@openclaw/openshell-sandbox 2026.9.5 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/replace-file-temp-owner.js

@@ -1,7 +1,8 @@
 import syncFs, {} from "node:fs";
 import fs, {} from "node:fs/promises";
 import path from "node:path";
-import { assertAsyncDirectoryGuard, createAsyncDirectoryGuard } from "./directory-guard.js";
+import { createAsyncDirectoryGuard } from "./directory-guard.js";
+import { hasErrorCode, removeOwnedPath } from "./file-cleanup.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentityForCleanup, sha256Hex } from "./file-identity.js";
@@ -9,6 +10,22 @@ import { withAsyncDirectoryGuards } from "./guarded-mutation.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
 import { registerTempPathForExit } from "./temp-cleanup.js";
 const PUBLISHED_READ_FLAGS = resolveReadOpenFlags();
+function describeFailure(error) {
+    try {
+        return String(error);
+    }
+    catch {
+        return "<unprintable failure>";
+    }
+}
+function isErrorValue(error) {
+    try {
+        return error instanceof Error;
+    }
+    catch {
+        return false;
+    }
+}
 export async function removePathIfIdentityUnchanged(targetPath, identity) {
     const parentGuard = await createAsyncDirectoryGuard(path.dirname(targetPath), { bigint: true });
     await withAsyncDirectoryGuards([parentGuard], async () => {
@@ -34,65 +51,33 @@ function missingOwnedFile(pathname, cause) {
         cause,
     });
 }
-function cleanupFailure(originalError, cleanupError) {
-    if (originalError !== undefined) {
-        return new Error(`Atomic file replace failed (${String(originalError)}); cleanup also failed (${String(cleanupError)})`, { cause: originalError });
+function cleanupFailure(originalFailure, cleanupError) {
+    if (originalFailure) {
+        return new Error(`Atomic file replace failed (${describeFailure(originalFailure.error)}); cleanup also failed (${describeFailure(cleanupError)})`, { cause: originalFailure.error });
     }
-    return cleanupError instanceof Error ? cleanupError : new Error(String(cleanupError));
+    return isErrorValue(cleanupError) ? cleanupError : new Error(describeFailure(cleanupError));
+}
+function closeFailure(closeError, params, cleanupFailure) {
+    return {
+        error: cleanupFailure
+            ? new AggregateError([cleanupFailure.error, closeError], "Atomic temp cleanup and close failed")
+            : params.originalFailure
+                ? new AggregateError([params.originalFailure.error, closeError], "Atomic file replace and close failed")
+                : closeError,
+    };
 }
 async function cleanupOwnedPath(params) {
-    if (!params.identity)
-        return true;
     try {
-        const current = params.fsModule === fs
-            ? syncFs.lstatSync(params.pathname, { bigint: true })
-            : await params.fsModule.lstat(params.pathname, { bigint: true });
-        if (current.isSymbolicLink() ||
-            !current.isFile() ||
-            current.nlink !== 1n ||
-            !sameFileIdentityForCleanup(current, params.identity)) {
-            return true;
-        }
-        await params.fsModule.unlink(params.pathname);
+        await removeOwnedPath(params);
         return true;
     }
     catch (cleanupError) {
-        if (cleanupError.code === "ENOENT")
-            return true;
         if (params.throwOnCleanupError) {
-            throw cleanupFailure(params.originalError, cleanupError);
+            throw cleanupFailure(params.originalFailure, cleanupError);
         }
         return false;
     }
 }
-// Borrowed handle: the caller retains it until this best-effort cleanup finishes.
