@openclaw/openshell-sandbox 2026.9.4 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/file-handle-transfer.js

@@ -0,0 +1,190 @@
+import fs from "node:fs";
+import { normalizeMaxBytes } from "./byte-budget.js";
+import { FsSafeError } from "./errors.js";
+import { assertSynchronousCallbackResult, composeMutationAssertions, rethrowMutationAuthorityError, } from "./mutation-authority.js";
+import { writeAllToFile } from "./write-file-handle.js";
+import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
+const NO_CALLBACK_ARGUMENTS = Object.freeze([]);
+function createTransferBuffer(sizeHint, limit) {
+    return Buffer.allocUnsafe(Math.min(512 * 1024, Math.max(64 * 1024, sizeHint), limit + 1));
+}
+/** Copies caller-owned regular-file descriptors without moving either cursor. */
+export function copyFileDescriptorSync(sourceFd, targetFd, options = {}) {
+    const signal = options.signal;
+    signal?.throwIfAborted();
+    const maxBytes = normalizeMaxBytes(options.maxBytes);
+    const onChunk = options.onChunk;
+    const assertBeforeMutation = options.assertBeforeMutation;
+    const sourceStat = inspectFileIdentitySync(() => {
+        signal?.throwIfAborted();
+        return fs.fstatSync(sourceFd, { bigint: true });
+    });
+    if (!sourceStat.isFile())
+        throw new FsSafeError("not-file", "copy source descriptor must be a regular file");
+    if (maxBytes !== undefined && Number.isFinite(maxBytes) && sourceStat.size > BigInt(maxBytes)) {
+        throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes`);
+    }
+    const targetStat = inspectFileIdentitySync(() => {
+        signal?.throwIfAborted();
+        return fs.fstatSync(targetFd, { bigint: true });
+    });
+    if (!targetStat.isFile())
+        throw new FsSafeError("not-file", "copy target descriptor must be a regular file");
+    if (sourceStat.dev === targetStat.dev && sourceStat.ino === targetStat.ino) {
+        throw new FsSafeError("path-alias", "copy source and target descriptors refer to the same file");
+    }
+    const limit = maxBytes ?? Infinity;
+    const buffer = createTransferBuffer(Number(sourceStat.size), limit);
+    let position = 0;
+    while (true) {
+        signal?.throwIfAborted();
+        const bytesRead = fs.readSync(sourceFd, buffer, 0, Math.min(buffer.length, limit - position + 1), position);
+        if (bytesRead > limit - position) {
+            throw new FsSafeError("too-large", `file exceeds limit of ${limit} bytes`);
+        }
+        if (bytesRead === 0)
+            return position;
+        const chunk = buffer.subarray(0, bytesRead);
+        assertSynchronousCallbackResult(onChunk?.(chunk), "onChunk");
+        let offset = 0;
+        while (offset < bytesRead) {
+            signal?.throwIfAborted();
+            assertSynchronousCallbackResult(assertBeforeMutation?.(), "assertBeforeMutation");
+            signal?.throwIfAborted();
+            const written = fs.writeSync(targetFd, chunk, offset, bytesRead - offset, position + offset);
+            if (written <= 0)
+                throw new FsSafeError("helper-failed", "file write made no progress");
+            offset += written;
+        }
+        position += bytesRead;
+    }
+}
+function defineReceiverValue(receiver, key, value) {
+    Object.defineProperty(receiver, key, {
+        value, enumerable: true, writable: true, configurable: true,
+    });
+}
+function copyTransferReceiver(options, maxBytes, sizeHint, signal, onChunk, assertBeforeMutation) {
+    const receiver = {};
+    const spreadSource = Object(options);
+    // Preserve the former late object-spread boundary, including proxy traps and
+    // unrelated getter failures. Authority-bearing values stay on their early
+    // snapshots, while descriptors still run in original own-key order.
+    for (const key of Reflect.ownKeys(spreadSource)) {
+        if (!Object.getOwnPropertyDescriptor(spreadSource, key)?.enumerable)
+            continue;
+        let value;
+        switch (key) {
+            case "maxBytes":
+                value = maxBytes;
+                break;
+            case "signal":
+                value = signal;
+                break;
+            case "onChunk":
+                value = onChunk;
+                break;
+            case "assertBeforeMutation":
+                value = assertBeforeMutation;
+                break;
+            default: value = Reflect.get(spreadSource, key);
+        }
+        // Create a data property so an enumerable __proto__ key cannot alter the
+        // ordinary receiver prototype, matching object spread.
