@openclaw/openshell-sandbox 2026.9.5 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-source.js

@@ -3,8 +3,8 @@ import fs, {} from "node:fs/promises";
 import { readBoundedSync } from "./bounded-read.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { FsSafeError } from "./errors.js";
-import { sameFileIdentity } from "./file-identity.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
+import { hasErrorCode } from "./file-cleanup.js";
 const OPEN_READ_FLAGS = resolveReadOpenFlags();
 function assertSourcePreview(source, src) {
     if (source.isSymbolicLink()) {
@@ -17,6 +17,14 @@ function assertSourcePreview(source, src) {
         throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${src}`);
     }
 }
+function assertOpenedSource(opened, current, src) {
+    if (!opened.isFile() || current.isSymbolicLink()) {
+        throw new FsSafeError("path-mismatch", `Copy fallback source changed while opening: ${src}`);
+    }
+    if (opened.nlink !== 1n) {
+        throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${src}`);
+    }
+}
 function sourceSymlinkError(src, cause) {
     return new FsSafeError("symlink", `Refusing copy fallback from non-file source: ${src}`, {
         cause,
@@ -27,7 +35,7 @@ async function openSource(fsModule, src) {
         return await fsModule.open(src, OPEN_READ_FLAGS);
     }
     catch (error) {
-        if (error.code === "ELOOP") {
+        if (hasErrorCode(error, "ELOOP")) {
             throw sourceSymlinkError(src, error);
         }
         throw error;
@@ -38,7 +46,7 @@ function openSourceSync(fsModule, src) {
         return fsModule.openSync(src, OPEN_READ_FLAGS);
     }
     catch (error) {
-        if (error.code === "ELOOP") {
+        if (hasErrorCode(error, "ELOOP")) {
             throw sourceSymlinkError(src, error);
         }
         throw error;
@@ -57,44 +65,30 @@ export async function readOwnedCopySource(params) {
         ? syncFs.lstatSync(params.src) : await params.fsModule.lstat(params.src), params.src);
     const handle = await openSource(params.fsModule, params.src);
     try {
-        if (params.expectedIdentity) {
-            const exact = await inspectFileIdentity(() => params.fsModule === fs
-                ? syncFs.fstatSync(handle.fd, { bigint: true }) : handle.stat({ bigint: true }), params.expectedIdentity);
-            await inspectFileIdentity(() => params.fsModule === fs
-                ? syncFs.lstatSync(params.src, { bigint: true }) : params.fsModule.lstat(params.src, { bigint: true }), exact);
-        }
-        const opened = params.fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
-        const current = params.fsModule === fs
-            ? syncFs.lstatSync(params.src) : await params.fsModule.lstat(params.src);
-        if (!opened.isFile() || current.isSymbolicLink() || !sameFileIdentity(opened, current)) {
-            throw new FsSafeError("path-mismatch", `Copy fallback source changed while opening: ${params.src}`);
-        }
-        if (opened.nlink !== 1) {
-            throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${params.src}`);
-        }
-        return { replacement: await handle.readFile(), mode: opened.mode };
+        const opened = await inspectFileIdentity(() => params.fsModule === fs
+            ? syncFs.fstatSync(handle.fd, { bigint: true }) : handle.stat({ bigint: true }), params.expectedIdentity);
+        const current = await inspectFileIdentity(() => params.fsModule === fs
+            ? syncFs.lstatSync(params.src, { bigint: true }) : params.fsModule.lstat(params.src, { bigint: true }), opened);
+        assertOpenedSource(opened, current, params.src);
+        return { replacement: await handle.readFile(), mode: Number(opened.mode) };
     }
     finally {
-        await handle.close().catch(() => undefined);
+        try {
+            await handle.close();
+        }
+        catch {
+            // Best-effort close includes synchronous adapter throws.
+        }
     }
 }
 export function readOwnedCopySourceSync(params) {
     assertSourcePreview(params.fsModule.lstatSync(params.src), params.src);
     const fd = openSourceSync(params.fsModule, params.src);
     try {
-        if (params.expectedIdentity) {
-            const exact = inspectFileIdentitySync(() => params.fsModule.fstatSync(fd, { bigint: true }), params.expectedIdentity);
-            inspectFileIdentitySync(() => params.fsModule.lstatSync(params.src, { bigint: true }), exact);
-        }
-        const opened = params.fsModule.fstatSync(fd);
-        const current = params.fsModule.lstatSync(params.src);
-        if (!opened.isFile() || current.isSymbolicLink() || !sameFileIdentity(opened, current)) {
-            throw new FsSafeError("path-mismatch", `Copy fallback source changed while opening: ${params.src}`);
-        }
-        if (opened.nlink !== 1) {
-            throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${params.src}`);
-        }
-        return { replacement: readAllSync(params.fsModule, fd, opened.size), mode: opened.mode };
+        const opened = inspectFileIdentitySync(() => params.fsModule.fstatSync(fd, { bigint: true }), params.expectedIdentity);
+        const current = inspectFileIdentitySync(() => params.fsModule.lstatSync(params.src, { bigint: true }), opened);
+        assertOpenedSource(opened, current, params.src);
+        return { replacement: readAllSync(params.fsModule, fd, Number(opened.size)), mode: Number(opened.mode) };
     }
     finally {
         try {