-export async function cleanupPinnedFilePath(params) {
-    if (!params.identity)
-        return;
-    try {
-        const guard = params.parentGuard;
-        if ([guard.stat.dev, guard.stat.ino].some((value) => typeof value === "number" && !Number.isSafeInteger(value)))
-            return;
-        await assertAsyncDirectoryGuard(guard);
-        const parent = syncFs.lstatSync(guard.dir, { bigint: true });
-        if (parent.isSymbolicLink() || !parent.isDirectory() ||
-            !sameFileIdentityForCleanup(parent, guard.stat))
-            return;
-        const opened = syncFs.fstatSync(params.handle.fd, { bigint: true });
-        if (!opened.isFile() || opened.nlink !== 1n ||
-            !sameFileIdentityForCleanup(opened, params.identity))
-            return;
-        await cleanupOwnedPath({
-            fsModule: fs,
-            pathname: params.pathname,
-            identity: params.identity,
-            throwOnCleanupError: false,
-        });
-    }
-    catch {
-        // Unverifiable authority must preserve the path and the original write failure.
-    }
-}
 function cleanupOwnedPathSync(params) {
     if (!params.identity)
         return true;
@@ -108,44 +93,56 @@ function cleanupOwnedPathSync(params) {
         return true;
     }
     catch (cleanupError) {
-        if (cleanupError.code === "ENOENT")
+        if (hasErrorCode(cleanupError, "ENOENT"))
             return true;
         if (params.throwOnCleanupError) {
-            throw cleanupFailure(params.originalError, cleanupError);
+            throw cleanupFailure(params.originalFailure, cleanupError);
         }
         return false;
     }
 }
-export class AsyncAtomicTempOwner {
+class AtomicTempOwner {
     pathname;
-    #handle;
-    #identity;
-    #exists = false;
-    #unregister;
+    resource;
+    recordedIdentity;
+    exists = false;
+    unregister;
     constructor(pathname) {
         this.pathname = pathname;
-        this.#unregister = registerTempPathForExit(pathname, { singleLinkFile: true });
+        this.unregister = registerTempPathForExit(pathname, { singleLinkFile: true });
     }
     start() {
-        this.#exists = true;
+        this.exists = true;
     }
     onIdentity = (identity) => {
-        this.#identity = identity;
-        this.#unregister.setIdentity(identity);
+        this.recordedIdentity = identity;
+        this.unregister.setIdentity(identity);
     };
-    adopt(temp) {
-        this.#handle = temp.handle;
-        this.onIdentity(temp.identity);
-    }
     get identity() {
-        if (!this.#identity)
+        if (!this.recordedIdentity)
             throw new Error("Atomic temp owner has no identity");
-        return this.#identity;
+        return this.recordedIdentity;
+    }
+    markRenamed() {
+        this.exists = false;
+        this.unregister();
+    }
+    takeResource() {
+        // A throwing close may already have released the descriptor for reuse.
+        const resource = this.resource;
+        this.resource = undefined;
+        return resource;
+    }
+}
+export class AsyncAtomicTempOwner extends AtomicTempOwner {
+    adopt(temp) {
+        this.resource = temp.handle;
+        this.onIdentity(temp.identity);
     }
     async assertCurrent(fsModule, pathname = this.pathname) {
         const opened = await inspectFileIdentity(async () => {
-            const stat = fsModule === fs ? syncFs.fstatSync(this.#handle.fd, { bigint: true })
-                : await this.#handle.stat({ bigint: true });
+            const stat = fsModule === fs ? syncFs.fstatSync(this.resource.fd, { bigint: true })
+                : await this.resource.stat({ bigint: true });
             assertOwnedFile(stat, pathname, false);
             return stat;
         }, this.identity);
@@ -158,7 +155,7 @@ export class AsyncAtomicTempOwner {
             }, opened);
         }
         catch (error) {
-            if (error.code === "ENOENT") {
+            if (hasErrorCode(error, "ENOENT")) {
                 throw missingOwnedFile(pathname, error);
             }
             throw error;
@@ -170,7 +167,7 @@ export class AsyncAtomicTempOwner {
             return;
         }
         catch (error) {
-            if (!(error instanceof FsSafeError) || error.code !== "path-mismatch" || !expectedHash) {
+            if (!(error instanceof FsSafeError) || !hasErrorCode(error, "path-mismatch") || !expectedHash) {
                 throw error;
             }
         }
@@ -180,7 +177,7 @@ export class AsyncAtomicTempOwner {
                 published = await fsModule.open(pathname, PUBLISHED_READ_FLAGS);
             }
             catch (error) {
-                if (error.code === "ELOOP") {
+                if (hasErrorCode(error, "ELOOP")) {
                     throw new FsSafeError("symlink", `Atomic replace published file became a symlink: ${pathname}`, {
                         cause: error,
                     });
@@ -202,81 +199,59 @@ export class AsyncAtomicTempOwner {
             if (sha256Hex(await published.readFile()) !== expectedHash) {
                 throw new FsSafeError("path-mismatch", `Atomic replace published content changed: ${pathname}`);
             }
-            await this.#handle?.close();
-            this.#handle = published;
-            this.#identity = identity;
+            const previousHandle = this.takeResource();
+            await previousHandle?.close();
+            this.resource = published;
+            this.recordedIdentity = identity;
             published = undefined;
         }
         finally {
-            await published?.close().catch(() => undefined);
+            try {
+                await published?.close();
+            }
+            catch {
+                // Preserve the selected verification or previous-handle close failure.