+        defineReceiverValue(receiver, key, value);
+    }
+    // Match the explicit fields that followed the former spread. Updating an
+    // existing key retains its original position; absent keys append in order.
+    defineReceiverValue(receiver, "maxBytes", maxBytes);
+    defineReceiverValue(receiver, "sizeHint", sizeHint);
+    defineReceiverValue(receiver, "targetPosition", 0);
+    defineReceiverValue(receiver, "assertBeforeMutation", assertBeforeMutation);
+    return receiver;
+}
+/** Copies caller-owned regular files from offset zero without moving either cursor. */
+export async function copyFileHandle(source, target, options = {}) {
+    // Snapshot caller-owned options before the first await. This preserves
+    // inherited/non-enumerable callbacks and prevents accessor mutation from
+    // replacing cancellation or mutation authority mid-transfer.
+    const signal = options.signal;
+    signal?.throwIfAborted();
+    const maxBytes = normalizeMaxBytes(options.maxBytes);
+    const onChunk = options.onChunk;
+    const assertBeforeMutation = composeMutationAssertions(undefined, options.assertBeforeMutation);
+    const sourceStat = await inspectFileIdentity(() => {
+        signal?.throwIfAborted();
+        return source.stat({ bigint: true });
+    });
+    signal?.throwIfAborted();
+    if (!sourceStat.isFile())
+        throw new FsSafeError("not-file", "copy source handle must be a regular file");
+    if (maxBytes !== undefined && Number.isFinite(maxBytes) && sourceStat.size > BigInt(maxBytes)) {
+        throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes`);
+    }
+    const targetStat = await inspectFileIdentity(() => {
+        signal?.throwIfAborted();
+        return target.stat({ bigint: true });
+    });
+    signal?.throwIfAborted();
+    if (!targetStat.isFile())
+        throw new FsSafeError("not-file", "copy target handle must be a regular file");
+    if (sourceStat.dev === targetStat.dev && sourceStat.ino === targetStat.ino) {
+        throw new FsSafeError("path-alias", "copy source and target handles refer to the same file");
+    }
+    const sizeHint = Number(sourceStat.size);
+    const callbackThis = copyTransferReceiver(options, maxBytes, sizeHint, signal, onChunk, assertBeforeMutation);
+    const beforeWrite = () => {
+        signal?.throwIfAborted();
+        assertBeforeMutation?.();
+    };
+    return await transferFileHandleCore(source, target, sizeHint, maxBytes, 0, signal, onChunk, beforeWrite, callbackThis).catch(rethrowMutationAuthorityError);
+}
+// Root.copyIn supplies already-admitted identities and retains its owned target cursor.
+export function transferFileHandle(source, target, options) {
+    try {
+        const maxBytes = options.maxBytes;
+        const sizeHint = options.sizeHint;
+        const targetPosition = options.targetPosition;
+        const signal = options.signal;
+        const onChunk = options.onChunk;
+        const assertBeforeMutation = options.assertBeforeMutation;
+        const beforeWrite = signal === undefined && assertBeforeMutation === undefined
+            ? undefined
+            : () => {
+                signal?.throwIfAborted();
+                if (assertBeforeMutation) {
+                    Reflect.apply(assertBeforeMutation, options, NO_CALLBACK_ARGUMENTS);
+                }
+            };
+        return transferFileHandleCore(source, target, sizeHint, maxBytes, targetPosition, signal, onChunk, beforeWrite, options);
+    }
+    catch (error) {
+        // Keep the former async-function contract for synchronous option getters.
