@openclaw/openshell-sandbox 2026.10.2 → 2026.10.5-beta.2

package/node_modules/@openclaw/fs-safe/dist/watch-rescan.js

@@ -55,15 +55,9 @@ export function mergeWatchRescan(scopes, before, slice, requested) {
         for (const name of slice.childPaths?.get(directory)?.values() ?? [])
             selected.add(name);
     }
-    for (const [name, previous] of before.entries) {
-        if (!selected.has(name))
-            continue;
-        const current = slice.entries.get(name);
-        if ((previous.startsWith("directory:") || current?.startsWith("directory:")) && identity(previous) !== identity(current))
-            return;
-    }
-    for (const [name, current] of slice.entries) {
-        if (selected.has(name) && current.startsWith("directory:") && identity(current) !== identity(before.entries.get(name)))
+    for (const name of selected) {
+        const previous = before.entries.get(name), current = slice.entries.get(name);
+        if ((previous?.startsWith("directory:") || current?.startsWith("directory:")) && identity(previous) !== identity(current))
             return;
     }
     // Exclusion changes can retire or admit a subtree, including callback-driven changes.

package/node_modules/@openclaw/fs-safe/dist/watch.js

@@ -5,7 +5,6 @@ import { rootHandleContext } from "./root-handle-context.js";
 import { createSuppressedError } from "./suppressed-error.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
 import { mergeWatchRescan, watchRescanScopes } from "./watch-rescan.js";
-import { watchStreamPaths } from "./watch-stream.js";
 import { admittedNativeChanges, changedEntries, excludedWatchPath, guardedHintChanges, scopedChanges } from "./watch-hints.js";
 import path from "node:path";
 import { watchBinding, NativeWatchBackend } from "./watch-native.js";
@@ -338,7 +337,7 @@ export function watch(root, input) {
                 }, maxPendingPaths, persistent);
                 backend = candidate;
                 if (snapshot)
-                    candidate.configure(watchStreamPaths(snapshot, g.scopes));
+                    candidate.configure(snapshot, g.scopes);
                 const hookResult = getFsSafeTestHooks()?.afterWatchBackendCreated?.(context.rootReal, batch => {
                     if (backend === candidate)
                         onHint(g, batch);
@@ -401,7 +400,7 @@ export function watch(root, input) {
             }
             try {
                 const entriesChanged = backend?.entries(next);
-                const streamsChanged = backend?.configure(watchStreamPaths(next, g.scopes));
+                const streamsChanged = backend?.configure(next, g.scopes);
                 if (entriesChanged || streamsChanged) {
                     // Complete a guarded pass with the new transport before publishing readiness.
                     // Bound handovers under churn; later passes still reconcile ongoing changes.

package/node_modules/@openclaw/fs-safe/docs/advanced.md

@@ -82,7 +82,7 @@ concurrent namespace changes.
 | `appendRegularFile`, `appendRegularFileSync`, `readRegularFile`, `readRegularFileSync`, `statRegularFile`, `statRegularFileSync`, `resolveRegularFileAppendFlags`, `AppendRegularFileOptions`, `RegularFileStatResult` | [regular-file.md](regular-file.md) | Type-checked regular-file I/O. |
 | `retainEntryForPublication`, `RetainedEntryPublication`, `RetainEntryForPublicationOptions`, `EntryPublicationReceipt`, `EntryPublicationResult`, `EntryPublicationIssue`, `PublicationIdentity`, `PublicationParent` | [One-way entry publication](entry-publication.md) | Native no-replace directory/regular-file/symlink export, including Windows NTFS junctions, under caller-exclusive namespace; explicit transition receipts, close-only disposal, no source CAS. |
 | `retainFileInDirectory`, `RetainedFile`, related receipt/result types | [Retained Windows files](retained-file.md) | Existing-file native handle custody and explicit removal; local NTFS, producer authority required, no persistence guarantee. |
-| `copyRootFileSync`, `CopyRootFileSyncOptions`, `CopiedRootFileSync` | [copy.md](copy.md#synchronous-guarded-file-copies) | Synchronous guarded exclusive file copy, optionally cloned and bound to an expected source identity, returning an owned destination descriptor and both identities. |
+| `copyRootFileSync`, `createRootFileCopyBatchSync`, `RootFileCopyBatchSync`, `CopyRootFileSyncOptions`, `CopiedRootFileSync` | [copy.md](copy.md#synchronous-guarded-file-copies) | Synchronous guarded exclusive file copy, optionally cloned and bound to an expected source identity, returning an owned destination descriptor and both identities. |
 | `sameFileIdentity`, `FileIdentityStat` | – | Compare two stats for same-inode equality. |
 | `readDirectoryIdentity`, `assertDirectoryIdentitySync`, `DirectoryIdentity` | [directory-identity.md](directory-identity.md) | Observe exact bigint directory identity and synchronously check a caller-selected path, optionally retaining its canonical path. |
 | `pathExists`, `pathExistsSync` | – | Boolean existence check that does not throw on `ENOENT`. |

