@openclaw/openshell-sandbox 2026.9.4 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-fallback.js

@@ -1,163 +1,152 @@
 import syncFs, {} from "node:fs";
+import fs, {} from "node:fs/promises";
+import { readBoundedAsync, readBoundedSync } from "./bounded-read.js";
 import { FsSafeError } from "./errors.js";
-import { sameFileIdentity } from "./file-identity.js";
+import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
 import { readOwnedCopySource, readOwnedCopySourceSync } from "./replace-file-copy-source.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { hasErrorCode } from "./file-cleanup.js";
 const SUPPORTS_NOFOLLOW = process.platform !== "win32" && "O_NOFOLLOW" in syncFs.constants;
 const NOFOLLOW = SUPPORTS_NOFOLLOW ? syncFs.constants.O_NOFOLLOW : 0;
 const OPEN_READ_FLAGS = resolveReadOpenFlags();
 const OPEN_READ_WRITE_FLAGS = syncFs.constants.O_RDWR | NOFOLLOW;
 const OPEN_WRITE_EXCLUSIVE_FLAGS = syncFs.constants.O_WRONLY | syncFs.constants.O_CREAT | syncFs.constants.O_EXCL | NOFOLLOW;
-const READ_CHUNK_BYTES = 64 * 1024;
-function notFound(error) {
-    return error.code === "ENOENT";
+function closeSyncAfterAdmissionFailure(fsModule, fd, error) {
+    try {
+        fsModule.closeSync(fd);
+    }
+    catch {
+        // Preserve the already-selected admission failure.
+    }
+    throw error;
 }
-function assertPinnedDestination(pathname, opened, dest, hardlinks) {
-    if (pathname.isSymbolicLink()) {
+function admitDestinationKind(pathname, opened, dest, admission) {
+    if (admission === "hardlinks") {
+        if (pathname.isSymbolicLink() || !pathname.isFile()) {
+            throw new FsSafeError("path-mismatch", `Atomic replace destination changed while opening: ${dest}`);
+        }
+    }
+    else if (pathname.isSymbolicLink()) {
         throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${dest}`);
     }
-    if (!pathname.isFile() || !opened.isFile()) {
+    else if (!pathname.isFile() || !opened.isFile()) {
         throw new FsSafeError("not-file", `Copy fallback destination must be a regular file: ${dest}`);
     }
-    if (!sameFileIdentity(pathname, opened)) {
-        throw new FsSafeError("path-mismatch", `Copy fallback destination changed while opening: ${dest}`);
-    }
-    if (hardlinks === "reject" && opened.nlink > 1) {
-        throw new FsSafeError("hardlink", `Hardlinked copy fallback destination not allowed: ${dest}`);
+    return pathname;
+}
+function assertDestinationLinks(opened, dest, admission, hardlinks) {
+    if ((admission === "hardlinks" || hardlinks === "reject") && opened.nlink > 1n) {
+        throw new FsSafeError("hardlink", `Hardlinked ${admission === "hardlinks" ? "atomic replace" : "copy fallback"} destination not allowed: ${dest}`);
     }
 }
-async function openPinnedDestination(fsModule, dest, hardlinks) {
-    const preview = await fsModule.lstat(dest).catch((error) => {
-        if (notFound(error))
+function inspectPinnedDestinationSync(fsModule, fd, dest, admission, hardlinks) {
+    const opened = inspectFileIdentitySync(() => fsModule.fstatSync(fd, { bigint: true }));
+    inspectFileIdentitySync(() => admitDestinationKind(fsModule.lstatSync(dest, { bigint: true }), opened, dest, admission), opened);
+    assertDestinationLinks(opened, dest, admission, hardlinks);
+}
+async function openPinnedDestination(fsModule, dest, admission, hardlinks) {
+    let preview;
+    try {
+        preview = fsModule === fs ? syncFs.lstatSync(dest) : await fsModule.lstat(dest);
+    }
+    catch (error) {
+        if (hasErrorCode(error, "ENOENT"))
             return null;
         throw error;
-    });
+    }
     if (!preview)
         return null;
-    if (preview.isSymbolicLink()) {
+    if (admission === "hardlinks" && (preview.isSymbolicLink() || !preview.isFile()))
+        return null;
+    if (admission === "restore" && preview.isSymbolicLink()) {
         throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${dest}`);
     }
-    const handle = await fsModule.open(dest, OPEN_READ_WRITE_FLAGS);
+    const handle = await fsModule.open(dest, admission === "restore" ? OPEN_READ_WRITE_FLAGS : OPEN_READ_FLAGS);
     try {
-        const opened = await handle.stat();
-        const current = await fsModule.lstat(dest);
