@openclaw/openshell-sandbox 2026.10.1-beta.2 → 2026.10.5-beta.1

package/node_modules/@openclaw/fs-safe/dist/secure-temp-dir.js

@@ -6,6 +6,7 @@ import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
 import { hasNodeErrorCode } from "./path.js";
 import { assertSafePathSegment } from "./safe-path-segment.js";
 import { assertNoWindowsPathAlias, pathForWindowsFilesystem } from "./windows-path-alias.js";
+import { privateTempDirectoryFix, secureTempDirectoryFailure } from "./temp-directory-diagnostics.js";
 import { captureSecureTempRepairAdapter, repairSecureTempDirectory, secureTempDirectoryReceipt, } from "./secure-temp-repair.js";
 export function resolveSecureTempRoot(options) {
     const { fallbackPrefix: prefix, accessSync: suppliedAccess, lstatSync: suppliedLstat, mkdirSync: suppliedMkdir, descriptor: suppliedDescriptor, getuid: suppliedGetuid, tmpdir: suppliedTmpdir, platform: suppliedPlatform, preferredDir, skipPreferredOnWindows, warn: suppliedWarn, warningPrefix: suppliedWarningPrefix, unsafeFallbackLabel: suppliedFallbackLabel, } = options;
@@ -82,8 +83,17 @@ export function resolveSecureTempRoot(options) {
             candidate = lstatSync(candidatePath);
         }
         catch (error) {
-            return { kind: hasNodeErrorCode(error, "ENOENT") ? "missing" : "invalid", error };
+            return { kind: hasNodeErrorCode(error, "ENOENT") ? "missing" : "invalid", error,
+                detail: `directory metadata could not be read; check path traversal/access permissions; ${privateTempDirectoryFix(uid)}` };
         }
+        const failureDetail = () => {
+            try {
+                return secureTempDirectoryFailure(candidate, uid, windows);
+            }
+            catch {
+                return `directory security facts could not be read; ${privateTempDirectoryFix(uid)}`;
+            }
+        };
         let receipt;
         try {
             if (descriptor && uid !== undefined) {
@@ -91,26 +101,28 @@ export function resolveSecureTempRoot(options) {
             }
             if (receipt ? (receipt.mode & 18n) !== 0n :
                 candidate.isDirectory() !== true || candidate.isSymbolicLink() !== false || !isSecureDirForUser(candidate)) {
-                return { kind: "invalid", receipt };
+                return { kind: "invalid", receipt, detail: failureDetail() };
             }
             accessSync(candidatePath, TMP_DIR_ACCESS_MODE);
             return { kind: "available", receipt };
         }
         catch (error) {
-            return { kind: "invalid", receipt, error };
+            return { kind: "invalid", receipt, error, detail: failureDetail() };
         }
     };
     const tryRepair = (candidatePath, state, finalize = false) => {
         assertNoWindowsPathAlias(candidatePath, "filesystem", "temp directory uses a Windows filesystem namespace alias", admissionPlatform);
         if (!descriptor || uid === undefined || !state.receipt) {
-            return finalize ? { kind: "invalid", error: new Error("Secure temp descriptor finalization is unavailable.") } : state;
+            return finalize ? { ...state, kind: "invalid", error: new Error("Secure temp descriptor finalization is unavailable."),
+                detail: `descriptor finalization is unavailable; ${privateTempDirectoryFix(uid)}` } : state;
         }
         try {
             repairSecureTempDirectory(candidatePath, state.receipt, uid, descriptor, () => accessSync(candidatePath, TMP_DIR_ACCESS_MODE), () => warn(`${warningPrefix} tightened permissions on temp dir: ${candidatePath}`), finalize);
             return { kind: "available" };
         }
         catch (error) {
-            return { kind: "invalid", error };
+            return { kind: "invalid", error,
+                detail: state.detail ?? `descriptor identity, permissions, or access could not be verified during repair; ${privateTempDirectoryFix(uid)}` };
         }
     };
     const ensureTrustedFallbackDir = () => {
@@ -128,7 +140,7 @@ export function resolveSecureTempRoot(options) {
                 finalize = !windows && (suppliedMkdir !== undefined || created !== undefined);
             }
             catch (cause) {
-                throw new Error(`Unable to create fallback ${unsafeFallbackLabel}: ${fallbackPath}`, { cause });
+                throw new Error(`Unable to create fallback ${unsafeFallbackLabel}: ${JSON.stringify(fallbackPath)}; check parent directory write/search access; ${privateTempDirectoryFix(uid)}`, { cause });
             }
             // A concurrent mkdir winner has no implicit ownership or mode authority.
             state = resolveDirState(entryPath);
@@ -137,7 +149,7 @@ export function resolveSecureTempRoot(options) {
         }
         state = tryRepair(entryPath, state, finalize);
         if (state.kind !== "available") {
-            throw new Error(`Unsafe fallback ${unsafeFallbackLabel}: ${fallbackPath}`, { cause: state.error });
+            throw new Error(`Unsafe fallback ${unsafeFallbackLabel}: ${JSON.stringify(fallbackPath)}; ${state.detail}`, { cause: state.error });
         }
         return fallbackPath;
     };

