.rethrowRefusal();
-        try {
-            writeAtomicDestinationSync(fsModule, fd, original, destination?.beforeRestore, destination?.writing);
-            destination?.verifyRestore();
-            fchmodSync?.(fd, originalMode);
-            fsModule.fsyncSync(fd);
-            throw restoreFailure(writeError, "restored");
-        }
-        catch (restoreError) {
-            mutation?.rethrowRefusal();
-            if (restoreError instanceof FsSafeError && restoreError.details?.cleanup === "restored") {
-                throw restoreError;
-            }
-            throw restoreFailure(writeError, "restore-failed", restoreError);
-        }
-    }
-}
-export async function copyFallbackReplace(params) {
+export function* copyFallbackReplace(io, params) {
     const mutation = params.mutation ?? new AtomicMutation({});
-    const source = await readOwnedCopySource({
-        fsModule: params.fsModule,
+    const source = yield* readOwnedCopySource(io, {
         src: params.src,
         expectedIdentity: params.expectedSourceIdentity,
     });
     const { replacement } = source;
-    let destHandle = null;
+    let file = null;
     let closeRequiredForSuccess = false;
     let completed = false;
     let destination;
     try {
         if (params.restore === "restore-original") {
-            const pinned = await openPinnedDestination(params.fsModule, params.dest, "restore", params.destinationHardlinks, mutation);
-            if (pinned) {
-                destHandle = pinned;
-                if (mutation.active)
-                    destination = await captureAtomicDestination(params.fsModule, pinned, params.dest, mutation, params.destinationHardlinks === "reject");
-                await replacePinnedWithRestore(params.fsModule, destHandle, replacement, params.maxRestoreBytes, source.mode, destination, mutation);
+            file = yield* openPinnedDestination(io, params.dest, "restore", params.destinationHardlinks, mutation);
+            if (file) {
+                if (mutation.active) {
+                    destination = yield* captureAtomicDestination(io, file, params.dest, mutation, params.destinationHardlinks === "reject");
+                }
+                yield* replacePinnedWithRestore(io, file, replacement, params.maxRestoreBytes, source.mode, destination, mutation);
             }
         }
-        if (!destHandle) {
+        if (!file) {
             let destStat = null;
             try {
-                destStat = params.fsModule === fs
-                    ? syncFs.lstatSync(params.dest) : await params.fsModule.lstat(params.dest);
+                destStat = yield* io.lstat(params.dest);
             }
             catch (error) {
                 if (!hasErrorCode(error, "ENOENT"))
@@ -257,112 +184,47 @@ export async function copyFallbackReplace(params) {
                 throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${params.dest}`);
             }
             if (destStat) {
-                await assertDestinationHardlinkPolicy(params.fsModule, params.dest, params.destinationHardlinks);
+                yield* assertDestinationHardlinkPolicy(io, params.dest, params.destinationHardlinks);
                 mutation.assert();
-                await params.fsModule.rm(params.dest, { force: true });
+                yield* io.remove(params.dest);
                 mutation.removed(params.dest);
             }
             mutation.assert();
-            destHandle = await params.fsModule.open(params.dest, OPEN_WRITE_EXCLUSIVE_FLAGS, source.mode & 0o777);
+            file = yield* io.open(params.dest, OPEN_WRITE_EXCLUSIVE_FLAGS, source.mode & 0o777);
             if (mutation.active) {
-                destination = await captureAtomicDestination(params.fsModule, destHandle, params.dest, mutation, params.destinationHardlinks === "reject");
+                destination = yield* captureAtomicDestination(io, file, params.dest, mutation, params.destinationHardlinks === "reject");
                 destination.writing();
-                await writeAtomicDestination(destHandle, replacement, destination.beforeWrite, destination.assertBeforeMutation);
-                await destination.verify();
             }
-            else {
-                await destHandle.writeFile(replacement);
+            if (destination || !io.asynchronous) {
+                yield* writeAtomicDestination(file, replacement, destination);
+                if (destination)
