@openclaw/openshell-sandbox 2026.10.6 → 2026.10.7

package/node_modules/@openclaw/fs-safe/dist/native-pinned-write.js

@@ -56,12 +56,27 @@ import { runPinnedWriteWindows } from "./native-pinned-write-windows.js";
 import { capturePolicyAwareNativeParent } from "./native-policy-parent.js";
 import { openNativeParentAdmission, openNativeRootAdmission } from "./native-parent-admission.js";
 import { assertNativeStaging, writeNativeStage } from "./native-staged-file.js";
+import { assertNativeCapabilities, getNativeBinding } from "./native.js";
 import { captureNativeFdClose } from "./native-binding.js";
 import { cachedNoReplaceUnavailable } from "./native-noreplace.js";
 import { isFsSafeNativeRequired } from "./native-config.js";
+import { copyLinkAtParent } from "./copy-link.js";
+const writeCapabilities = ["openBeneath", "mkdirBeneath", "renameNoReplace", "renameReplace"];
+const posixWriteCapabilities = [...writeCapabilities, "createStagedFile", "stagedFileMatches", "removeStagedFile"];
+function pinnedWriteCapabilities(params) {
+    const windows = process.platform === "win32";
+    const capabilities = windows ? [...writeCapabilities, "fstatIdentity"] : posixWriteCapabilities;
+    const nativeCopy = params.input.kind === "file" && !params.private &&
+        (windows || !params.verifyPosixMode);
+    return nativeCopy ? [...capabilities, "copyFileExclusive"] : capabilities;
+}
+export function getPinnedWriteNativeBinding(params) {
+    return getNativeBinding(...pinnedWriteCapabilities(params));
+}
 export async function runPinnedWriteNative(binding, params, fallback) {
     const env_1 = { stack: [], error: void 0, hasError: false };
     try {
+        assertNativeCapabilities(binding, ...pinnedWriteCapabilities(params));
         const closeFd = captureNativeFdClose(binding);
         const windows = process.platform === "win32";
         if (!windows) {
@@ -112,6 +127,9 @@ export async function runPinnedWriteNative(binding, params, fallback) {
                 parentPathStat = admitted.guard.stat;
             }
             const verificationGuard = { dir: parentPath, realPath: parentPath, stat: parentPathStat };
+            if (params.input.kind === "link") {
+                return await copyLinkAtParent(params, params.input, verificationGuard, { binding, fd: parentFd });
+            }
             if (params.overwrite === false) {
                 try {
                     fsSync.lstatSync(path.join(parentPath, params.basename));

package/node_modules/@openclaw/fs-safe/dist/native-policy-parent.d.ts

@@ -1,6 +1,6 @@
 import { type BigIntStats } from "node:fs";
 import { type AsyncDirectoryGuard } from "./directory-guard.js";
-import type { NativeBinding } from "./native.js";
+import { type NativeBinding } from "./native.js";
 import type { NativeRootAdmission } from "./native-parent-admission.js";
 import type { PinnedWriteParams } from "./pinned-write-types.js";
 import { describeStagedDirectory, type PolicyStagedDirectory } from "./staged-directory.js";

package/node_modules/@openclaw/fs-safe/dist/native-policy-parent.js

@@ -54,6 +54,7 @@ import fsSync, {} from "node:fs";
 import path from "node:path";
 import { inspectDirectoryIdentity, inspectDirectoryIdentitySync, } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
+import { assertNativeCapabilities } from "./native.js";
 import { captureNativeFdClose } from "./native-binding.js";
 import { NativePolicyDirectoryMismatch } from "./native-policy-directory-observation.js";
 import { assertWindowsPolicyParentCurrent, closeWindowsPolicyParentAfterFailure, openWindowsPolicyParent, windowsParentObservation, } from "./native-policy-parent-windows.js";
@@ -76,6 +77,7 @@ function mkdirPosixPolicyChild(binding, parentFd, basename) {
         if (typeof created === "boolean")
             return created;
     }
+    assertNativeCapabilities(binding, "mkdirBeneath");
     binding.mkdirBeneath(parentFd, basename, 0o777);
     return false;
 }
@@ -122,6 +124,7 @@ function tryDescribePolicyPosixParent(binding, fd, pathname) {
 export async function capturePolicyAwareNativeParent(binding, params, rootAdmission, windows, directoryFlags, fuseChildCreation = false) {
     const env_1 = { stack: [], error: void 0, hasError: false };
     try {
+        assertNativeCapabilities(binding, "openBeneath");
         const rootFd = rootAdmission.root.fd;
         const closeFd = captureNativeFdClose(binding);
         const observationDisposers = windows ? undefined : new Map();