-        assertPinnedDestination(current, opened, dest, hardlinks);
-        return { handle, stat: opened };
+        if (fsModule === fs)
+            inspectPinnedDestinationSync(syncFs, handle.fd, dest, admission, hardlinks);
+        else {
+            const opened = await inspectFileIdentity(() => handle.stat({ bigint: true }));
+            await inspectFileIdentity(async () => admitDestinationKind(await fsModule.lstat(dest, { bigint: true }), opened, dest, admission), opened);
+            assertDestinationLinks(opened, dest, admission, hardlinks);
+        }
+        return handle;
     }
     catch (error) {
-        await handle.close().catch(() => undefined);
+        try {
+            await handle.close();
+        }
+        catch {
+            // Preserve the already-selected admission failure.
+        }
         throw error;
     }
 }
-function openPinnedDestinationSync(fsModule, dest, hardlinks) {
+function openPinnedDestinationSync(fsModule, dest, admission, hardlinks) {
     let preview;
     try {
         preview = fsModule.lstatSync(dest);
     }
     catch (error) {
-        if (notFound(error))
+        if (hasErrorCode(error, "ENOENT"))
             return null;
         throw error;
     }
-    if (preview.isSymbolicLink()) {
+    if (admission === "hardlinks" && (preview.isSymbolicLink() || !preview.isFile()))
+        return null;
+    if (admission === "restore" && preview.isSymbolicLink()) {
         throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${dest}`);
     }
-    const fd = fsModule.openSync(dest, OPEN_READ_WRITE_FLAGS);
+    const fd = fsModule.openSync(dest, admission === "restore" ? OPEN_READ_WRITE_FLAGS : OPEN_READ_FLAGS);
     try {
-        const opened = fsModule.fstatSync(fd);
-        assertPinnedDestination(fsModule.lstatSync(dest), opened, dest, hardlinks);
-        return { fd, stat: opened };
+        inspectPinnedDestinationSync(fsModule, fd, dest, admission, hardlinks);
+        return fd;
     }
     catch (error) {
-        fsModule.closeSync(fd);
-        throw error;
+        closeSyncAfterAdmissionFailure(fsModule, fd, error);
     }
 }
 export async function assertDestinationHardlinkPolicy(fsModule, dest, policy) {
     if (policy !== "reject")
         return;
-    const preview = await fsModule.lstat(dest).catch((error) => {
-        if (notFound(error))
-            return null;
-        throw error;
-    });
-    if (!preview || preview.isSymbolicLink() || !preview.isFile())
+    const handle = await openPinnedDestination(fsModule, dest, "hardlinks");
+    if (!handle)
         return;
-    const handle = await fsModule.open(dest, OPEN_READ_FLAGS);
     try {
-        const opened = await handle.stat();
-        const current = await fsModule.lstat(dest);
-        if (current.isSymbolicLink() || !current.isFile() || !sameFileIdentity(current, opened)) {
-            throw new FsSafeError("path-mismatch", `Atomic replace destination changed while opening: ${dest}`);
-        }
-        if (opened.nlink > 1) {
-            throw new FsSafeError("hardlink", `Hardlinked atomic replace destination not allowed: ${dest}`);
-        }
+        await handle.close();
     }
-    finally {
-        await handle.close().catch(() => undefined);
+    catch {
+        // The asynchronous admission pin has best-effort close semantics.
     }
 }
 export function assertDestinationHardlinkPolicySync(fsModule, dest, policy) {
     if (policy !== "reject")
         return;
-    let preview;
-    try {
-        preview = fsModule.lstatSync(dest);
-    }
-    catch (error) {
-        if (notFound(error))
-            return;
-        throw error;
-    }
-    if (preview.isSymbolicLink() || !preview.isFile())
-        return;
-    const fd = fsModule.openSync(dest, OPEN_READ_FLAGS);
-    try {
-        const opened = fsModule.fstatSync(fd);
-        const current = fsModule.lstatSync(dest);
-        if (current.isSymbolicLink() || !current.isFile() || !sameFileIdentity(current, opened)) {
-            throw new FsSafeError("path-mismatch", `Atomic replace destination changed while opening: ${dest}`);
-        }
-        if (opened.nlink > 1) {
-            throw new FsSafeError("hardlink", `Hardlinked atomic replace destination not allowed: ${dest}`);