+        return Promise.reject(error);
+    }
+}
+async function transferFileHandleCore(source, target, sizeHint, maxBytes, targetPosition, signal, onChunk, beforeWrite, callbackThis) {
+    const limit = maxBytes ?? Infinity;
+    const buffer = createTransferBuffer(sizeHint, limit);
+    let position = 0;
+    while (true) {
+        signal?.throwIfAborted();
+        const { bytesRead } = await source.read(buffer, 0, Math.min(buffer.length, limit - position + 1), position);
+        signal?.throwIfAborted();
+        if (bytesRead > limit - position) {
+            throw new FsSafeError("too-large", `file exceeds limit of ${limit} bytes`);
+        }
+        if (bytesRead === 0)
+            return position;
+        const chunk = buffer.subarray(0, bytesRead);
+        if (onChunk) {
+            const returned = Function.prototype.call.call(onChunk, callbackThis, chunk);
+            assertSynchronousCallbackResult(returned, "onChunk");
+        }
+        await writeAllToFile(target, chunk, {
+            position: targetPosition === undefined ? undefined : targetPosition + position,
+            assertBeforeMutation: beforeWrite,
+        });
+        position += bytesRead;
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/file-hash.d.ts

@@ -1,10 +1,16 @@
 import type { FileHandle } from "node:fs/promises";
 import { type NativeBinding } from "./native.js";
 export type Sha256FileInput = string | FileHandle;
+export type Sha256FileSyncInput = string | number;
+export type Sha256FileOptions = {
+    maxBytes?: number;
+    signal?: AbortSignal;
+};
 export type Sha256FileResult = {
     bytes: number;
     digest: string;
 };
-export declare function hashFileHandle(handle: FileHandle, native?: NativeBinding | undefined): Promise<Sha256FileResult>;
-export declare function sha256File(input: Sha256FileInput): Promise<Sha256FileResult>;
-//# sourceMappingURL=file-hash.d.ts.map
+export declare function hashFileHandle(handle: FileHandle, native?: NativeBinding | undefined, { maxBytes, signal }?: Sha256FileOptions): Promise<Sha256FileResult>;
+export declare function sha256File(input: Sha256FileInput, options?: Sha256FileOptions): Promise<Sha256FileResult>;
+/** Hash synchronously from offset zero, retaining ownership and position of a borrowed fd. */
+export declare function sha256FileSync(input: Sha256FileSyncInput, options?: Sha256FileOptions): Sha256FileResult;

package/node_modules/@openclaw/fs-safe/dist/file-hash.js

@@ -1,73 +1,296 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
 import { createHash } from "node:crypto";
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
+import { normalizeMaxBytes } from "./byte-budget.js";
 import { FsSafeError } from "./errors.js";
 import { getNativeBinding } from "./native.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
-export async function hashFileHandle(handle, native = getNativeBinding()) {
-    const stat = await handle.stat();
-    if (!stat.isFile()) {
-        throw new FsSafeError("not-file", "SHA-256 input is not a regular file");
-    }
-    if (native) {
-        return await native.sha256File(handle.fd);
-    }
-    const hash = createHash("sha256");
-    const buffer = Buffer.allocUnsafe(64 * 1024);
-    let position = 0;
-    while (true) {
-        const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);
-        if (bytesRead === 0) {
-            return { bytes: position, digest: hash.digest("hex") };
-        }
-        hash.update(buffer.subarray(0, bytesRead));
-        position += bytesRead;
+import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
+// Idle storage is bounded independently of caller concurrency. A pending read
+// retains its exclusive borrow until the async hasher settles.
+const hashScratchBuffers = [];
+function takeHashScratch(size) {
+    const index = hashScratchBuffers.findIndex((buffer) => buffer.length >= size);
+    return index < 0 ? Buffer.allocUnsafe(size) : hashScratchBuffers.splice(index, 1)[0];
+}
+class HashScratch {
+    #storage;
+    buffer;
+    constructor(size) {
+        this.#storage = takeHashScratch(size);
+        this.buffer = this.#storage.subarray(0, size);
+    }
+    grow(size) {
+        const storage = takeHashScratch(size);
+        this[Symbol.dispose]();
+        this.#storage = storage;
+        return this.buffer = storage.subarray(0, size);
+    }
+    [Symbol.dispose]() {
+        // Clear the used view before retention; a larger unused tail was cleared
+        // by its previous borrower, without making tiny hashes clear large buffers.
