@openclaw/openshell-sandbox 2026.10.6 → 2026.10.8

package/node_modules/@openclaw/fs-safe/dist/publish-file.js

@@ -11,7 +11,7 @@ import { ownDirectoryReceipt } from "./directory-receipt.js";
 import { hashFileHandle } from "./file-hash.js";
 import { sameFileIdentity, sameFileIdentityForCleanup, } from "./file-identity.js";
 import { syncFileBestEffortSync } from "./file-sync.js";
-import { getNativeBinding, requireNativeBinding } from "./native.js";
+import { getNativeBinding, requireNativeBinding, selectNativeBinding } from "./native.js";
 import { captureNativeFdClose } from "./native-binding.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { directorySyncFailure, publicationFailure, rememberCreatedTarget, } from "./publish-file-failure.js";
@@ -19,11 +19,9 @@ import { admitStandalonePublicationPath, assertNoWindowsPathAlias } from "./wind
 import { getFsSafeTestHooks } from "./test-hooks.js";
 import { hasErrorCode } from "./file-cleanup.js";
 import { writeAllToFile } from "./write-file-handle.js";
-const HARDLINK_FALLBACK_CODES = new Set(["EPERM", "EXDEV", "ENOTSUP", "EOPNOTSUPP", "ENOSYS"]);
+import { isHardlinkFallbackError } from "./hardlink-fallback.js";
+export { isHardlinkFallbackError } from "./hardlink-fallback.js";
 const NATIVE_COPY_FALLBACK_CODES = new Set(["EINVAL", "ENOSYS", "ENOTSUP", "EOPNOTSUPP", "EPERM", "EXDEV"]);
-export function isHardlinkFallbackError(error) {
-    return HARDLINK_FALLBACK_CODES.has(error?.code ?? "");
-}
 function directoryOpenFlags() {
     return (fsSync.constants.O_RDONLY |
         (typeof fsSync.constants.O_DIRECTORY === "number" ? fsSync.constants.O_DIRECTORY : 0));
@@ -78,13 +76,16 @@ async function copyPinnedSource(params) {
     if (params.native && params.targetNativeParent) {
         const closeFd = captureNativeFdClose(params.native);
         for (const method of ["clone", "copy-file-range"]) {
+            const native = selectNativeBinding(params.native, method === "clone" ? "cloneFileExclusive" : "copyFileRangeExclusive");
+            if (!native)
+                continue;
             let nativeFd;
             try {
                 if (method === "clone") {
-                    nativeFd = params.native.cloneFileExclusive(params.source.fd, params.targetNativeParent.handle.fd, params.targetNativeParent.basename);
+                    nativeFd = native.cloneFileExclusive(params.source.fd, params.targetNativeParent.handle.fd, params.targetNativeParent.basename);
                 }
                 else {
-                    const copied = await params.native.copyFileRangeExclusive(params.source.fd, params.targetNativeParent.handle.fd, params.targetNativeParent.basename);
+                    const copied = await native.copyFileRangeExclusive(params.source.fd, params.targetNativeParent.handle.fd, params.targetNativeParent.basename);
                     if (copied.errorCode) {
                         throw Object.assign(new Error(copied.errorMessage ?? "native copy failed"), {
                             code: copied.errorCode,
@@ -263,14 +264,14 @@ export async function publishFileExclusive(params) {
         await parent.assertCurrent();
         assertSourceCurrent();
         const native = strategy === "rename-noreplace"
-            ? requireNativeBinding()
-            : getNativeBinding();
+            ? requireNativeBinding("renameNoReplace")
+            : getNativeBinding("linkBeneath");
         if (native) {
             sourceNativeParent = await openNativeParent(sourcePath);
             targetNativeParent = await openNativeParent(targetPath);
         }
         if (strategy === "rename-noreplace") {
-            const binding = requireNativeBinding();
+            const binding = requireNativeBinding("renameNoReplace");
             try {
                 const fallback = nativeMoveNoReplace(binding, [
                     sourceNativeParent.handle.fd, sourceNativeParent.basename,
@@ -313,7 +314,7 @@ export async function publishFileExclusive(params) {
             return await finishPublication("rename-noreplace", source, sourceExactIdentity);
         }
         try {
-            if (native) {
+            if (native?.linkBeneath) {
                 native.linkBeneath(sourceNativeParent.handle.fd, sourceNativeParent.basename, targetNativeParent.handle.fd, targetNativeParent.basename);
             }
             else {