package/node_modules/@openclaw/fs-safe/docs/archive.md

@@ -702,6 +702,9 @@ await extractArchive({
 
 ## `readArchiveEntry`
 
+The byte limit is selected and validated once before reading the archive; changing
+the options object during a read does not change the active limit.
+
 `readArchiveEntry(archivePath, entryPath, { maxBytes, kind? })` reads one
 regular-file entry into a bounded `Buffer` without extracting a tree. It reads
 the input through an identity-checked descriptor, rejects a requested link or

package/node_modules/@openclaw/fs-safe/docs/atomic.md

@@ -16,6 +16,11 @@ import {
 
 Write `content` to a sibling temp file in the destination directory, apply the parent-directory and final file modes through verified descriptors, optionally `fsync` the file descriptor, optionally `fsync` the parent directory after rename, then atomically rename over the destination. No permission change follows a caller-supplied pathname.
 
+On POSIX, non-durable asynchronous writes using Node inspect the staged file's
+complete permission bits with their final identity check and skip a redundant
+mode change when they already match. A restrictive umask or differing special
+bits still require descriptor mode correction before publication.
+
 On POSIX, the parent is opened with no-follow and directory-only flags, checked against its exact pre-open device/inode identity, and mode-adjusted through that descriptor. A replacement symlink is rejected rather than followed. If the directory cannot be opened for descriptor access, the operation fails closed instead of retrying by pathname. Windows does not enforce POSIX directory modes and Node cannot consistently open directory descriptors there, so `dirMode` is passed only to `mkdir`; no pathname `chmod` fallback is attempted.
 
 Async replacements to the same destination are serialized inside the current process, so two overlapping `replaceFileAtomic()` calls do not interleave their temp-write/rename phases. Use a sidecar lock when multiple processes may write the same target.
@@ -258,7 +263,9 @@ opened, removed, or replaced. A successor at that name is left untouched.
 `details.cleanup: "restored"` means the retained original file's bytes and mode
 were restored and synchronized, not that the pathname still names it. The existing
 `writing` receipt identifies that file; no `published` receipt is emitted for a
-failed replacement. Restoration I/O failures report `"restore-failed"`.
+failed replacement. Restoration I/O failures report `"restore-failed"`, even if
+the thrown error itself carries a `cleanup: "restored"` receipt from another
+operation; the cause retains both the replacement and restoration failures.
 
 Callback refusals, detected identity/type/link changes, and other metadata errors
 remain terminal. Failed descriptor revalidation also stops restoration. These
@@ -539,8 +546,9 @@ remain a best-effort sequence, not atomic.
 `onDestinationPublished` runs exactly once after a successful rename resolves,
 before awaited post-rename directory checks or source cleanup. It receives a
 frozen receipt with the resolved absolute destination path and the exact bigint
-device/inode identity observed on the rename source before dispatch: the
-original source for a direct rename, or the staged copy for fallback. Failed
+device/inode identity observed on the rename source after the synchronous
+authority callbacks return and before dispatch: the source selected for a direct
+rename, or the staged copy for fallback. Failed
 rename attempts never emit receipts. The return contract remains `Promise<void>`.
 
 The receipt records an observed identity, not authorization, durable storage,

package/node_modules/@openclaw/fs-safe/docs/contributing.md

@@ -175,7 +175,7 @@ temporary storage; session scratch trees may suppress macOS filesystem events.
 ### Optional Linux Testbox
 
 The manual `testbox-validation.yml` workflow prepares a 16-vCPU Ubuntu 24.04
-Blacksmith Testbox with Node 24.21.0, pnpm 12.4.2, dependencies, the Rust WASM
+Blacksmith Testbox with Node 24.21.0, pnpm 12.10.1, dependencies, the Rust WASM
 target, and the pinned portable archive compiler. It leaves library builds and
 validation commands to the caller and does not replace required CI checks.
 

