@openclaw/openshell-sandbox 2026.10.1-beta.2 → 2026.10.5-beta.1

package/node_modules/@openclaw/fs-safe/dist/guest-native-python.js

@@ -32,6 +32,16 @@ export const GUEST_FILESYSTEM_CREATE_STAGING_PYTHON = [
 ].join("\n");
 export const GUEST_FILESYSTEM_RENAME_NO_REPLACE_PYTHON = [
     "def rename_no_replace(src_parent_fd, src_basename, dst_parent_fd, dst_basename):",
+    "    import stat",
+    "    source = os.lstat(src_basename, dir_fd=src_parent_fd)",
+    "    kind = stat.S_IFMT(source.st_mode)",
+    "    expected = (source.st_dev, source.st_ino, kind)",
+    "    def verify(parent_fd, basename, links):",
+    "        current = os.lstat(basename, dir_fd=parent_fd)",
+    "        if (current.st_dev, current.st_ino, stat.S_IFMT(current.st_mode)) != expected:",
+    "            raise OSError(errno.ESTALE, 'no-replace publication identity changed', basename)",
+    "        if kind == stat.S_IFREG and current.st_nlink != links:",
+    "            raise OSError(errno.ESTALE, 'no-replace publication link count changed', basename)",
     "    libc = ctypes.CDLL(None, use_errno=True)",
     "    is_linux = sys.platform.startswith('linux')",
     "    if is_linux:",
@@ -62,6 +72,31 @@ export const GUEST_FILESYSTEM_RENAME_NO_REPLACE_PYTHON = [
     "            raise OSError(error_code, os.strerror(error_code), dst_basename)",
     "    elif not is_linux:",
     "        raise OSError(errno.ENOSYS, 'atomic no-replace rename is unavailable')",
+    "    # Only a definitive rejection of the fixed flags reaches this fallback.",
+    "    if kind not in (stat.S_IFDIR, stat.S_IFREG):",
+    "        raise OSError(errno.EINVAL, 'no-replace fallback requires a file or directory', src_basename)",
+    "    verify(src_parent_fd, src_basename, 1)",
+    "    try:",
+    "        os.lstat(dst_basename, dir_fd=dst_parent_fd)",
+    "    except FileNotFoundError:",
+    "        pass",
+    "    else:",
+    "        raise FileExistsError(errno.EEXIST, os.strerror(errno.EEXIST), dst_basename)",
+    "    if kind == stat.S_IFDIR:",
+    "        verify(src_parent_fd, src_basename, 1)",
+    "        # A directory rename can replace only an EMPTY directory raced into",
+    "        # the absent target. Non-empty directories and files are refused.",
+    "        # The slash enforces source directory type at the syscall, even if",
+    "        # a peer substitutes a file/symlink after verification. Identity",
+    "        # checks are not compare-and-swap; verify publication afterward.",
+    "        try:",
+    "            os.rename(src_basename + '/', dst_basename, src_dir_fd=src_parent_fd, dst_dir_fd=dst_parent_fd)",
+    "        except OSError as error:",
+    "            if error.errno in (errno.ENOTEMPTY, errno.ENOTDIR, errno.EEXIST):",
+    "                raise FileExistsError(errno.EEXIST, os.strerror(errno.EEXIST), dst_basename) from error",
+    "            raise",
+    "        verify(dst_parent_fd, dst_basename, 1)",
+    "        return",
     "    os.link(",
     "        src_basename,",
     "        dst_basename,",
@@ -69,12 +104,19 @@ export const GUEST_FILESYSTEM_RENAME_NO_REPLACE_PYTHON = [
     "        dst_dir_fd=dst_parent_fd,",
     "        follow_symlinks=False,",
     "    )",
+    "    # Only this exact two-name interval permits nlink=2. Never roll back the",
+    "    # target on failure: it may be the only remaining link to the source.",
+    "    verify(dst_parent_fd, dst_basename, 2)",
+    "    verify(src_parent_fd, src_basename, 2)",
+    "    os.unlink(src_basename, dir_fd=src_parent_fd)",
+    "    verify(dst_parent_fd, dst_basename, 1)",
 ].join("\n");
 export const GUEST_FILESYSTEM_CREATE_EXCLUSIVE_PYTHON = [
     "def create_exclusive(parent_fd, basename, stdin_buffer):",
     "    staging_fd = None",
     "    staging_name = None",
     "    temp_fd = None",
+    "    temp_inode = None",
     "    temp_name = 'payload'",
     "    try:",
     "        try:",
@@ -85,6 +127,7 @@ export const GUEST_FILESYSTEM_CREATE_EXCLUSIVE_PYTHON = [
     "            raise FileExistsError(errno.EEXIST, os.strerror(errno.EEXIST), basename)",
     "        staging_name, staging_fd = create_staging_dir(parent_fd)",
     "        temp_fd = os.open(temp_name, WRITE_FLAGS, 0o600, dir_fd=staging_fd)",
+    "        temp_inode = inode_identity(os.fstat(temp_fd))",
     "        while True:",
     "            chunk = stdin_buffer.read(65536)",
     "            if not chunk:",
@@ -92,8 +135,7 @@ export const GUEST_FILESYSTEM_CREATE_EXCLUSIVE_PYTHON = [
     "            write_all(temp_fd, chunk)",
     "        # exclusive create payload is durable before publication",
     "        os.fsync(temp_fd)",
-    "        temp_inode = inode_identity(os.fstat(temp_fd))",
-    "        # Publish with a native atomic no-replace rename.",
+    "        # Publish with no-replace rename or the checked file fallback.",
     "        rename_no_replace(staging_fd, temp_name, parent_fd, basename)",
     "        target_stat = os.lstat(basename, dir_fd=parent_fd)",
     "        if temp_inode != inode_identity(target_stat):",
@@ -105,14 +147,19 @@ export const GUEST_FILESYSTEM_CREATE_EXCLUSIVE_PYTHON = [
     "        if staging_fd is not None:",
     "            # Cleanup stays relative to the private pinned directory, so a",
     "            # parent-path substitution cannot redirect payload deletion.",
+    "            payload_removed = False",
     "            try:",
-    "                os.unlink(temp_name, dir_fd=staging_fd)",
+    "                current_payload = os.lstat(temp_name, dir_fd=staging_fd)",
+    "                # Preserve ambiguous or partially published link pairs.",
+    "                if temp_inode == inode_identity(current_payload) and current_payload.st_nlink == 1:",
+    "                    os.unlink(temp_name, dir_fd=staging_fd)",
+    "                    payload_removed = True",
     "            except FileNotFoundError:",
-    "                pass",
+    "                payload_removed = True",
     "            staging_identity = entry_identity(os.fstat(staging_fd))",
     "            os.close(staging_fd)",
     "            staging_removed = False",
-    "            if staging_name is not None:",
+    "            if staging_name is not None and payload_removed:",
     "                try:",
     "                    current_staging = os.lstat(staging_name, dir_fd=parent_fd)",
     "                    if same_identity(staging_identity, current_staging):",