package/node_modules/@openclaw/fs-safe/dist/root-copy.d.ts

@@ -0,0 +1,18 @@
+import { type BigIntStats } from "node:fs";
+import type { OpenResult } from "./root-impl.js";
+import type { RootContext } from "./root-context.js";
+import type { RootCopyOptions, RootCopySource, HardlinkPolicy } from "./root-options.js";
+import { onCopyPublication, onCopySourceAdmission, type CopyPublicationOptions } from "./copy-publication.js";
+type RootCopyParams = RootCopyOptions & {
+    source: RootCopySource;
+    relativePath: string;
+    verifyPublished?: CopyPublicationOptions[typeof onCopyPublication];
+    admitSource?: CopyPublicationOptions[typeof onCopySourceAdmission];
+};
+export declare function copyFileInRoot(root: RootContext, params: RootCopyParams, openVerifiedLocalFile: (path: string, options: {
+    hardlinks?: HardlinkPolicy;
+}) => Promise<{
+    opened: OpenResult;
+    identity: BigIntStats;
+}>): Promise<void>;
+export {};

package/node_modules/@openclaw/fs-safe/dist/root-copy.js

@@ -0,0 +1,128 @@
+import fsSync, {} from "node:fs";
+import { assertCopySourceCurrent, resolveFileCopyCloneMode } from "./copy-file-input.js";
+import { resolveCopyCloneMode } from "./copy-policy.js";
+import { captureCopyMetadata } from "./copy-metadata.js";
+import { admitCopyLink, assertCopyLinkAvailable } from "./copy-link.js";
+import { assertAbsolutePathInput } from "./absolute-path.js";
+import { assertNoNulPathInput } from "./path.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
+import { inspectFileIdentity } from "./strict-file-identity.js";
+import { MutationAuthorityError } from "./mutation-authority.js";
+import { serializePathWrite } from "./write-queue.js";
+import { rootWriteQueueKey } from "./root-create-native.js";
+import { resolvePinnedWriteTargetInRoot } from "./root-write-admission.js";
+import { createCopyPublicationObserver, onCopyPublication, onCopySourceAdmission } from "./copy-publication.js";
+import { isAlreadyExistsError, normalizePinnedWriteError } from "./root-errors.js";
+import { runPinnedWriteHelper } from "./pinned-write.js";
+import { FsSafeError } from "./errors.js";
+export async function copyFileInRoot(root, params, openVerifiedLocalFile) {
+    params.signal?.throwIfAborted();
+    resolveCopyCloneMode(params.clone, "never");
+    if (params.sourceSymlinks !== undefined && params.sourceSymlinks !== "reject" && params.sourceSymlinks !== "copy-link") {
+        throw new FsSafeError("invalid-path", "sourceSymlinks must be reject or copy-link");
+    }
+    if (params.sourceSymlinks === "copy-link") {
+        if (typeof params.source !== "string") {
+            throw new FsSafeError("invalid-path", "sourceSymlinks: copy-link requires an absolute-path string source; open/stat capabilities cannot observe links without following them");
+        }
+        const link = await admitCopyLink(assertAbsolutePathInput(params.source), params.preserveMetadata === true, params.signal)
+            .catch(error => { throw normalizePinnedWriteError(error); });
+        if (link) {
+            if (params.overwrite === true)
+                throw new FsSafeError("invalid-path", "copy-link cannot overwrite an existing destination; omit overwrite or use false");
+            assertCopyLinkAvailable();
+            const mode = params.mode ?? (params.preserveSourceMode ? Number(link.identity.mode & 4095n) : undefined);
+            await copyInputInRoot(root, { ...params, overwrite: false }, link, mode);
+            return;
+        }
+    }
+    const clone = resolveFileCopyCloneMode(params.clone);
+    let source;
+    let sourceIdentity;
+    if (typeof params.source === "string") {
+        assertNoNulPathInput(params.source, "source path contains a NUL byte");
+        assertNoWindowsPathAlias(params.source, "filesystem", "source path uses a Windows filesystem namespace alias");
+        ({ opened: source, identity: sourceIdentity } = await openVerifiedLocalFile(params.source, {
+            hardlinks: params.sourceHardlinks,
+        }));
+    }
+    else {
+        source = await params.source.root.open(params.source.relativePath, params.sourceHardlinks === undefined ? undefined : { hardlinks: params.sourceHardlinks });
+        try {
+            sourceIdentity = await inspectFileIdentity(() => fsSync.fstatSync(source.handle.fd, { bigint: true }));
+        }
+        catch (error) {
+            await source.handle.close().catch(() => undefined);
+            throw error;
+        }
+    }
+    try {
+        if (params.maxBytes !== undefined && source.stat.size > params.maxBytes) {
+            throw new FsSafeError("too-large", `file exceeds limit of ${params.maxBytes} bytes (got ${source.stat.size})`);
+        }
+        let metadata;
+        try {
+            metadata = params.preserveMetadata ? captureCopyMetadata(source.handle.fd, sourceIdentity) : undefined;
+        }
+        catch (error) {
+            throw normalizePinnedWriteError(error);
+        }
+        const sourceAdmission = params.admitSource?.(sourceIdentity, source.realPath);
+        const verifySource = async () => {
+            params.signal?.throwIfAborted();
+            try {
+                sourceAdmission?.verify();
+            }
+            catch (error) {
+                throw new MutationAuthorityError(error);
+            }
+            if (typeof params.source !== "string")
+                await params.source.root.stat(".");
+            await assertCopySourceCurrent(source, sourceIdentity);
+        };
+        const mode = sourceAdmission?.mode ?? params.mode ?? (params.preserveSourceMode ? Number(sourceIdentity.mode & 4095n) : undefined);
+        await copyInputInRoot(root, params, {
+            kind: "file", handle: source.handle, size: source.stat.size, clone,
+            signal: params.signal, metadata, verifySource,
+        }, mode, () => assertCopySourceCurrent(source, sourceIdentity));
+    }
+    finally {
+        await source.handle.close().catch(() => { });
+    }
+}
+async function copyInputInRoot(root, params, input, mode, verifyAdmission = input.verifySource) {
+    if (mode !== undefined && (!Number.isInteger(mode) || mode < 0 || mode > 0o7777)) {
+        throw new FsSafeError("invalid-path", "invalid copy mode");
+    }
+    await serializePathWrite(rootWriteQueueKey(root, params.relativePath), async () => {
+        const pinned = await resolvePinnedWriteTargetInRoot(root, params.relativePath, mode, params.denyMutations, params.overwrite !== false, params.mutationSymlinks);
+        await serializePathWrite(pinned.targetPath, async () => {
+            await verifyAdmission();
+            const observer = createCopyPublicationObserver(pinned.targetPath, params.onDestinationPublished);
+            try {
+                await runPinnedWriteHelper({
+                    rootPath: pinned.rootReal, relativeParentPath: pinned.relativeParentPath, basename: pinned.basename,
+                    mkdir: params.mkdir !== false, mode: pinned.mode, overwrite: params.overwrite !== false,
+                    rejectFinalSymlink: params.mutationSymlinks !== undefined, maxBytes: params.maxBytes,
+                    sync: params.durable !== false,
+                    assertBeforeMutation: params.signal || params.assertBeforeMutation ? () => {
+                        if (params.signal?.aborted)
+                            throw new MutationAuthorityError(params.signal.reason);
+                        params.assertBeforeMutation?.();
+                    } : undefined,
+                    verifyPublished: params.verifyPublished, onPublished: observer.onPublished, input,
+                    rootIdentity: root.rootIdentity, mutationAdmission: pinned.mutationAdmission,
+                });
+            }
+            catch (error) {
+                observer.rethrowObserverFailure(error);
+                if (params.signal?.aborted && error === params.signal.reason)
+                    throw error;
+                if (isAlreadyExistsError(error))
+                    throw new FsSafeError("already-exists", "copy destination already exists", { cause: error });
+                throw normalizePinnedWriteError(error);
+            }
+            await input.verifySource();
+        });
+    });
+}

