@openclaw/openshell-sandbox 2026.10.5 → 2026.10.7

package/node_modules/@openclaw/fs-safe/dist/native-parent-admission.js

@@ -5,6 +5,7 @@ import { inspectDirectoryIdentity, inspectDirectoryIdentitySync } from "./direct
 import { nodeDirectorySearchOnlyFlags } from "./directory-mode-node.js";
 import { inspectNativeDirectoryObservation } from "./native-directory-observation.js";
 import { FsSafeError } from "./errors.js";
+import { assertNativeCapabilities } from "./native.js";
 import { captureNativeFdClose } from "./native-binding.js";
 import { realpathSync } from "./realpath.js";
 import { describeStagedDirectory, exactIdentityMatches } from "./staged-directory.js";
@@ -22,6 +23,7 @@ function assertParentAdmissionAvailable(binding) {
         throw unavailable("native parent directory admission is unavailable");
     }
     captureNativeFdClose(binding);
+    assertNativeCapabilities(binding, "openBeneath");
 }
 export async function openNativeRootAdmission(binding, params) {
     assertParentAdmissionAvailable(binding);

package/node_modules/@openclaw/fs-safe/dist/native-pinned-write-windows.d.ts

@@ -1,6 +1,6 @@
 import type { FileHandle } from "node:fs/promises";
 import { type AnyAsyncDirectoryGuard } from "./directory-guard.js";
 import type { FileIdentityStat } from "./file-identity.js";
-import type { NativeBinding } from "./native.js";
+import { type NativeBinding } from "./native.js";
 import type { PinnedWriteParams } from "./pinned-write-types.js";
 export declare function runPinnedWriteWindows(binding: NativeBinding, params: PinnedWriteParams, root: FileHandle, parentFd: number, parentGuard: AnyAsyncDirectoryGuard): Promise<FileIdentityStat>;

package/node_modules/@openclaw/fs-safe/dist/native-pinned-write-windows.js

@@ -8,6 +8,8 @@ import { assertSyncDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { nativeOpenFlags, removeNativeCreatedFileIfStillPinned, } from "./native-operations.js";
 import { writePinnedInput } from "./pinned-write-input.js";
+import { assertNativeCopyCompleted, createNativeCopyFile } from "./copy-file-input.js";
+import { assertNativeCapabilities } from "./native.js";
 import { captureNativeFdClose } from "./native-binding.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
@@ -15,6 +17,7 @@ import { classifyNativeRenameFailure } from "./native-rename-outcome.js";
 import { cleanupPinnedFilePath } from "./file-cleanup.js";
 import { createStagedFileReceipt, settleStagedFile } from "./staged-file-settlement.js";
 import { exactIdentityMatches } from "./staged-directory.js";
+import { restoreCopyMetadata } from "./copy-metadata.js";
 import { inspectNativeDirectoryObservation } from "./native-directory-observation.js";
 function closeWriteFd(closeFd, fd) {
     if (fd === undefined)
@@ -50,6 +53,7 @@ function assertNamedParentCurrent(binding, guard, identity) {
     assertSyncDirectoryGuard({ ...guard, stat: identity });
 }
 export async function runPinnedWriteWindows(binding, params, root, parentFd, parentGuard) {
+    assertNativeCapabilities(binding, "openBeneath", "renameNoReplace", "renameReplace", "fstatIdentity");
     const closeFd = captureNativeFdClose(binding);
     const parentPath = parentGuard.realPath;
     let tempFd;
@@ -78,6 +82,9 @@ export async function runPinnedWriteWindows(binding, params, root, parentFd, par
     try {
         tempName = `.fs-safe-${randomUUID()}.tmp`;
         params.assertBeforeMutation?.();
+        const copied = params.input.kind === "file" && !params.private
+            ? await createNativeCopyFile(binding, params.input, parentFd, tempName, params.maxBytes)
+            : undefined;
         if (params.private) {
             const parentIdentity = fsSync.fstatSync(parentFd, { bigint: true });
             privateHandle = await createFileHandle(path.join(parentPath, tempName), {
@@ -91,16 +98,24 @@ export async function runPinnedWriteWindows(binding, params, root, parentFd, par
             });
             tempFd = privateHandle.fd;
         }
+        else if (copied) {
+            tempFd = copied.fd;
+        }
         else {
             tempFd = binding.openBeneath(parentFd, tempName, nativeOpenFlags(fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL)).fd;
         }
         const verificationIdentity = inspectFileIdentitySync(() => fsSync.fstatSync(tempFd, { bigint: true }));
         tempIdentity = verificationIdentity;
+        if (params.input.kind === "file")
+            assertNativeCopyCompleted(params.input, copied);
         // Creation is requested at 0600 in the binding, but a restrictive umask
         // can remove owner access. Keep the unpublished inode private and
         // reopenable until the published name has been identity-fenced.
         fsSync.fchmodSync(tempFd, 0o600);
-        await writePinnedInput(tempFd, params.input, params.maxBytes, params.assertBeforeMutation);
+        if (!copied)
+            await writePinnedInput(tempFd, params.input, params.maxBytes, params.assertBeforeMutation);
+        if (params.input.kind === "file")
+            restoreCopyMetadata(tempFd, params.input.metadata);
         if (params.sync !== false) {
             if (params.strictFileSync)
                 fsSync.fsyncSync(tempFd);
@@ -132,6 +147,9 @@ export async function runPinnedWriteWindows(binding, params, root, parentFd, par
             }
             assertFinalSymlinkRejected(path.join(parentPath, params.basename), params.rejectFinalSymlink);
         }
+        // The authority callback itself may have cancelled an otherwise completed copy.
+        if (params.input.kind === "file")
+            params.input.signal?.throwIfAborted();
         try {
             if (params.overwrite === false) {
                 binding.renameNoReplace(parentFd, tempName, parentFd, params.basename);

