@openclaw/openshell-sandbox 2026.10.5-beta.4 → 2026.10.10-beta.2

package/node_modules/@openclaw/fs-safe/dist/root-remove.js

@@ -266,7 +266,9 @@ export async function removePathInRootFallback(root, targetPath, options, receip
     const rootGuard = await createAsyncDirectoryGuard(root.rootReal, { bigint: true });
     if (!sameFileIdentityForCleanup(rootGuard.stat, root.rootIdentity))
         throw rootPathChangedError();
-    const guards = [rootGuard];
+    const guards = [
+        createRemovalDirectoryAssertion(rootGuard.dir, rootGuard.stat, rootGuard.realPath),
+    ];
     let ancestor = root.rootReal;
     const parentRelative = path.relative(root.rootReal, path.dirname(targetPath));
     for (const segment of parentRelative.split(path.sep).filter(Boolean)) {
@@ -287,12 +289,12 @@ export async function removePathInRootFallback(root, targetPath, options, receip
         if (!isPathInside(guard.realPath, ancestor) || !isPathInside(ancestor, guard.realPath)) {
             throw new FsSafeError("path-mismatch", "removal ancestor changed during operation");
         }
-        guards.push(guard);
+        guards.push(createRemovalDirectoryAssertion(guard.dir, guard.stat, guard.realPath));
     }
     function assertCurrent() {
         for (const guard of guards) {
             try {
-                assertSyncDirectoryGuard(guard);
+                assertRemovalDirectoryCurrent(guard);
             }
             catch (error) {
                 // force tolerates a vanished leaf, never a lost traversal boundary.
@@ -342,7 +344,7 @@ export async function removePathInRootFallback(root, targetPath, options, receip
                 !sameFileIdentityForCleanup(directoryGuard.stat, initial)) {
                 throw new FsSafeError("path-mismatch", "removal directory changed during operation");
             }
-            guards.push(directoryGuard);
+            guards.push(createRemovalDirectoryAssertion(directoryGuard.dir, directoryGuard.stat, directoryGuard.realPath));
             try {
                 assertCurrent();
                 assertNotAborted(options.signal);

package/node_modules/@openclaw/fs-safe/dist/root-walk.js

@@ -29,23 +29,9 @@ function entryKind(entry) {
 function limitEntry(relativePath) {
     return { relativePath, kind: "truncated", size: 0 };
 }
-export async function* walkRoot(root, relativePath, options) {
-    if (!["skip", "follow-within-root", "include"].includes(options.symlinkPolicy)) {
-        throw new TypeError(`invalid root walk symlink policy: ${String(options.symlinkPolicy)}`);
-    }
-    if (options.order !== undefined && !["sorted", "filesystem"].includes(options.order)) {
-        throw new TypeError(`invalid root walk order: ${String(options.order)}`);
-    }
-    if (options.limitBehavior !== undefined &&
-        !["truncate", "throw"].includes(options.limitBehavior)) {
-        throw new TypeError(`invalid root walk limit behavior: ${String(options.limitBehavior)}`);
-    }
-    if (options.onDirectoryError !== undefined &&
-        !["throw", "skip-and-report"].includes(options.onDirectoryError)) {
-        throw new TypeError(`invalid root walk directory error behavior: ${String(options.onDirectoryError)}`);
-    }
-    const maxDepth = validateBudget("maxDepth", options.maxDepth);
-    const maxEntries = validateBudget("maxEntries", options.maxEntries);
+export function walkRoot(root, relativePath, options) {
+    let maxDepth;
+    let maxEntries;
     const visitedDirectories = new Set();
     let examined = 0;
     let truncated = false;
@@ -69,6 +55,24 @@ export async function* walkRoot(root, relativePath, options) {
         return { relativePath: directory, kind: "directory-error", size: 0, error };
     };
     async function* visit(directory, depth, admittedChildPath) {
+        if (depth === 0) {
+            if (!["skip", "follow-within-root", "include"].includes(options.symlinkPolicy)) {
+                throw new TypeError(`invalid root walk symlink policy: ${String(options.symlinkPolicy)}`);
+            }
+            if (options.order !== undefined && !["sorted", "filesystem"].includes(options.order)) {
+                throw new TypeError(`invalid root walk order: ${String(options.order)}`);
+            }
+            if (options.limitBehavior !== undefined &&
+                !["truncate", "throw"].includes(options.limitBehavior)) {
+                throw new TypeError(`invalid root walk limit behavior: ${String(options.limitBehavior)}`);
+            }
+            if (options.onDirectoryError !== undefined &&
+                !["throw", "skip-and-report"].includes(options.onDirectoryError)) {
+                throw new TypeError(`invalid root walk directory error behavior: ${String(options.onDirectoryError)}`);
+            }
+            maxDepth = validateBudget("maxDepth", options.maxDepth);
+            maxEntries = validateBudget("maxEntries", options.maxEntries);
+        }
         options.signal?.throwIfAborted();
         let listing;
         let canonicalDirectory;
@@ -142,7 +146,7 @@ export async function* walkRoot(root, relativePath, options) {
             while (true) {
                 let next;
                 try {
-                    next = await listing.next();
+                    next = listing.nextSnapshot ? listing.nextSnapshot() : await listing.next();
                     options.signal?.throwIfAborted();
                 }
                 catch (error) {
@@ -228,5 +232,5 @@ export async function* walkRoot(root, relativePath, options) {
             }
         }
     }
-    yield* visit(relativePath, 0);
+    return visit(relativePath, 0);
 }

