@openclaw/openshell-sandbox 2026.9.5 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/root-write-admission.d.ts

@@ -1,7 +1,7 @@
 import type { BigIntStats } from "node:fs";
 import { type DenyMutationPolicy } from "./deny-mutations.js";
 import { type AnyAsyncDirectoryGuard } from "./directory-guard.js";
-import type { PinnedWriteMutationAdmission } from "./pinned-write.js";
+import type { PinnedWriteMutationAdmission } from "./pinned-write-types.js";
 import type { RootContext } from "./root-context.js";
 import { resolvePathInRoot } from "./root-context.js";
 import { type MutationSymlinkPolicy } from "./root-symlink-policy.js";
@@ -34,9 +34,7 @@ export type RootWritePathSelection = Readonly<{
 export type RetainedRootWriteSelection = RootWritePathSelection & Readonly<{
     identity: Readonly<Pick<BigIntStats, "dev" | "ino">>;
 }>;
-export declare function retainRootWriteSelection(owner: object, selection: RetainedRootWriteSelection): void;
 export declare function createRootWriteSelectionForFd(selection: RootWritePathSelection, fd: number): RetainedRootWriteSelection;
-export declare function takeRootWriteSelection(owner: object): RetainedRootWriteSelection | undefined;
 export declare function assertRootWritePathSelectionSync(root: RootContext, selection: RootWritePathSelection): void;
 export declare function assertRootWriteSelectionSync(root: RootContext, selection: RetainedRootWriteSelection, verifyBinding: boolean, fd?: number): void;
 export declare function prepareRootWritePathSelection(params: Omit<RootWritePathSelection, "parentGuard"> & Readonly<{
@@ -65,4 +63,3 @@ export declare function resolveGuardedWritePathInRoot(root: RootContext, params:
 export declare function resolveGuardedWriteTargetInRoot(root: RootContext, params: GuardedWritePathOptions): Promise<GuardedRootWriteTarget>;
 export declare function resolvePinnedWriteTargetInRoot(root: RootContext, relativePath: string, requestedMode?: number, denyMutations?: DenyMutationPolicy, overwrite?: boolean, mutationSymlinks?: MutationSymlinkPolicy): Promise<PinnedWriteTarget>;
 export {};
-//# sourceMappingURL=root-write-admission.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-write-admission.js

@@ -6,19 +6,15 @@ import { FsSafeError } from "./errors.js";
 import { isNotFoundPathError } from "./path.js";
 import { assertNoPathAliasEscape } from "./path-policy.js";
 import { preparePinnedWriteMutationAdmission, snapshotPinnedMutationPolicy, } from "./pinned-mutation-admission.js";
-import { admitPathInsideRoot } from "./root-boundary.js";
+import { admitPathInsideRoot, sameNormalizedPathSpelling } from "./root-boundary.js";
 import { resolvePathInRoot } from "./root-context.js";
-import { hardlinkedPathNotAllowedError, outsideWorkspaceError } from "./root-errors.js";
+import { errorCauseOptions, hardlinkedPathNotAllowedError, outsideWorkspaceError } from "./root-errors.js";
 import { inheritWriteTargetMode } from "./root-write-mode.js";
 import { mutationSymlinkResolution, } from "./root-symlink-policy.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { realpathSync } from "./realpath.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
 import { assertPreparedRootWriteParentCurrent, } from "./root-write-complete-parent.js";
-const retainedRootWriteSelections = new WeakMap();
-export function retainRootWriteSelection(owner, selection) {
-    retainedRootWriteSelections.set(owner, selection);
-}
 export function createRootWriteSelectionForFd(selection, fd) {
     const stat = inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }));
     return Object.freeze({
@@ -26,15 +22,8 @@ export function createRootWriteSelectionForFd(selection, fd) {
         identity: Object.freeze({ dev: stat.dev, ino: stat.ino }),
     });
 }
-export function takeRootWriteSelection(owner) {
-    const selection = retainedRootWriteSelections.get(owner);
-    retainedRootWriteSelections.delete(owner);
-    return selection;
-}
 function writeSelectionChanged(cause) {
-    return new FsSafeError("path-mismatch", "write target changed during operation", {
-        cause: cause instanceof Error ? cause : undefined,
-    });
+    return new FsSafeError("path-mismatch", "write target changed during operation", errorCauseOptions(cause));
 }
 function inspectRegularSelectionPath(pathname, expected, follow) {
     let observed;
@@ -55,11 +44,6 @@ function inspectRegularSelectionPath(pathname, expected, follow) {
         throw hardlinkedPathNotAllowedError();
     return observed;
 }
-function sameNormalizedPathSpelling(left, right) {
-    // Windows can expose case-sensitive directories, so normalize separators
-    // and roots without using path.relative's case-folding comparison.
-    return path.resolve(left) === path.resolve(right);
-}
 function inspectSelectionBindingSync(root, selection, fd) {
     inspectRegularSelectionPath(selection.selectedPath, selection.identity, false);
     if (!sameNormalizedPathSpelling(selection.operationTargetPath, selection.selectedPath)) {
@@ -200,9 +184,7 @@ export async function resolveGuardedWritePathInRoot(root, params) {
             });
         }
         catch (error) {
-            throw new FsSafeError("path-alias", "path alias escape blocked", {
-                cause: error instanceof Error ? error : undefined,
-            });
+            throw new FsSafeError("path-alias", "path alias escape blocked", errorCauseOptions(error));
         }
     }
     return resolvedPath;

