@openclaw/openshell-sandbox 2026.9.5 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/staged-directory.js

@@ -1,7 +1,9 @@
 import fs, {} from "node:fs";
 import path from "node:path";
+import { directoryReceiptAuthority, ownDirectoryReceipt } from "./directory-receipt.js";
 import { FsSafeError } from "./errors.js";
 import { inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { nativePolicyDirectoryObserver, NativePolicyDirectoryMismatch } from "./native-policy-directory-observation.js";
 import { checkedMutationDirectory, } from "./pinned-mutation-observation.js";
 import { realpathSync } from "./realpath.js";
 import { resolvePathPreservingWindowsRoot } from "./windows-path-alias.js";
@@ -38,12 +40,31 @@ function sameDirectoryMetadata(left, right) {
 }
 // The policy hot path is Node/POSIX-only. It deliberately uses native
 // canonicalization so a successful capture contains no JS realpath work.
-export function describePolicyStagedDirectory(fd, pathname) {
+export function describePolicyStagedDirectory(fd, pathname, binding) {
     const resolved = path.resolve(pathname);
     const descriptor = fs.fstatSync(fd, { bigint: true });
     if (!descriptor.isDirectory()) {
         throw new FsSafeError("not-file", "staging parent must be a directory");
     }
+    const observeCurrent = nativePolicyDirectoryObserver(binding, fd, resolved);
+    const observed = observeCurrent?.();
+    if (observed) {
+        if (!sameDirectoryMetadata(descriptor, observed.identity)) {
+            throw new NativePolicyDirectoryMismatch();
+        }
+        const directory = Object.freeze({
+            path: resolved,
+            realPath: observed.canonicalPath,
+            identity: Object.freeze({ dev: descriptor.dev, ino: descriptor.ino }),
+        });
+        return Object.freeze({
+            directory,
+            observation: checkedMutationDirectory(resolved, observed.canonicalPath, observed.identity, observeCurrent),
+            stat: descriptor,
+            observeCurrent,
+            disposeObservation: observeCurrent.dispose,
+        });
+    }
     const before = inspectDirectoryIdentitySync(resolved);
     const canonicalPath = path.resolve(realpathSync.native(resolved));
     const after = inspectDirectoryIdentitySync(resolved, descriptor);
@@ -64,6 +85,14 @@ export function describePolicyStagedDirectory(fd, pathname) {
     });
 }
 export function assertPolicyStagedDirectoryCurrent(captured) {
+    const observed = captured.observeCurrent?.();
+    if (observed) {
+        if (!sameDirectoryMetadata(captured.stat, observed.identity) ||
+            observed.canonicalPath !== captured.directory.realPath) {
+            throw new FsSafeError("path-mismatch", "staging directory pathname changed");
+        }
+        return captured.stat;
+    }
     const current = inspectDirectoryIdentitySync(captured.directory.path, captured.directory.identity);
     if (!sameDirectoryMetadata(captured.stat, current) ||
         path.resolve(realpathSync.native(captured.directory.path)) !== captured.directory.realPath) {
@@ -72,6 +101,14 @@ export function assertPolicyStagedDirectoryCurrent(captured) {
     return current;
 }
 export function refreshPolicyStagedDirectoryObservation(captured) {
+    const observed = captured.observeCurrent?.();
+    if (observed) {
+        if (!exactIdentityMatches(captured.directory.identity, observed.identity) ||
+            observed.canonicalPath !== captured.directory.realPath) {
+            throw new FsSafeError("path-mismatch", "staging directory pathname changed");
+        }
+        return checkedMutationDirectory(captured.directory.path, observed.canonicalPath, observed.identity, captured.observeCurrent);
+    }
     const current = inspectDirectoryIdentitySync(captured.directory.path, captured.directory.identity);
     const canonicalPath = path.resolve(realpathSync.native(captured.directory.path));
     if (canonicalPath !== captured.directory.realPath) {
@@ -80,16 +117,15 @@ export function refreshPolicyStagedDirectoryObservation(captured) {
     return checkedMutationDirectory(captured.directory.path, canonicalPath, current);
 }
 export function openStagedDirectory(directory) {
-    // Copy supplied facts before any asynchronous work; receipts are not authority.
-    const pathname = resolvePathPreservingWindowsRoot(typeof directory === "string" ? directory : directory.path);
-    const expected = typeof directory === "string" ? undefined : {
-        realPath: directory.realPath, dev: directory.identity.dev, ino: directory.identity.ino,
-    };
+    const expected = typeof directory === "string"
+        ? undefined
+        : directoryReceiptAuthority(ownDirectoryReceipt(directory));
+    const pathname = resolvePathPreservingWindowsRoot(typeof directory === "string" ? directory : expected.path);
     const before = fs.lstatSync(pathname, { bigint: true });
     if (!before.isDirectory()) {
         throw new FsSafeError("not-file", "staging parent must be a real directory");
     }
-    if (expected && (!exactIdentityMatches(expected, before) || realpathSync(pathname) !== expected.realPath)) {
+    if (expected && (!exactIdentityMatches(expected.identity, before) || realpathSync(pathname) !== expected.realPath)) {
         throw new FsSafeError("path-mismatch", "stale staging directory receipt");
     }
     const fd = fs.openSync(pathname, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);