package/node_modules/@openclaw/fs-safe/dist/root-create-native.js

@@ -63,10 +63,11 @@ import { getNativeBinding } from "./native.js";
 import { captureNativeFdClose } from "./native-binding.js";
 import { openNativeRootAdmission } from "./native-parent-admission.js";
 import { capturePolicyAwareNativeParent } from "./native-policy-parent.js";
-import { isNotFoundPathError, isPathInside } from "./path.js";
+import { hasNodeErrorCode, isNotFoundPathError, isPathInside } from "./path.js";
 import { preparePinnedWriteMutationAdmission } from "./pinned-mutation-admission.js";
 import { resolvePathViaExistingAncestor } from "./root-path-existing.js";
 import { admitPathInsideRoot } from "./root-boundary.js";
+import { directoryComponentNotDirectoryError } from "./root-errors.js";
 import { assertRootIdentityCurrentSync } from "./root-context.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
@@ -81,7 +82,7 @@ function unavailable() {
     throw new FsSafeError("helper-unavailable", "native confined creation is unavailable");
 }
 async function withNativeDirectory(params, operation, discard) {
-    const binding = getNativeBinding();
+    const binding = getNativeBinding("openBeneath", "mkdirChildBeneath");
     if (!binding?.openBeneath || !binding.mkdirChildBeneath || (params.private && process.platform === "win32"))
         return unavailable();
     const directoryTarget = params.directory === params.target;
@@ -232,10 +233,17 @@ export async function tryMkdirRootNative(params) {
     // and uses handle-relative NtCreateFile with its protected security descriptor.
     if (params.private && process.platform === "win32")
         return false;
-    return await withNativeDirectory(params, async (_binding, _fd, assertCurrent) => { assertCurrent(); return true; });
+    try {
+        return await withNativeDirectory(params, async (_binding, _fd, assertCurrent) => { assertCurrent(); return true; });
+    }
+    catch (error) {
+        if (hasNodeErrorCode(error, "ENOTDIR"))
+            throw directoryComponentNotDirectoryError(error);
+        throw error;
+    }
 }
 export async function tryOpenCreateRootNative(params) {
-    const binding = getNativeBinding();
+    const binding = getNativeBinding("openBeneath", "mkdirChildBeneath", "removeStagedFile", "openCreateBeneath");
     if (!binding?.removeStagedFile || !binding.openCreateBeneath)
         return unavailable();
     const access = (params.existingFlags & fs.constants.O_RDWR) ? 0o600 : 0o200;