package/node_modules/@openclaw/fs-safe/dist/guest.js

@@ -395,7 +395,7 @@ export const GUEST_FILESYSTEM_PYTHON = [
     "                break",
     "            write_all(temp_fd, chunk)",
     "        try:",
-    "            os.fchmod(temp_fd, stat.S_IMODE(src_stat.st_mode))",
+    "            os.fchmod(temp_fd, stat.S_IMODE(src_file_stat.st_mode))",
     "        except AttributeError:",
     "            pass",
     "        os.fsync(temp_fd)",

package/node_modules/@openclaw/fs-safe/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { FsSafeError, categorizeFsSafeError, } from "./errors.js";
+export { FsSafeError, categorizeFsSafeError, isNoReplaceUnsupported, } from "./errors.js";
 export type * from "./errors.js";
 export { DEFAULT_ROOT_MAX_BYTES, root, type Root, } from "./root.js";
 export type * from "./root-public-types.js";

package/node_modules/@openclaw/fs-safe/dist/index.js

@@ -1,4 +1,4 @@
-export { FsSafeError, categorizeFsSafeError, } from "./errors.js";
+export { FsSafeError, categorizeFsSafeError, isNoReplaceUnsupported, } from "./errors.js";
 export { DEFAULT_ROOT_MAX_BYTES, root, } from "./root.js";
 export { configureFsSafeNative, getFsSafeNativeConfig, } from "./native-config.js";
 export { writeExternalFileWithinRoot, } from "./output.js";

