@openclaw/openshell-sandbox 2026.10.5-beta.4 → 2026.10.10-beta.2

package/node_modules/@openclaw/fs-safe/dist/pinned-write.js

@@ -12,8 +12,7 @@ import { syncDirectoryBestEffort } from "./directory-durability.js";
 import { sha256Hex } from "./file-identity.js";
 import { withAsyncDirectoryGuards } from "./guarded-mutation.js";
 import { mkdirPathComponentsWithGuards } from "./guarded-mkdir.js";
-import { runPinnedWriteNative } from "./native-pinned-write.js";
-import { getNativeBinding } from "./native.js";
+import { getPinnedWriteNativeBinding, runPinnedWriteNative } from "./native-pinned-write.js";
 import { validatePinnedRelativePath } from "./pinned-operation.js";
 import { cleanupPinnedFilePath } from "./file-cleanup.js";
 import { withSidecarLock } from "./sidecar-lock.js";
@@ -23,6 +22,7 @@ import { assertPinnedWriteMode, preparePinnedWriteMode } from "./pinned-write-mo
 import { runPinnedStagedWrite } from "./pinned-write-staged.js";
 import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
+import { copyLinkAtParent } from "./copy-link.js";
 function assertSafeBasename(basename) {
     if (!basename ||
         basename === "." ||
@@ -88,7 +88,7 @@ export async function runPinnedWriteHelper(params) {
     if (normalizedParams.onRenameIdentityMismatch === "verify-content") {
         return await runPinnedWriteFallback(normalizedParams);
     }
-    const native = getNativeBinding();
+    const native = getPinnedWriteNativeBinding(normalizedParams);
     if (native) {
         return await runPinnedWriteNative(native, normalizedParams, input => runPinnedWriteFallback({ ...normalizedParams, input }));
     }
@@ -225,6 +225,8 @@ async function runPinnedWriteFallback(params) {
         }));
         await assertAsyncDirectoryGuard(parentGuard);
     }
+    if (params.input.kind === "link")
+        return await copyLinkAtParent(params, params.input, parentGuard);
     if (params.overwrite === false && params.input.kind !== "file" && !params.input.stageBeforePublish) {
         const assertBeforeMutation = () => {
             assertFinalSymlinkRejected(targetPath, params.rejectFinalSymlink);
@@ -261,7 +263,7 @@ async function runPinnedWriteFallback(params) {
             if (verifyPosixMode)
                 assertPinnedWriteMode(handle.fd, 0o600, params.private);
             // Content writes may clear set-ID bits; finalize them through the owned fd.
-            await handle.chmod(params.mode);
+            fsSync.fchmodSync(handle.fd, params.mode);
             if (verifyPosixMode)
                 assertPinnedWriteMode(handle.fd, params.mode, params.private);
             if (params.sync !== false) {
@@ -270,7 +272,7 @@ async function runPinnedWriteFallback(params) {
                 else
                     await syncFileBestEffort(handle);
             }
-            const stat = fsSync.fstatSync(handle.fd);
+            const stat = fsSync.fstatSync(handle.fd, { bigint: true });
             if (params.sync !== false)
                 await syncDirectoryBestEffort(parentPath);
             // Publication is complete. A failed outer check must not remove its target.

package/node_modules/@openclaw/fs-safe/dist/pipe.d.ts

@@ -0,0 +1,9 @@
+import { type OwnedFileDescriptorSync } from "./create-owned-file.js";
+export type OwnedPipeSync = {
+    readonly reader: OwnedFileDescriptorSync;
+    readonly writer: OwnedFileDescriptorSync;
+    /** True when close-on-exec was set atomically at creation. */
+    readonly atomicCloseOnExec: boolean;
+};
+/** Creates a POSIX anonymous pipe with two native-owned, close-on-exec ends. */
+export declare function createPipe(): OwnedPipeSync;

package/node_modules/@openclaw/fs-safe/dist/pipe.js

@@ -0,0 +1,26 @@
+import { ownFileDescriptorSync } from "./create-owned-file.js";
+import { FsSafeError } from "./errors.js";
+import { captureNativeFdClose } from "./native-binding.js";
+import { requireNativeBinding } from "./native.js";
+/** Creates a POSIX anonymous pipe with two native-owned, close-on-exec ends. */
+export function createPipe() {
+    if (!["linux", "darwin", "freebsd"].includes(process.platform)) {
+        throw new FsSafeError("unsupported-platform", "anonymous pipes require Linux, Darwin, or FreeBSD");
+    }
+    const native = requireNativeBinding();
+    if (!native.createPipe) {
+        throw new FsSafeError("helper-unavailable", "native anonymous pipes are unavailable");
+    }
+    const close = captureNativeFdClose(native);
+    try {
+        const { reader, writer, atomicCloseOnExec } = native.createPipe();
+        return Object.freeze({
+            reader: ownFileDescriptorSync(reader, close),
+            writer: ownFileDescriptorSync(writer, close),
+            atomicCloseOnExec,
+        });
+    }
+    catch (cause) {
+        throw new FsSafeError("helper-failed", "anonymous pipe creation failed", { cause });
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/private-directory.js

