@openclaw/fs-safe 0.6.0 → 0.7.1

package/dist/sidecar-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sidecar-lock.d.ts","sourceRoot":"","sources":["../src/sidecar-lock.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAmLjC,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM;cAS3B,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WACpD,yBAAyB,CAAC,QAAQ,CAAC,KAC3C,OAAO,CAAC,iBAAiB,CAAC;eAYL,CAAC,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WACxD,yBAAyB,CAAC,QAAQ,CAAC,MACxC,MAAM,OAAO,CAAC,CAAC,CAAC,KACnB,OAAO,CAAC,CAAC,CAAC;iBASW,OAAO,CAAC,IAAI,CAAC;iBAQnB,IAAI;uBAIE,oBAAoB,EAAE;EAW/C;AAED,wBAAsB,eAAe,CAAC,CAAC,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/E,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EACzC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAMZ"}
+{"version":3,"file":"sidecar-lock.d.ts","sourceRoot":"","sources":["../src/sidecar-lock.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAsLjC,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM;cAS3B,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WACpD,yBAAyB,CAAC,QAAQ,CAAC,KAC3C,OAAO,CAAC,iBAAiB,CAAC;eAYL,CAAC,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WACxD,yBAAyB,CAAC,QAAQ,CAAC,MACxC,MAAM,OAAO,CAAC,CAAC,CAAC,KACnB,OAAO,CAAC,CAAC,CAAC;iBAqBW,OAAO,CAAC,IAAI,CAAC;iBAQnB,IAAI;uBAIE,oBAAoB,EAAE;EAW/C;AAED,wBAAsB,eAAe,CAAC,CAAC,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/E,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EACzC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAMZ"}

package/dist/sidecar-lock.js

@@ -3,6 +3,7 @@ import { sameFileIdentity } from "./file-identity.js";
 import { removeSidecarLockIfUnchanged, sidecarLockSnapshotMatches, } from "./sidecar-lock-reclaim.js";
 import { acquireSidecarLock } from "./sidecar-lock-acquire.js";
 import { createHeldSidecarLockHandle } from "./sidecar-lock-handle.js";
+import { createSuppressedError } from "./suppressed-error.js";
 const GLOBAL_STATE_KEY = Symbol.for("fsSafe.sidecarLockManagers");
 const GLOBAL_CLEANUP_KEY = Symbol.for("fsSafe.sidecarLockCleanupRegistered");
 const GLOBAL_CLEANUP_HANDLER_KEY = Symbol.for("fsSafe.sidecarLockCleanupHandler");
@@ -121,23 +122,18 @@ async function releaseHeldLock(state, normalizedTargetPath, held, options = {})
     if (current !== held) {
         return false;
     }
+    if (held.releasePromise) {
+        await held.releasePromise;
+        return true;
+    }
     if (options.force) {
         held.refCount = 0;
     }
-    else {
+    else if (!options.retry && held.refCount > 0) {
         held.refCount -= 1;
-        if (held.refCount > 0) {
-            return false;
-        }
-    }
-    if (held.releasePromise) {
-        await held.releasePromise.catch(() => undefined);
-        return true;
     }
-    state.held.delete(normalizedTargetPath);
-    if (held.compromiseTimer) {
-        clearInterval(held.compromiseTimer);
-        held.compromiseTimer = undefined;
+    if (held.refCount > 0) {
+        return false;
     }
     held.releasePromise = (async () => {
         await held.handle.close().catch(() => undefined);
@@ -145,6 +141,13 @@ async function releaseHeldLock(state, normalizedTargetPath, held, options = {})
             lockRoot: held.lockRoot,
             parsePayload: held.parsePayload,
         });
+        if (state.held.get(normalizedTargetPath) === held) {
+            state.held.delete(normalizedTargetPath);
+        }
+        if (held.compromiseTimer) {
+            clearInterval(held.compromiseTimer);
+            held.compromiseTimer = undefined;
+        }
     })();
     try {
         await held.releasePromise;
@@ -158,7 +161,7 @@ function handleForHeldLock(state, normalizedTargetPath, held) {
     return createHeldSidecarLockHandle({
         normalizedTargetPath,
         held,
-        release: async () => await releaseHeldLock(state, normalizedTargetPath, held),
+        release: async (options) => await releaseHeldLock(state, normalizedTargetPath, held, { retry: options?.retry }),
     });
 }
 export function createSidecarLockManager(key) {
@@ -179,12 +182,21 @@ export function createSidecarLockManager(key) {
     }
     async function withLock(options, fn) {
         const lock = await acquire(options);
+        let result;
         try {
-            return await fn();
+            result = await fn();
         }
-        finally {
-            await lock.release();
+        catch (bodyError) {
+            try {
+                await lock.release();
+            }
+            catch (releaseError) {
+                throw createSuppressedError(releaseError, bodyError, "file lock callback and release both failed");
+            }
+            throw bodyError;
         }
+        await lock.release();
+        return result;
     }
     async function drain() {
         for (const [normalizedTargetPath, held] of Array.from(state.held.entries())) {