+            }
         }
     }
-    markRenamed() {
-        this.#exists = false;
-        this.#unregister();
-    }
     async finish(params) {
-        let deferredError;
-        let cleanupComplete = !this.#exists;
-        if (this.#exists) {
+        let deferredFailure;
+        let cleanupComplete = !this.exists;
+        if (this.exists) {
             try {
                 cleanupComplete = await cleanupOwnedPath({
                     fsModule: params.fsModule,
                     pathname: this.pathname,
-                    identity: this.#identity,
-                    originalError: params.originalError,
+                    identity: this.recordedIdentity,
+                    originalFailure: params.originalFailure,
                     throwOnCleanupError: params.throwOnCleanupError,
                 });
             }
             catch (error) {
-                deferredError = error;
+                deferredFailure = { error };
             }
         }
         if (cleanupComplete)
-            this.#unregister();
+            this.unregister();
+        const handle = this.takeResource();
         try {
-            await this.#handle?.close();
+            await handle?.close();
         }
         catch (closeError) {
-            deferredError = deferredError
-                ? new AggregateError([deferredError, closeError], "Atomic temp cleanup and close failed")
-                : params.originalError !== undefined
-                    ? new AggregateError([params.originalError, closeError], "Atomic file replace and close failed")
-                    : closeError;
+            deferredFailure = closeFailure(closeError, params, deferredFailure);
         }
-        if (deferredError)
-            throw deferredError;
+        if (deferredFailure)
+            throw deferredFailure.error;
     }
 }
-export class SyncAtomicTempOwner {
-    pathname;
-    #fd;
-    #identity;
-    #exists = false;
-    #unregister;
-    constructor(pathname) {
-        this.pathname = pathname;
-        this.#unregister = registerTempPathForExit(pathname, { singleLinkFile: true });
-    }
-    start() {
-        this.#exists = true;
-    }
-    onIdentity = (identity) => {
-        this.#identity = identity;
-        this.#unregister.setIdentity(identity);
-    };
+export class SyncAtomicTempOwner extends AtomicTempOwner {
     adopt(temp) {
-        this.#fd = temp.fd;
+        this.resource = temp.fd;
         this.onIdentity(temp.identity);
     }
-    get identity() {
-        if (!this.#identity)
-            throw new Error("Atomic temp owner has no identity");
-        return this.#identity;
-    }
     assertCurrent(fsModule, pathname = this.pathname) {
         const opened = inspectFileIdentitySync(() => {
-            const stat = fsModule.fstatSync(this.#fd, { bigint: true });
+            const stat = fsModule.fstatSync(this.resource, { bigint: true });
             assertOwnedFile(stat, pathname, false);
             return stat;
         }, this.identity);
@@ -288,7 +263,7 @@ export class SyncAtomicTempOwner {
             }, opened);
         }
         catch (error) {
-            if (error.code === "ENOENT") {
+            if (hasErrorCode(error, "ENOENT")) {
                 throw missingOwnedFile(pathname, error);
             }
             throw error;
@@ -300,7 +275,7 @@ export class SyncAtomicTempOwner {
             return;
         }
         catch (error) {
-            if (!(error instanceof FsSafeError) || error.code !== "path-mismatch" || !expectedHash) {
+            if (!(error instanceof FsSafeError) || !hasErrorCode(error, "path-mismatch") || !expectedHash) {
                 throw error;
             }
         }
@@ -310,7 +285,7 @@ export class SyncAtomicTempOwner {
                 publishedFd = fsModule.openSync(pathname, PUBLISHED_READ_FLAGS);