package/node_modules/@openclaw/fs-safe/dist/native-pinned-write.d.ts

@@ -1,4 +1,7 @@
 import type { FileIdentityStat } from "./file-identity.js";
-import type { NativeBinding } from "./native.js";
+import { type NativeBinding } from "./native.js";
 import type { PinnedWriteParams } from "./pinned-write-types.js";
+type PinnedWriteCapabilitiesInput = Pick<PinnedWriteParams, "input" | "private" | "verifyPosixMode">;
+export declare function getPinnedWriteNativeBinding(params: PinnedWriteCapabilitiesInput): NativeBinding | undefined;
 export declare function runPinnedWriteNative(binding: NativeBinding, params: PinnedWriteParams, fallback: (input: PinnedWriteParams["input"]) => Promise<FileIdentityStat>): Promise<FileIdentityStat>;
+export {};

package/node_modules/@openclaw/fs-safe/dist/native-pinned-write.js

@@ -56,12 +56,27 @@ import { runPinnedWriteWindows } from "./native-pinned-write-windows.js";
 import { capturePolicyAwareNativeParent } from "./native-policy-parent.js";
 import { openNativeParentAdmission, openNativeRootAdmission } from "./native-parent-admission.js";
 import { assertNativeStaging, writeNativeStage } from "./native-staged-file.js";
+import { assertNativeCapabilities, getNativeBinding } from "./native.js";
 import { captureNativeFdClose } from "./native-binding.js";
 import { cachedNoReplaceUnavailable } from "./native-noreplace.js";
 import { isFsSafeNativeRequired } from "./native-config.js";
+import { copyLinkAtParent } from "./copy-link.js";
+const writeCapabilities = ["openBeneath", "mkdirBeneath", "renameNoReplace", "renameReplace"];
+const posixWriteCapabilities = [...writeCapabilities, "createStagedFile", "stagedFileMatches", "removeStagedFile"];
+function pinnedWriteCapabilities(params) {
+    const windows = process.platform === "win32";
+    const capabilities = windows ? [...writeCapabilities, "fstatIdentity"] : posixWriteCapabilities;
+    const nativeCopy = params.input.kind === "file" && !params.private &&
+        (windows || !params.verifyPosixMode);
+    return nativeCopy ? [...capabilities, "copyFileExclusive"] : capabilities;
+}
+export function getPinnedWriteNativeBinding(params) {
+    return getNativeBinding(...pinnedWriteCapabilities(params));
+}
 export async function runPinnedWriteNative(binding, params, fallback) {
     const env_1 = { stack: [], error: void 0, hasError: false };
     try {
+        assertNativeCapabilities(binding, ...pinnedWriteCapabilities(params));
         const closeFd = captureNativeFdClose(binding);
         const windows = process.platform === "win32";
         if (!windows) {
@@ -112,6 +127,9 @@ export async function runPinnedWriteNative(binding, params, fallback) {
                 parentPathStat = admitted.guard.stat;
             }
             const verificationGuard = { dir: parentPath, realPath: parentPath, stat: parentPathStat };
+            if (params.input.kind === "link") {
+                return await copyLinkAtParent(params, params.input, verificationGuard, { binding, fd: parentFd });
+            }
             if (params.overwrite === false) {
                 try {
                     fsSync.lstatSync(path.join(parentPath, params.basename));

