@openclaw/fs-safe 0.16.0 → 0.18.0

package/dist/move-path.js

@@ -2,10 +2,10 @@ import { randomUUID } from "node:crypto";
 import fsSync, { constants as fsConstants } from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { createAsyncDirectoryGuard, inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { assertSyncDirectoryGuard, createAsyncDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { guardedRename } from "./guarded-mutation.js";
-import { assertSourceStillMatches, cleanupCopiedEntry, createCleanupCopiedEntryState, entryIdentity, sameIdentity, sourceChangedError, } from "./move-path-cleanup.js";
+import { assertSourceStillMatches, cleanupCopiedEntry, createCleanupCopiedEntryState, entryIdentity, inspectSourceDirectory, inspectSourceEntry, sameIdentity, sourceChangedError, } from "./move-path-cleanup.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { realpathSync } from "./realpath.js";
 import { cleanupPinnedFilePath } from "./file-cleanup.js";
@@ -57,7 +57,7 @@ function isSameOrDescendant(parentPath, candidatePath) {
         (!path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== ".."));
 }
 async function assertCopyDestinationOutsideSource(sourcePath, targetPath, expectedIdentity) {
-    const sourceStat = fsSync.lstatSync(sourcePath);
+    const sourceStat = inspectSourceEntry(sourcePath, () => fsSync.lstatSync(sourcePath, { bigint: true }));
     const sourceIdentity = entryIdentity(sourceStat);
     if (expectedIdentity && !sameIdentity(expectedIdentity, sourceIdentity)) {
         throw sourceChangedError(sourcePath);
@@ -80,7 +80,7 @@ async function assertCopyDestinationOutsideSource(sourcePath, targetPath, expect
     return sourceIdentity;
 }
 function modeBits(mode) {
-    return mode & 0o777;
+    return Number(mode & 511n);
 }
 async function chmodDirectoryPinned(directoryPath, mode) {
     if (process.platform === "win32") {
@@ -120,21 +120,25 @@ async function copyRegularFilePinned(params) {
         throw error;
     }
     try {
-        const openedStat = fsSync.fstatSync(sourceHandle.fd);
+        const inspectOpenedSource = () => inspectSourceEntry(params.from, () => {
+            const stat = fsSync.fstatSync(sourceHandle.fd, { bigint: true });
+            if (params.rejectHardlinks && stat.nlink > 1n)
+                throw hardlinkedSourceError(params.from);
+            if (!stat.isFile())
+                throw sourceChangedError(params.from);
+            return stat;
+        });
+        const openedStat = inspectOpenedSource();
         openedIdentity = entryIdentity(openedStat);
-        if (params.rejectHardlinks && openedStat.nlink > 1) {
-            throw hardlinkedSourceError(params.from);
-        }
         const openAdvancedWindowsCtime = process.platform === "win32" &&
             params.identity.dev === openedIdentity.dev &&
             params.identity.ino === openedIdentity.ino &&
             params.identity.mode === openedIdentity.mode &&
             params.identity.nlink === openedIdentity.nlink &&
             params.identity.size === openedIdentity.size &&
-            params.identity.mtimeMs === openedIdentity.mtimeMs &&
-            openedIdentity.ctimeMs >= params.identity.ctimeMs;
-        if (!openedStat.isFile() ||
-            (!sameIdentity(params.identity, openedIdentity) && !openAdvancedWindowsCtime)) {
+            params.identity.mtimeNs === openedIdentity.mtimeNs &&
+            openedIdentity.ctimeNs >= params.identity.ctimeNs;
+        if (!sameIdentity(params.identity, openedIdentity) && !openAdvancedWindowsCtime) {
             throw sourceChangedError(params.from);
         }
         await assertSourceStillMatches(params.from, openedIdentity);
@@ -154,11 +158,7 @@ async function copyRegularFilePinned(params) {
             }
             // Re-check the opened source before the staged tree can be committed. If
             // it changed while we copied, the caller should retry the move.
-            const finalSourceStat = fsSync.fstatSync(sourceHandle.fd);
-            if (params.rejectHardlinks && finalSourceStat.nlink > 1) {
-                throw hardlinkedSourceError(params.from);
-            }
-            if (!sameIdentity(openedIdentity, entryIdentity(finalSourceStat))) {
+            if (!sameIdentity(openedIdentity, inspectOpenedSource())) {
                 throw sourceChangedError(params.from);
             }
             await destinationHandle.chmod(modeBits(params.mode));
@@ -178,21 +178,8 @@ async function copyRegularFilePinned(params) {
     }
     return openedIdentity;
 }
-function inspectSourceDirectory(sourcePath, expected) {
-    try {
-        return inspectDirectoryIdentitySync(sourcePath, expected);
-    }
-    catch (error) {
-        const code = error?.code;
-        if (code === "ENOENT" || code === "ENOTDIR" ||
-            (error instanceof FsSafeError && (error.code === "path-mismatch" || error.code === "not-file"))) {
-            throw sourceChangedError(sourcePath);
-        }
-        throw error;
-    }
-}
 async function copyEntryWithManifest(from, to, options, expectedIdentity) {
-    const sourceStat = fsSync.lstatSync(from);
+    const sourceStat = inspectSourceEntry(from, () => fsSync.lstatSync(from, { bigint: true }));
     const identity = entryIdentity(sourceStat);
     if (expectedIdentity && !sameIdentity(expectedIdentity, identity)) {
         throw sourceChangedError(from);
@@ -208,8 +195,7 @@ async function copyEntryWithManifest(from, to, options, expectedIdentity) {
         return { ...identity, kind: "leaf" };
     }
     if (sourceStat.isDirectory()) {
-        const directoryStat = inspectSourceDirectory(from);