             }
             catch (error) {
-                if (error.code === "ELOOP") {
+                if (hasErrorCode(error, "ELOOP")) {
                     throw new FsSafeError("symlink", `Atomic replace published file became a symlink: ${pathname}`, {
                         cause: error,
                     });
@@ -330,11 +305,10 @@ export class SyncAtomicTempOwner {
             if (sha256Hex(fsModule.readFileSync(publishedFd)) !== expectedHash) {
                 throw new FsSafeError("path-mismatch", `Atomic replace published content changed: ${pathname}`);
             }
-            const previousFd = this.#fd;
-            this.#fd = undefined;
+            const previousFd = this.takeResource();
             fsModule.closeSync(previousFd);
-            this.#fd = publishedFd;
-            this.#identity = identity;
+            this.resource = publishedFd;
+            this.recordedIdentity = identity;
             publishedFd = undefined;
         }
         finally {
@@ -348,44 +322,35 @@ export class SyncAtomicTempOwner {
             }
         }
     }
-    markRenamed() {
-        this.#exists = false;
-        this.#unregister();
-    }
     finish(params) {
-        let deferredError;
-        let cleanupComplete = !this.#exists;
-        if (this.#exists) {
+        let deferredFailure;
+        let cleanupComplete = !this.exists;
+        if (this.exists) {
             try {
                 cleanupComplete = cleanupOwnedPathSync({
                     fsModule: params.fsModule,
                     pathname: this.pathname,
-                    identity: this.#identity,
-                    originalError: params.originalError,
+                    identity: this.recordedIdentity,
+                    originalFailure: params.originalFailure,
                     throwOnCleanupError: params.throwOnCleanupError,
                 });
             }
             catch (error) {
-                deferredError = error;
+                deferredFailure = { error };
             }
         }
         if (cleanupComplete)
-            this.#unregister();
-        if (this.#fd !== undefined) {
-            const fd = this.#fd;
-            this.#fd = undefined;
+            this.unregister();
+        const fd = this.takeResource();
+        if (fd !== undefined) {
             try {
                 params.fsModule.closeSync(fd);
             }
             catch (closeError) {
-                deferredError = deferredError
-                    ? new AggregateError([deferredError, closeError], "Atomic temp cleanup and close failed")
-                    : params.originalError !== undefined
-                        ? new AggregateError([params.originalError, closeError], "Atomic file replace and close failed")
-                        : closeError;
+                deferredFailure = closeFailure(closeError, params, deferredFailure);
             }
         }
-        if (deferredError)
-            throw deferredError;
+        if (deferredFailure)
+            throw deferredFailure.error;
     }
 }

package/node_modules/@openclaw/fs-safe/dist/replace-file.d.ts

@@ -1,7 +1,7 @@
 import syncFs from "node:fs";
 import fs from "node:fs/promises";
-import { type ReplaceFileAtomicRestoreCleanup, type ReplaceFileAtomicRestoreFailureDetails, type ReplaceFileCopyFallbackRestorePolicy, type ReplaceFileDestinationHardlinkPolicy } from "./replace-file-copy-fallback.js";
-import { type RenameIdentityPolicy } from "./replace-file-rename-policy.js";
+import type { RenameIdentityPolicy } from "./pinned-write-types.js";
+import { type ReplaceFileCopyFallbackRestorePolicy, type ReplaceFileDestinationHardlinkPolicy } from "./replace-file-copy-fallback.js";
 export type ReplaceFileAtomicFileSystem = {