package/node_modules/@openclaw/fs-safe/dist/root-write-admission.js

@@ -260,12 +260,14 @@ export async function resolvePinnedWriteTargetInRoot(root, relativePath, request
     }
     if (!overwrite) {
         try {
-            const existing = fsSync.statSync(resolved);
-            if (!existing.isFile() && !existing.isDirectory())
-                throw new FsSafeError("not-file", "not a file");
-            if (existing.isFile() && existing.nlink > 1)
-                throw hardlinkedPathNotAllowedError();
-            throw new FsSafeError("already-exists", "file already exists");
+            const existing = fsSync.statSync(resolved, { throwIfNoEntry: false });
+            if (existing) {
+                if (!existing.isFile() && !existing.isDirectory())
+                    throw new FsSafeError("not-file", "not a file");
+                if (existing.isFile() && existing.nlink > 1)
+                    throw hardlinkedPathNotAllowedError();
+                throw new FsSafeError("already-exists", "file already exists");
+            }
         }
         catch (error) {
             if (!isNotFoundPathError(error))

package/node_modules/@openclaw/fs-safe/dist/root-write-publication.js

@@ -62,7 +62,11 @@ export async function finishRootFallbackWrite(params) {
         // Final mode belongs to the accepted object, including on rename-unstable
         // filesystems; never chmod the old temp and assume its mode was transferred.
         try {
-            await handle.chmod(params.mode);
+            // Windows chmod only changes the owner-write bit (the read-only attribute).
+            const modeChange = process.platform !== "win32" ||
+                (fsSync.fstatSync(handle.fd).mode & 0o200) !== (params.mode & 0o200);
+            if (modeChange)
+                fsSync.fchmodSync(handle.fd, params.mode);
         }
         catch (error) {
             await cleanupPinnedFilePath({

package/node_modules/@openclaw/fs-safe/dist/secure-file-windows.js

@@ -3,6 +3,7 @@ import { getNativeBinding } from "./native.js";
 import { getFsSafeNativeConfig } from "./native-config.js";
 import { warnNativeFallback } from "./native-fallback-warning.js";
 import { inspectWindowsDescriptorCommand } from "./windows-security-command.js";
+import { assertWindowsHelperAllowed } from "./windows-appcontainer.js";
 import { unverified as permissionUnverified, validateSecureWindowsSecurityFacts } from "./windows-security-facts.js";
 const IDENTITY_RE = /^([0-9a-f]{8}):([0-9a-f]{16})$/;
 const TRUSTED_OWNER_CLASSES = new Set(["current-user", "system", "administrators"]);
@@ -61,7 +62,8 @@ export async function inspectSecureWindowsFile(params) {
         permissionUnverified("Windows descriptor ACL verification requires an up-to-date native helper");
     }
     if (!nativeAvailable) {
-        warnNativeFallback("windows-secure-file", "Windows descriptor ACL inspection uses a slower built-in system command.");
+        assertWindowsHelperAllowed();
+        warnNativeFallback("windows-secure-file", "Windows descriptor ACL inspection launches the packaged .NET helper for each check.", "inspectWindowsSecureFileHandle");
     }
     let result;
     try {

