@openclaw/openshell-sandbox 2026.9.5 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/replace-directory.js

@@ -1,12 +1,93 @@
 import { randomUUID } from "node:crypto";
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { guardedRename, guardedRm } from "./guarded-mutation.js";
+import { assertSyncDirectoryGuard, createAsyncDirectoryGuard, inspectDirectoryIdentitySync, } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { classifyNativeRenameFailure, NATIVE_RENAME_SOURCE_IDENTITY_MISMATCH, } from "./native-rename-outcome.js";
 import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
+import { RetainedDirectoryReplacement } from "./retained-directory-replacement.js";
 import { assertSafePathPrefix } from "./safe-path-segment.js";
-import { admitStandalonePublicationPath } from "./standalone-publication-path.js";
+import { admitStandalonePublicationPath, assertNoWindowsPathAlias } from "./windows-path-alias.js";
 import { serializePathWrite } from "./write-queue.js";
-import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
+function distinctGuards(source, target) {
+    return source === target ? [source] : [source, target];
+}
+function assertGuardsCurrent(guards) {
+    for (const guard of guards)
+        assertSyncDirectoryGuard(guard);
+}
+function copyOperationalCode(target, source) {
+    const code = source?.code;
+    if (typeof code === "string") {
+        Object.defineProperty(target, "code", { configurable: true, value: code });
+    }
+}
+function replacementFailure(error, message, details) {
+    if (error instanceof FsSafeError) {
+        return new FsSafeError(error.code, message, { cause: error, details });
+    }
+    const failure = new Error(message, { cause: error });
+    copyOperationalCode(failure, error);
+    Object.defineProperty(failure, "details", { configurable: true, value: details });
+    return failure;
+}
+function replacementAggregate(error, recoveryError, message, details) {
+    const combined = new AggregateError([error, recoveryError], "directory replacement operation and recovery both failed");
+    if (error instanceof FsSafeError) {
+        return new FsSafeError(error.code, message, { cause: combined, details });
+    }
+    const failure = new Error(message, { cause: combined });
+    copyOperationalCode(failure, error);
+    Object.defineProperty(failure, "details", { configurable: true, value: details });
+    return failure;
+}
+function isMissingDirectoryEntry(error) {
+    return error?.code === "ENOENT";
+}
+function observeOptionalDirectory(pathname) {
+    let initial;
+    try {
+        initial = fsSync.lstatSync(pathname, { bigint: true });
+    }
+    catch (error) {
+        if (isMissingDirectoryEntry(error))
+            return undefined;
+        throw error;
+    }
+    return inspectDirectoryIdentitySync(pathname, undefined, initial);
+}
+function normalizeNativeRenameFailure(error) {
+    const code = error?.code;
+    if (code === NATIVE_RENAME_SOURCE_IDENTITY_MISMATCH) {
+        return new FsSafeError("path-mismatch", "directory replacement source identity changed before native rename", { cause: error });
+    }
+    if (code === "EINVAL" || code === "ENOSYS" || code === "ENOTSUP" ||
+        code === "EOPNOTSUPP") {
+        return new FsSafeError("helper-unavailable", "native no-replace directory rename is unavailable on this filesystem", { cause: error });
+    }
+    return error;
+}
+function renameRetainedDirectory(params) {
+    const guards = distinctGuards(params.sourceParent, params.targetParent);
+    assertGuardsCurrent(guards);
+    const initial = fsSync.lstatSync(params.from, { bigint: true });
+    const identity = inspectDirectoryIdentitySync(params.from, params.expectedSource, initial);
+    try {
+        params.renameNoReplace(identity);
+    }
+    catch (error) {
+        if (classifyNativeRenameFailure(error) === "indeterminate") {
+            params.onIndeterminate();
+        }
+        throw normalizeNativeRenameFailure(error);
+    }
+    // Record the transition synchronously before any post-rename observation.