package/dist/strict-file-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"strict-file-identity.d.ts","sourceRoot":"","sources":["../src/strict-file-identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAG3C,KAAK,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC;AA6B1D,wBAAsB,mBAAmB,CAAC,CAAC,SAAS,iBAAiB,EACnE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACzB,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAAC,CAAC,CAAC,CAOZ;AAED,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,iBAAiB,EACjE,OAAO,EAAE,MAAM,CAAC,EAChB,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,CAAC,CAOH"}
+{"version":3,"file":"strict-file-identity.d.ts","sourceRoot":"","sources":["../src/strict-file-identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAI3C,KAAK,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC;AA+B1D,wBAAsB,mBAAmB,CAAC,CAAC,SAAS,iBAAiB,EACnE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACzB,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAAC,CAAC,CAAC,CAOZ;AAED,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,iBAAiB,EACjE,OAAO,EAAE,MAAM,CAAC,EAChB,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,CAAC,CAOH"}

package/dist/strict-file-identity.js

@@ -1,6 +1,9 @@
 import { FsSafeError } from "./errors.js";
+import { recordFileObservationFailure } from "./file-observation.js";
 function identityMismatch() {
-    return new FsSafeError("path-mismatch", "file identity changed or could not be verified");
+    const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
+    recordFileObservationFailure(error, "identity");
+    return error;
 }
 function identityCheck(expected, platform) {
     const known = {};

package/dist/suppressed-error.d.ts

@@ -0,0 +1,6 @@
+export type SuppressedErrorLike = Error & {
+    error: unknown;
+    suppressed: unknown;
+};
+export declare function createSuppressedError(error: unknown, suppressed: unknown, message: string): SuppressedErrorLike;
+//# sourceMappingURL=suppressed-error.d.ts.map

package/dist/suppressed-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressed-error.d.ts","sourceRoot":"","sources":["../src/suppressed-error.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG;IACxC,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAQF,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,MAAM,GACd,mBAAmB,CAgBrB"}

package/dist/suppressed-error.js

@@ -0,0 +1,15 @@
+export function createSuppressedError(error, suppressed, message) {
+    const constructor = globalThis.SuppressedError;
+    if (constructor) {
+        return new constructor(error, suppressed, message);
+    }
+    const combined = new Error(message, {
+        cause: error instanceof Error ? error : undefined,
+    });
+    combined.name = "SuppressedError";
+    Object.defineProperties(combined, {
+        error: { configurable: true, value: error },
+        suppressed: { configurable: true, value: suppressed },
+    });
+    return combined;
+}

package/dist/temp-cleanup.d.ts

@@ -6,6 +6,8 @@ export type TempPathRegistration = (() => void) & {
 export declare function registerTempPathForExit(tempPath: string, options?: {
     recursive?: boolean;
     identity?: FileIdentityStat;
+    singleLinkFile?: boolean;
+    cleanupSync?: () => unknown;
 }): TempPathRegistration;
 export declare function __cleanupRegisteredTempPathsForTest(): void;
 export declare function __cleanupRegisteredTempPathForTest(tempPath: string): void;