package/node_modules/@openclaw/fs-safe/dist/sibling-staged-file.js

@@ -8,6 +8,8 @@ import { syncDirectoryBestEffort } from "./directory-durability.js";
 import { isWindowsReservedDeviceName } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
 import { getNativeBinding } from "./native.js";
+import { isFsSafeNativeRequired } from "./native-config.js";
+import { cachedNoReplaceDevice, isNoReplaceUnavailable } from "./native-noreplace.js";
 import { handoffPrivateProducerFile, } from "./private-producer-handoff.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { rootFromDirectoryGuard } from "./root-impl.js";
@@ -109,8 +111,18 @@ async function writeIsolatedProducer(params) {
         const result = await Reflect.apply(write, writeReceiver, [producerPath]);
         assertCurrent();
         if (native) {
-            await targetRoot.move(path.relative(targetRoot.rootReal, producerPath), path.basename(tempPath), { assertBeforeMutation: assertCurrent });
-            return { cleanupWorkspace, result };
+            try {
+                const cached = cachedNoReplaceDevice(native, parentGuard.stat.dev, "producer handoff");
+                if (cached)
+                    throw cached;
+                await targetRoot.move(path.relative(targetRoot.rootReal, producerPath), path.basename(tempPath), { assertBeforeMutation: assertCurrent });
+                return { cleanupWorkspace, result };
+            }
+            catch (error) {
+                if (isFsSafeNativeRequired() || !isNoReplaceUnavailable(error))
+                    throw error;
+                assertCurrent();
+            }
         }
         const handoff = await handoffPrivateProducerFile({
             sourcePath: producerPath,
@@ -126,7 +138,10 @@ async function writeIsolatedProducer(params) {
             await cleanupWorkspace();
         }
         catch (cleanupError) {
-            throw new AggregateError([error, cleanupError], "isolated producer operation and workspace cleanup failed");
+            const combined = new AggregateError([error, cleanupError], "isolated producer operation and workspace cleanup failed");
+            if (isNoReplaceUnavailable(error))
+                throw new FsSafeError(error.code, error.message, { cause: combined });
+            throw combined;
         }
         throw error;
     }

