@openclaw/openshell-sandbox 2026.10.5-beta.4 → 2026.10.10-beta.2

package/node_modules/@openclaw/fs-safe/dist/root-mkdir-native.js

@@ -0,0 +1,239 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+import fs from "node:fs";
+import path from "node:path";
+import { inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { nodeDirectorySearchOnlyFlags } from "./directory-mode-node.js";
+import { FsSafeError } from "./errors.js";
+import { getNativeBinding } from "./native.js";
+import { captureNativeFdClose } from "./native-binding.js";
+import { openExactNativeRootSync } from "./native-parent-admission.js";
+import { hasNodeErrorCode } from "./path.js";
+import { realpathSync } from "./realpath.js";
+import { assertRootIdentityCurrentSync } from "./root-context.js";
+import { verifyMkdirDirectory } from "./root-create-native.js";
+import { directoryComponentNotDirectoryError } from "./root-errors.js";
+import { isSafePathSegment } from "./safe-path-segment.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { getFsSafeTestHooks } from "./test-hooks.js";
+import { pathForWindowsFilesystem } from "./windows-path-alias.js";
+export function tryMkdirNativeParents(root, relativePath) {
+    try {
+        return mkdirOrdinaryNativeParents(root, relativePath);
+    }
+    catch (error) {
+        if (hasNodeErrorCode(error, "ENOTDIR"))
+            throw directoryComponentNotDirectoryError(error);
+        throw error;
+    }
+}
+function mkdirOrdinaryNativeParents(root, relativePath) {
+    if (getFsSafeTestHooks()?.beforeRootFallbackMutation)
+        return false;
+    const segments = relativePath.split(path.sep === "\\" ? /[\\/]/ : "/");
+    if (segments.length < 2 || segments.some(segment => !isSafePathSegment(segment, { allowDotPrefix: true }) || segment.endsWith(".")))
+        return false;
+    let rootStat;
+    assertRootIdentityCurrentSync(root, stat => { rootStat = stat; });
+    const target = path.join(root.rootReal, ...segments);
+    const parentPath = path.dirname(target);
+    try {
+        const child = fs.lstatSync(pathForWindowsFilesystem(target), { throwIfNoEntry: false });
+        if (child && (!child.isDirectory() || realpathSync.native(pathForWindowsFilesystem(target)) !== target))
+            return false;
+    }
+    catch {
+        return false;
+    }
+    let parentIdentity;
+    try {
+        parentIdentity = inspectDirectoryIdentitySync(parentPath);
+    }
+    catch (error) {
+        // Reuse this exact Root snapshot and failed parent observation without an
+        // intervening await. All opened ancestors still receive fresh native fences.
+        return hasNodeErrorCode(error, "ENOENT") ? mkdirMissingParents(root, segments, rootStat) : false;
+    }
+    try {
+        if (realpathSync.native(pathForWindowsFilesystem(parentPath)) !== parentPath)
+            return false;
+    }
+    catch {
+        return false;
+    }
+    return mkdirExistingParent(root, segments, parentIdentity);
+}
+/** Ordinary missing suffixes need no policy callbacks or repeated path resolution. */
+function mkdirMissingParents(root, segments, rootStat) {
+    const binding = getNativeBinding("openBeneath", "mkdirChildBeneath");
+    if (!binding?.openBeneath || !binding.mkdirOpenChildBeneath)
+        return false;
+    let parentDepth = segments.length - 2;
+    let parentPath;
+    let parentIdentity;
+    for (;;) {
+        parentPath = path.join(root.rootReal, ...segments.slice(0, parentDepth));
+        try {
+            parentIdentity = inspectDirectoryIdentitySync(parentPath, undefined, parentDepth === 0 ? rootStat : undefined);
+            if (realpathSync.native(pathForWindowsFilesystem(parentPath)) !== parentPath)
+                return false;
+            break;
+        }
+        catch (error) {
+            if (!hasNodeErrorCode(error, "ENOENT") || parentDepth === 0)
+                return false;
+            parentDepth--;
+        }
+    }
+    try {
+        const env_1 = { stack: [], error: void 0, hasError: false };
+        try {
+            const rootOwner = __addDisposableResource(env_1, openExactNativeRootSync(binding, {
+                rootPath: root.rootReal, rootIdentity: root.rootIdentity,
+            }), false);
+            const close = captureNativeFdClose(binding);
+            const directories = [];
+            const directoryOwner = __addDisposableResource(env_1, { [Symbol.dispose]() {
+                    const errors = [];
+                    for (const directory of directories.toReversed()) {
+                        try {