package/node_modules/@openclaw/fs-safe/dist/secure-file.d.ts

@@ -1,3 +1,4 @@
+import { type ExactFileIdentity } from "./exact-identity.js";
 import { type Stats } from "node:fs";
 import { type PermissionCheck, type PermissionCheckOptions } from "./permissions.js";
 export type SecureFileReadOptions = {
@@ -26,6 +27,7 @@ export type SecureFileReadResult = {
     buffer: Buffer;
     realPath: string;
     stat: Stats;
+    exactIdentity: ExactFileIdentity;
     permissions?: PermissionCheck;
 };
 export declare function readSecureFile(options: SecureFileReadOptions): Promise<SecureFileReadResult>;

package/node_modules/@openclaw/fs-safe/dist/secure-file.js

@@ -1,3 +1,4 @@
+import { exactFileIdentity, numberStats } from "./exact-identity.js";
 import fsSync, {} from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -135,11 +136,16 @@ async function openSecureHandle(options, maxBytes) {
         throw err;
     }
     try {
-        const openedStat = fsSync.fstatSync(handle.fd);
+        const openedIdentity = inspectFileIdentitySync(() => {
+            const observed = fsSync.fstatSync(handle.fd, { bigint: true });
+            if (!observed.isFile())
+                throw new FsSafeError("not-file", `${label(options)} must be a file: ${options.filePath}`);
+            return observed;
+        });
+        const openedStat = numberStats(openedIdentity);
         if (!openedStat.isFile()) {
             throw new FsSafeError("not-file", `${label(options)} must be a file: ${options.filePath}`);
         }
-        const openedIdentity = inspectFileIdentitySync(() => fsSync.fstatSync(handle.fd, { bigint: true }));
         assertNotHardlinked(options, openedIdentity);
         inspectFileIdentitySync(() => {
             const pathStat = options.trust?.allowSymlink
@@ -255,7 +261,7 @@ async function assertSecurePermissions(options, opened, fd) {
     return permissions;
 }
 async function readHandleWithTimeout(handle, timeoutMs, maxBytes) {
-    const read = () => maxBytes === undefined ? handle.readFile() : readFileHandleBounded(handle, maxBytes);
+    const read = () => readFileHandleBounded(handle, maxBytes ?? Infinity);
     if (timeoutMs === undefined || !Number.isFinite(timeoutMs) || timeoutMs <= 0) {
         return await read();
     }
@@ -290,7 +296,7 @@ export async function readSecureFile(options) {
             throw new FsSafeError("not-file", `${label(options)} must remain a file: ${options.filePath}`);
         }
         assertNotHardlinked(options, finalIdentity);
-        return { buffer, realPath: opened.realPath, stat: opened.pathStat, permissions };
+        return { buffer, realPath: opened.realPath, stat: opened.pathStat, exactIdentity: exactFileIdentity(opened.identity), permissions };
     }
     finally {
         await opened.handle.close().catch(() => undefined);

package/node_modules/@openclaw/fs-safe/dist/sibling-staged-file.js

@@ -75,7 +75,7 @@ async function writeIsolatedProducer(params) {
     const targetRoot = rootFromDirectoryGuard(parentGuard);
     // Select the handoff before invoking the producer. Missing required native
     // support must not leave producer output behind as a discovery side effect.
-    const native = getNativeBinding();
+    const native = getNativeBinding("openBeneath", "renameNoReplace");
     const cleanupErrors = [];
     const { target, identity } = await createOwnedTempFile({
         rootDir: targetRoot.rootReal,

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.js

@@ -246,8 +246,8 @@ export async function sidecarReclaimGuardExists(pathname, lockRoot) {
     try {
         if (lockRoot)
             await lockRoot.stat(relativeSidecarLockPath(lockRoot, pathname));
-        else
-            fsSync.lstatSync(pathname);
+        else if (fsSync.lstatSync(pathname, { throwIfNoEntry: false }) === undefined)
+            return false;
         return true;
     }
     catch (error) {