package/node_modules/@openclaw/fs-safe/dist/root-impl.js

@@ -55,7 +55,7 @@ import fsSync, { constants as fsConstants } from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { normalizeMaxBytes } from "./byte-budget.js";
-import { assertCopySourceCurrent, resolveFileCopyCloneMode } from "./copy-file-input.js";
+import { copyFileInRoot } from "./root-copy.js";
 import { assertPrivateFileCreationAvailable, resolveCreationPermissions } from "./creation-boundary.js";
 import { assertAsyncDirectoryGuard, assertSyncDirectoryGuard, createAsyncDirectoryGuard, createNearestExistingDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
@@ -68,6 +68,7 @@ import { openedPathResolutionError, recordExclusiveCreateFailure, recordOpenedFi
 import { runPinnedWriteHelper, runPinnedWriteWithRenamePolicy } from "./pinned-write.js";
 import { preparePinnedWriteMutationAdmission, snapshotPinnedMutationPolicy } from "./pinned-mutation-admission.js";
 import { getNativeBinding } from "./native.js";
+import { getPinnedWriteNativeBinding } from "./native-pinned-write.js";
 import { isFsSafeNativeRequired } from "./native-config.js";
 import { validatePinnedRelativePath } from "./pinned-operation.js";
 import { PATH_ALIAS_POLICIES } from "./path-policy.js";
@@ -104,7 +105,7 @@ import { assertRootFallbackWritePath } from "./root-write-lock-binding.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
 import { admitMoveSourceStat, movePathNative } from "./root-move-noreplace.js";
 import { admitRootReadHandle, inspectOpenedPathIdentitySync } from "./root-read-admission.js";
-import { createCopyPublicationObserver, onCopyPublication, onCopySourceAdmission } from "./copy-publication.js";
+import { onCopyPublication, onCopySourceAdmission } from "./copy-publication.js";
 import { writeAllToFile } from "./write-file-handle.js";
 import { createInputOptions, rethrowCreateInputError, rootWriteInput, retainSidecarCreated } from "./root-create-input.js";
 import { assertFinalSymlinkRejected, mutationSymlinkResolution, readSymlinkResolution } from "./root-symlink-policy.js";
@@ -113,7 +114,7 @@ import { assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot } from "./wi
 import { resolvePinnedObservedPathInRoot } from "./root-observed-path.js";
 import { registerFileLockSyncRootAdapter } from "./file-lock-sync-root.js";
 import { mergeReadOptions, readDefaults, } from "./root-options.js";
-import { composeMutationAssertions, MutationAuthorityError, rethrowMutationAuthorityError } from "./mutation-authority.js";
+import { composeMutationAssertions, rethrowMutationAuthorityError } from "./mutation-authority.js";
 export { DEFAULT_ROOT_MAX_BYTES } from "./root-options.js";
 export { resolveOpenedFileRealPathForHandle } from "./opened-realpath.js";
 function logWarn(message) {
@@ -355,7 +356,7 @@ export class RootHandle {
             durable: options.durable ?? this.defaults.durable ?? true,
             verifyPublished: options[onCopyPublication],
             admitSource: options[onCopySourceAdmission],
-        }).catch(rethrowMutationAuthorityError);
+        }, openVerifiedLocalFile).catch(rethrowMutationAuthorityError);
     }
     async exists(relativePath) {
         try {
@@ -897,7 +898,7 @@ async function writeFileInRoot(root, params) {
     const input = rootWriteInput(params);
     await serializePathWrite(rootWriteQueueKey(root, params.relativePath), async () => {
         if (!params.private && input.kind === "buffer" && !input.stageBeforePublish && process.platform === "win32" &&
-            (params.renameIdentity === "verify-content-with-lock" || !getNativeBinding())) {
+            (params.renameIdentity === "verify-content-with-lock" || !getPinnedWriteNativeBinding({ input }))) {
             await writeFileFallback(root, { ...params, data: input.data });
             return;
         }
@@ -965,93 +966,6 @@ async function commitPinnedWriteInRoot(root, pinned, params, input) {
         throw normalizePinnedWriteError(error);
     }
 }
-async function copyFileInRoot(root, params) {
-    params.signal?.throwIfAborted();
-    const clone = resolveFileCopyCloneMode(params.clone);
-    let source;
-    let sourceIdentity;
-    if (typeof params.source === "string") {
-        assertNoNulPathInput(params.source, "source path contains a NUL byte");
-        assertNoWindowsPathAlias(params.source, "filesystem", "source path uses a Windows filesystem namespace alias");