package/node_modules/@openclaw/fs-safe/dist/staged-file-settlement.d.ts

@@ -0,0 +1,16 @@
+import type { BigIntStats } from "node:fs";
+import { FsSafeError } from "./errors.js";
+import type { StagedFileCleanupReceipt, StagedFileFailureDetails, StagedFilePublication, StagedFileReceipt } from "./staged-file-types.js";
+export declare function createStagedFileReceipt(directory: StagedFileReceipt["directory"], temporaryBasename: string, stat: BigIntStats): StagedFileReceipt;
+export declare function stagedFileFailure(error: unknown, details: StagedFileFailureDetails): FsSafeError;
+/** Finish owned cleanup and every close before surfacing publication evidence. */
+export declare function settleStagedFile(params: {
+    temporaryBasename: string;
+    publication: StagedFilePublication;
+    phase: StagedFileFailureDetails["phase"];
+    failure?: {
+        error: unknown;
+    };
+    cleanup: () => Promise<StagedFileCleanupReceipt["status"]>;
+    close: readonly (() => Promise<void> | void)[];
+}): Promise<void>;

package/node_modules/@openclaw/fs-safe/dist/staged-file-settlement.js

@@ -0,0 +1,57 @@
+import { FsSafeError } from "./errors.js";
+export function createStagedFileReceipt(directory, temporaryBasename, stat) {
+    return Object.freeze({
+        directory,
+        temporaryBasename,
+        identity: Object.freeze({
+            dev: stat.dev, ino: stat.ino, mode: Number(stat.mode & 4095n),
+            nlink: stat.nlink, size: stat.size, uid: Number(stat.uid), gid: Number(stat.gid),
+            mtimeNs: stat.mtimeNs, ctimeNs: stat.ctimeNs,
+        }),
+    });
+}
+export function stagedFileFailure(error, details) {
+    const code = error instanceof FsSafeError
+        ? error.code
+        : error?.code === "EEXIST" ? "already-exists" : "helper-failed";
+    return new FsSafeError(code, `staged file ${details.phase} failed`, { cause: error, details });
+}
+/** Finish owned cleanup and every close before surfacing publication evidence. */
+export async function settleStagedFile(params) {
+    const errors = params.failure ? [params.failure.error] : [];
+    let status;
+    try {
+        status = await params.cleanup();
+    }
+    catch (error) {
+        status = "failed";
+        errors.push(error);
+    }
+    let resources = "closed";
+    for (const close of params.close) {
+        try {
+            await close();
+        }
+        catch (error) {
+            resources = "close-failed";
+            errors.push(error);
+        }
+    }
+    const incomplete = status === "failed" || status === "preserved" || resources === "close-failed";
+    // A settled pre-publication failure retains the producer/authority rejection exactly.
+    if (!incomplete && (!params.failure || params.publication.status === "not-published"))
+        return;
+    const error = errors.length > 1 ? new AggregateError(errors, "staged operation and settlement failed")
+        : errors.length === 1 ? errors[0] : new FsSafeError("not-removable", "staged cleanup preserved an unverified entry");
+    const cleanup = Object.freeze({
+        temporaryBasename: params.temporaryBasename,
+        publication: params.publication,
+        status,
+        resources,
+    });
+    throw stagedFileFailure(error, {
+        phase: params.failure ? params.phase : "cleanup",
+        publication: params.publication,
+        cleanup,
+    });
+}