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-retained.js

@@ -99,7 +99,7 @@ export function retainCreatedSidecar(lockPath, raw, createdFd, guard, nativePare
                 }
             } };
     }
-    if (!binding.stagedFileMatches || !binding.removeStagedFile)
+    if (!binding.openBeneath || !binding.stagedFileMatches || !binding.removeStagedFile)
         return undefined;
     const closeFile = captureNativeFdClose(binding);
     const parentFd = binding.openBeneath(nativeParent.fd, "", nativeOpenFlags(fs.constants.O_RDONLY | fs.constants.O_DIRECTORY)).fd;

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-target.js

@@ -1,3 +1,4 @@
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { canonicalPathFromExistingAncestor } from "./absolute-path.js";
@@ -23,7 +24,13 @@ export async function resolveSidecarTargetPath(resolved, lockRoot) {
         assertNoWindowsPathAlias(normalized);
         return normalized;
     }
-    await fs.mkdir(recursiveMkdirPath(dir), { recursive: true });
+    let parentExists = false;
+    try {
+        parentExists = fsSync.statSync(dir).isDirectory();
+    }
+    catch { /* Preserve mkdir errors below. */ }
+    if (!parentExists)
+        await fs.mkdir(recursiveMkdirPath(dir), { recursive: true });
     let parent;
     try {
         parent = realpathSync.native(dir);

package/node_modules/@openclaw/fs-safe/dist/staged-directory.d.ts

@@ -18,6 +18,19 @@ export declare function exactIdentityMatches(expected: FileIdentityStat, actual:
 }>): boolean;
 export declare function describeStagedDirectory(fd: number, pathname: string): StagedDirectorySnapshot;
 export declare function assertStagedDirectoryCurrent(receipt: StagedDirectorySnapshot): BigIntStats;
+export declare function assertNativeStagedDirectoryCurrent(binding: NativeBinding, fd: number, directory: StagedDirectorySnapshot): void;
+/** Ordinary publication fences identity, while sibling entries may change. */
+export declare function describeNativeStagedDirectory(binding: NativeBinding, fd: number, canonicalPath: string): {
+    directory: Readonly<{
+        path: string;
+        realPath: string;
+        identity: Readonly<{
+            dev: bigint;
+            ino: bigint;
+        }>;
+    }>;
+    stat: BigIntStats;
+};
 export declare function describePolicyStagedDirectory(fd: number, pathname: string, binding?: NativeBinding): PolicyStagedDirectory;
 export declare function assertPolicyStagedDirectoryCurrent(captured: PolicyStagedDirectory): BigIntStats;
 export declare function refreshPolicyStagedDirectoryObservation(captured: PolicyStagedDirectory): MutationDirectoryObservation;

package/node_modules/@openclaw/fs-safe/dist/staged-directory.js

@@ -34,6 +34,35 @@ export function assertStagedDirectoryCurrent(receipt) {
     }
     return current;
 }
+export function assertNativeStagedDirectoryCurrent(binding, fd, directory) {
+    if (typeof binding.stagedDirectoryMatches === "function" && directory.path === directory.realPath) {
+        try {
+            if (!binding.stagedDirectoryMatches(fd, directory.path, directory.identity.dev, directory.identity.ino)) {
+                throw new FsSafeError("path-mismatch", "staging directory pathname changed");
+            }
+            return;
+        }
+        catch (error) {
+            if (error?.code !== "OBSERVATION_UNAVAILABLE")
+                throw error;
+        }
+    }
+    assertStagedDirectoryCurrent(directory);
+}
+/** Ordinary publication fences identity, while sibling entries may change. */
+export function describeNativeStagedDirectory(binding, fd, canonicalPath) {
+    const stat = fs.fstatSync(fd, { bigint: true });
+    if (!stat.isDirectory())
+        throw new FsSafeError("not-file", "staging parent must be a directory");
+    const pathname = resolvePathPreservingWindowsRoot(canonicalPath);
+    const directory = Object.freeze({
+        path: pathname,
+        realPath: pathname,
+        identity: Object.freeze({ dev: stat.dev, ino: stat.ino }),
+    });
+    assertNativeStagedDirectoryCurrent(binding, fd, directory);
+    return { directory, stat };
+}
 function sameDirectoryMetadata(left, right) {
     return left.dev === right.dev && left.ino === right.ino && left.mode === right.mode &&
         left.nlink === right.nlink;