package/node_modules/@openclaw/fs-safe/dist/root-write-compatibility.d.ts

@@ -1,5 +1,4 @@
-import { type RootBoundaryIdentity } from "./root-boundary.js";
-export declare function assertRootFallbackWritePath(expected: string | undefined, actual: string): void;
+import type { RootBoundaryIdentity } from "./root-boundary.js";
 export declare function withRootFallbackCompatibilityLock<T>(params: {
     rootPath: string;
     targetPath: string;
@@ -10,4 +9,3 @@ export declare function withRootFallbackCompatibilityLock<T>(params: {
     relativePath: string;
     assertBeforeMutation: () => void;
 }) => Promise<T>): Promise<T>;
-//# sourceMappingURL=root-write-compatibility.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-write-compatibility.js

@@ -1,74 +1,23 @@
-import fs from "node:fs";
-import path from "node:path";
-import { FsSafeError } from "./errors.js";
-import { isNotFoundPathError } from "./path.js";
-import { admitPathInsideRoot } from "./root-boundary.js";
 import { withPinnedWriteRenameIdentityLock } from "./pinned-write.js";
-import { realpathSync } from "./realpath.js";
+import { createRootWriteLockBinding } from "./root-write-lock-binding.js";
 import { serializePathWrite } from "./write-queue.js";
-function unsupportedSpelling() {
-    return new FsSafeError("path-alias", "Windows compatibility writes require lower-case ASCII destination components");
-}
-// The caller first applies the Root's ordinary path and mutation policies. This
-// extra admission rule is deliberately narrower than general Windows filenames:
-// the existing lock protocol has no portable case/Unicode equivalence key for a
-// missing name. Do not guess one, or switch keys when a placeholder appears.
-function effectiveDestination(rootPath, targetPath, rootIdentity) {
-    let effective;
+export async function withRootFallbackCompatibilityLock(params, run) {
+    const binding = createRootWriteLockBinding(params);
+    const callerAssertion = params.assertBeforeMutation;
+    const assertBeforeMutation = callerAssertion === undefined
+        ? binding.assertCurrent
+        : () => { callerAssertion.call(params); binding.assertCurrent(); };
+    // Keep the alias queue and historical lock hash before admitting the writer.
     try {
-        effective = realpathSync.native(targetPath);
-    }
-    catch (error) {
-        if (!isNotFoundPathError(error))
-            throw error;
-        let cursor = targetPath;
-        const missing = [];
-        for (;;) {
-            try {
-                fs.lstatSync(cursor);
-                break;
-            }
-            catch (error) {
-                if (!isNotFoundPathError(error) || cursor === rootPath)
-                    throw error;
-                const parent = path.dirname(cursor);
-                if (parent === cursor)
-                    throw error;
-                missing.unshift(path.basename(cursor));
-                cursor = parent;
-            }
-        }
-        // An existing dangling link must fail resolution, not become a missing
-        // lexical component. Keep the fallback bounded by the retained Root.
-        effective = path.join(realpathSync.native(cursor), ...missing);
+        return await serializePathWrite(binding.targetPath, async () => await withPinnedWriteRenameIdentityLock({
+            rootPath: params.rootPath, targetPath: binding.targetPath, relativeTargetPath: binding.relativeLockPath,
+        }, async () => await run({
+            targetPath: binding.targetPath,
+            relativePath: binding.relativePath,
+            assertBeforeMutation,
+        })));
     }
-    const admitted = admitPathInsideRoot({ rootPath, candidatePath: effective, rootIdentity });
-    if (!admitted)
-        throw unsupportedSpelling();
-    const relative = admitted.relativePath;
-    if (!relative || !relative.split(path.sep).every(component => /^[a-z0-9._-]+$/.test(component) && !component.endsWith(".")))
-        throw unsupportedSpelling();
-    return admitted.path;
-}
-export function assertRootFallbackWritePath(expected, actual) {
-    if (expected !== undefined && actual !== expected) {
-        throw new FsSafeError("path-mismatch", "compatibility write destination changed after lock selection");
+    finally {
+        binding.dispose();
     }
 }
-export async function withRootFallbackCompatibilityLock(params, run) {
-    const targetPath = effectiveDestination(params.rootPath, params.targetPath, params.rootIdentity);
-    const relativePath = path.relative(params.rootPath, targetPath).split(path.sep).join("/");
-    const assertCurrent = () => assertRootFallbackWritePath(targetPath, effectiveDestination(params.rootPath, targetPath, params.rootIdentity));
-    // Sidecars are reentrant within one manager; aliases also need the same local
-    // queue before acquisition. The outer Root queue uses the caller's spelling.
-    return await serializePathWrite(targetPath, async () => await withPinnedWriteRenameIdentityLock({
-        rootPath: params.rootPath, targetPath, relativeTargetPath: relativePath,
-    }, async () => {
-        // The guarded open resolves again under the lock; each mutation rechecks
-        // below. Lock selection is never reused as post-lock filesystem authority.
-        return await run({
-            targetPath, relativePath,
-            assertBeforeMutation: () => { params.assertBeforeMutation?.(); assertCurrent(); },
-        });
-    }));
-}

package/node_modules/@openclaw/fs-safe/dist/root-write-complete-parent.d.ts

@@ -39,4 +39,3 @@ export type SharedRootWriteTarget = Readonly<{
 export declare function assertPreparedRootWriteParentCurrent(prepared: PreparedRootWriteParent, verifyTarget?: boolean): void;
 export declare function prepareSharedRootWriteTarget(root: RootContext, params: SharedRootWriteTargetParams): Promise<SharedRootWriteTarget>;
 export {};
-//# sourceMappingURL=root-write-complete-parent.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-write-complete-parent.js