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-acquire.js

@@ -2,6 +2,7 @@ import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import { FsSafeError } from "./errors.js";
 import { fileObservation } from "./file-observation.js";
+import { sameFileIdentityForCleanup } from "./file-identity.js";
 import { readFileHandleBounded } from "./bounded-read.js";
 import { openSidecarRoot } from "./sidecar-lock-root.js";
 import { createNativeExclusiveFile } from "./native-operations.js";
@@ -14,7 +15,8 @@ import { ancestryHasSidecarAdmission, captureSidecarAdmissionAncestry, createSid
 import { resolveSidecarLockPaths } from "./sidecar-lock-target.js";
 import { createSuppressedError } from "./suppressed-error.js";
 import { sleep } from "./timing.js";
-import { sidecarExclusiveCreate } from "./root-create-input.js";
+import { sidecarRetainedCreate } from "./root-create-input.js";
+import { cleanupCreatedSidecar, retainCreatedSidecar } from "./sidecar-lock-retained.js";
 import { stopSidecarLockMonitoring } from "./sidecar-lock-handle.js";
 export async function acquireSidecarLock(options, context) {
     const admissionAncestry = captureSidecarAdmissionAncestry();
@@ -166,6 +168,7 @@ export async function acquireSidecarLock(options, context) {
                 continue;
             }
             let handle = null;
+            let retainedSidecar;
             let createdSnapshot = null, createdHeld;
             let admissionConflict = false;
             let exclusiveCreateConflict = false;
@@ -247,7 +250,13 @@ export async function acquireSidecarLock(options, context) {
                     const relativeLockPath = relativeSidecarLockPath(lockRoot, lockPath);
                     const observation = fileObservation();
                     try {
-                        await observation.run(() => lockRoot.create(relativeLockPath, raw, { ...sidecarExclusiveCreate, mkdir: true, mode: 0o600 }));
+                        await observation.run(() => lockRoot.create(relativeLockPath, raw, {
+                            mkdir: true, mode: 0o600,
+                            ...sidecarRetainedCreate({
+                                retain(fd, parent, nativeParent) { retainedSidecar = retainCreatedSidecar(lockPath, raw, fd, parent, nativeParent); },
+                                cleanup(fd, parent, identity) { cleanupCreatedSidecar(lockPath, raw, fd, parent, identity); },
+                            }),
+                        }));
                     }
                     catch (error) {
                         // Only this invocation's failed exclusive open grants denial retry authority.
@@ -262,6 +271,7 @@ export async function acquireSidecarLock(options, context) {
                     createdSnapshot = { raw, payload, ownershipToken };
                     const opened = await openSidecarRoot(lockRoot, relativeLockPath, "unlinked");
                     if (!opened) {
+                        retainedSidecar?.settle(true, false);
                         await waitForRetry();
                         continue;
                     }
@@ -299,7 +309,11 @@ export async function acquireSidecarLock(options, context) {
                 }
                 const snapshot = { raw, payload, stat: fsSync.fstatSync(handle.fd, { bigint: true }), ownershipToken };
                 createdSnapshot = snapshot;
+                if (retainedSidecar && !sameFileIdentityForCleanup(retainedSidecar.identity, snapshot.stat)) {
+                    throw new FsSafeError("path-mismatch", "created sidecar lock identity changed before admission");
+                }
                 if (snapshot.stat.nlink === 0n) {
+                    retainedSidecar?.settle(true, false);
                     await handle.close();
                     handle = null;
                     await waitForRetry();
@@ -310,10 +324,15 @@ export async function acquireSidecarLock(options, context) {
                     admissionConflict = true;
                     throw Object.assign(new Error("sidecar lock admission changed"), { code: "EEXIST" });
                 }
+                // An open descendant file prevents Windows directory relocation. The
+                // native receipt retains its parent and verifies the leaf at settlement.
+                if (retainedSidecar && process.platform === "win32")
+                    await handle.close();
                 createdHeld = {
                     refCount: 1,
                     reentrantOwner: requestedReentrantOwner,
                     handle,
+                    retainedSidecar,
                     lockPath,
                     snapshot,
                     acquiredAt: Date.now(),
@@ -380,7 +399,10 @@ export async function acquireSidecarLock(options, context) {
                         await handle.close().catch(() => undefined);
                     }
                     // Root records use the creator receipt; partial raw writes use fd identity.
-                    if (failedSnapshot) {
+                    if (retainedSidecar) {
+                        retainedSidecar.settle(true, false);
+                    }
+                    else if (failedSnapshot) {
                         await removeSidecarLockIfUnchanged(lockPath, failedSnapshot, {
                             lockRoot,
                             parsePayload: conditionalSidecarLockParser(parserState, admission, () => admission.hasToken() && !context.held.has(normalizedTargetPath)),

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-admission.d.ts

@@ -2,10 +2,12 @@ import type { NativeFileHandle } from "./native-operations.js";
 import type { Root } from "./root-impl.js";
 import type { SidecarLockSnapshot } from "./sidecar-lock-reclaim.js";
 import type { SidecarLockHandle } from "./sidecar-lock-types.js";
+import type { RetainedSidecar } from "./sidecar-lock-retained.js";
 export type HeldSidecarLock = {
     refCount: number;
     reentrantOwner?: string;
     handle: NativeFileHandle;
+    retainedSidecar?: RetainedSidecar;
     lockPath: string;
     snapshot: SidecarLockSnapshot;
     acquiredAt: number;

