@openclaw/feishu 2026.9.8 → 2026.10.1-beta.2

package/node_modules/@openclaw/fs-safe/docs/watch.md

@@ -64,28 +64,50 @@ This does not promise delivery for a differently spelled alias that appears and
 disappears entirely between scans: without an observed identity, it cannot be
 admitted as the selected path. Observation is not a complete transient history.
 Raw event names remain private: detail comes from guarded scans, prior guarded
-snapshots, or explicitly configured targets. Unclassifiable hints inside selected,
-non-excluded territory lose detail. Hints for excluded or unselected paths are
+snapshots, or explicitly configured targets. A non-target name absent from both
+snapshots is ignored only when its parent directory has the same device/inode in
+both guarded passes. Otherwise the unclassifiable selected hint loses detail.
+Hints for excluded or unselected paths are
 ignored. Exclusion callbacks are synchronous; excluded directories are recorded
 without descent. Bounded exclusion records recognize late deletion hints.
-Genuine backend event loss and detail-budget exhaustion still invalidate every
-scope, including when an excluded subtree caused the underlying event pressure.
+Pending hint pressure folds filenames into directory-level subtree hints, coarsening
+toward the Root as needed. Unrelated folds are ignored after guarded alias admission;
+relevant or uncertain folds trigger a full guarded pass and publish its snapshot
+diff. The hint directory itself is never published without observation. Genuine
+backend event loss and snapshot-diff budget exhaustion still invalidate every
+scope, including when an excluded subtree caused genuine kernel loss.
+
+On Linux and macOS, an undecodable child name triggers a structural hint for its
+containing directory. If that directory's children are selected by a tree scope
+with remaining depth, a guarded scan fails closed with `invalid-path` while the
+name remains present. An undecodable sibling beside an ancestor or missing-scope
+anchor is ignored: it cannot match a validated literal scope component. Raw or
+lossily decoded names are never published or used for child I/O. Windows already
+fails closed by reconciling after an undecodable UTF-16 notification.
+
+Linux nameless self-events (including directory chmod, rename and deletion) retain
+structural detail for the watched directory. Self-events for the Root itself,
+kernel queue overflow and malformed transport buffers still lose detail.
 
 ## Transport and mode
 
 | Platform/runtime | `auto` | Event transport / limitation |
 | --- | --- | --- |
 | Node.js on Linux with addon | `events` | One shared Rust thread and inotify instance; a nonrecursive watch per distinct directory inode. |
-| Node.js on macOS with addon | `events` | One FSEvents stream per subscription on a shared serial dispatch queue. Pathname activity after a swap remains advisory. |
+| Node.js on macOS with addon | `events` | Entry scopes use descriptor-bound kqueue watches; tree scopes share one FSEvents stream per subscription. Pathname activity after a swap remains advisory. |
 | Node.js on Windows with addon | `events` | One recursive ReadDirectoryChangesW Root handle per subscription on the shared IOCP hub; the open handle prevents ordinary renames of the Root's ancestors. |
 | Bun / other unsupported runtimes | `poll` | TSFN lifetime and shutdown have not been qualified; `events` rejects. |
 | Missing/disabled addon | `poll` | `events` rejects with `FsSafeError("helper-unavailable")`. |
 
 The shared hub sleeps until a filesystem event, command, or callback acknowledgement:
-Linux blocks on inotify plus eventfd, Windows on IOCP, and macOS on its command
-channel (FSEvents wakes it from the serial dispatch queue). There is no native
+Linux blocks on inotify plus eventfd, Windows on IOCP, and macOS on kqueue with a
+command wake (FSEvents wakes it from the serial dispatch queue). There is no native
 polling timer; the independent JS reconciliation interval remains authoritative.
 