-        const directoryIdentity = Object.freeze({ dev: directoryStat.dev, ino: directoryStat.ino });
+        const directoryIdentity = Object.freeze({ dev: sourceStat.dev, ino: sourceStat.ino });
         await fs.mkdir(to, { mode: modeBits(sourceStat.mode) || 0o755 });
         options.onCreated?.(fsSync.lstatSync(to, { bigint: true }));
         const children = [];
@@ -226,6 +212,7 @@ async function copyEntryWithManifest(from, to, options, expectedIdentity) {
                 name: child,
                 manifest: await copyEntryWithManifest(path.join(from, child), path.join(to, child), {
                     sourceHardlinks: options.sourceHardlinks, budget: options.budget,
+                    aliases: options.aliases,
                 }),
             });
         }
@@ -241,9 +228,13 @@ async function copyEntryWithManifest(from, to, options, expectedIdentity) {
     if (!sourceStat.isFile()) {
         throw new Error(`Refusing to move non-file path with copy fallback: ${from}`);
     }
-    if (options.sourceHardlinks === "reject" && sourceStat.nlink > 1) {
+    if (options.sourceHardlinks === "reject" && sourceStat.nlink > 1n) {
         throw hardlinkedSourceError(from);
     }
+    const aliasKey = options.aliases && identity.nlink > 1n ? `${identity.dev}:${identity.ino}` : undefined;
+    const alias = aliasKey ? options.aliases.get(aliasKey) : undefined;
+    if (alias && !sameIdentity(alias, identity))
+        throw sourceChangedError(from);
     const copiedIdentity = await copyRegularFilePinned({
         from,
         identity,
@@ -252,7 +243,14 @@ async function copyEntryWithManifest(from, to, options, expectedIdentity) {
         to,
         onCreated: options.onCreated,
     });
-    return { ...copiedIdentity, kind: "leaf" };
+    // A permitted Windows open advances every name's ctime. Share its receipt
+    // only after the preceding fingerprint and this complete copy were verified.
+    if (alias)
+        return Object.assign(alias, copiedIdentity);
+    const manifest = { ...copiedIdentity, kind: "leaf" };
+    if (aliasKey)
+        options.aliases.set(aliasKey, manifest);
+    return manifest;
 }
 function assertSynchronousResult(returned, name) {
     if (returned !== undefined) {
@@ -275,13 +273,13 @@ export async function movePathWithCopyFallback(options) {
     const callerPublished = options.onDestinationPublished;
     let assertionRejected = false;
     let destinationPublished = false;
-    const assertBeforeMutation = () => {
-        assertSynchronousResult(callerMutationAssert?.(), "assertBeforeMutation");
+    const assertBeforeMutation = callerMutationAssert == null ? undefined : () => {
+        assertSynchronousResult(callerMutationAssert(), "assertBeforeMutation");
     };
     const assertBeforeRename = () => {
         try {
             assertSynchronousResult(callerRenameAssert?.(), "assertBeforeRename");
-            assertBeforeMutation();
+            assertBeforeMutation?.();
         }
         catch (error) {
             assertionRejected = true;
@@ -332,6 +330,29 @@ export async function movePathWithCopyFallback(options) {
         // never become the published target; the copy loop fences nlink again.
     }
     const sourceIdentity = await assertCopyDestinationOutsideSource(sourcePath, targetPath);
+    const sourceParentPath = path.dirname(sourcePath);
+    const sourceParent = assertBeforeMutation || callerRenameAssert || callerPublished
+        ? await createAsyncDirectoryGuard(realpathSync.native(sourceParentPath), { bigint: true })
+        : undefined;
+    const assertSourceParent = sourceParent ? () => {
+        try {
+            if (realpathSync.native(sourceParentPath) !== sourceParent.realPath)
+                throw sourceChangedError(sourcePath);
+            assertSyncDirectoryGuard(sourceParent);
+        }
+        catch (error) {
+            const code = error?.code;
+            if (code === "ENOENT" || code === "ENOTDIR" || code === "ELOOP" ||
+                (error instanceof FsSafeError && (error.code === "path-mismatch" || error.code === "not-file"))) {
+                throw sourceChangedError(sourcePath);
+            }
+            throw error;
+        }
+    } : undefined;
+    const assertBeforeCleanup = assertSourceParent ? () => {
+        assertBeforeMutation?.();
+        assertSourceParent();
+    } : undefined;
     const targetDir = path.dirname(targetPath);
     const staged = path.join(targetDir, `.fs-safe-move-${process.pid}-${randomUUID()}.tmp`);
     const stage = await createMoveStageOwner(staged);
@@ -339,6 +360,7 @@ export async function movePathWithCopyFallback(options) {
         const manifest = await copyEntryWithManifest(sourcePath, staged, {
             sourceHardlinks: rejectHardlinks ? "reject" : "allow",
             onCreated: stage.record,
+            ...(!rejectHardlinks && process.platform === "win32" ? { aliases: new Map() } : {}),
             ...(rejectHardlinks ? { budget: { discovered: 1 } } : {}),
         }, sourceIdentity);
         const cleanupState = createCleanupCopiedEntryState(sourcePath, manifest);
@@ -355,7 +377,8 @@ export async function movePathWithCopyFallback(options) {
                 onRenamed();
             },
         });
-        const cleanupResult = await cleanupCopiedEntry(sourcePath, manifest, cleanupState, assertBeforeMutation);
+        assertSourceParent?.();
+        const cleanupResult = await cleanupCopiedEntry(sourcePath, manifest, cleanupState, assertBeforeCleanup);
         if (cleanupResult === "stale") {
             throw sourceChangedError(sourcePath);
         }