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-retained.d.ts

@@ -0,0 +1,14 @@
+import type { AnyAsyncDirectoryGuard } from "./directory-guard.js";
+import type { NativeWriteParent, PublishedWriteIdentity } from "./pinned-write-types.js";
+export interface RetainedSidecar {
+    readonly identity: Readonly<{
+        dev: bigint;
+        ino: bigint;
+    }>;
+    /** Synchronous settlement also works in the process exit handler. Always closes. */
+    settle(remove: boolean, reportMismatch?: boolean): void;
+}
+/** Borrowed creation authority: never reopens a path or closes the writer's fds. */
+export declare function cleanupCreatedSidecar(lockPath: string, raw: string, fd: number, parent: NativeWriteParent, identity: PublishedWriteIdentity): void;
+/** Called only by the exclusive creator while its verified descriptor is alive. */
+export declare function retainCreatedSidecar(lockPath: string, raw: string, createdFd: number, guard: AnyAsyncDirectoryGuard, nativeParent?: NativeWriteParent): RetainedSidecar | undefined;

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-retained.js

@@ -0,0 +1,187 @@
+import fs from "node:fs";
+import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { hasErrorCode } from "./file-cleanup.js";
+import { captureNativeFdClose } from "./native-binding.js";
+import { nativeOpenFlags } from "./native-operations.js";
+import { sameFileIdentityForCleanup, sha256Hex } from "./file-identity.js";
+function mismatch(check) {
+    return new FsSafeError("path-mismatch", `created sidecar lock ${check} changed; replacement preserved`);
+}
+function assertOwnerRecord(fd, expected) {
+    if (fs.fstatSync(fd, { bigint: true }).size !== BigInt(expected.length))
+        throw mismatch("owner record");
+    const bytes = Buffer.alloc(expected.length);
+    let offset = 0;
+    while (offset < bytes.length) {
+        const read = fs.readSync(fd, bytes, offset, bytes.length - offset, offset);
+        if (read === 0)
+            throw mismatch("owner record");
+        offset += read;
+    }
+    if (!bytes.equals(expected))
+        throw mismatch("owner record");
+}
+/** Borrowed creation authority: never reopens a path or closes the writer's fds. */
+export function cleanupCreatedSidecar(lockPath, raw, fd, parent, identity) {
+    const name = path.basename(lockPath);
+    const windows = process.platform === "win32";
+    try {
+        if (windows) {
+            if (!parent.binding.rootRemovalStat || !parent.binding.rootRemovalUnlink) {
+                throw new FsSafeError("helper-unavailable", "creator cleanup is unavailable");
+            }
+            const entry = parent.binding.rootRemovalStat(parent.fd, name);
+            if (entry.directory || entry.symlink || !sameFileIdentityForCleanup(identity, entry))
+                throw mismatch("identity");
+        }
+        else if (!parent.binding.stagedFileMatches || !parent.binding.removeStagedFile) {
+            throw new FsSafeError("helper-unavailable", "creator cleanup is unavailable");
+        }
+        else if (!parent.binding.stagedFileMatches(parent.fd, name, fd)) {
+            throw mismatch("identity");
+        }
+    }
+    catch (error) {
+        if (hasErrorCode(error, "ENOENT"))
+            return;
+        throw error;
+    }
+    const stat = fs.fstatSync(fd, { bigint: true });
+    if (!stat.isFile() || stat.nlink !== 1n || !sameFileIdentityForCleanup(identity, stat))
+        throw mismatch("identity");
+    assertOwnerRecord(fd, Buffer.from(raw));
+    if (windows) {
+        try {
+            parent.binding.rootRemovalUnlink(parent.fd, name, identity.dev, identity.ino, false);
+        }
+        catch (error) {
+            if (!hasErrorCode(error, "ENOENT"))
+                throw error;
+        }
+    }
+    else {
+        if (parent.binding.removeStagedFile(parent.fd, name, fd) === "preserved")
+            throw mismatch("identity");
+    }
+}
+/** Called only by the exclusive creator while its verified descriptor is alive. */
+export function retainCreatedSidecar(lockPath, raw, createdFd, guard, nativeParent) {
+    const binding = nativeParent?.binding;
+    if (!binding)
+        return undefined;
+    const created = fs.fstatSync(createdFd, { bigint: true });
+    if (!created.isFile() || created.nlink !== 1n)
+        throw mismatch("identity");
+    const identity = Object.freeze({ dev: created.dev, ino: created.ino });
+    const name = path.basename(lockPath);
+    if (process.platform === "win32") {
+        if (!binding.retainWindowsSidecar)
+            return undefined;