@@ -1,45 +1,29 @@
 import fsSync from "node:fs";
 import path from "node:path";
 import { assertDirectoryIdentitySync, createAsyncDirectoryGuard, inspectDirectoryIdentitySync, } from "./directory-guard.js";
-import { WINDOWS_RESERVED_DEVICE_NAMES } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
 import { getFsSafeNativeConfig } from "./native-config.js";
 import { hasNodeErrorCode } from "./path.js";
 import { realpathSync } from "./realpath.js";
-import { admitPathInsideRoot } from "./root-boundary.js";
+import { admitPathInsideRoot, sameNormalizedPathSpelling } from "./root-boundary.js";
+import { ordinaryWindowsSegments } from "./pinned-mutation-shared-route.js";
 import { prepareRootWriteTarget } from "./root-directory-creation.js";
-import { isSafePathSegment } from "./safe-path-segment.js";
+import { errorCauseOptions } from "./root-errors.js";
+import { canReuseParentWithMutationAssertion } from "./root-write-lock-binding.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
 function writeSelectionChanged(cause) {
-    return new FsSafeError("path-mismatch", "write target changed during operation", {
-        cause: cause instanceof Error ? cause : undefined,
-    });
-}
-function sameNormalizedPathSpelling(left, right) {
-    // Windows can expose case-sensitive directories, so normalize separators
-    // and roots without using path.relative's case-folding comparison.
-    return path.resolve(left) === path.resolve(right);
-}
-function windowsReservedDeviceSegment(segment) {
-    const extension = segment.indexOf(".");
-    const stem = segment.slice(0, extension < 0 ? segment.length : extension).toUpperCase();
-    return WINDOWS_RESERVED_DEVICE_NAMES.has(stem);
+    return new FsSafeError("path-mismatch", "write target changed during operation", errorCauseOptions(cause));
 }
 function ordinarySharedWriteRoute(root, relativePath, operationTargetPath) {
     if (process.versions.bun || relativePath === "" || relativePath.startsWith("~") ||
         relativePath.includes("\0") || path.isAbsolute(relativePath))
         return false;
-    const separator = process.platform === "win32" ? "\\" : "/";
-    const alternateSeparator = process.platform === "win32" ? "/" : "\\";
-    if (relativePath.includes(alternateSeparator))
-        return false;
-    const segments = relativePath.split(separator);
-    if (segments.some((segment) => segment === "" || segment === "." || segment === ".." ||
-        (process.platform === "win32" &&
-            (!isSafePathSegment(segment, { allowDotPrefix: true }) ||
-                segment.endsWith(".") || segment.endsWith(" ") ||
-                windowsReservedDeviceSegment(segment)))))
+    if (process.platform === "win32") {
+        if (!ordinaryWindowsSegments(relativePath))
+            return false;
+    }
+    else if (relativePath.includes("\\") || relativePath.split("/").some(segment => segment === "" || segment === "." || segment === ".."))
         return false;
     const routed = path.resolve(root.rootReal, relativePath);
     const admitted = admitPathInsideRoot({
@@ -185,7 +169,8 @@ export async function prepareSharedRootWriteTarget(root, params) {
     if (mutationAdmission)
         await beforeParentAdmission?.(resolvedPath);
     const preparedParent = params.mkdir !== false &&
-        params.assertBeforeMutation === undefined && beforeParentAdmission === undefined
+        canReuseParentWithMutationAssertion(params.assertBeforeMutation, root.rootReal, guardedTarget.targetPath) &&
+        beforeParentAdmission === undefined
         ? await prepareCompleteRootWriteParent(root, guardedTarget, params.relativePath)
         : undefined;
     const targetPath = params.mkdir === false

package/node_modules/@openclaw/fs-safe/dist/root-write-lock-binding.d.ts

@@ -0,0 +1,14 @@
+import { type RootBoundaryIdentity } from "./root-boundary.js";
+export declare function canReuseParentWithMutationAssertion(assertion: (() => void) | undefined, rootPath: string, targetPath: string): boolean;
+export declare function assertRootFallbackWritePath(expected: string | undefined, actual: string): void;
+export declare function createRootWriteLockBinding(params: Readonly<{
+    rootPath: string;
+    targetPath: string;
+    rootIdentity?: RootBoundaryIdentity;
+}>): Readonly<{
+    targetPath: string;
+    relativePath: string;
+    relativeLockPath: string;
+    assertCurrent: () => void;
+    dispose(): void;
+}>;