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-child-admission.js

@@ -3,7 +3,7 @@ import { inspectDirectoryIdentitySync, observeDirectoryIdentitySync } from "./di
 import { pinNodeDirectoryForMode, pinNodeDirectoryForModeSync } from "./directory-mode-node.js";
 import { FsSafeError } from "./errors.js";
 import { fileIdentityMismatchError, inspectFileIdentitySync } from "./strict-file-identity.js";
-import { classifyTempWorkspaceOwner, warnUnmappedTempWorkspaceAncestor } from "./temp-workspace-ownership.js";
+import { classifyTempWorkspaceOwner, hasTrustedAndroidTempAncestorGroup, warnUnmappedTempWorkspaceAncestor } from "./temp-workspace-ownership.js";
 import { privateTempDirectoryFix, tempDirectoryMode } from "./temp-directory-diagnostics.js";
 export const TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY = process.platform === "linux" || process.platform === "darwin";
 export function projectTempWorkspaceNumericIdentity(identity) {
@@ -54,9 +54,11 @@ export function assertTrustedTempWorkspaceDirectory(stat, uid, privateDirectory,
     // Unmapped host owners are unverifiable; trust the host directory hierarchy.
     // Admit sticky ancestors so PrivateUsers keeps host /tmp and PrivateTmp usable.
     // Leaf roots stay euid-owned/private; non-sticky writable ancestors are rejected.
+    const writeMask = !privateDirectory && hasTrustedAndroidTempAncestorGroup(stat, uid, ownership)
+        ? 0o002 : 0o022;
     const writable = typeof stat.mode === "bigint"
-        ? (stat.mode & 18n) !== 0n
-        : Number.isSafeInteger(stat.mode) && stat.mode >= 0 && (stat.mode & 0o022) !== 0;
+        ? (stat.mode & BigInt(writeMask)) !== 0n
+        : Number.isSafeInteger(stat.mode) && stat.mode >= 0 && (stat.mode & writeMask) !== 0;
     const sticky = typeof stat.mode === "bigint"
         ? (stat.mode & 512n) !== 0n
         : Number.isSafeInteger(stat.mode) && stat.mode >= 0 && (stat.mode & 0o1000) !== 0;

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-descriptor.d.ts

@@ -23,6 +23,10 @@ export declare class TempWorkspaceRetainedChild {
         retained: TempWorkspaceRetainedChild;
         stat: fsSync.BigIntStats;
     };
+    static adoptCreated(dir: string, fd: number, searchOnly: boolean): {
+        retained: TempWorkspaceRetainedChild;
+        stat: fsSync.BigIntStats;
+    };
     discardInitialReceipt(): void;
     finalizeAdmission(ownerUid: number | undefined, mode: number): TempWorkspaceIdentityStat;
     initializeMode(mode: number, ownerUid: number | undefined, assertParent: () => void): Promise<void>;
@@ -36,6 +40,10 @@ export declare class TempWorkspaceRetainedChild {
             ino: bigint;
         }>;
         directory: RetainedChildDirectory | undefined;
+        creationActivity: Readonly<{
+            mtimeNs: bigint;
+            ctimeNs: bigint;
+        }> | undefined;
     };
     close(): void;
 }