+Linux discards queued events for watches retired by fs-safe, including their
+`IN_IGNORED` echoes, without invalidating unrelated subscriptions. A genuinely
+unknown descriptor or kernel queue overflow still invalidates every subscription.
+
 `mode` is required. `poll` never starts or loads the watch hub; guarded scans
 may still use the existing addon. Existing `FS_SAFE_NATIVE_MODE=off` and
 `require` policies apply: `require` plus an unavailable event backend rejects
@@ -104,15 +126,29 @@ Nonblocking TSFN batches cannot block the hub on JavaScript, and per-owner
 pending detail and queued batches are bounded. The last removal stops and joins
 the native thread. No Worker threads, eval programs, or JS `fs.watch` are used.
 
-macOS uses FileEvents, NoDefer and WatchRoot with a 30 ms FSEvents latency.
-After guarded admission, streams use selected tree anchors and entry parents,
+macOS entry scopes use nonrecursive `EVFILT_VNODE` watches on the admitted parent
+and, when present, the entry itself. Parent activity requests a guarded scan
+without supplying filenames. The entry descriptor covers content and attribute
+changes and is replaced when a guarded scan admits a new identity. Missing paths
+use their nearest admitted ancestor. Descriptors are opened without following
+symlinks; a symlink entry uses `O_SYMLINK` to observe the link itself. Every
+descriptor's device/inode must match the guarded observation. There are at most
+two retained descriptors per entry scope (128 scopes maximum), counted in health
+`directories`; descriptor exhaustion fails registration with `EMFILE`. Removal
+closes these descriptors on the hub before returning. Deep unselected traffic
+does not reach an entry-only subscription.
+
+Tree scopes of every depth retain FileEvents, NoDefer and WatchRoot with a 30 ms
+FSEvents latency. After guarded admission, streams use only selected tree anchors,
 falling back to the nearest admitted ancestor for missing paths. Nested anchors
 are deduplicated, with at most 128 paths. The eight shallowest non-overlapping
 excluded directories are also passed to `FSEventStreamSetExclusionPaths`.
 When the stream paths change, the old stream is stopped, invalidated and released
 on its dispatch queue, then its replacement starts before another guarded pass
 covers the handover. Native exclusions reduce traffic but cannot eliminate real
-FSEvents drops, including during recursive deletion.
+FSEvents drops, including during recursive deletion. A shallow tree anchored above
+a busy unselected subtree still receives recursive traffic; pending hints fold
+under pressure, while genuine FSEvents drops can still overflow.
 Absolute hints are reduced lexically against the admitted canonical Root;
 outside paths never become detail. Dropped/wrapped streams, RootChanged and
 Unmount trigger guarded reconciliation. Pathname hints can reflect activity
@@ -157,6 +193,20 @@ handles and delivery queues, and closing one does not retire another's observati
 
 Periodic guarded reconciliation runs without needing an event. It catches
 missed events and works on filesystems where native hints are incomplete.
+Hint validation, scope relevance, and spelling-alias admission share the internal
+hint module. Bounded change merging preserves structural precedence and insertion
+order; nameless children require remaining tree depth, while folded subtrees also
+cover ancestors of selected scopes.
+Detailed native batches first pass guarded scope and spelling-alias admission;
+proven unrelated activity does not schedule a scan. Relevant entry hints refresh
+the entry scopes, while tree hints refresh the affected directory and its identity
+chain, retaining unchanged sibling subtrees. Namespace changes, coarse directory
+hints, vanished or hard-linked leaves, changed topology, uncertain identities,
+backend loss, and batches without filenames still receive a full guarded pass.
+`reconcile()`, initial admission, and scope replacement always reconcile every scope.
+The periodic timer is independent of event traffic, so frequent hints cannot defer
+the full missed-event check. Repeated passes reuse bounded pathname strings, never
+cached metadata or filesystem authority.
 When polling is selected, the interval is `pollIntervalMs`, then `intervalMs`,
 then 1000 ms, in that order. This applies to explicit `mode: "poll"`, `auto`
 selecting polling, and `auto` falling back after an unsupported event backend.
@@ -166,6 +216,11 @@ uses 25 ms polling when needed and retains the 30-second events reconciliation.
 Scans are metadata comparisons: content changes preserving all compared
 metadata may be missed in polling mode. No mode promises transactional
 snapshots, complete history, or hard real-time delivery.
+On Node.js, directory name reads avoid a thread-pool round trip per entry. Scans yield to
+the event loop between bounded groups of at most 32 names so cancellation and
+other work can progress; every entry still receives the same identity checks
+and entry-budget admission before its metadata is read.
+Bun and Deno retain asynchronous name reads.
 