package/dist/mutation-authority.d.ts

@@ -6,4 +6,3 @@ export declare class MutationAuthorityError extends FsSafeError {
 export declare function assertSynchronousCallbackResult(returned: unknown, name: string): void;
 export declare function composeMutationAssertions(defaultAssertion?: () => void, callAssertion?: () => void): (() => void) | undefined;
 export declare function rethrowMutationAuthorityError(error: unknown): never;
-//# sourceMappingURL=mutation-authority.d.ts.map

package/dist/native-binding.d.ts

@@ -160,4 +160,3 @@ export interface NativeBinding {
     sha256File(fd: number, maxBytes?: number, signal?: AbortSignal): Promise<NativeFileHash>;
 }
 export declare function captureNativeFdClose(binding: NativeBinding): (fd: number) => void;
-//# sourceMappingURL=native-binding.d.ts.map

package/dist/native-config.d.ts

@@ -14,4 +14,3 @@ export declare function configureFsSafeNative(config: Partial<FsSafeNativeConfig
 export declare function configureFsSafePython(config: Partial<FsSafePythonConfig>): void;
 export declare function getFsSafeNativeConfig(): FsSafeNativeConfig;
 export declare function __resetFsSafeNativeConfigForTest(): void;
-//# sourceMappingURL=native-config.d.ts.map