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-descriptor.js

@@ -90,6 +90,7 @@ export class TempWorkspaceRetainedChild {
     #dir;
     #identity;
     #numericIdentity;
+    #creationActivity;
     #access;
     #fd;
     #modeLease = false;
@@ -102,6 +103,8 @@ export class TempWorkspaceRetainedChild {
         }
         this.#dir = dir;
         this.#identity = Object.freeze({ dev: identity.dev, ino: identity.ino });
+        this.#creationActivity = typeof identity.mtimeNs === "bigint" && typeof identity.ctimeNs === "bigint"
+            ? Object.freeze({ mtimeNs: identity.mtimeNs, ctimeNs: identity.ctimeNs }) : undefined;
         this.#numericIdentity = TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY
             ? projectTempWorkspaceNumericIdentity(this.#identity)
             : undefined;
@@ -127,6 +130,14 @@ export class TempWorkspaceRetainedChild {
     }
     static retainCreated(dir) {
         const descriptor = openRetainedDirectory(dir);
+        return TempWorkspaceRetainedChild.#adoptCreated(dir, descriptor);
+    }
+    static adoptCreated(dir, fd, searchOnly) {
+        return TempWorkspaceRetainedChild.#adoptCreated(dir, {
+            fd, access: searchOnly ? "search" : "read", proc: searchOnly && process.platform === "linux",
+        });
+    }
+    static #adoptCreated(dir, descriptor) {
         try {
             // Only this immediate post-create route installs a receipt. Freezing the
             // exact fd result keeps its identity and complete mode immutable while
@@ -317,9 +328,9 @@ export class TempWorkspaceRetainedChild {
         }
         if (!retainDescriptor) {
             fsSync.closeSync(fd);
-            return { dir: this.#dir, identity: this.#identity, directory: undefined };
+            return { dir: this.#dir, identity: this.#identity, directory: undefined, creationActivity: this.#creationActivity };
         }
-        return { dir: this.#dir, identity: this.#identity, directory: { fd } };
+        return { dir: this.#dir, identity: this.#identity, directory: { fd }, creationActivity: this.#creationActivity };
     }
     close() {
         this.#assertModeLeaseReleased();