-        ({ opened: source, identity: sourceIdentity } = await openVerifiedLocalFile(params.source, {
-            hardlinks: params.sourceHardlinks,
-        }));
-    }
-    else {
-        source = await params.source.root.open(params.source.relativePath, params.sourceHardlinks === undefined ? undefined : { hardlinks: params.sourceHardlinks });
-        try {
-            sourceIdentity = await inspectFileIdentity(() => fsSync.fstatSync(source.handle.fd, { bigint: true }));
-        }
-        catch (error) {
-            await source.handle.close().catch(() => undefined);
-            throw error;
-        }
-    }
-    if (params.maxBytes !== undefined && source.stat.size > params.maxBytes) {
-        await source.handle.close().catch(() => { });
-        throw new FsSafeError("too-large", `file exceeds limit of ${params.maxBytes} bytes (got ${source.stat.size})`);
-    }
-    try {
-        const sourceAdmission = params.admitSource?.(sourceIdentity, source.realPath);
-        const mode = sourceAdmission?.mode ?? params.mode;
-        await serializePathWrite(rootWriteQueueKey(root, params.relativePath), async () => {
-            const pinned = await resolvePinnedWriteTargetInRoot(root, params.relativePath, mode ?? (params.preserveSourceMode ? Number(sourceIdentity.mode & 4095n) : undefined), params.denyMutations, params.overwrite !== false, params.mutationSymlinks);
-            await serializePathWrite(pinned.targetPath, async () => {
-                await assertCopySourceCurrent(source, sourceIdentity);
-                const verifySource = async () => {
-                    params.signal?.throwIfAborted();
-                    try {
-                        sourceAdmission?.verify();
-                    }
-                    catch (error) {
-                        throw new MutationAuthorityError(error);
-                    }
-                    if (typeof params.source !== "string") {
-                        await params.source.root.stat(".");
-                    }
-                    await assertCopySourceCurrent(source, sourceIdentity);
-                };
-                const observer = createCopyPublicationObserver(pinned.targetPath, params.onDestinationPublished);
-                try {
-                    await runPinnedWriteHelper({
-                        rootPath: pinned.rootReal,
-                        relativeParentPath: pinned.relativeParentPath,
-                        basename: pinned.basename,
-                        mkdir: params.mkdir !== false,
-                        mode: pinned.mode,
-                        overwrite: params.overwrite !== false,
-                        rejectFinalSymlink: params.mutationSymlinks !== undefined,
-                        maxBytes: params.maxBytes,
-                        sync: params.durable !== false,
-                        assertBeforeMutation: params.signal || params.assertBeforeMutation ? () => {
-                            if (params.signal?.aborted)
-                                throw new MutationAuthorityError(params.signal.reason);
-                            params.assertBeforeMutation?.();
-                        } : undefined,
-                        verifyPublished: params.verifyPublished,
-                        onPublished: observer.onPublished,
-                        input: { kind: "file", handle: source.handle, size: source.stat.size, clone, signal: params.signal, verifySource },
-                        rootIdentity: root.rootIdentity,
-                        mutationAdmission: pinned.mutationAdmission,
-                    });
-                }
-                catch (error) {
-                    observer.rethrowObserverFailure(error);
-                    if (params.signal?.aborted && error === params.signal.reason)
-                        throw error;
-                    if (isAlreadyExistsError(error)) {
-                        throw new FsSafeError("already-exists", "copy destination already exists", { cause: error });
-                    }
-                    throw normalizePinnedWriteError(error);
-                }
-                await verifySource();
-            });
-        });
-    }
-    finally {
-        await source.handle.close().catch(() => { });
-    }
-}
 async function resolvePinnedPathInRoot(root, params) {
     const resolved = await resolvePinnedRootPathInRoot(root, {
         relativePath: params.relativePath,