package/dist/native-directory-observation.d.ts

@@ -14,4 +14,3 @@ export declare function getNativeDirectoryObservationBackend(enabled?: boolean):
 export declare function inspectNativeDirectoryObservation(backend: NativeDirectoryObservationBackend, pathname: string, expected?: ExactStatIdentity, platform?: NodeJS.Platform): NativeDirectoryObservation;
 export declare function extendNativeDirectoryObservationGuard(observation: NativeDirectoryObservation, dir: string): NativeDirectoryObservationGuard;
 export declare function isNativeDirectoryObservationGuard(guard: unknown): guard is NativeDirectoryObservationGuard;
-//# sourceMappingURL=native-directory-observation.d.ts.map

package/dist/native-fallback-warning.d.ts

@@ -1,4 +1,3 @@
 /** Warn once per capability, without including caller paths or native error text. */
 export declare function warnNativeFallback(feature: string, limitation: string): void;
 export declare function __resetNativeFallbackWarningsForTest(): void;
-//# sourceMappingURL=native-fallback-warning.d.ts.map

package/dist/native-operations.d.ts

@@ -1,10 +1,7 @@
-import { type BigIntStats, type Stats } from "node:fs";
-import type { ContainmentGuarantee } from "./containment.js";
+import { type BigIntStats } from "node:fs";
 export type NativeFileHandle = {
     readonly fd: number;
-    readonly containment: ContainmentGuarantee;
     close(): Promise<void>;
-    stat(): Promise<Stats>;
     writeFile(data: string | Buffer, encoding?: BufferEncoding): Promise<void>;
 };
 export declare function nativeOpenFlags(flags: number): number;
@@ -16,4 +13,3 @@ export declare function removeNativeCreatedFileIfStillPinned(params: {
     created?: BigIntStats;
 }): void;
 export declare function createNativeExclusiveFile(targetPath: string, mode: number): Promise<NativeFileHandle | undefined>;
-//# sourceMappingURL=native-operations.d.ts.map

package/dist/native-operations.js

@@ -21,20 +21,16 @@ export function writeNativeFd(fd, data) {
         offset += written;
     }
 }
-function wrapNativeFd(fd, containment, closeFd) {
+function wrapNativeFd(fd, closeFd) {
     let open = true;
     return {
         fd,
-        containment,
         async close() {
             if (open) {
                 open = false;
                 closeFd(fd);
             }
         },
-        async stat() {
-            return fsSync.fstatSync(fd);
-        },
         async writeFile(data, encoding) {
             writeNativeFd(fd, Buffer.isBuffer(data) ? data : Buffer.from(data, encoding ?? "utf8"));
         },
@@ -91,7 +87,7 @@ export async function createNativeExclusiveFile(targetPath, mode) {
         fd = opened.fd;
         fsSync.fchmodSync(fd, mode);
         created = fsSync.fstatSync(fd, { bigint: true });
-        return wrapNativeFd(fd, opened.containment, closeFd);
+        return wrapNativeFd(fd, closeFd);
     }
     catch (error) {
         if (fd !== undefined) {

package/dist/native-parent-admission.d.ts

@@ -32,4 +32,3 @@ export declare function openNativeParentAdmission(binding: NativeBinding, rootAd
     root: Pick<FileHandle, "fd">;
 }, relativeParentPath: string, observation?: "native-directory"): Promise<NativeParentAdmission>;
 export {};
-//# sourceMappingURL=native-parent-admission.d.ts.map

package/dist/native-pinned-write-windows.d.ts

@@ -4,4 +4,3 @@ import type { FileIdentityStat } from "./file-identity.js";
 import type { NativeBinding } from "./native.js";
 import type { PinnedWriteParams } from "./pinned-write.js";
 export declare function runPinnedWriteWindows(binding: NativeBinding, params: PinnedWriteParams, root: FileHandle, parentFd: number, parentGuard: AnyAsyncDirectoryGuard): Promise<FileIdentityStat>;
-//# sourceMappingURL=native-pinned-write-windows.d.ts.map