package/node_modules/@openclaw/fs-safe/docs/copy.md

@@ -257,3 +257,51 @@ replacement entries. This helper creates directly at the destination name, so
 other processes may observe partial bytes until it returns. It does not promise
 crash durability or a coherent snapshot of concurrent in-place source edits.
 Use a private capture directory and keep sources unchanged while capturing.
+
+### Batches of synchronous guarded copies
+
+`createRootFileCopyBatchSync()` on `advanced` returns a disposable
+`RootFileCopyBatchSync`. Its `copyFile(options)` takes the same
+`CopyRootFileSyncOptions` and returns the same owned `CopiedRootFileSync` as
+`copyRootFileSync`:
+
+```ts
+import { createRootFileCopyBatchSync } from "@openclaw/fs-safe/advanced";
+
+using batch = createRootFileCopyBatchSync();
+for (const name of ["plugin.js", "package.json"]) {
+  using copied = batch.copyFile({
+    source: { rootPath: "/srv/plugins", absolutePath: `/srv/plugins/${name}` },
+    destination: { rootPath: "/srv/capture", absolutePath: `/srv/capture/${name}` },
+    clone: "auto",
+    maxBytes: 16 * 1024 * 1024,
+  });
+  console.log(copied.bytes, copied.sourceIdentity);
+}
+```
+
+On canonical POSIX paths, the batch retains root and ancestor directory
+identities across files. Every use still checks those identities without
+following directory symlinks; root and parent canonical paths are rechecked.
+Source opens, source and destination file identities, hardlink policy, exclusive
+creation, bounds, permissions, and cleanup are checked separately for every file.
+No source descriptor, file contents, or successful file-admission result is cached.
+An ancestor replacement rejects even when the leaf parent has not changed.
+Windows and noncanonical path spellings keep the full per-file resolver and its
+alias handling. There is no option to bypass validation.
+
+Keep the batch scoped to one capture or materialization, with unchanged source
+and destination directory topology. `close()` and `Symbol.dispose` idempotently
+release its retained metadata; later calls reject with `invalid-path`. Returned
+file descriptors remain independently caller-owned. Successful earlier files
+are not rolled back if a later copy fails. A failed copy keeps the ordinary
+identity-checked cleanup contract; the batch is not an atomic tree transaction
+or a coherent snapshot of concurrent edits. The single-file helper also reuses
+directory admissions for the duration of its one copy.
+
+Both APIs reuse the freshly checked canonical root during initial POSIX path
+admission. This avoids repeatedly resolving every absolute root component while
+retaining lexical traversal and the before/after root and parent identity checks.
+Windows and root aliases retain the ordinary resolver, including its handling
+of dot segments in symlink targets. No caller changes are needed for the
+single-file improvement.

package/node_modules/@openclaw/fs-safe/docs/guest.md

@@ -43,9 +43,26 @@ The fragment has no argument preflight of its own.
 
 On Linux it uses `renameat2(RENAME_NOREPLACE)`; on macOS it uses
 `renameatx_np(RENAME_EXCL)`. If Linux lacks that function or reports it as
-unsupported, it falls back to `link(..., follow_symlinks=False)`, leaving the
-source entry for caller cleanup. That fallback supports files, not directory
-publication. Existing destinations are never replaced by this fragment.
+unsupported, it falls back to `link(..., follow_symlinks=False)`, verifying the
+source and target against the admitted inode with exactly two links
+before unlinking the source. Admission and final target verification require
+one link. A successful file publication consumes the source in both paths.
+
+For directories, a definitive Linux rejection (`EINVAL`, `ENOSYS`, `ENOTSUP`,
+or `EOPNOTSUPP`) or missing `renameat2` rechecks the source identity and target
+absence, then uses plain rename through the same directory descriptors. A
+trailing slash enforces directory source type at the syscall. Directory rename
+can replace only an **empty directory created concurrently**; non-empty
+directories and non-directory targets are refused as `EEXIST`. An existing
+empty directory observed by the absence check is also refused. No empty claim
+directory is exposed before publishing the completed source.
+
+Identity checks and mutation remain separate, not source-name compare-and-swap.
+The fallback verifies the published identity afterward. A file fallback failure
+can leave both names, and post-publication failures preserve the destination
+for caller reconciliation. Exclusive-create cleanup preserves changed payloads
+and incomplete link pairs. The guest has no strict/require mode; host native
+policy does not apply. macOS and other errors retain their fail-closed behavior.
 
 ## Invocation protocol
 
@@ -107,7 +124,7 @@ entries, including symlinks, without following them. A force removal tolerates
 a missing leaf but does not suppress failure to open its parent.
 