+        this.buffer.fill(0);
+        hashScratchBuffers.push(this.#storage);
+        hashScratchBuffers.sort((left, right) => left.length - right.length);
+        if (hashScratchBuffers.length > 4)
+            hashScratchBuffers.shift();
     }
 }
-async function hashPath(filePath) {
-    const before = await inspectFileIdentity(async () => {
-        const stat = await fs.lstat(filePath, { bigint: true });
-        if (stat.isSymbolicLink()) {
-            throw new FsSafeError("symlink", "SHA-256 path must not be a symbolic link");
-        }
+export async function hashFileHandle(handle, native = getNativeBinding(), { maxBytes = Infinity, signal } = {}) {
+    const env_1 = { stack: [], error: void 0, hasError: false };
+    try {
+        signal?.throwIfAborted();
+        const stat = fsSync.fstatSync(handle.fd);
         if (!stat.isFile()) {
-            throw new FsSafeError("not-file", "SHA-256 path is not a regular file");
+            throw new FsSafeError("not-file", "SHA-256 input is not a regular file");
         }
-        return stat;
-    });
+        if (stat.size > maxBytes) {
+            throw new FsSafeError("too-large", `SHA-256 input exceeds ${maxBytes} bytes`);
+        }
+        if (native) {
+            // A completed N-API task can mask later aborts on the same signal.
+            const nativeSignal = signal ? AbortSignal.any([signal]) : undefined;
+            try {
+                const result = await native.sha256File(handle.fd, Number.isFinite(maxBytes) ? maxBytes : undefined, nativeSignal);
+                signal?.throwIfAborted();
+                return result;
+            }
+            catch (error) {
+                // N-API settles only after compute stops; never race descriptor cleanup.
+                signal?.throwIfAborted();
+                if (error?.code === "too-large") {
+                    throw new FsSafeError("too-large", `SHA-256 input exceeds ${maxBytes} bytes`, { cause: error });
+                }
+                throw error;
+            }
+            finally {
+                // Node retains composite signals while N-API's abort listener is attached.
+                if (nativeSignal)
+                    nativeSignal.onabort = null;
+            }
+        }
+        const hash = createHash("sha256");
+        const scratch = __addDisposableResource(env_1, new HashScratch(Math.min(256 * 1024, Math.max(1, stat.size + 1), maxBytes + 1)), false);
+        let buffer = scratch.buffer;
+        let position = 0;
+        while (true) {
+            signal?.throwIfAborted();
+            const length = Math.min(buffer.length, maxBytes - position + 1);
+            const { bytesRead } = await handle.read(buffer, 0, length, position);
+            signal?.throwIfAborted();
+            if (bytesRead > maxBytes - position) {
+                throw new FsSafeError("too-large", `SHA-256 input exceeds ${maxBytes} bytes`);
+            }
+            if (bytesRead === 0) {
+                return { bytes: position, digest: hash.digest("hex") };
+            }
+            hash.update(buffer.subarray(0, bytesRead));
+            position += bytesRead;
+            // A full small buffer can mean growth or a virtual file with an unhelpful size.
+            if (bytesRead === buffer.length && buffer.length < 64 * 1024) {
+                buffer = scratch.grow(Math.min(64 * 1024, maxBytes + 1));
+            }
+        }
+    }
+    catch (e_1) {
+        env_1.error = e_1;
+        env_1.hasError = true;
+    }
+    finally {
+        __disposeResources(env_1);
+    }
+}
+function hashPathIdentity(filePath, afterOpen = false) {
+    const stat = fsSync.lstatSync(filePath, { bigint: true });
+    if (afterOpen && (stat.isSymbolicLink() || !stat.isFile())) {
+        throw new FsSafeError("path-mismatch", "SHA-256 path changed while opening");
+    }
+    if (stat.isSymbolicLink()) {
+        throw new FsSafeError("symlink", "SHA-256 path must not be a symbolic link");
+    }
+    if (!stat.isFile()) {
+        throw new FsSafeError("not-file", "SHA-256 path is not a regular file");
+    }
+    return stat;
+}
+function hashDescriptorIdentity(fd) {
+    const stat = fsSync.fstatSync(fd, { bigint: true });
+    if (!stat.isFile()) {
+        throw new FsSafeError("not-file", "SHA-256 path is not a regular file");
+    }
+    return stat;
+}
+function rethrowHashOpenError(error) {
+    if (error?.code === "ELOOP") {