-        }
-    }
-    finally {
+    const fd = openPinnedDestinationSync(fsModule, dest, "hardlinks");
+    if (fd !== null)
         fsModule.closeSync(fd);
-    }
 }
-async function readBounded(handle, maxBytes) {
-    const chunks = [];
+function restoreReadOptions(stat, maxBytes) {
+    return {
+        initialSize: Number.isSafeInteger(stat.size) && stat.size >= 0 ? stat.size : undefined,
+        createLimitError: () => new FsSafeError("too-large", `Atomic replace restore snapshot exceeds maxRestoreBytes (${maxBytes})`),
+    };
+}
+async function readRestoreSnapshot(handle, maxBytes, stat) {
     let position = 0;
-    while (position <= maxBytes) {
-        const buffer = Buffer.allocUnsafe(Math.min(READ_CHUNK_BYTES, maxBytes - position + 1));
-        const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);
-        if (bytesRead === 0)
-            break;
+    return await readBoundedAsync(maxBytes, async (buffer, length) => {
+        const { bytesRead } = await handle.read(buffer, 0, length, position);
         position += bytesRead;
-        if (position > maxBytes) {
-            throw new FsSafeError("too-large", `Atomic replace restore snapshot exceeds maxRestoreBytes (${maxBytes})`);
-        }
-        chunks.push(buffer.subarray(0, bytesRead));
-    }
-    return Buffer.concat(chunks, position);
+        return bytesRead;
+    }, restoreReadOptions(stat, maxBytes));
 }
-function readBoundedSync(fsModule, fd, maxBytes) {
-    const chunks = [];
+function readRestoreSnapshotSync(fsModule, fd, maxBytes, stat) {
     let position = 0;
-    while (position <= maxBytes) {
-        const buffer = Buffer.allocUnsafe(Math.min(READ_CHUNK_BYTES, maxBytes - position + 1));
-        const bytesRead = fsModule.readSync(fd, buffer, 0, buffer.length, position);
-        if (bytesRead === 0)
-            break;
+    return readBoundedSync(maxBytes, (buffer, length) => {
+        const bytesRead = fsModule.readSync(fd, buffer, 0, length, position);
         position += bytesRead;
-        if (position > maxBytes) {
-            throw new FsSafeError("too-large", `Atomic replace restore snapshot exceeds maxRestoreBytes (${maxBytes})`);
-        }
-        chunks.push(buffer.subarray(0, bytesRead));
-    }
-    return Buffer.concat(chunks, position);
+        return bytesRead;
+    }, restoreReadOptions(stat, maxBytes));
 }
 async function writeAll(handle, data) {
     await handle.truncate(0);
@@ -184,16 +173,17 @@ function writeAllSync(fsModule, fd, data) {
 function restoreFailure(writeError, cleanup, restoreError) {
     const primary = writeError instanceof Error ? writeError : new Error(String(writeError));
     const details = { cleanup };
-    const cause = restoreError
+    const cause = cleanup === "restore-failed"
         ? new AggregateError([primary, restoreError], "copy fallback and original restoration both failed")
         : primary;
     return new FsSafeError("helper-failed", cleanup === "restored"
         ? `Atomic copy fallback failed; original destination restored: ${primary.message}`
         : `Atomic copy fallback failed and original restoration failed: ${primary.message}`, { cause, details });
 }
-async function replacePinnedWithRestore(handle, replacement, maxRestoreBytes, replacementMode) {
-    const originalMode = (await handle.stat()).mode;
-    const original = await readBounded(handle, maxRestoreBytes);
+async function replacePinnedWithRestore(fsModule, handle, replacement, maxRestoreBytes, replacementMode) {
+    const originalStat = fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
+    const originalMode = originalStat.mode;
+    const original = await readRestoreSnapshot(handle, maxRestoreBytes, originalStat);
     try {
         await writeAll(handle, replacement);
         await handle.chmod(replacementMode);
@@ -215,8 +205,9 @@ async function replacePinnedWithRestore(handle, replacement, maxRestoreBytes, re
     }
 }
 function replacePinnedWithRestoreSync(fsModule, fd, replacement, maxRestoreBytes, replacementMode, fchmodSync) {
-    const originalMode = fsModule.fstatSync(fd).mode;
-    const original = readBoundedSync(fsModule, fd, maxRestoreBytes);
+    const originalStat = fsModule.fstatSync(fd);
+    const originalMode = originalStat.mode;