+        const native = binding.retainWindowsSidecar(nativeParent.fd, guard.realPath, name, BigInt(guard.stat.dev), BigInt(guard.stat.ino), created.dev, created.ino, BigInt(Buffer.byteLength(raw)), sha256Hex(raw), 1024 * 1024);
+        const admitted = native.admission;
+        if (admitted.status === "unsupported" && admitted.resources === "closed")
+            return undefined;
+        if (admitted.status !== "retained") {
+            throw new FsSafeError("helper-failed", "could not retain created sidecar lock", { details: { result: admitted } });
+        }
+        return { identity, settle(remove, reportMismatch = true) {
+                const result = native.settle(remove);
+                if (result.status === "preserved-mismatch") {
+                    if (reportMismatch || result.resources !== "closed") {
+                        throw mismatch(result.errors.some(error => /digest|size changed/u.test(error.message)) ? "owner record" : "identity");
+                    }
+                    return;
+                }
+                if (result.errors.length || result.resources !== "closed" ||
+                    (remove && result.disposition !== "accepted" && result.namespace !== "absent")) {
+                    throw new FsSafeError("helper-failed", "retained sidecar lock settlement failed", { details: { result } });
+                }
+            } };
+    }
+    if (!binding.stagedFileMatches || !binding.removeStagedFile)
+        return undefined;
+    const closeFile = captureNativeFdClose(binding);
+    const parentFd = binding.openBeneath(nativeParent.fd, "", nativeOpenFlags(fs.constants.O_RDONLY | fs.constants.O_DIRECTORY)).fd;
+    let fd;
+    try {
+        const parentStat = fs.fstatSync(parentFd, { bigint: true });
+        if (!parentStat.isDirectory() || !sameFileIdentityForCleanup(guard.stat, parentStat))
+            throw mismatch("identity");
+        fd = binding.openBeneath(parentFd, name, nativeOpenFlags(fs.constants.O_RDONLY | fs.constants.O_NONBLOCK)).fd;
+        const ownedFd = fd;
+        const assertIdentity = () => {
+            try {
+                if (!binding.stagedFileMatches(parentFd, name, ownedFd))
+                    throw mismatch("identity");
+            }
+            catch (error) {
+                if (hasErrorCode(error, "ENOENT"))
+                    return false;
+                throw error;
+            }
+            const current = fs.fstatSync(ownedFd, { bigint: true });
+            if (!current.isFile() || current.nlink !== 1n || !sameFileIdentityForCleanup(created, current))
+                throw mismatch("identity");
+            return true;
+        };
+        const expected = Buffer.from(raw);
+        const assertOwner = () => assertOwnerRecord(ownedFd, expected);
+        if (!assertIdentity())
+            throw mismatch("identity");
+        assertOwner();
+        let settled = false;
+        return { identity, settle(remove, reportMismatch = true) {
+                if (settled)
+                    return;
+                settled = true;
+                const errors = [];
+                try {
+                    if (remove && assertIdentity()) {
+                        assertOwner();
+                        if (assertIdentity() && binding.removeStagedFile(parentFd, name, ownedFd) === "preserved")
+                            throw mismatch("identity");
+                    }
+                }
+                catch (error) {
+                    if (reportMismatch || !(error instanceof FsSafeError && error.code === "path-mismatch"))
+                        errors.push(error);
+                }
+                try {
+                    closeFile(ownedFd);
+                }
+                catch (error) {
+                    errors.push(error);
+                }
+                try {
+                    closeFile(parentFd);
+                }
+                catch (error) {
+                    errors.push(error);
+                }
+                if (errors.length === 1)
+                    throw errors[0];
+                if (errors.length)
+                    throw new AggregateError(errors, "sidecar lock cleanup and close failed");
+            } };
+    }
+    catch (error) {
+        const errors = [error];
+        try {
+            if (fd !== undefined)
+                closeFile(fd);
+        }
+        catch (closeError) {
+            errors.push(closeError);
+        }
+        try {
+            closeFile(parentFd);
+        }
+        catch (closeError) {
+            errors.push(closeError);
+        }
+        if (errors.length > 1)
+            throw new AggregateError(errors, "sidecar retention and close failed");
+        throw error;
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock.js