@@ -25,6 +25,6 @@ export async function createPrivateDirectory(targetPath, options) {
     if (components.some(component => component.endsWith(".") || component.endsWith(" "))) {
         throw Object.assign(new Error("private directory path has an ambiguous component"), { code: "EINVAL" });
     }
-    warnNativeFallback("windows-private-directory", "Private Windows directory creation uses a slower built-in system command.");
+    warnNativeFallback("windows-private-directory", "Private Windows directory creation launches the packaged .NET helper for each check or creation.", "createPrivateDirectory");
     await createPrivateWindowsDirectoryCommand(path.win32.resolve(targetPath));
 }

package/node_modules/@openclaw/fs-safe/dist/private-producer-handoff.js

@@ -2,6 +2,7 @@ import fsSync, {} from "node:fs";
 import fs, {} from "node:fs/promises";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentityForCleanup } from "./file-identity.js";
+import { isHardlinkFallbackError } from "./hardlink-fallback.js";
 import { assertSynchronousCallbackResult } from "./mutation-authority.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { errorCauseOptions } from "./root-errors.js";
@@ -39,11 +40,7 @@ export function normalizeLinkError(error) {
     if (code === "EEXIST") {
         return new FsSafeError("already-exists", "isolated producer sibling already exists", errorCauseOptions(error));
     }
-    if (code === "EXDEV" ||
-        code === "ENOSYS" ||
-        code === "ENOTSUP" ||
-        code === "EOPNOTSUPP" ||
-        code === "EPERM") {
+    if (isHardlinkFallbackError(error)) {
         return new FsSafeError("helper-unavailable", "atomic isolated producer handoff is unavailable", errorCauseOptions(error));
     }
     return error;

package/node_modules/@openclaw/fs-safe/dist/private-temp-workspace.d.ts

@@ -1,7 +1,8 @@
+import { type ExactIdentityReceipt } from "./exact-identity.js";
 import type { TempWorkspaceOptions, TempWorkspace, TempWorkspaceSync } from "./temp-workspace-types.js";
 export type { TempWorkspaceCleanupResult, TempWorkspaceCleanupSafety, } from "./temp-workspace-owner.js";
 export type { TempWorkspaceOptions, TempWorkspace, TempWorkspaceSync } from "./temp-workspace-types.js";
-export declare function tempWorkspace(options: TempWorkspaceOptions): Promise<TempWorkspace>;
+export declare function tempWorkspace(options: TempWorkspaceOptions): Promise<TempWorkspace & ExactIdentityReceipt>;
 export declare function withTempWorkspace<T>(options: TempWorkspaceOptions, run: (workspace: TempWorkspace) => Promise<T>): Promise<T>;
-export declare function tempWorkspaceSync(options: TempWorkspaceOptions): TempWorkspaceSync;
+export declare function tempWorkspaceSync(options: TempWorkspaceOptions): TempWorkspaceSync & ExactIdentityReceipt;
 export declare function withTempWorkspaceSync<T>(options: TempWorkspaceOptions, run: (workspace: TempWorkspaceSync) => T): T;