package/node_modules/@openclaw/fs-safe/dist/native-staged-file.d.ts

@@ -5,7 +5,7 @@ import type { FileIdentityStat } from "./file-identity.js";
 import { type NativeBinding } from "./native-binding.js";
 import type { PinnedWriteInput, PinnedWriteParams } from "./pinned-write-types.js";
 import type { PublishedFileReceipt, StagedFile, StagedFileCleanupReceipt, StagedFileReceipt } from "./staged-file-types.js";
-export type NativeStagingBinding = NativeBinding & Required<Pick<NativeBinding, "createStagedFile" | "stagedFileMatches" | "removeStagedFile">>;
+export type NativeStagingBinding = NativeBinding & Required<Pick<NativeBinding, "createStagedFile" | "stagedFileMatches" | "removeStagedFile" | "renameReplace" | "renameNoReplace">>;
 export declare function assertNativeStaging(binding: NativeBinding): asserts binding is NativeStagingBinding;
 type StagedPermissionPolicy = "private-creation" | "mode-only";
 type NativeStageOwner = Readonly<{

package/node_modules/@openclaw/fs-safe/dist/native-staged-file.js

@@ -67,6 +67,7 @@ import { classifyNativeRenameFailure } from "./native-rename-outcome.js";
 import { createStagedFileReceipt, stagedFailure } from "./staged-file-settlement.js";
 import { noReplaceUnavailable, rememberNoReplaceUnavailable } from "./native-noreplace.js";
 import { isFsSafeNativeRequired } from "./native-config.js";
+import { restoreCopyMetadata } from "./copy-metadata.js";
 export function assertNativeStaging(binding) {
     if ([
         binding.closeOwnedFd,
@@ -299,6 +300,8 @@ class NativeStagedFile {
             } : this.#assertBeforeMutation;
             if (!copied)
                 await writePinnedInput(fd, input, maxBytes, assertBeforeMutation);
+            if (input.kind === "file")
+                restoreCopyMetadata(fd, input.metadata);
             if (this.#verifyMode)
                 this.#assertStagePermissions(fd);
             if (this.#owner.sync !== false) {

package/node_modules/@openclaw/fs-safe/dist/native.d.ts

@@ -1,4 +1,4 @@
-import { type NativeBinding } from "./native-binding.js";
+import { type NativeBinding, type CapableNativeBinding } from "./native-binding.js";
 export type { NativeBinding } from "./native-binding.js";
 export declare function __loadBundledNativeForTest(): NativeBinding;
 export declare function __nativeLoaderDetectorsForTest(): {
@@ -7,7 +7,9 @@ export declare function __nativeLoaderDetectorsForTest(): {
     elfInterpreter: boolean | undefined;
 };
 export declare function __nativeTargetForTest(platform: NodeJS.Platform, arch: string, musl?: boolean): string | undefined;
-export declare function getNativeBinding(): NativeBinding | undefined;
-export declare function requireNativeBinding(): NativeBinding;
+export declare function selectNativeBinding<K extends keyof NativeBinding>(native: NativeBinding | undefined, ...capabilities: K[]): CapableNativeBinding<K> | undefined;
+export declare function assertNativeCapabilities<K extends keyof NativeBinding>(native: NativeBinding, ...capabilities: K[]): asserts native is CapableNativeBinding<K>;
+export declare function getNativeBinding<K extends keyof NativeBinding = never>(...capabilities: K[]): CapableNativeBinding<K> | undefined;
+export declare function requireNativeBinding<K extends keyof NativeBinding = never>(...capabilities: K[]): CapableNativeBinding<K>;
 export declare function __setNativeLoaderForTest(loader: () => NativeBinding): void;
 export declare function __resetNativeLoaderForTest(): void;