package/node_modules/@openclaw/fs-safe/dist/root-move-noreplace.js

@@ -80,7 +80,7 @@ export async function movePathNative(root, params, paths, overwrite = false) {
                 throw error;
             // Advisory fast rejection only. renameNoReplace owns the collision decision.
         }
-    const binding = requireNativeBinding();
+    const binding = requireNativeBinding("openBeneath", overwrite ? "renameReplaceWithIdentity" : "renameNoReplace");
     if (typeof (overwrite ? binding.renameReplaceWithIdentity : binding.renameNoReplace) !== "function") {
         throw new FsSafeError("helper-unavailable", "native move is unavailable");
     }

package/node_modules/@openclaw/fs-safe/dist/root-options.d.ts

@@ -38,6 +38,8 @@ export type RootCopyOptions = Pick<RootDefaults, "assertBeforeMutation" | "denyM
     clone?: CopyCloneMode;
     signal?: AbortSignal;
     preserveSourceMode?: boolean;
+    preserveMetadata?: boolean;
+    sourceSymlinks?: "reject" | "copy-link";
     onDestinationPublished?: (receipt: RootCopyPublicationReceipt) => void;
 };
 export type RootCopySource = string | {

package/node_modules/@openclaw/fs-safe/dist/root-remove-native.js

@@ -29,7 +29,7 @@ function normalize(error, details) {
     return normalizeRemovePathError(error, details);
 }
 export async function removePathInRootNative(root, target, options, receipts) {
-    const binding = getNativeBinding();
+    const binding = getNativeBinding("openBeneath", "rootRemovalStat", "rootRemovalUnlink");
     if (!binding?.rootRemovalStat || !binding.rootRemovalUnlink) {
         unavailable();
     }
@@ -39,6 +39,13 @@ export async function removePathInRootNative(root, target, options, receipts) {
     const boundary = await captureNonrecursiveRemovalAdmission(root, target, options, receipts);
     if (!boundary)
         return;
+    if (options.recursive && options.maxEntries === 0) {
+        options.signal?.throwIfAborted();
+        boundary.assertCurrent();
+        throw new FsSafeError("too-large", "recursive removal budget exceeded", {
+            details: { operation: "remove", phase: "inspect", relativePath: "" },
+        });
+    }
     const rootAdmission = await openNativeRootAdmission(binding, {
         rootPath: root.rootReal, rootIdentity: root.rootIdentity, operation: "remove", reportCloseErrors: true, searchOnly: true,
     }).catch(error => { throw normalizeRemoveGuardError(error); });

package/node_modules/@openclaw/fs-safe/dist/sibling-staged-file.js

@@ -75,7 +75,7 @@ async function writeIsolatedProducer(params) {
     const targetRoot = rootFromDirectoryGuard(parentGuard);
     // Select the handoff before invoking the producer. Missing required native
     // support must not leave producer output behind as a discovery side effect.
-    const native = getNativeBinding();
+    const native = getNativeBinding("openBeneath", "renameNoReplace");
     const cleanupErrors = [];
     const { target, identity } = await createOwnedTempFile({
         rootDir: targetRoot.rootReal,