package/node_modules/@openclaw/fs-safe/dist/private-temp-workspace.js

@@ -1,3 +1,4 @@
+import { exactFileIdentity } from "./exact-identity.js";
 import { randomInt, randomUUID } from "node:crypto";
 import fsSync, {} from "node:fs";
 import fs from "node:fs/promises";
@@ -61,6 +62,26 @@ function createTempWorkspaceWithRequestedModeSync(childPrefix, dirMode, prepareC
     }
     throw collision;
 }
+function createNativeTempWorkspace(childPrefix, capability) {
+    const create = capability.binding?.createTempDirectoryBeneath;
+    if (!create || capability.parent?.access !== "read")
+        return undefined;
+    for (let attempt = 0; attempt < TEMP_WORKSPACE_DIRECT_CREATE_ATTEMPTS; attempt += 1) {
+        const dir = randomTempWorkspaceChildPath(childPrefix);
+        capability.prepareChildCreation();
+        let created;
+        try {
+            created = create.call(capability.binding, capability.parent.fd, path.basename(dir));
+        }
+        catch (error) {
+            if (error.code === "EEXIST")
+                continue;
+            throw error;
+        }
+        return { dir, ...TempWorkspaceRetainedChild.adoptCreated(dir, created.fd, created.searchOnly) };
+    }
+    throw Object.assign(new Error("temp workspace name collisions exhausted"), { code: "EEXIST" });
+}
 function resolveWorkspaceLeaf(dir, fileName) {
     const resolved = path.join(dir, assertWorkspaceFileName(fileName));
     assertNoWindowsPathAlias(resolved, "filesystem", "temp workspace path uses a Windows filesystem namespace alias");
@@ -143,7 +164,7 @@ function registerTempWorkspace(dir, retainedChild, capability, admission, dirMod
     catch (error) {
         throwTempWorkspaceCreationFailure(error, retainedChild, capability, owner);
     }
-    return { owner: owner, unregisterTempDir, identity: { dev: Number(stat.dev), ino: Number(stat.ino) } };
+    return { owner: owner, unregisterTempDir, exactIdentity: exactFileIdentity(stat), identity: { dev: Number(stat.dev), ino: Number(stat.ino) } };
 }
 async function createTempWorkspace(options, scopedPrefix = false) {
     const { rootDir, dirMode, mode, cleanupSafety } = tempWorkspaceSettings(options);
@@ -154,12 +175,17 @@ async function createTempWorkspace(options, scopedPrefix = false) {
     let dir;
     let retainedChild;
     try {
-        // Native capability discovery is complete before this synchronous
-        // boundary. The existing canonical-root route now captures the complete
-        // ancestry and associates its provisional parent descriptor here, then
-        // dispatches mkdtemp without yielding or invoking another probe.
-        capability.prepareChildCreation();
-        dir = await fs.mkdtemp(childPrefix);
+        // Both creation routes first capture the complete ancestry and associate
+        // the provisional parent descriptor without another capability probe.
+        const created = createNativeTempWorkspace(childPrefix, capability);
+        if (created) {
+            dir = created.dir;
+            retainedChild = created.retained;
+        }
+        else {
+            capability.prepareChildCreation();
+            dir = await fs.mkdtemp(childPrefix);
+        }
         assertNoWindowsPathAlias(dir, "filesystem", "temp workspace path uses a Windows filesystem namespace alias");
         if (capability.parent)
             capability.assertCurrent();
@@ -169,7 +195,7 @@ async function createTempWorkspace(options, scopedPrefix = false) {
         const needsModeInitialization = validateInitialTempWorkspaceChild(stat, admission.ownerUid, dirMode, dir);
         // Retain while the child still has its private creation mode so an
         // explicit dirMode such as 0 cannot make identity descriptor acquisition fail.
-        retainedChild = TempWorkspaceRetainedChild.retain(dir, stat);
+        retainedChild ??= TempWorkspaceRetainedChild.retain(dir, stat);
         if (needsModeInitialization) {
             await retainedChild.initializeMode(dirMode, admission.ownerUid, admission.assertCurrent);
         }
@@ -177,12 +203,13 @@ async function createTempWorkspace(options, scopedPrefix = false) {
     catch (error) {
         throwTempWorkspaceCreationFailure(error, retainedChild, capability);
     }
-    const { owner, identity, unregisterTempDir } = registerTempWorkspace(dir, retainedChild, capability, admission, dirMode);
+    const { owner, identity, exactIdentity, unregisterTempDir } = registerTempWorkspace(dir, retainedChild, capability, admission, dirMode);
     // Once registered, even a store-construction failure remains exit-cleanable.
     const store = fileStore({ rootDir: dir, private: true, dirMode, mode });
     return {
         dir,
         identity,
+        exactIdentity,
         store,
         path: (fileName) => resolveWorkspaceLeaf(dir, fileName),
         write: async (fileName, data) => await store.write(assertWorkspaceFileName(fileName), data, { mode }),
@@ -273,12 +300,13 @@ function createTempWorkspaceSync(options, scopedPrefix = false) {
     catch (error) {
         throwTempWorkspaceCreationFailure(error, retainedChild, capability);
     }
-    const { owner, identity, unregisterTempDir } = registerTempWorkspace(dir, retainedChild, capability, admission, dirMode);
+    const { owner, identity, exactIdentity, unregisterTempDir } = registerTempWorkspace(dir, retainedChild, capability, admission, dirMode);
     // Once registered, even a store-construction failure remains exit-cleanable.
     const store = fileStoreSync({ rootDir: dir, private: true, dirMode, mode });
     return {
         dir,
         identity,
+        exactIdentity,
         store,
         path: (fileName) => resolveWorkspaceLeaf(dir, fileName),
         write: (fileName, data) => store.write(assertWorkspaceFileName(fileName), data, { mode }),