package/node_modules/@openclaw/fs-safe/dist/native-policy-parent.d.ts

@@ -1,6 +1,6 @@
 import { type BigIntStats } from "node:fs";
 import { type AsyncDirectoryGuard } from "./directory-guard.js";
-import type { NativeBinding } from "./native.js";
+import { type NativeBinding } from "./native.js";
 import type { NativeRootAdmission } from "./native-parent-admission.js";
 import type { PinnedWriteParams } from "./pinned-write-types.js";
 import { describeStagedDirectory, type PolicyStagedDirectory } from "./staged-directory.js";

package/node_modules/@openclaw/fs-safe/dist/native-policy-parent.js

@@ -54,6 +54,7 @@ import fsSync, {} from "node:fs";
 import path from "node:path";
 import { inspectDirectoryIdentity, inspectDirectoryIdentitySync, } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
+import { assertNativeCapabilities } from "./native.js";
 import { captureNativeFdClose } from "./native-binding.js";
 import { NativePolicyDirectoryMismatch } from "./native-policy-directory-observation.js";
 import { assertWindowsPolicyParentCurrent, closeWindowsPolicyParentAfterFailure, openWindowsPolicyParent, windowsParentObservation, } from "./native-policy-parent-windows.js";
@@ -76,6 +77,7 @@ function mkdirPosixPolicyChild(binding, parentFd, basename) {
         if (typeof created === "boolean")
             return created;
     }
+    assertNativeCapabilities(binding, "mkdirBeneath");
     binding.mkdirBeneath(parentFd, basename, 0o777);
     return false;
 }
@@ -122,6 +124,7 @@ function tryDescribePolicyPosixParent(binding, fd, pathname) {
 export async function capturePolicyAwareNativeParent(binding, params, rootAdmission, windows, directoryFlags, fuseChildCreation = false) {
     const env_1 = { stack: [], error: void 0, hasError: false };
     try {
+        assertNativeCapabilities(binding, "openBeneath");
         const rootFd = rootAdmission.root.fd;
         const closeFd = captureNativeFdClose(binding);
         const observationDisposers = windows ? undefined : new Map();

package/node_modules/@openclaw/fs-safe/dist/native-staged-file.d.ts

@@ -5,7 +5,7 @@ import type { FileIdentityStat } from "./file-identity.js";
 import { type NativeBinding } from "./native-binding.js";
 import type { PinnedWriteInput, PinnedWriteParams } from "./pinned-write-types.js";
 import type { PublishedFileReceipt, StagedFile, StagedFileCleanupReceipt, StagedFileReceipt } from "./staged-file-types.js";
-export type NativeStagingBinding = NativeBinding & Required<Pick<NativeBinding, "createStagedFile" | "stagedFileMatches" | "removeStagedFile">>;
+export type NativeStagingBinding = NativeBinding & Required<Pick<NativeBinding, "createStagedFile" | "stagedFileMatches" | "removeStagedFile" | "renameReplace" | "renameNoReplace">>;
 export declare function assertNativeStaging(binding: NativeBinding): asserts binding is NativeStagingBinding;
 type StagedPermissionPolicy = "private-creation" | "mode-only";
 type NativeStageOwner = Readonly<{

