@openclaw/fs-safe 0.5.0 → 0.5.2

package/dist/permissions.js

@@ -1,52 +1,6 @@
-import { execFile } from "node:child_process";
 import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { promisify } from "node:util";
-import { normalizeLowercaseStringOrEmpty } from "./string-coerce.js";
-import { inspectWindowsPermissionsNative } from "./windows-permissions-native.js";
-import { resolveWindowsSystemCommand } from "./windows-command.js";
-import { inspectWindowsOwner, resolveWindowsCurrentUserSid, resolveWindowsPrincipalSids, } from "./windows-owner.js";
-const execFileAsync = promisify(execFile);
-const INHERIT_FLAGS = new Set(["I", "OI", "CI", "IO", "NP"]);
-const WORLD_PRINCIPALS = new Set(["everyone", "users", "builtin\\users", "authenticated users", "nt authority\\authenticated users", "anonymous logon", "nt authority\\anonymous logon", "guests", "builtin\\guests", "interactive", "nt authority\\interactive", "network", "nt authority\\network", "local"]);
-const TRUSTED_BASE = new Set([
-    "nt authority\\system",
-    "system",
-    "builtin\\administrators",
-    "creator owner",
-    "autorite nt\\système",
-    "nt-autorität\\system",
-    "autoridad nt\\system",
-    "autoridade nt\\system",
-]);
-const WORLD_SUFFIXES = ["\\users", "\\authenticated users"];
-const SID_RE = /^\*?s-\d+-\d+(-\d+)+$/i;
-const TRUSTED_SIDS = new Set([
-    "s-1-5-18",
-    "s-1-5-32-544",
-    "s-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464",
-]);
-const WORLD_SIDS = new Set(["s-1-1-0", "s-1-5-11", "s-1-5-32-545", "s-1-5-7", "s-1-5-32-546", "s-1-5-4", "s-1-2-0", "s-1-5-2"]);
-const STATUS_PREFIXES = [
-    "successfully processed",
-    "processed",
-    "failed processing",
-    "no mapping between account names",
-];
-function stripDiacritics(value) {
-    return value.normalize("NFD").replace(/[\u0300-\u036f]/g, "");
-}
-const TRUSTED_BASE_ASCII = new Set([...TRUSTED_BASE].map(stripDiacritics));
-const normalize = (value) => normalizeLowercaseStringOrEmpty(value);
-const defaultWindowsUserInfo = () => os.userInfo();
-function defaultPermissionExec(command, args) {
-    return execFileAsync(command, args, {
-        encoding: "utf8",
-        windowsHide: true,
-        maxBuffer: 1024 * 1024,
-    });
-}
+import { formatIcaclsResetCommand, inspectWindowsPermissions, } from "./permissions-windows.js";
+export { createIcaclsResetCommand, formatIcaclsResetCommand, formatWindowsAclSummary, inspectWindowsAcl, parseIcaclsOutput, resolveWindowsUserPrincipal, summarizeWindowsAcl, } from "./permissions-windows.js";
 export async function safeStat(targetPath) {
     try {
         const lst = await fs.lstat(targetPath);
@@ -103,58 +57,14 @@ export async function inspectPathPermissions(targetPath, opts) {
     const bits = modeBits(effectiveMode);
     const platform = opts?.platform ?? process.platform;
     if (platform === "win32") {
-        const native = inspectWindowsPermissionsNative({
-            targetPath, stat: st, effectiveIsDir, effectiveMode, bits,
-        });
-        if (native)
-            return native;
-        const owner = await inspectWindowsOwner({
+        return await inspectWindowsPermissions({
             targetPath,
-            env: opts?.env,
-            exec: opts?.exec ?? defaultPermissionExec,
-        });
-        const acl = await inspectWindowsAcl(targetPath, {
-            env: opts?.env,
-            exec: opts?.exec,
-            currentUserSid: owner.currentUserSid,
-            principalSids: owner.principalSids,
-            principalTranslationFailed: owner.principalTranslationFailed,
-        });
-        const ownerFields = {
-            ...(owner.sid ? { ownerSid: owner.sid } : {}),