package/dist/temp-cleanup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"temp-cleanup.d.ts","sourceRoot":"","sources":["../src/temp-cleanup.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG;IAChD,WAAW,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC/C,CAAC;AAsCF,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;CAAE,GAC7D,oBAAoB,CAyBtB;AAED,wBAAgB,mCAAmC,IAAI,IAAI,CAE1D;AAED,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAYzE"}
+{"version":3,"file":"temp-cleanup.d.ts","sourceRoot":"","sources":["../src/temp-cleanup.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG;IAChD,WAAW,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC/C,CAAC;AAkDF,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;CAC7B,GACA,oBAAoB,CA2BtB;AAED,wBAAgB,mCAAmC,IAAI,IAAI,CAE1D;AAED,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAUzE"}

package/dist/temp-cleanup.js

@@ -7,18 +7,32 @@ function pathStillMatchesReceipt(entry) {
         return false;
     }
     try {
-        return sameFileIdentityForCleanup(fsSync.lstatSync(entry.path, { bigint: true }), entry.identity);
+        const current = fsSync.lstatSync(entry.path, { bigint: true });
+        return (!entry.singleLinkFile || (current.isFile() && current.nlink === 1n)) &&
+            sameFileIdentityForCleanup(current, entry.identity);
     }
     catch (error) {
-        return error.code === "ENOENT";
+        return !entry.singleLinkFile && error.code === "ENOENT";
+    }
+}
+function removeRegisteredPathSync(entry) {
+    if (entry.singleLinkFile)
+        fsSync.unlinkSync(entry.path);
+    else
+        fsSync.rmSync(entry.path, { force: true, recursive: entry.recursive });
+}
+function cleanupEntrySync(entry) {
+    if (entry.cleanupSync) {
+        entry.cleanupSync();
+    }
+    else if (pathStillMatchesReceipt(entry)) {
+        removeRegisteredPathSync(entry);
     }
 }
 function cleanupRegisteredTempPathsSync() {
     for (const entry of tempCleanupEntries.values()) {
         try {
-            if (pathStillMatchesReceipt(entry)) {
-                fsSync.rmSync(entry.path, { force: true, recursive: entry.recursive });
-            }
+            cleanupEntrySync(entry);
         }
         catch {
             // Process-exit cleanup is best-effort.
@@ -35,8 +49,10 @@ export function registerTempPathForExit(tempPath, options) {
         path: tempPath,
         recursive: options?.recursive === true,
         identity: options?.identity,
+        singleLinkFile: options?.singleLinkFile,
+        cleanupSync: options?.cleanupSync,
     };
-    if (!entry.identity) {
+    if (!entry.identity && !entry.cleanupSync) {
         try {
             entry.identity = fsSync.lstatSync(tempPath, { bigint: true });
         }
@@ -46,7 +62,8 @@ export function registerTempPathForExit(tempPath, options) {
     }
     tempCleanupEntries.set(tempPath, entry);
     const unregister = (() => {
-        tempCleanupEntries.delete(tempPath);
+        if (tempCleanupEntries.get(tempPath) === entry)
+            tempCleanupEntries.delete(tempPath);
     });
     unregister.setIdentity = (identity) => {
         entry.identity = identity;
@@ -62,9 +79,7 @@ export function __cleanupRegisteredTempPathForTest(tempPath) {
         return;
     }
     try {
-        if (pathStillMatchesReceipt(entry)) {
-            fsSync.rmSync(entry.path, { force: true, recursive: entry.recursive });
-        }
+        cleanupEntrySync(entry);
     }
     finally {
         tempCleanupEntries.delete(tempPath);

