@openclaw/openshell-sandbox 2026.9.4 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/move-path-cleanup.d.ts

@@ -1,17 +1,11 @@
-export type EntryIdentity = {
-    ctimeMs: number;
-    dev: number;
-    ino: number;
-    mode: number;
-    mtimeMs: number;
-    nlink: number;
-    size: number;
-};
+import fsSync from "node:fs";
+export type EntryIdentity = Readonly<Pick<fsSync.BigIntStats, "ctimeNs" | "dev" | "ino" | "mode" | "mtimeNs" | "nlink" | "size">>;
 export type CopiedEntryManifest = (EntryIdentity & {
     children: Array<{
         name: string;
         manifest: CopiedEntryManifest;
     }>;
+    directoryIdentity: Readonly<Pick<fsSync.BigIntStats, "dev" | "ino">>;
     kind: "directory";
 }) | (EntryIdentity & {
     kind: "leaf";
@@ -25,19 +19,12 @@ type CleanupAliasGroup = {
 export type CleanupCopiedEntryState = {
     aliasGroups: Map<string, CleanupAliasGroup>;
 };
-export declare function entryIdentity(stat: {
-    ctimeMs: number;
-    dev: number;
-    ino: number;
-    mode: number;
-    mtimeMs: number;
-    nlink: number;
-    size: number;
-}): EntryIdentity;
+export declare function entryIdentity(stat: EntryIdentity): EntryIdentity;
 export declare function sameIdentity(a: EntryIdentity, b: EntryIdentity): boolean;
 export declare function sourceChangedError(sourcePath: string): Error;
+export declare function inspectSourceEntry(sourcePath: string, observe: () => fsSync.BigIntStats): fsSync.BigIntStats;
+export declare function inspectSourceDirectory(sourcePath: string, expected?: Pick<fsSync.BigIntStats, "dev" | "ino">): fsSync.BigIntStats;
 export declare function assertSourceStillMatches(sourcePath: string, identity: EntryIdentity): Promise<void>;
 export declare function createCleanupCopiedEntryState(sourcePath: string, manifest: CopiedEntryManifest): CleanupCopiedEntryState;
-export declare function cleanupCopiedEntry(sourcePath: string, manifest: CopiedEntryManifest, state: CleanupCopiedEntryState, assertBeforeMutation: () => void): Promise<CleanupCopiedEntryResult>;
+export declare function cleanupCopiedEntry(sourcePath: string, manifest: CopiedEntryManifest, state: CleanupCopiedEntryState, assertBeforeMutation: (() => void) | undefined): Promise<CleanupCopiedEntryResult>;
 export {};
-//# sourceMappingURL=move-path-cleanup.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/move-path-cleanup.js