package/node_modules/@openclaw/fs-safe/dist/publish-copy-stage.js

@@ -2,7 +2,10 @@ import fs, {} from "node:fs";
 import path from "node:path";
 import { assertSyncDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
+import { assertExclusiveCreateLeaf } from "./exclusive-create.js";
 import { sameFileIdentityForCleanup } from "./file-identity.js";
+import { hasErrorCode } from "./file-cleanup.js";
+import { isHardlinkFallbackError } from "./hardlink-fallback.js";
 // Node has no portable no-replace rename. Publish the completed stage by link,
 // then remove its verified temporary name without yielding.
 export function publishCopyStage(params) {
@@ -27,7 +30,16 @@ export function publishCopyStage(params) {
         throw new FsSafeError("already-exists", "destination already exists");
     }
     params.onPublicationAttempt?.();
-    fs.linkSync(temporaryPath, targetPath);
+    let renamed = false;
+    try {
+        fs.linkSync(temporaryPath, targetPath);
+    }
+    catch (error) {
+        if (!isHardlinkFallbackError(error))
+            throw error;
+        publishThroughPlaceholder(params, assertCurrent);
+        renamed = true;
+    }
     let observerRejected = false;
     let observerError;
     try {
@@ -38,16 +50,29 @@ export function publishCopyStage(params) {
         observerError = error;
     }
     try {
-        const parent = fs.lstatSync(path.dirname(temporaryPath), { bigint: true });
-        const current = fs.lstatSync(temporaryPath, { bigint: true });
-        if (parent.isSymbolicLink() || !parent.isDirectory() ||
-            !sameFileIdentityForCleanup(parent, params.parentGuard.stat) ||
-            current.isSymbolicLink() || !current.isFile() ||
-            !sameFileIdentityForCleanup(current, identity)) {
-            throw new FsSafeError("path-mismatch", "published copy temporary name changed before cleanup");
+        if (renamed) {
+            assertSyncDirectoryGuard(params.parentGuard);
+            if (fs.lstatSync(temporaryPath, { throwIfNoEntry: false })) {
+                throw new FsSafeError("path-mismatch", "renamed copy stage still exists");
+            }
+            const target = fs.lstatSync(targetPath, { bigint: true });
+            if (!target.isFile() || target.isSymbolicLink() || target.nlink !== 1n ||
+                !sameFileIdentityForCleanup(target, identity)) {
+                throw new FsSafeError("path-mismatch", "renamed copy target changed after publication");
+            }
+        }
+        else {
+            const parent = fs.lstatSync(path.dirname(temporaryPath), { bigint: true });
+            const current = fs.lstatSync(temporaryPath, { bigint: true });
+            if (parent.isSymbolicLink() || !parent.isDirectory() ||
+                !sameFileIdentityForCleanup(parent, params.parentGuard.stat) ||
+                current.isSymbolicLink() || !current.isFile() ||
+                !sameFileIdentityForCleanup(current, identity)) {
+                throw new FsSafeError("path-mismatch", "published copy temporary name changed before cleanup");
+            }
+            // This removes the stage's name, never the published destination or source.
+            fs.unlinkSync(temporaryPath);
         }
-        // This removes the stage's name, never the published destination or source.
-        fs.unlinkSync(temporaryPath);
     }
     catch (error) {
         throw new FsSafeError("helper-failed", "published copy temporary cleanup failed", {
@@ -58,3 +83,60 @@ export function publishCopyStage(params) {
     if (observerRejected)
         throw observerError;
 }
+function isEmptyPlaceholder(current, identity) {
+    return current.isFile() && !current.isSymbolicLink() && current.nlink === 1n &&
+        current.size === 0n && sameFileIdentityForCleanup(current, identity);
+}
+function publishThroughPlaceholder(params, assertCurrent) {
+    const { targetPath, temporaryPath } = params;
+    // An empty placeholder can be observed before the completed stage atomically replaces it.
+    // The stage proved directory write access; a real permission denial still fails O_EXCL.
+    assertCurrent();
+    let fd;
+    try {
+        assertExclusiveCreateLeaf(targetPath);
+        fd = fs.openSync(targetPath, fs.constants.O_WRONLY | fs.constants.O_CREAT |
+            fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW ?? 0), 0o600);
+    }
+    catch (error) {
+        if (hasErrorCode(error, "EEXIST")) {
+            throw new FsSafeError("already-exists", "destination already exists", { cause: error });
+        }
+        throw error;
+    }
+    let placeholder;
+    try {
+        try {
+            placeholder = fs.fstatSync(fd, { bigint: true });
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        assertCurrent();
+        const current = fs.lstatSync(targetPath, { bigint: true, throwIfNoEntry: false });
+        if (!current || !isEmptyPlaceholder(current, placeholder)) {
+            throw new FsSafeError("path-mismatch", "exclusive copy placeholder changed before publication");
+        }
+        fs.renameSync(temporaryPath, targetPath);
+    }
+    catch (error) {
+        try {
+            assertSyncDirectoryGuard(params.parentGuard);
+            const current = fs.lstatSync(targetPath, { bigint: true, throwIfNoEntry: false });
+            if (current) {
+                if (!placeholder)
+                    throw new FsSafeError("path-mismatch", "copy placeholder identity unavailable for cleanup");
+                if (isEmptyPlaceholder(current, placeholder))
+                    fs.unlinkSync(targetPath);
+            }
+        }
+        catch (cleanupError) {
+            throw new FsSafeError("helper-failed", "unpublished copy placeholder cleanup failed", {
+                cause: new AggregateError([error, cleanupError], "publication and cleanup failed"),
+                details: { publication: "not-published", path: targetPath, cleanup: "failed",
+                    ...(placeholder ? { dev: placeholder.dev, ino: placeholder.ino } : {}) },
+            });
+        }
+        throw error;
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/publish-file-failure.d.ts