 `ready` resolves after the first complete guarded scan establishes the baseline,
 even while writes continue. Events mode installs each directory registration
@@ -186,9 +241,9 @@ transient descendant scan errors produce structural invalidations, preserving th
 Root identity checks. Events during a pass coalesce into one pending pass and
 retain bounded detail regardless of how long the scan takes. The 25 ms hint
 coalescing window does not impose a scan deadline. A full native callback queue
-retains its bounded pending batch for retry. Genuine backend loss, exhausted
-detail capacity, or an unclassifiable selected hint emits `overflow` without
-detail. Sustained writes cannot exhaust a pass budget or disable observation.
+retains its bounded pending batch for retry. Pending native and JavaScript hint queues degrade to coarse subtree hints when
+full. Genuine backend loss, exhausted snapshot-diff capacity, or an unclassifiable
+selected hint emits `overflow` without detail. Sustained writes cannot exhaust a pass budget or disable observation.
 
 `reconcile()` resolves after a complete pass that **started after the call**. Calls
 waiting for the same future pass coalesce; an earlier in-flight pass cannot satisfy
@@ -202,7 +257,8 @@ including during startup or reconciliation. Invalidations still arrive while
 other work keeps the process alive. Persistent and non-persistent subscriptions
 have independent lifetimes; closing the last persistent one lets Node exit.
 Native environment cleanup retires any remaining event registrations and joins
-the hub at exit. `signal` triggers close;
+the hub at exit. `signal` triggers close, including when a caller's abort
+listener stops event propagation;
 await `close()` or `[Symbol.asyncDispose]()` to join owned work.
 
 `health()` returns `starting`, `ready`, `reconciling`, `unavailable`, or `closed`,
@@ -249,3 +305,29 @@ replay one with `--replay <failure.json>`. Event mode requires a working native
 binding and never silently falls back to polling. The small
 `test/watch-model.test.ts` corpus runs in ordinary CI; native-event cases also run
 when `FS_SAFE_TEST_WATCH_EVENTS=1`. Keep fixtures on normal `os.tmpdir()` storage.
+
+The nightly watch-stress workflow includes 500 seeds per mode with the finite
+state corpus on all five runners. Add `--transitions` to exercise that corpus
+before each random sequence in a local run.
+It varies `maxPendingPaths` from 2 through 8, creates missing tree descendants
+beside concurrent sibling churn, uses filesystem-proven case and Unicode aliases,
+and covers atomic-save names, excluded subtrees, Linux undecodable siblings,
+directory chmod/rename/deletion, scope replacement, and subscription retirement.
+A separate quiet subscription must remain unaffected. The checker records genuine
+backend loss and rejects overflow without that loss or a selected diff exceeding
+the configured budget. Each checkpoint permits at most four guarded passes and
+refreshes the consumer cache only in response to invalidation.
+Volumes without Unicode-normalization aliases also receive a distinct spelling
+beside the missing target. On Linux a selected undecodable child must fail its
+owner closed with `invalid-path` while the other subscription stays healthy.
+
+```sh
+node scripts/watch-stress/model-runner.mjs --transitions --seeds 500 --mode both --output watch-transition-results.json
+```
+
+For transport diagnosis, add `--native-only`: event-mode checkpoints then wait up
+to 400 intervals of 25 ms without calling `reconcile()`. This stronger diagnostic
+depends on native event delivery; it is separate from the periodic-reconciliation
+guarantee and must not turn an unavailable transport into a passing run. Transition
+failures retain their seed and mode in the report; replay them with `--seed N
+--seeds 1 --mode events --transitions` and the same diagnostic options.

package/node_modules/@openclaw/fs-safe/docs/writing.md

@@ -64,6 +64,35 @@ Failed-write cleanup compares exact parent and file identities, including large
 Windows file indexes. Replaced paths and paths whose ownership cannot be verified
 are preserved.
 