+    params.onRenamed?.(identity);
+    inspectDirectoryIdentitySync(params.to, identity);
+    assertGuardsCurrent(guards);
+    return identity;
+}
 export async function replaceDirectoryAtomic(options) {
     const stagedDirInput = admitStandalonePublicationPath(options.stagedDir, "staged directory uses a Windows filesystem namespace alias");
     const targetDirInput = admitStandalonePublicationPath(options.targetDir, "target directory uses a Windows filesystem namespace alias");
@@ -23,28 +104,184 @@ async function replaceDirectoryAtomicUnserialized(stagedDir, targetDir, backupPr
     const parentDir = path.dirname(targetDir);
     const backupPrefix = assertSafePathPrefix(backupPrefixInput ?? ".fs-safe-dir-backup-", { label: "atomic directory backup prefix" });
     const backupDir = path.join(parentDir, `${backupPrefix}${process.pid}-${randomUUID()}`);
-    let backupCreated = false;
+    const backup = {
+        identity: undefined,
+        transition: "not-renamed",
+    };
+    const publication = {
+        status: "not-published",
+    };
+    let operationFailed = false;
+    let operationError;
+    let operationDetails = {
+        phase: "backup",
+        publication: publication.status,
+        recovery: "none",
+    };
+    const retainedBinding = RetainedDirectoryReplacement.requireBinding();
     await fs.mkdir(recursiveMkdirPath(parentDir), { recursive: true });
+    const targetParent = await createAsyncDirectoryGuard(parentDir, { bigint: true });
+    const stagedParentDir = path.dirname(stagedDir);
+    const stagedParent = stagedParentDir === parentDir
+        ? targetParent
+        : await createAsyncDirectoryGuard(stagedParentDir, { bigint: true });
+    const stagedIdentity = inspectDirectoryIdentitySync(stagedDir);
+    const targetIdentity = observeOptionalDirectory(targetDir);
+    const retained = RetainedDirectoryReplacement.retain({
+        targetParent: {
+            path: parentDir,
+            realPath: targetParent.realPath,
+            identity: targetParent.stat,
+        },
+        stagedParent: {
+            path: stagedParentDir,
+            realPath: stagedParent.realPath,
+            identity: stagedParent.stat,
+        },
+        ...(targetIdentity ? {
+            originalTarget: { path: targetDir, identity: targetIdentity },
+        } : {}),
+    }, retainedBinding);
+    const targetBasename = path.basename(targetDir);
+    const stagedBasename = path.basename(stagedDir);
+    const backupBasename = path.basename(backupDir);
+    const details = (phase, recovery) => {
+        operationDetails = {
+            phase,
+            publication: publication.status,
+            recovery,
+            ...(backup.transition === "not-renamed" ? {} : { backupPath: backupDir }),
+        };
+        return operationDetails;
+    };
+    const rollback = (error, failedPhase, identity) => {
+        const rollbackState = {
+            transition: "not-renamed",
+        };
+        try {
+            renameRetainedDirectory({
+                from: backupDir,
+                to: targetDir,
+                sourceParent: targetParent,
+                targetParent,
+                expectedSource: identity,
+                renameNoReplace: expectedSource => {
+                    retained.renameNoReplace("target", backupBasename, targetBasename, expectedSource);
+                },
+                onIndeterminate() {
+                    rollbackState.transition = "indeterminate";
+                    backup.transition = "indeterminate";
+                },
+                onRenamed() {
+                    rollbackState.transition = "renamed";
+                    backup.transition = "not-renamed";
+                },
+            });
+        }
+        catch (rollbackError) {
+            const recovery = rollbackState.transition === "renamed"
+                ? "restored-unverified"
+                : rollbackState.transition === "indeterminate"
+                    ? "indeterminate"
+                    : "backup-path-preserved";
+            throw replacementAggregate(error, rollbackError, `directory ${failedPhase} and rollback failed`, details("rollback", recovery));
+        }
+        throw replacementFailure(error, `directory ${failedPhase} failed after restoring the original target`, details(failedPhase, "restored"));
+    };
     try {
-        await guardedRename({ from: targetDir, to: backupDir });
-        backupCreated = true;
-    }
-    catch (err) {
-        if (err.code !== "ENOENT") {
-            throw err;
+        if (targetIdentity) {
+            try {
+                backup.identity = renameRetainedDirectory({
+                    from: targetDir,
+                    to: backupDir,
+                    sourceParent: targetParent,
+                    targetParent,
+                    expectedSource: targetIdentity,
+                    renameNoReplace: expectedSource => {
+                        retained.renameNoReplace("target", targetBasename, backupBasename, expectedSource);
+                    },
+                    onIndeterminate() {
+                        backup.transition = "indeterminate";
+                    },
+                    onRenamed(identity) {
+                        backup.identity = identity;
+                        backup.transition = "renamed";
+                    },
+                });
+            }
+            catch (err) {