@@ -1,3 +1,4 @@
+import { type ExactFileIdentity } from "./exact-identity.js";
 import { FsSafeError } from "./errors.js";
 import type { FileIdentityStat } from "./file-identity.js";
 export type PublishFileExclusiveSyncFailurePolicy = "rollback" | "preserve";
@@ -11,6 +12,7 @@ export type PublishFileExclusiveFailureDetails = {
     phase: PublishFileExclusiveFailurePhase;
     targetCreated: boolean;
     targetIdentity?: FileIdentityStat;
+    exactTargetIdentity?: ExactFileIdentity;
     cleanup: PublishFileExclusiveCleanup;
     directorySync?: PublishFileExclusiveDirectorySyncFailure;
     fallback?: "link-unlink";
@@ -21,6 +23,7 @@ export type PublishFailureState = {
     phase: PublishFileExclusiveFailurePhase;
     targetCreated: boolean;
     targetIdentity?: FileIdentityStat;
+    exactTargetIdentity?: ExactFileIdentity;
     targetCleanupIdentity?: FileIdentityStat;
     preserveTarget: boolean;
     directorySync?: PublishFileExclusiveDirectorySyncFailure;

package/node_modules/@openclaw/fs-safe/dist/publish-file-failure.js

@@ -1,6 +1,8 @@
+import { exactFileIdentity } from "./exact-identity.js";
 import { FsSafeError } from "./errors.js";
 export function rememberCreatedTarget(state, identity, phase) {
     state.targetCreated = true;
+    state.exactTargetIdentity = exactFileIdentity(identity);
     state.targetIdentity = { dev: Number(identity.dev), ino: Number(identity.ino) };
     state.targetCleanupIdentity = { dev: identity.dev, ino: identity.ino };
     state.phase = phase;
@@ -10,6 +12,7 @@ export function publicationFailure(error, state, cleanup) {
     const details = {
         phase: state.phase,
         targetCreated: state.targetCreated,
+        ...(state.exactTargetIdentity ? { exactTargetIdentity: state.exactTargetIdentity } : {}),
         ...(state.targetIdentity ? { targetIdentity: state.targetIdentity } : {}),
         ...(state.directorySync ? { directorySync: state.directorySync } : {}),
         ...(state.fallback ? { fallback: state.fallback, publication: "published", sourceRemoval: state.sourceRemoval } : {}),