package/node_modules/@openclaw/fs-safe/dist/native.js

@@ -127,12 +127,14 @@ function isMusl() {
     return false;
 }
 function targetFor(platform, arch, musl) {
-    if (platform === "win32" && arch === "x64")
-        return "win32-x64-msvc";
+    if (platform === "win32" && (arch === "x64" || arch === "arm64"))
+        return `win32-${arch}-msvc`;
     if (platform === "darwin" && arch === "x64")
         return "darwin-x64";
     if (platform === "darwin" && arch === "arm64")
         return "darwin-arm64";
+    if (platform === "freebsd" && (arch === "x64" || arch === "arm64"))
+        return `freebsd-${arch}`;
     if (platform === "linux" && (arch === "x64" || arch === "arm64")) {
         return `linux-${arch}-${musl ? "musl" : "gnu"}`;
     }
@@ -166,7 +168,24 @@ export function __nativeLoaderDetectorsForTest() {
 export function __nativeTargetForTest(platform, arch, musl = false) {
     return targetFor(platform, arch, musl);
 }
-export function getNativeBinding() {
+export function selectNativeBinding(native, ...capabilities) {
+    if (!native)
+        return undefined;
+    const missing = capabilities.filter((name) => typeof native[name] !== "function");
+    if (missing.length === 0)
+        return native;
+    if (getFsSafeNativeConfig().mode === "require") {
+        throw new FsSafeError("helper-unavailable", `native fs-safe capabilities unavailable: ${missing.join(", ")}`);
+    }
+    return undefined;
+}
+export function assertNativeCapabilities(native, ...capabilities) {
+    const missing = capabilities.filter((name) => typeof native[name] !== "function");
+    if (missing.length) {
+        throw new FsSafeError("helper-unavailable", `native fs-safe capabilities unavailable: ${missing.join(", ")}`);
+    }
+}
+export function getNativeBinding(...capabilities) {
     const { mode } = getFsSafeNativeConfig();
     if (mode === "off")
         return undefined;
@@ -182,7 +201,7 @@ export function getNativeBinding() {
         }
     }
     if (binding)
-        return binding;
+        return selectNativeBinding(binding, ...capabilities);
     if (mode === "require") {
         throw new FsSafeError("helper-unavailable", "native fs-safe helper is unavailable", {
             cause: loadError,
@@ -190,8 +209,8 @@ export function getNativeBinding() {
     }
     return undefined;
 }
-export function requireNativeBinding() {
-    const native = getNativeBinding();
+export function requireNativeBinding(...capabilities) {
+    const native = getNativeBinding(...capabilities);
     if (!native) {
         throw new FsSafeError("helper-unavailable", "native fs-safe helper is unavailable", {
             cause: loadError,

package/node_modules/@openclaw/fs-safe/dist/opened-realpath.js

@@ -26,7 +26,15 @@ export async function resolveOpenedFileRealPathForFd(fd, handleStat, ioPath) {
         : [];
     for (const fdPath of fdCandidates) {
         try {
-            const fdRealPath = realpathSync.native(fdPath);
+            // Linux procfs already reports the descriptor's physical pathname. Keep
+            // the fresh identity check without walking that canonical path again.
+            const fdLink = fdPath.startsWith("/proc/") ? fsSync.readlinkSync(fdPath) : undefined;
+            // The deletion suffix can also name a live entry or a symlink. Preserve
+            // canonicalization for that ambiguous spelling, including literal names.
+            const fdRealPath = fdLink !== undefined && !fdLink.endsWith(" (deleted)")
+                ? fdLink : realpathSync.native(fdPath);
+            if (!path.isAbsolute(fdRealPath))
+                continue;
             const fdRealStat = statOptions ? fsSync.statSync(fdRealPath, statOptions) : fsSync.statSync(fdRealPath);
             if (sameFileIdentity(handleStat, fdRealStat)) {
                 return { realPath: fdRealPath, stat: fdRealStat };

