@openclaw/fs-safe 0.13.1 → 0.15.0

package/dist/path-suffix-aliases.js

@@ -15,6 +15,7 @@ const MAX_SUFFIX_DEPTH = 32;
 const MAX_MKDIR_ATTEMPTS = 128;
 const MAX_CREATED_DIRECTORIES = 64;
 const MAX_FORWARD_OBSERVATIONS = 4_096;
+const MAX_SCALED_FORWARD_OBSERVATIONS = 32_768;
 const PROBE_NAME_LENGTH = 6;
 const PROBE_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
 const PROBE_FIRST_ALPHABET = "bdefghijkmoqrstuvwxyz";
@@ -25,7 +26,7 @@ function assertMutationPath(value) {
     if (value.length > MAX_PATH_LENGTH)
         unavailable();
 }
-function suffixSegments(value) {
+function suffixSegments(value, maxDepth) {
     if (typeof value !== "string")
         throw new TypeError("suffix must be a string");
     if (value.length > MAX_SUFFIX_LENGTH)
@@ -35,8 +36,8 @@ function suffixSegments(value) {
     }
     const windows = process.platform === "win32";
     const segments = (windows ? value.replaceAll("/", "\\") : value).split(path.sep);
-    if (segments.length > MAX_SUFFIX_DEPTH)
-        throw new RangeError("suffix exceeds 32 components");
+    if (segments.length > maxDepth)
+        throw new RangeError(`suffix exceeds ${maxDepth} components`);
     if (segments.some(segment => !segment || segment === "." || segment === ".." ||
         (windows && (segment.includes(":") || /^[ .]+$/u.test(segment) ||
             isWindowsReservedDeviceName(segment))))) {
@@ -96,14 +97,8 @@ function createPrivateProbeName(nameLength) {
     return name;
 }
 function* asciiCaseProbePairs(nameLength, forbidden) {
-    let count = 0;
-    for (let attempt = 0; attempt < 96 && count < 24; attempt++) {
-        const first = createPrivateProbeName(nameLength);
-        const second = `${first[0].toUpperCase()}${first.slice(1)}`;
-        if (!forbidden(first) && !forbidden(second)) {
-            count++;
-            yield [first, second];
-        }
+    for (const first of privateProbeNames(nameLength, forbidden)) {
+        yield [first, `${first[0].toUpperCase()}${first.slice(1)}`];
     }
 }
 function* privateProbeNames(nameLength, forbidden) {
@@ -128,8 +123,16 @@ class ProbeDirectories {
     observations = 0;
     mkdirAttempts = 0;
     creations = 0;
-    constructor(requestedDirectory) {
+    maxObservations;
+    maxMkdirAttempts;
+    maxCreations;
+    constructor(requestedDirectory, depth) {
         this.requestedDirectory = requestedDirectory;
+        // The suffix-length limit bounds actual depth, so these products remain safe integers.
+        const scale = Math.max(1, depth / MAX_SUFFIX_DEPTH);
+        this.maxObservations = Math.min(MAX_SCALED_FORWARD_OBSERVATIONS, MAX_FORWARD_OBSERVATIONS * scale * scale);
+        this.maxMkdirAttempts = MAX_MKDIR_ATTEMPTS * scale;
+        this.maxCreations = MAX_CREATED_DIRECTORIES * scale;
         this.observe(1);
         const canonical = realpathSync.native(pathForWindowsFilesystem(requestedDirectory));
         assertMutationPath(canonical);
@@ -138,7 +141,7 @@ class ProbeDirectories {
         this.assert(this.root);
     }
     reserveObservations(units) {
-        if (this.observations + units > MAX_FORWARD_OBSERVATIONS)
+        if (units > this.maxObservations - this.observations)
             unavailable();
     }
     observe(units, cleanup = false) {
@@ -159,7 +162,7 @@ class ProbeDirectories {
         }
     }
     create(parent, name) {
-        if (this.mkdirAttempts >= MAX_MKDIR_ATTEMPTS || this.creations >= MAX_CREATED_DIRECTORIES)
+        if (this.mkdirAttempts >= this.maxMkdirAttempts || this.creations >= this.maxCreations)
             unavailable();
         const probePath = path.join(parent.path, name);
         assertMutationPath(probePath);
@@ -337,11 +340,16 @@ export function probePathSuffixAliasesSync(options) {
     const directory = resolvePathPreservingWindowsRoot(requestedDirectory);
     if (directory.length > MAX_PATH_LENGTH)
         throw new RangeError("resolved directory exceeds 32768 code units");
+    const requestedMaxDepth = options.maxDepth;
+    const maxDepth = requestedMaxDepth === undefined ? MAX_SUFFIX_DEPTH : requestedMaxDepth;
+    if (!Number.isSafeInteger(maxDepth) || maxDepth < 0) {
+        throw new RangeError("maxDepth must be a non-negative safe integer");
+    }
     const leftInput = options.left;
     const rightInput = options.right;
     const predicate = options.shouldProbeCaseVariants;
-    const left = suffixSegments(leftInput);
-    const right = suffixSegments(rightInput);
+    const left = suffixSegments(leftInput, maxDepth);
+    const right = suffixSegments(rightInput, maxDepth);
     if (left.length !== right.length)
         throw new TypeError("suffixes must have the same component count");
     if (predicate !== undefined && typeof predicate !== "function") {
@@ -370,7 +378,7 @@ export function probePathSuffixAliasesSync(options) {
     let observed;
     let cleaned = true;
     try {
-        observed = observeSuffixes(() => owner ??= new ProbeDirectories(directory), left, right, shouldProbe);
+        observed = observeSuffixes(() => owner ??= new ProbeDirectories(directory, left.length), left, right, shouldProbe);
         owner?.assert(owner.root);
     }
     catch {