+### Windows link modes
+
+With `mutationSymlinks` omitted, Windows buffered replacement `write()` and
+`writeJson()` calls (`overwrite` omitted or `true`) currently differ by
+implementation. The native pinned path rejects a final file
+symlink with `path-alias`. The legacy JavaScript path can follow an unchanged
+contained final link and replace its admitted target, preserving the link itself.
+It reauthorizes the original link's target before staging and publication when
+mutation policy is present, and retains its file/parent identity checks.
+The legacy path is used by native mode `off`, by `auto` without a binding,
+and by the explicit `renameIdentity: "verify-content-with-lock"` policy.
+
+An omitted mutation policy also leaves parent-junction behavior implementation
+dependent: native Windows parent admission refuses reparse traversal and can
+report `invalid-path`, while the legacy writer can use the junction's admitted
+contained target. This does not authorize an escaping target or bypass deny
+policy. Set `mutationSymlinks: "reject"` explicitly for uniform link rejection
+across these implementations, either in Root defaults or per call:
+
+```ts
+import { root } from "@openclaw/fs-safe";
+
+const files = await root("C:/workspace", { mutationSymlinks: "reject" });
+await files.write("state.json", "{}");
+```
+
+These are existing compatibility differences; omitted policy does not currently
+provide uniform Windows link handling. See [write-side link policy](security-model.md#symlinks-write-side).
+
 ## Denying mutations
 
 All mutation verbs accept `denyMutations?: DenyMutationPolicy`, either as a root default or per-call option:
@@ -86,7 +115,10 @@ await fs.remove(".ssh/id_rsa");    // throws FsSafeError code "denied-path"
 
 ### `fs.write(rel, data, options?)`
 
-Overwrite or create. Always atomic.
+Overwrite or create. Replacement is atomic; buffered `overwrite: false` can
+expose incomplete content on the JavaScript fallback. Use
+[`create()` with `atomic: true`](#atomic-buffered-creation) when create-only
+publication must wait for complete content.
 
 ```ts
 await fs.write("state/last-run.json", JSON.stringify(run));
@@ -107,6 +139,11 @@ await fs.write("notes/today.txt", "hello\n", { encoding: "utf8" });
 | `overwrite` | `boolean` | `true`; `false` is create-only. |
 | `renameIdentity` | `RenameIdentityPolicy` | `"strict"`. |
 
+`mkdir: false` requires existing parents and never creates a missing parent.
+On POSIX, otherwise permitted relative in-root parent aliases remain available
+to buffered and streamed writes and copies with native support enabled or
+disabled. An explicit mutation symlink policy still applies.
+
 `write`, `create`, `writeJson`, `createJson`, `append`, and `copyIn` accept `durable`.
 Precedence is per-call option, then `Root.defaults.durable`, then `true`;
 an explicitly `undefined` call option preserves the root default.
@@ -150,6 +187,10 @@ alone is never proof that the name still refers to the expected file.
 ### `fs.create(rel, data, options?)`
 
 Don't-clobber variant of `write()`. Throws `already-exists` if the target is there.
+An existing regular file or directory reports `already-exists` on every backend,
+including buffered, atomic and streamed creation. Rejected directories and their
+contents remain unchanged. Other non-regular types retain `not-file`; boundary,
+explicit symlink policy, deny and hardlink failures retain their precedence.
 Create-only preflight preserves boundary, alias, hardlink, and type checks without
 opening an existing target to inherit its mode; a fresh file uses the requested
 mode or the normal new-file default. When the native binding is in use
@@ -304,7 +345,12 @@ type RootWriteJsonOptions = RootWriteOptions & {
 
 ### `fs.append(rel, data, options?)`
 
-Open in append mode, write, sync the file handle, and close. Honors `mkdir` for the parent directory and syncs the parent directory when the append creates the file. `durable: false` skips both syncs. Pass `prependNewlineIfNeeded: true` to insert a `\n` if the file does not already end in one.
+Open in append mode, write, sync the file handle, and close. Honors `mkdir` for
+the parent directory and syncs that directory when creating the file.
+`durable: false` skips both syncs. Pass `prependNewlineIfNeeded: true` to separate
+existing content from appended text when neither side supplies a newline. Strings use their `encoding` for the
+newline check, including UTF-16LE; Buffers use a single LF byte. Empty strings
+and Buffers add no separator; an empty append still creates a missing file.
 
 `mode` selects the creation mode, defaulting to `0o600` when neither the call nor
 the Root supplies it. On POSIX, the process umask can further restrict that mode;
@@ -317,23 +363,87 @@ await fs.append("logs/today.log", `[${ts}] ${line}\n`);
 await fs.append("notes/scratch.md", "* new bullet", { prependNewlineIfNeeded: true });
 ```
 