+                    yield* destination.verify();
             }
-            await destHandle.chmod(source.mode);
-            if (params.sync) {
-                await destHandle.sync();
+            else {
+                yield file.writeFile(replacement);
             }
+            const chmod = file.chmod(source.mode);
+            if (io.asynchronous)
+                yield chmod;
+            if (params.sync)
+                yield* file.sync();
             closeRequiredForSuccess = !params.sync;
         }
         if (destination)
-            await destination.verify();
-        destination?.published();
-        completed = true;
-    }
-    finally {
-        if (destHandle) {
-            try {
-                await destHandle.close();
-            }
-            catch (closeError) {
-                if (closeRequiredForSuccess && completed) {
-                    throw closeError;
-                }
-            }
-        }
-    }
-}
-export function copyFallbackReplaceSync(params) {
-    const mutation = params.mutation ?? new AtomicMutation({});
-    const source = readOwnedCopySourceSync({
-        fsModule: params.fsModule,
-        src: params.src,
-        expectedIdentity: params.expectedSourceIdentity,
-    });
-    const { replacement } = source;
-    let destFd;
-    let closeRequiredForSuccess = false;
-    let completed = false;
-    let destination;
-    try {
-        if (params.restore === "restore-original") {
-            const pinned = openPinnedDestinationSync(params.fsModule, params.dest, "restore", params.destinationHardlinks, mutation);
-            if (pinned !== null) {
-                destFd = pinned;
-                if (mutation.active)
-                    destination = captureAtomicDestinationSync(params.fsModule, pinned, params.dest, mutation, params.destinationHardlinks === "reject");
-                replacePinnedWithRestoreSync(params.fsModule, destFd, replacement, params.maxRestoreBytes, source.mode, params.fchmodSync, destination, mutation);
-            }
-        }
-        if (destFd === undefined) {
-            let destStat = null;
-            try {
-                destStat = params.fsModule.lstatSync(params.dest);
-            }
-            catch (error) {
-                if (!hasErrorCode(error, "ENOENT"))
-                    throw error;
-            }
-            if (destStat?.isSymbolicLink()) {
-                throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${params.dest}`);
-            }
-            if (destStat) {
-                assertDestinationHardlinkPolicySync(params.fsModule, params.dest, params.destinationHardlinks);
-                mutation.assert();
-                params.fsModule.rmSync(params.dest, { force: true });
-                mutation.removed(params.dest);
-            }
-            mutation.assert();
-            destFd = params.fsModule.openSync(params.dest, OPEN_WRITE_EXCLUSIVE_FLAGS, source.mode & 0o777);
-            if (mutation.active)
-                destination = captureAtomicDestinationSync(params.fsModule, destFd, params.dest, mutation, params.destinationHardlinks === "reject");
-            destination?.writing();
-            writeAtomicDestinationSync(params.fsModule, destFd, replacement, destination?.beforeWrite);
-            destination?.verify();
-            params.fchmodSync?.(destFd, source.mode);
-            if (params.sync) {
-                params.fsModule.fsyncSync(destFd);
-            }
-            closeRequiredForSuccess = !params.sync;
-        }
-        destination?.verify();
+            yield* destination.verify();
         destination?.published();
         completed = true;
     }
     finally {
-        if (destFd !== undefined) {
+        if (file) {
             try {
-                params.fsModule.closeSync(destFd);
+                const closing = file.close();
+                if (io.asynchronous)
+                    yield closing;
             }
             catch (closeError) {
-                if (closeRequiredForSuccess && completed) {
+                if (closeRequiredForSuccess && completed)
                     throw closeError;
-                }
             }
         }
     }

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-source.d.ts

@@ -1,20 +1,9 @@
-import syncFs, { type BigIntStats } from "node:fs";
-type AsyncSourceFileSystem = Pick<typeof import("node:fs/promises"), "lstat" | "open">;