+                            close(directory.fd);
+                        }
+                        catch (error) {
+                            errors.push(error);
+                        }
+                    }
+                    if (errors.length)
+                        throw new AggregateError(errors, "mkdir directory close failed");
+                } }, false);
+            const flags = (nodeDirectorySearchOnlyFlags()?.flags ?? fs.constants.O_RDONLY) |
+                (fs.constants.O_DIRECTORY ?? 0) | (fs.constants.O_NOFOLLOW ?? 0);
+            let current = rootOwner.fd;
+            if (parentDepth > 0) {
+                current = binding.openBeneath(rootOwner.fd, segments.slice(0, parentDepth).join("/"), flags).fd;
+                directories.push({ fd: current, pathname: parentPath });
+                inspectFileIdentitySync(() => fs.fstatSync(current, { bigint: true }), parentIdentity);
+            }
+            const assertCurrent = () => {
+                assertRootIdentityCurrentSync(root);
+                for (const directory of directories)
+                    verifyMkdirDirectory(binding, directory.fd, directory.pathname);
+                verifyMkdirDirectory(binding, rootOwner.fd, root.rootReal);
+            };
+            assertCurrent();
+            for (const segment of segments.slice(parentDepth)) {
+                const child = binding.mkdirOpenChildBeneath(current, segment, 0o777, flags);
+                parentPath = path.join(parentPath, segment);
+                directories.push({ fd: child.fd, pathname: parentPath });
+                // Retain every ancestor until the complete suffix is admitted. The
+                // post-create fence also precedes the next synchronous child mutation.
+                assertCurrent();
+                current = child.fd;
+            }
+            return true;
+        }
+        catch (e_1) {
+            env_1.error = e_1;
+            env_1.hasError = true;
+        }
+        finally {
+            __disposeResources(env_1);
+        }
+    }
+    catch (error) {
+        if (hasNodeErrorCode(error, "ENOTDIR"))
+            throw directoryComponentNotDirectoryError(error);
+        throw error;
+    }
+}
+function mkdirExistingParent(root, segments, parentIdentity) {
+    const env_2 = { stack: [], error: void 0, hasError: false };
+    try {
+        const target = path.join(root.rootReal, ...segments);
+        const parentPath = path.dirname(target);
+        const binding = getNativeBinding("openBeneath", "mkdirChildBeneath");
+        if (!binding?.openBeneath || !binding.mkdirChildBeneath) {
+            throw new FsSafeError("helper-unavailable", "native confined creation is unavailable");
+        }
+        const rootOwner = __addDisposableResource(env_2, openExactNativeRootSync(binding, {
+            rootPath: root.rootReal, rootIdentity: root.rootIdentity,
+        }), false);
+        verifyMkdirDirectory(binding, rootOwner.fd, root.rootReal);
+        const flags = (nodeDirectorySearchOnlyFlags()?.flags ?? fs.constants.O_RDONLY) |
+            (fs.constants.O_DIRECTORY ?? 0) | (fs.constants.O_NOFOLLOW ?? 0);
+        const close = captureNativeFdClose(binding);
+        const parent = binding.openBeneath(rootOwner.fd, segments.slice(0, -1).join("/"), flags).fd;
+        const parentOwner = __addDisposableResource(env_2, { [Symbol.dispose]() { close(parent); } }, false);
+        inspectFileIdentitySync(() => fs.fstatSync(parent, { bigint: true }), parentIdentity);
+        verifyMkdirDirectory(binding, parent, parentPath);
+        assertRootIdentityCurrentSync(root);
+        const name = segments.at(-1);
+        const child = binding.mkdirOpenChildBeneath
+            ? binding.mkdirOpenChildBeneath(parent, name, 0o777, flags).fd
+            : (binding.mkdirChildBeneath(parent, name, 0o777), binding.openBeneath(parent, name, flags).fd);
+        const childOwner = __addDisposableResource(env_2, { [Symbol.dispose]() { close(child); } }, false);
+        assertRootIdentityCurrentSync(root);
+        verifyMkdirDirectory(binding, child, target);
+        inspectDirectoryIdentitySync(parentPath, parentIdentity);
+        verifyMkdirDirectory(binding, parent, parentPath);
+        verifyMkdirDirectory(binding, rootOwner.fd, root.rootReal);
+        return true;
+    }
+    catch (e_2) {
+        env_2.error = e_2;
+        env_2.hasError = true;
+    }
+    finally {
+        __disposeResources(env_2);
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/root-move-noreplace.js