@@ -108,7 +108,10 @@ function releaseAllLocksSync(state, options) {
         void held.handle.close().catch(() => undefined);
         try {
             const retained = options?.preserveRetained === true && held.retainOnExit;
-            if (!retained && !held.lockRoot && snapshotMatchesSync(held.lockPath, held.snapshot)) {
+            if (held.retainedSidecar) {
+                held.retainedSidecar.settle(!retained);
+            }
+            else if (!retained && !held.lockRoot && snapshotMatchesSync(held.lockPath, held.snapshot)) {
                 fsSync.rmSync(held.lockPath, { force: true });
             }
         }
@@ -186,6 +189,17 @@ async function releaseHeldLock(state, normalizedTargetPath, held, options = {})
     }
     held.releasePromise = (async () => {
         await held.handle.close().catch(() => undefined);
+        if (held.retainedSidecar) {
+            try {
+                held.retainedSidecar.settle(true);
+            }
+            finally {
+                if (state.held.get(normalizedTargetPath) === held)
+                    state.held.delete(normalizedTargetPath);
+                stopSidecarLockMonitoring(held);
+            }
+            return;
+        }
         await removeSidecarLockIfUnchanged(held.lockPath, held.snapshot, {
             lockRoot: held.lockRoot,
             parsePayload: held.parsePayload,

package/node_modules/@openclaw/fs-safe/dist/staged-file-settlement.js

@@ -1,4 +1,5 @@
 import { FsSafeError } from "./errors.js";
+import { noReplaceUnavailable } from "./native-noreplace.js";
 export function createStagedFileReceipt(directory, temporaryBasename, stat) {
     return Object.freeze({
         directory,
@@ -11,6 +12,7 @@ export function createStagedFileReceipt(directory, temporaryBasename, stat) {
     });
 }
 export function stagedFailure(kind, error, details) {
+    error = noReplaceUnavailable(error, `${kind} publication`) ?? error;
     let code = "helper-failed";
     try {
         code = error instanceof FsSafeError ? error.code
@@ -19,7 +21,8 @@ export function stagedFailure(kind, error, details) {
     catch {
         // Uninspectable error metadata must not interrupt terminal settlement.
     }
-    return new FsSafeError(code, `staged ${kind} ${details.phase} failed`, { cause: error, details });
+    return new FsSafeError(code, code === "helper-unavailable" && error instanceof FsSafeError
+        ? error.message : `staged ${kind} ${details.phase} failed`, { cause: error, details });
 }
 /** Finish owned cleanup and every close before surfacing publication evidence. */
 export async function settleStagedFile(params) {

package/node_modules/@openclaw/fs-safe/dist/temp-directory-diagnostics.d.ts

@@ -0,0 +1,10 @@
+export declare function tempDirectoryMode(mode: number | bigint): string;
+export declare function privateTempDirectoryFix(uid: number | undefined): string;
+type TempDirectoryStat = {
+    isDirectory(): boolean;
+    isSymbolicLink(): boolean;
+    uid?: number | bigint;
+    mode?: number | bigint;
+};
+export declare function secureTempDirectoryFailure(stat: TempDirectoryStat, uid: number | undefined, windows: boolean): string;
+export {};