package/node_modules/@openclaw/fs-safe/dist/native-staged-file.js

@@ -67,6 +67,7 @@ import { classifyNativeRenameFailure } from "./native-rename-outcome.js";
 import { createStagedFileReceipt, stagedFailure } from "./staged-file-settlement.js";
 import { noReplaceUnavailable, rememberNoReplaceUnavailable } from "./native-noreplace.js";
 import { isFsSafeNativeRequired } from "./native-config.js";
+import { restoreCopyMetadata } from "./copy-metadata.js";
 export function assertNativeStaging(binding) {
     if ([
         binding.closeOwnedFd,
@@ -299,6 +300,8 @@ class NativeStagedFile {
             } : this.#assertBeforeMutation;
             if (!copied)
                 await writePinnedInput(fd, input, maxBytes, assertBeforeMutation);
+            if (input.kind === "file")
+                restoreCopyMetadata(fd, input.metadata);
             if (this.#verifyMode)
                 this.#assertStagePermissions(fd);
             if (this.#owner.sync !== false) {

package/node_modules/@openclaw/fs-safe/dist/native.d.ts

@@ -1,4 +1,4 @@
-import { type NativeBinding } from "./native-binding.js";
+import { type NativeBinding, type CapableNativeBinding } from "./native-binding.js";
 export type { NativeBinding } from "./native-binding.js";
 export declare function __loadBundledNativeForTest(): NativeBinding;
 export declare function __nativeLoaderDetectorsForTest(): {
@@ -7,7 +7,9 @@ export declare function __nativeLoaderDetectorsForTest(): {
     elfInterpreter: boolean | undefined;
 };
 export declare function __nativeTargetForTest(platform: NodeJS.Platform, arch: string, musl?: boolean): string | undefined;
-export declare function getNativeBinding(): NativeBinding | undefined;
-export declare function requireNativeBinding(): NativeBinding;
+export declare function selectNativeBinding<K extends keyof NativeBinding>(native: NativeBinding | undefined, ...capabilities: K[]): CapableNativeBinding<K> | undefined;
+export declare function assertNativeCapabilities<K extends keyof NativeBinding>(native: NativeBinding, ...capabilities: K[]): asserts native is CapableNativeBinding<K>;
+export declare function getNativeBinding<K extends keyof NativeBinding = never>(...capabilities: K[]): CapableNativeBinding<K> | undefined;
+export declare function requireNativeBinding<K extends keyof NativeBinding = never>(...capabilities: K[]): CapableNativeBinding<K>;
 export declare function __setNativeLoaderForTest(loader: () => NativeBinding): void;
 export declare function __resetNativeLoaderForTest(): void;

package/node_modules/@openclaw/fs-safe/dist/native.js

@@ -127,12 +127,14 @@ function isMusl() {
     return false;
 }
 function targetFor(platform, arch, musl) {
-    if (platform === "win32" && arch === "x64")
-        return "win32-x64-msvc";
+    if (platform === "win32" && (arch === "x64" || arch === "arm64"))
+        return `win32-${arch}-msvc`;
     if (platform === "darwin" && arch === "x64")
         return "darwin-x64";
     if (platform === "darwin" && arch === "arm64")
         return "darwin-arm64";
+    if (platform === "freebsd" && (arch === "x64" || arch === "arm64"))
+        return `freebsd-${arch}`;
     if (platform === "linux" && (arch === "x64" || arch === "arm64")) {
         return `linux-${arch}-${musl ? "musl" : "gnu"}`;
     }
@@ -166,7 +168,24 @@ export function __nativeLoaderDetectorsForTest() {
 export function __nativeTargetForTest(platform, arch, musl = false) {
     return targetFor(platform, arch, musl);
 }
-export function getNativeBinding() {
+export function selectNativeBinding(native, ...capabilities) {
+    if (!native)
+        return undefined;
+    const missing = capabilities.filter((name) => typeof native[name] !== "function");
+    if (missing.length === 0)
+        return native;
+    if (getFsSafeNativeConfig().mode === "require") {
+        throw new FsSafeError("helper-unavailable", `native fs-safe capabilities unavailable: ${missing.join(", ")}`);
+    }
+    return undefined;
+}
+export function assertNativeCapabilities(native, ...capabilities) {
+    const missing = capabilities.filter((name) => typeof native[name] !== "function");
+    if (missing.length) {
+        throw new FsSafeError("helper-unavailable", `native fs-safe capabilities unavailable: ${missing.join(", ")}`);
+    }
+}
+export function getNativeBinding(...capabilities) {
     const { mode } = getFsSafeNativeConfig();
     if (mode === "off")
         return undefined;
@@ -182,7 +201,7 @@ export function getNativeBinding() {
         }
     }
     if (binding)
-        return binding;
+        return selectNativeBinding(binding, ...capabilities);
     if (mode === "require") {
         throw new FsSafeError("helper-unavailable", "native fs-safe helper is unavailable", {
             cause: loadError,
@@ -190,8 +209,8 @@ export function getNativeBinding() {
     }
     return undefined;
 }
-export function requireNativeBinding() {
-    const native = getNativeBinding();
+export function requireNativeBinding(...capabilities) {
+    const native = getNativeBinding(...capabilities);
     if (!native) {
         throw new FsSafeError("helper-unavailable", "native fs-safe helper is unavailable", {
             cause: loadError,