@@ -1,15 +1,15 @@
 import fsSync, {} from "node:fs";
 import path from "node:path";
-import { assertAsyncDirectoryGuard, assertSyncDirectoryGuard } from "./directory-guard.js";
+import { assertDirectoryGuard, assertSyncDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { assertMutationNotDenied } from "./deny-mutations.js";
-import { openNativeParentAdmission, openNativeRootAdmission, } from "./native-parent-admission.js";
+import { borrowNativeRootParent, openNativeParentAdmission, openExactNativeRootAdmissionSync, } from "./native-parent-admission.js";
 import { requireNativeBinding } from "./native.js";
 import { isNotFoundPathError } from "./path.js";
-import { assertRootIdentityCurrent, assertRootIdentityCurrentSync } from "./root-context.js";
+import { assertRootIdentityCurrentSync } from "./root-context.js";
 import { resolveRootPathSync } from "./root-path.js";
 import { admitPathInsideRoot } from "./root-boundary.js";
-import { errorCauseOptions, fileNotFoundError, hardlinkedPathNotAllowedError, isAlreadyExistsError, normalizePinnedPathError, outsideWorkspaceError, } from "./root-errors.js";
+import { errorCauseOptions, fileNotFoundError, hardlinkedPathNotAllowedError, isAlreadyExistsError, normalizePinnedPathError, outsideWorkspaceError, rootPathChangedError, } from "./root-errors.js";
 import { assertFinalSymlinkRejected, mutationSymlinkResolution } from "./root-symlink-policy.js";
 import { PATH_ALIAS_POLICIES } from "./path-policy.js";
 import { createSuppressedError } from "./suppressed-error.js";
@@ -80,15 +80,14 @@ export async function movePathNative(root, params, paths, overwrite = false) {
                 throw error;
             // Advisory fast rejection only. renameNoReplace owns the collision decision.
         }
-    const binding = requireNativeBinding();
+    const binding = requireNativeBinding("openBeneath", overwrite ? "renameReplaceWithIdentity" : "renameNoReplace");
     if (typeof (overwrite ? binding.renameReplaceWithIdentity : binding.renameNoReplace) !== "function") {
         throw new FsSafeError("helper-unavailable", "native move is unavailable");
     }
-    const rootAdmission = await openNativeRootAdmission(binding, {
+    const rootAdmission = openExactNativeRootAdmissionSync(binding, {
         rootPath: root.rootReal,
         rootIdentity: root.rootIdentity,
         operation: "native move",
-        searchOnly: true,
     });
     let sourceParent;
     let targetParent;
@@ -96,15 +95,18 @@ export async function movePathNative(root, params, paths, overwrite = false) {
     let operationError;
     try {
         const sourceParentRelativePath = nativeParentRelativePath(root.rootReal, paths.sourceParentPath);
-        sourceParent = await openNativeParentAdmission(binding, rootAdmission, sourceParentRelativePath);
+        sourceParent = sourceParentRelativePath === "" ? borrowNativeRootParent(rootAdmission) : await openNativeParentAdmission(binding, rootAdmission, sourceParentRelativePath, "native-directory");
         const targetParentRelativePath = nativeParentRelativePath(root.rootReal, paths.targetParentPath);
         targetParent = targetParentRelativePath === sourceParentRelativePath
             ? sourceParent
-            : await openNativeParentAdmission(binding, rootAdmission, targetParentRelativePath);
+            : targetParentRelativePath === "" ? borrowNativeRootParent(rootAdmission)