package/node_modules/@openclaw/fs-safe/dist/root-write-lock-binding.js

@@ -0,0 +1,162 @@
+import fs from "node:fs";
+import path from "node:path";
+import { inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { hasNodeErrorCode, isNotFoundPathError } from "./path.js";
+import { admitPathInsideRoot } from "./root-boundary.js";
+import { realpathSync } from "./realpath.js";
+const lockObservations = new WeakMap();
+export function canReuseParentWithMutationAssertion(assertion, rootPath, targetPath) {
+    if (assertion === undefined)
+        return true;
+    const binding = lockObservations.get(assertion);
+    return binding?.rootPath === rootPath && binding.targetPath === targetPath;
+}
+function unsupportedSpelling() {
+    return new FsSafeError("path-alias", "Windows compatibility writes require lower-case ASCII destination components");
+}
+// Missing names have no portable case/Unicode lock key. Keep this admission
+// narrower than general Root paths and never change keys after acquisition.
+function effectiveDestination(rootPath, targetPath, rootIdentity) {
+    let effective;
+    let missingHint;
+    try {
+        effective = realpathSync.native(targetPath);
+    }
+    catch (error) {
+        if (!isNotFoundPathError(error))
+            throw error;
+        let cursor = targetPath;
+        const missing = [];
+        for (;;) {
+            try {
+                fs.lstatSync(cursor);
+                break;
+            }
+            catch (error) {
+                if (!isNotFoundPathError(error) || cursor === rootPath)
+                    throw error;
+                const parent = path.dirname(cursor);
+                if (parent === cursor)
+                    throw error;
+                missing.unshift(path.basename(cursor));
+                cursor = parent;
+            }
+        }
+        // Existing dangling links must fail resolution, not become missing names.
+        const canonicalParent = realpathSync.native(cursor);
+        effective = path.join(canonicalParent, ...missing);
+        // The hint must describe the selected route exactly. The full resolver can
+        // normalize a missing raw `..` component out of the eventual lock path.
+        if (missing.length > 1 && path.resolve(canonicalParent) === canonicalParent &&
+            missing.every(component => /^[a-z0-9._-]+$/.test(component) &&
+                component !== "." && component !== ".." && !component.endsWith("."))) {
+            missingHint = Object.freeze({ parentPath: canonicalParent, parts: Object.freeze(missing), nextIndex: 0 });
+        }
+    }
+    const admitted = admitPathInsideRoot({ rootPath, candidatePath: effective, rootIdentity });
+    if (!admitted)
+        throw unsupportedSpelling();
+    const relative = admitted.relativePath;
+    if (!relative || !relative.split(path.sep).every(component => /^[a-z0-9._-]+$/.test(component) && !component.endsWith(".")))
+        throw unsupportedSpelling();
+    return {
+        path: admitted.path,
+        // Case-folded or rebased root spellings keep the full resolver and its
+        // existing root-identity admission at every mutation.
+        missing: admitted.admission === "exact" && admitted.path === effective ? missingHint : undefined,
+    };
+}
+// The hint stores only a location. Each call freshly binds the nearest existing
+// prefix and its first absent child; no identity or authorization crosses calls.
+function observeMissingDestination(hint) {
+    // A complete parent needs only the ordinary leaf check, not a prefix fence.
+    if (hint.parts.length - hint.nextIndex < 2)
+        return undefined;
+    try {
+        let parentPath = hint.parentPath;
+        let parent = inspectDirectoryIdentitySync(parentPath);