-For high-volume logging, consider [`openWritable`](#openwritable) and a long-lived append handle. Direct append-mode writes preserve kernel append semantics, but they are not atomic against external rotators that rename or unlink the target.
+For high-volume logging, consider [`openWritable`](#openwritable-for-streaming) and a long-lived append handle. Direct append-mode writes preserve kernel append semantics, but they are not atomic against external rotators that rename or unlink the target.
 
 ### `fs.copyIn(rel, sourceAbsPath, options?)`
 
-Bring a file from outside the root into the root, atomically. The source path must be absolute. The library streams the source through the boundary, writes to a sibling temp, and renames over the destination.
+`copyIn` accepts a `RootCopySource`: a trusted absolute source path or a file
+within another Root. The guarded form supplies `root` with only its `open` and
+`stat` read capabilities, plus `relativePath`:
 
 ```ts
-await fs.copyIn("inbox/upload.bin", "/tmp/incoming.bin", {
-  maxBytes: 64 * 1024 * 1024,
+const source = await root("/srv/templates");
+const destination = await root("/srv/workspace");
+await destination.copyIn("config/settings.json", {
+  root: source,
+  relativePath: "config/settings.json",
+}, {
+  overwrite: false,
+  clone: "auto",
+  mode: 0o600,
+  signal: AbortSignal.timeout(30_000),
 });
 ```
 