+                : await openNativeParentAdmission(binding, rootAdmission, targetParentRelativePath, "native-directory");
         const parentAdmissions = targetParent === sourceParent
             ? [sourceParent]
             : [sourceParent, targetParent];
-        await getFsSafeTestHooks()?.beforeRootFallbackMutation?.("move", paths.targetPath);
+        const beforeMutation = getFsSafeTestHooks()?.beforeRootFallbackMutation;
+        if (beforeMutation)
+            await beforeMutation("move", paths.targetPath);
         const admittedSourcePath = admitMovePath(root, sourceParent, path.basename(paths.sourcePath));
         const admittedTargetPath = admitMovePath(root, targetParent, path.basename(paths.targetPath));
         if (params.denyMutations) {
@@ -113,9 +115,29 @@ export async function movePathNative(root, params, paths, overwrite = false) {
             await assertMutationNotDenied(admittedSourcePath, params.denyMutations, { protectAncestors: true });
             await assertMutationNotDenied(admittedTargetPath, params.denyMutations, { protectAncestors: true });
         }
-        await assertRootIdentityCurrent(root);
-        for (const admission of parentAdmissions)
-            assertSyncDirectoryGuard(admission.guard);
+        const rootParent = sourceParentRelativePath === "" ? sourceParent
+            : targetParentRelativePath === "" ? targetParent : undefined;
+        if (rootParent) {
+            // Borrowing Root already checked this guard in the same synchronous phase.
+            const borrowedRootCurrent = sourceParent === targetParent &&
+                sourceParentRelativePath === "" && !beforeMutation &&
+                params.denyMutations === undefined && params.assertBeforeMutation === undefined;
+            if (!borrowedRootCurrent) {
+                try {
+                    assertSyncDirectoryGuard(rootParent.guard);
+                }
+                catch (error) {
+                    throw rootPathChangedError(error instanceof Error ? error : undefined);
+                }
+            }
+        }
+        else {
+            assertRootIdentityCurrentSync(root);
+        }
+        for (const admission of parentAdmissions) {
+            if (admission !== rootParent)
+                assertSyncDirectoryGuard(admission.guard);
+        }
         // Linux auto fallback needs an exact source even without an authority callback.
         const sourceStat = overwrite || params.assertBeforeMutation || (process.platform === "linux" && !params.requireNative)
             ? inspectFileIdentitySync(() => admitMoveSourceStat(fsSync.lstatSync(admittedSourcePath, { bigint: true })), paths.expectedSourceIdentity)
@@ -185,7 +207,7 @@ export async function movePathNative(root, params, paths, overwrite = false) {
         }
         try {
             for (const admission of parentAdmissions)
-                await assertAsyncDirectoryGuard(admission.guard);
+                assertDirectoryGuard(admission.guard, "native");
             if (overwrite)
                 inspectFileIdentitySync(() => fsSync.lstatSync(admittedTargetPath, { bigint: true }), sourceStat);
         }
@@ -211,7 +233,7 @@ export async function movePathNative(root, params, paths, overwrite = false) {
         }
     }
     try {
-        await rootAdmission.root.close();
+        rootAdmission.root.close();
     }
     catch (error) {
         closeErrors.push(error);