package/node_modules/@openclaw/fs-safe/dist/native-binding.d.ts

@@ -139,6 +139,7 @@ export interface NativeBinding {
     renameReplaceWithIdentity?(sourceParent: number, source: string, targetParent: number, target: string, dev: bigint, ino: bigint): void;
     /** Windows-only, private handle custody; no borrowed/runtime descriptors. */
     retainWindowsFile?(directory: string, basename: string, parentDev: bigint, parentIno: bigint, dev: bigint, ino: bigint, size: bigint, mtimeNs: bigint, ctimeNs: bigint, sha256: string, maxBytes: number): NativeRetainedFile;
+    retainWindowsSidecar?(parentFd: number, directory: string, basename: string, parentDev: bigint, parentIno: bigint, dev: bigint, ino: bigint, size: bigint, sha256: string, maxBytes: number): NativeRetainedFile;
     watchRegister?(root: string, limit: number, callback: (batch: import("./watch-native.js").NativeWatchWireBatch) => void, persistent: boolean): number;
     watchConfigure?(id: number, anchors: string[], exclusions: string[]): void;
     watchEntries?(id: number, entries: import("./watch-native.js").NativeWatchEntry[]): {
@@ -203,6 +204,7 @@ export interface NativeBinding {
     stagedFileMatches?(parentFd: number, basename: string, fileFd: number): boolean;
     removeStagedFile?(parentFd: number, basename: string, fileFd: number): "removed" | "name-absent" | "preserved";
     copyFileExclusive?(sourceFd: number, parentFd: number, basename: string, clone: CopyCloneMode, maxBytes: number | undefined, signal: AbortSignal | undefined): Promise<NativeFileCopyResult>;
+    copyFileExclusiveSync?(sourceFd: number, parentFd: number, basename: string, clone: CopyCloneMode, maxBytes: number | undefined): NativeFileCopyResult;
     cloneFileExclusive(sourceFd: number, targetRootFd: number, targetRelPath: string): number;
     copyFileRangeExclusive(sourceFd: number, targetRootFd: number, targetRelPath: string): Promise<NativeCopyResult>;
     createPrivateDirectory(path: string): void;
@@ -235,6 +237,8 @@ export interface NativeBinding {
     entryPublicationFilesystem?(parentFd: number): string;
     publishRetainedEntryNoReplace?(sourceParentFd: number, sourceBasename: string, sourceFd: number, targetParentFd: number, targetBasename: string): NativePublicationTransition;
     renameNoReplace(...args: NativeTwoPathArgs): void;
+    /** Linux auto-mode fallback through already-admitted direct-child parents. */
+    moveNoReplaceFallback?(...args: [...paths: NativeTwoPathArgs, expectedSourceDev: bigint, expectedSourceIno: bigint]): void;
     /** Identity-fenced retained-directory rename capability. */
     renameNoReplaceWithIdentity?(...args: [...paths: NativeTwoPathArgs, expectedSourceDev: bigint, expectedSourceIno: bigint]): void;
     renameReplace(...args: NativeTwoPathArgs): void;

package/node_modules/@openclaw/fs-safe/dist/native-move-fallback.d.ts

@@ -0,0 +1,3 @@
+import type { BigIntStats } from "node:fs";
+import type { NativeBinding } from "./native-binding.js";
+export declare function nativeMoveNoReplace(binding: NativeBinding, paths: Parameters<NativeBinding["renameNoReplace"]>, expected: BigIntStats | undefined, allowFallback: boolean, operation?: string): "link-unlink" | undefined;

package/node_modules/@openclaw/fs-safe/dist/native-move-fallback.js

@@ -0,0 +1,54 @@
+import { FsSafeError } from "./errors.js";
+import { cachedNoReplaceUnavailable, noReplaceUnavailable, rememberNoReplaceUnavailable, } from "./native-noreplace.js";
+function fallbackError(error, operation) {
+    const code = error?.code;
+    const message = error instanceof Error ? error.message : "native no-replace move fallback failed";
+    if (code === "EEXIST") {
+        return new FsSafeError("already-exists", "no-replace fallback destination exists", { cause: error });
+    }
+    if (code === "FS_SAFE_INTERNAL_MOVE_LINK_UNSUPPORTED") {
+        return new FsSafeError("helper-unavailable", message, { cause: error,
+            details: { capability: "rename-noreplace", fallback: "link-unlink", fallbackCapability: "linkat" } });
+    }
+    const sourceRemoval = new Map([
+        ["FS_SAFE_INTERNAL_MOVE_LINK_CHANGED", "not-attempted"],
+        ["FS_SAFE_INTERNAL_MOVE_SOURCE_LINKED", "still-linked"],
+        ["FS_SAFE_INTERNAL_MOVE_UNLINK_UNVERIFIED", "unverified"],
+        ["FS_SAFE_INTERNAL_MOVE_PUBLISHED", "removed"],
+    ]).get(code ?? "");
+    if (sourceRemoval) {
+        return new FsSafeError(code === "FS_SAFE_INTERNAL_MOVE_LINK_CHANGED" ? "path-mismatch" : "helper-failed", message, { cause: error, details: { operation, fallback: "link-unlink",
+                publication: "published", sourceRemoval } });
+    }
+    // Keep identity errors available to the caller's normalizer.
+    return error;
+}
+export function nativeMoveNoReplace(binding, paths, expected, allowFallback, operation = "move") {
+    const [sourceFd, source, targetFd, target] = paths;
+    let unavailable = cachedNoReplaceUnavailable(binding, sourceFd, operation);
+    if (!unavailable) {
+        try {
+            binding.renameNoReplace(...paths);
+            return;
+        }
+        catch (error) {
+            unavailable = noReplaceUnavailable(error, operation, true);
+            if (!unavailable)
+                throw error;
+            // As in sibling publication/quarantine, distinct sibling names cannot
+            // have a directory-ancestry EINVAL. Cross-parent moves must not cache it.
+            if (sourceFd === targetFd && source !== target) {
+                rememberNoReplaceUnavailable(binding, sourceFd, unavailable);
+            }
+        }
+    }
+    if (!allowFallback || process.platform !== "linux" || !binding.moveNoReplaceFallback || !expected)
+        throw unavailable;
+    try {
+        binding.moveNoReplaceFallback(...paths, expected.dev, expected.ino);
+        return expected.isFile() ? "link-unlink" : undefined;
+    }
+    catch (error) {
+        throw fallbackError(error, operation);
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/native-noreplace.d.ts