 Write preserves an existing regular file's mode and otherwise creates private
-files. Copy preserves the source mode. Exclusive create publishes a mode-0600
+files. Copy and cross-device file moves preserve the admitted source descriptor's mode. Exclusive create publishes a mode-0600
 file from a private staging directory. Staging names retain the `.openclaw-*`
 prefixes and use short random suffixes independent of the destination basename,
 so legal names near the filesystem's component limit also work for writes and

package/node_modules/@openclaw/fs-safe/docs/path-scope.md

@@ -1,5 +1,9 @@
 # pathScope()
 
+Paths supplied to a scope are literal filesystem names. In particular, `~/file`
+selects a file inside a directory named `~` beneath the scope; it does not expand
+the user's home directory.
+
 `pathScope()` prepares absolute paths and returns plain `{ ok, path }` results. `resolve()` and `resolveAll()` check lexical containment without touching the filesystem; `existing()`, `files()`, and `writable()` add the filesystem checks described below. Use it to prepare paths before handing them to another library, whose file-opening and mutation behavior still applies.
 
 ```ts

package/node_modules/@openclaw/fs-safe/docs/sidecar-lock.md

@@ -35,7 +35,7 @@ try {
 
 The lock file sits next to the protected resource. If a process crashes mid-lock, the next acquirer notices the held entry, inspects its payload (PID, host, acquired-at timestamp), and decides — via `shouldReclaim` (defaulting to "is the lock older than `staleMs`?") — whether it should keep waiting or fail.
 
-On natural event-loop shutdown, a globally deduplicated `process.on("beforeExit")` handler attempts asynchronous cleanup of held Root-backed locks through their retained Root capability and ownership receipt. The synchronous `process.on("exit")` handler provides last-chance cleanup for raw locks and raw-path reclaim guards. Changed sidecars and failed Root cleanup remain in place; cleanup does not keep retrying during shutdown unless another acquisition re-arms it. Locks acquired with `retainOnExit: true` are exempt from both handlers: their sidecar stays in place after exit and is governed only by the caller's own stale policy. Because exit handlers are globally deduplicated across package copies, `retainOnExit` fails closed with `helper-unavailable` if an older copy that cannot honor it registered the handlers first.
+On natural event-loop shutdown, a globally deduplicated `process.on("beforeExit")` handler attempts asynchronous cleanup of held Root-backed locks through their creation receipt (or the Root capability when native retention is unavailable). The synchronous `process.on("exit")` handler also cleans retained native sidecars, raw locks, and raw-path reclaim guards. Changed sidecars and failed Root cleanup remain in place; cleanup does not keep retrying during shutdown unless another acquisition re-arms it. Locks acquired with `retainOnExit: true` are exempt from both handlers: their sidecar stays in place after exit and is governed only by the caller's own stale policy. Because exit handlers are globally deduplicated across package copies, `retainOnExit` fails closed with `helper-unavailable` if an older copy that cannot honor it registered the handlers first.
 
 Asynchronous Root-backed stale recovery uses a regular file at the
 `.reclaim` name, created, verified, and removed through that Root. Its ownership
@@ -57,17 +57,17 @@ even if guard ownership has also changed.
 Root guard; let its original attempt settle before retrying that guarded path.
 It stops compromise monitoring for forgotten holders, including callbacks from checks already in flight.
 
-Always release locks in a `finally` block. Application-managed graceful shutdown can await `release()` or `manager.drain()` before terminating. Explicit `process.exit()`, uncaught failures, crashes, default signal handling, and fatal termination (including `SIGKILL`) do not reliably run asynchronous Root cleanup and may leave sidecars. Recover only after an application-owned liveness policy proves the holder cannot still be writing.
+Always release locks in a `finally` block. Application-managed graceful shutdown can await `release()` or `manager.drain()` before terminating. Explicit `process.exit()` runs synchronous cleanup for retained native sidecars, but cannot run asynchronous fallback Root cleanup. Uncaught failures, crashes, default signal handling, and fatal termination (including `SIGKILL`) may leave sidecars. Recover only after an application-owned liveness policy proves the holder cannot still be writing.
 
 Exit cleanup tolerates shared managers created by older package copies that lack reclaim-guard state, and continues through later manager domains. Handler ownership remains first-registration-wins: loading an updated copy does not replace an older copy's registered handler. First registration is committed only after Node accepts the listener; synchronous `newListener` reentry fails closed and a thrown registration rolls back so a later acquisition can retry. Restart with the updated copy registering first to obtain the fix. After building, `node scripts/legacy-lock-exit-proof.mjs` checks clean exit, removal of legacy and modern raw locks, and preservation of a retained lock using synthetic temporary files.
 