package/node_modules/@openclaw/fs-safe/dist/opened-realpath.js

@@ -26,7 +26,15 @@ export async function resolveOpenedFileRealPathForFd(fd, handleStat, ioPath) {
         : [];
     for (const fdPath of fdCandidates) {
         try {
-            const fdRealPath = realpathSync.native(fdPath);
+            // Linux procfs already reports the descriptor's physical pathname. Keep
+            // the fresh identity check without walking that canonical path again.
+            const fdLink = fdPath.startsWith("/proc/") ? fsSync.readlinkSync(fdPath) : undefined;
+            // The deletion suffix can also name a live entry or a symlink. Preserve
+            // canonicalization for that ambiguous spelling, including literal names.
+            const fdRealPath = fdLink !== undefined && !fdLink.endsWith(" (deleted)")
+                ? fdLink : realpathSync.native(fdPath);
+            if (!path.isAbsolute(fdRealPath))
+                continue;
             const fdRealStat = statOptions ? fsSync.statSync(fdRealPath, statOptions) : fsSync.statSync(fdRealPath);
             if (sameFileIdentity(handleStat, fdRealStat)) {
                 return { realPath: fdRealPath, stat: fdRealStat };

package/node_modules/@openclaw/fs-safe/dist/overwrite-file-handle.js

@@ -1,3 +1,4 @@
+import fs from "node:fs";
 import { FsSafeError } from "./errors.js";
 import { assertSynchronousCallbackResult } from "./mutation-authority.js";
 import { readFileWindowFully } from "./positional-read.js";
@@ -10,7 +11,9 @@ export async function overwriteFileHandle(handle, data, options = {}) {
     const beforeWrite = options.beforeWrite;
     const payload = data.subarray(0, data.byteLength);
     const payloadBytes = payload.byteLength;
-    const stat = await handle.stat();
+    const fd = handle.fd;
+    // Keep FileHandle's closed-handle error while avoiding a metadata I/O hop.
+    const stat = fd < 0 ? await handle.stat() : fs.fstatSync(fd);
     if (!stat.isFile()) {
         throw new FsSafeError("not-file", "overwrite handle must be a regular file");
     }

package/node_modules/@openclaw/fs-safe/dist/permissions-public.d.ts

@@ -3,3 +3,4 @@ export type { PermissionCommandFailure } from "./permission-exec.js";
 export { createPrivateDirectory, type CreatePrivateDirectoryOptions, } from "./private-directory.js";
 export { readOwnerAndDacl, type OwnerAndDaclResult, type WindowsAccessControlEntry, type WindowsAceFlags, } from "./owner-dacl.js";
 export { readOwnerAndDaclBatch } from "./owner-dacl-batch.js";
+export { inspectDarwinAcl, type DarwinAclInspection } from "./darwin-acl.js";

package/node_modules/@openclaw/fs-safe/dist/permissions-public.js

@@ -2,3 +2,4 @@ export { formatOctal, formatPermissionDetail, formatPermissionRemediation, inspe
 export { createPrivateDirectory, } from "./private-directory.js";
 export { readOwnerAndDacl, } from "./owner-dacl.js";
 export { readOwnerAndDaclBatch } from "./owner-dacl-batch.js";
+export { inspectDarwinAcl } from "./darwin-acl.js";