package/node_modules/@openclaw/fs-safe/dist/publish-file.d.ts

@@ -1,20 +1,22 @@
+import { type ExactFileIdentity } from "./exact-identity.js";
 import { type BigIntStats, type Stats } from "node:fs";
 import { type DirectoryReceipt, type DirectorySyncOutcome } from "./directory-durability.js";
-import { type FileIdentityStat } from "./file-identity.js";
+import { type FileIdentityInput } from "./file-identity.js";
 import { type PublishFileExclusiveSyncFailurePolicy } from "./publish-file-failure.js";
+export { isHardlinkFallbackError } from "./hardlink-fallback.js";
 export type PublishFileExclusiveStrategy = "link-or-copy" | "link-required" | "rename-noreplace";
 export type PublishFileExclusiveResult = {
     method: "hardlink" | "exclusive-copy" | "rename-noreplace";
     /** Linux auto fallback; exclusive and identity-checked, but not crash-atomic. */
     fallback?: "link-unlink";
     identity: Stats;
+    exactIdentity: ExactFileIdentity;
     directorySync: DirectorySyncOutcome;
 };
-export declare function isHardlinkFallbackError(error: unknown): boolean;
 export declare function publishFileExclusive(params: {
     sourcePath: string;
     targetPath: string;
-    expectedSourceIdentity?: FileIdentityStat;
+    expectedSourceIdentity?: FileIdentityInput;
     strategy: PublishFileExclusiveStrategy;
     onSyncFailure?: PublishFileExclusiveSyncFailurePolicy;
     parentReceipt?: DirectoryReceipt<Stats | BigIntStats>;