package/node_modules/@openclaw/fs-safe/dist/overwrite-file-handle.js

@@ -1,3 +1,4 @@
+import fs from "node:fs";
 import { FsSafeError } from "./errors.js";
 import { assertSynchronousCallbackResult } from "./mutation-authority.js";
 import { readFileWindowFully } from "./positional-read.js";
@@ -10,7 +11,9 @@ export async function overwriteFileHandle(handle, data, options = {}) {
     const beforeWrite = options.beforeWrite;
     const payload = data.subarray(0, data.byteLength);
     const payloadBytes = payload.byteLength;
-    const stat = await handle.stat();
+    const fd = handle.fd;
+    // Keep FileHandle's closed-handle error while avoiding a metadata I/O hop.
+    const stat = fd < 0 ? await handle.stat() : fs.fstatSync(fd);
     if (!stat.isFile()) {
         throw new FsSafeError("not-file", "overwrite handle must be a regular file");
     }

package/node_modules/@openclaw/fs-safe/dist/permissions-public.d.ts

@@ -3,3 +3,4 @@ export type { PermissionCommandFailure } from "./permission-exec.js";
 export { createPrivateDirectory, type CreatePrivateDirectoryOptions, } from "./private-directory.js";
 export { readOwnerAndDacl, type OwnerAndDaclResult, type WindowsAccessControlEntry, type WindowsAceFlags, } from "./owner-dacl.js";
 export { readOwnerAndDaclBatch } from "./owner-dacl-batch.js";
+export { inspectDarwinAcl, type DarwinAclInspection } from "./darwin-acl.js";

package/node_modules/@openclaw/fs-safe/dist/permissions-public.js

@@ -2,3 +2,4 @@ export { formatOctal, formatPermissionDetail, formatPermissionRemediation, inspe
 export { createPrivateDirectory, } from "./private-directory.js";
 export { readOwnerAndDacl, } from "./owner-dacl.js";
 export { readOwnerAndDaclBatch } from "./owner-dacl-batch.js";
+export { inspectDarwinAcl } from "./darwin-acl.js";

package/node_modules/@openclaw/fs-safe/dist/permissions-windows.js

@@ -40,30 +40,25 @@ const normalize = (value) => normalizeLowercaseStringOrEmpty(value);
 const defaultWindowsUserInfo = () => os.userInfo();
 const defaultPermissionExec = executePermissionCommand;
 function inspectWindowsPermissionsNative(targetPath, unverified) {
-    const native = getNativeBinding();
+    const native = getNativeBinding("readOwnerAndDacl");
     if (!native)
         return undefined;
-    try {
-        const facts = native.readOwnerAndDacl(targetPath);
-        if (facts.fallbackRequired)
-            return undefined;
-        return {
-            ...unverified,
-            source: "windows-acl",
-            worldWritable: facts.worldWritable,
-            groupWritable: facts.groupWritable,
-            worldReadable: facts.worldReadable,
-            groupReadable: facts.groupReadable,
-            ownerSid: facts.ownerSid,
-            ownerTrusted: facts.ownerClass !== "foreign",
-            aclSummary: `native owner=${facts.ownerClass} world=` +
-                `${facts.worldReadable ? "r" : "-"}${facts.worldWritable ? "w" : "-"} ` +
-                `group=${facts.groupReadable ? "r" : "-"}${facts.groupWritable ? "w" : "-"}`,
-        };
-    }
-    catch {
+    const facts = native.readOwnerAndDacl(targetPath);
+    if (facts.fallbackRequired)
         return undefined;
-    }
+    return {
+        ...unverified,
+        source: "windows-acl",
+        worldWritable: facts.worldWritable,
+        groupWritable: facts.groupWritable,
+        worldReadable: facts.worldReadable,
+        groupReadable: facts.groupReadable,
+        ownerSid: facts.ownerSid,
+        ownerTrusted: facts.ownerClass !== "foreign",
+        aclSummary: `native owner=${facts.ownerClass} world=` +
+            `${facts.worldReadable ? "r" : "-"}${facts.worldWritable ? "w" : "-"} ` +
+            `group=${facts.groupReadable ? "r" : "-"}${facts.groupWritable ? "w" : "-"}`,
+    };
 }
 export async function inspectWindowsPermissions(targetPath, unverified, opts) {
     if (hasWindowsPathAlias(targetPath, "filesystem", "win32")) {
@@ -263,32 +258,26 @@ export async function inspectWindowsAcl(targetPath, opts) {
     }
     let owner;
     if (process.platform === "win32" && opts?.env === undefined && opts?.exec === undefined) {
-        try {
-            const native = getNativeBinding();
-            const stat = native && await safeStat(targetPath);
-            // Keep the named-query behavior for leaf links; the native reader follows them.
-            const facts = stat?.ok && !stat.isSymlink ? native?.readOwnerAndDacl(targetPath) : undefined;
-            if (facts && !facts.fallbackRequired && facts.isLocal && facts.aceListComplete && facts.unsupportedAceTypes.length === 0 &&
-                facts.aces.every(ace => ace.flags.inherited && ace.mask !== 0)) {
-                // .NET normalizes explicit ACEs, but retains nonzero inherited ACEs in
-                // their original order without merging them. Other forms keep its query.
-                // Adapt descriptor facts only: the public summary owns its SID and rights
-                // classification, which differs from the native secure-read policy.
-                owner = {
-                    daclPresent: facts.daclPresent,
-                    currentUserSid: facts.currentUserSid,
-                    aces: facts.aces.map(ace => ({
-                        sid: ace.sid,
-                        mask: ace.mask,
-                        deny: ace.aceType === "deny",
-                        inheritOnly: ace.flags.inheritOnly,
-                    })),
-                };
-            }
-        }
-        catch {
-            // Preserve this inspector's structured fallback and command diagnostics
-            // when the optional helper or native descriptor query is unavailable.
+        const native = getNativeBinding("readOwnerAndDacl");
+        const stat = native && await safeStat(targetPath);
+        // Keep the named-query behavior for leaf links; the native reader follows them.
+        const facts = stat?.ok && !stat.isSymlink ? native?.readOwnerAndDacl(targetPath) : undefined;
+        if (facts && !facts.fallbackRequired && facts.isLocal && facts.aceListComplete && facts.unsupportedAceTypes.length === 0 &&
+            facts.aces.every(ace => ace.flags.inherited && ace.mask !== 0)) {
+            // .NET normalizes explicit ACEs, but retains nonzero inherited ACEs in
+            // their original order without merging them. Other forms keep its query.
+            // Adapt descriptor facts only: the public summary owns its SID and rights
+            // classification, which differs from the native secure-read policy.
+            owner = {
+                daclPresent: facts.daclPresent,
+                currentUserSid: facts.currentUserSid,
+                aces: facts.aces.map(ace => ({
+                    sid: ace.sid,
+                    mask: ace.mask,
+                    deny: ace.aceType === "deny",
+                    inheritOnly: ace.flags.inheritOnly,
+                })),
+            };
         }
     }
     owner ??= await inspectWindowsOwner({ targetPath, env: opts?.env, exec: opts?.exec ?? defaultPermissionExec });