package/dist/temp-workspace-owner.d.ts

@@ -0,0 +1,23 @@
+import { type FileIdentityStat } from "./file-identity.js";
+import { type NativeBinding } from "./native.js";
+import { openStagedDirectory } from "./staged-directory.js";
+export type TempWorkspaceCleanupResult = "removed" | "missing" | "identity-mismatch" | "indeterminate";
+export type TempWorkspaceCleanupSafety = "compatible" | "require-bounded";
+type RetainedDirectory = ReturnType<typeof openStagedDirectory>;
+export declare class TempWorkspaceCleanupCapability {
+    #private;
+    readonly binding: NativeBinding | undefined;
+    readonly parent: RetainedDirectory | undefined;
+    constructor(root: string, safety: TempWorkspaceCleanupSafety);
+    get canRemoveOwnedTree(): boolean;
+    assertCurrent(): void;
+    close(): void;
+}
+export declare class TempWorkspaceCleanupOwner {
+    #private;
+    constructor(dir: string, identity: FileIdentityStat, capability: TempWorkspaceCleanupCapability);
+    cleanup(): Promise<TempWorkspaceCleanupResult>;
+    cleanupSync(): TempWorkspaceCleanupResult;
+}
+export {};
+//# sourceMappingURL=temp-workspace-owner.d.ts.map

package/dist/temp-workspace-owner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"temp-workspace-owner.d.ts","sourceRoot":"","sources":["../src/temp-workspace-owner.ts"],"names":[],"mappings":"AAMA,OAAO,EAA8B,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAgC,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAG1F,MAAM,MAAM,0BAA0B,GAAG,SAAS,GAAG,SAAS,GAAG,mBAAmB,GAAG,eAAe,CAAC;AACvG,MAAM,MAAM,0BAA0B,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAE1E,KAAK,iBAAiB,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAoBhE,qBAAa,8BAA8B;;IACzC,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAI/C,YAAY,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAiC3D;IAED,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED,aAAa,IAAI,IAAI,CASpB;IAED,KAAK,IAAI,IAAI,CAIZ;CACF;AAED,qBAAa,yBAAyB;;IAWpC,YAAY,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,8BAA8B,EAe9F;IAuLD,OAAO,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAM7C;IAED,WAAW,IAAI,0BAA0B,CAexC;CACF"}