-            ...(owner.trusted !== undefined ? { ownerTrusted: owner.trusted } : {}),
-            ...(owner.error ? { ownerError: owner.error } : {}),
-        };
-        if (!acl.ok) {
-            return {
-                ok: true,
-                isSymlink: st.isSymlink,
-                isDir: effectiveIsDir,
-                mode: effectiveMode,
-                bits,
-                source: "unknown",
-                worldWritable: false,
-                groupWritable: false,
-                worldReadable: false,
-                groupReadable: false,
-                ...ownerFields,
-                error: acl.error,
-            };
-        }
-        return {
-            ok: true,
-            isSymlink: st.isSymlink,
-            isDir: effectiveIsDir,
-            mode: effectiveMode,
+            stat: st,
+            effectiveIsDir,
+            effectiveMode,
             bits,
-            source: "windows-acl",
-            worldWritable: acl.untrustedWorld.some((entry) => entry.canWrite),
-            groupWritable: acl.untrustedGroup.some((entry) => entry.canWrite),
-            worldReadable: acl.untrustedWorld.some((entry) => entry.canRead),
-            groupReadable: acl.untrustedGroup.some((entry) => entry.canRead),
-            ...ownerFields,
-            aclSummary: formatWindowsAclSummary(acl),
-        };
+            opts,
+        });
     }
     return {
         ok: true,
@@ -182,7 +92,15 @@ export function formatPermissionRemediation(params) {
             env: params.env,
         });
     }
-    return `chmod ${params.posixMode.toString(8).padStart(3, "0")} ${params.targetPath}`;
+    const optionSeparator = params.targetPath.startsWith("-") ? "-- " : "";
+    return (`chmod ${params.posixMode.toString(8).padStart(3, "0")} ${optionSeparator}` +
+        formatPosixShellArgument(params.targetPath));
+}
+function formatPosixShellArgument(value) {
+    if (value && /^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) {
+        return value;
+    }
+    return `'${value.replaceAll("'", `'\\''`)}'`;
 }
 export function modeBits(mode) {
     return mode == null ? null : mode & 0o777;
@@ -202,232 +120,3 @@ export function isWorldReadable(bits) {
 export function isGroupReadable(bits) {
     return bits != null && (bits & 0o040) !== 0;
 }
-function normalizeSid(value) {
-    const normalized = normalize(value);
-    return normalized.startsWith("*") ? normalized.slice(1) : normalized;
-}
-export function resolveWindowsUserPrincipal(env, userInfo = defaultWindowsUserInfo) {
-    const username = env?.USERNAME?.trim() || userInfo().username?.trim();
-    if (!username) {
-        return null;
-    }
-    const domain = env?.USERDOMAIN?.trim();
-    return domain ? `${domain}\\${username}` : username;
-}
-function buildTrustedPrincipals(env) {
-    const trusted = new Set(TRUSTED_BASE);
-    const principal = resolveWindowsUserPrincipal(env);
-    if (principal) {
-        trusted.add(normalize(principal));
-        const userOnly = principal.split("\\").at(-1);
-        if (userOnly) {
-            trusted.add(normalize(userOnly));
-        }
-    }
-    const userSid = normalizeSid(env?.USERSID ?? "");
-    if (userSid && SID_RE.test(userSid) && !WORLD_SIDS.has(userSid)) {
-        trusted.add(userSid);
-    }
-    return trusted;
-}
-function classifyPrincipal(principal, trustedPrincipals) {
-    const normalized = normalize(principal);
-    if (SID_RE.test(normalized)) {
-        const sid = normalizeSid(normalized);
-        if (WORLD_SIDS.has(sid))
-            return "world";
-        if (TRUSTED_SIDS.has(sid) || trustedPrincipals.has(sid))