package/node_modules/@openclaw/fs-safe/dist/replace-file-descriptor.d.ts

@@ -48,4 +48,3 @@ export declare function writeTempFileSync(params: {
     identity: BigIntStats;
 };
 export {};
-//# sourceMappingURL=replace-file-descriptor.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/replace-file-descriptor.js

@@ -2,9 +2,8 @@ import { syncFileBestEffort, syncFileBestEffortSync } from "./file-sync.js";
 import syncFs, {} from "node:fs";
 import fs, {} from "node:fs/promises";
 import { FsSafeError } from "./errors.js";
-import { sameFileIdentity } from "./file-identity.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
-import { assertOwnedDirectory, ownDirectoryMode } from "./directory-mode-owner.js";
+import { ownDirectoryMode } from "./directory-mode-owner.js";
 export async function syncDirectoryBestEffort(fsModule, dirPath) {
     let handle;
     try {
@@ -15,7 +14,12 @@ export async function syncDirectoryBestEffort(fsModule, dirPath) {
         // Best-effort on platforms/filesystems that do not support directory fsync.
     }
     finally {
-        await handle?.close().catch(() => undefined);
+        try {
+            await handle?.close();
+        }
+        catch {
+            // Best-effort close also covers synchronous adapter throws.
+        }
     }
 }
 export function syncDirectoryBestEffortSync(fsModule, dirPath) {
@@ -48,12 +52,7 @@ function assertDirectory(identity, dirPath) {
     if (identity.isSymbolicLink() || !identity.isDirectory()) {
         throw new FsSafeError("not-file", `Atomic replace parent must be a real directory: ${dirPath}`);
     }
-}
-function assertSameDirectory(expected, opened, dirPath) {
-    assertDirectory(opened, dirPath);
-    if (!sameFileIdentity(expected, opened)) {
-        throw new FsSafeError("path-mismatch", `Atomic replace parent changed before its mode could be applied: ${dirPath}`);
-    }
+    return identity;
 }
 export async function pinDirectoryForMode(params) {
     // Node does not enforce POSIX directory modes on Windows, and its directory
@@ -63,15 +62,16 @@ export async function pinDirectoryForMode(params) {
         return;
     }
     const expected = params.fsModule === fs
-        ? syncFs.lstatSync(params.dirPath) : await params.fsModule.lstat(params.dirPath);
-    assertDirectory(expected, params.dirPath);
+        ? inspectFileIdentitySync(() => assertDirectory(syncFs.lstatSync(params.dirPath, { bigint: true }), params.dirPath))
+        : await inspectFileIdentity(async () => assertDirectory(await params.fsModule.lstat(params.dirPath, { bigint: true }), params.dirPath));
     const handle = await params.fsModule.open(params.dirPath, directoryOpenFlags());
     try {
         const owner = ownDirectoryMode({
             async inspect() {
-                const opened = params.fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
-                assertOwnedDirectory(expected, opened);
-                return opened.mode & 0o7777;
+                const opened = params.fsModule === fs
+                    ? inspectFileIdentitySync(() => assertDirectory(syncFs.fstatSync(handle.fd, { bigint: true }), params.dirPath), expected)
+                    : await inspectFileIdentity(async () => assertDirectory(await handle.stat({ bigint: true }), params.dirPath), expected);
+                return Number(opened.mode & 4095n);
             },
             chmod: (mode) => handle.chmod(mode),
             close: () => handle.close(),
@@ -98,11 +98,10 @@ export function applyDirectoryModeSync(params) {
     if (process.platform === "win32") {
         return;
     }
-    const expected = params.fsModule.lstatSync(params.dirPath);
-    assertDirectory(expected, params.dirPath);
+    const expected = inspectFileIdentitySync(() => assertDirectory(params.fsModule.lstatSync(params.dirPath, { bigint: true }), params.dirPath));
     const fd = params.fsModule.openSync(params.dirPath, directoryOpenFlags());
     try {
-        assertSameDirectory(expected, params.fsModule.fstatSync(fd), params.dirPath);
+        inspectFileIdentitySync(() => assertDirectory(params.fsModule.fstatSync(fd, { bigint: true }), params.dirPath), expected);
         // chmod ignores file-type bits; mask so raw stat modes are tolerated.
         params.fchmodSync?.(fd, params.mode & 0o7777);
     }

package/node_modules/@openclaw/fs-safe/dist/replace-file-mode.d.ts

@@ -1,3 +1,2 @@
 import type { Stats } from "node:fs";
 export declare function inheritedRegularFileMode(stat: Stats): number;
-//# sourceMappingURL=replace-file-mode.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/replace-file-rename-policy.d.ts