package/node_modules/@openclaw/fs-safe/dist/publish-file.js

@@ -1,3 +1,4 @@
+import { exactFileIdentity, numberStats } from "./exact-identity.js";
 import { nativeMoveNoReplace } from "./native-move-fallback.js";
 import { getFsSafeNativeConfig } from "./native-config.js";
 import { createHash } from "node:crypto";
@@ -9,9 +10,9 @@ import { pinDirectory, } from "./directory-durability.js";
 import { FsSafeError } from "./errors.js";
 import { ownDirectoryReceipt } from "./directory-receipt.js";
 import { hashFileHandle } from "./file-hash.js";
-import { sameFileIdentity, sameFileIdentityForCleanup, } from "./file-identity.js";
+import { sameFileIdentity, sameFileIdentityForCleanup, hasSafeFileIdentity, identityFromReceipt, } from "./file-identity.js";
 import { syncFileBestEffortSync } from "./file-sync.js";
-import { getNativeBinding, requireNativeBinding } from "./native.js";
+import { getNativeBinding, requireNativeBinding, selectNativeBinding } from "./native.js";
 import { captureNativeFdClose } from "./native-binding.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { directorySyncFailure, publicationFailure, rememberCreatedTarget, } from "./publish-file-failure.js";
@@ -19,11 +20,9 @@ import { admitStandalonePublicationPath, assertNoWindowsPathAlias } from "./wind
 import { getFsSafeTestHooks } from "./test-hooks.js";
 import { hasErrorCode } from "./file-cleanup.js";
 import { writeAllToFile } from "./write-file-handle.js";
-const HARDLINK_FALLBACK_CODES = new Set(["EPERM", "EXDEV", "ENOTSUP", "EOPNOTSUPP", "ENOSYS"]);
+import { isHardlinkFallbackError } from "./hardlink-fallback.js";
+export { isHardlinkFallbackError } from "./hardlink-fallback.js";
 const NATIVE_COPY_FALLBACK_CODES = new Set(["EINVAL", "ENOSYS", "ENOTSUP", "EOPNOTSUPP", "EPERM", "EXDEV"]);
-export function isHardlinkFallbackError(error) {
-    return HARDLINK_FALLBACK_CODES.has(error?.code ?? "");
-}
 function directoryOpenFlags() {
     return (fsSync.constants.O_RDONLY |
         (typeof fsSync.constants.O_DIRECTORY === "number" ? fsSync.constants.O_DIRECTORY : 0));
@@ -78,13 +77,16 @@ async function copyPinnedSource(params) {
     if (params.native && params.targetNativeParent) {
         const closeFd = captureNativeFdClose(params.native);
         for (const method of ["clone", "copy-file-range"]) {
+            const native = selectNativeBinding(params.native, method === "clone" ? "cloneFileExclusive" : "copyFileRangeExclusive");
+            if (!native)
+                continue;
             let nativeFd;
             try {
                 if (method === "clone") {
-                    nativeFd = params.native.cloneFileExclusive(params.source.fd, params.targetNativeParent.handle.fd, params.targetNativeParent.basename);
+                    nativeFd = native.cloneFileExclusive(params.source.fd, params.targetNativeParent.handle.fd, params.targetNativeParent.basename);
                 }
                 else {
-                    const copied = await params.native.copyFileRangeExclusive(params.source.fd, params.targetNativeParent.handle.fd, params.targetNativeParent.basename);
+                    const copied = await native.copyFileRangeExclusive(params.source.fd, params.targetNativeParent.handle.fd, params.targetNativeParent.basename);
                     if (copied.errorCode) {
                         throw Object.assign(new Error(copied.errorMessage ?? "native copy failed"), {
                             code: copied.errorCode,
@@ -184,7 +186,7 @@ async function removeCreatedTargetIfUnchanged(targetPath, identity) {
 async function syncPublishedParent(params) {
     params.failure.phase = "directory-sync";
     try {
-        await getFsSafeTestHooks()?.beforePublishDirectorySync?.(params.method, params.targetPath, params.failure.targetIdentity);
+        await getFsSafeTestHooks()?.beforePublishDirectorySync?.(params.method, params.targetPath, params.failure.exactTargetIdentity);
         // PinnedDirectory.sync() revalidates descriptor/path identity immediately
         // before and after fsync; keep that check inside the shared sync boundary.
         return await params.parent.sync();
@@ -195,6 +197,12 @@ async function syncPublishedParent(params) {
     }
 }
 export async function publishFileExclusive(params) {
+    const expectedInput = params.expectedSourceIdentity;
+    const expected = expectedInput && identityFromReceipt(expectedInput);
+    const expectedSourceIdentity = expected && { dev: expected.dev, ino: expected.ino };
+    if (expectedSourceIdentity && !hasSafeFileIdentity(expectedSourceIdentity)) {
+        throw new FsSafeError("path-mismatch", "publication source identity is not exact; pass fs.stat(path, { bigint: true })");
+    }
     const sourcePathInput = admitStandalonePublicationPath(params.sourcePath, "publication source uses a Windows filesystem namespace alias");
     const targetPathInput = admitStandalonePublicationPath(params.targetPath, "publication target uses a Windows filesystem namespace alias");
     const parentReceiptInput = params.parentReceipt;
@@ -234,18 +242,13 @@ export async function publishFileExclusive(params) {
         parent = await pinDirectory(parentReceipt ?? parentPath, {
             label: "publication parent",
         });
-        const sourceIdentity = fsSync.fstatSync(source.fd);
         const sourceExactIdentity = fsSync.fstatSync(source.fd, { bigint: true });
         const sourcePathExactIdentity = fsSync.lstatSync(sourcePath, { bigint: true });
-        const expectedSourceIdentity = params.expectedSourceIdentity;
         if (sourcePathExactIdentity.isSymbolicLink() ||
             !sourcePathExactIdentity.isFile() ||
             !sameFileIdentity(sourcePathExactIdentity, sourceExactIdentity) ||
             (expectedSourceIdentity &&
-                !sameFileIdentity(expectedSourceIdentity, typeof expectedSourceIdentity.dev === "bigint" ||
-                    typeof expectedSourceIdentity.ino === "bigint"
-                    ? sourceExactIdentity
-                    : sourceIdentity))) {
+                !sameFileIdentity(expectedSourceIdentity, sourceExactIdentity))) {
             throw new FsSafeError("path-mismatch", "publication source identity did not match");
         }
         const assertSourceCurrent = () => assertPinnedSourceCurrent({ sourcePath, handle: source, identity: sourceExactIdentity });
@@ -258,19 +261,22 @@ export async function publishFileExclusive(params) {
             else
                 assertSourceCurrent();
             assertPublishedTargetCurrent(targetPath, identity, "publication target changed during directory sync");
-            return { method, ...(failure.fallback ? { fallback: failure.fallback } : {}), identity: fsSync.fstatSync(handle.fd), directorySync };
+            const observed = fsSync.fstatSync(handle.fd, { bigint: true });
+            if (!sameFileIdentity(observed, identity))
+                throw new FsSafeError("path-mismatch", "publication descriptor changed");
+            return { method, ...(failure.fallback ? { fallback: failure.fallback } : {}), identity: numberStats(observed), exactIdentity: exactFileIdentity(observed), directorySync };
         };
         await parent.assertCurrent();
         assertSourceCurrent();
         const native = strategy === "rename-noreplace"
-            ? requireNativeBinding()
-            : getNativeBinding();
+            ? requireNativeBinding("renameNoReplace")
+            : getNativeBinding("linkBeneath");
         if (native) {
             sourceNativeParent = await openNativeParent(sourcePath);
             targetNativeParent = await openNativeParent(targetPath);
         }
         if (strategy === "rename-noreplace") {
-            const binding = requireNativeBinding();
+            const binding = requireNativeBinding("renameNoReplace");
             try {
                 const fallback = nativeMoveNoReplace(binding, [
                     sourceNativeParent.handle.fd, sourceNativeParent.basename,
@@ -313,7 +319,7 @@ export async function publishFileExclusive(params) {
             return await finishPublication("rename-noreplace", source, sourceExactIdentity);
         }
         try {
-            if (native) {
+            if (native?.linkBeneath) {
                 native.linkBeneath(sourceNativeParent.handle.fd, sourceNativeParent.basename, targetNativeParent.handle.fd, targetNativeParent.basename);
             }
             else {