package/node_modules/@openclaw/fs-safe/dist/permissions-windows.js

@@ -40,30 +40,25 @@ const normalize = (value) => normalizeLowercaseStringOrEmpty(value);
 const defaultWindowsUserInfo = () => os.userInfo();
 const defaultPermissionExec = executePermissionCommand;
 function inspectWindowsPermissionsNative(targetPath, unverified) {
-    const native = getNativeBinding();
+    const native = getNativeBinding("readOwnerAndDacl");
     if (!native)
         return undefined;
-    try {
-        const facts = native.readOwnerAndDacl(targetPath);
-        if (facts.fallbackRequired)
-            return undefined;
-        return {
-            ...unverified,
-            source: "windows-acl",
-            worldWritable: facts.worldWritable,
-            groupWritable: facts.groupWritable,
-            worldReadable: facts.worldReadable,
-            groupReadable: facts.groupReadable,
-            ownerSid: facts.ownerSid,
-            ownerTrusted: facts.ownerClass !== "foreign",
-            aclSummary: `native owner=${facts.ownerClass} world=` +
-                `${facts.worldReadable ? "r" : "-"}${facts.worldWritable ? "w" : "-"} ` +
-                `group=${facts.groupReadable ? "r" : "-"}${facts.groupWritable ? "w" : "-"}`,
-        };
-    }
-    catch {
+    const facts = native.readOwnerAndDacl(targetPath);
+    if (facts.fallbackRequired)
         return undefined;
-    }
+    return {
+        ...unverified,
+        source: "windows-acl",
+        worldWritable: facts.worldWritable,
+        groupWritable: facts.groupWritable,
+        worldReadable: facts.worldReadable,
+        groupReadable: facts.groupReadable,
+        ownerSid: facts.ownerSid,
+        ownerTrusted: facts.ownerClass !== "foreign",
+        aclSummary: `native owner=${facts.ownerClass} world=` +
+            `${facts.worldReadable ? "r" : "-"}${facts.worldWritable ? "w" : "-"} ` +
+            `group=${facts.groupReadable ? "r" : "-"}${facts.groupWritable ? "w" : "-"}`,
+    };
 }
 export async function inspectWindowsPermissions(targetPath, unverified, opts) {
     if (hasWindowsPathAlias(targetPath, "filesystem", "win32")) {
@@ -263,32 +258,26 @@ export async function inspectWindowsAcl(targetPath, opts) {
     }
     let owner;
     if (process.platform === "win32" && opts?.env === undefined && opts?.exec === undefined) {
-        try {
-            const native = getNativeBinding();
-            const stat = native && await safeStat(targetPath);
-            // Keep the named-query behavior for leaf links; the native reader follows them.
-            const facts = stat?.ok && !stat.isSymlink ? native?.readOwnerAndDacl(targetPath) : undefined;
-            if (facts && !facts.fallbackRequired && facts.isLocal && facts.aceListComplete && facts.unsupportedAceTypes.length === 0 &&
-                facts.aces.every(ace => ace.flags.inherited && ace.mask !== 0)) {
-                // .NET normalizes explicit ACEs, but retains nonzero inherited ACEs in
-                // their original order without merging them. Other forms keep its query.
-                // Adapt descriptor facts only: the public summary owns its SID and rights
-                // classification, which differs from the native secure-read policy.
-                owner = {
-                    daclPresent: facts.daclPresent,
-                    currentUserSid: facts.currentUserSid,
-                    aces: facts.aces.map(ace => ({
-                        sid: ace.sid,
-                        mask: ace.mask,
-                        deny: ace.aceType === "deny",
-                        inheritOnly: ace.flags.inheritOnly,
-                    })),
-                };
-            }
-        }
-        catch {
-            // Preserve this inspector's structured fallback and command diagnostics
-            // when the optional helper or native descriptor query is unavailable.
+        const native = getNativeBinding("readOwnerAndDacl");
+        const stat = native && await safeStat(targetPath);
+        // Keep the named-query behavior for leaf links; the native reader follows them.
+        const facts = stat?.ok && !stat.isSymlink ? native?.readOwnerAndDacl(targetPath) : undefined;
+        if (facts && !facts.fallbackRequired && facts.isLocal && facts.aceListComplete && facts.unsupportedAceTypes.length === 0 &&
+            facts.aces.every(ace => ace.flags.inherited && ace.mask !== 0)) {
+            // .NET normalizes explicit ACEs, but retains nonzero inherited ACEs in
+            // their original order without merging them. Other forms keep its query.
+            // Adapt descriptor facts only: the public summary owns its SID and rights
+            // classification, which differs from the native secure-read policy.
+            owner = {
+                daclPresent: facts.daclPresent,
+                currentUserSid: facts.currentUserSid,
+                aces: facts.aces.map(ace => ({
+                    sid: ace.sid,
+                    mask: ace.mask,
+                    deny: ace.aceType === "deny",
+                    inheritOnly: ace.flags.inheritOnly,
+                })),
+            };
         }
     }
     owner ??= await inspectWindowsOwner({ targetPath, env: opts?.env, exec: opts?.exec ?? defaultPermissionExec });