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-owner.js

@@ -191,6 +191,7 @@ export class TempWorkspaceCleanupOwner {
     #identity;
     #capability;
     #directory;
+    #creationActivity;
     #closed = false;
     #running = false;
     #exitInterrupted = false;
@@ -202,6 +203,7 @@ export class TempWorkspaceCleanupOwner {
         this.#identity = child.identity;
         this.#capability = capability;
         this.#directory = child.directory;
+        this.#creationActivity = child.creationActivity;
     }
     #repeat() {
         return this.#result === "removed" ? "missing" : this.#result;
@@ -307,7 +309,12 @@ export class TempWorkspaceCleanupOwner {
                 !sameFileIdentityForCleanup(quarantined, this.#identity)) {
                 return "indeterminate";
             }
-            return { name, path: quarantinePath, nativeRemoval };
+            // Timestamps are only a performance hint. Every identity fence still
+            // runs, and even an unchanged/coarse timestamp must pass OS empty removal.
+            const tryEmpty = this.#creationActivity !== undefined &&
+                current.mtimeNs === this.#creationActivity.mtimeNs &&
+                current.ctimeNs === this.#creationActivity.ctimeNs;
+            return { name, path: quarantinePath, nativeRemoval, tryEmpty };
         }
         catch (error) {
             if (error instanceof FsSafeError && error.code === "helper-unavailable")
@@ -335,11 +342,23 @@ export class TempWorkspaceCleanupOwner {
         }
         return result.outcome === "removed" ? "removed" : "indeterminate";
     }
+    #tryRemoveEmptyNative(quarantine) {
+        if (!quarantine.tryEmpty)
+            return undefined;
+        const binding = this.#capability.binding;
+        const result = binding.tryRemoveEmptyOwnedTree?.(this.#capability.parent.fd, quarantine.name, this.#directory.fd);
+        if (!result || (!result.errorCode && result.outcome === "not-empty"))
+            return undefined;
+        return this.#mapRemoval(result);
+    }
     async #remove(quarantine) {
         if (quarantine.nativeRemoval) {
             const beforeNativeRemoval = getFsSafeTestHooks()?.beforeTempWorkspaceNativeRemoval;
             if (beforeNativeRemoval)
                 await beforeNativeRemoval(quarantine.path);
+            const emptyResult = this.#tryRemoveEmptyNative(quarantine);
+            if (emptyResult !== undefined)
+                return emptyResult;
             return this.#mapRemoval(await this.#capability.binding.removeOwnedTree(this.#capability.parent.fd, quarantine.name, this.#directory.fd));
         }
         try {
@@ -349,7 +368,31 @@ export class TempWorkspaceCleanupOwner {
             return "indeterminate";
         }
         // Removal failures propagate unchanged; only authority uncertainty becomes a receipt.
-        await fs.rm(quarantine.path, { recursive: true, force: true });
+        const tryEmpty = quarantine.tryEmpty && process.platform !== "win32";
+        try {
+            if (tryEmpty)
+                await fs.rmdir(quarantine.path);
+            else
+                await fs.rm(quarantine.path, { recursive: true, force: true });
+        }
+        catch (error) {
+            if (!tryEmpty)
+                throw error;
+            const code = error?.code;
+            if (code !== "ENOENT") {
+                if (code !== "ENOTEMPTY" && code !== "EEXIST" && code !== "EPERM")
+                    throw error;
+                // rmdir yielded before reporting a nonempty directory. Re-admit the
+                // quarantine before allowing pathname-recursive removal to follow it.
+                try {
+                    this.#assertQuarantine(quarantine);
+                }
+                catch {
+                    return "indeterminate";
+                }
+                await fs.rm(quarantine.path, { recursive: true, force: true });
+            }
+        }
         try {
             this.#capability.assertCurrent();
             return "removed";
@@ -361,6 +404,9 @@ export class TempWorkspaceCleanupOwner {
     #removeSync(quarantine) {
         if (quarantine.nativeRemoval) {
             getFsSafeTestHooks()?.beforeTempWorkspaceNativeRemovalSync?.(quarantine.path);
+            const emptyResult = this.#tryRemoveEmptyNative(quarantine);
+            if (emptyResult !== undefined)
+                return emptyResult;
             return this.#mapRemoval(this.#capability.binding.removeOwnedTreeSync(this.#capability.parent.fd, quarantine.name, this.#directory.fd));
         }
         try {
@@ -369,7 +415,29 @@ export class TempWorkspaceCleanupOwner {
         catch {
             return "indeterminate";
         }
-        fsSync.rmSync(quarantine.path, { recursive: true, force: true });
+        const tryEmpty = quarantine.tryEmpty && process.platform !== "win32";
+        try {
+            if (tryEmpty)
+                fsSync.rmdirSync(quarantine.path);
+            else
+                fsSync.rmSync(quarantine.path, { recursive: true, force: true });
+        }
+        catch (error) {
+            if (!tryEmpty)
+                throw error;
+            const code = error?.code;
+            if (code !== "ENOENT") {
+                if (code !== "ENOTEMPTY" && code !== "EEXIST" && code !== "EPERM")
+                    throw error;
+                try {
+                    this.#assertQuarantine(quarantine);
+                }
+                catch {
+                    return "indeterminate";
+                }
+                fsSync.rmSync(quarantine.path, { recursive: true, force: true });
+            }
+        }
         try {
             this.#capability.assertCurrent();
             return "removed";

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-ownership.d.ts

@@ -2,7 +2,8 @@ type DirectoryOwner = {
     uid: number | bigint;
     gid: number | bigint;
 };
-export type TempWorkspaceOwnership = "user" | "root" | "unmapped" | "foreign";
+export type TempWorkspaceOwnership = "user" | "root" | "android-system" | "unmapped" | "foreign";
 export declare function classifyTempWorkspaceOwner(stat: DirectoryOwner, uid: number): TempWorkspaceOwnership;
+export declare function hasTrustedAndroidTempAncestorGroup(stat: DirectoryOwner, uid: number, ownership: TempWorkspaceOwnership): boolean;
 export declare function warnUnmappedTempWorkspaceAncestor(): void;
 export {};