-Each new sidecar also carries an internal random ownership token encoded as JSON trailing whitespace. `JSON.parse()` and every payload callback still see exactly the caller-provided object. Only the process that successfully created the sidecar keeps that token as release authority; merely reading token-shaped bytes from disk does not enable this mode. Release compares the in-memory token and exact serialized bytes, and requires the pathname to remain a regular file, instead of requiring an opened descriptor and pathname lookup to report the same inode identity. This preserves ownership checks on filesystems such as Docker Desktop VirtioFS where those two views can legitimately differ. Sidecars created by older releases have no token and retain the legacy identity-plus-content check. Raw acquisition, snapshot, and exit cleanup capture bigint device/inode values; unsafe numeric identities from older in-process receipts cannot authorize cleanup. If Windows reports a zero device or inode for either identity observation, that check is inconclusive and removal is skipped.
+Each new sidecar also carries an internal random ownership token encoded as JSON trailing whitespace. `JSON.parse()` and every payload callback still see exactly the caller-provided object. Only the process that successfully created the sidecar keeps that token as release authority; merely reading token-shaped bytes from disk does not enable this mode. Raw and JavaScript fallback release compare the in-memory token and exact serialized bytes, and require the pathname to remain a regular file, instead of requiring an opened descriptor and pathname lookup to report the same inode identity. Retained native Root locks additionally require the exact created inode and a single link, as described below. This preserves ownership checks on filesystems such as Docker Desktop VirtioFS where those two views can legitimately differ. Sidecars created by older releases have no token and retain the legacy identity-plus-content check. Raw acquisition, snapshot, and exit cleanup capture bigint device/inode values; unsafe numeric identities from older in-process receipts cannot authorize cleanup. If Windows reports a zero device or inode for either identity observation, that check is inconclusive and removal is skipped.
 
 Last-chance raw-lock exit cleanup requires known Windows device and inode values from both pathname observations and the opened descriptor. A zero value leaves the sidecar in place, including for token-owned locks. Known descriptor/path identity differences remain supported; a pathname identity change during the read still prevents cleanup.
 
 The raw sidecar bytes are not a canonical JSON representation: tools that trim or rewrite the trailing whitespace invalidate the ownership token, so release leaves the changed sidecar in place and fails closed. The token distinguishes cooperating acquisitions; it is not a secret and does not make pathname compare-and-remove atomic against a hostile process that can replace files outside the lock protocol.
 
-`release()` propagates an I/O failure that prevents deletion of an unchanged, owned sidecar; it never reports successful cleanup while leaving that lock behind. The handle and manager retain the exact cleanup receipt after a failure, so the same handle can retry `release()` and `manager.drain()` can retry retained cleanup. A changed sidecar remains an ownership mismatch rather than a deletion failure and is left untouched. If both a `withFileLock()` or `withFileLockSync()` callback and release fail, the release error is the primary `SuppressedError.error` and the callback failure remains available as `SuppressedError.suppressed`. Failed asynchronous acquisition cleanup uses the same shape, with the cleanup error primary and the acquisition failure suppressed. On Node runtimes without the global `SuppressedError` constructor, fs-safe returns the equivalent `Error` shape with the same name and properties.
+`release()` propagates an I/O failure that prevents deletion of an unchanged, owned sidecar; it never reports successful cleanup while leaving that lock behind. Raw and JavaScript fallback handles and managers retain the cleanup receipt after an I/O failure, so the same handle can retry `release()` and `manager.drain()` can retry cleanup. Retained native Root locks settle once and close their retained handles on every outcome, including failure; a failed deletion requires application-owned recovery. A changed sidecar is left untouched. Retained native Root release reports `FsSafeError` code `path-mismatch`, distinguishing a changed identity from a changed owner record; this includes a replacement inode containing an exact copy of the original bytes. If both a `withFileLock()` or `withFileLockSync()` callback and release fail, the release error is the primary `SuppressedError.error` and the callback failure remains available as `SuppressedError.suppressed`. Failed asynchronous acquisition cleanup uses the same shape, with the cleanup error primary and the acquisition failure suppressed. On Node runtimes without the global `SuppressedError` constructor, fs-safe returns the equivalent `Error` shape with the same name and properties.
 