     promises: Pick<typeof fs, "mkdir" | "writeFile" | "rename" | "copyFile" | "unlink" | "rm" | "open" | "stat" | "lstat"> & {
         /** @deprecated Accepted for adapter compatibility but never called. */
@@ -13,7 +13,6 @@ export type ReplaceFileAtomicSyncFileSystem = Pick<typeof syncFs, "mkdirSync" |
     chmodSync?: typeof syncFs.chmodSync;
     fchmodSync?: typeof syncFs.fchmodSync;
 };
-export type { RenameIdentityPolicy, ReplaceFileAtomicRestoreCleanup, ReplaceFileAtomicRestoreFailureDetails, ReplaceFileCopyFallbackRestorePolicy, ReplaceFileDestinationHardlinkPolicy, };
 type ReplaceFileAtomicBaseOptions = {
     filePath: string;
     content: string | Uint8Array;
@@ -56,4 +55,4 @@ export type ReplaceFileAtomicResult = {
 export declare function replaceFileAtomic(options: ReplaceFileAtomicOptions): Promise<ReplaceFileAtomicResult>;
 export declare function replaceFileAtomicWithDirectorySync(options: ReplaceFileAtomicOptions, syncParent?: (directoryPath: string) => Promise<unknown>): Promise<ReplaceFileAtomicResult>;
 export declare function replaceFileAtomicSync(options: ReplaceFileAtomicSyncOptions): ReplaceFileAtomicResult;
-//# sourceMappingURL=replace-file.d.ts.map
+export {};

package/node_modules/@openclaw/fs-safe/dist/replace-file.js

@@ -9,16 +9,10 @@ import { inheritedRegularFileMode } from "./replace-file-mode.js";
 import { atomicExpectedContentHash, validateRenameIdentity, withAtomicRenameIdentityLock, withAtomicRenameIdentityLockSync, } from "./replace-file-rename-policy.js";
 import { AsyncAtomicTempOwner, SyncAtomicTempOwner } from "./replace-file-temp-owner.js";
 import { assertSafePathPrefix } from "./safe-path-segment.js";
-import { admitStandalonePublicationPath } from "./standalone-publication-path.js";
+import { admitStandalonePublicationPath } from "./windows-path-alias.js";
 import { sleep, sleepSync } from "./timing.js";
 import { serializePathWrite } from "./write-queue.js";
-function isRetryableRenameError(error) {
-    return error.code === "EBUSY";
-}
-function isPermissionRenameError(error) {
-    const code = error.code;
-    return code === "EPERM" || code === "EEXIST";
-}
+import { hasErrorCode, readErrorCode } from "./file-cleanup.js";
 async function renameWithRetry(params) {
     for (let attempt = 0; attempt <= params.maxRetries; attempt++) {
         if (attempt > 0)
@@ -28,11 +22,12 @@ async function renameWithRetry(params) {
             return { method: "rename" };
         }
         catch (error) {
-            if (isRetryableRenameError(error) && attempt < params.maxRetries) {
+            const code = readErrorCode(error);
+            if (code === "EBUSY" && attempt < params.maxRetries) {
                 await sleep(params.baseDelayMs * 2 ** attempt);
                 continue;
             }
-            if (params.copyFallbackOnPermissionError && isPermissionRenameError(error)) {
+            if (params.copyFallbackOnPermissionError && (code === "EPERM" || code === "EEXIST")) {
                 await copyFallbackReplace({
                     fsModule: params.fsModule,
                     src: params.src,
@@ -59,11 +54,12 @@ function renameWithRetrySync(params) {
             return { method: "rename" };
         }
         catch (error) {
-            if (isRetryableRenameError(error) && attempt < params.maxRetries) {
+            const code = readErrorCode(error);
+            if (code === "EBUSY" && attempt < params.maxRetries) {
                 sleepSync(params.baseDelayMs * 2 ** attempt);
                 continue;
             }
-            if (params.copyFallbackOnPermissionError && isPermissionRenameError(error)) {
+            if (params.copyFallbackOnPermissionError && (code === "EPERM" || code === "EEXIST")) {
                 copyFallbackReplaceSync({
                     fsModule: params.fsModule,
                     src: params.src,