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-ownership.js

@@ -28,6 +28,8 @@ export function classifyTempWorkspaceOwner(stat, uid) {
         return "user";
     if (stat.uid === 0 || stat.uid === 0n)
         return "root";
+    if (process.platform === "android" && (stat.uid === 1000 || stat.uid === 1000n))
+        return "android-system";
     if (process.platform !== "linux")
         return "foreign";
     try {
@@ -44,6 +46,26 @@ export function classifyTempWorkspaceOwner(stat, uid) {
         return "foreign";
     }
 }
+// Android reserves the system group and each app's matching UID/GID. This
+// exception is for ancestor group-write only; private leaves still reject it.
+export function hasTrustedAndroidTempAncestorGroup(stat, uid, ownership) {
+    if (process.platform !== "android")
+        return false;
+    if (ownership === "user" && uid % 100000 >= 10000 && uid % 100000 <= 19999) {
+        return stat.gid === uid || stat.gid === BigInt(uid);
+    }
+    if (ownership !== "android-system" || (stat.gid !== 1000 && stat.gid !== 1000n))
+        return false;
+    try {
+        const gid = process.getegid?.();
+        const groups = process.getgroups?.();
+        return gid !== undefined && Number.isSafeInteger(gid) && gid >= 0 && gid !== 1000 && Array.isArray(groups) &&
+            groups.every((group) => Number.isSafeInteger(group) && group >= 0 && group !== 1000);
+    }
+    catch {
+        return false;
+    }
+}
 export function warnUnmappedTempWorkspaceAncestor() {
     if (warned)
         return;

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-types.d.ts

@@ -1,3 +1,4 @@
+import type { ExactFileIdentity } from "./exact-identity.js";
 import type { FileStore, FileStoreSync } from "./file-store.js";
 import type { TempPathIdentityReceipt } from "./temp-cleanup.js";
 import type { TempWorkspaceCleanupResult, TempWorkspaceCleanupSafety } from "./temp-workspace-owner.js";
@@ -11,6 +12,7 @@ export type TempWorkspaceOptions = {
 export type TempWorkspace = {
     dir: string;
     identity: TempPathIdentityReceipt;
+    exactIdentity?: ExactFileIdentity;
     store: FileStore;
     path(fileName: string): string;
     write(fileName: string, data: string | Uint8Array): Promise<string>;
@@ -26,6 +28,7 @@ export type TempWorkspace = {
 export type TempWorkspaceSync = {
     dir: string;
     identity: TempPathIdentityReceipt;
+    exactIdentity?: ExactFileIdentity;
     store: FileStoreSync;
     path(fileName: string): string;
     write(fileName: string, data: string | Uint8Array): string;

package/node_modules/@openclaw/fs-safe/dist/test-hooks.d.ts

@@ -1,5 +1,6 @@
 import type { FileHandle } from "node:fs/promises";
 import type { FileIdentityStat } from "./file-identity.js";
+export { holdWindowsSharingLock, setWindowsFileAttributes, readWindowsFileExtents } from "./windows-test-hooks.js";
 export type FsSafeTestHooks = {
     beforeWatchRegistration?: (path: string) => void | Promise<void>;
     afterWatchRegistration?: (path: string) => void | Promise<void>;

package/node_modules/@openclaw/fs-safe/dist/test-hooks.js

@@ -1,3 +1,4 @@
+export { holdWindowsSharingLock, setWindowsFileAttributes, readWindowsFileExtents } from "./windows-test-hooks.js";
 let fsSafeTestHooks;
 function allowFsSafeTestHooks() {
     return process.env.NODE_ENV === "test" || process.env.VITEST === "true";

package/node_modules/@openclaw/fs-safe/dist/trash.js

@@ -97,7 +97,7 @@ function assertAllowedTrashTarget(targetPath, allowedRoots) {
     if (isForeignWindowsShareOrDevicePath(lexicalTarget, [...allowedRoots, ...resolvedRoots])) {
         throw new Error(`Refusing to trash path outside allowed roots: ${targetPath}`);
     }
-    const stat = fs.lstatSync(lexicalTarget);
+    const stat = fs.lstatSync(lexicalTarget, { bigint: true });
     const resolvedTarget = resolveTrashTargetPath(targetPath);
     const resolvedTargetPath = resolvedTarget.path;
     const parent = createSyncDirectoryGuard(path.dirname(lexicalTarget));
@@ -121,7 +121,7 @@ function assertAllowedTrashTarget(targetPath, allowedRoots) {
 }
 function assertTrashTargetGuard(guard) {
     assertSyncDirectoryGuard(guard.parent);
-    const stat = fs.lstatSync(guard.path);
+    const stat = fs.lstatSync(guard.path, { bigint: true });
     if (!sameFileIdentity(stat, guard.stat)) {
         throw new Error(`Refusing to trash path after it changed: ${guard.path}`);
     }