package/node_modules/@openclaw/fs-safe/dist/root-native-creation-path.d.ts

@@ -0,0 +1,32 @@
+import fs from "node:fs";
+import type { PinnedMutationPolicySnapshot } from "./pinned-mutation-admission.js";
+import { type RootContext } from "./root-context.js";
+export type Creation = {
+    root: RootContext;
+    directory: string;
+    target: string;
+    mkdir: boolean;
+    private?: boolean;
+    policy?: PinnedMutationPolicySnapshot;
+    resolveCurrent(): Promise<string>;
+    assertBeforeMutation?: () => void;
+    originalPath?: string;
+    selectedParent?: NonNullable<ReturnType<typeof existingCreationParent>>;
+};
+export declare function existingCreationParent(params: Creation): {
+    path: string;
+    identity: fs.BigIntStats;
+    relative: string;
+    flags: number;
+} | undefined;
+export declare function probeNativeCreationPath(root: RootContext, relativePath: string): {
+    rootReal: string;
+    rootWithSep: string;
+    resolved: string;
+    parent: {
+        path: string;
+        identity: fs.BigIntStats;
+        relative: string;
+        flags: number;
+    };
+} | undefined;

package/node_modules/@openclaw/fs-safe/dist/root-native-creation-path.js

@@ -0,0 +1,56 @@
+import fs from "node:fs";
+import path from "node:path";
+import { inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { nodeDirectorySearchOnlyFlags } from "./directory-mode-node.js";
+import { assertRootIdentityCurrentSync } from "./root-context.js";
+import { getFsSafeTestHooks } from "./test-hooks.js";
+import { pathForWindowsFilesystem } from "./windows-path-alias.js";
+import { realpathSync } from "./realpath.js";
+import { isSafePathSegment } from "./safe-path-segment.js";
+export function existingCreationParent(params) {
+    if (params.private || params.policy || params.assertBeforeMutation !== undefined ||
+        getFsSafeTestHooks()?.beforeRootFallbackMutation || !params.originalPath ||
+        params.directory !== path.dirname(params.target))
+        return undefined;
+    const segments = params.originalPath.split(path.sep === "\\" ? /[\\/]/ : "/");
+    if (segments.some(segment => !isSafePathSegment(segment, { allowDotPrefix: true }) || segment.endsWith(".")) ||
+        path.join(params.root.rootReal, ...segments) !== params.target)
+        return undefined;
+    let rootStat;
+    assertRootIdentityCurrentSync(params.root, stat => { rootStat = stat; });
+    try {
+        const identity = inspectDirectoryIdentitySync(params.directory, undefined, params.directory === params.root.rootReal ? rootStat : undefined);
+        if (realpathSync.native(pathForWindowsFilesystem(params.directory)) !== params.directory)
+            return undefined;
+        return {
+            path: params.directory, identity,
+            relative: path.relative(params.root.rootReal, params.directory).split(path.sep).join("/"),
+            flags: (nodeDirectorySearchOnlyFlags()?.flags ?? fs.constants.O_RDONLY) |
+                (fs.constants.O_DIRECTORY ?? 0) | (fs.constants.O_NOFOLLOW ?? 0),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function probeNativeCreationPath(root, relativePath) {
+    if (typeof relativePath !== "string")
+        return undefined;
+    const segments = relativePath.split(path.sep === "\\" ? /[\\/]/ : "/");
+    if (segments.some(segment => !isSafePathSegment(segment, { allowDotPrefix: true }) || segment.endsWith(".")))
+        return undefined;
+    const target = path.join(root.rootReal, ...segments);
+    assertRootIdentityCurrentSync(root);
+    try {
+        if (fs.lstatSync(pathForWindowsFilesystem(target), { throwIfNoEntry: false }))
+            return undefined;
+    }
+    catch {
+        return undefined;
+    }
+    const parent = existingCreationParent({ root, target, directory: path.dirname(target), mkdir: true,
+        originalPath: relativePath, resolveCurrent: async () => target });
+    if (!parent)
+        return undefined;
+    return { rootReal: root.rootReal, rootWithSep: root.rootWithSep, resolved: target, parent };
+}

package/node_modules/@openclaw/fs-safe/dist/root-options.d.ts

@@ -38,6 +38,8 @@ export type RootCopyOptions = Pick<RootDefaults, "assertBeforeMutation" | "denyM
     clone?: CopyCloneMode;
     signal?: AbortSignal;
     preserveSourceMode?: boolean;
+    preserveMetadata?: boolean;
+    sourceSymlinks?: "reject" | "copy-link";
     onDestinationPublished?: (receipt: RootCopyPublicationReceipt) => void;
 };
 export type RootCopySource = string | {

package/node_modules/@openclaw/fs-safe/dist/root-public-types.d.ts

@@ -9,3 +9,4 @@ export type { CopyCloneMode } from "./copy-policy.js";
 export type { RootEntriesOptions } from "./root-entries.js";
 export type { ContainmentGuarantee } from "./containment.js";
 export type { RootWalkDataEntry, RootWalkDataEntryKind, RootWalkDirectoryErrorBehavior, RootWalkEntry, RootWalkEntryFilter, RootWalkEntryFilterResult, RootWalkEntryKind, RootWalkLimitBehavior, RootWalkOptions, RootWalkSymlinkPolicy, } from "./root-walk.js";
+export type { ExactFileIdentity } from "./exact-identity.js";