+                if (backup.transition === "renamed" && backup.identity) {
+                    rollback(err, "backup", backup.identity);
+                }
+                const recovery = backup.transition === "indeterminate" ? "indeterminate" : "none";
+                throw replacementFailure(err, "directory backup failed before publication", details("backup", recovery));
+            }
+        }
+        try {
+            renameRetainedDirectory({
+                from: stagedDir,
+                to: targetDir,
+                sourceParent: stagedParent,
+                targetParent,
+                expectedSource: stagedIdentity,
+                renameNoReplace: expectedSource => {
+                    retained.renameNoReplace("staged", stagedBasename, targetBasename, expectedSource);
+                },
+                onIndeterminate() {
+                    publication.status = "indeterminate";
+                },
+                onRenamed() {
+                    publication.status = "published";
+                },
+            });
+        }
+        catch (err) {
+            if (publication.status === "published") {
+                throw replacementFailure(err, "published directory failed retained identity verification", details("publish", backup.transition === "renamed" ? "backup-path-preserved" : "none"));
+            }
+            if (publication.status === "indeterminate") {
+                throw replacementFailure(err, "directory publication outcome is indeterminate", details("publish", backup.transition === "renamed" ? "backup-path-preserved" : "none"));
+            }
+            if (backup.transition === "renamed" && backup.identity) {
+                rollback(err, "publish", backup.identity);
+            }
+            throw replacementFailure(err, "directory publication failed before commit", details("publish", "none"));
+        }
+        details("publish", backup.transition === "renamed" ? "backup-path-preserved" : "none");
+        if (backup.transition === "renamed" && backup.identity) {
+            let cleanupAttempted = false;
+            try {
+                assertSyncDirectoryGuard(targetParent);
+                inspectDirectoryIdentitySync(backupDir, backup.identity);
+                cleanupAttempted = true;
+                const outcome = await retained.removeOriginal(backupBasename);
+                if (outcome !== "removed") {
+                    throw new FsSafeError("path-mismatch", "retained backup changed before bounded cleanup");
+                }
+                backup.transition = "not-renamed";
+                details("cleanup", "none");
+            }
+            catch (error) {
+                throw replacementFailure(error, "published directory but retained backup cleanup failed", {
+                    ...details("cleanup", cleanupAttempted ? "cleanup-incomplete" : "backup-path-preserved"),
+                });
+            }
         }
     }
-    try {
-        await guardedRename({ from: stagedDir, to: targetDir });
+    catch (error) {
+        operationFailed = true;
+        operationError = error;
+        throw error;
     }
-    catch (err) {
-        if (backupCreated) {
-            await guardedRename({ from: backupDir, to: targetDir }).catch(() => undefined);
-            backupCreated = false;
+    finally {
+        try {
+            retained.close();
+        }
+        catch (closeError) {
+            if (operationFailed) {
+                throw replacementAggregate(operationError, closeError, "directory replacement and retained descriptor close failed", operationDetails);
+            }
+            throw replacementFailure(closeError, "directory replacement retained descriptor close failed", operationDetails);
         }
-        throw err;
-    }
-    if (backupCreated) {
-        await guardedRm({ target: backupDir, recursive: true, force: true, verifyAfter: false });
     }
 }

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-fallback.d.ts

@@ -36,4 +36,3 @@ export declare function copyFallbackReplaceSync(params: {
     sync: boolean;
 }): void;
 export {};
-//# sourceMappingURL=replace-file-copy-fallback.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-fallback.js

@@ -2,139 +2,129 @@ import syncFs, {} from "node:fs";
 import fs, {} from "node:fs/promises";
 import { readBoundedAsync, readBoundedSync } from "./bounded-read.js";
 import { FsSafeError } from "./errors.js";
-import { sameFileIdentity } from "./file-identity.js";
+import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
 import { readOwnedCopySource, readOwnedCopySourceSync } from "./replace-file-copy-source.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { hasErrorCode } from "./file-cleanup.js";
 const SUPPORTS_NOFOLLOW = process.platform !== "win32" && "O_NOFOLLOW" in syncFs.constants;
 const NOFOLLOW = SUPPORTS_NOFOLLOW ? syncFs.constants.O_NOFOLLOW : 0;
 const OPEN_READ_FLAGS = resolveReadOpenFlags();
 const OPEN_READ_WRITE_FLAGS = syncFs.constants.O_RDWR | NOFOLLOW;
 const OPEN_WRITE_EXCLUSIVE_FLAGS = syncFs.constants.O_WRONLY | syncFs.constants.O_CREAT | syncFs.constants.O_EXCL | NOFOLLOW;
-function notFound(error) {
-    return error.code === "ENOENT";
+function closeSyncAfterAdmissionFailure(fsModule, fd, error) {
+    try {
+        fsModule.closeSync(fd);
+    }
+    catch {
+        // Preserve the already-selected admission failure.