-            return "trusted";
-        return "group";
-    }
-    if (trustedPrincipals.has(normalized) || TRUSTED_BASE.has(normalized)) {
-        return "trusted";
-    }
-    if (WORLD_PRINCIPALS.has(normalized) ||
-        WORLD_SUFFIXES.some((suffix) => normalized.endsWith(suffix))) {
-        return "world";
-    }
-    const stripped = stripDiacritics(normalized);
-    if (stripped !== normalized && TRUSTED_BASE_ASCII.has(stripped)) {
-        return "trusted";
-    }
-    return "group";
-}
-function rightsFromTokens(tokens) {
-    const upper = tokens.join("").toUpperCase();
-    return {
-        canWrite: upper.includes("F") || upper.includes("M") || upper.includes("W") || upper.includes("D"),
-        canRead: upper.includes("F") || upper.includes("M") || upper.includes("R"),
-    };
-}
-function stripTargetPrefix(params) {
-    if (params.lowerLine.startsWith(params.lowerTarget)) {
-        return params.trimmedLine.slice(params.normalizedTarget.length).trim();
-    }
-    if (params.lowerLine.startsWith(params.quotedLower)) {
-        return params.trimmedLine.slice(params.quotedTarget.length).trim();
-    }
-    return params.trimmedLine;
-}
-function parseAceEntry(entry) {
-    if (!entry.includes("("))
-        return null;
-    const idx = entry.indexOf(":");
-    if (idx === -1)
-        return null;
-    const principal = entry.slice(0, idx).trim();
-    const rawRights = entry.slice(idx + 1).trim();
-    const tokens = rawRights
-        .match(/\(([^)]+)\)/g)
-        ?.map((token) => token.slice(1, -1).trim())
-        .filter(Boolean) ?? [];
-    if (tokens.some((token) => token.toUpperCase() === "DENY"))
-        return null;
-    const rights = tokens.filter((token) => !INHERIT_FLAGS.has(token.toUpperCase()));
-    if (rights.length === 0)
-        return null;
-    const normalizedPrincipal = normalizeSid(principal);
-    return {
-        principal,
-        ...(SID_RE.test(normalizedPrincipal) ? { sid: normalizedPrincipal } : {}),
-        rights,
-        rawRights,
-        ...rightsFromTokens(rights),
-    };
-}
-export function parseIcaclsOutput(output, targetPath) {
-    const entries = [];
-    const normalizedTarget = targetPath.trim();
-    const lowerTarget = normalizedTarget.toLowerCase();
-    const quotedTarget = `"${normalizedTarget}"`;
-    const quotedLower = quotedTarget.toLowerCase();
-    for (const rawLine of output.split(/\r?\n/)) {
-        const line = rawLine.trimEnd();
-        if (!line.trim())
-            continue;
-        const trimmed = line.trim();
-        const lower = trimmed.toLowerCase();
-        if (STATUS_PREFIXES.some((prefix) => lower.startsWith(prefix)))
-            continue;
-        const parsed = parseAceEntry(stripTargetPrefix({
-            trimmedLine: trimmed,
-            lowerLine: lower,
-            normalizedTarget,
-            lowerTarget,
-            quotedTarget,
-            quotedLower,
-        }));
-        if (parsed)
-            entries.push(parsed);
-    }
-    return entries;
-}
-export function summarizeWindowsAcl(entries, env) {
-    const trustedPrincipals = buildTrustedPrincipals(env);
-    const trusted = [];
-    const untrustedWorld = [];
-    const untrustedGroup = [];
-    for (const entry of entries) {
-        const classification = classifyPrincipal(entry.sid ?? entry.principal, trustedPrincipals);
-        if (classification === "trusted")
-            trusted.push(entry);
-        else if (classification === "world")
-            untrustedWorld.push(entry);
-        else
-            untrustedGroup.push(entry);
-    }
-    return { trusted, untrustedWorld, untrustedGroup };
-}