+        for (let nextIndex = hint.nextIndex; nextIndex < hint.parts.length; nextIndex++) {
+            const childPath = path.join(parentPath, hint.parts[nextIndex]);
+            let child;
+            try {
+                child = fs.lstatSync(childPath, { bigint: true });
+            }
+            catch (error) {
+                if (!hasNodeErrorCode(error, "ENOENT"))
+                    return undefined;
+                if (realpathSync.native(parentPath) !== parentPath)
+                    return undefined;
+                inspectDirectoryIdentitySync(parentPath, parent);
+                try {
+                    fs.lstatSync(childPath);
+                }
+                catch (error) {
+                    if (!hasNodeErrorCode(error, "ENOENT"))
+                        return undefined;
+                    // Absence can follow a renamed ancestor through a new alias while
+                    // preserving the directory's identity. Finish at its current name.
+                    if (realpathSync.native(parentPath) !== parentPath)
+                        return undefined;
+                    return Object.freeze({ parentPath, parts: hint.parts, nextIndex });
+                }
+                return undefined;
+            }
+            // An existing leaf always receives the historical full resolution,
+            // including final links, collisions and unsupported canonical spellings.
+            if (nextIndex === hint.parts.length - 1)
+                return undefined;
+            parent = inspectDirectoryIdentitySync(childPath, undefined, child);
+            parentPath = childPath;
+        }
+    }
+    catch {
+        // Removal, redirection and uncertain observations only discard the hint.
+        // The full resolver below still determines the destination and error.
+    }
+    return undefined;
+}
+export function assertRootFallbackWritePath(expected, actual) {
+    if (expected !== undefined && actual !== expected) {
+        throw new FsSafeError("path-mismatch", "compatibility write destination changed after lock selection");
+    }
+}
+export function createRootWriteLockBinding(params) {
+    const { rootPath } = params;
+    const rootIdentity = params.rootIdentity && Object.freeze({
+        dev: params.rootIdentity.dev, ino: params.rootIdentity.ino,
+    });
+    const selected = effectiveDestination(rootPath, params.targetPath, rootIdentity);
+    const targetPath = selected.path;
+    let missingHint = selected.missing;
+    const relativePath = path.relative(rootPath, targetPath);
+    let active = true;
+    const assertCurrent = () => {
+        if (!active)
+            throw new FsSafeError("path-mismatch", "compatibility lock observation expired");
+        const observed = missingHint && observeMissingDestination(missingHint);
+        if (observed) {
+            missingHint = observed;
+            return;
+        }
+        missingHint = undefined;
+        const current = effectiveDestination(rootPath, targetPath, rootIdentity);
+        assertRootFallbackWritePath(targetPath, current.path);
+        missingHint = current.missing;
+    };
+    // Only this library-owned, observation-only closure permits parent reuse.
+    // Callers cannot obtain that status by setting properties on their callback.
+    lockObservations.set(assertCurrent, Object.freeze({ rootPath, targetPath }));
+    return Object.freeze({
+        targetPath,
+        relativePath,
+        // The existing lock protocol uses slashes; the writer needs native spelling.
+        relativeLockPath: relativePath.split(path.sep).join("/"),
+        assertCurrent,
+        dispose() {
+            active = false;
+            missingHint = undefined;
+            lockObservations.delete(assertCurrent);
+        },
+    });
+}