package/dist/permission-exec.d.ts

@@ -8,6 +8,8 @@ export type PermissionCommandFailure = {
     stderr: string;
 };
 export declare function formatPermissionErrorDetail(value: string): string;
+/** Formats only caught permission-query failures without invoking user code. */
+export declare function formatCaughtPermissionFailure(error: unknown): string;
 export declare class PermissionCommandError extends Error implements PermissionCommandFailure {
     readonly command: string;
     readonly durationMs: number;

package/dist/permission-exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-exec.d.ts","sourceRoot":"","sources":["../src/permission-exec.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,kCAAkC,QAAS,CAAC;AAEzD,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjE;AAgBD,qBAAa,sBAAuB,SAAQ,KAAM,YAAW,wBAAwB;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YACE,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,OAAO,EACd,SAAS,SAAqC,EAc/C;CACF;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,wBAAwB,GAAG,SAAS,CAgBtC;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,SAAS,SAAqC,GAC7C,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAa7C"}
+{"version":3,"file":"permission-exec.d.ts","sourceRoot":"","sources":["../src/permission-exec.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,kCAAkC,QAAS,CAAC;AAEzD,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjE;AA4ED,gFAAgF;AAChF,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAqBpE;AA2CD,qBAAa,sBAAuB,SAAQ,KAAM,YAAW,wBAAwB;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YACE,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,OAAO,EACd,SAAS,SAAqC,EAc/C;CACF;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,wBAAwB,GAAG,SAAS,CAgCtC;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,SAAS,SAAqC,GAC7C,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAa7C"}