-export async function inspectWindowsAcl(targetPath, opts) {
-    const exec = opts?.exec ?? defaultPermissionExec;
-    try {
-        if (opts?.principalTranslationFailed) {
-            throw new Error("Windows ACL principal SID translation failed");
-        }
-        const { stdout, stderr } = await exec(resolveWindowsSystemCommand("icacls.exe", opts?.env), [
-            targetPath,
-        ]);
-        let entries = parseIcaclsOutput(`${stdout}\n${stderr}`.trim(), targetPath);
-        const unresolvedPrincipals = entries
-            .filter((entry) => !entry.sid)
-            .map((entry) => entry.principal);
-        const principalSids = await resolveWindowsPrincipalSids({
-            principals: unresolvedPrincipals,
-            known: opts?.principalSids,
-            env: opts?.env,
-            exec,
-        });
-        entries = entries.map((entry) => {
-            const sid = entry.sid ?? principalSids[entry.principal.toLowerCase()];
-            if (!sid) {
-                throw new Error(`Windows ACL principal SID could not be verified: ${entry.principal}`);
-            }
-            return { ...entry, sid };
-        });
-        let currentUserSid = normalizeSid(opts?.currentUserSid ?? "");
-        let effectiveEnv = currentUserSid ? { USERSID: currentUserSid } : undefined;
-        let { trusted, untrustedWorld, untrustedGroup } = summarizeWindowsAcl(entries, effectiveEnv);
-        const needsUserSidResolution = !currentUserSid && untrustedGroup.some((entry) => entry.sid && !TRUSTED_SIDS.has(entry.sid));
-        if (needsUserSidResolution) {
-            currentUserSid =
-                (await resolveWindowsCurrentUserSid({ exec, env: opts?.env })) ?? "";
-            if (currentUserSid) {
-                effectiveEnv = { USERSID: currentUserSid };
-                ({ trusted, untrustedWorld, untrustedGroup } = summarizeWindowsAcl(entries, effectiveEnv));
-            }
-        }
-        return { ok: true, entries, trusted, untrustedWorld, untrustedGroup };
-    }
-    catch (err) {
-        return {
-            ok: false,
-            entries: [],
-            trusted: [],
-            untrustedWorld: [],
-            untrustedGroup: [],
-            error: String(err),
-        };
-    }
-}
-export function formatWindowsAclSummary(summary) {
-    if (!summary.ok)
-        return "unknown";
-    const untrusted = [...summary.untrustedWorld, ...summary.untrustedGroup];
-    return untrusted.length === 0
-        ? "trusted-only"
-        : untrusted.map((entry) => `${entry.principal}:${entry.rawRights}`).join(", ");
-}
-export function formatIcaclsResetCommand(targetPath, opts) {
-    const command = resolveWindowsSystemCommand("icacls.exe", opts.env);
-    const user = resolveWindowsUserPrincipal(opts.env, opts.userInfo) ?? "%USERNAME%";
-    const grant = opts.isDir ? "(OI)(CI)F" : "F";
-    return [
-        command,
-        `"${targetPath}"`,
-        "/inheritance:r",
-        "/grant:r",
-        `"${user}:${grant}"`,
-        "/grant:r",
-        `"*S-1-5-18:${grant}"`,
-    ].join(" ");
-}
-export function createIcaclsResetCommand(targetPath, opts) {
-    const user = resolveWindowsUserPrincipal(opts.env, opts.userInfo);
-    if (!user) {
-        return null;
-    }
-    const grant = opts.isDir ? "(OI)(CI)F" : "F";
-    const args = [
-        targetPath,
-        "/inheritance:r",
-        "/grant:r",
-        `${user}:${grant}`,
-        "/grant:r",
-        `*S-1-5-18:${grant}`,
-    ];
-    return {
-        command: resolveWindowsSystemCommand("icacls.exe", opts.env),
-        args,
-        display: formatIcaclsResetCommand(targetPath, opts),
-    };
-}