+    }
+    throw error;
 }
-function assertPinnedDestination(pathname, opened, dest, hardlinks) {
-    if (pathname.isSymbolicLink()) {
+function admitDestinationKind(pathname, opened, dest, admission) {
+    if (admission === "hardlinks") {
+        if (pathname.isSymbolicLink() || !pathname.isFile()) {
+            throw new FsSafeError("path-mismatch", `Atomic replace destination changed while opening: ${dest}`);
+        }
+    }
+    else if (pathname.isSymbolicLink()) {
         throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${dest}`);
     }
-    if (!pathname.isFile() || !opened.isFile()) {
+    else if (!pathname.isFile() || !opened.isFile()) {
         throw new FsSafeError("not-file", `Copy fallback destination must be a regular file: ${dest}`);
     }
-    if (!sameFileIdentity(pathname, opened)) {
-        throw new FsSafeError("path-mismatch", `Copy fallback destination changed while opening: ${dest}`);
-    }
-    if (hardlinks === "reject" && opened.nlink > 1) {
-        throw new FsSafeError("hardlink", `Hardlinked copy fallback destination not allowed: ${dest}`);
+    return pathname;
+}
+function assertDestinationLinks(opened, dest, admission, hardlinks) {
+    if ((admission === "hardlinks" || hardlinks === "reject") && opened.nlink > 1n) {
+        throw new FsSafeError("hardlink", `Hardlinked ${admission === "hardlinks" ? "atomic replace" : "copy fallback"} destination not allowed: ${dest}`);
     }
 }
-async function openPinnedDestination(fsModule, dest, hardlinks) {
+function inspectPinnedDestinationSync(fsModule, fd, dest, admission, hardlinks) {
+    const opened = inspectFileIdentitySync(() => fsModule.fstatSync(fd, { bigint: true }));
+    inspectFileIdentitySync(() => admitDestinationKind(fsModule.lstatSync(dest, { bigint: true }), opened, dest, admission), opened);
+    assertDestinationLinks(opened, dest, admission, hardlinks);
+}
+async function openPinnedDestination(fsModule, dest, admission, hardlinks) {
     let preview;
     try {
         preview = fsModule === fs ? syncFs.lstatSync(dest) : await fsModule.lstat(dest);
     }
     catch (error) {
-        if (notFound(error))
+        if (hasErrorCode(error, "ENOENT"))
             return null;
         throw error;
     }
     if (!preview)
         return null;
-    if (preview.isSymbolicLink()) {
+    if (admission === "hardlinks" && (preview.isSymbolicLink() || !preview.isFile()))
+        return null;
+    if (admission === "restore" && preview.isSymbolicLink()) {
         throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${dest}`);
     }
-    const handle = await fsModule.open(dest, OPEN_READ_WRITE_FLAGS);
+    const handle = await fsModule.open(dest, admission === "restore" ? OPEN_READ_WRITE_FLAGS : OPEN_READ_FLAGS);
     try {
-        const opened = fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
-        const current = fsModule === fs ? syncFs.lstatSync(dest) : await fsModule.lstat(dest);
-        assertPinnedDestination(current, opened, dest, hardlinks);
-        return { handle, stat: opened };
+        if (fsModule === fs)
+            inspectPinnedDestinationSync(syncFs, handle.fd, dest, admission, hardlinks);
+        else {
+            const opened = await inspectFileIdentity(() => handle.stat({ bigint: true }));
+            await inspectFileIdentity(async () => admitDestinationKind(await fsModule.lstat(dest, { bigint: true }), opened, dest, admission), opened);
+            assertDestinationLinks(opened, dest, admission, hardlinks);
+        }
+        return handle;
     }
     catch (error) {
-        await handle.close().catch(() => undefined);
+        try {
+            await handle.close();
+        }
+        catch {
+            // Preserve the already-selected admission failure.