-Options are `{ denyMutations?, durable?, maxBytes?, mkdir?, mode?, sourceHardlinks? }`.
-`durable` follows the root default and is `true` when omitted at both levels;
-set it to `false` to skip file and parent-directory syncs for reconstructible data.
-Use `sourceHardlinks: "reject"` to refuse if the source itself is a hardlinked
-alias. There is no encoding option: copying preserves source bytes.
+The source Root applies its read policies, including confinement and symlink
+handling. `sourceHardlinks` overrides its hardlink policy only when supplied;
+otherwise the source Root default is retained. The admitted source
+descriptor stays open through copying and source-identity verification; copying
+does not consume its current file position. Both forms enforce `maxBytes` while
+reading, including when a file grows after admission, and use bounded buffers.
+Copies have independent file data; changing either file cannot change the other.
+Set `preserveSourceMode: true` to select the mode from the admitted source
+descriptor. An explicit numeric `mode`, including `Root.defaults.mode`, takes
+precedence. By default, copying retains the existing destination-mode rules.
+The operation verifies source identity, not a coherent snapshot of concurrent
+in-place edits. Keep the source unchanged when snapshot consistency is required.
+
+`overwrite` defaults to `true`, preserving the existing replacement behavior.
+With `overwrite: false`, an existing destination produces `already-exists` and
+is never altered. Copying prepares a private sibling file before publishing its
+completed contents. Native mode uses no-replace rename. The guarded JavaScript
+fallback links the completed stage and removes its temporary name in the same
+JavaScript turn; the filesystem must support hardlinks. Other processes can
+briefly observe both names. The source is never hardlinked to the destination.
+
+`clone` chooses the file-data transfer strategy through `CopyCloneMode`, shared
+with [`copyTree`](copy.md#api). File copies default to `"never"`; tree copies
+default to `"auto"`:
+
+| Value | Behavior |
+| --- | --- |
+| `never` | Copy regular file bytes using reads and writes, without explicit cloning or copy offload. |
+| `auto` | Try native file cloning, then copy offload or ordinary byte copying when cloning is unavailable. |
+| `always` | Require native cloning; fail when the binding or filesystem cannot provide it. |
+
+Native file cloning supports APFS and supported Linux filesystems. Windows
+currently uses byte copying for `never` and `auto`; `always` fails. Clone choice
+does not change modes, durability, root confinement, or source and publication
+identity checks. The shared strategy does not replace Root's guarded regular-file
+contract with `copyTree`'s caller-owned immutable-tree and metadata contract.
+
+An already aborted `signal` prevents I/O. Cancellation during copying waits for
+admitted reads and native work to settle, then cleans only the owned unpublished
+stage. The final authority check runs before publication. Once publication has
+occurred, later cancellation or verification failure preserves the destination.
+The synchronous optional `onDestinationPublished` callback receives a frozen
+`RootCopyPublicationReceipt` containing `{ path, dev, ino }`, with exact bigint identity immediately after
+publication, before later checks can fail. Callback errors also preserve the
+published file and retain their original thrown value when cleanup succeeds,
+including errors whose metadata cannot be inspected. Promise, thenable, and synchronous or asynchronous generator
+results reject with `TypeError`; returned generators are never advanced. Other
+synchronous return values are ignored. This receipt records an outcome; it does
+not authorize removing a file that another actor may have edited. Application recovery and cooperative
+locking remain caller-owned.
+
+Existing `copyIn` callers must account for completed destinations retained after
+a post-publication source-verification failure, even without the new options.
+Recovery must inspect current destination state rather than assume a rejected
+copy left no file.
+
+`durable` follows the Root default (`true` when omitted at both levels);
+`false` skips file and parent-directory syncs. Use `sourceHardlinks: "reject"`
+to refuse hardlinked sources. There is no encoding option: copying preserves bytes.
 
 ### `fs.move(from, to, options?)`
 
@@ -370,7 +480,11 @@ paths are rechecked after the live mutation-authority callback and before
 dispatch. The Root and retained parents are fenced again after any such callback.
 These checks retain the documented final check-to-syscall race.
 
-For `{ overwrite: true }`, the JavaScript path checks both parent directories
+For `{ overwrite: true }`, `require` mode retains both parents, checks the source
+identity relative to its parent, and renames through those descriptors (or the
+corresponding Windows handles). It then rechecks the parents and destination
+identity. `require` rejects with `helper-unavailable` if this operation's native
+entry point is absent. In `off` and default `auto`, the JavaScript path checks both parent directories
 before and after the rename. A failed post-operation check rejects even though
 the rename may already have completed; rejection does not imply rollback.
 
@@ -481,15 +595,35 @@ reasons, are propagated without adding or changing their details. Context is
 diagnostic; it is not permission to retry or mutate an entry.
 
 Removal is incremental, not atomic. A later budget, cancellation, identity, or
-filesystem failure does not restore already removed entries. As with existing
-`remove`, this is a guarded JavaScript operation in every native mode: pathname
-checks are best-effort against a hostile concurrent process and do not create
-an atomic check-and-delete syscall. Use OS isolation for that threat model.
+filesystem failure does not restore already removed entries. Required-mode POSIX
+removal checks the entry without following links and uses `unlinkat` relative
+to a retained parent; empty directories use `AT_REMOVEDIR`. Recursive native
+removal enumerates through retained directory descriptors and retains its
+ordering, budgets, abort checks, and denied-descendant preflight. Linux descent
+requires `openat2` with `RESOLVE_NO_XDEV`; macOS checks mount identity.
+
+Windows nonrecursive removal checks the identity of the exact handle opened
+relative to the parent and deletes that object with `FileDispositionInfoEx`,
+without following a final reparse point. `require` rejects recursive removal
+on Windows and on Linux without that mount-bounded capability. `off` and default
+`auto` retain the JavaScript implementation even when the addon is loaded: its pathname checks are best-effort
+against a hostile concurrent process and cannot prevent every outside side
+effect. POSIX native deletion is also not an atomic expected-inode conditional
+unlink. See the [platform matrix](security-model.md#native-root-mutation-capabilities)
+for the precise parent-pinning guarantee and remaining same-call limitations.
 