package/dist/pinned-write.js

@@ -69,7 +69,7 @@ export async function runPinnedWriteHelper(params) {
         return await runPinnedWriteFallback(params);
     }
     const native = getNativeBinding();
-    if (native && params.overwrite === false) {
+    if (native) {
         return await runPinnedWriteNative(native, params);
     }
     return await runPinnedWriteFallback(params);
@@ -107,6 +107,7 @@ async function runPinnedWriteFallback(params) {
         parentPath = await mkdirPathComponentsWithGuards({
             rootReal: params.rootPath,
             targetPath: parentPath,
+            beforeComponent: async (componentPath) => await getFsSafeTestHooks()?.beforeRootFallbackMutation?.("mkdir", componentPath),
         });
     }
     const parentGuard = params.mkdir

package/dist/regular-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"regular-file.d.ts","sourceRoot":"","sources":["../src/regular-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,MAAM,MAAM,SAAS,CAAC;AAW7B,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAExF,KAAK,8BAA8B,GAAG,IAAI,CACxC,OAAO,MAAM,CAAC,SAAS,EACvB,UAAU,GAAG,SAAS,GAAG,UAAU,CACpC,GACC,OAAO,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAEvD,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,wBAAgB,6BAA6B,CAC3C,SAAS,GAAE,8BAAiD,GAC3D,MAAM,CAQR;AAsBD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CActF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,CAc3E;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CAyD3C;AAoDD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,KAAK,CAAC;CACb,CAqBA;AAmBD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDxF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CA2D7E"}
+{"version":3,"file":"regular-file.d.ts","sourceRoot":"","sources":["../src/regular-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,MAAM,MAAM,SAAS,CAAC;AAW7B,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAExF,KAAK,8BAA8B,GAAG,IAAI,CACxC,OAAO,MAAM,CAAC,SAAS,EACvB,UAAU,GAAG,SAAS,GAAG,UAAU,CACpC,GACC,OAAO,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAEvD,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,wBAAgB,6BAA6B,CAC3C,SAAS,GAAE,8BAAiD,GAC3D,MAAM,CAQR;AAsBD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CActF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,CAc3E;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CAyD3C;AA6DD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,KAAK,CAAC;CACb,CA6BA;AAmBD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDxF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CA2D7E"}

package/dist/regular-file.js

@@ -133,9 +133,19 @@ function verifyStableReadTarget(params) {
 }
 function readOpenedRegularFileSync(params) {
     const stat = fsSync.fstatSync(params.fd);
+    let pathStat;
+    try {
+        pathStat = fsSync.lstatSync(params.filePath);
+    }
+    catch (error) {
+        if (isNotFoundPathError(error)) {
+            throw new FsSafeError("path-mismatch", `File changed during read: ${params.filePath}`);
+        }
+        throw error;
+    }
     verifyStableReadTarget({
         filePath: params.filePath,
-        pathStat: fsSync.lstatSync(params.filePath),
+        pathStat,
         postOpenStat: stat,
         preOpenStat: params.preOpenStat,
     });
@@ -168,7 +178,16 @@ export function readRegularFileSync(params) {
     if (params.maxBytes !== undefined && result.stat.size > params.maxBytes) {
         throw regularFileTooLargeError(params.filePath, params.maxBytes);
     }
-    const fd = fsSync.openSync(params.filePath, resolveRegularFileReadFlags());
+    let fd;
+    try {
+        fd = fsSync.openSync(params.filePath, resolveRegularFileReadFlags());
+    }
+    catch (error) {
+        if (isNotFoundPathError(error)) {
+            throw new FsSafeError("path-mismatch", `File changed during read: ${params.filePath}`);
+        }
+        throw error;
+    }
     try {
         return readOpenedRegularFileSync({
             fd,

package/dist/replace-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replace-directory.d.ts","sourceRoot":"","sources":["../src/replace-directory.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAiCf"}
+{"version":3,"file":"replace-directory.d.ts","sourceRoot":"","sources":["../src/replace-directory.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/replace-directory.js