package/node_modules/@openclaw/fs-safe/dist/pinned-write-input.js

@@ -29,6 +29,8 @@ function streamChunkBytes(chunk) {
     return snapshotByteView(chunk);
 }
 export async function writePinnedInput(target, input, maxBytes, assertBeforeMutation) {
+    if (input.kind === "link")
+        throw new FsSafeError("helper-failed", "link copying requires the link publication path");
     if (input.kind === "file") {
         await writeCopyFileToFd(typeof target === "number" ? target : target.fd, input, maxBytes, assertBeforeMutation);
         return;

package/node_modules/@openclaw/fs-safe/dist/pinned-write-staged.js

@@ -18,6 +18,7 @@ import { cleanupPinnedFilePath } from "./file-cleanup.js";
 import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
 import { createStagedFileReceipt, settleStagedFile } from "./staged-file-settlement.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
+import { restoreCopyMetadata } from "./copy-metadata.js";
 export async function runPinnedStagedWrite(params, parentPath, parentGuard) {
     const verifyPosixMode = process.platform !== "win32" &&
         (params.verifyPosixMode === true || params.private === true);
@@ -66,6 +67,8 @@ export async function runPinnedStagedWrite(params, parentPath, parentGuard) {
         }
         const expectedTempStat = tempStat;
         await handle.chmod(params.mode);
+        if (params.input.kind === "file")
+            restoreCopyMetadata(handle.fd, params.input.metadata);
         if (verifyPosixMode) {
             assertPinnedWriteMode(handle.fd, params.mode, params.private);
             assertBeforeMutation = pinnedWriteModeAssertion(handle.fd, params.mode, params.assertBeforeMutation, params.private);