package/dist/permission-exec.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import path from "node:path";
-import { promisify } from "node:util";
+import { promisify, types as utilTypes } from "node:util";
 import { formatErrorDetail } from "./error-detail.js";
 const execFileAsync = promisify(execFile);
 export const DEFAULT_PERMISSION_EXEC_TIMEOUT_MS = 30_000;
@@ -8,15 +8,127 @@ export function formatPermissionErrorDetail(value) {
     const formatted = formatErrorDetail(value);
     return formatted.length > 400 ? `${formatted.slice(0, 399)}…` : formatted;
 }
+const MISSING_DATA_PROPERTY = Object.freeze({ found: false });
+const MAX_CAUGHT_FAILURE_PROTOTYPES = 4;
+const primitiveString = String;
+const isUint8Array = utilTypes.isUint8Array;
+const Uint8ArrayIntrinsic = Uint8Array;
+const typedArrayPrototype = Object.getPrototypeOf(Uint8ArrayIntrinsic.prototype);
+const typedArrayBufferGetter = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer").get;
+const typedArrayByteOffsetGetter = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteOffset").get;
+const typedArrayByteLengthGetter = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength").get;
+const typedArraySet = Object.getOwnPropertyDescriptor(typedArrayPrototype, "set").value;
+const textDecoderDecode = TextDecoder.prototype.decode;
+const stderrDecoder = new TextDecoder("utf-8", {
+    fatal: false,
+    ignoreBOM: true,
+});
+const MAX_STDERR_BYTES = 1600;
+function isInspectableCaughtObject(value) {
+    if ((typeof value !== "object" || value === null) && typeof value !== "function") {
+        return false;
+    }
+    try {
+        return !utilTypes.isProxy(value);
+    }
+    catch {
+        return false;
+    }
+}
+function dataProperty(value, name) {
+    if (!isInspectableCaughtObject(value))
+        return MISSING_DATA_PROPERTY;
+    let current = value;
+    for (let depth = 0; current !== null && depth < MAX_CAUGHT_FAILURE_PROTOTYPES; depth += 1) {
+        if (!isInspectableCaughtObject(current))
+            return MISSING_DATA_PROPERTY;
+        let descriptor;
+        try {
+            descriptor = Object.getOwnPropertyDescriptor(current, name);
+        }
+        catch {
+            return MISSING_DATA_PROPERTY;
+        }
+        if (descriptor) {
+            return Object.hasOwn(descriptor, "value")
+                ? { found: true, value: descriptor.value }
+                : MISSING_DATA_PROPERTY;
+        }
+        try {
+            current = Object.getPrototypeOf(current);
+        }
+        catch {
+            return MISSING_DATA_PROPERTY;
+        }
+    }
+    return MISSING_DATA_PROPERTY;
+}
+function caughtPrimitiveDisplay(value) {
+    if (value !== null && (typeof value === "object" || typeof value === "function"))
+        return undefined;
+    return primitiveString(value);
+}
+/** Formats only caught permission-query failures without invoking user code. */
+export function formatCaughtPermissionFailure(error) {
+    const primitive = caughtPrimitiveDisplay(error);
+    if (primitive !== undefined)
+        return formatBoundedCaughtDetail(primitive);
+    if (!isInspectableCaughtObject(error)) {
+        return "Uninspectable proxy failure";
+    }
+    const message = dataProperty(error, "message");
+    const name = dataProperty(error, "name");
+    const rawMessage = message.found && typeof message.value === "string"
+        ? message.value : "";
+    const rawName = name.found && typeof name.value === "string"
+        ? name.value : "";
+    const messageText = rawMessage.slice(0, 400);
+    const nameText = rawName.slice(0, 400);
+    const display = messageText
+        ? (nameText ? `${nameText}: ${messageText}` : messageText)
+        : nameText || (typeof error === "function" ? "Unknown function failure" : "Unknown object failure");
+    return formatBoundedCaughtDetail(display, rawMessage.length > messageText.length || rawName.length > nameText.length);
+}
+function formatBoundedCaughtDetail(value, alreadyTruncated = false) {
+    const inputWasTruncated = alreadyTruncated || value.length > 400;
+    const formatted = formatPermissionErrorDetail(value.slice(0, 400));
+    if (!inputWasTruncated || formatted.endsWith("…"))
+        return formatted;
+    return `${formatted.slice(0, 399)}…`;
+}
+function safeStderr(value) {
+    if (typeof value === "string")
+        return formatBoundedCaughtDetail(value);
+    try {
+        if (!isUint8Array(value))
+            return "";
+        const backing = Reflect.apply(typedArrayBufferGetter, value, []);
+        const byteOffset = Reflect.apply(typedArrayByteOffsetGetter, value, []);
+        const byteLength = Reflect.apply(typedArrayByteLengthGetter, value, []);
+        const copiedByteLength = byteLength < MAX_STDERR_BYTES
+            ? byteLength : MAX_STDERR_BYTES;
+        const source = new Uint8ArrayIntrinsic(backing, byteOffset, copiedByteLength);
+        const copy = new Uint8ArrayIntrinsic(copiedByteLength);
+        Reflect.apply(typedArraySet, copy, [source, 0]);
+        const decoded = Reflect.apply(textDecoderDecode, stderrDecoder, [copy]);
+        return formatBoundedCaughtDetail(decoded, byteLength > copiedByteLength);
+    }
+    catch {
+        return "";
+    }
+}
 function commandFailureFields(error) {
-    const fields = error && typeof error === "object" ? error : {};
+    const killed = dataProperty(error, "killed");
+    const code = dataProperty(error, "code");
+    const signal = dataProperty(error, "signal");
+    const stderr = dataProperty(error, "stderr");
     return {
-        timedOut: "killed" in fields && fields.killed === true &&
-            "signal" in fields && fields.signal === "SIGKILL",
-        exitCode: "code" in fields && typeof fields.code === "number" ? fields.code : null,
-        signal: "signal" in fields && typeof fields.signal === "string" ? fields.signal : null,
-        stderr: formatPermissionErrorDetail("stderr" in fields && (typeof fields.stderr === "string" || Buffer.isBuffer(fields.stderr))
-            ? fields.stderr.toString() : ""),
+        found: killed.found || code.found || signal.found || stderr.found,
+        timedOut: killed.found && killed.value === true &&
+            signal.found && signal.value === "SIGKILL",
+        exitCode: code.found && typeof code.value === "number" ? code.value : null,
+        signal: signal.found && typeof signal.value === "string" ? signal.value : null,
+        stderr: stderr.found ? safeStderr(stderr.value) : "",
     };
 }
 export class PermissionCommandError extends Error {
@@ -41,21 +153,38 @@ export class PermissionCommandError extends Error {
     }
 }
 export function getPermissionCommandFailure(error, command, durationMs) {
-    if (error instanceof PermissionCommandError) {
-        return {
-            command: error.command,
-            durationMs: error.durationMs,
-            timedOut: error.timedOut,
-            exitCode: error.exitCode,
-            signal: error.signal,
-            stderr: error.stderr,
-        };
+    if (isInspectableCaughtObject(error) && utilTypes.isNativeError(error)) {
+        const name = dataProperty(error, "name");
+        if (name.found && name.value === "PermissionCommandError") {
+            const wrappedCommand = dataProperty(error, "command");
+            const wrappedDuration = dataProperty(error, "durationMs");
+            const wrappedTimedOut = dataProperty(error, "timedOut");
+            const wrappedExitCode = dataProperty(error, "exitCode");
+            const wrappedSignal = dataProperty(error, "signal");
+            const wrappedStderr = dataProperty(error, "stderr");
+            if (wrappedCommand.found && typeof wrappedCommand.value === "string" &&
+                wrappedDuration.found && typeof wrappedDuration.value === "number" &&
+                Number.isSafeInteger(wrappedDuration.value) && wrappedDuration.value >= 0 &&
+                wrappedTimedOut.found && typeof wrappedTimedOut.value === "boolean" &&
+                wrappedExitCode.found && (wrappedExitCode.value === null || typeof wrappedExitCode.value === "number") &&
+                wrappedSignal.found && (wrappedSignal.value === null || typeof wrappedSignal.value === "string") &&
+                wrappedStderr.found) {
+                return {
+                    command: wrappedCommand.value,
+                    durationMs: wrappedDuration.value,
+                    timedOut: wrappedTimedOut.value,
+                    exitCode: wrappedExitCode.value,
+                    signal: wrappedSignal.value,
+                    stderr: safeStderr(wrappedStderr.value),
+                };
+            }
+        }
     }
-    if (!error || typeof error !== "object" ||
-        !("code" in error || "signal" in error || "killed" in error || "stderr" in error)) {
+    const fields = commandFailureFields(error);
+    if (!fields.found)
         return undefined;
-    }
-    return { command, durationMs: Math.round(durationMs), ...commandFailureFields(error) };
+    const { found: _found, ...detail } = fields;
+    return { command, durationMs: Math.round(durationMs), ...detail };
 }
 export async function executePermissionCommand(command, args, timeoutMs = DEFAULT_PERMISSION_EXEC_TIMEOUT_MS) {
     const startedAt = performance.now();