+    const original = readRestoreSnapshotSync(fsModule, fd, maxRestoreBytes, originalStat);
     try {
         writeAllSync(fsModule, fd, replacement);
         fchmodSync?.(fd, replacementMode);
@@ -245,20 +236,25 @@ export async function copyFallbackReplace(params) {
     });
     const { replacement } = source;
     let destHandle = null;
+    let closeRequiredForSuccess = false;
     try {
         if (params.restore === "restore-original") {
-            const pinned = await openPinnedDestination(params.fsModule, params.dest, params.destinationHardlinks);
+            const pinned = await openPinnedDestination(params.fsModule, params.dest, "restore", params.destinationHardlinks);
             if (pinned) {
-                destHandle = pinned.handle;
-                await replacePinnedWithRestore(destHandle, replacement, params.maxRestoreBytes, source.mode);
+                destHandle = pinned;
+                await replacePinnedWithRestore(params.fsModule, destHandle, replacement, params.maxRestoreBytes, source.mode);
             }
         }
         if (!destHandle) {
-            const destStat = await params.fsModule.lstat(params.dest).catch((error) => {
-                if (notFound(error))
-                    return null;
-                throw error;
-            });
+            let destStat = null;
+            try {
+                destStat = params.fsModule === fs
+                    ? syncFs.lstatSync(params.dest) : await params.fsModule.lstat(params.dest);
+            }
+            catch (error) {
+                if (!hasErrorCode(error, "ENOENT"))
+                    throw error;
+            }
             if (destStat?.isSymbolicLink()) {
                 throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${params.dest}`);
             }
@@ -272,10 +268,20 @@ export async function copyFallbackReplace(params) {
             if (params.sync) {
                 await destHandle.sync();
             }
+            closeRequiredForSuccess = !params.sync;
         }
     }
     finally {
-        await destHandle?.close().catch(() => undefined);
+        if (destHandle) {
+            try {
+                await destHandle.close();
+            }
+            catch (closeError) {
+                if (closeRequiredForSuccess) {
+                    throw closeError;
+                }
+            }
+        }
     }
 }
 export function copyFallbackReplaceSync(params) {
@@ -286,11 +292,12 @@ export function copyFallbackReplaceSync(params) {
     });
     const { replacement } = source;
     let destFd;
+    let closeRequiredForSuccess = false;
     try {
         if (params.restore === "restore-original") {
-            const pinned = openPinnedDestinationSync(params.fsModule, params.dest, params.destinationHardlinks);
-            if (pinned) {
-                destFd = pinned.fd;
+            const pinned = openPinnedDestinationSync(params.fsModule, params.dest, "restore", params.destinationHardlinks);
+            if (pinned !== null) {
+                destFd = pinned;
                 replacePinnedWithRestoreSync(params.fsModule, destFd, replacement, params.maxRestoreBytes, source.mode, params.fchmodSync);
             }
         }
@@ -300,7 +307,7 @@ export function copyFallbackReplaceSync(params) {
                 destStat = params.fsModule.lstatSync(params.dest);
             }
             catch (error) {
-                if (!notFound(error))
+                if (!hasErrorCode(error, "ENOENT"))
                     throw error;
             }
             if (destStat?.isSymbolicLink()) {
@@ -316,6 +323,7 @@ export function copyFallbackReplaceSync(params) {
             if (params.sync) {
                 params.fsModule.fsyncSync(destFd);
             }
+            closeRequiredForSuccess = !params.sync;
         }
     }
     finally {
@@ -323,8 +331,10 @@ export function copyFallbackReplaceSync(params) {
             try {
                 params.fsModule.closeSync(destFd);
             }
-            catch {
-                // Best-effort close after fallback replacement.
+            catch (closeError) {
+                if (closeRequiredForSuccess) {
+                    throw closeError;
+                }
             }
         }
     }