package/node_modules/@openclaw/fs-safe/dist/temp-directory-diagnostics.js

@@ -0,0 +1,29 @@
+export function tempDirectoryMode(mode) {
+    return (typeof mode === "bigint" ? mode & 4095n : mode & 0o7777).toString(8).padStart(4, "0");
+}
+export function privateTempDirectoryFix(uid) {
+    return `use a real private directory${uid === undefined ? "" : ` owned by uid ${uid}`} with mode 0700 under trusted ancestors (or use resolveSecureTempRoot()); do not chmod a shared temp directory to 0700`;
+}
+// Called only after failed admission; diagnostics never authorize repair.
+export function secureTempDirectoryFailure(stat, uid, windows) {
+    if (stat.isSymbolicLink())
+        return "is a symbolic link; choose a real directory, not a symlink";
+    if (!stat.isDirectory())
+        return "is not a directory; choose a real directory";
+    if (!windows && uid !== undefined) {
+        if (stat.uid !== undefined && stat.uid !== uid && stat.uid !== BigInt(uid)) {
+            return `has owner uid ${stat.uid}, expected uid ${uid}; ${privateTempDirectoryFix(uid)}`;
+        }
+        const mode = stat.mode;
+        if (mode !== undefined) {
+            if ((typeof mode === "number" && (!Number.isSafeInteger(mode) || mode < 0)) ||
+                (typeof mode === "bigint" && mode < 0n)) {
+                return `has invalid mode bits; ${privateTempDirectoryFix(uid)}`;
+            }
+            if (typeof mode === "bigint" ? (mode & 18n) !== 0n : (mode & 0o022) !== 0) {
+                return `has group/world-writable mode ${tempDirectoryMode(mode)} (a sticky bit does not make a private root safe); ${privateTempDirectoryFix(uid)}`;
+            }
+        }
+    }
+    return `directory identity, permissions, or write/search access could not be verified; ${privateTempDirectoryFix(uid)}`;
+}

package/node_modules/@openclaw/fs-safe/dist/temp-target.js

@@ -143,7 +143,7 @@ export async function createOwnedTempFile(params) {
             capability.assertCurrent();
             const initial = inspectDirectoryIdentitySync(dir);
             identity = Object.freeze({ dev: initial.dev, ino: initial.ino });
-            const needsModeInitialization = validateInitialTempWorkspaceChild(initial, admission.ownerUid, 0o700);
+            const needsModeInitialization = validateInitialTempWorkspaceChild(initial, admission.ownerUid, 0o700, dir);
             retainedChild = TempWorkspaceRetainedChild.retain(dir, identity);
             if (needsModeInitialization) {
                 await retainedChild.initializeMode(0o700, admission.ownerUid, admission.assertCurrent);

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-admission.js

@@ -46,7 +46,7 @@ function snapshotFromExactObservation(dir, uid, realPath, stat, privateDirectory
     if (stat.symbolicLink || !stat.directory) {
         throw new FsSafeError("not-file", "temp workspace root component must be a real directory");
     }
-    assertTrustedTempWorkspaceDirectory(stat, uid, privateDirectory);
+    assertTrustedTempWorkspaceDirectory(stat, uid, privateDirectory, dir);
     const identity = Object.freeze({ dev: stat.dev, ino: stat.ino });
     // Retain copied immutable scalars, never a mutable Stats object supplied by
     // an observation hook. Every later permission check uses a fresh snapshot.
@@ -106,7 +106,7 @@ function inspectSnapshotIdentity(entry) {
 }
 function assertSnapshot(entry, uid) {
     const stat = inspectSnapshotIdentity(entry);
-    assertTrustedTempWorkspaceDirectory(stat, uid, entry.privateDirectory);
+    assertTrustedTempWorkspaceDirectory(stat, uid, entry.privateDirectory, entry.dir);
     assertCanonicalRoot(entry);
 }
 function snapshotMissingRootComponent(parent, dir, ownerUid, privateDirectory) {
@@ -115,7 +115,7 @@ function snapshotMissingRootComponent(parent, dir, ownerUid, privateDirectory) {
         return snapshot(dir, ownerUid, undefined, privateDirectory);
     }
     const current = inspectSnapshotIdentity(parent);
-    assertTrustedTempWorkspaceDirectory(current, ownerUid, parent.privateDirectory);
+    assertTrustedTempWorkspaceDirectory(current, ownerUid, parent.privateDirectory, parent.dir);
     let realPath;
     try {
         realPath = canonicalTempWorkspacePath(dir);
@@ -136,7 +136,7 @@ function snapshotMissingRootComponent(parent, dir, ownerUid, privateDirectory) {
 function assertChain(chain, uid) {
     for (const entry of chain) {
         const current = inspectSnapshotIdentity(entry);
-        assertTrustedTempWorkspaceDirectory(current, uid, entry.privateDirectory);
+        assertTrustedTempWorkspaceDirectory(current, uid, entry.privateDirectory, entry.dir);
     }
     const last = chain[chain.length - 1];
     assertCanonicalRoot(last);
@@ -159,7 +159,7 @@ function associateTempWorkspaceRoot(entry, ownerUid, descriptorFd) {
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
         throw new FsSafeError("not-file", "temp workspace cleanup parent must be a real directory");
     }
-    assertTrustedTempWorkspaceDirectory(stat, ownerUid, entry.privateDirectory);
+    assertTrustedTempWorkspaceDirectory(stat, ownerUid, entry.privateDirectory, entry.dir);
 }
 function discoverMissingTempWorkspaceAncestor(ancestor, missing, missingError) {
     // The caller already classified the first ENOENT. Keep this handoff out of
@@ -290,7 +290,7 @@ function canonicalRootAdmission(discovery, ownerUid) {
                     return snapshot(dir, ownerUid, dir, index === ancestry.length - 1 && discovery.privateDirectory).entry;
                 }
                 const current = inspectSnapshotIdentity(discovery);
-                assertTrustedTempWorkspaceDirectory(current, ownerUid, discovery.privateDirectory);
+                assertTrustedTempWorkspaceDirectory(current, ownerUid, discovery.privateDirectory, discovery.dir);
                 return discovery;
             });
             const current = candidate[candidate.length - 1];