package/node_modules/@openclaw/fs-safe/dist/root-remove-native.js

@@ -1,16 +1,16 @@
 import fs from "node:fs";
 import path from "node:path";
 import { scheduler } from "node:timers/promises";
-import { assertSyncDirectoryGuard } from "./directory-guard.js";
 import { assertMutationNotDenied } from "./deny-mutations.js";
 import { FsSafeError } from "./errors.js";
 import { MutationAuthorityError } from "./mutation-authority.js";
 import { getNativeBinding } from "./native.js";
-import { openNativeParentAdmission, openNativeRootAdmission } from "./native-parent-admission.js";
+import { borrowNativeRootParent, openNativeParentAdmission, openExactNativeRootAdmissionSync } from "./native-parent-admission.js";
 import { isNotFoundPathError, isPathInside } from "./path.js";
 import { assertRootIdentityCurrentSync } from "./root-context.js";
 import { normalizeRemoveGuardError, normalizeRemovePathError } from "./root-errors.js";
 import { captureNonrecursiveRemovalAdmission, nonrecursiveRemovalKind } from "./root-remove.js";
+import { assertRemovalDirectoryCurrent, createRemovalDirectoryAssertion } from "./root-remove-identity.js";
 import { createSuppressedError } from "./suppressed-error.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
 function unavailable() {
@@ -28,8 +28,73 @@ function normalize(error, details) {
     }
     return normalizeRemovePathError(error, details);
 }
+async function removeNativeLeaf(binding, parent, target, options, boundary, rootGuardCurrent) {
+    const assertNotAborted = () => {
+        try {
+            options.signal?.throwIfAborted();
+        }
+        catch (error) {
+            throw new MutationAuthorityError(error);
+        }
+    };
+    assertNotAborted();
+    const before = getFsSafeTestHooks()?.beforeRootFallbackMutation;
+    if (before) {
+        try {
+            await before("remove", target);
+        }
+        catch (error) {
+            throw normalizeRemoveGuardError(error);
+        }
+    }
+    if (options.denyMutations)
+        await assertMutationNotDenied(target, options.denyMutations, { protectAncestors: true });
+    const name = path.basename(target);
+    const observe = (expected) => {
+        assertNotAborted();
+        if (!rootGuardCurrent)
+            boundary.assertCurrent();
+        rootGuardCurrent = false;
+        try {
+            const entry = binding.rootRemovalStat(parent.fd, name);
+            if (expected && (entry.dev !== expected.dev || entry.ino !== expected.ino || entry.directory !== expected.directory)) {
+                throw new FsSafeError("path-mismatch", "removal entry changed");
+            }
+            if (entry.symlink && options.mutationSymlinks !== undefined)
+                throw new FsSafeError("symlink", "symlink not allowed", {
+                    details: { operation: "remove", phase: expected ? "remove" : "inspect", relativePath: "" },
+                });
+            return entry;
+        }
+        catch (error) {
+            if (options.force && isNotFoundPathError(error))
+                return undefined;
+            throw normalize(error, { operation: "remove", phase: expected ? "remove" : "inspect", relativePath: "" });
+        }
+    };
+    const entry = observe();
+    if (!entry)
+        return;
+    if (!entry.directory && options[nonrecursiveRemovalKind] === "directory") {
+        throw new FsSafeError("path-mismatch", "store entry is no longer a directory");
+    }
+    if (options.assertBeforeMutation) {
+        options.assertBeforeMutation();
+        if (!observe(entry))
+            return;
+    }
+    try {
+        binding.rootRemovalUnlink(parent.fd, name, entry.dev, entry.ino, entry.directory);
+    }
+    catch (error) {
+        if (!(options.force && isNotFoundPathError(error)))
+            throw normalize(error, { operation: "remove", phase: "remove", relativePath: "" });
+    }
+    boundary.assertAfterMutation();
+    assertNotAborted();
+}
 export async function removePathInRootNative(root, target, options, receipts) {
-    const binding = getNativeBinding();
+    const binding = getNativeBinding("openBeneath", "rootRemovalStat", "rootRemovalUnlink");
     if (!binding?.rootRemovalStat || !binding.rootRemovalUnlink) {
         unavailable();
     }
@@ -39,9 +104,22 @@ export async function removePathInRootNative(root, target, options, receipts) {
     const boundary = await captureNonrecursiveRemovalAdmission(root, target, options, receipts);
     if (!boundary)
         return;