-type SyncSourceFileSystem = Pick<typeof syncFs, "closeSync" | "fstatSync" | "lstatSync" | "openSync" | "readSync">;
-export declare function readOwnedCopySource(params: {
-    fsModule: AsyncSourceFileSystem;
+import type { BigIntStats } from "node:fs";
+import { type AtomicIo, type Procedure } from "./atomic-io.js";
+export declare function readOwnedCopySource(io: AtomicIo, params: {
     src: string;
     expectedIdentity?: BigIntStats;
-}): Promise<{
+}): Procedure<{
     replacement: Buffer;
     mode: number;
 }>;
-export declare function readOwnedCopySourceSync(params: {
-    fsModule: SyncSourceFileSystem;
-    src: string;
-    expectedIdentity?: BigIntStats;
-}): {
-    replacement: Buffer;
-    mode: number;
-};
-export {};

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-source.js

@@ -1,9 +1,6 @@
-import syncFs, {} from "node:fs";
-import fs, {} from "node:fs/promises";
-import { readBoundedSync } from "./bounded-read.js";
+import { inspectAtomicIdentity } from "./atomic-io.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { FsSafeError } from "./errors.js";
-import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
 import { hasErrorCode } from "./file-cleanup.js";
 const OPEN_READ_FLAGS = resolveReadOpenFlags();
 function assertSourcePreview(source, src) {
@@ -25,77 +22,39 @@ function assertOpenedSource(opened, current, src) {
         throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${src}`);
     }
 }
-function sourceSymlinkError(src, cause) {
-    return new FsSafeError("symlink", `Refusing copy fallback from non-file source: ${src}`, {
-        cause,
-    });
-}
-async function openSource(fsModule, src) {
-    try {
-        return await fsModule.open(src, OPEN_READ_FLAGS);
-    }
-    catch (error) {
-        if (hasErrorCode(error, "ELOOP")) {
-            throw sourceSymlinkError(src, error);
-        }
-        throw error;
-    }
-}
-function openSourceSync(fsModule, src) {
-    try {
-        return fsModule.openSync(src, OPEN_READ_FLAGS);
-    }
-    catch (error) {
-        if (hasErrorCode(error, "ELOOP")) {
-            throw sourceSymlinkError(src, error);
-        }
-        throw error;
-    }
-}
-function readAllSync(fsModule, fd, size) {
-    let position = 0;
-    return readBoundedSync(Infinity, (buffer, length) => {
-        const bytesRead = fsModule.readSync(fd, buffer, 0, length, position);
-        position += bytesRead;
-        return bytesRead;
-    }, { initialSize: Number.isSafeInteger(size) && size >= 0 ? size : undefined });
-}
-export async function readOwnedCopySource(params) {
-    assertSourcePreview(params.fsModule === fs
-        ? syncFs.lstatSync(params.src) : await params.fsModule.lstat(params.src), params.src);
-    const handle = await openSource(params.fsModule, params.src);
+export function* readOwnedCopySource(io, params) {
+    assertSourcePreview(yield* io.lstat(params.src), params.src);
+    const handle = yield* openSource(io, params.src);
     try {
-        const opened = await inspectFileIdentity(() => params.fsModule === fs
-            ? syncFs.fstatSync(handle.fd, { bigint: true }) : handle.stat({ bigint: true }), params.expectedIdentity);
-        const current = await inspectFileIdentity(() => params.fsModule === fs
-            ? syncFs.lstatSync(params.src, { bigint: true }) : params.fsModule.lstat(params.src, { bigint: true }), opened);
+        const openedInspection = inspectAtomicIdentity(io, () => handle.statExact(), params.expectedIdentity);
+        const opened = (io.asynchronous ? (yield openedInspection) : openedInspection);
+        const currentInspection = inspectAtomicIdentity(io, () => io.lstatExact(params.src), opened);
+        const current = (io.asynchronous ? (yield currentInspection) : currentInspection);
         assertOpenedSource(opened, current, params.src);
-        return { replacement: await handle.readFile(), mode: Number(opened.mode) };
+        const replacement = yield* handle.readFile(io.asynchronous ? undefined : Number(opened.size));
+        return { replacement, mode: Number(opened.mode) };
     }
     finally {
         try {
-            await handle.close();
+            const closing = handle.close();
+            if (io.asynchronous)
+                yield closing;
         }
         catch {
-            // Best-effort close includes synchronous adapter throws.
+            // Source close never replaces the selected read or admission result.