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-source.d.ts

@@ -18,4 +18,3 @@ export declare function readOwnedCopySourceSync(params: {
     mode: number;
 };
 export {};
-//# sourceMappingURL=replace-file-copy-source.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-source.js

@@ -1,10 +1,11 @@
 import syncFs, {} from "node:fs";
+import fs, {} from "node:fs/promises";
+import { readBoundedSync } from "./bounded-read.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { FsSafeError } from "./errors.js";
-import { sameFileIdentity } from "./file-identity.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
+import { hasErrorCode } from "./file-cleanup.js";
 const OPEN_READ_FLAGS = resolveReadOpenFlags();
-const READ_CHUNK_BYTES = 64 * 1024;
 function assertSourcePreview(source, src) {
     if (source.isSymbolicLink()) {
         throw new FsSafeError("symlink", `Refusing copy fallback from non-file source: ${src}`);
@@ -16,6 +17,14 @@ function assertSourcePreview(source, src) {
         throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${src}`);
     }
 }
+function assertOpenedSource(opened, current, src) {
+    if (!opened.isFile() || current.isSymbolicLink()) {
+        throw new FsSafeError("path-mismatch", `Copy fallback source changed while opening: ${src}`);
+    }
+    if (opened.nlink !== 1n) {
+        throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${src}`);
+    }
+}
 function sourceSymlinkError(src, cause) {
     return new FsSafeError("symlink", `Refusing copy fallback from non-file source: ${src}`, {
         cause,
@@ -26,7 +35,7 @@ async function openSource(fsModule, src) {
         return await fsModule.open(src, OPEN_READ_FLAGS);
     }
     catch (error) {
-        if (error.code === "ELOOP") {
+        if (hasErrorCode(error, "ELOOP")) {
             throw sourceSymlinkError(src, error);
         }
         throw error;
@@ -37,64 +46,49 @@ function openSourceSync(fsModule, src) {
         return fsModule.openSync(src, OPEN_READ_FLAGS);
     }
     catch (error) {
-        if (error.code === "ELOOP") {
+        if (hasErrorCode(error, "ELOOP")) {
             throw sourceSymlinkError(src, error);
         }
         throw error;
     }
 }
-function readAllSync(fsModule, fd) {
-    const chunks = [];
+function readAllSync(fsModule, fd, size) {
     let position = 0;
-    while (true) {
-        const buffer = Buffer.allocUnsafe(READ_CHUNK_BYTES);
-        const bytesRead = fsModule.readSync(fd, buffer, 0, buffer.length, position);
-        if (bytesRead === 0)
-            break;
+    return readBoundedSync(Infinity, (buffer, length) => {
+        const bytesRead = fsModule.readSync(fd, buffer, 0, length, position);
         position += bytesRead;
-        chunks.push(buffer.subarray(0, bytesRead));
-    }
-    return Buffer.concat(chunks, position);
+        return bytesRead;
+    }, { initialSize: Number.isSafeInteger(size) && size >= 0 ? size : undefined });
 }
 export async function readOwnedCopySource(params) {
-    assertSourcePreview(await params.fsModule.lstat(params.src), params.src);
+    assertSourcePreview(params.fsModule === fs
+        ? syncFs.lstatSync(params.src) : await params.fsModule.lstat(params.src), params.src);