 ### `fs.mkdir(rel)`
 
 `mkdir -p`. Creates missing parents.
 
+`require` mode creates each missing component relative to a retained directory,
+opens the child without following a final symlink, and checks its identity before
+continuing. Windows private creation retains its protected native creator,
+which verifies the admitted parent identity and calls handle-relative
+`NtCreateFile` with a protected security descriptor. `require` refuses a missing
+native capability; default `auto` retains its existing best-effort path and does
+not confine mkdir under hostile concurrency.
+
 ```ts
 await fs.mkdir("snapshots/2026/05");
 ```
@@ -538,6 +672,28 @@ destination — there is no atomic-rename step. For exclusive publication of a
 complete stream, use [`create()`](#streamed-creation). For streamed replacement,
 the [`atomic`](atomic.md) helpers provide a staged writer.
 
+When creating a missing file, `require` mode uses an exclusive no-follow open
+beneath a retained parent and verifies the same inode during handoff to the
+returned Node `FileHandle`. `append()` uses this path too. Required creation
+fails with `helper-unavailable` with an incomplete addon, or when a
+restrictive mode or umask prevents that handoff without widening initial permissions.
+Default `auto` retains its existing JavaScript creation path even when the addon
+is loaded, and does not confine creation under hostile concurrency. Required creation confinement
+does not upgrade the returned `containment: "best-effort"` label or provide a
+transaction around later caller writes.
+
+On Windows, fallback creation rejects an observed dangling final symlink before
+opening it, preserving the missing referent even when it is outside the Root.
+Create-only writes and standalone exclusive creators apply the same preflight;
+exclusive creation treats an existing symlink as a collision. This check does not close the race
+between inspecting the leaf and opening it. An existing contained final symlink
+still follows the omitted-policy behavior described above.
+
+The native creation syscall applies the requested mode and inherited ACLs.
+If those kernel-created permissions prevent the subsequent FileHandle handoff,
+the operation fails and attempts identity-bound cleanup; it does not widen an
+inherited ACL with a later `chmod`.
+
 For all three write modes, `mode` only selects new-file creation permissions,
 defaulting to `0o600` when neither the call nor the Root supplies it. POSIX
 permissions remain subject to the process umask; existing files are not chmodded.

package/node_modules/@openclaw/fs-safe/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe",
-  "version": "0.21.1",
+  "version": "0.23.0",
   "description": "Capability-style filesystem roots for Node.js apps that handle untrusted relative paths.",
   "keywords": [
     "filesystem",
@@ -173,20 +173,20 @@
     "archive:producer-smoke": "node scripts/archive-producer-smoke.mjs"
   },
   "optionalDependencies": {
-    "@openclaw/fs-safe-darwin-arm64": "0.21.1",
-    "@openclaw/fs-safe-darwin-x64": "0.21.1",
-    "@openclaw/fs-safe-linux-arm64-gnu": "0.21.1",
-    "@openclaw/fs-safe-linux-arm64-musl": "0.21.1",
-    "@openclaw/fs-safe-linux-x64-gnu": "0.21.1",
-    "@openclaw/fs-safe-linux-x64-musl": "0.21.1",
-    "@openclaw/fs-safe-win32-x64-msvc": "0.21.1",
+    "@openclaw/fs-safe-darwin-arm64": "0.23.0",
+    "@openclaw/fs-safe-darwin-x64": "0.23.0",
+    "@openclaw/fs-safe-linux-arm64-gnu": "0.23.0",
+    "@openclaw/fs-safe-linux-arm64-musl": "0.23.0",
+    "@openclaw/fs-safe-linux-x64-gnu": "0.23.0",
+    "@openclaw/fs-safe-linux-x64-musl": "0.23.0",
+    "@openclaw/fs-safe-win32-x64-msvc": "0.23.0",
     "jszip": "^3.10.2"
   },
   "devDependencies": {
     "@emnapi/runtime": "2.0.0-alpha.5",
     "@napi-rs/cli": "3.10.5",
     "@types/node": "^26.6.1",
-    "@vitest/coverage-v8": "5.0.1",
+    "@vitest/coverage-v8": "5.0.2",
     "fast-check": "^4.10.1",
     "istanbul-lib-coverage": "3.2.2",
     "istanbul-lib-report": "3.0.1",
@@ -194,7 +194,7 @@
     "sigstore": "5.0.0",
     "tar": "7.5.22",
     "typescript": "^7.0.2",
-    "vite": "8.3.0",
+    "vite": "8.3.1",
     "vitest": "^5.0.1"
   },
   "engines": {