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-retained.js

@@ -99,7 +99,7 @@ export function retainCreatedSidecar(lockPath, raw, createdFd, guard, nativePare
                 }
             } };
     }
-    if (!binding.stagedFileMatches || !binding.removeStagedFile)
+    if (!binding.openBeneath || !binding.stagedFileMatches || !binding.removeStagedFile)
         return undefined;
     const closeFile = captureNativeFdClose(binding);
     const parentFd = binding.openBeneath(nativeParent.fd, "", nativeOpenFlags(fs.constants.O_RDONLY | fs.constants.O_DIRECTORY)).fd;

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-target.js

@@ -1,3 +1,4 @@
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { canonicalPathFromExistingAncestor } from "./absolute-path.js";
@@ -23,7 +24,13 @@ export async function resolveSidecarTargetPath(resolved, lockRoot) {
         assertNoWindowsPathAlias(normalized);
         return normalized;
     }
-    await fs.mkdir(recursiveMkdirPath(dir), { recursive: true });
+    let parentExists = false;
+    try {
+        parentExists = fsSync.statSync(dir).isDirectory();
+    }
+    catch { /* Preserve mkdir errors below. */ }
+    if (!parentExists)
+        await fs.mkdir(recursiveMkdirPath(dir), { recursive: true });
     let parent;
     try {
         parent = realpathSync.native(dir);

package/node_modules/@openclaw/fs-safe/dist/test-hooks.d.ts

@@ -1,5 +1,6 @@
 import type { FileHandle } from "node:fs/promises";
 import type { FileIdentityStat } from "./file-identity.js";
+export { holdWindowsSharingLock, setWindowsFileAttributes, readWindowsFileExtents } from "./windows-test-hooks.js";
 export type FsSafeTestHooks = {
     beforeWatchRegistration?: (path: string) => void | Promise<void>;
     afterWatchRegistration?: (path: string) => void | Promise<void>;

package/node_modules/@openclaw/fs-safe/dist/test-hooks.js

@@ -1,3 +1,4 @@
+export { holdWindowsSharingLock, setWindowsFileAttributes, readWindowsFileExtents } from "./windows-test-hooks.js";
 let fsSafeTestHooks;
 function allowFsSafeTestHooks() {
     return process.env.NODE_ENV === "test" || process.env.VITEST === "true";

package/node_modules/@openclaw/fs-safe/dist/watch-native.js

@@ -5,9 +5,9 @@ import { watchStreamPaths } from "./watch-stream.js";
 export function watchBinding(mode) {
     if (mode === "poll")
         return;
-    const binding = getNativeBinding(); // Preserves require + missing-addon failure.
+    const binding = getNativeBinding("watchRegister", "watchAdd", "watchUnregister", ...(process.platform === "darwin" ? ["watchConfigure", "watchEntries"] : []));
     // Bun TSFN teardown remains unqualified; guarded native scans remain usable.
-    if (binding?.watchRegister && (process.platform !== "darwin" || (binding.watchConfigure && binding.watchEntries)) && !process.versions.bun && !process.versions.deno && ["linux", "darwin", "win32"].includes(process.platform))
+    if (binding && !process.versions.bun && !process.versions.deno && ["linux", "darwin", "win32"].includes(process.platform))
         return binding;
     if (mode === "events" || getFsSafeNativeConfig().mode === "require") {
         throw new FsSafeError("helper-unavailable", "native watch events are unavailable", { details: { operation: "watch" } });