package/node_modules/@openclaw/fs-safe/dist/staged-file-types.d.ts

@@ -53,4 +53,3 @@ export interface StagedFile extends AsyncDisposable {
     }): Promise<PublishedFileReceipt>;
     cleanup(): Promise<StagedFileCleanupReceipt>;
 }
-//# sourceMappingURL=staged-file-types.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/stat-observation.d.ts

@@ -8,4 +8,3 @@ export type StatObservationReceipt = {
 export declare function inspectStatObservationSync(inspect: (bigint: boolean) => Stats | BigIntStats, expected?: ExactStatIdentity, initial?: Stats | BigIntStats, platform?: NodeJS.Platform): StatObservationReceipt;
 /** Revalidate an exact identity without allocating a receipt that the caller will discard. */
 export declare function assertStatObservationSync(inspect: (bigint: boolean) => Stats | BigIntStats, expected: ExactStatIdentity, initial?: Stats | BigIntStats, platform?: NodeJS.Platform): Stats | BigIntStats;
-//# sourceMappingURL=stat-observation.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/store.d.ts

@@ -1,4 +1,3 @@
 export { fileStore, fileStoreSync, type FileStore, type FileStoreOptions, type FileStorePruneOptions, type FileStoreReadOptions, type FileStoreSync, type FileStoreWriteOptions, } from "./file-store.js";
 export { jsonStore, type JsonStore, type JsonFileStoreOptions, type JsonStoreLockOptions, type JsonStoreOptions, } from "./json-store.js";
 export { ackJsonDurableQueueEntry, ensureJsonDurableQueueDirs, jsonDurableQueueEntryExists, loadJsonDurableQueueEntry, loadPendingJsonDurableQueueEntries, moveJsonDurableQueueEntryToFailed, readJsonDurableQueueEntry, resolveJsonDurableQueueEntryPaths, unlinkBestEffort, writeJsonDurableQueueEntry, type JsonDurableQueueEntryPaths, type JsonDurableQueueLoadOptions, type JsonDurableQueueReadResult, } from "./json-durable-queue.js";
-//# sourceMappingURL=store.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/strict-file-identity.d.ts

@@ -1,6 +1,5 @@
 import type { BigIntStats } from "node:fs";
 type ExactFileIdentity = Pick<BigIntStats, "dev" | "ino">;
 export declare function inspectFileIdentity<T extends ExactFileIdentity>(inspect: () => T | Promise<T>, expected?: ExactFileIdentity, platform?: NodeJS.Platform): Promise<T>;
-export declare function inspectFileIdentitySync<T extends ExactFileIdentity>(inspect: () => T, expected?: ExactFileIdentity, platform?: NodeJS.Platform): T;
+export declare function inspectFileIdentitySync<T extends ExactFileIdentity>(inspect: () => T, expected?: ExactFileIdentity, platform?: NodeJS.Platform, mismatch?: () => Error): T;
 export {};
-//# sourceMappingURL=strict-file-identity.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/strict-file-identity.js