 ## API
 
@@ -265,10 +265,48 @@ its separate canonical-path mutation queue. The synchronous APIs implement the
 same owner/refcount rules; a mismatched synchronous acquisition blocks the
 calling thread according to its retry and timeout options.
 
-Pass `lockRoot` to place sidecar create, read, verification, and removal behind
-an existing `Root` capability. `lockPath` must resolve inside that root.
-Identity-conditioned removal remains the only release and reclaim deletion
-path.
+Pass `lockRoot` to admit sidecar creation, reads, and verification through an
+existing `Root` capability. `lockPath` must resolve inside that root.
+
+With the maintained native helper, asynchronous acquisition retains cleanup
+authority over only the sidecar it created: an identity-checked parent descriptor
+and file descriptor on POSIX, or a shared-delete parent directory handle on Windows
+(local NTFS). `release()` and process-exit cleanup verify the original named
+entry's exact identity, regular-file type, single link, and complete owner record
+through those retained handles. They then use guarded descriptor-relative removal
+or Windows disposition-delete, without resolving the Root again. Cleanup therefore
+works after the Root moves, is replaced, or its parent becomes a symlink. A foreign
+entry at either the original Root path or the retained sidecar name is preserved.
+The retained handles close on success, mismatch, failed acquisition, and exit
+(including `retainOnExit`, which closes handles without deleting).
+If retention itself fails after creation, rollback checks the original identity
+and owner bytes through the creator's still-open descriptors before removing the
+claim. A changed entry is preserved and both the retention and cleanup errors are
+reported; cleanup never falls back to token-only deletion of a replacement.
+Retention duplicates the already-admitted parent authority instead of walking
+its pathname again or requiring extra access to its ancestors.
+Windows opens the named file through the retained parent only for settlement,
+with delete access and sharing; keeping a file handle open would prevent ordinary
+directory relocation. Retained cleanup compares the owner bytes directly and does
+not invoke `parsePayload`; verification and stale-policy reads still do.
+Windows permits renaming that retained parent itself, but refuses renaming an
+ancestor containing the open directory handle, even with delete sharing and no
+data access. Such a refused move leaves the Root and lock in place; release or
+exit cleanup closes the pin so the ancestor can then move. POSIX also supports
+cleanup after a successful ancestor move or symlink swap.
+
+`verifyStillHeld()` retains its Root-based semantics and can still reject a moved
+Root even though `release()` can remove its own sidecar. This creation-specific
+cleanup receipt does not authorize other Root operations or stale reclamation;
+those continue to enforce current confinement and mutation policy. As with the
+sidecar protocol generally, the POSIX final identity check and unlink are not an
+atomic compare-and-delete against an uncooperative process racing the same name.
+
+When native retention is unavailable or explicitly disabled, release keeps the
+existing Root-based fail-closed behavior; a moved Root can leave a sidecar requiring
+application-owned recovery. Use the matching maintained native package to obtain
+relocation-safe cleanup. Synchronous Root locks keep their existing Root authority.
+Identity-conditioned removal remains the only release and reclaim deletion path.
 Root mutation refusals during stale removal propagate unchanged, including
 `null`, `undefined`, and errors carrying `ENOENT`; they do not become missing-sidecar retries.
 

package/node_modules/@openclaw/fs-safe/docs/temp.md

@@ -35,6 +35,18 @@ mode, correction uses a verified directory descriptor.
 An initial mode-descriptor admission error is preserved if closing that rejected
 descriptor also fails; close failures after successful admission remain reportable.
 
+These rules apply equally to effective UID 0: root-owned `0700` or `0755` temp
+roots beneath root-owned sticky `1777` `/tmp` are accepted. Passing `/tmp` itself
+as `rootDir` is rejected because the workspace root must be private. Permission
+and ownership errors name the rejected directory (including an unsafe ancestor),
+the observed mode or owner UID, the expected property, and a recovery path.
+Prefer `resolveSecureTempRoot()` or a dedicated directory owned by the effective
+user with mode `0700`. For a non-sticky writable ancestor, have its administrator
+restore appropriate permissions (`1777` for shared system temp) or move the root
+under trusted ancestry. Do not make shared `/tmp` private or take ownership of
+another user's directory. A caller's preferred root takes precedence over
+`TMPDIR`; changing `TMPDIR` only changes the resolver's fallback location.