package/dist/permissions-windows.js

@@ -96,7 +96,7 @@ export async function inspectWindowsPermissions(params) {
         env: params.opts?.env,
         exec: params.opts?.exec ?? defaultPermissionExec,
     });
-    if (owner.error) {
+    if (owner.error !== undefined) {
         const error = `Windows owner inspection failed: ${owner.error}`;
         return { ...unverified, ownerError: owner.error, error, errorDetail: owner.errorDetail, errorCause: owner.errorCause };
     }

package/dist/pinned-mutation-admission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pinned-mutation-admission.d.ts","sourceRoot":"","sources":["../src/pinned-mutation-admission.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGvF,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAKV,4BAA4B,EAC7B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAgCtE,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAClD,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C,CAAC,CAAC;AAEH,wBAAgB,4BAA4B,CAC1C,aAAa,EAAE,kBAAkB,GAAG,SAAS,EAC7C,gBAAgB,EAAE,qBAAqB,GAAG,SAAS,GAClD,4BAA4B,GAAG,SAAS,CAO1C;AAuJD,wBAAsB,mCAAmC,CAAC,MAAM,EAAE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yBAAyB,EAAE,MAAM,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACjD,cAAc,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjD,GAAG,OAAO,CAAC;IACV,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;CAClD,CAAC,CAsQD"}
+{"version":3,"file":"pinned-mutation-admission.d.ts","sourceRoot":"","sources":["../src/pinned-mutation-admission.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGvF,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAKV,4BAA4B,EAC7B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAgCtE,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAClD,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C,CAAC,CAAC;AAEH,wBAAgB,4BAA4B,CAC1C,aAAa,EAAE,kBAAkB,GAAG,SAAS,EAC7C,gBAAgB,EAAE,qBAAqB,GAAG,SAAS,GAClD,4BAA4B,GAAG,SAAS,CAO1C;AAuJD,wBAAsB,mCAAmC,CAAC,MAAM,EAAE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yBAAyB,EAAE,MAAM,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACjD,cAAc,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjD,GAAG,OAAO,CAAC;IACV,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;CAClD,CAAC,CAgQD"}