     const handle = await openSource(params.fsModule, params.src);
     try {
-        if (params.expectedIdentity) {
-            const exact = await inspectFileIdentity(() => handle.stat({ bigint: true }), params.expectedIdentity);
-            await inspectFileIdentity(() => params.fsModule.lstat(params.src, { bigint: true }), exact);
-        }
-        const opened = await handle.stat();
-        const current = await params.fsModule.lstat(params.src);
-        if (!opened.isFile() || current.isSymbolicLink() || !sameFileIdentity(opened, current)) {
-            throw new FsSafeError("path-mismatch", `Copy fallback source changed while opening: ${params.src}`);
-        }
-        if (opened.nlink !== 1) {
-            throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${params.src}`);
-        }
-        return { replacement: await handle.readFile(), mode: opened.mode };
+        const opened = await inspectFileIdentity(() => params.fsModule === fs
+            ? syncFs.fstatSync(handle.fd, { bigint: true }) : handle.stat({ bigint: true }), params.expectedIdentity);
+        const current = await inspectFileIdentity(() => params.fsModule === fs
+            ? syncFs.lstatSync(params.src, { bigint: true }) : params.fsModule.lstat(params.src, { bigint: true }), opened);
+        assertOpenedSource(opened, current, params.src);
+        return { replacement: await handle.readFile(), mode: Number(opened.mode) };
     }
     finally {
-        await handle.close().catch(() => undefined);
+        try {
+            await handle.close();
+        }
+        catch {
+            // Best-effort close includes synchronous adapter throws.
+        }
     }
 }
 export function readOwnedCopySourceSync(params) {
     assertSourcePreview(params.fsModule.lstatSync(params.src), params.src);
     const fd = openSourceSync(params.fsModule, params.src);
     try {
-        if (params.expectedIdentity) {
-            const exact = inspectFileIdentitySync(() => params.fsModule.fstatSync(fd, { bigint: true }), params.expectedIdentity);
-            inspectFileIdentitySync(() => params.fsModule.lstatSync(params.src, { bigint: true }), exact);
-        }
-        const opened = params.fsModule.fstatSync(fd);
-        const current = params.fsModule.lstatSync(params.src);
-        if (!opened.isFile() || current.isSymbolicLink() || !sameFileIdentity(opened, current)) {
-            throw new FsSafeError("path-mismatch", `Copy fallback source changed while opening: ${params.src}`);
-        }
-        if (opened.nlink !== 1) {
-            throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${params.src}`);
-        }
-        return { replacement: readAllSync(params.fsModule, fd), mode: opened.mode };
+        const opened = inspectFileIdentitySync(() => params.fsModule.fstatSync(fd, { bigint: true }), params.expectedIdentity);
+        const current = inspectFileIdentitySync(() => params.fsModule.lstatSync(params.src, { bigint: true }), opened);
+        assertOpenedSource(opened, current, params.src);
+        return { replacement: readAllSync(params.fsModule, fd, Number(opened.size)), mode: Number(opened.mode) };
     }
     finally {
         try {