@@ -0,0 +1,8 @@
+import { FsSafeError } from "./errors.js";
+import type { NativeBinding } from "./native-binding.js";
+export declare const NATIVE_NOREPLACE_UNSUPPORTED = "FS_SAFE_INTERNAL_RENAME_NOREPLACE_UNSUPPORTED";
+export declare function isNoReplaceUnavailable(error: unknown): error is FsSafeError;
+export declare function noReplaceUnavailable(error: unknown, operation: string, syscallOnly?: boolean): FsSafeError | undefined;
+export declare function rememberNoReplaceUnavailable(binding: NativeBinding, parentFd: number, error: FsSafeError): void;
+export declare function cachedNoReplaceUnavailable(binding: NativeBinding, parentFd: number, operation?: string): FsSafeError | undefined;
+export declare function cachedNoReplaceDevice(binding: NativeBinding, device: bigint, operation: string): FsSafeError | undefined;

package/node_modules/@openclaw/fs-safe/dist/native-noreplace.js

@@ -0,0 +1,55 @@
+import fs from "node:fs";
+import { FsSafeError } from "./errors.js";
+export const NATIVE_NOREPLACE_UNSUPPORTED = "FS_SAFE_INTERNAL_RENAME_NOREPLACE_UNSUPPORTED";
+const unsupported = new WeakMap();
+const capabilityErrors = new WeakMap();
+const MAX_DEVICES = 128;
+function unavailable(operation, detail, cause) {
+    const error = new FsSafeError("helper-unavailable", `native no-replace ${operation} is unsupported on this filesystem (${detail})`, { cause, details: { capability: "rename-noreplace" } });
+    capabilityErrors.set(error, detail);
+    return error;
+}
+export function isNoReplaceUnavailable(error) {
+    return error instanceof FsSafeError && capabilityErrors.has(error);
+}
+export function noReplaceUnavailable(error, operation, syscallOnly = false) {
+    try {
+        const code = error?.code;
+        if (code !== NATIVE_NOREPLACE_UNSUPPORTED &&
+            !(syscallOnly && ["EINVAL", "ENOSYS", "ENOTSUP", "EOPNOTSUPP"].includes(code ?? "")))
+            return;
+        const capability = process.platform === "darwin" ? "renameatx_np RENAME_EXCL"
+            : process.platform === "win32" ? "native no-replace rename" : "renameat2 RENAME_NOREPLACE";
+        const detail = code === NATIVE_NOREPLACE_UNSUPPORTED
+            ? error.message : `${capability}: ${code}`;
+        return unavailable(operation, detail, error);
+    }
+    catch {
+        // Diagnostic getters do not establish non-publication.
+        return;
+    }
+}
+export function rememberNoReplaceUnavailable(binding, parentFd, error) {
+    const detail = capabilityErrors.get(error);
+    if (!detail)
+        return;
+    const device = fs.fstatSync(parentFd, { bigint: true }).dev;
+    let devices = unsupported.get(binding);
+    if (!devices)
+        unsupported.set(binding, devices = new Map());
+    if (!devices.has(device) && devices.size >= MAX_DEVICES)
+        devices.delete(devices.keys().next().value);
+    devices.set(device, detail);
+}
+export function cachedNoReplaceUnavailable(binding, parentFd, operation = "publication") {
+    if (!unsupported.has(binding))
+        return;
+    return cachedNoReplaceDevice(binding, fs.fstatSync(parentFd, { bigint: true }).dev, operation);
+}
+export function cachedNoReplaceDevice(binding, device, operation) {
+    const devices = unsupported.get(binding);
+    if (!devices)
+        return;
+    const detail = devices.get(device);
+    return detail ? unavailable(operation, detail) : undefined;
+}

package/node_modules/@openclaw/fs-safe/dist/native-operations.d.ts

@@ -5,7 +5,6 @@ export type NativeFileHandle = {
     writeFile(data: string | Buffer, encoding?: BufferEncoding): Promise<void>;
 };
 export declare function nativeOpenFlags(flags: number): number;
-export declare function writeNativeFd(fd: number, data: Buffer): void;
 export declare function removeNativeCreatedFileIfStillPinned(params: {
     parentPath: string;
     parentFd: number;