package/dist/pinned-mutation-admission.js

@@ -7,7 +7,7 @@ import { ordinarySharedAbsoluteInsideRoot, simpleSharedRoute, } from "./pinned-m
 import { resolvePathViaExistingAncestor } from "./root-path-existing.js";
 import { outsideWorkspaceError } from "./root-errors.js";
 import { getFsSafeNativeConfig } from "./native-config.js";
-import { advanceMutationObservation, mutationObservationCurrent, observeMutationPath, mutationDirectoryObservationCurrent, mutationObservationUsesDirectory, missingMutationSegments, nextMissingMutationPath, } from "./pinned-mutation-observation.js";
+import { advanceMutationObservation, mutationObservationCurrent, observeMutationPath, mutationObservationsCurrent, mutationObservationUsesDirectory, missingMutationSegments, nextMissingMutationPath, } from "./pinned-mutation-observation.js";
 export function snapshotPinnedMutationPolicy(denyMutations, mutationSymlinks) {
     if (denyMutations === undefined && mutationSymlinks === undefined)
         return undefined;
@@ -92,10 +92,12 @@ function captureEpoch(rootReal, target, policy, session) {
         return undefined;
     }
 }
-function epochCurrent(epoch) {
+function epochCurrent(epoch, directories) {
     return !process.versions.bun && epoch.mode === epoch.session.nativeMode &&
         getFsSafeNativeConfig().mode === epoch.mode &&
-        epoch.observations.every(mutationObservationCurrent);
+        (directories ? mutationObservationsCurrent(epoch.observations, directories) :
+            epoch.observations.every(mutationObservationCurrent)) &&
+        getFsSafeNativeConfig().mode === epoch.mode;
 }
 function assertCachedNotDenied(target, epoch) {
     if (epoch.paths.some((paths) => paths.some((denied) => isPathInside(denied, target) && isPathInside(target, denied))) ||
@@ -143,10 +145,8 @@ function advanceAuthorizedDirectory(admittedEpoch, admitted, receipt) {
         target,
         observations: Object.freeze(complete),
     });
-    if (!mutationDirectoryObservationCurrent(receipt.parent) ||
-        !mutationDirectoryObservationCurrent(receipt.child) ||
-        !mutationObservationUsesDirectory(target, receipt.child) ||
-        !epochCurrent(next))
+    if (!mutationObservationUsesDirectory(target, receipt.child) ||
+        !epochCurrent(next, [receipt.parent, receipt.child]))
         return undefined;
     assertCachedNotDenied(target.path, next);
     assertCachedNotDenied(receipt.child.path, next);
@@ -165,6 +165,10 @@ export async function preparePinnedWriteMutationAdmission(params) {
         selectedTarget: params.resolvedTargetPath,
         policy,
     });
+    const nativeRoute = sharedRoute ?? (process.platform === "win32" && params.originalPath?.includes("/")
+        ? simpleSharedRoute({ rootReal: params.rootReal, rootIdentity: params.rootIdentity,
+            originalPath: params.originalPath.replaceAll("/", "\\"), selectedTarget: params.resolvedTargetPath, policy })
+        : undefined);
     let pinnedSession;
     let epoch;
     let pending;
@@ -194,13 +198,13 @@ export async function preparePinnedWriteMutationAdmission(params) {
         }
         return current;
     };
-    const beginSharedParentWalk = sharedRoute ? () => {
+    const createSharedParentWalk = (admittedRoute) => {
         const session = Object.freeze({
             kind: "shared",
-            route: sharedRoute.route,
+            route: admittedRoute.route,
             selectedTarget: params.resolvedTargetPath,
             nativeMode: getFsSafeNativeConfig().mode,
-            rootIdentity: sharedRoute.rootIdentity,
+            rootIdentity: admittedRoute.rootIdentity,
             authorizationToken: Object.freeze({}),
         });
         let disposed = false;
@@ -232,20 +236,14 @@ export async function preparePinnedWriteMutationAdmission(params) {
                 if (!reusable || reusable.session !== session ||
                     !reusableSharedCreateRequest(request, reusable) ||
                     !mutationObservationUsesDirectory(reusable.target, parent) ||
-                    !epochCurrent(reusable)) {
+                    !nonzeroDirectoryObservation(parent) || !epochCurrent(reusable, [parent])) {
                     disable();
                     return undefined;
                 }
                 assertCachedNotDenied(request.targetPath, reusable);
                 assertCachedNotDenied(request.mutationPath, reusable);
-                // This is the required end fence. A returned receipt remains usable
-                // only synchronously, while the exact parent identity and spelling
-                // still match the observation captured by this walk.
-                if (!nonzeroDirectoryObservation(parent) ||
-                    !mutationDirectoryObservationCurrent(parent)) {
-                    disable();
-                    return undefined;
-                }
+                // The epoch check ends with the exact parent fence. The receipt is
+                // consumed synchronously before any intervening authority callback.
                 sharedPending = Object.freeze({
                     epoch: reusable,
                     childPath: request.mutationPath,
@@ -320,7 +318,7 @@ export async function preparePinnedWriteMutationAdmission(params) {
                 disable();
             },
         });
-    } : undefined;
+    };
     const mutationAdmission = Object.freeze({
         rejectParentSymlinks: policy.mutationSymlinks === "reject",
         beginParentWalk: route ? () => {
@@ -335,26 +333,22 @@ export async function preparePinnedWriteMutationAdmission(params) {
             pending = undefined;
             return route;
         } : undefined,
-        beginSharedParentWalk,
+        beginSharedParentWalk: sharedRoute ? () => createSharedParentWalk(sharedRoute) : undefined,
+        beginNativeParentWalk: nativeRoute ? () => createSharedParentWalk(nativeRoute) : undefined,
         tryAuthorizeAtParent(request, parent) {
             pending = undefined;
             const reusable = epoch;
             if (!reusable || reusable.session !== pinnedSession ||
                 !reusableRequest(request, reusable) ||
                 !mutationObservationUsesDirectory(reusable.target, parent) ||
-                !epochCurrent(reusable)) {
+                !epochCurrent(reusable, [parent])) {
                 epoch = undefined;
                 return undefined;
             }
             assertCachedNotDenied(request.targetPath, reusable);
             assertCachedNotDenied(request.mutationPath, reusable);
-            // This is the required end fence. The caller can consume the returned
-            // token without awaiting only while the exact pathname, canonical
-            // spelling, descriptor identity, type, mode, and link count still match.
-            if (!mutationDirectoryObservationCurrent(parent)) {
-                epoch = undefined;
-                return undefined;
-            }
+            // The epoch check ends at the exact parent pathname, canonical spelling,
+            // identity, type, mode and link-count fence, with no intervening await.
             if (request.phase === "parent-create") {
                 pending = Object.freeze({
                     epoch: reusable,