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-child-admission.d.ts

@@ -14,10 +14,10 @@ export declare function projectTempWorkspaceNumericIdentity(identity: TempWorksp
 export declare function inspectTempWorkspaceDescriptorIdentitySync(fd: number, expected: TempWorkspaceIdentity, numeric: TempWorkspaceNumericIdentity | undefined): TempWorkspaceIdentityStat;
 export declare function inspectTempWorkspaceDirectoryIdentitySync(dir: string, expected: TempWorkspaceIdentity, numeric: TempWorkspaceNumericIdentity | undefined): TempWorkspaceIdentityStat;
 export declare function validateTempWorkspaceDirMode(mode: number): void;
-export declare function assertTrustedTempWorkspaceDirectory(stat: Pick<BigIntStats, "uid" | "gid" | "mode"> | Pick<Stats, "uid" | "gid" | "mode">, uid: number | undefined, privateDirectory?: boolean): void;
-export declare function assertTempWorkspaceChildState(stat: BigIntStats | Stats, ownerUid: number | undefined): void;
-export declare function validateInitialTempWorkspaceChild(stat: BigIntStats, ownerUid: number | undefined, mode: number): boolean;
+export declare function assertTrustedTempWorkspaceDirectory(stat: Pick<BigIntStats, "uid" | "gid" | "mode"> | Pick<Stats, "uid" | "gid" | "mode">, uid: number | undefined, privateDirectory: boolean, dir: string): void;
+export declare function assertTempWorkspaceChildState(stat: BigIntStats | Stats, ownerUid: number | undefined, dir: string): void;
+export declare function validateInitialTempWorkspaceChild(stat: BigIntStats, ownerUid: number | undefined, mode: number, dir: string): boolean;
 export declare function childHasRequestedMode(stat: BigIntStats | Stats, mode: number): boolean;
 export declare function admitTempWorkspaceChild(dir: string, expected: BigIntStats, parent: TempWorkspaceRootAdmission, mode: number): Promise<void> | undefined;
 export declare function admitTempWorkspaceChildSync(dir: string, expected: BigIntStats, parent: TempWorkspaceRootAdmission, mode: number): void;
-export declare function validateAdmittedTempWorkspaceChild(current: TempWorkspaceIdentityStat, ownerUid: number | undefined, mode: number): void;
+export declare function validateAdmittedTempWorkspaceChild(current: TempWorkspaceIdentityStat, ownerUid: number | undefined, mode: number, dir: string): void;