package/node_modules/@openclaw/fs-safe/dist/native-operations.js

@@ -10,31 +10,6 @@ export function nativeOpenFlags(flags) {
         (closeOnExec ?? 0) |
         (typeof fsSync.constants.O_NOFOLLOW === "number" ? fsSync.constants.O_NOFOLLOW : 0));
 }
-export function writeNativeFd(fd, data) {
-    let offset = 0;
-    while (offset < data.byteLength) {
-        const written = fsSync.writeSync(fd, data, offset, data.byteLength - offset);
-        if (written <= 0) {
-            throw Object.assign(new Error("native file write made no progress"), { code: "EIO" });
-        }
-        offset += written;
-    }
-}
-function wrapNativeFd(fd, closeFd) {
-    let open = true;
-    return {
-        fd,
-        async close() {
-            if (open) {
-                open = false;
-                closeFd(fd);
-            }
-        },
-        async writeFile(data, encoding) {
-            writeNativeFd(fd, Buffer.isBuffer(data) ? data : Buffer.from(data, encoding ?? "utf8"));
-        },
-    };
-}
 export function removeNativeCreatedFileIfStillPinned(params) {
     if (!params.created) {
         return;
@@ -86,7 +61,28 @@ export async function createNativeExclusiveFile(targetPath, mode) {
         fd = opened.fd;
         fsSync.fchmodSync(fd, mode);
         created = fsSync.fstatSync(fd, { bigint: true });
-        return wrapNativeFd(fd, closeFd);
+        const ownedFd = fd;
+        let open = true;
+        return {
+            fd: ownedFd,
+            async close() {
+                if (open) {
+                    open = false;
+                    closeFd(ownedFd);
+                }
+            },
+            async writeFile(data, encoding) {
+                const buffer = Buffer.isBuffer(data) ? data : Buffer.from(data, encoding ?? "utf8");
+                let offset = 0;
+                while (offset < buffer.byteLength) {
+                    const written = fsSync.writeSync(ownedFd, buffer, offset, buffer.byteLength - offset);
+                    if (written <= 0) {
+                        throw Object.assign(new Error("native file write made no progress"), { code: "EIO" });
+                    }
+                    offset += written;
+                }
+            },
+        };
     }
     catch (error) {
         if (fd !== undefined) {

package/node_modules/@openclaw/fs-safe/dist/native-pinned-write-windows.js

@@ -188,7 +188,11 @@ export async function runPinnedWriteWindows(binding, params, root, parentFd, par
         if (params.sync !== false)
             syncFileBestEffortSync(parentFd);
         // Verification follows publication and final chmod, outside rollback handling.
-        await params.verifyPublished?.(targetFd, verificationIdentity, parentGuard);
+        if (params.overwrite === false && params.input.kind === "buffer" && params.input.stageBeforePublish === false) {
+            await params.verifyPublished?.(targetFd, verificationIdentity, parentGuard, { fd: parentFd, binding });
+        }
+        else
+            await params.verifyPublished?.(targetFd, verificationIdentity, parentGuard);
         completed = true;
         return { dev: targetIdentity.dev, ino: targetIdentity.ino };
     }

package/node_modules/@openclaw/fs-safe/dist/native-pinned-write.d.ts

@@ -1,4 +1,4 @@
 import type { FileIdentityStat } from "./file-identity.js";
 import type { NativeBinding } from "./native.js";
 import type { PinnedWriteParams } from "./pinned-write-types.js";
-export declare function runPinnedWriteNative(binding: NativeBinding, params: PinnedWriteParams): Promise<FileIdentityStat>;
+export declare function runPinnedWriteNative(binding: NativeBinding, params: PinnedWriteParams, fallback: (input: PinnedWriteParams["input"]) => Promise<FileIdentityStat>): Promise<FileIdentityStat>;