package/node_modules/@openclaw/fs-safe/dist/windows-security-bridge.cs

@@ -41,18 +41,19 @@ public static partial class FsSafeWindowsBridge {
 
   sealed class Failure : Exception {
     public readonly string Code;
-    public Failure(string code, string message) : base(message) { Code=code; }
+    public readonly uint? Errno;
+    public Failure(string code, string message, uint? errno=null) : base(message) { Code=code; Errno=errno; }
   }
   static Failure OsFailure(uint error, string operation, bool identity=false, bool fullIdentity=false) {
     // Native security calls retain EACCES; shared handle identity calls use EPERM.
     string code=error==5 ? (identity ? "EPERM" : "EACCES") : error==80 || error==183 ? "EEXIST" : error==2 || error==3 ? "ENOENT" :
       identity && (error==112 || error==39) ? "ENOSPC" : identity && (error==32 || error==33) ? "EBUSY" :
       fullIdentity && (error==1 || error==50 || error==87) ? "ENOTSUP" : "EIO";
-    return new Failure(code, operation+" failed with Windows error "+error);
+    return new Failure(code, operation+" failed with Windows error "+error, error);
   }
   static Failure CreateFailure(uint error) {
     var failure=OsFailure(error,"create private directory",true);
-    return failure.Code=="EPERM" ? new Failure("EACCES",failure.Message) : failure;
+    return failure.Code=="EPERM" ? new Failure("EACCES",failure.Message,failure.Errno) : failure;
   }
   static void Require(bool condition, string code, string message) {
     if (!condition) throw new Failure(code,message);
@@ -305,7 +306,8 @@ public static partial class FsSafeWindowsBridge {
             var failure=primary as Failure;
             throw new Failure(failure==null ? "EIO" : failure.Code,
               (failure==null ? "private directory validation failed" : failure.Message)+
-              "; owned-handle cleanup failed with Windows error "+Marshal.GetLastWin32Error());
+              "; owned-handle cleanup failed with Windows error "+Marshal.GetLastWin32Error(),
+              failure==null ? null : failure.Errno);
           }
           throw;
         }
@@ -330,7 +332,11 @@ public static partial class FsSafeWindowsBridge {
       } else if(operation=="path") result=InspectPath(path);
       else throw new Failure("EINVAL","unknown Windows security operation");
       return Row("ok",true,"result",result);
-    } catch(Failure error) { return Row("ok",false,"code",error.Code,"message",error.Message); }
+    } catch(Failure error) {
+      var reply=Row("ok",false,"code",error.Code,"message",error.Message);
+      if(error.Errno.HasValue) reply.Add("errno",error.Errno.Value);
+      return reply;
+    }
       catch(Exception) { return Row("ok",false,"code","EIO","message","Windows security descriptor processing failed"); }
   }
 }

package/node_modules/@openclaw/fs-safe/dist/windows-security-command.js

@@ -85,7 +85,15 @@ function parseReplyValue(stdout, operation) {
         if (typeof response.code !== "string" || !codes.has(response.code) || typeof response.message !== "string") {
             unverified("Windows security command returned an invalid failure");
         }
-        throw Object.assign(new Error(response.message), { code: response.code });
+        if (response.errno !== undefined &&
+            (typeof response.errno !== "number" || !Number.isInteger(response.errno) || response.errno < 0 || response.errno > 0xffff_ffff)) {
+            unverified("Windows security command returned an invalid native error number");
+        }
+        const failure = Object.assign(new Error(response.message), { code: response.code });
+        if (response.errno !== undefined) {
+            Object.defineProperty(failure, "errno", { value: response.errno, enumerable: true, configurable: true, writable: true });
+        }
+        throw failure;
     }
     if (operation === "create" && (!record(response.result) || response.result.created !== true || !isFullIdentity(response.result.identity))) {
         unverified("Windows security command did not verify private-directory creation");

package/node_modules/@openclaw/fs-safe/dist/windows-test-hooks.d.ts

@@ -0,0 +1,16 @@
+/** Test-only handle that omits delete sharing. */
+export declare function holdWindowsSharingLock(filePath: string): Disposable & {
+    close(): void;
+};
+/** Test-only attribute updates preserve unspecified bits on the opened object. */
+export declare function setWindowsFileAttributes(filePath: string, attrs: {
+    readOnly?: boolean;
+    hidden?: boolean;
+    system?: boolean;
+}): void;
+/** Test-only physical mapping reader; lcn -1 represents sparse clusters. */
+export declare function readWindowsFileExtents(filePath: string): {
+    vcn: bigint;
+    lcn: bigint;
+    clusters: bigint;
+}[];