+
 On Linux, non-identity `/proc/self/uid_map` and `/proc/self/gid_map` evidence
 permits ancestors whose UID and GID equal unmapped kernel overflow IDs,
 provided the same ancestor mode checks pass.

package/node_modules/@openclaw/fs-safe/docs/watch.md

@@ -152,8 +152,9 @@ FSEvents drops, including during recursive deletion. A shallow tree anchored abo
 a busy unselected subtree still receives recursive traffic; pending hints fold
 under pressure, while genuine FSEvents drops can still overflow.
 Absolute hints are reduced lexically against the admitted canonical Root;
-outside paths never become detail. Dropped/wrapped streams, RootChanged and
-Unmount trigger guarded reconciliation. Pathname hints can reflect activity
+outside paths never become detail. Dropped/wrapped streams, RootChanged, Unmount
+and notifications naming the Root itself trigger guarded reconciliation without detail.
+Pathname hints can reflect activity
 after a swap, but the Root is never replaced and names require guarded admission.
 Removal synchronously stops, invalidates and releases the stream on its queue.
 

package/node_modules/@openclaw/fs-safe/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe",
-  "version": "0.24.2",
+  "version": "0.25.0",
   "description": "Capability-style filesystem roots for Node.js apps that handle untrusted relative paths.",
   "keywords": [
     "filesystem",
@@ -173,32 +173,32 @@
     "archive:producer-smoke": "node scripts/archive-producer-smoke.mjs"
   },
   "optionalDependencies": {
-    "@openclaw/fs-safe-darwin-arm64": "0.24.2",
-    "@openclaw/fs-safe-darwin-x64": "0.24.2",
-    "@openclaw/fs-safe-linux-arm64-gnu": "0.24.2",
-    "@openclaw/fs-safe-linux-arm64-musl": "0.24.2",
-    "@openclaw/fs-safe-linux-x64-gnu": "0.24.2",
-    "@openclaw/fs-safe-linux-x64-musl": "0.24.2",
-    "@openclaw/fs-safe-win32-x64-msvc": "0.24.2",
+    "@openclaw/fs-safe-darwin-arm64": "0.25.0",
+    "@openclaw/fs-safe-darwin-x64": "0.25.0",
+    "@openclaw/fs-safe-linux-arm64-gnu": "0.25.0",
+    "@openclaw/fs-safe-linux-arm64-musl": "0.25.0",
+    "@openclaw/fs-safe-linux-x64-gnu": "0.25.0",
+    "@openclaw/fs-safe-linux-x64-musl": "0.25.0",
+    "@openclaw/fs-safe-win32-x64-msvc": "0.25.0",
     "jszip": "^3.10.2"
   },
   "devDependencies": {
-    "@emnapi/runtime": "2.0.0-alpha.5",
-    "@napi-rs/cli": "3.10.6",
-    "@types/node": "^26.6.1",
+    "@emnapi/runtime": "2.0.0-alpha.6",
+    "@napi-rs/cli": "3.10.8",
+    "@types/node": "^26.6.4",
     "@vitest/coverage-v8": "5.0.3",
-    "fast-check": "^4.10.1",
+    "fast-check": "^4.10.2",
     "istanbul-lib-coverage": "3.2.2",
     "istanbul-lib-report": "3.0.1",
     "istanbul-reports": "3.2.0",
     "sigstore": "5.0.0",
     "tar": "7.5.22",
     "typescript": "^7.0.2",
-    "vite": "8.3.2",
-    "vitest": "^5.0.1"
+    "vite": "8.3.3",
+    "vitest": "^5.0.3"
   },
   "engines": {
     "node": ">=22"
   },
-  "packageManager": "pnpm@12.4.2"
+  "packageManager": "pnpm@12.10.1"
 }

package/node_modules/@openclaw/fs-safe-darwin-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-darwin-arm64",
-  "version": "0.24.2",
+  "version": "0.25.0",
   "description": "macOS arm64 native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-darwin-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-darwin-x64",
-  "version": "0.24.2",
+  "version": "0.25.0",
   "description": "macOS x64 native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-arm64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-arm64-gnu",
-  "version": "0.24.2",
+  "version": "0.25.0",
   "description": "Linux arm64 glibc native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-arm64-musl/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-arm64-musl",
-  "version": "0.24.2",
+  "version": "0.25.0",
   "description": "Linux arm64 musl native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-x64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-x64-gnu",
-  "version": "0.24.2",
+  "version": "0.25.0",
   "description": "Linux x64 glibc native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-linux-x64-musl/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-linux-x64-musl",
-  "version": "0.24.2",
+  "version": "0.25.0",
   "description": "Linux x64 musl native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/node_modules/@openclaw/fs-safe-win32-x64-msvc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe-win32-x64-msvc",
-  "version": "0.24.2",
+  "version": "0.25.0",
   "description": "Windows x64 MSVC native binding for @openclaw/fs-safe.",
   "license": "MIT",
   "author": "OpenClaw Team <dev@openclaw.ai>",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/openshell-sandbox",
-  "version": "2026.10.2",
+  "version": "2026.10.5-beta.2",
   "description": "OpenClaw sandbox backend for the NVIDIA OpenShell CLI with mirrored local workspaces and SSH command execution.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "type": "module",
   "dependencies": {
-    "@openclaw/fs-safe": "0.24.2",
+    "@openclaw/fs-safe": "0.25.0",
     "p-limit": "7.3.3",
     "zod": "4.6.5"
   },
@@ -23,10 +23,10 @@