@@ -40,19 +40,19 @@ export async function inspectFileIdentity(inspect, expected, platform = process.
     }
     throw identityMismatch();
 }
-export function inspectFileIdentitySync(inspect, expected, platform = process.platform) {
+export function inspectFileIdentitySync(inspect, expected, platform = process.platform, mismatch = identityMismatch) {
     let knownDev;
     let knownIno;
     if (expected) {
         knownDev = expected.dev;
         if (typeof knownDev !== "bigint")
-            throw identityMismatch();
+            throw mismatch();
         knownIno = expected.ino;
         if (typeof knownIno !== "bigint")
-            throw identityMismatch();
+            throw mismatch();
         // An unknown expected device must not bypass observation of its inode.
         if (platform === "win32" && (knownDev === 0n || knownIno === 0n))
-            throw identityMismatch();
+            throw mismatch();
     }
     for (let attempt = 0; attempt < 2; attempt++) {
         const stat = inspect();
@@ -61,28 +61,28 @@ export function inspectFileIdentitySync(inspect, expected, platform = process.pl
         // a checker closure, known-component object, or field array per inspection.
         const dev = stat.dev;
         if (typeof dev !== "bigint")
-            throw identityMismatch();
+            throw mismatch();
         if (platform === "win32" && dev === 0n) {
             complete = false;
         }
         else {
             if (knownDev !== undefined && knownDev !== dev)
-                throw identityMismatch();
+                throw mismatch();
             knownDev = dev;
         }
         const ino = stat.ino;
         if (typeof ino !== "bigint")
-            throw identityMismatch();
+            throw mismatch();
         if (platform === "win32" && ino === 0n) {
             complete = false;
         }
         else {
             if (knownIno !== undefined && knownIno !== ino)
-                throw identityMismatch();
+                throw mismatch();
             knownIno = ino;
         }
         if (complete)
             return stat;
     }
-    throw identityMismatch();
+    throw mismatch();
 }

package/node_modules/@openclaw/fs-safe/dist/string-coerce.d.ts

@@ -2,4 +2,3 @@ export declare function normalizeNullableString(value: unknown): string | null;
 export declare function normalizeOptionalString(value: unknown): string | undefined;
 export declare function normalizeOptionalLowercaseString(value: unknown): string | undefined;
 export declare function normalizeLowercaseStringOrEmpty(value: unknown): string;
-//# sourceMappingURL=string-coerce.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/suppressed-error.d.ts

@@ -3,4 +3,3 @@ export type SuppressedErrorLike = Error & {
     suppressed: unknown;
 };
 export declare function createSuppressedError(error: unknown, suppressed: unknown, message: string): SuppressedErrorLike;
-//# sourceMappingURL=suppressed-error.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/symlink-parents.d.ts

@@ -9,4 +9,3 @@ export type AssertNoSymlinkParentsOptions = {
 };
 export declare function assertNoSymlinkParents(params: AssertNoSymlinkParentsOptions): Promise<void>;
 export declare function assertNoSymlinkParentsSync(params: AssertNoSymlinkParentsOptions): void;
-//# sourceMappingURL=symlink-parents.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/symlink-parents.js

@@ -26,32 +26,7 @@ function formatUnsafePath(params, current) {
     return `${params.messagePrefix ?? "Path"} must not traverse symlinked directory: ${current}`;
 }
 export async function assertNoSymlinkParents(params) {
-    const walk = resolvePathWalk(params);
-    if (!walk) {
-        return;
-    }
-    let current = walk.root;
-    for (const [index, segment] of walk.segments.entries()) {
-        current = path.join(current, segment);
-        try {
-            const stat = fsSync.lstatSync(current);
-            if (stat.isSymbolicLink()) {
-                if (params.allowRootChildSymlink && path.dirname(current) === walk.root) {
-                    continue;
-                }
-                throw new Error(formatUnsafePath(params, current));
-            }
-            if ((params.requireDirectories || index < walk.segments.length - 1) && !stat.isDirectory()) {
-                throw new FsSafeError("not-file", `${params.messagePrefix ?? "Path"} must traverse directories: ${current}`);
-            }
-        }
-        catch (err) {
-            if (hasNodeErrorCode(err, "ENOENT") && params.allowMissing !== false) {
-                return;
-            }
-            throw err;
-        }
-    }
+    assertNoSymlinkParentsSync(params);
 }
 export function assertNoSymlinkParentsSync(params) {
     const walk = resolvePathWalk(params);
@@ -74,7 +49,7 @@ export function assertNoSymlinkParentsSync(params) {
             }
         }
         catch (err) {
-            if (err.code === "ENOENT" && params.allowMissing !== false) {
+            if (hasNodeErrorCode(err, "ENOENT") && params.allowMissing !== false) {
                 return;
             }
             throw err;