package/dist/pinned-mutation-observation.d.ts

@@ -6,6 +6,11 @@ export type MutationIdentity = Readonly<{
     nlink: bigint;
 }>;
 declare const checkedDirectoryObservation: unique symbol;
+export type MutationDirectoryCurrent = Readonly<{
+    canonicalPath: string;
+    identity: MutationIdentity;
+}>;
+export type MutationDirectoryObserver = () => MutationDirectoryCurrent | undefined;
 export type MutationDirectoryObservation = Readonly<{
     path: string;
     canonicalPath: string;
@@ -24,11 +29,11 @@ export type MutationPathObservation = Readonly<{
 }>;
 export declare function missingMutationSegments(observation: MutationPathObservation): number;
 export declare function nextMissingMutationPath(observation: MutationPathObservation): string | undefined;
-export declare function checkedMutationDirectory(pathname: string, canonicalPath: string, stat: BigIntStats): MutationDirectoryObservation;
-export declare function mutationDirectoryObservationCurrent(observation: MutationDirectoryObservation): boolean;
+export declare function checkedMutationDirectory(pathname: string, canonicalPath: string, stat: Pick<BigIntStats, "dev" | "ino" | "mode" | "nlink">, observeCurrent?: MutationDirectoryObserver): MutationDirectoryObservation;
 export declare function mutationObservationUsesDirectory(observation: MutationPathObservation, directory: MutationDirectoryObservation): boolean;
 export declare function observeMutationPath(pathname: string): MutationPathObservation | undefined;
 export declare function mutationObservationCurrent(observation: MutationPathObservation): boolean;
+export declare function mutationObservationsCurrent(observations: readonly MutationPathObservation[], directories: readonly MutationDirectoryObservation[]): boolean;
 export declare function advanceMutationObservation(observation: MutationPathObservation, parent: MutationDirectoryObservation, child: MutationDirectoryObservation): MutationPathObservation | undefined;
 export {};
 //# sourceMappingURL=pinned-mutation-observation.d.ts.map