@@ -1,12 +1,16 @@
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
 export function entryIdentity(stat) {
     return {
-        ctimeMs: stat.ctimeMs,
+        ctimeNs: stat.ctimeNs,
         dev: stat.dev,
         ino: stat.ino,
         mode: stat.mode,
-        mtimeMs: stat.mtimeMs,
+        mtimeNs: stat.mtimeNs,
         nlink: stat.nlink,
         size: stat.size,
     };
@@ -17,19 +21,32 @@ export function sameIdentity(a, b) {
         a.mode === b.mode &&
         a.nlink === b.nlink &&
         a.size === b.size &&
-        a.mtimeMs === b.mtimeMs &&
-        a.ctimeMs === b.ctimeMs);
-}
-function sameDirectoryNode(a, b) {
-    return a.dev === b.dev && a.ino === b.ino;
+        a.mtimeNs === b.mtimeNs &&
+        a.ctimeNs === b.ctimeNs);
 }
 export function sourceChangedError(sourcePath) {
     return Object.assign(new Error(`Source changed during move fallback: ${sourcePath}`), {
         code: "ESTALE",
     });
 }
+export function inspectSourceEntry(sourcePath, observe) {
+    return inspectFileIdentitySync(observe, undefined, process.platform, () => sourceChangedError(sourcePath));
+}
+export function inspectSourceDirectory(sourcePath, expected) {
+    try {
+        return inspectDirectoryIdentitySync(sourcePath, expected);
+    }
+    catch (error) {
+        const code = error?.code;
+        if (code === "ENOENT" || code === "ENOTDIR" ||
+            (error instanceof FsSafeError && (error.code === "path-mismatch" || error.code === "not-file"))) {
+            throw sourceChangedError(sourcePath);
+        }
+        throw error;
+    }
+}
 export async function assertSourceStillMatches(sourcePath, identity) {
-    if (!sameIdentity(identity, entryIdentity(await fs.lstat(sourcePath)))) {
+    if (!sameIdentity(identity, inspectSourceEntry(sourcePath, () => fsSync.lstatSync(sourcePath, { bigint: true })))) {
         throw sourceChangedError(sourcePath);
     }
 }
@@ -43,7 +60,7 @@ function collectAliasCandidates(sourcePath, manifest, candidates) {
         }
         return;
     }
-    if (manifest.nlink <= 1) {
+    if (manifest.nlink <= 1n) {
         return;
     }
     const key = identityKey(manifest);
@@ -76,15 +93,26 @@ function sameOwnedUnlinkTransition(before, after) {
         before.ino === after.ino &&
         before.mode === after.mode &&
         before.size === after.size &&
-        before.mtimeMs === after.mtimeMs &&
-        before.nlink > 0 &&
-        after.nlink === before.nlink - 1 &&
-        after.ctimeMs >= before.ctimeMs);
+        before.mtimeNs === after.mtimeNs &&
+        before.nlink > 0n &&
+        after.nlink === before.nlink - 1n &&
+        after.ctimeNs >= before.ctimeNs);
 }
 function poisonAliasGroup(group) {
     group.stale = true;
     return "stale";
 }
+function inspectCleanupLeaf(sourcePath, expected) {
+    let mismatch;
+    try {
+        return inspectFileIdentitySync(() => fsSync.lstatSync(sourcePath, { bigint: true }), expected, process.platform, () => mismatch = sourceChangedError(sourcePath));
+    }
+    catch (error) {
+        if (mismatch !== undefined && error === mismatch)
+            return undefined;
+        throw error;
+    }
+}
 async function observeOwnedAliasUnlink(sourcePath, group) {
     group.remainingPaths.delete(sourcePath);
     const remainingPath = group.remainingPaths.values().next().value;
@@ -93,7 +121,7 @@ async function observeOwnedAliasUnlink(sourcePath, group) {
     }
     let observed;
     try {
-        observed = await fs.lstat(remainingPath);
+        observed = inspectCleanupLeaf(remainingPath, group.expected);
     }
     catch (error) {
         if (error?.code === "ENOENT") {
@@ -101,42 +129,58 @@ async function observeOwnedAliasUnlink(sourcePath, group) {
         }
         throw error;
     }
-    const observedIdentity = entryIdentity(observed);
-    if (!sameOwnedUnlinkTransition(group.expected, observedIdentity)) {
+    if (!observed || !sameOwnedUnlinkTransition(group.expected, observed)) {
         return poisonAliasGroup(group);
     }
-    group.expected = observedIdentity;
+    group.expected = entryIdentity(observed);
     return "removed";
 }
 function mergeCleanupResults(a, b) {
     return a === "stale" || b === "stale" ? "stale" : "removed";
 }
 export async function cleanupCopiedEntry(sourcePath, manifest, state, assertBeforeMutation) {
-    const aliasGroup = manifest.kind === "leaf" ? state.aliasGroups.get(identityKey(manifest)) : undefined;
-    if (aliasGroup?.stale) {
-        return "stale";
-    }
-    let currentStat;
-    try {
-        currentStat = await fs.lstat(sourcePath);
-    }
-    catch (error) {
-        if (error?.code === "ENOENT") {
-            return aliasGroup ? poisonAliasGroup(aliasGroup) : "removed";
-        }
-        throw error;
-    }
     if (manifest.kind === "directory") {
-        if (!currentStat.isDirectory() || !sameDirectoryNode(manifest, entryIdentity(currentStat))) {
+        let currentStat;
+        try {
+            currentStat = inspectFileIdentitySync(() => fsSync.lstatSync(sourcePath, { bigint: true }), manifest.directoryIdentity);
+        }
+        catch (error) {
+            if (error?.code === "ENOENT")
+                return "removed";
+            if (error instanceof FsSafeError && error.code === "path-mismatch")
+                return "stale";
+            throw error;
+        }
+        if (!currentStat.isDirectory()) {
             return "stale";
         }
         // A same-inode directory can gain unrelated children after commit. Still
         // clean manifest children so the fallback does not duplicate copied files.
         let result = "removed";
+        const assertBeforeChildMutation = assertBeforeMutation ? () => {
+            assertBeforeMutation();
+            inspectSourceDirectory(sourcePath, manifest.directoryIdentity);
+        } : undefined;
         for (const child of manifest.children) {
-            result = mergeCleanupResults(result, await cleanupCopiedEntry(path.join(sourcePath, child.name), child.manifest, state, assertBeforeMutation));
+            result = mergeCleanupResults(result, await cleanupCopiedEntry(path.join(sourcePath, child.name), child.manifest, state, assertBeforeChildMutation));
+        }
+        // Child cleanup and the caller's authority check can replace the directory.
+        // Keep the final exact observation after both, immediately before removal.
+        assertBeforeMutation?.();
+        try {
+            currentStat = inspectFileIdentitySync(() => fsSync.lstatSync(sourcePath, { bigint: true }), manifest.directoryIdentity);
+        }
+        catch (error) {
+            if (error?.code === "ENOENT") {
+                return "stale";
+            }
+            if (error instanceof FsSafeError && error.code === "path-mismatch")
+                return "stale";
+            throw error;
+        }
+        if (!currentStat.isDirectory()) {
+            return "stale";
         }
-        assertBeforeMutation();
         try {
             await fs.rmdir(sourcePath);
         }
@@ -149,11 +193,30 @@ export async function cleanupCopiedEntry(sourcePath, manifest, state, assertBefo
         }
         return result;
     }
+    const aliasGroup = state.aliasGroups.get(identityKey(manifest));
+    if (aliasGroup?.stale) {
+        return "stale";
+    }
     const expected = aliasGroup?.expected ?? manifest;
-    if (!sameIdentity(expected, entryIdentity(currentStat))) {
-        return aliasGroup ? poisonAliasGroup(aliasGroup) : "stale";
+    let currentStat;
+    try {
+        currentStat = inspectCleanupLeaf(sourcePath, expected);
+    }
+    catch (error) {
+        if (error?.code === "ENOENT") {
+            return aliasGroup ? poisonAliasGroup(aliasGroup) : "removed";
+        }
+        throw error;
+    }
+    for (let observation = 0;; observation++) {
+        if (!currentStat || !sameIdentity(expected, currentStat)) {
+            return aliasGroup ? poisonAliasGroup(aliasGroup) : "stale";
+        }
+        if (observation || !assertBeforeMutation)
+            break;
+        assertBeforeMutation();
+        currentStat = inspectCleanupLeaf(sourcePath, expected);
     }
-    assertBeforeMutation();
     await fs.unlink(sourcePath);
     return aliasGroup
         ? await observeOwnedAliasUnlink(sourcePath, aliasGroup)