package/node_modules/@openclaw/fs-safe/dist/native-pinned-write.js

@@ -57,7 +57,9 @@ import { capturePolicyAwareNativeParent } from "./native-policy-parent.js";
 import { openNativeParentAdmission, openNativeRootAdmission } from "./native-parent-admission.js";
 import { assertNativeStaging, writeNativeStage } from "./native-staged-file.js";
 import { captureNativeFdClose } from "./native-binding.js";
-export async function runPinnedWriteNative(binding, params) {
+import { cachedNoReplaceUnavailable } from "./native-noreplace.js";
+import { isFsSafeNativeRequired } from "./native-config.js";
+export async function runPinnedWriteNative(binding, params, fallback) {
     const env_1 = { stack: [], error: void 0, hasError: false };
     try {
         const closeFd = captureNativeFdClose(binding);
@@ -126,9 +128,17 @@ export async function runPinnedWriteNative(binding, params) {
                 windowsOwnsDirectories = true;
                 return await runPinnedWriteWindows(binding, params, root, parentFd, verificationGuard);
             }
+            if (params.overwrite === false && !(params.input.kind === "buffer" && params.input.stageBeforePublish === false)) {
+                const unavailable = cachedNoReplaceUnavailable(binding, parentFd);
+                if (unavailable) {
+                    if (isFsSafeNativeRequired() || (params.input.kind === "file" && params.input.clone === "always"))
+                        throw unavailable;
+                    return await fallback(params.input);
+                }
+            }
             const ownedParent = parentFd;
             parentFd = undefined;
-            return await writeNativeStage(binding, ownedParent, closeFd, directory, params, verificationGuard);
+            return await writeNativeStage(binding, ownedParent, closeFd, directory, params, verificationGuard, fallback);
         }
         catch (error) {
             admissionFailure = { error };

package/node_modules/@openclaw/fs-safe/dist/native-rename-outcome.js

@@ -1,7 +1,9 @@
+import { NATIVE_NOREPLACE_UNSUPPORTED } from "./native-noreplace.js";
 export const NATIVE_RENAME_SOURCE_IDENTITY_MISMATCH = "FS_SAFE_INTERNAL_RENAME_SOURCE_IDENTITY_MISMATCH";
 export function classifyNativeRenameFailure(error) {
     try {
-        if (error?.code === NATIVE_RENAME_SOURCE_IDENTITY_MISMATCH) {
+        const code = error?.code;
+        if (code === NATIVE_RENAME_SOURCE_IDENTITY_MISMATCH || code === NATIVE_NOREPLACE_UNSUPPORTED) {
             return "uncommitted";
         }
     }

package/node_modules/@openclaw/fs-safe/dist/native-staged-file.d.ts

@@ -25,7 +25,7 @@ declare class NativeStagedFile implements StagedFile {
     #private;
     constructor(owner: NativeStageOwner);
     static create(owner: NativeStageOwner, input: PinnedWriteInput, maxBytes?: number): Promise<NativeStagedFile>;
-    static write(binding: NativeStagingBinding, parentFd: number, closeParentFd: (fd: number) => void, directory: StagedFileReceipt["directory"], params: PinnedWriteParams, parentGuard: AnyAsyncDirectoryGuard): Promise<FileIdentityStat>;
+    static write(binding: NativeStagingBinding, parentFd: number, closeParentFd: (fd: number) => void, directory: StagedFileReceipt["directory"], params: PinnedWriteParams, parentGuard: AnyAsyncDirectoryGuard, fallback: (input: PinnedWriteInput) => Promise<FileIdentityStat>): Promise<FileIdentityStat>;
     get receipt(): StagedFileReceipt;
     assertCurrent(): Promise<void>;
     publish(basename: string, options: {