package/node_modules/@openclaw/fs-safe-darwin-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-darwin-arm64",
-  "version": "0.21.1",
+  "version": "0.23.0",
   "description": "macOS arm64 native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-darwin-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-darwin-x64",
-  "version": "0.21.1",
+  "version": "0.23.0",
   "description": "macOS x64 native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-arm64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-arm64-gnu",
-  "version": "0.21.1",
+  "version": "0.23.0",
   "description": "Linux arm64 glibc native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-arm64-musl/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-arm64-musl",
-  "version": "0.21.1",
+  "version": "0.23.0",
   "description": "Linux arm64 musl native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-x64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-x64-gnu",
-  "version": "0.21.1",
+  "version": "0.23.0",
   "description": "Linux x64 glibc native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-x64-musl/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-x64-musl",
-  "version": "0.21.1",
+  "version": "0.23.0",
   "description": "Linux x64 musl native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-win32-x64-msvc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-win32-x64-msvc",
-  "version": "0.21.1",
+  "version": "0.23.0",
   "description": "Windows x64 MSVC native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/feishu",
-  "version": "2026.9.8",
+  "version": "2026.10.1-beta.2",
   "description": "OpenClaw Feishu/Lark channel plugin for chats and workplace tools (community maintained by @m1heng).",
   "repository": {
     "type": "git",
@@ -9,7 +9,7 @@
   "type": "module",
   "dependencies": {
     "@larksuiteoapi/node-sdk": "1.74.0",
-    "@openclaw/fs-safe": "0.21.1",
+    "@openclaw/fs-safe": "0.23.0",
     "mdast-util-from-markdown": "2.0.3",
     "mdast-util-gfm-table": "2.0.0",
     "micromark-extension-gfm-table": "2.1.2",
@@ -17,7 +17,7 @@
     "zod": "4.6.5"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.9.8"
+    "openclaw": ">=2026.10.1-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -64,11 +64,11 @@
       "minHostVersion": ">=2026.5.29"
     },
     "compat": {
-      "pluginApi": ">=2026.9.8"
+      "pluginApi": ">=2026.10.1-beta.2"
     },
     "build": {
       "bundledDist": false,
-      "openclawVersion": "2026.9.8"
+      "openclawVersion": "2026.10.1-beta.2"
     },
     "release": {
       "publishToClawHub": true,

package/skills/feishu-wiki/SKILL.md

@@ -14,7 +14,7 @@ From `https://example.feishu.cn/wiki/ABC123def`, use `ABC123def` as `token`. Tre
 
 - Use `spaces` to enumerate accessible knowledge spaces and `nodes` for a space or parent node.
 - Continue pagination with the returned `page_token` while `has_more` is true, keeping the same space and parent.
-- Use `search` when the user provides a query but not an exact node.
+- Search is unavailable. Use `nodes` to browse a known space or parent, or `get` when the user provides a wiki token.
 - Use `get` to resolve a wiki token to its `node_token`, `obj_token`, and `obj_type`.
 
 ## Create and organize