package/dist/pinned-mutation-observation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pinned-mutation-observation.d.ts","sourceRoot":"","sources":["../src/pinned-mutation-observation.ts"],"names":[],"mappings":"AAAA,OAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAM/C,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC,CAAC;AAEH,QAAA,MAAM,2BAA2B,eAAmD,CAAC;AAErF,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC,CAAC;AA8BH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,uBAAuB,GAAG,MAAM,CAEpF;AAED,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,uBAAuB,GAAG,MAAM,GAAG,SAAS,CAGhG;AAKD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,WAAW,GAChB,4BAA4B,CAU9B;AAQD,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,4BAA4B,GACxC,OAAO,CAUT;AAED,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,uBAAuB,EACpC,SAAS,EAAE,4BAA4B,GACtC,OAAO,CAMT;AAGD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CA0BzF;AAED,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,uBAAuB,GAAG,OAAO,CAaxF;AAID,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,uBAAuB,EACpC,MAAM,EAAE,4BAA4B,EACpC,KAAK,EAAE,4BAA4B,GAClC,uBAAuB,GAAG,SAAS,CAiBrC"}
+{"version":3,"file":"pinned-mutation-observation.d.ts","sourceRoot":"","sources":["../src/pinned-mutation-observation.ts"],"names":[],"mappings":"AAAA,OAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAM/C,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC,CAAC;AAEH,QAAA,MAAM,2BAA2B,eAAmD,CAAC;AAGrF,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,gBAAgB,CAAC;CAC5B,CAAC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAEnF,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC,CAAC;AA6BH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,uBAAuB,GAAG,MAAM,CAEpF;AAED,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,uBAAuB,GAAG,MAAM,GAAG,SAAS,CAGhG;AAKD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,EACzD,cAAc,CAAC,EAAE,yBAAyB,GACzC,4BAA4B,CAY9B;AAQD,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,uBAAuB,EACpC,SAAS,EAAE,4BAA4B,GACtC,OAAO,CAMT;AAGD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CA0BzF;AAED,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,uBAAuB,GAAG,OAAO,CAaxF;AAKD,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,SAAS,uBAAuB,EAAE,EAChD,WAAW,EAAE,SAAS,4BAA4B,EAAE,GACnD,OAAO,CAiET;AAID,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,uBAAuB,EACpC,MAAM,EAAE,4BAA4B,EACpC,KAAK,EAAE,4BAA4B,GAClC,uBAAuB,GAAG,SAAS,CAiBrC"}