package/dist/temp-workspace-owner.js

@@ -0,0 +1,320 @@
+import { randomUUID } from "node:crypto";
+import fsSync from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createAsyncDirectoryGuard, createSyncDirectoryGuard } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { sameFileIdentityForCleanup } from "./file-identity.js";
+import { withAsyncDirectoryGuards, withSyncDirectoryGuards } from "./guarded-mutation.js";
+import { getNativeBinding } from "./native.js";
+import { assertStagedDirectoryCurrent, openStagedDirectory } from "./staged-directory.js";
+import { getFsSafeTestHooks } from "./test-hooks.js";
+function isNativeCleanupBinding(binding) {
+    return typeof binding?.renameNoReplace === "function" &&
+        typeof binding.removeOwnedTree === "function" &&
+        typeof binding.removeOwnedTreeSync === "function" &&
+        typeof binding.ownedTreeRemovalAvailable === "function";
+}
+function nativeRemovalError(result) {
+    if (!result.errorCode)
+        return undefined;
+    return Object.assign(new Error(result.errorMessage ?? "native owned-tree cleanup failed"), {
+        code: result.errorCode,
+    });
+}
+export class TempWorkspaceCleanupCapability {
+    binding;
+    parent;
+    #ownedTreeRemovalAvailable;
+    #closed = false;
+    constructor(root, safety) {
+        let binding;
+        try {
+            binding = getNativeBinding();
+        }
+        catch (error) {
+            if (safety === "require-bounded")
+                throw error;
+        }
+        this.binding = binding;
+        let parent;
+        try {
+            parent = openStagedDirectory(root);
+            assertStagedDirectoryCurrent(parent.receipt);
+        }
+        catch {
+            if (parent)
+                fsSync.closeSync(parent.fd);
+            parent = undefined;
+        }
+        this.parent = parent;
+        let available = false;
+        if (parent && isNativeCleanupBinding(binding)) {
+            try {
+                available = binding.ownedTreeRemovalAvailable(parent.fd) === true;
+            }
+            catch {
+                // Runtime denial must select fallback or reject before child creation.
+            }
+        }
+        this.#ownedTreeRemovalAvailable = available;
+        if (safety === "require-bounded" && !this.canRemoveOwnedTree) {
+            this.close();
+            throw new FsSafeError("helper-unavailable", "temp workspace owned-tree cleanup is unavailable");
+        }
+    }
+    get canRemoveOwnedTree() {
+        return !this.#closed && this.#ownedTreeRemovalAvailable;
+    }
+    assertCurrent() {
+        if (this.#closed || !this.parent) {
+            throw new FsSafeError("path-mismatch", "temp workspace cleanup parent is unavailable");
+        }
+        assertStagedDirectoryCurrent(this.parent.receipt);
+        const current = fsSync.fstatSync(this.parent.fd, { bigint: true });
+        if (!sameFileIdentityForCleanup(current, this.parent.receipt.identity)) {
+            throw new FsSafeError("path-mismatch", "temp workspace cleanup parent changed");
+        }
+    }
+    close() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        if (this.parent)
+            fsSync.closeSync(this.parent.fd);
+    }
+}
+export class TempWorkspaceCleanupOwner {
+    #dir;
+    #identity;
+    #capability;
+    #directory;
+    #closed = false;
+    #running = false;
+    #exitInterrupted = false;
+    #result;
+    #pending;
+    constructor(dir, identity, capability) {
+        this.#dir = dir;
+        this.#identity = { dev: identity.dev, ino: identity.ino };
+        this.#capability = capability;
+        let directory;
+        if (capability.canRemoveOwnedTree) {
+            directory = openStagedDirectory(dir);
+            const current = fsSync.fstatSync(directory.fd, { bigint: true });
+            if (!sameFileIdentityForCleanup(current, this.#identity)) {
+                fsSync.closeSync(directory.fd);
+                capability.close();
+                throw new FsSafeError("path-mismatch", "temp workspace changed while retaining cleanup authority");
+            }
+        }
+        this.#directory = directory;
+    }
+    #repeat() {
+        return this.#result === "removed" ? "missing" : this.#result;
+    }
+    #close() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        const errors = [];
+        if (this.#directory) {
+            try {
+                fsSync.closeSync(this.#directory.fd);
+            }
+            catch (error) {
+                errors.push(error);
+            }
+        }
+        try {
+            this.#capability.close();
+        }
+        catch (error) {
+            errors.push(error);
+        }
+        if (errors.length === 1)
+            throw errors[0];
+        if (errors.length > 1)
+            throw new AggregateError(errors, "temp workspace cleanup descriptor close failed");
+    }
+    #finish(result) {
+        this.#result ??= this.#exitInterrupted ? "indeterminate" : result;
+        try {
+            this.#close();
+        }
+        catch (error) {
+            this.#result = "indeterminate";
+            throw error;
+        }
+        return this.#result;
+    }
+    #fallbackResult() {
+        try {
+            const current = fsSync.lstatSync(this.#dir, { bigint: true });
+            return current.isDirectory() && !current.isSymbolicLink() &&
+                sameFileIdentityForCleanup(current, this.#identity)
+                ? "indeterminate"
+                : "identity-mismatch";
+        }
+        catch (error) {
+            return error.code === "ENOENT" ? "missing" : "indeterminate";
+        }
+    }
+    #prepare() {
+        const parent = this.#capability.parent;
+        if (!parent)
+            return this.#fallbackResult();
+        try {
+            this.#capability.assertCurrent();
+            let current;
+            try {
+                current = fsSync.lstatSync(this.#dir, { bigint: true });