package/dist/native-pinned-write.d.ts

@@ -2,4 +2,3 @@ import type { FileIdentityStat } from "./file-identity.js";
 import type { NativeBinding } from "./native.js";
 import type { PinnedWriteParams } from "./pinned-write.js";
 export declare function runPinnedWriteNative(binding: NativeBinding, params: PinnedWriteParams): Promise<FileIdentityStat>;
-//# sourceMappingURL=native-pinned-write.d.ts.map

package/dist/native-pinned-write.js

@@ -66,12 +66,6 @@ import { realpathSync } from "./realpath.js";
 import { isNotFoundPathError, isSymlinkOpenError } from "./path.js";
 import { checkedMutationDirectory, } from "./pinned-mutation-observation.js";
 import { createPathSegmentRoute, joinPathSegmentRoute } from "./path-segment-route.js";
-function relativeParentSegments(relativeParentPath) {
-    return relativeParentPath.split("/").filter(Boolean);
-}
-function prospectiveTargetPath(parentPath, parentRoute, offset, basename) {
-    return joinPathSegmentRoute(parentPath, parentRoute, offset, basename);
-}
 function sameAbsolutePath(left, right) {
     return path.relative(path.resolve(left), path.resolve(right)) === "";
 }
@@ -172,12 +166,12 @@ async function capturePolicyAwarePosixParent(binding, params, rootFd, directoryF
                 observationDisposers.set(fd, dispose);
             return captured;
         };
-        const segments = relativeParentSegments(params.relativeParentPath);
+        const segments = params.relativeParentPath.split("/").filter(Boolean);
         const parentSpelling = segments.length
             ? path.join(params.rootPath, ...segments)
             : params.rootPath;
         const segmentRoute = createPathSegmentRoute(segments);
-        const initialTarget = prospectiveTargetPath(params.rootPath, segmentRoute, 0, params.basename);
+        const initialTarget = joinPathSegmentRoute(params.rootPath, segmentRoute, 0, params.basename);
         let retainedTargetPath = params.mutationAdmission?.beginParentWalk?.();
         if (retainedTargetPath && !sameAbsolutePath(retainedTargetPath, initialTarget)) {
             retainedTargetPath = undefined;
@@ -255,7 +249,7 @@ async function capturePolicyAwarePosixParent(binding, params, rootFd, directoryF
                     if (!isNotFoundPathError(openError)) {
                         throw normalizePolicyParentOpenError(openError, params);
                     }
-                    const targetPath = retainedTargetPath ?? prospectiveTargetPath(currentPath, segmentRoute, index, params.basename);
+                    const targetPath = retainedTargetPath ?? joinPathSegmentRoute(currentPath, segmentRoute, index, params.basename);
                     const request = Object.freeze({
                         targetPath,
                         mutationPath: childPath,
@@ -311,7 +305,7 @@ async function capturePolicyAwarePosixParent(binding, params, rootFd, directoryF
                             childAuthorization = params.mutationAdmission.advanceCreatedDirectory(evidence);
                         }
                     }
-                    const targetPath = retainedTargetPath ?? prospectiveTargetPath(child.parentPath, segmentRoute, index + 1, params.basename);
+                    const targetPath = retainedTargetPath ?? joinPathSegmentRoute(child.parentPath, segmentRoute, index + 1, params.basename);
                     const request = Object.freeze({
                         targetPath,
                         mutationPath: targetPath,

package/dist/native-policy-directory-observation.d.ts

@@ -9,4 +9,3 @@ export type NativePolicyDirectoryObserver = MutationDirectoryObserver & {
 };
 /** Fresh name/metadata/canonical facts from a caller-owned POSIX descriptor. */
 export declare function nativePolicyDirectoryObserver(binding: NativeBinding | undefined, fd: number, pathname: string): NativePolicyDirectoryObserver | undefined;
-//# sourceMappingURL=native-policy-directory-observation.d.ts.map

package/dist/native-policy-parent-windows.d.ts

@@ -11,4 +11,3 @@ type PolicyParent = {
 };
 export declare function capturePolicyAwareWindowsParent(binding: NativeBinding, params: PinnedWriteParams, rootAdmission: NativeRootAdmission): Promise<PolicyParent>;
 export {};
-//# sourceMappingURL=native-policy-parent-windows.d.ts.map