package/node_modules/@openclaw/fs-safe/dist/pinned-write-types.d.ts

@@ -1,4 +1,5 @@
 import type { CopyFileInput } from "./copy-file-input.js";
+import type { CopyLinkInput } from "./copy-link.js";
 import type { AnyAsyncDirectoryGuard } from "./directory-guard.js";
 import type { FileIdentityStat } from "./file-identity.js";
 import type { MutationDirectoryObservation } from "./pinned-mutation-observation.js";
@@ -16,7 +17,7 @@ export type PinnedWriteInput = {
     kind: "stream";
     stream: AsyncIterable<Uint8Array | string>;
     stageBeforePublish?: boolean;
-} | CopyFileInput;
+} | CopyFileInput | CopyLinkInput;
 export type RenameIdentityPolicy = "strict" | "verify-content-with-lock";
 export type PublishedWriteIdentity = Readonly<{
     dev: bigint;

package/node_modules/@openclaw/fs-safe/dist/pinned-write.js

@@ -12,8 +12,7 @@ import { syncDirectoryBestEffort } from "./directory-durability.js";
 import { sha256Hex } from "./file-identity.js";
 import { withAsyncDirectoryGuards } from "./guarded-mutation.js";
 import { mkdirPathComponentsWithGuards } from "./guarded-mkdir.js";
-import { runPinnedWriteNative } from "./native-pinned-write.js";
-import { getNativeBinding } from "./native.js";
+import { getPinnedWriteNativeBinding, runPinnedWriteNative } from "./native-pinned-write.js";
 import { validatePinnedRelativePath } from "./pinned-operation.js";
 import { cleanupPinnedFilePath } from "./file-cleanup.js";
 import { withSidecarLock } from "./sidecar-lock.js";
@@ -23,6 +22,7 @@ import { assertPinnedWriteMode, preparePinnedWriteMode } from "./pinned-write-mo
 import { runPinnedStagedWrite } from "./pinned-write-staged.js";
 import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
+import { copyLinkAtParent } from "./copy-link.js";
 function assertSafeBasename(basename) {
     if (!basename ||
         basename === "." ||
@@ -88,7 +88,7 @@ export async function runPinnedWriteHelper(params) {
     if (normalizedParams.onRenameIdentityMismatch === "verify-content") {
         return await runPinnedWriteFallback(normalizedParams);
     }
-    const native = getNativeBinding();
+    const native = getPinnedWriteNativeBinding(normalizedParams);
     if (native) {
         return await runPinnedWriteNative(native, normalizedParams, input => runPinnedWriteFallback({ ...normalizedParams, input }));
     }
@@ -225,6 +225,8 @@ async function runPinnedWriteFallback(params) {
         }));
         await assertAsyncDirectoryGuard(parentGuard);
     }
+    if (params.input.kind === "link")
+        return await copyLinkAtParent(params, params.input, parentGuard);
     if (params.overwrite === false && params.input.kind !== "file" && !params.input.stageBeforePublish) {
         const assertBeforeMutation = () => {
             assertFinalSymlinkRejected(targetPath, params.rejectFinalSymlink);

package/node_modules/@openclaw/fs-safe/dist/pipe.d.ts

@@ -0,0 +1,9 @@
+import { type OwnedFileDescriptorSync } from "./create-owned-file.js";
+export type OwnedPipeSync = {
+    readonly reader: OwnedFileDescriptorSync;
+    readonly writer: OwnedFileDescriptorSync;
+    /** True when close-on-exec was set atomically at creation. */
+    readonly atomicCloseOnExec: boolean;
+};
+/** Creates a POSIX anonymous pipe with two native-owned, close-on-exec ends. */
+export declare function createPipe(): OwnedPipeSync;