+            }
+            catch (error) {
+                this.#capability.assertCurrent();
+                return error.code === "ENOENT" ? "missing" : "indeterminate";
+            }
+            this.#capability.assertCurrent();
+            if (!current.isDirectory() || current.isSymbolicLink() ||
+                !sameFileIdentityForCleanup(current, this.#identity)) {
+                return "identity-mismatch";
+            }
+            const name = `.fs-safe-workspace-cleanup-${randomUUID()}`;
+            const quarantinePath = path.join(parent.receipt.path, name);
+            const nativeRemoval = this.#capability.canRemoveOwnedTree && this.#directory !== undefined;
+            if (nativeRemoval) {
+                this.#capability.binding.renameNoReplace(parent.fd, path.basename(this.#dir), parent.fd, name);
+            }
+            else {
+                const guard = createSyncDirectoryGuard(parent.receipt.path);
+                withSyncDirectoryGuards([guard], () => {
+                    this.#capability.assertCurrent();
+                    fsSync.renameSync(this.#dir, quarantinePath);
+                });
+            }
+            this.#capability.assertCurrent();
+            const quarantined = fsSync.lstatSync(quarantinePath, { bigint: true });
+            this.#capability.assertCurrent();
+            if (!quarantined.isDirectory() || quarantined.isSymbolicLink() ||
+                !sameFileIdentityForCleanup(quarantined, this.#identity)) {
+                return "indeterminate";
+            }
+            return { name, path: quarantinePath, nativeRemoval };
+        }
+        catch {
+            // A failed rename can still have committed on a remote filesystem.
+            return "indeterminate";
+        }
+    }
+    #assertQuarantine(quarantine) {
+        const current = fsSync.lstatSync(quarantine.path, { bigint: true });
+        if (!current.isDirectory() || current.isSymbolicLink() ||
+            !sameFileIdentityForCleanup(current, this.#identity)) {
+            throw new FsSafeError("path-mismatch", "temp workspace quarantine changed");
+        }
+        this.#capability.assertCurrent();
+    }
+    #mapRemoval(result) {
+        const error = nativeRemovalError(result);
+        if (error) {
+            if (error.code === "path-mismatch")
+                return "indeterminate";
+            throw error;
+        }
+        return result.outcome === "removed" ? "removed" : "indeterminate";
+    }
+    async #remove(quarantine) {
+        if (quarantine.nativeRemoval) {
+            const beforeNativeRemoval = getFsSafeTestHooks()?.beforeTempWorkspaceNativeRemoval;
+            if (beforeNativeRemoval)
+                await beforeNativeRemoval(quarantine.path);
+            return this.#mapRemoval(await this.#capability.binding.removeOwnedTree(this.#capability.parent.fd, quarantine.name, this.#directory.fd));
+        }
+        let removalError;
+        try {
+            const guard = await createAsyncDirectoryGuard(this.#capability.parent.receipt.path);
+            await withAsyncDirectoryGuards([guard], async () => {
+                this.#assertQuarantine(quarantine);
+                try {
+                    await fs.rm(quarantine.path, { recursive: true, force: true });
+                }
+                catch (error) {
+                    removalError = error;
+                    throw error;
+                }
+            });
+            return "removed";
+        }
+        catch (error) {
+            if (error === removalError)
+                throw error;
+            return "indeterminate";
+        }
+    }
+    #removeSync(quarantine) {
+        if (quarantine.nativeRemoval) {
+            getFsSafeTestHooks()?.beforeTempWorkspaceNativeRemovalSync?.(quarantine.path);
+            return this.#mapRemoval(this.#capability.binding.removeOwnedTreeSync(this.#capability.parent.fd, quarantine.name, this.#directory.fd));
+        }
+        let removalError;
+        try {
+            const guard = createSyncDirectoryGuard(this.#capability.parent.receipt.path);
+            withSyncDirectoryGuards([guard], () => {
+                this.#assertQuarantine(quarantine);
+                try {
+                    fsSync.rmSync(quarantine.path, { recursive: true, force: true });
+                }
+                catch (error) {
+                    removalError = error;
+                    throw error;
+                }
+            });
+            return "removed";
+        }
+        catch (error) {
+            if (error === removalError)
+                throw error;
+            return "indeterminate";
+        }
+    }
+    async #run() {
+        let result = "indeterminate";
+        try {
+            const prepared = this.#prepare();
+            result = typeof prepared === "string" ? prepared : await this.#remove(prepared);
+            return this.#finish(result);
+        }
+        finally {
+            if (!this.#closed)
+                this.#finish(result);
+        }
+    }
+    cleanup() {
+        if (this.#result)
+            return Promise.resolve(this.#repeat());
+        if (this.#pending)
+            return this.#pending.then(() => this.#repeat());
+        this.#running = true;
+        this.#pending = this.#run();
+        return this.#pending;
+    }
+    cleanupSync() {
+        if (this.#result)
+            return this.#repeat();
+        if (this.#running) {
+            this.#exitInterrupted = true;
+            return "indeterminate";
+        }
+        this.#running = true;
+        let result = "indeterminate";
+        try {
+            const prepared = this.#prepare();
+            result = typeof prepared === "string" ? prepared : this.#removeSync(prepared);
+            return this.#finish(result);
+        }
+        finally {
+            if (!this.#closed)
+                this.#finish(result);
+        }
+    }
+}