package/node_modules/@openclaw/fs-safe/dist/native-staged-file.js

@@ -59,12 +59,14 @@ import path from "node:path";
 import { FsSafeError } from "./errors.js";
 import { assertSynchronousCallbackResult, isMutationAuthorityError } from "./mutation-authority.js";
 import { captureNativeFdClose } from "./native-binding.js";
-import { writePinnedInput } from "./pinned-write-input.js";
+import { replayPinnedInput, writePinnedInput } from "./pinned-write-input.js";
 import { assertNativeCopyCompleted, createNativeCopyFile } from "./copy-file-input.js";
 import { assertStagedDirectoryCurrent, openStagedDirectory } from "./staged-directory.js";
 import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
 import { classifyNativeRenameFailure } from "./native-rename-outcome.js";
 import { createStagedFileReceipt, stagedFailure } from "./staged-file-settlement.js";
+import { noReplaceUnavailable, rememberNoReplaceUnavailable } from "./native-noreplace.js";
+import { isFsSafeNativeRequired } from "./native-config.js";
 export function assertNativeStaging(binding) {
     if ([
         binding.closeOwnedFd,
@@ -93,6 +95,9 @@ class NativeStagedFile {
     #state = { status: "open", publication: NOT_PUBLISHED };
     #receipt;
     #rejectFinalSymlink = false;
+    #unsupportedNoReplace;
+    #fallbackCleanup;
+    #fallbackCleanupError;
     constructor(owner) {
         const name = owner.name ?? `.fs-safe-${randomUUID()}.tmp`;
         assertBasename(name, owner.portableNames !== false);
@@ -121,7 +126,7 @@ class NativeStagedFile {
         await staged.#prepare(input, maxBytes);
         return staged;
     }
-    static async write(binding, parentFd, closeParentFd, directory, params, parentGuard) {
+    static async write(binding, parentFd, closeParentFd, directory, params, parentGuard, fallback) {
         const env_1 = { stack: [], error: void 0, hasError: false };
         try {
             const exclusive = params.overwrite === false && params.input.kind === "buffer" && params.input.stageBeforePublish === false;
@@ -143,12 +148,39 @@ class NativeStagedFile {
                 if (staged.#verifyMode)
                     staged.#assertCurrent();
             }
-            const published = exclusive
-                ? staged.#completePublication(params.basename, false, params.onPublished)
-                : await staged.publish(params.basename, { overwrite: params.overwrite !== false }, params.onPublished);
+            let published;
+            try {
+                published = exclusive
+                    ? staged.#completePublication(params.basename, false, params.onPublished)
+                    : await staged.publish(params.basename, { overwrite: params.overwrite !== false }, params.onPublished);
+            }
+            catch (error) {
+                if (!staged.#unsupportedNoReplace || isFsSafeNativeRequired() ||
+                    (params.input.kind === "file" && params.input.clone === "always"))
+                    throw error;
+                // Remove only our identity-known stage before re-admitting the JS write.
+                // Keep its descriptor alive to replay a one-shot stream in bounded chunks.
+                staged.#fallbackCleanup = "failed";
+                let removed;
+                try {
+                    removed = binding.removeStagedFile(parentFd, staged.#owner.name, staged.#file());
+                    staged.#fallbackCleanup = removed;
+                }
+                catch (cleanupError) {
+                    staged.#fallbackCleanupError = { error: cleanupError };
+                    throw error;
+                }
+                if (removed !== "removed" && removed !== "name-absent")
+                    throw error;
+                rememberNoReplaceUnavailable(binding, parentFd, staged.#unsupportedNoReplace);
+                return await fallback(replayPinnedInput(staged.#file(), params.input));
+            }
             const identity = published.staged.identity;
             try {
-                await params.verifyPublished?.(staged.#file(), identity, parentGuard);
+                if (exclusive)
+                    await params.verifyPublished?.(staged.#file(), identity, parentGuard, { fd: parentFd, binding });
+                else
+                    await params.verifyPublished?.(staged.#file(), identity, parentGuard);
             }
             catch (error) {
                 if (params.overwrite === false && params.input.kind !== "file" && params.input.stageBeforePublish === true) {
@@ -321,6 +353,15 @@ class NativeStagedFile {
             catch (error) {
                 // Record before inspecting metadata, whose getters can reenter cleanup.
                 state.publication = Object.freeze({ status: "indeterminate", basename, overwrite });
+                // Linux VFS and rename(2): unsupported flags return EINVAL; ENOSYS
+                // means no syscall. A regular file renamed to a distinct sibling cannot
+                // hit the directory-into-itself EINVAL case. Nothing was published.
+                const unavailable = !overwrite ? noReplaceUnavailable(error, "publication", true) : undefined;
+                if (unavailable && this.#state === state && state.status === "open") {
+                    state.publication = NOT_PUBLISHED;
+                    this.#unsupportedNoReplace = unavailable;
+                    throw unavailable;
+                }
                 // Only explicit pre-dispatch provenance can rule out a committed rename.
                 if (classifyNativeRenameFailure(error) === "uncommitted") {
                     state.publication = NOT_PUBLISHED;
@@ -377,6 +418,11 @@ class NativeStagedFile {
         if (state.publication.status === "indeterminate") {
             outcome = "preserved";
         }
+        else if (this.#fallbackCleanup) {
+            outcome = this.#fallbackCleanup;
+            if (this.#fallbackCleanupError)
+                errors.push(this.#fallbackCleanupError.error);
+        }
         else if (state.publication.status === "not-published" && state.fileFd !== undefined) {
             try {
                 outcome = this.#owner.binding.removeStagedFile(this.#owner.parentFd, this.#owner.name, state.fileFd);

package/node_modules/@openclaw/fs-safe/dist/permission-exec.js

@@ -5,7 +5,8 @@ import { formatErrorDetail } from "./error-detail.js";
 const execFileAsync = promisify(execFile);
 export const DEFAULT_PERMISSION_EXEC_TIMEOUT_MS = 30_000;
 export function formatPermissionErrorDetail(value) {
-    const formatted = formatErrorDetail(value);
+    // Escaping cannot shrink input; 401 code units decide the 400-character excerpt.
+    const formatted = formatErrorDetail(value.slice(0, 401));
     return formatted.length > 400 ? `${formatted.slice(0, 399)}…` : formatted;
 }
 const MAX_CAUGHT_FAILURE_PROTOTYPES = 4;