package/node_modules/@openclaw/fs-safe/dist/pipe.js

@@ -0,0 +1,26 @@
+import { ownFileDescriptorSync } from "./create-owned-file.js";
+import { FsSafeError } from "./errors.js";
+import { captureNativeFdClose } from "./native-binding.js";
+import { requireNativeBinding } from "./native.js";
+/** Creates a POSIX anonymous pipe with two native-owned, close-on-exec ends. */
+export function createPipe() {
+    if (!["linux", "darwin", "freebsd"].includes(process.platform)) {
+        throw new FsSafeError("unsupported-platform", "anonymous pipes require Linux, Darwin, or FreeBSD");
+    }
+    const native = requireNativeBinding();
+    if (!native.createPipe) {
+        throw new FsSafeError("helper-unavailable", "native anonymous pipes are unavailable");
+    }
+    const close = captureNativeFdClose(native);
+    try {
+        const { reader, writer, atomicCloseOnExec } = native.createPipe();
+        return Object.freeze({
+            reader: ownFileDescriptorSync(reader, close),
+            writer: ownFileDescriptorSync(writer, close),
+            atomicCloseOnExec,
+        });
+    }
+    catch (cause) {
+        throw new FsSafeError("helper-failed", "anonymous pipe creation failed", { cause });
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/private-producer-handoff.js

@@ -2,6 +2,7 @@ import fsSync, {} from "node:fs";
 import fs, {} from "node:fs/promises";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentityForCleanup } from "./file-identity.js";
+import { isHardlinkFallbackError } from "./hardlink-fallback.js";
 import { assertSynchronousCallbackResult } from "./mutation-authority.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { errorCauseOptions } from "./root-errors.js";
@@ -39,11 +40,7 @@ export function normalizeLinkError(error) {
     if (code === "EEXIST") {
         return new FsSafeError("already-exists", "isolated producer sibling already exists", errorCauseOptions(error));
     }
-    if (code === "EXDEV" ||
-        code === "ENOSYS" ||
-        code === "ENOTSUP" ||
-        code === "EOPNOTSUPP" ||
-        code === "EPERM") {
+    if (isHardlinkFallbackError(error)) {
         return new FsSafeError("helper-unavailable", "atomic isolated producer handoff is unavailable", errorCauseOptions(error));
     }
     return error;