package/dist/temp.d.ts

@@ -1,4 +1,4 @@
-export { tempWorkspace, type TempWorkspace, type TempWorkspaceOptions, type TempWorkspaceCleanupResult, tempWorkspaceSync, type TempWorkspaceSync, withTempWorkspace, withTempWorkspaceSync, } from "./private-temp-workspace.js";
+export { tempWorkspace, type TempWorkspace, type TempWorkspaceOptions, type TempWorkspaceCleanupResult, type TempWorkspaceCleanupSafety, tempWorkspaceSync, type TempWorkspaceSync, withTempWorkspace, withTempWorkspaceSync, } from "./private-temp-workspace.js";
 export type { TempPathIdentityReceipt } from "./temp-cleanup.js";
 export { resolveSecureTempRoot, type ResolveSecureTempRootOptions } from "./secure-temp-dir.js";
 //# sourceMappingURL=temp.d.ts.map

package/dist/temp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"temp.d.ts","sourceRoot":"","sources":["../src/temp.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,KAAK,4BAA4B,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"temp.d.ts","sourceRoot":"","sources":["../src/temp.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,KAAK,4BAA4B,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/test-hooks.d.ts

@@ -4,6 +4,7 @@ export type FsSafeTestHooks = {
     afterPreOpenLstat?: (filePath: string) => Promise<void> | void;
     beforeOpen?: (filePath: string, flags: number) => Promise<void> | void;
     afterOpen?: (filePath: string, handle: FileHandle) => Promise<void> | void;
+    afterOpenedPathIdentityCheck?: (filePath: string, handle: FileHandle) => Promise<void> | void;
     beforeArchiveOutputMutation?: (operation: "mkdir" | "chmod", targetPath: string) => Promise<void> | void;
     beforeFileStorePruneDescend?: (dirPath: string) => Promise<void> | void;
     beforeFileStoreSyncPrivateWrite?: (filePath: string) => void;
@@ -11,6 +12,10 @@ export type FsSafeTestHooks = {
     afterPinnedWriteFallbackRename?: (targetPath: string) => Promise<void> | void;
     beforeSiblingTempWrite?: (tempPath: string) => Promise<void> | void;
     beforeSidecarLockSnapshotOpen?: (lockPath: string) => Promise<void> | void;
+    beforeRegularFileAppendOpen?: (filePath: string) => Promise<void> | void;
+    beforeRegularFileAppendOpenSync?: (filePath: string) => void;
+    beforeTempWorkspaceNativeRemoval?: (quarantinePath: string) => Promise<void> | void;
+    beforeTempWorkspaceNativeRemovalSync?: (quarantinePath: string) => void;
     beforeTrashMove?: (targetPath: string, destPath: string) => void;
     afterPublishTargetCreated?: (method: "hardlink" | "exclusive-copy" | "rename-noreplace", targetPath: string, identity: FileIdentityStat) => Promise<void> | void;
     beforePublishDirectorySync?: (method: "hardlink" | "exclusive-copy" | "rename-noreplace", targetPath: string, identity: FileIdentityStat) => Promise<void> | void;