package/node_modules/@openclaw/fs-safe/dist/root-write-mode.d.ts

@@ -5,4 +5,3 @@ export declare function inheritWriteTargetMode(params: {
     rootIdentity?: RootBoundaryIdentity;
     requestedMode?: number;
 }): Promise<number>;
-//# sourceMappingURL=root-write-mode.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-write-publication.d.ts

@@ -21,4 +21,3 @@ export declare function finishRootFallbackWrite(params: {
     }>;
     onVerificationFailure: (error: unknown) => void;
 }): Promise<void>;
-//# sourceMappingURL=root-write-publication.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-write-publication.js

@@ -4,7 +4,7 @@ import { readFileHandleBounded } from "./bounded-read.js";
 import { syncDirectoryBestEffort } from "./directory-durability.js";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentityForCleanup, sha256Hex } from "./file-identity.js";
-import { cleanupPinnedFilePath } from "./replace-file-temp-owner.js";
+import { cleanupPinnedFilePath } from "./file-cleanup.js";
 import { verifyAtomicWriteResult } from "./root-write-verification.js";
 // Compatibility callers hold the lock throughout this operation. The caller
 // owns the original write handle; this helper owns a content-verified reopen.

package/node_modules/@openclaw/fs-safe/dist/root-write-verification.d.ts

@@ -1,5 +1,5 @@
 import { type AnyAsyncDirectoryGuard } from "./directory-guard.js";
-import type { PublishedWriteIdentity } from "./pinned-write.js";
+import type { PublishedWriteIdentity } from "./pinned-write-types.js";
 import { type RootContext } from "./root-context.js";
 export declare function verifyAtomicWriteResult(params: {
     root: RootContext;
@@ -9,4 +9,3 @@ export declare function verifyAtomicWriteResult(params: {
     expectedMode?: number;
     parentGuard: AnyAsyncDirectoryGuard;
 }): Promise<void>;
-//# sourceMappingURL=root-write-verification.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-write-verification.js