package/node_modules/@openclaw/fs-safe/dist/move-path-stage.d.ts

@@ -0,0 +1,7 @@
+import { type BigIntStats } from "node:fs";
+export declare function createMoveStageOwner(staged: string): Promise<{
+    record(created: BigIntStats): void;
+    assertCurrent: () => void;
+    published(): void;
+    cleanup(): Promise<void>;
+}>;

package/node_modules/@openclaw/fs-safe/dist/move-path-stage.js

@@ -0,0 +1,56 @@
+import fsSync, {} from "node:fs";
+import path from "node:path";
+import { createAsyncDirectoryGuard } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { guardedRm, guardedRmSync } from "./guarded-mutation.js";
+import { sameFileIdentityForCleanup } from "./file-identity.js";
+import { registerTempPathForExit } from "./temp-cleanup.js";
+import { realpathSync } from "./realpath.js";
+export async function createMoveStageOwner(staged) {
+    const parent = await createAsyncDirectoryGuard(path.dirname(staged), { bigint: true });
+    let identity;
+    let unregister;
+    const changed = () => new FsSafeError("path-mismatch", "move staging path changed before publication");
+    const assertParent = () => {
+        const current = fsSync.lstatSync(parent.dir, { bigint: true });
+        if (!current.isDirectory() || current.isSymbolicLink() ||
+            !sameFileIdentityForCleanup(current, parent.stat) ||
+            realpathSync.native(parent.dir) !== parent.realPath)
+            throw changed();
+    };
+    const assertCurrent = () => {
+        assertParent();
+        if (!identity || !sameFileIdentityForCleanup(fsSync.lstatSync(staged, { bigint: true }), identity)) {
+            throw changed();
+        }
+    };
+    return {
+        record(created) {
+            if (!sameFileIdentityForCleanup(created, created))
+                throw changed();
+            identity = created;
+            unregister = registerTempPathForExit(staged, {
+                identity,
+                cleanupSync: () => {
+                    guardedRmSync({ target: staged, recursive: created.isDirectory(), assertBeforeMutation: assertCurrent });
+                },
+            });
+        },
+        assertCurrent,
+        published() { unregister?.(); },
+        async cleanup() {
+            if (!identity)
+                return;
+            try {
+                await guardedRm({ target: staged, recursive: identity.isDirectory(), assertBeforeMutation: assertCurrent });
+                unregister?.();
+            }
+            catch (error) {
+                if (error.code === "ENOENT" || error instanceof FsSafeError) {
+                    unregister?.();
+                }
+                // Retry only the original receipt after transient cleanup I/O failures.
+            }
+        },
+    };
+}

package/node_modules/@openclaw/fs-safe/dist/move-path.d.ts

@@ -18,4 +18,3 @@ type MoveCopyFallbackReason = "cross-device" | "windows-rename-denied";
 export declare function moveCopyFallbackReasonForRenameError(error: unknown, platform?: NodeJS.Platform): MoveCopyFallbackReason | undefined;
 export declare function movePathWithCopyFallback(options: MovePathWithCopyFallbackOptions): Promise<void>;
 export {};
-//# sourceMappingURL=move-path.d.ts.map