package/node_modules/@openclaw/fs-safe/dist/temp-cleanup.d.ts

@@ -11,4 +11,3 @@ export declare function registerTempPathForExit(tempPath: string, options?: {
 }): TempPathRegistration;
 export declare function __cleanupRegisteredTempPathsForTest(): void;
 export declare function __cleanupRegisteredTempPathForTest(tempPath: string): void;
-//# sourceMappingURL=temp-cleanup.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/temp-target.d.ts

@@ -29,4 +29,3 @@ export declare function createOwnedTempFile(params: TempFileOptions): Promise<{
 export declare function tempFile(params: TempFileOptions): Promise<TempFile>;
 export declare function withTempFile<T>(params: TempFileOptions, fn: (tmpPath: string) => Promise<T>): Promise<T>;
 export {};
-//# sourceMappingURL=temp-target.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/temp-target.js

@@ -59,10 +59,7 @@ function sanitizeExtension(extension) {
     return token ? `.${token}` : "";
 }
 export function sanitizeTempFileName(fileName) {
-    const sanitized = sanitizeSafePathSegment(path.basename(fileName), "download.bin", {
-        allowDotPrefix: true,
-    });
-    return suffixWindowsReservedDeviceName(sanitized);
+    return suffixWindowsReservedDeviceName(sanitizeSafePathSegment(path.basename(fileName)) ?? "download.bin");
 }
 export function buildRandomTempFilePath(params) {
     const rootDir = resolveTempRoot(params.rootDir);
@@ -87,16 +84,7 @@ function isNodeErrorWithCode(err, code) {
 }
 async function cleanupTempDir(dir, identity, onCleanupError) {
     try {
-        let current;
-        try {
-            current = fsSync.lstatSync(dir, { bigint: true });
-        }
-        catch (error) {
-            if (isNodeErrorWithCode(error, "ENOENT")) {
-                return;
-            }
-            throw error;
-        }
+        const current = fsSync.lstatSync(dir, { bigint: true });
         if (!current || !sameFileIdentityForCleanup(current, identity)) {
             return;
         }
@@ -131,7 +119,7 @@ export async function createOwnedTempFile(params) {
     const prefix = `${sanitizePrefix(params.prefix)}-`;
     if (cleanupSafety === "require-bounded") {
         const initialFileName = sanitizeTempFileName(params.fileName ?? "download.bin");
-        const [{ TempWorkspaceCleanupCapability, TempWorkspaceCleanupOwner }, { admitExistingTempWorkspaceRoot }, { TempWorkspaceRetainedChild }, { validateInitialTempWorkspaceChild, admitRetainedTempWorkspaceChild }, { inspectDirectoryIdentitySync },] = await Promise.all([
+        const [{ TempWorkspaceCleanupCapability, TempWorkspaceCleanupOwner, throwTempWorkspaceCreationFailure }, { admitExistingTempWorkspaceRoot }, { TempWorkspaceRetainedChild }, { validateInitialTempWorkspaceChild }, { inspectDirectoryIdentitySync },] = await Promise.all([
             import("./temp-workspace-owner.js"),
             import("./temp-workspace-admission.js"),
             import("./temp-workspace-descriptor.js"),
@@ -159,9 +147,9 @@ export async function createOwnedTempFile(params) {
             identity = Object.freeze({ dev: initial.dev, ino: initial.ino });
             const needsModeInitialization = validateInitialTempWorkspaceChild(initial, admission.ownerUid, 0o700);
             retainedChild = TempWorkspaceRetainedChild.retain(dir, identity);
-            const modeInitialization = admitRetainedTempWorkspaceChild(retainedChild, needsModeInitialization, admission, 0o700);
-            if (modeInitialization)
-                await modeInitialization;
+            if (needsModeInitialization) {
+                await retainedChild.initializeMode(0o700, admission.ownerUid, admission.assertCurrent);
+            }
             const retainDescriptor = capability.admitChildDescriptor(retainedChild.ensureReadable());
             capability.assertAncestryCurrent();
             retainedChild.finalizeAdmission(admission.ownerUid, 0o700);
@@ -172,34 +160,7 @@ export async function createOwnedTempFile(params) {
             });
         }
         catch (error) {
-            try {
-                if (cleanupOwner)
-                    cleanupOwner.cleanupSync();
-                else {
-                    const closeErrors = [];
-                    try {
-                        retainedChild?.close();
-                    }
-                    catch (closeError) {
-                        closeErrors.push(closeError);
-                    }
-                    try {
-                        capability.close();
-                    }
-                    catch (closeError) {
-                        closeErrors.push(closeError);
-                    }
-                    if (closeErrors.length === 1)
-                        throw closeErrors[0];
-                    if (closeErrors.length > 1) {
-                        throw new AggregateError(closeErrors, "temp file admission descriptor close failed");
-                    }
-                }
-            }
-            catch (cleanupError) {
-                throw new AggregateError([error, cleanupError], "temp file creation and cleanup both failed");
-            }
-            throw error;
+            return throwTempWorkspaceCreationFailure(error, retainedChild, capability, cleanupOwner, "temp file");
         }
         const owner = cleanupOwner;
         const file = (fileName) => {