-    const rootAdmission = await openNativeRootAdmission(binding, {
-        rootPath: root.rootReal, rootIdentity: root.rootIdentity, operation: "remove", reportCloseErrors: true, searchOnly: true,
-    }).catch(error => { throw normalizeRemoveGuardError(error); });
+    if (options.recursive && options.maxEntries === 0) {
+        options.signal?.throwIfAborted();
+        boundary.assertCurrent();
+        throw new FsSafeError("too-large", "recursive removal budget exceeded", {
+            details: { operation: "remove", phase: "inspect", relativePath: "" },
+        });
+    }
+    let rootAdmission;
+    try {
+        rootAdmission = openExactNativeRootAdmissionSync(binding, {
+            rootPath: root.rootReal, rootIdentity: root.rootIdentity, operation: "remove", reportCloseErrors: true,
+        });
+    }
+    catch (error) {
+        throw normalizeRemoveGuardError(error);
+    }
     let parent;
     let initialEntry;
     let initialDirectory;
@@ -53,7 +131,7 @@ export async function removePathInRootNative(root, target, options, receipts) {
         if (!isPathInside(root.rootReal, parentPath))
             throw new FsSafeError("outside-workspace", "removal parent is outside root");
         try {
-            parent = await openNativeParentAdmission(binding, rootAdmission, path.relative(root.rootReal, parentPath).split(path.sep).join("/"));
+            parent = parentPath === root.rootReal ? borrowNativeRootParent(rootAdmission) : await openNativeParentAdmission(binding, rootAdmission, path.relative(root.rootReal, parentPath).split(path.sep).join("/"), "native-directory");
         }
         catch (error) {
             assertRootIdentityCurrentSync(root);
@@ -95,7 +173,13 @@ export async function removePathInRootNative(root, target, options, receipts) {
                     }
                 }
             }
-            if (!options.recursive || initialEntry)
+            if (!options.recursive)
+                await removeNativeLeaf(binding, parent, target, options, boundary, 
+                // The borrowed Root guard is the complete parent fence. Without an
+                // intervening callback or await, the first leaf sample shares its phase.
+                parentPath === root.rootReal && !options.signal && !options.denyMutations &&
+                    !options.assertBeforeMutation && !getFsSafeTestHooks()?.beforeRootFallbackMutation);
+            else if (initialEntry)
                 await removeEntries(parent);
         }
     }
@@ -159,7 +243,7 @@ export async function removePathInRootNative(root, target, options, receipts) {
         function assertTraversalCurrent() {
             for (const guard of guards) {
                 try {
-                    assertSyncDirectoryGuard(guard);
+                    assertRemovalDirectoryCurrent(guard);
                 }
                 catch (cause) {
                     throw new FsSafeError("path-mismatch", "removal ancestor changed", { cause });
@@ -196,8 +280,6 @@ export async function removePathInRootNative(root, target, options, receipts) {
             }
             if (!counted)
                 examined++;
-            if (!options.recursive)
-                await beforeMutation(entryPath);
             await assertMutationNotDenied(entryPath, options.denyMutations, { protectAncestors: true });
             const initial = observe(fd, name, entryPath, depth === 0 ? initialEntry : undefined);
             if (!initial)
@@ -234,7 +316,7 @@ export async function removePathInRootNative(root, target, options, receipts) {
                                 throw normalize(error, details(entryPath, "enumerate"));
                             }
                         };
-                        guards.push({ dir: entryPath, realPath: entryPath, stat });
+                        guards.push(createRemovalDirectoryAssertion(entryPath, stat, entryPath));
                         try {
                             assertCurrent();
                             if (options.order === "sorted") {
@@ -299,10 +381,7 @@ export async function removePathInRootNative(root, target, options, receipts) {
                 if (!(options.force && isNotFoundPathError(error)))
                     throw normalize(error, details(entryPath, "remove"));
             }
-            if (options.recursive)
-                boundary.assertCurrent();
-            else
-                boundary.assertAfterMutation();
+            boundary.assertCurrent();
             assertTraversalCurrent();
             assertNotAborted();
         }