package/dist/native-rename-outcome.d.ts

@@ -1,4 +1,3 @@
 export declare const NATIVE_RENAME_SOURCE_IDENTITY_MISMATCH = "FS_SAFE_INTERNAL_RENAME_SOURCE_IDENTITY_MISMATCH";
 export type NativeRenameFailureOutcome = "uncommitted" | "indeterminate";
 export declare function classifyNativeRenameFailure(error: unknown): NativeRenameFailureOutcome;
-//# sourceMappingURL=native-rename-outcome.d.ts.map

package/dist/native-staged-file.d.ts

@@ -1,4 +1,5 @@
 import type { DirectoryReceipt } from "./directory-durability.js";
+import { type BigIntStats, type Stats } from "node:fs";
 import type { AnyAsyncDirectoryGuard } from "./directory-guard.js";
 import type { FileIdentityStat } from "./file-identity.js";
 import { type NativeBinding } from "./native-binding.js";
@@ -7,10 +8,23 @@ import type { PublishedFileReceipt, StagedFile, StagedFileCleanupReceipt, Staged
 export type NativeStagingBinding = NativeBinding & Required<Pick<NativeBinding, "createStagedFile" | "stagedFileMatches" | "removeStagedFile">>;
 export declare function assertNativeStaging(binding: NativeBinding): asserts binding is NativeStagingBinding;
 type StagedPermissionPolicy = "private-creation" | "mode-only";
+type NativeStageOwner = Readonly<{
+    binding: NativeStagingBinding;
+    parentFd: number;
+    closeParentFd: (fd: number) => void;
+    directory: StagedFileReceipt["directory"];
+    portableNames?: boolean;
+    mode: number;
+    sync?: boolean;
+    strictFileSync?: boolean;
+    assertBeforeMutation?: () => void;
+    permissionPolicy?: StagedPermissionPolicy;
+    name?: string;
+}>;
 declare class NativeStagedFile implements StagedFile {
     #private;
-    constructor(binding: NativeStagingBinding, parentFd: number, closeParentFd: (fd: number) => void, directory: StagedFileReceipt["directory"], portableNames: boolean, publishedMode: number, sync: boolean, assertBeforeMutation?: () => void, name?: string, strictFileSync?: boolean, permissionPolicy?: StagedPermissionPolicy);
-    static create(binding: NativeStagingBinding, parentFd: number, closeParentFd: (fd: number) => void, directory: StagedFileReceipt["directory"], input: PinnedWriteInput, mode: number, maxBytes?: number, portableNames?: boolean, sync?: boolean, assertBeforeMutation?: () => void, exclusiveBasename?: string, strictFileSync?: boolean, permissionPolicy?: StagedPermissionPolicy): Promise<NativeStagedFile>;
+    constructor(owner: NativeStageOwner);
+    static create(owner: NativeStageOwner, input: PinnedWriteInput, maxBytes?: number): Promise<NativeStagedFile>;
     static write(binding: NativeStagingBinding, parentFd: number, closeParentFd: (fd: number) => void, directory: StagedFileReceipt["directory"], params: PinnedWriteParams, parentGuard: AnyAsyncDirectoryGuard): Promise<FileIdentityStat>;
     get receipt(): StagedFileReceipt;
     assertCurrent(): Promise<void>;
@@ -24,9 +38,8 @@ export declare const createNativeStage: (...args: Parameters<typeof NativeStaged
 export declare const writeNativeStage: typeof NativeStagedFile.write;
 export type { PublishedFileReceipt, StagedFile, StagedFileCleanupReceipt, StagedFileFailureDetails, StagedFilePublication, StagedFileReceipt, } from "./staged-file-types.js";
 export declare function stageFileInDirectory(options: {
-    directory: string | DirectoryReceipt;
+    directory: string | DirectoryReceipt<Stats | BigIntStats>;
     content: string | Uint8Array;
     /** Published mode; the unpublished stage stays at 0600. Defaults to 0600. */
     mode?: number;
 }): Promise<StagedFile>;
-//# sourceMappingURL=native-staged-file.d.ts.map