+        throw new FsSafeError("symlink", "SHA-256 path must not be a symbolic link", {
+            cause: error,
+        });
+    }
+    throw error;
+}
+async function hashPath(filePath, options) {
+    assertNoWindowsPathAlias(filePath, "filesystem", "SHA-256 path uses a Windows filesystem namespace alias");
+    const before = await inspectFileIdentity(() => hashPathIdentity(filePath));
     let handle;
     try {
+        options.signal?.throwIfAborted();
         handle = await fs.open(filePath, resolveReadOpenFlags());
     }
     catch (error) {
-        if (error?.code === "ELOOP") {
-            throw new FsSafeError("symlink", "SHA-256 path must not be a symbolic link", {
-                cause: error,
-            });
-        }
-        throw error;
+        rethrowHashOpenError(error);
     }
+    let completed = false;
     try {
-        const opened = await inspectFileIdentity(async () => {
-            const stat = await handle.stat({ bigint: true });
-            if (!stat.isFile()) {
-                throw new FsSafeError("not-file", "SHA-256 path is not a regular file");
+        options.signal?.throwIfAborted();
+        const opened = await inspectFileIdentity(() => hashDescriptorIdentity(handle.fd), before);
+        await inspectFileIdentity(() => hashPathIdentity(filePath, true), opened);
+        const result = await hashFileHandle(handle, getNativeBinding(), options);
+        completed = true;
+        return result;
+    }
+    finally {
+        if (completed)
+            await handle.close();
+        else
+            await handle.close().catch(() => undefined);
+    }
+}
+export async function sha256File(input, options = {}) {
+    options.signal?.throwIfAborted();
+    const normalized = { maxBytes: normalizeMaxBytes(options.maxBytes), signal: options.signal };
+    return typeof input === "string"
+        ? await hashPath(input, normalized)
+        : await hashFileHandle(input, getNativeBinding(), normalized);
+}
+function hashDescriptorSync(fd, { maxBytes = Infinity, signal }) {
+    const env_2 = { stack: [], error: void 0, hasError: false };
+    try {
+        signal?.throwIfAborted();
+        const stat = fsSync.fstatSync(fd);
+        if (!stat.isFile()) {
+            throw new FsSafeError("not-file", "SHA-256 input is not a regular file");
+        }
+        if (stat.size > maxBytes) {
+            throw new FsSafeError("too-large", `SHA-256 input exceeds ${maxBytes} bytes`);
+        }
+        const hash = createHash("sha256");
+        const scratch = __addDisposableResource(env_2, new HashScratch(Math.min(256 * 1024, Math.max(1, stat.size + 1), maxBytes + 1)), false);
+        let buffer = scratch.buffer;
+        let position = 0;
+        while (true) {
+            signal?.throwIfAborted();
+            const length = Math.min(buffer.length, maxBytes - position + 1);
+            const bytesRead = fsSync.readSync(fd, buffer, 0, length, position);
+            signal?.throwIfAborted();
+            if (bytesRead > maxBytes - position) {
+                throw new FsSafeError("too-large", `SHA-256 input exceeds ${maxBytes} bytes`);
+            }
+            if (bytesRead === 0) {
+                return { bytes: position, digest: hash.digest("hex") };
             }
-            return stat;
-        }, before);
-        await inspectFileIdentity(async () => {
-            const stat = await fs.lstat(filePath, { bigint: true });
-            if (stat.isSymbolicLink() || !stat.isFile()) {
-                throw new FsSafeError("path-mismatch", "SHA-256 path changed while opening");
+            hash.update(buffer.subarray(0, bytesRead));
+            position += bytesRead;
+            if (bytesRead === buffer.length && buffer.length < 64 * 1024) {
+                buffer = scratch.grow(Math.min(64 * 1024, maxBytes + 1));
             }
-            return stat;
-        }, opened);
-        return await hashFileHandle(handle);
+        }
+    }
+    catch (e_2) {
+        env_2.error = e_2;
+        env_2.hasError = true;
     }
     finally {
-        await handle.close().catch(() => undefined);
+        __disposeResources(env_2);
+    }
+}
+function hashPathSync(filePath, options) {
+    assertNoWindowsPathAlias(filePath, "filesystem", "SHA-256 path uses a Windows filesystem namespace alias");
+    const before = inspectFileIdentitySync(() => hashPathIdentity(filePath));
+    let fd;
+    try {
+        options.signal?.throwIfAborted();