@@ -1,11 +1,20 @@
+import { randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { guardedRename, guardedRm } from "./guarded-mutation.js";
+import { assertSafePathPrefix } from "./safe-path-segment.js";
+import { serializePathWrite } from "./write-queue.js";
 export async function replaceDirectoryAtomic(options) {
     const targetDir = path.resolve(options.targetDir);
+    await serializePathWrite(targetDir, async () => {
+        await replaceDirectoryAtomicUnserialized(options, targetDir);
+    });
+}
+async function replaceDirectoryAtomicUnserialized(options, targetDir) {
     const stagedDir = path.resolve(options.stagedDir);
     const parentDir = path.dirname(targetDir);
-    const backupDir = path.join(parentDir, `${options.backupPrefix ?? ".fs-safe-dir-backup-"}${process.pid}-${Date.now()}`);
+    const backupPrefix = assertSafePathPrefix(options.backupPrefix ?? ".fs-safe-dir-backup-", { label: "atomic directory backup prefix" });
+    const backupDir = path.join(parentDir, `${backupPrefix}${process.pid}-${randomUUID()}`);
     let backupCreated = false;
     await fs.mkdir(parentDir, { recursive: true });
     try {

package/dist/replace-file-copy-fallback.d.ts

@@ -21,6 +21,7 @@ export declare function copyFallbackReplace(params: {
     destinationHardlinks?: ReplaceFileDestinationHardlinkPolicy;
     restore: ReplaceFileCopyFallbackRestorePolicy;
     maxRestoreBytes?: number;
+    sync: boolean;
 }): Promise<void>;
 export declare function copyFallbackReplaceSync(params: {
     fsModule: SyncFallbackFs;
@@ -29,6 +30,8 @@ export declare function copyFallbackReplaceSync(params: {
     destinationHardlinks?: ReplaceFileDestinationHardlinkPolicy;
     restore: ReplaceFileCopyFallbackRestorePolicy;
     maxRestoreBytes?: number;
+    fchmodSync?: (fd: number, mode: number) => void;
+    sync: boolean;
 }): void;
 export {};
 //# sourceMappingURL=replace-file-copy-fallback.d.ts.map

package/dist/replace-file-copy-fallback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replace-file-copy-fallback.d.ts","sourceRoot":"","sources":["../src/replace-file-copy-fallback.ts"],"names":[],"mappings":"AAAA,OAAO,MAAsB,MAAM,SAAS,CAAC;AAK7C,MAAM,MAAM,oCAAoC,GAAG,QAAQ,CAAC;AAC5D,MAAM,MAAM,oCAAoC,GAAG,kBAAkB,GAAG,MAAM,CAAC;AAC/E,MAAM,MAAM,+BAA+B,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAC5E,MAAM,MAAM,sCAAsC,GAAG;IACnD,OAAO,EAAE,+BAA+B,CAAC;CAC1C,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,KAAK,EAAE,cAAc,kBAAkB,EAAE,KAAK,CAAC;IAC/C,IAAI,EAAE,cAAc,kBAAkB,EAAE,IAAI,CAAC;IAC7C,EAAE,EAAE,cAAc,kBAAkB,EAAE,EAAE,CAAC;IACzC,MAAM,EAAE,cAAc,kBAAkB,EAAE,MAAM,CAAC;CAClD,CAAC;AAEF,KAAK,cAAc,GAAG,IAAI,CACxB,OAAO,MAAM,EACX,WAAW,GACX,WAAW,GACX,WAAW,GACX,eAAe,GACf,WAAW,GACX,UAAU,GACV,UAAU,GACV,QAAQ,GACR,YAAY,GACZ,WAAW,CACd,CAAC;AAuFF,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,oCAAoC,GAC5C,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,oCAAoC,GAC5C,IAAI,CAwBN;AA0HD,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,QAAQ,EAAE,eAAe,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,oCAAoC,CAAC;IAC5D,OAAO,EAAE,oCAAoC,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDhB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,oCAAoC,CAAC;IAC5D,OAAO,EAAE,oCAAoC,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,IAAI,CA4EP"}
+{"version":3,"file":"replace-file-copy-fallback.d.ts","sourceRoot":"","sources":["../src/replace-file-copy-fallback.ts"],"names":[],"mappings":"AAAA,OAAO,MAAsB,MAAM,SAAS,CAAC;AAK7C,MAAM,MAAM,oCAAoC,GAAG,QAAQ,CAAC;AAC5D,MAAM,MAAM,oCAAoC,GAAG,kBAAkB,GAAG,MAAM,CAAC;AAC/E,MAAM,MAAM,+BAA+B,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAC5E,MAAM,MAAM,sCAAsC,GAAG;IACnD,OAAO,EAAE,+BAA+B,CAAC;CAC1C,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,KAAK,EAAE,cAAc,kBAAkB,EAAE,KAAK,CAAC;IAC/C,IAAI,EAAE,cAAc,kBAAkB,EAAE,IAAI,CAAC;IAC7C,EAAE,EAAE,cAAc,kBAAkB,EAAE,EAAE,CAAC;IACzC,MAAM,EAAE,cAAc,kBAAkB,EAAE,MAAM,CAAC;CAClD,CAAC;AAEF,KAAK,cAAc,GAAG,IAAI,CACxB,OAAO,MAAM,EACX,WAAW,GACX,WAAW,GACX,WAAW,GACX,eAAe,GACf,WAAW,GACX,UAAU,GACV,UAAU,GACV,QAAQ,GACR,YAAY,GACZ,WAAW,CACd,CAAC;AAuFF,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,oCAAoC,GAC5C,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,oCAAoC,GAC5C,IAAI,CAwBN;AAmID,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,QAAQ,EAAE,eAAe,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,oCAAoC,CAAC;IAC5D,OAAO,EAAE,oCAAoC,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CA+DhB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,oCAAoC,CAAC;IAC5D,OAAO,EAAE,oCAAoC,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,IAAI,CA6EP"}