@@ -1,5 +1,5 @@
 import fsSync, {} from "node:fs";
-import fs from "node:fs/promises";
+import fs, {} from "node:fs/promises";
 import { assertAsyncDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentity } from "./file-identity.js";
@@ -45,59 +45,46 @@ export async function verifyAtomicWriteResult(params) {
         return stat;
     };
     try {
-        // This descriptor remains owned by the writer, even when final mode forbids opens.
-        const stat = assertDescriptor();
-        assertPath(fsSync.lstatSync(params.targetPath, { bigint: true }));
-        const { realPath, stat: resolvedStat } = await resolveOpenedFileRealPathForFd(params.fd, stat, params.targetPath);
-        // Consume the resolver's observation only in this pass; the checks after
-        // the directory guards must still sample the current path and descriptor.
-        assertPath(resolvedStat);
-        if (!admitPathInsideRoot({
-            rootPath: params.root.rootReal,
-            candidatePath: realPath,
-            rootIdentity: params.root.rootIdentity,
-        })) {
-            throw outsideWorkspaceError();
-        }
-        await assertAsyncDirectoryGuard(params.parentGuard);
-        await assertRootIdentityCurrent(params.root);
-        // Recheck after canonical resolution and directory checks, including late links.
-        assertPath(fsSync.lstatSync(params.targetPath, { bigint: true }));
-        assertDescriptor();
-        if (needsPathOpen) {
-            // A retained fd cannot prove that an opaque Windows pathname still names it.
-            // Reopen only for publication verification: the writer's exact identity is
-            // independent proof unavailable to ordinary readers. Never read any bytes.
-            assertNoUnsafeDeviceReadPath(params.targetPath);
-            const opened = await fs.open(params.targetPath, resolveReadOpenFlags()).catch((error) => {
-                if (isSymlinkOpenError(error)) {
-                    throw new FsSafeError("symlink", "symlink open blocked", { cause: error });
-                }
-                if (hasNodeErrorCode(error, "EISDIR")) {
-                    throw new FsSafeError("not-file", "not a file");
-                }
-                throw error;
-            });
-            try {
-                const reopenedStat = assertDescriptor(opened.fd);
+        let opened;
+        try {
+            while (true) {
+                // The original descriptor remains borrowed; only a verification reopen is owned here.
+                const fd = opened?.fd ?? params.fd;
+                const stat = assertDescriptor(fd);
                 assertPath(fsSync.lstatSync(params.targetPath, { bigint: true }));
-                const { realPath: reopenedPath, stat: reopenedPathStat } = await resolveOpenedFileRealPathForFd(opened.fd, reopenedStat, params.targetPath);
-                assertPath(reopenedPathStat);
+                const { realPath, stat: resolvedStat } = await resolveOpenedFileRealPathForFd(fd, stat, params.targetPath);
+                // Consume the resolver's observation only in this pass; the checks after
+                // the directory guards must still sample the current path and descriptor.
+                assertPath(resolvedStat);
                 if (!admitPathInsideRoot({
                     rootPath: params.root.rootReal,
-                    candidatePath: reopenedPath,
+                    candidatePath: realPath,
                     rootIdentity: params.root.rootIdentity,
                 })) {
                     throw outsideWorkspaceError();
                 }
                 await assertAsyncDirectoryGuard(params.parentGuard);
                 await assertRootIdentityCurrent(params.root);
+                // Recheck after canonical resolution and directory checks, including late links.
                 assertPath(fsSync.lstatSync(params.targetPath, { bigint: true }));
-                assertDescriptor(opened.fd);
+                assertDescriptor(fd);
+                if (opened || !needsPathOpen)
+                    break;
+                // Opaque Windows pathname identity needs one independent, read-free reopen.
+                assertNoUnsafeDeviceReadPath(params.targetPath);
+                opened = await fs.open(params.targetPath, resolveReadOpenFlags()).catch((error) => {
+                    if (isSymlinkOpenError(error)) {
+                        throw new FsSafeError("symlink", "symlink open blocked", { cause: error });
+                    }
+                    if (hasNodeErrorCode(error, "EISDIR"))
+                        throw new FsSafeError("not-file", "not a file");
+                    throw error;
+                });
             }
-            finally {
+        }
+        finally {
+            if (opened)
                 await opened.close().catch(() => undefined);
-            }
         }
     }
     catch (error) {