+        }
         throw error;
     }
 }
-function openPinnedDestinationSync(fsModule, dest, hardlinks) {
+function openPinnedDestinationSync(fsModule, dest, admission, hardlinks) {
     let preview;
     try {
         preview = fsModule.lstatSync(dest);
     }
     catch (error) {
-        if (notFound(error))
+        if (hasErrorCode(error, "ENOENT"))
             return null;
         throw error;
     }
-    if (preview.isSymbolicLink()) {
+    if (admission === "hardlinks" && (preview.isSymbolicLink() || !preview.isFile()))
+        return null;
+    if (admission === "restore" && preview.isSymbolicLink()) {
         throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${dest}`);
     }
-    const fd = fsModule.openSync(dest, OPEN_READ_WRITE_FLAGS);
+    const fd = fsModule.openSync(dest, admission === "restore" ? OPEN_READ_WRITE_FLAGS : OPEN_READ_FLAGS);
     try {
-        const opened = fsModule.fstatSync(fd);
-        assertPinnedDestination(fsModule.lstatSync(dest), opened, dest, hardlinks);
-        return { fd, stat: opened };
+        inspectPinnedDestinationSync(fsModule, fd, dest, admission, hardlinks);
+        return fd;
     }
     catch (error) {
-        fsModule.closeSync(fd);
-        throw error;
+        closeSyncAfterAdmissionFailure(fsModule, fd, error);
     }
 }
 export async function assertDestinationHardlinkPolicy(fsModule, dest, policy) {
     if (policy !== "reject")
         return;
-    let preview;
-    try {
-        preview = fsModule === fs ? syncFs.lstatSync(dest) : await fsModule.lstat(dest);
-    }
-    catch (error) {
-        if (notFound(error))
-            return;
-        throw error;
-    }
-    if (!preview || preview.isSymbolicLink() || !preview.isFile())
+    const handle = await openPinnedDestination(fsModule, dest, "hardlinks");
+    if (!handle)
         return;
-    const handle = await fsModule.open(dest, OPEN_READ_FLAGS);
     try {
-        const opened = fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
-        const current = fsModule === fs ? syncFs.lstatSync(dest) : await fsModule.lstat(dest);
-        if (current.isSymbolicLink() || !current.isFile() || !sameFileIdentity(current, opened)) {
-            throw new FsSafeError("path-mismatch", `Atomic replace destination changed while opening: ${dest}`);
-        }
-        if (opened.nlink > 1) {
-            throw new FsSafeError("hardlink", `Hardlinked atomic replace destination not allowed: ${dest}`);
-        }
+        await handle.close();
     }
-    finally {
-        await handle.close().catch(() => undefined);
+    catch {
+        // The asynchronous admission pin has best-effort close semantics.