package/dist/replace-file-copy-fallback.js

@@ -189,15 +189,18 @@ function restoreFailure(writeError, cleanup, restoreError) {
         ? `Atomic copy fallback failed; original destination restored: ${primary.message}`
         : `Atomic copy fallback failed and original restoration failed: ${primary.message}`, { cause, details });
 }
-async function replacePinnedWithRestore(handle, replacement, maxRestoreBytes) {
+async function replacePinnedWithRestore(handle, replacement, maxRestoreBytes, replacementMode) {
+    const originalMode = (await handle.stat()).mode;
     const original = await readBounded(handle, maxRestoreBytes);
     try {
         await writeAll(handle, replacement);
+        await handle.chmod(replacementMode);
         await handle.sync();
     }
     catch (writeError) {
         try {
             await writeAll(handle, original);
+            await handle.chmod(originalMode);
             await handle.sync();
             throw restoreFailure(writeError, "restored");
         }
@@ -209,15 +212,18 @@ async function replacePinnedWithRestore(handle, replacement, maxRestoreBytes) {
         }
     }
 }
-function replacePinnedWithRestoreSync(fsModule, fd, replacement, maxRestoreBytes) {
+function replacePinnedWithRestoreSync(fsModule, fd, replacement, maxRestoreBytes, replacementMode, fchmodSync) {
+    const originalMode = fsModule.fstatSync(fd).mode;
     const original = readBoundedSync(fsModule, fd, maxRestoreBytes);
     try {
         writeAllSync(fsModule, fd, replacement);
+        fchmodSync?.(fd, replacementMode);
         fsModule.fsyncSync(fd);
     }
     catch (writeError) {
         try {
             writeAllSync(fsModule, fd, original);
+            fchmodSync?.(fd, originalMode);
             fsModule.fsyncSync(fd);
             throw restoreFailure(writeError, "restored");
         }
@@ -247,7 +253,7 @@ export async function copyFallbackReplace(params) {
             const pinned = await openPinnedDestination(params.fsModule, params.dest, params.destinationHardlinks);
             if (pinned) {
                 destHandle = pinned.handle;
-                await replacePinnedWithRestore(destHandle, replacement, params.maxRestoreBytes);
+                await replacePinnedWithRestore(destHandle, replacement, params.maxRestoreBytes, sourceStat.mode);
             }
         }
         if (!destHandle) {
@@ -265,13 +271,16 @@ export async function copyFallbackReplace(params) {
             }
             destHandle = await params.fsModule.open(params.dest, OPEN_WRITE_EXCLUSIVE_FLAGS, sourceStat.mode & 0o777);
             await destHandle.writeFile(replacement);
+            await destHandle.chmod(sourceStat.mode);
+            if (params.sync) {
+                await destHandle.sync();
+            }
         }
     }
     finally {
         await destHandle?.close().catch(() => undefined);
         await sourceHandle.close().catch(() => undefined);
     }
-    await params.fsModule.unlink(params.src).catch(() => undefined);
 }
 export function copyFallbackReplaceSync(params) {
     const sourcePreview = params.fsModule.lstatSync(params.src);
@@ -291,7 +300,7 @@ export function copyFallbackReplaceSync(params) {
             const pinned = openPinnedDestinationSync(params.fsModule, params.dest, params.destinationHardlinks);
             if (pinned) {
                 destFd = pinned.fd;
-                replacePinnedWithRestoreSync(params.fsModule, destFd, replacement, params.maxRestoreBytes);
+                replacePinnedWithRestoreSync(params.fsModule, destFd, replacement, params.maxRestoreBytes, sourceStat.mode, params.fchmodSync);
             }
         }
         if (destFd === undefined) {
@@ -312,6 +321,10 @@ export function copyFallbackReplaceSync(params) {
             }
             destFd = params.fsModule.openSync(params.dest, OPEN_WRITE_EXCLUSIVE_FLAGS, sourceStat.mode & 0o777);
             writeAllSync(params.fsModule, destFd, replacement);
+            params.fchmodSync?.(destFd, sourceStat.mode);
+            if (params.sync) {
+                params.fsModule.fsyncSync(destFd);
+            }
         }
     }
     finally {
@@ -330,10 +343,4 @@ export function copyFallbackReplaceSync(params) {
             // Best-effort close after fallback replacement.
         }
     }
-    try {
-        params.fsModule.unlinkSync(params.src);
-    }
-    catch {
-        // Best-effort cleanup after fallback replacement.
-    }
 }