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-admission.d.ts

@@ -1,12 +1,6 @@
-type ExactIdentity = Readonly<{
-    dev: bigint;
-    ino: bigint;
-}>;
 export type TempWorkspaceRootAdmission = {
     dir: string;
-    identity: ExactIdentity;
     ownerUid: number | undefined;
-    realPath: string;
     retainCleanupParent(descriptorFd: number): void;
     prepareCleanupProbe(descriptorFd: number): void;
     prepareChildCreation(descriptorFd?: number): void;
@@ -18,5 +12,3 @@ export type TempWorkspaceRootAdmission = {
 export declare function admitExistingTempWorkspaceRoot(rootDir: string): TempWorkspaceRootAdmission;
 export declare function admitTempWorkspaceRoot(rootDir: string): Promise<TempWorkspaceRootAdmission>;
 export declare function admitTempWorkspaceRootSync(rootDir: string): TempWorkspaceRootAdmission;
-export {};
-//# sourceMappingURL=temp-workspace-admission.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-admission.js

@@ -2,14 +2,12 @@ import fsSync, {} from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { inspectDirectoryIdentitySync, observeDirectoryIdentitySync, } from "./directory-guard.js";
-import { admitTempWorkspaceChild, admitTempWorkspaceChildSync, } from "./temp-workspace-child-admission.js";
+import { admitTempWorkspaceChild, admitTempWorkspaceChildSync, assertTrustedTempWorkspaceDirectory, inspectTempWorkspaceDescriptorIdentitySync, projectTempWorkspaceNumericIdentity, TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY, } from "./temp-workspace-child-admission.js";
 import { FsSafeError } from "./errors.js";
 import { recordFileObservationFailure } from "./file-observation.js";
 import { realpathSync } from "./realpath.js";
 import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
-import { inspectTempWorkspaceDescriptorIdentitySync, projectTempWorkspaceNumericIdentity, TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY, } from "./temp-workspace-identity.js";
-import { assertTrustedTempWorkspaceDirectory } from "./temp-workspace-permissions.js";
 const WINDOWS = process.platform === "win32";
 function effectiveOwner() {
     // Windows mode/uid fields do not describe ACL authority. The supplied root's
@@ -116,6 +114,30 @@ function assertSnapshot(entry, uid) {
     assertTrustedTempWorkspaceDirectory(stat, uid);
     assertCanonicalRoot(entry);
 }
+function snapshotMissingRootComponent(parent, dir, ownerUid) {
+    if (parent.dir !== parent.realPath) {
+        assertSnapshot(parent, ownerUid);
+        return snapshot(dir, ownerUid);
+    }
+    const current = inspectSnapshotIdentity(parent);
+    assertTrustedTempWorkspaceDirectory(current, ownerUid);
+    let realPath;
+    try {
+        realPath = canonicalTempWorkspacePath(dir);
+    }
+    catch (error) {
+        // Keep parent resolution failures ahead of a missing or unreadable child.
+        assertCanonicalRoot(parent);
+        throw error;
+    }
+    if (path.dirname(realPath) !== parent.realPath) {
+        assertCanonicalRoot(parent);
+        return snapshot(dir, ownerUid);
+    }
+    // The child's canonical parent confirms the same parent name at this phase.