package/node_modules/@openclaw/fs-safe/dist/pinned-write-input.d.ts

@@ -1,3 +1,5 @@
 import type { FileHandle } from "node:fs/promises";
 import type { PinnedWriteInput } from "./pinned-write-types.js";
+/** Replay a consumed stream from an owned, readable stage descriptor. */
+export declare function replayPinnedInput(fd: number, input: PinnedWriteInput): PinnedWriteInput;
 export declare function writePinnedInput(target: FileHandle | number, input: PinnedWriteInput, maxBytes?: number, assertBeforeMutation?: () => void): Promise<void>;

package/node_modules/@openclaw/fs-safe/dist/pinned-write-input.js

@@ -1,8 +1,25 @@
+import { readSync } from "node:fs";
 import { types } from "node:util";
 import { snapshotByteView } from "./byte-view.js";
 import { writeCopyFileToFd } from "./copy-file-input.js";
 import { FsSafeError } from "./errors.js";
 import { writeAllToFile } from "./write-file-handle.js";
+/** Replay a consumed stream from an owned, readable stage descriptor. */
+export function replayPinnedInput(fd, input) {
+    if (input.kind !== "stream")
+        return input;
+    return { kind: "stream", stageBeforePublish: true, stream: (async function* () {
+            let position = 0;
+            const buffer = Buffer.alloc(64 * 1024);
+            for (;;) {
+                const bytes = readSync(fd, buffer, 0, buffer.length, position);
+                if (!bytes)
+                    return;
+                position += bytes;
+                yield buffer.subarray(0, bytes);
+            }
+        })() };
+}
 const isUint8Array = types.isUint8Array;
 function streamChunkBytes(chunk) {
     if (Buffer.isBuffer(chunk))

package/node_modules/@openclaw/fs-safe/dist/pinned-write-types.d.ts

@@ -2,6 +2,11 @@ import type { CopyFileInput } from "./copy-file-input.js";
 import type { AnyAsyncDirectoryGuard } from "./directory-guard.js";
 import type { FileIdentityStat } from "./file-identity.js";
 import type { MutationDirectoryObservation } from "./pinned-mutation-observation.js";
+import type { NativeBinding } from "./native-binding.js";
+export type NativeWriteParent = Readonly<{
+    fd: number;
+    binding: NativeBinding;
+}>;
 export type PinnedWriteInput = {
     kind: "buffer";
     data: string | Buffer;
@@ -64,5 +69,5 @@ export type PinnedWriteParams = {
     mutationAdmission?: PinnedWriteMutationAdmission;
     onRenameIdentityMismatch?: "verify-content";
     onPublished?: (identity: PublishedWriteIdentity) => void;
-    verifyPublished?: (fd: number, identity: PublishedWriteIdentity, parentGuard: AnyAsyncDirectoryGuard) => Promise<void>;
+    verifyPublished?: (fd: number, identity: PublishedWriteIdentity, parentGuard: AnyAsyncDirectoryGuard, nativeParent?: NativeWriteParent) => Promise<void>;
 };

package/node_modules/@openclaw/fs-safe/dist/pinned-write.js

@@ -90,7 +90,7 @@ export async function runPinnedWriteHelper(params) {
     }
     const native = getNativeBinding();
     if (native) {
-        return await runPinnedWriteNative(native, normalizedParams);
+        return await runPinnedWriteNative(native, normalizedParams, input => runPinnedWriteFallback({ ...normalizedParams, input }));
     }
     return await runPinnedWriteFallback(normalizedParams);
 }

package/node_modules/@openclaw/fs-safe/dist/private-temp-workspace.js

@@ -166,7 +166,7 @@ async function createTempWorkspace(options, scopedPrefix = false) {
         else
             admission.assertCurrent();
         const stat = inspectDirectoryIdentitySync(dir);
-        const needsModeInitialization = validateInitialTempWorkspaceChild(stat, admission.ownerUid, dirMode);
+        const needsModeInitialization = validateInitialTempWorkspaceChild(stat, admission.ownerUid, dirMode, dir);
         // Retain while the child still has its private creation mode so an
         // explicit dirMode such as 0 cannot make identity descriptor acquisition fail.
         retainedChild = TempWorkspaceRetainedChild.retain(dir, stat);
@@ -261,7 +261,7 @@ function createTempWorkspaceSync(options, scopedPrefix = false) {
         else {
             stat = inspectDirectoryIdentitySync(dir);
         }
-        const needsModeInitialization = validateInitialTempWorkspaceChild(stat, admission.ownerUid, dirMode);
+        const needsModeInitialization = validateInitialTempWorkspaceChild(stat, admission.ownerUid, dirMode, dir);
         retainedChild ??= TempWorkspaceRetainedChild.retain(dir, stat);
         if (needsModeInitialization) {
             retainedChild.initializeModeSync(dirMode, admission.ownerUid, admission.assertCurrent);