package/dist/replace-file-descriptor.d.ts

@@ -0,0 +1,33 @@
+import syncFs, { type Stats } from "node:fs";
+import fs from "node:fs/promises";
+type AsyncTempFileSystem = Pick<typeof fs, "lstat" | "open" | "writeFile">;
+type SyncTempFileSystem = Pick<typeof syncFs, "closeSync" | "fstatSync" | "fsyncSync" | "lstatSync" | "openSync" | "writeFileSync">;
+export type SyncFchmod = (fd: number, mode: number) => void;
+export declare function applyDirectoryMode(params: {
+    fsModule: AsyncTempFileSystem;
+    dirPath: string;
+    mode: number;
+}): Promise<void>;
+export declare function applyDirectoryModeSync(params: {
+    fsModule: SyncTempFileSystem;
+    dirPath: string;
+    mode: number;
+    fchmodSync?: SyncFchmod;
+}): void;
+export declare function writeTempFile(params: {
+    fsModule: AsyncTempFileSystem;
+    tempPath: string;
+    content: string | Uint8Array;
+    mode: number;
+    sync: boolean;
+}): Promise<Stats>;
+export declare function writeTempFileSync(params: {
+    fsModule: SyncTempFileSystem;
+    tempPath: string;
+    content: string | Uint8Array;
+    mode: number;
+    fchmodSync?: SyncFchmod;
+    sync: boolean;
+}): Stats;
+export {};
+//# sourceMappingURL=replace-file-descriptor.d.ts.map

package/dist/replace-file-descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replace-file-descriptor.d.ts","sourceRoot":"","sources":["../src/replace-file-descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,EAAE,EAAE,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAuB,MAAM,kBAAkB,CAAC;AAIvD,KAAK,mBAAmB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC,CAAC;AAC3E,KAAK,kBAAkB,GAAG,IAAI,CAC5B,OAAO,MAAM,EACb,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,eAAe,CACrF,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AA2B5D,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBhB;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,GAAG,IAAI,CAcP;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE;IAC1C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,OAAO,CAAC,KAAK,CAAC,CAkBjB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,KAAK,CAkBR"}