package/dist/pinned-mutation-observation.js

@@ -4,6 +4,7 @@ import { isNotFoundPathError } from "./path.js";
 import { realpathSync } from "./realpath.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
 const checkedDirectoryObservation = Symbol("checked mutation directory observation");
+const directoryObservers = new WeakMap();
 function identity(stat) {
     return Object.freeze({ dev: stat.dev, ino: stat.ino, mode: stat.mode, nlink: stat.nlink });
 }
@@ -17,8 +18,7 @@ function directoryMode(mode) {
 }
 function absent(pathname) {
     try {
-        fs.lstatSync(pathname);
-        return false;
+        return fs.lstatSync(pathname, { throwIfNoEntry: false }) === undefined;
     }
     catch (error) {
         // ENOTDIR is incomplete evidence, not a missing child of a directory.
@@ -35,35 +35,25 @@ export function nextMissingMutationPath(observation) {
 // Callers may construct this only from their just-completed exact pathname and
 // canonical fences. The private brand prevents unverified structural objects
 // from advancing an admission epoch.
-export function checkedMutationDirectory(pathname, canonicalPath, stat) {
-    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+export function checkedMutationDirectory(pathname, canonicalPath, stat, observeCurrent) {
+    if (!directoryMode(stat.mode)) {
         throw new TypeError("mutation directory evidence must describe a real directory");
     }
-    return Object.freeze({
+    const observation = Object.freeze({
         path: pathname,
         canonicalPath,
         identity: identity(stat),
         [checkedDirectoryObservation]: true,
     });
+    if (observeCurrent)
+        directoryObservers.set(observation, observeCurrent);
+    return observation;
 }
 function checkedDirectory(observation) {
     return observation[checkedDirectoryObservation] === true &&
         path.isAbsolute(observation.path) && path.isAbsolute(observation.canonicalPath) &&
         directoryMode(observation.identity.mode);
 }
-export function mutationDirectoryObservationCurrent(observation) {
-    if (!checkedDirectory(observation))
-        return false;
-    try {
-        const stat = inspectFileIdentitySync(() => fs.lstatSync(observation.path, { bigint: true }));
-        return stat.isDirectory() && !stat.isSymbolicLink() &&
-            sameIdentity(observation.identity, stat) &&
-            realpathSync.native(observation.path) === observation.canonicalPath;
-    }
-    catch {
-        return false;
-    }
-}
 export function mutationObservationUsesDirectory(observation, directory) {
     return checkedDirectory(directory) &&
         observation.ancestor === directory.path &&
@@ -118,6 +108,79 @@ export function mutationObservationCurrent(observation) {
         return false;
     }
 }
+// Share only ordinary spelling observations collected in this synchronous
+// phase. Aliases retain their independent raw/canonical binding checks, and no
+// fact escapes this call or crosses an authority callback or mutation.
+export function mutationObservationsCurrent(observations, directories) {
+    const groups = new Map();
+    const groupFor = (pathname) => {
+        let group = groups.get(pathname);
+        if (!group) {
+            group = { observations: [], directories: [] };
+            groups.set(pathname, group);
+        }
+        return group;
+    };
+    try {
+        for (const observation of observations) {
+            if (observation.ancestor !== observation.canonicalAncestor) {
+                if (!mutationObservationCurrent(observation))
+                    return false;
+            }
+            else {
+                groupFor(observation.ancestor).observations.push(observation);
+            }
+        }
+        for (const directory of directories) {
+            if (!checkedDirectory(directory))
+                return false;
+            groupFor(directory.path).directories.push(directory);
+        }
+        const current = (pathname, group) => {
+            const missing = new Set(group.observations.flatMap((observation) => {
+                const next = nextMissingMutationPath(observation);
+                return next === undefined ? [] : [next];
+            }));
+            // Exact directory roles are the end fence. Observe missing children
+            // before refreshing that parent, matching the ordered admission fence.
+            if (group.directories.length && ![...missing].every(absent))
+                return false;
+            const observed = group.directories.length
+                ? directoryObservers.get(group.directories[0])?.() : undefined;
+            const stat = observed?.identity ??
+                inspectFileIdentitySync(() => fs.lstatSync(pathname, { bigint: true }));
+            const canonical = observed?.canonicalPath ?? realpathSync.native(pathname);
+            const isDirectory = directoryMode(stat.mode);
+            if (!group.observations.every((observation) => canonical === observation.canonicalAncestor &&
+                sameIdentity(observation.entry, stat, isDirectory) &&
+                sameIdentity(observation.identity, stat, isDirectory) &&
+                (missingMutationSegments(observation) === 0 || isDirectory)))
+                return false;
+            if (!group.directories.every((directory) => isDirectory &&
+                sameIdentity(directory.identity, stat) && canonical === directory.canonicalPath))
+                return false;
+            return group.directories.length > 0 || [...missing].every(absent);
+        };
+        for (const [pathname, group] of groups) {
+            if (!group.directories.length && !current(pathname, group))
+                return false;
+        }
+        // Preserve the supplied parent/child order, even when a directory also
+        // appeared earlier as the Root or a denied path's nearest ancestor.
+        const checked = new Set();
+        for (const directory of directories) {
+            if (checked.has(directory.path))
+                continue;
+            if (!current(directory.path, groups.get(directory.path)))
+                return false;
+            checked.add(directory.path);
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 // This is deliberately a pure tentative update. The immediately following
 // parent authorization validates the complete epoch once before reusing it.
 export function advanceMutationObservation(observation, parent, child) {

package/dist/pinned-mutation-shared-route.d.ts

@@ -9,6 +9,7 @@ type SharedMutationPolicy = Readonly<{
     denyMutations?: DenyMutationPolicy;
     mutationSymlinks?: MutationSymlinkPolicy;
 }>;
+export declare function ordinaryWindowsSegments(relativePath: string): boolean;
 export declare function ordinarySharedAbsoluteInsideRoot(rootReal: string, candidatePath: string, rootIdentity: ExactRootIdentity): boolean;
 export declare function simpleSharedRoute(params: {
     rootReal: string;