@@ -114,7 +110,7 @@ async function resolveMode(options, filePath) {
         stat = fsModule === fs ? syncFs.lstatSync(filePath) : await fsModule.lstat(filePath);
     }
     catch (error) {
-        if (error.code === "ENOENT") {
+        if (hasErrorCode(error, "ENOENT")) {
             return defaultMode;
         }
         throw error;
@@ -132,7 +128,7 @@ function resolveModeSync(options, filePath) {
         stat = fsModule.lstatSync(filePath);
     }
     catch (error) {
-        if (error.code !== "ENOENT") {
+        if (!hasErrorCode(error, "ENOENT")) {
             throw error;
         }
     }
@@ -171,7 +167,7 @@ async function replaceFileAtomicUnserialized(options, filePath, renameIdentity,
     const expectedHash = atomicExpectedContentHash(renameIdentity, options.content);
     const tempPath = buildReplaceTempPath(filePath, options.tempPrefix);
     const tempOwner = new AsyncAtomicTempOwner(tempPath);
-    let originalError;
+    let originalFailure;
     try {
         await fsModule.mkdir(fsModule === fs ? recursiveMkdirPath(dir) : dir, { recursive: true, mode: dirMode });
         await applyDirectoryMode({ fsModule, dirPath: dir, mode: dirMode });
@@ -229,13 +225,13 @@ async function replaceFileAtomicUnserialized(options, filePath, renameIdentity,
         return result;
     }
     catch (error) {
-        originalError = error;
+        originalFailure = { error };
         throw error;
     }
     finally {
         await tempOwner.finish({
             fsModule,
-            originalError,
+            originalFailure,
             throwOnCleanupError: options.throwOnCleanupError === true,
         });
     }
@@ -271,7 +267,7 @@ function replaceFileAtomicSyncUnserialized(options, filePath, renameIdentity) {
     }
     const tempPath = buildReplaceTempPath(filePath, options.tempPrefix);
     const tempOwner = new SyncAtomicTempOwner(tempPath);
-    let originalError;
+    let originalFailure;
     try {
         fsModule.mkdirSync(fsModule === syncFs ? recursiveMkdirPath(dir) : dir, { recursive: true, mode: dirMode });
         applyDirectoryModeSync({ fsModule, dirPath: dir, mode: dirMode, fchmodSync });
@@ -327,13 +323,13 @@ function replaceFileAtomicSyncUnserialized(options, filePath, renameIdentity) {
         return result;
     }
     catch (error) {
-        originalError = error;
+        originalFailure = { error };
         throw error;
     }
     finally {
         tempOwner.finish({
             fsModule,
-            originalError,
+            originalFailure,
             throwOnCleanupError: options.throwOnCleanupError === true,
         });
     }

package/node_modules/@openclaw/fs-safe/dist/retained-directory-replacement.d.ts

@@ -0,0 +1,25 @@
+import type { BigIntStats } from "node:fs";
+import type { NativeBinding, NativeOwnedTreeRemovalResult } from "./native-binding.js";
+type RenameBinding = NativeBinding & Required<Pick<NativeBinding, "renameNoReplaceWithIdentity">>;
+export type RetainedReplacementParent = Readonly<{
+    path: string;
+    realPath: string;
+    identity: Pick<BigIntStats, "dev" | "ino">;
+}>;
+export declare class RetainedDirectoryReplacement {
+    #private;
+    private constructor();
+    static requireBinding(): RenameBinding;
+    static retain(params: {
+        targetParent: RetainedReplacementParent;
+        stagedParent: RetainedReplacementParent;
+        originalTarget?: Readonly<{
+            path: string;
+            identity: Pick<BigIntStats, "dev" | "ino">;
+        }>;
+    }, binding?: RenameBinding): RetainedDirectoryReplacement;
+    renameNoReplace(sourceParent: "staged" | "target", sourceBasename: string, targetBasename: string, expectedSource: Pick<BigIntStats, "dev" | "ino">): void;
+    removeOriginal(backupBasename: string): Promise<NativeOwnedTreeRemovalResult["outcome"]>;
+    close(): void;
+}
+export {};