package/node_modules/@openclaw/fs-safe/dist/root.d.ts

@@ -1,7 +1,2 @@
-export { DEFAULT_ROOT_MAX_BYTES, openLocalFileSafely, readLocalFileSafely, resolveOpenedFileRealPathForHandle, root, type DenyMutationPolicy, type HardlinkPolicy, type MutationSymlinkPolicy, type RenameIdentityPolicy, type OpenResult, type ReadResult, type Root, type RootAppendOptions, type RootCopyOptions, type RootCopySource, type RootCreateJsonOptions, type RootCreateOptions, type RootCreateStreamOptions, type RootDefaults, type RootMkdirOptions, type RootMoveOptions, type RootOpenOptions, type RootOpenWritableOptions, type RootOptions, type RootReadOptions, type RootRemoveOptions, type RootWriteJsonOptions, type RootWriteOptions, type SymlinkPolicy, type WritableOpenMode, type WritableOpenResult, } from "./root-impl.js";
-export type { RootCopyPublicationReceipt } from "./copy-publication.js";
-export type { CopyCloneMode } from "./copy-policy.js";
-export type { RootEntriesOptions } from "./root-entries.js";
-export type { ContainmentGuarantee } from "./containment.js";
-export type { RootWalkDataEntry, RootWalkDataEntryKind, RootWalkDirectoryErrorBehavior, RootWalkEntry, RootWalkEntryFilter, RootWalkEntryFilterResult, RootWalkEntryKind, RootWalkLimitBehavior, RootWalkOptions, RootWalkSymlinkPolicy, } from "./root-walk.js";
-//# sourceMappingURL=root.d.ts.map
+export { DEFAULT_ROOT_MAX_BYTES, openLocalFileSafely, readLocalFileSafely, resolveOpenedFileRealPathForHandle, root, type Root, } from "./root-impl.js";
+export type * from "./root-public-types.js";

package/node_modules/@openclaw/fs-safe/dist/safe-path-segment.d.ts

@@ -7,6 +7,5 @@ export declare function assertNoDriveRelativePathSegments(value: string, label:
 export declare function trimHyphenEdges(value: string): string;
 export declare function isSafePathSegment(segment: string, options?: SafePathSegmentOptions): boolean;
 export declare function assertSafePathSegment(segment: string, options?: SafePathSegmentOptions): string;
-export declare function sanitizeSafePathSegment(value: string, fallback: string, options?: SafePathSegmentOptions): string;
+export declare function sanitizeSafePathSegment(value: string): string | undefined;
 export declare function assertSafePathPrefix(prefix: string, options?: SafePathSegmentOptions): string;
-//# sourceMappingURL=safe-path-segment.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/safe-path-segment.js

@@ -47,17 +47,14 @@ export function assertSafePathSegment(segment, options = {}) {
     }
     return segment;
 }
-export function sanitizeSafePathSegment(value, fallback, options = {}) {
+export function sanitizeSafePathSegment(value) {
     const sanitized = value
         .trim()
         .replace(/[\\/]+/g, "-")
         .replace(/\0/g, "")
         .replace(/[^A-Za-z0-9._-]+/g, "-");
     const trimmed = trimHyphenEdges(sanitized);
-    if (isSafePathSegment(trimmed, options)) {
-        return trimmed;
-    }
-    return assertSafePathSegment(fallback, { ...options, label: "fallback path segment" });
+    return isSafePathSegment(trimmed, { allowDotPrefix: true }) ? trimmed : undefined;
 }
 export function assertSafePathPrefix(prefix, options = {}) {
     // Prefixes are often derived from safe filenames. Normalize harmless

package/node_modules/@openclaw/fs-safe/dist/secret-file.d.ts

@@ -23,4 +23,3 @@ export declare function prepareSecretFileWrite(params: Omit<SecretFileWriteParam
 export declare function writeSecretFileAtomic(params: SecretFileWriteParams): Promise<void>;
 export declare function createSecretFileAtomic(params: SecretFileWriteParams): Promise<void>;
 export {};
-//# sourceMappingURL=secret-file.d.ts.map