package/dist/test-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-hooks.d.ts","sourceRoot":"","sources":["../src/test-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,MAAM,MAAM,eAAe,GAAG;IAC5B,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC/D,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvE,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3E,2BAA2B,CAAC,EAAE,CAC5B,SAAS,EAAE,OAAO,GAAG,OAAO,EAC5B,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,2BAA2B,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxE,+BAA+B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7D,0BAA0B,CAAC,EAAE,CAC3B,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,EACtC,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,8BAA8B,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9E,sBAAsB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACpE,6BAA6B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3E,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACjE,yBAAyB,CAAC,EAAE,CAC1B,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,EAC1D,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,gBAAgB,KACvB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,0BAA0B,CAAC,EAAE,CAC3B,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,EAC1D,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,gBAAgB,KACvB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC3B,CAAC;AAQF,wBAAgB,kBAAkB,IAAI,eAAe,GAAG,SAAS,CAEhE;AAED,wBAAgB,2BAA2B,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,IAAI,CAKzE"}
+{"version":3,"file":"test-hooks.d.ts","sourceRoot":"","sources":["../src/test-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,MAAM,MAAM,eAAe,GAAG;IAC5B,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC/D,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvE,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3E,4BAA4B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9F,2BAA2B,CAAC,EAAE,CAC5B,SAAS,EAAE,OAAO,GAAG,OAAO,EAC5B,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,2BAA2B,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxE,+BAA+B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7D,0BAA0B,CAAC,EAAE,CAC3B,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,EACtC,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,8BAA8B,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9E,sBAAsB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACpE,6BAA6B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3E,2BAA2B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzE,+BAA+B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7D,gCAAgC,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACpF,oCAAoC,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC;IACxE,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACjE,yBAAyB,CAAC,EAAE,CAC1B,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,EAC1D,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,gBAAgB,KACvB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,0BAA0B,CAAC,EAAE,CAC3B,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,EAC1D,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,gBAAgB,KACvB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC3B,CAAC;AAQF,wBAAgB,kBAAkB,IAAI,eAAe,GAAG,SAAS,CAEhE;AAED,wBAAgB,2BAA2B,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,IAAI,CAKzE"}

package/docs/advanced.md

@@ -72,6 +72,13 @@ Operational filesystem failures such as permissions or I/O errors are rethrown.
 | `assertNoSymlinkParents`, `assertNoSymlinkParentsSync`, `AssertNoSymlinkParentsOptions` | – | Reject paths whose ancestor chain contains symlinks. |
 | `assertNoHardlinkedFinalPath`, `assertNoPathAliasEscape`, `PATH_ALIAS_POLICIES`, `PathAliasPolicy` | – | Hardlink/alias defense building blocks. |
 
+`openRootFile()` and `openRootFileSync()` compare exact bigint identities before
+open, on the retained descriptor, and on the current resolved path. Their `stat`
+receipts remain numeric. Custom `ioFs` adapters must honor `{ bigint: true }` for
+`lstatSync` and `fstatSync`; numeric identity responses fail validation. Unknown
+Windows identities receive one re-inspection without reopening, then fail
+validation if still unknown.
+
 The bounded descriptor helpers start at the descriptor's current offset and
 leave ownership with the caller. They are intended for the second half of a
 safe read: first open and validate the path using the boundary appropriate to
@@ -118,7 +125,7 @@ component is followed by another segment, both helpers throw
 |---|---|---|
 | `stageFileInDirectory`, `StagedFile`, `StagedFileReceipt`, `PublishedFileReceipt`, `StagedFilePublication`, `StagedFileCleanupReceipt`, `StagedFileFailureDetails` | [staged-file.md](staged-file.md) | Native-required Linux/macOS lifecycle retaining the original directory for abort cleanup. |
 | `tempFile`, `withTempFile`, `TempFile`, `buildRandomTempFilePath`, `sanitizeTempFileName` | [temp.md](temp.md) | One-file temp primitive; prefer `tempWorkspace` from `@openclaw/fs-safe/temp` for the stable surface. |
-| `writeSiblingTempFile`, `writeViaSiblingTempPath`, `WriteSiblingTempFileOptions`, `WriteSiblingTempFileResult` | – | Sibling-temp write building block used by `replaceFileAtomic`. |
+| `writeSiblingTempFile`, `writeViaSiblingTempPath`, `WriteSiblingTempFileOptions`, `WriteSiblingTempFileResult` | – | Callback-produced file staging: verified sibling publication or private-workspace copy through a root. |
 
 ### Permissions