     }
 }
 export function assertDestinationHardlinkPolicySync(fsModule, dest, policy) {
     if (policy !== "reject")
         return;
-    let preview;
-    try {
-        preview = fsModule.lstatSync(dest);
-    }
-    catch (error) {
-        if (notFound(error))
-            return;
-        throw error;
-    }
-    if (preview.isSymbolicLink() || !preview.isFile())
-        return;
-    const fd = fsModule.openSync(dest, OPEN_READ_FLAGS);
-    try {
-        const opened = fsModule.fstatSync(fd);
-        const current = fsModule.lstatSync(dest);
-        if (current.isSymbolicLink() || !current.isFile() || !sameFileIdentity(current, opened)) {
-            throw new FsSafeError("path-mismatch", `Atomic replace destination changed while opening: ${dest}`);
-        }
-        if (opened.nlink > 1) {
-            throw new FsSafeError("hardlink", `Hardlinked atomic replace destination not allowed: ${dest}`);
-        }
-    }
-    finally {
+    const fd = openPinnedDestinationSync(fsModule, dest, "hardlinks");
+    if (fd !== null)
         fsModule.closeSync(fd);
-    }
 }
 function restoreReadOptions(stat, maxBytes) {
     return {
@@ -183,7 +173,7 @@ function writeAllSync(fsModule, fd, data) {
 function restoreFailure(writeError, cleanup, restoreError) {
     const primary = writeError instanceof Error ? writeError : new Error(String(writeError));
     const details = { cleanup };
-    const cause = restoreError
+    const cause = cleanup === "restore-failed"
         ? new AggregateError([primary, restoreError], "copy fallback and original restoration both failed")
         : primary;
     return new FsSafeError("helper-failed", cleanup === "restored"
@@ -246,11 +236,12 @@ export async function copyFallbackReplace(params) {
     });
     const { replacement } = source;
     let destHandle = null;
+    let closeRequiredForSuccess = false;
     try {
         if (params.restore === "restore-original") {
-            const pinned = await openPinnedDestination(params.fsModule, params.dest, params.destinationHardlinks);
+            const pinned = await openPinnedDestination(params.fsModule, params.dest, "restore", params.destinationHardlinks);
             if (pinned) {
-                destHandle = pinned.handle;
+                destHandle = pinned;
                 await replacePinnedWithRestore(params.fsModule, destHandle, replacement, params.maxRestoreBytes, source.mode);
             }
         }
@@ -261,7 +252,7 @@ export async function copyFallbackReplace(params) {
                     ? syncFs.lstatSync(params.dest) : await params.fsModule.lstat(params.dest);
             }
             catch (error) {
-                if (!notFound(error))
+                if (!hasErrorCode(error, "ENOENT"))
                     throw error;
             }
             if (destStat?.isSymbolicLink()) {
@@ -277,10 +268,20 @@ export async function copyFallbackReplace(params) {
             if (params.sync) {
                 await destHandle.sync();
             }
+            closeRequiredForSuccess = !params.sync;
         }
     }
     finally {
-        await destHandle?.close().catch(() => undefined);
+        if (destHandle) {
+            try {
+                await destHandle.close();
+            }
+            catch (closeError) {
+                if (closeRequiredForSuccess) {
+                    throw closeError;
+                }
+            }
+        }
     }
 }
 export function copyFallbackReplaceSync(params) {
@@ -291,11 +292,12 @@ export function copyFallbackReplaceSync(params) {
     });
     const { replacement } = source;
     let destFd;
+    let closeRequiredForSuccess = false;
     try {
         if (params.restore === "restore-original") {
-            const pinned = openPinnedDestinationSync(params.fsModule, params.dest, params.destinationHardlinks);
-            if (pinned) {
-                destFd = pinned.fd;
+            const pinned = openPinnedDestinationSync(params.fsModule, params.dest, "restore", params.destinationHardlinks);
+            if (pinned !== null) {
+                destFd = pinned;
                 replacePinnedWithRestoreSync(params.fsModule, destFd, replacement, params.maxRestoreBytes, source.mode, params.fchmodSync);
             }
         }
@@ -305,7 +307,7 @@ export function copyFallbackReplaceSync(params) {
                 destStat = params.fsModule.lstatSync(params.dest);
             }
             catch (error) {
-                if (!notFound(error))
+                if (!hasErrorCode(error, "ENOENT"))
                     throw error;
             }
             if (destStat?.isSymbolicLink()) {
@@ -321,6 +323,7 @@ export function copyFallbackReplaceSync(params) {
             if (params.sync) {
                 params.fsModule.fsyncSync(destFd);
             }
+            closeRequiredForSuccess = !params.sync;
         }
     }
     finally {
@@ -328,8 +331,10 @@ export function copyFallbackReplaceSync(params) {
             try {
                 params.fsModule.closeSync(destFd);
             }
-            catch {
-                // Best-effort close after fallback replacement.
+            catch (closeError) {
+                if (closeRequiredForSuccess) {
+                    throw closeError;
+                }
             }
         }
     }

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-source.d.ts

@@ -18,4 +18,3 @@ export declare function readOwnedCopySourceSync(params: {
     mode: number;
 };
 export {};
-//# sourceMappingURL=replace-file-copy-source.d.ts.map