package/node_modules/@openclaw/fs-safe/dist/read-opened-file.d.ts

@@ -1,3 +1,4 @@
+import type { ExactFileIdentity } from "./exact-identity.js";
 import type { Stats } from "node:fs";
 import type { FileHandle } from "node:fs/promises";
 import type { ContainmentGuarantee } from "./containment.js";
@@ -6,6 +7,7 @@ export type ReadResult = {
     containment: ContainmentGuarantee;
     realPath: string;
     stat: Stats;
+    exactIdentity: ExactFileIdentity;
 };
 type OpenedFile = Omit<ReadResult & {
     handle: FileHandle;

package/node_modules/@openclaw/fs-safe/dist/read-opened-file.js

@@ -1,18 +1,17 @@
 import { normalizeMaxBytes } from "./byte-budget.js";
-import { readFileHandleBounded } from "./bounded-read.js";
+import { readFileHandleBoundedWithSize } from "./bounded-read.js";
 import { FsSafeError } from "./errors.js";
 export async function readOpenedFileSafely(params) {
     const maxBytes = normalizeMaxBytes(params.maxBytes);
     if (maxBytes !== undefined && params.opened.stat.size > maxBytes) {
         throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got ${params.opened.stat.size})`);
     }
-    const buffer = maxBytes === undefined
-        ? await params.opened.handle.readFile()
-        : await readFileHandleBounded(params.opened.handle, maxBytes);
+    const buffer = await readFileHandleBoundedWithSize(params.opened.handle, maxBytes ?? Infinity, params.opened.stat.size);
     return {
         buffer,
         containment: params.opened.containment,
         realPath: params.opened.realPath,
         stat: params.opened.stat,
+        exactIdentity: params.opened.exactIdentity,
     };
 }

package/node_modules/@openclaw/fs-safe/dist/realpath.js

@@ -4,9 +4,41 @@ import { getSystemErrorName } from "node:util";
 import { FsSafeError } from "./errors.js";
 import { getNativeBinding } from "./native.js";
 import { getFsSafeNativeConfig } from "./native-config.js";
+import { isWindowsAppContainer } from "./windows-appcontainer.js";
 const runtimePlatform = process.versions.bun ? platform() : undefined;
 const bunPosix = runtimePlatform === "darwin" || runtimePlatform === "linux" ? runtimePlatform : undefined;
 function resolve(input, native) {
+    if (native && process.platform === "win32") {
+        try {
+            return fs.realpathSync.native(input);
+        }
+        catch (error) {
+            if (error.code !== "EPERM" || error.syscall !== "realpath")
+                throw error;
+            let binding;
+            try {
+                binding = getNativeBinding();
+            }
+            catch {
+                binding = undefined;
+            }
+            if (!binding || !isWindowsAppContainer(binding))
+                throw error;
+            if (!binding?.resolveWindowsCanonicalPath) {
+                throw new FsSafeError("helper-unavailable", "Windows canonicalization after a denied DOS-name query requires the native binding", { cause: error });
+            }
+            let resolved;
+            try {
+                resolved = binding.resolveWindowsCanonicalPath(input);
+            }
+            catch (cause) {
+                throw new FsSafeError("path-mismatch", "Windows canonical path cannot be verified safely", { cause });
+            }
+            if (resolved === null)
+                throw error;
+            return resolved;
+        }
+    }
     if (bunPosix) {
         // Bun 1.4.2 normalizes native path components and opens the leaf for reads.
         // The Rust OS resolver preserves permissions, locks and physical spelling.