@@ -1,7 +1,5 @@
-import type { RenameIdentityPolicy } from "./pinned-write.js";
-export type { RenameIdentityPolicy };
+import type { RenameIdentityPolicy } from "./pinned-write-types.js";
 export declare function validateRenameIdentity(policy: RenameIdentityPolicy | undefined): void;
 export declare function atomicExpectedContentHash(policy: RenameIdentityPolicy | undefined, content: string | Uint8Array): string | undefined;
 export declare function withAtomicRenameIdentityLock<T>(filePath: string, fn: () => Promise<T>): Promise<T>;
 export declare function withAtomicRenameIdentityLockSync<T>(filePath: string, fn: () => T): T;
-//# sourceMappingURL=replace-file-rename-policy.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/replace-file-temp-owner.d.ts

@@ -1,54 +1,49 @@
 import syncFs, { type BigIntStats } from "node:fs";
 import fs, { type FileHandle } from "node:fs/promises";
-import { type AnyAsyncDirectoryGuard } from "./directory-guard.js";
+import { type TempPathRegistration } from "./temp-cleanup.js";
 type AsyncOwnerFileSystem = Pick<typeof fs, "lstat" | "open" | "unlink">;
 type SyncOwnerFileSystem = Pick<typeof syncFs, "closeSync" | "fstatSync" | "lstatSync" | "openSync" | "readFileSync" | "unlinkSync">;
+export type AtomicTempFailure = Readonly<{
+    error: unknown;
+}>;
 export declare function removePathIfIdentityUnchanged(targetPath: string, identity: Pick<BigIntStats, "dev" | "ino">): Promise<void>;
-export declare function cleanupPinnedFilePath(params: {
-    pathname: string;
-    handle: FileHandle;
-    identity?: BigIntStats;
-    parentGuard: AnyAsyncDirectoryGuard;
-}): Promise<void>;
-export declare class AsyncAtomicTempOwner {
-    #private;
+declare class AtomicTempOwner<Resource> {
     readonly pathname: string;
+    protected resource: Resource | undefined;
+    protected recordedIdentity: BigIntStats | undefined;
+    protected exists: boolean;
+    protected unregister: TempPathRegistration;
     constructor(pathname: string);
     start(): void;
     readonly onIdentity: (identity: BigIntStats) => void;
+    get identity(): BigIntStats;
+    markRenamed(): void;
+    protected takeResource(): Resource | undefined;
+}
+export declare class AsyncAtomicTempOwner extends AtomicTempOwner<FileHandle> {
     adopt(temp: {
         handle: FileHandle;
         identity: BigIntStats;
     }): void;
-    get identity(): BigIntStats;
     assertCurrent(fsModule: AsyncOwnerFileSystem, pathname?: string): Promise<void>;
     assertPublished(fsModule: AsyncOwnerFileSystem, pathname: string, expectedHash?: string): Promise<void>;
-    markRenamed(): void;
     finish(params: {
         fsModule: AsyncOwnerFileSystem;
-        originalError?: unknown;
+        originalFailure?: AtomicTempFailure;
         throwOnCleanupError: boolean;
     }): Promise<void>;
 }
-export declare class SyncAtomicTempOwner {
-    #private;
-    readonly pathname: string;
-    constructor(pathname: string);
-    start(): void;
-    readonly onIdentity: (identity: BigIntStats) => void;
+export declare class SyncAtomicTempOwner extends AtomicTempOwner<number> {
     adopt(temp: {
         fd: number;
         identity: BigIntStats;
     }): void;
-    get identity(): BigIntStats;
     assertCurrent(fsModule: SyncOwnerFileSystem, pathname?: string): void;
     assertPublished(fsModule: SyncOwnerFileSystem, pathname: string, expectedHash?: string): void;
-    markRenamed(): void;
     finish(params: {
         fsModule: SyncOwnerFileSystem;
-        originalError?: unknown;
+        originalFailure?: AtomicTempFailure;
         throwOnCleanupError: boolean;
     }): void;
 }
 export {};
-//# sourceMappingURL=replace-file-temp-owner.d.ts.map