package/node_modules/@openclaw/fs-safe/dist/publish-copy-stage.js

@@ -2,7 +2,10 @@ import fs, {} from "node:fs";
 import path from "node:path";
 import { assertSyncDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
+import { assertExclusiveCreateLeaf } from "./exclusive-create.js";
 import { sameFileIdentityForCleanup } from "./file-identity.js";
+import { hasErrorCode } from "./file-cleanup.js";
+import { isHardlinkFallbackError } from "./hardlink-fallback.js";
 // Node has no portable no-replace rename. Publish the completed stage by link,
 // then remove its verified temporary name without yielding.
 export function publishCopyStage(params) {
@@ -27,7 +30,16 @@ export function publishCopyStage(params) {
         throw new FsSafeError("already-exists", "destination already exists");
     }
     params.onPublicationAttempt?.();
-    fs.linkSync(temporaryPath, targetPath);
+    let renamed = false;
+    try {
+        fs.linkSync(temporaryPath, targetPath);
+    }
+    catch (error) {
+        if (!isHardlinkFallbackError(error))
+            throw error;
+        publishThroughPlaceholder(params, assertCurrent);
+        renamed = true;
+    }
     let observerRejected = false;
     let observerError;
     try {
@@ -38,16 +50,29 @@ export function publishCopyStage(params) {
         observerError = error;
     }
     try {
-        const parent = fs.lstatSync(path.dirname(temporaryPath), { bigint: true });
-        const current = fs.lstatSync(temporaryPath, { bigint: true });
-        if (parent.isSymbolicLink() || !parent.isDirectory() ||
-            !sameFileIdentityForCleanup(parent, params.parentGuard.stat) ||
-            current.isSymbolicLink() || !current.isFile() ||
-            !sameFileIdentityForCleanup(current, identity)) {
-            throw new FsSafeError("path-mismatch", "published copy temporary name changed before cleanup");
+        if (renamed) {
+            assertSyncDirectoryGuard(params.parentGuard);
+            if (fs.lstatSync(temporaryPath, { throwIfNoEntry: false })) {
+                throw new FsSafeError("path-mismatch", "renamed copy stage still exists");
+            }
+            const target = fs.lstatSync(targetPath, { bigint: true });
+            if (!target.isFile() || target.isSymbolicLink() || target.nlink !== 1n ||
+                !sameFileIdentityForCleanup(target, identity)) {
+                throw new FsSafeError("path-mismatch", "renamed copy target changed after publication");
+            }
+        }
+        else {
+            const parent = fs.lstatSync(path.dirname(temporaryPath), { bigint: true });
+            const current = fs.lstatSync(temporaryPath, { bigint: true });
+            if (parent.isSymbolicLink() || !parent.isDirectory() ||
+                !sameFileIdentityForCleanup(parent, params.parentGuard.stat) ||
+                current.isSymbolicLink() || !current.isFile() ||
+                !sameFileIdentityForCleanup(current, identity)) {
+                throw new FsSafeError("path-mismatch", "published copy temporary name changed before cleanup");
+            }
+            // This removes the stage's name, never the published destination or source.
+            fs.unlinkSync(temporaryPath);
         }
-        // This removes the stage's name, never the published destination or source.
-        fs.unlinkSync(temporaryPath);
     }
     catch (error) {
         throw new FsSafeError("helper-failed", "published copy temporary cleanup failed", {
@@ -58,3 +83,60 @@ export function publishCopyStage(params) {
     if (observerRejected)
         throw observerError;
 }
+function isEmptyPlaceholder(current, identity) {
+    return current.isFile() && !current.isSymbolicLink() && current.nlink === 1n &&
+        current.size === 0n && sameFileIdentityForCleanup(current, identity);
+}
+function publishThroughPlaceholder(params, assertCurrent) {
+    const { targetPath, temporaryPath } = params;
+    // An empty placeholder can be observed before the completed stage atomically replaces it.
+    // The stage proved directory write access; a real permission denial still fails O_EXCL.
+    assertCurrent();
+    let fd;
+    try {
+        assertExclusiveCreateLeaf(targetPath);
+        fd = fs.openSync(targetPath, fs.constants.O_WRONLY | fs.constants.O_CREAT |
+            fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW ?? 0), 0o600);
+    }
+    catch (error) {
+        if (hasErrorCode(error, "EEXIST")) {
+            throw new FsSafeError("already-exists", "destination already exists", { cause: error });
+        }
+        throw error;
+    }
+    let placeholder;
+    try {
+        try {
+            placeholder = fs.fstatSync(fd, { bigint: true });
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        assertCurrent();
+        const current = fs.lstatSync(targetPath, { bigint: true, throwIfNoEntry: false });
+        if (!current || !isEmptyPlaceholder(current, placeholder)) {
+            throw new FsSafeError("path-mismatch", "exclusive copy placeholder changed before publication");
+        }
+        fs.renameSync(temporaryPath, targetPath);
+    }
+    catch (error) {
+        try {
+            assertSyncDirectoryGuard(params.parentGuard);
+            const current = fs.lstatSync(targetPath, { bigint: true, throwIfNoEntry: false });
+            if (current) {
+                if (!placeholder)
+                    throw new FsSafeError("path-mismatch", "copy placeholder identity unavailable for cleanup");
+                if (isEmptyPlaceholder(current, placeholder))
+                    fs.unlinkSync(targetPath);
+            }
+        }
+        catch (cleanupError) {
+            throw new FsSafeError("helper-failed", "unpublished copy placeholder cleanup failed", {
+                cause: new AggregateError([error, cleanupError], "publication and cleanup failed"),
+                details: { publication: "not-published", path: targetPath, cleanup: "failed",
+                    ...(placeholder ? { dev: placeholder.dev, ino: placeholder.ino } : {}) },
+            });
+        }
+        throw error;
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/publish-file.d.ts

@@ -2,6 +2,7 @@ import { type BigIntStats, type Stats } from "node:fs";
 import { type DirectoryReceipt, type DirectorySyncOutcome } from "./directory-durability.js";
 import { type FileIdentityStat } from "./file-identity.js";
 import { type PublishFileExclusiveSyncFailurePolicy } from "./publish-file-failure.js";
+export { isHardlinkFallbackError } from "./hardlink-fallback.js";
 export type PublishFileExclusiveStrategy = "link-or-copy" | "link-required" | "rename-noreplace";
 export type PublishFileExclusiveResult = {
     method: "hardlink" | "exclusive-copy" | "rename-noreplace";
@@ -10,7 +11,6 @@ export type PublishFileExclusiveResult = {
     identity: Stats;
     directorySync: DirectorySyncOutcome;
 };
-export declare function isHardlinkFallbackError(error: unknown): boolean;
 export declare function publishFileExclusive(params: {
     sourcePath: string;
     targetPath: string;