package/node_modules/@openclaw/fs-safe/dist/pinned-write-input.js

@@ -29,6 +29,8 @@ function streamChunkBytes(chunk) {
     return snapshotByteView(chunk);
 }
 export async function writePinnedInput(target, input, maxBytes, assertBeforeMutation) {
+    if (input.kind === "link")
+        throw new FsSafeError("helper-failed", "link copying requires the link publication path");
     if (input.kind === "file") {
         await writeCopyFileToFd(typeof target === "number" ? target : target.fd, input, maxBytes, assertBeforeMutation);
         return;

package/node_modules/@openclaw/fs-safe/dist/pinned-write-staged.js

@@ -18,6 +18,7 @@ import { cleanupPinnedFilePath } from "./file-cleanup.js";
 import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
 import { createStagedFileReceipt, settleStagedFile } from "./staged-file-settlement.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
+import { restoreCopyMetadata } from "./copy-metadata.js";
 export async function runPinnedStagedWrite(params, parentPath, parentGuard) {
     const verifyPosixMode = process.platform !== "win32" &&
         (params.verifyPosixMode === true || params.private === true);
@@ -66,6 +67,8 @@ export async function runPinnedStagedWrite(params, parentPath, parentGuard) {
         }
         const expectedTempStat = tempStat;
         await handle.chmod(params.mode);
+        if (params.input.kind === "file")
+            restoreCopyMetadata(handle.fd, params.input.metadata);
         if (verifyPosixMode) {
             assertPinnedWriteMode(handle.fd, params.mode, params.private);
             assertBeforeMutation = pinnedWriteModeAssertion(handle.fd, params.mode, params.assertBeforeMutation, params.private);

package/node_modules/@openclaw/fs-safe/dist/pinned-write-types.d.ts

@@ -1,4 +1,5 @@
 import type { CopyFileInput } from "./copy-file-input.js";
+import type { CopyLinkInput } from "./copy-link.js";
 import type { AnyAsyncDirectoryGuard } from "./directory-guard.js";
 import type { FileIdentityStat } from "./file-identity.js";
 import type { MutationDirectoryObservation } from "./pinned-mutation-observation.js";
@@ -16,7 +17,7 @@ export type PinnedWriteInput = {
     kind: "stream";
     stream: AsyncIterable<Uint8Array | string>;
     stageBeforePublish?: boolean;
-} | CopyFileInput;
+} | CopyFileInput | CopyLinkInput;
 export type RenameIdentityPolicy = "strict" | "verify-content-with-lock";
 export type PublishedWriteIdentity = Readonly<{
     dev: bigint;