package/node_modules/@openclaw/fs-safe/dist/replace-file-descriptor.d.ts

@@ -48,4 +48,3 @@ export declare function writeTempFileSync(params: {
     identity: BigIntStats;
 };
 export {};
-//# sourceMappingURL=replace-file-descriptor.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/replace-file-descriptor.js

@@ -2,9 +2,8 @@ import { syncFileBestEffort, syncFileBestEffortSync } from "./file-sync.js";
 import syncFs, {} from "node:fs";
 import fs, {} from "node:fs/promises";
 import { FsSafeError } from "./errors.js";
-import { sameFileIdentity } from "./file-identity.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
-import { assertOwnedDirectory, ownDirectoryMode } from "./directory-mode-owner.js";
+import { ownDirectoryMode } from "./directory-mode-owner.js";
 export async function syncDirectoryBestEffort(fsModule, dirPath) {
     let handle;
     try {
@@ -15,7 +14,12 @@ export async function syncDirectoryBestEffort(fsModule, dirPath) {
         // Best-effort on platforms/filesystems that do not support directory fsync.
     }
     finally {
-        await handle?.close().catch(() => undefined);
+        try {
+            await handle?.close();
+        }
+        catch {
+            // Best-effort close also covers synchronous adapter throws.
+        }
     }
 }
 export function syncDirectoryBestEffortSync(fsModule, dirPath) {
@@ -48,12 +52,7 @@ function assertDirectory(identity, dirPath) {
     if (identity.isSymbolicLink() || !identity.isDirectory()) {
         throw new FsSafeError("not-file", `Atomic replace parent must be a real directory: ${dirPath}`);
     }
-}
-function assertSameDirectory(expected, opened, dirPath) {
-    assertDirectory(opened, dirPath);
-    if (!sameFileIdentity(expected, opened)) {
-        throw new FsSafeError("path-mismatch", `Atomic replace parent changed before its mode could be applied: ${dirPath}`);
-    }
+    return identity;
 }
 export async function pinDirectoryForMode(params) {
     // Node does not enforce POSIX directory modes on Windows, and its directory
@@ -63,15 +62,16 @@ export async function pinDirectoryForMode(params) {
         return;
     }
     const expected = params.fsModule === fs
-        ? syncFs.lstatSync(params.dirPath) : await params.fsModule.lstat(params.dirPath);
-    assertDirectory(expected, params.dirPath);
+        ? inspectFileIdentitySync(() => assertDirectory(syncFs.lstatSync(params.dirPath, { bigint: true }), params.dirPath))
+        : await inspectFileIdentity(async () => assertDirectory(await params.fsModule.lstat(params.dirPath, { bigint: true }), params.dirPath));
     const handle = await params.fsModule.open(params.dirPath, directoryOpenFlags());
     try {
         const owner = ownDirectoryMode({
             async inspect() {
-                const opened = params.fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
-                assertOwnedDirectory(expected, opened);
-                return opened.mode & 0o7777;
+                const opened = params.fsModule === fs
+                    ? inspectFileIdentitySync(() => assertDirectory(syncFs.fstatSync(handle.fd, { bigint: true }), params.dirPath), expected)
+                    : await inspectFileIdentity(async () => assertDirectory(await handle.stat({ bigint: true }), params.dirPath), expected);
+                return Number(opened.mode & 4095n);
             },
             chmod: (mode) => handle.chmod(mode),
             close: () => handle.close(),
@@ -98,11 +98,10 @@ export function applyDirectoryModeSync(params) {
     if (process.platform === "win32") {
         return;
     }
-    const expected = params.fsModule.lstatSync(params.dirPath);
-    assertDirectory(expected, params.dirPath);
+    const expected = inspectFileIdentitySync(() => assertDirectory(params.fsModule.lstatSync(params.dirPath, { bigint: true }), params.dirPath));
     const fd = params.fsModule.openSync(params.dirPath, directoryOpenFlags());
     try {
-        assertSameDirectory(expected, params.fsModule.fstatSync(fd), params.dirPath);
+        inspectFileIdentitySync(() => assertDirectory(params.fsModule.fstatSync(fd, { bigint: true }), params.dirPath), expected);
         // chmod ignores file-type bits; mask so raw stat modes are tolerated.
         params.fchmodSync?.(fd, params.mode & 0o7777);
     }

package/node_modules/@openclaw/fs-safe/dist/replace-file-mode.d.ts

@@ -0,0 +1,2 @@
+import type { Stats } from "node:fs";
+export declare function inheritedRegularFileMode(stat: Stats): number;

package/node_modules/@openclaw/fs-safe/dist/replace-file-mode.js

@@ -0,0 +1,10 @@
+import { FsSafeError } from "./errors.js";
+export function inheritedRegularFileMode(stat) {
+    if (stat.isSymbolicLink()) {
+        throw new FsSafeError("symlink", "atomic replace destination must not be a symbolic link");
+    }
+    if (!stat.isFile()) {
+        throw new FsSafeError("not-file", "atomic replace destination must be a regular file");
+    }
+    return stat.mode & 0o777;
+}

package/node_modules/@openclaw/fs-safe/dist/replace-file-rename-policy.d.ts

@@ -1,7 +1,5 @@
-import type { RenameIdentityPolicy } from "./pinned-write.js";
-export type { RenameIdentityPolicy };
+import type { RenameIdentityPolicy } from "./pinned-write-types.js";
 export declare function validateRenameIdentity(policy: RenameIdentityPolicy | undefined): void;
 export declare function atomicExpectedContentHash(policy: RenameIdentityPolicy | undefined, content: string | Uint8Array): string | undefined;
 export declare function withAtomicRenameIdentityLock<T>(filePath: string, fn: () => Promise<T>): Promise<T>;
 export declare function withAtomicRenameIdentityLockSync<T>(filePath: string, fn: () => T): T;
-//# sourceMappingURL=replace-file-rename-policy.d.ts.map