       "minHostVersion": ">=2026.5.12-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.10.2"
+      "pluginApi": ">=2026.10.5-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.10.2",
+      "openclawVersion": "2026.10.5-beta.2",
       "bundledDist": false
     },
     "release": {
@@ -45,7 +45,7 @@
     "assets/activity.svg"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.10.2"
+    "openclaw": ">=2026.10.5-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {

package/node_modules/@openclaw/fs-safe/dist/file-lock-sync-root-arbitration.d.ts

@@ -1,17 +0,0 @@
-import { FsSafeError } from "./errors.js";
-import type { FileLockSyncHandle } from "./file-lock-sync.js";
-import { type FileLockSyncRootAuthority, type FileLockSyncRootPath } from "./file-lock-sync-root.js";
-import type { FileLockSyncRootFileReceipt } from "./file-lock-sync-root-io.js";
-import { type RootSyncHeldLock } from "./file-lock-sync-root-held.js";
-export declare class FileLockSyncRootArbitrationCollision extends FsSafeError {
-    constructor();
-}
-export type FileLockSyncRootArbitration = Readonly<{
-    authority: FileLockSyncRootAuthority;
-    heldLocks: Map<string, RootSyncHeldLock>;
-    lockRootPath: FileLockSyncRootPath;
-    normalizedTargetPath: string;
-    reentrantOwner?: string;
-}>;
-export declare function tryReuseCurrentRootSyncHeldLock(arbitration: FileLockSyncRootArbitration): FileLockSyncHandle | undefined;
-export declare function cleanupCreatedRootSyncLock(lockRootPath: FileLockSyncRootPath, fd: number, receipt: FileLockSyncRootFileReceipt, timer?: NodeJS.Timeout): void;

package/node_modules/@openclaw/fs-safe/dist/file-lock-sync-root-arbitration.js

@@ -1,66 +0,0 @@
-import fs from "node:fs";
-import { foreignSyncHeldLock } from "./file-lock-sync-admission.js";
-import path from "node:path";
-import { FsSafeError } from "./errors.js";
-import {} from "./file-lock-sync-root.js";
-import { removeFileLockSyncRootFile } from "./file-lock-sync-root-mutation.js";
-import { createSuppressedError } from "./suppressed-error.js";
-import { createRootSyncHeldLockHandle, verifyRootSyncHeldLock, } from "./file-lock-sync-root-held.js";
-export class FileLockSyncRootArbitrationCollision extends FsSafeError {
-    constructor() {
-        super("path-mismatch", "file lock arbitration changed during local creation");
-    }
-}
-function sameRootLockPath(left, right) {
-    return left.relativePath === right.relativePath && path.relative(left.path, right.path) === "";
-}
-export function tryReuseCurrentRootSyncHeldLock(arbitration) {
-    const held = arbitration.heldLocks.get(arbitration.normalizedTargetPath);
-    const reusable = held && !foreignSyncHeldLock("root", arbitration.normalizedTargetPath) &&
-        arbitration.reentrantOwner !== undefined &&
-        held.reentrantOwner !== undefined &&
-        arbitration.reentrantOwner === held.reentrantOwner &&
-        arbitration.authority.adapter === held.rootAuthority.adapter &&
-        sameRootLockPath(arbitration.lockRootPath, held.rootPath) &&
-        held.releaseState !== "released";
-    if (!reusable)
-        return undefined;
-    if (!verifyRootSyncHeldLock(held)) {
-        throw new FsSafeError("path-mismatch", "held sidecar lock changed before reentrant reuse");
-    }
-    // Verification can invoke a custom parser. Re-fetch the exact entry before
-    // granting a reference, while retaining supported releasing/exit states.
-    if (arbitration.heldLocks.get(arbitration.normalizedTargetPath) !== held ||
-        held.releaseState === "released" || foreignSyncHeldLock("root", arbitration.normalizedTargetPath)) {
-        throw new FsSafeError("path-mismatch", "held sidecar lock changed during reentrant reuse");
-    }
-    held.refCount += 1;
-    held.revision += 1;
-    return createRootSyncHeldLockHandle(held);
-}
-export function cleanupCreatedRootSyncLock(lockRootPath, fd, receipt, timer) {
-    let timerCleanupFailed = false;
-    let timerCleanupError;
-    try {
-        if (timer)
-            clearInterval(timer);
-    }
-    catch (error) {
-        timerCleanupFailed = true;
-        timerCleanupError = error;
-    }
-    try {
-        fs.closeSync(fd);
-        if (!removeFileLockSyncRootFile(lockRootPath, receipt)) {
-            throw new FsSafeError("path-mismatch", "created sidecar lock changed before cleanup");
-        }
-    }
-    catch (fileCleanupError) {
-        if (timerCleanupFailed) {
-            throw createSuppressedError(timerCleanupError, fileCleanupError, "unpublished lock timer and file cleanup both failed");
-        }
-        throw fileCleanupError;
-    }
-    if (timerCleanupFailed)
-        throw timerCleanupError;
-}

package/node_modules/@openclaw/fs-safe/dist/publish-file-native.d.ts

@@ -1,4 +0,0 @@
-import type { BigIntStats } from "node:fs";
-import type { NativeBinding } from "./native-binding.js";
-import { type PublishFailureState } from "./publish-file-failure.js";
-export declare function publishFileNoReplaceNative(binding: NativeBinding, paths: Parameters<NativeBinding["renameNoReplace"]>, expected: BigIntStats, failure: PublishFailureState): "link-unlink" | undefined;