+        fd = fsSync.openSync(filePath, resolveReadOpenFlags());
+    }
+    catch (error) {
+        rethrowHashOpenError(error);
+    }
+    let completed = false;
+    try {
+        options.signal?.throwIfAborted();
+        const opened = inspectFileIdentitySync(() => hashDescriptorIdentity(fd), before);
+        inspectFileIdentitySync(() => hashPathIdentity(filePath, true), opened);
+        const result = hashDescriptorSync(fd, options);
+        completed = true;
+        return result;
+    }
+    finally {
+        try {
+            fsSync.closeSync(fd);
+        }
+        catch (error) {
+            if (completed)
+                throw error;
+        }
     }
 }
-export async function sha256File(input) {
-    return typeof input === "string" ? await hashPath(input) : await hashFileHandle(input);
+/** Hash synchronously from offset zero, retaining ownership and position of a borrowed fd. */
+export function sha256FileSync(input, options = {}) {
+    options.signal?.throwIfAborted();
+    const normalized = { maxBytes: normalizeMaxBytes(options.maxBytes), signal: options.signal };
+    return typeof input === "string"
+        ? hashPathSync(input, normalized)
+        : hashDescriptorSync(input, normalized);
 }

package/node_modules/@openclaw/fs-safe/dist/file-identity.d.ts

@@ -5,4 +5,3 @@ export type FileIdentityStat = {
 export declare function sha256Hex(data: string | Buffer, encoding?: BufferEncoding): string;
 export declare function sameFileIdentity(left: FileIdentityStat, right: FileIdentityStat, platform?: NodeJS.Platform): boolean;
 export declare function sameFileIdentityForCleanup(left: FileIdentityStat, right: FileIdentityStat, platform?: NodeJS.Platform): boolean;
-//# sourceMappingURL=file-identity.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/file-identity.js

@@ -23,12 +23,26 @@ export function sameFileIdentity(left, right, platform = process.platform) {
         !isStatValueProvablyDifferent(left.ino, right.ino, platform));
 }
 export function sameFileIdentityForCleanup(left, right, platform = process.platform) {
+    if (platform !== "win32") {
+        return sameStatValue(left.dev, right.dev) && sameStatValue(left.ino, right.ino);
+    }
     // A zero Windows device or inode is unknown, not proof that a pathname still
     // names the object we created. Cleanup must fail closed rather than delete a
     // replacement that happens to share the known half of the identity.
-    if (platform === "win32" &&
-        (isZero(left.dev) || isZero(left.ino) || isZero(right.dev) || isZero(right.ino))) {
+    // Capture each potentially adapter-backed observation once. This strengthens
+    // the fence against changing accessors; exact legacy getter traces are not a
+    // compatibility contract.
+    const leftDev = left.dev;
+    if (isZero(leftDev))
         return false;
-    }
-    return sameStatValue(left.dev, right.dev) && sameStatValue(left.ino, right.ino);
+    const leftIno = left.ino;
+    if (isZero(leftIno))
+        return false;
+    const rightDev = right.dev;
+    if (isZero(rightDev))
+        return false;
+    const rightIno = right.ino;
+    if (isZero(rightIno))
+        return false;
+    return sameStatValue(leftDev, rightDev) && sameStatValue(leftIno, rightIno);
 }

package/node_modules/@openclaw/fs-safe/dist/file-lock-sync-acquisition.d.ts

@@ -0,0 +1,22 @@
+import type { FileLockSyncHandle } from "./file-lock-sync.js";
+import type { SidecarLockCompromisedInfo, SidecarLockRetryOptions } from "./sidecar-lock-types.js";
+/** Owns local arbitration and retry state, independently of filesystem authority. */
+export declare class SyncLockAcquisition {
+    #private;
+    readonly lockPath: string;
+    readonly normalizedTargetPath: string;
+    private readonly retry;
+    private readonly timeoutMs;
+    constructor(lockPath: string, normalizedTargetPath: string, retry: SidecarLockRetryOptions, timeoutMs: number | undefined);
+    get owns(): boolean;
+    hasToken(): boolean;
+    assert(): void;
+    reserve(): void;
+    release(): void;
+    run<T>(callback: () => T): T;
+    waitForRetry(): void;
+    retryDenial(error: unknown): boolean;
+    monitor(held: {
+        timer?: NodeJS.Timeout;
+    }, handle: FileLockSyncHandle, callback: ((info: SidecarLockCompromisedInfo) => void) | undefined, interval: number | undefined, receiver: object, recordTimer?: (timer: NodeJS.Timeout) => void): void;
+}