package/node_modules/@openclaw/fs-safe/dist/pinned-write.js

@@ -12,8 +12,7 @@ import { syncDirectoryBestEffort } from "./directory-durability.js";
 import { sha256Hex } from "./file-identity.js";
 import { withAsyncDirectoryGuards } from "./guarded-mutation.js";
 import { mkdirPathComponentsWithGuards } from "./guarded-mkdir.js";
-import { runPinnedWriteNative } from "./native-pinned-write.js";
-import { getNativeBinding } from "./native.js";
+import { getPinnedWriteNativeBinding, runPinnedWriteNative } from "./native-pinned-write.js";
 import { validatePinnedRelativePath } from "./pinned-operation.js";
 import { cleanupPinnedFilePath } from "./file-cleanup.js";
 import { withSidecarLock } from "./sidecar-lock.js";
@@ -23,6 +22,7 @@ import { assertPinnedWriteMode, preparePinnedWriteMode } from "./pinned-write-mo
 import { runPinnedStagedWrite } from "./pinned-write-staged.js";
 import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
+import { copyLinkAtParent } from "./copy-link.js";
 function assertSafeBasename(basename) {
     if (!basename ||
         basename === "." ||
@@ -88,7 +88,7 @@ export async function runPinnedWriteHelper(params) {
     if (normalizedParams.onRenameIdentityMismatch === "verify-content") {
         return await runPinnedWriteFallback(normalizedParams);
     }
-    const native = getNativeBinding();
+    const native = getPinnedWriteNativeBinding(normalizedParams);
     if (native) {
         return await runPinnedWriteNative(native, normalizedParams, input => runPinnedWriteFallback({ ...normalizedParams, input }));
     }
@@ -225,6 +225,8 @@ async function runPinnedWriteFallback(params) {
         }));
         await assertAsyncDirectoryGuard(parentGuard);
     }
+    if (params.input.kind === "link")
+        return await copyLinkAtParent(params, params.input, parentGuard);
     if (params.overwrite === false && params.input.kind !== "file" && !params.input.stageBeforePublish) {
         const assertBeforeMutation = () => {
             assertFinalSymlinkRejected(targetPath, params.rejectFinalSymlink);

package/node_modules/@openclaw/fs-safe/dist/pipe.d.ts

@@ -0,0 +1,9 @@
+import { type OwnedFileDescriptorSync } from "./create-owned-file.js";
+export type OwnedPipeSync = {
+    readonly reader: OwnedFileDescriptorSync;
+    readonly writer: OwnedFileDescriptorSync;
+    /** True when close-on-exec was set atomically at creation. */
+    readonly atomicCloseOnExec: boolean;
+};
+/** Creates a POSIX anonymous pipe with two native-owned, close-on-exec ends. */
+export declare function createPipe(): OwnedPipeSync;

package/node_modules/@openclaw/fs-safe/dist/pipe.js

@@ -0,0 +1,26 @@
+import { ownFileDescriptorSync } from "./create-owned-file.js";
+import { FsSafeError } from "./errors.js";
+import { captureNativeFdClose } from "./native-binding.js";
+import { requireNativeBinding } from "./native.js";
+/** Creates a POSIX anonymous pipe with two native-owned, close-on-exec ends. */
+export function createPipe() {
+    if (!["linux", "darwin", "freebsd"].includes(process.platform)) {
+        throw new FsSafeError("unsupported-platform", "anonymous pipes require Linux, Darwin, or FreeBSD");
+    }
+    const native = requireNativeBinding();
+    if (!native.createPipe) {
+        throw new FsSafeError("helper-unavailable", "native anonymous pipes are unavailable");
+    }
+    const close = captureNativeFdClose(native);
+    try {
+        const { reader, writer, atomicCloseOnExec } = native.createPipe();
+        return Object.freeze({
+            reader: ownFileDescriptorSync(reader, close),
+            writer: ownFileDescriptorSync(writer, close),
+            atomicCloseOnExec,
+        });
+    }
+    catch (cause) {
+        throw new FsSafeError("helper-failed", "anonymous pipe creation failed", { cause });
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/private-producer-handoff.js

@@ -2,6 +2,7 @@ import fsSync, {} from "node:fs";
 import fs, {} from "node:fs/promises";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentityForCleanup } from "./file-identity.js";
+import { isHardlinkFallbackError } from "./hardlink-fallback.js";
 import { assertSynchronousCallbackResult } from "./mutation-authority.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { errorCauseOptions } from "./root-errors.js";
@@ -39,11 +40,7 @@ export function normalizeLinkError(error) {
     if (code === "EEXIST") {
         return new FsSafeError("already-exists", "isolated producer sibling already exists", errorCauseOptions(error));
     }
-    if (code === "EXDEV" ||
-        code === "ENOSYS" ||
-        code === "ENOTSUP" ||
-        code === "EOPNOTSUPP" ||
-        code === "EPERM") {
+    if (isHardlinkFallbackError(error)) {
         return new FsSafeError("helper-unavailable", "atomic isolated producer handoff is unavailable", errorCauseOptions(error));
     }
     return error;