         }
     }
 }
-export function readOwnedCopySourceSync(params) {
-    assertSourcePreview(params.fsModule.lstatSync(params.src), params.src);
-    const fd = openSourceSync(params.fsModule, params.src);
+function* openSource(io, src) {
     try {
-        const opened = inspectFileIdentitySync(() => params.fsModule.fstatSync(fd, { bigint: true }), params.expectedIdentity);
-        const current = inspectFileIdentitySync(() => params.fsModule.lstatSync(params.src, { bigint: true }), opened);
-        assertOpenedSource(opened, current, params.src);
-        return { replacement: readAllSync(params.fsModule, fd, Number(opened.size)), mode: Number(opened.mode) };
+        return yield* io.open(src, OPEN_READ_FLAGS);
     }
-    finally {
-        try {
-            params.fsModule.closeSync(fd);
-        }
-        catch {
-            // Best-effort close after reading a copy-fallback source.
+    catch (error) {
+        if (hasErrorCode(error, "ELOOP")) {
+            throw new FsSafeError("symlink", `Refusing copy fallback from non-file source: ${src}`, {
+                cause: error,
+            });
         }
+        throw error;
     }
 }

package/node_modules/@openclaw/fs-safe/dist/replace-file-descriptor.d.ts

@@ -1,46 +1,21 @@
-import syncFs, { type BigIntStats } from "node:fs";
-import fs, { type FileHandle } from "node:fs/promises";
-import { type DirectoryModeOwner } from "./directory-mode-node.js";
+import { type BigIntStats } from "node:fs";
 import type { AtomicMutation } from "./replace-file-mutation.js";
-type AsyncTempFileSystem = Pick<typeof fs, "lstat" | "open" | "writeFile">;
-type SyncTempFileSystem = Pick<typeof syncFs, "closeSync" | "fstatSync" | "fsyncSync" | "lstatSync" | "openSync" | "writeFileSync">;
-export type SyncFchmod = (fd: number, mode: number) => void;
-export declare function syncDirectoryBestEffort(fsModule: Pick<typeof fs, "open">, dirPath: string): Promise<void>;
-export declare function syncDirectoryBestEffortSync(fsModule: Pick<typeof syncFs, "openSync" | "fsyncSync" | "closeSync">, dirPath: string): void;
-export declare function pinDirectoryForMode(params: {
-    fsModule: AsyncTempFileSystem;
-    dirPath: string;
-    /** Compatibility for best-effort directory modes; admission and close still fail closed. */
-    ignoreChmodError?: boolean;
-    mutation?: AtomicMutation;
-}): Promise<DirectoryModeOwner | undefined>;
-export declare function applyDirectoryMode(params: Parameters<typeof pinDirectoryForMode>[0] & {
-    mode: number;
-}): Promise<void>;
-export declare function applyDirectoryModeSync(params: {
-    fsModule: SyncTempFileSystem;
+import { type AtomicFile, type AtomicIo, type Procedure } from "./atomic-io.js";
+export declare function syncDirectoryBestEffort(io: AtomicIo, dirPath: string): Procedure<void>;
+export declare function applyDirectoryMode(io: AtomicIo, params: {
     dirPath: string;
     mode: number;
-    fchmodSync?: SyncFchmod;
+    ignoreChmodError?: boolean;
     mutation?: AtomicMutation;
-}): void;
-export declare function writeTempFile(params: {
-    fsModule: AsyncTempFileSystem;
+}): Procedure<void>;
+export declare function writeTempFile(io: AtomicIo, params: {
     tempPath: string;
     content: string | Uint8Array;
     mode: number;
     sync: boolean;
     onIdentity?: (identity: BigIntStats) => void;
     mutation?: AtomicMutation;
-}): Promise<{
-    handle: FileHandle;
+}): Procedure<{
+    file: AtomicFile;
     identity: BigIntStats;
 }>;
-export declare function writeTempFileSync(params: Omit<Parameters<typeof writeTempFile>[0], "fsModule"> & {
-    fsModule: SyncTempFileSystem;
-    fchmodSync?: SyncFchmod;
-}): {
-    fd: number;
-    identity: BigIntStats;
-};
-export {};