+    // Its exact non-symlink/owner observation still precedes mode initialization.
+    return snapshot(dir, ownerUid, realPath);
+}
 function assertChain(chain, uid) {
     for (const entry of chain) {
         const current = inspectSnapshotIdentity(entry);
@@ -223,9 +245,7 @@ function rootAdmission(chain, ownerUid) {
     const current = chain[chain.length - 1];
     return {
         dir: current.dir,
-        identity: current.identity,
         ownerUid,
-        realPath: current.realPath,
         retainCleanupParent: (descriptorFd) => {
             assertSnapshot(current, ownerUid);
             associateTempWorkspaceRoot(current, ownerUid, descriptorFd);
@@ -256,9 +276,7 @@ function canonicalRootAdmission(discovery, ownerUid) {
     };
     return {
         dir: discovery.dir,
-        identity: discovery.identity,
         ownerUid,
-        realPath: discovery.realPath,
         // Merely opening the cleanup-parent descriptor grants no authority. The
         // exact association is completed only at a bounded probe or the mutation
         // boundary below.
@@ -321,6 +339,7 @@ export async function admitTempWorkspaceRoot(rootDir) {
         return admission;
     const guardedChain = chain;
     for (const segment of missing) {
+        const parentEntry = guardedChain[guardedChain.length - 1];
         const parent = rootAdmission(guardedChain, ownerUid);
         const dir = path.join(parent.dir, segment);
         assertNoWindowsPathAlias(dir, "filesystem");
@@ -334,8 +353,7 @@ export async function admitTempWorkspaceRoot(rootDir) {
             if (error.code !== "EEXIST")
                 throw error;
         }
-        parent.assertCurrent();
-        const observed = snapshot(dir, ownerUid);
+        const observed = snapshotMissingRootComponent(parentEntry, dir, ownerUid);
         if (created) {
             const modeInitialization = admitTempWorkspaceChild(dir, observed.stat, parent, 0o700);
             if (modeInitialization)
@@ -351,6 +369,7 @@ export function admitTempWorkspaceRootSync(rootDir) {
         return admission;
     const guardedChain = chain;
     for (const segment of missing) {
+        const parentEntry = guardedChain[guardedChain.length - 1];
         const parent = rootAdmission(guardedChain, ownerUid);
         const dir = path.join(parent.dir, segment);
         assertNoWindowsPathAlias(dir, "filesystem");
@@ -364,8 +383,7 @@ export function admitTempWorkspaceRootSync(rootDir) {
             if (error.code !== "EEXIST")
                 throw error;
         }
-        parent.assertCurrent();
-        const observed = snapshot(dir, ownerUid);
+        const observed = snapshotMissingRootComponent(parentEntry, dir, ownerUid);
         if (created)
             admitTempWorkspaceChildSync(dir, observed.stat, parent, 0o700);
         guardedChain.push(observed.entry);

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-child-admission.d.ts

@@ -1,13 +1,23 @@
-import type { BigIntStats, Stats } from "node:fs";
+import { type BigIntStats, type Stats } from "node:fs";
 import type { TempWorkspaceRootAdmission } from "./temp-workspace-admission.js";
-import type { TempWorkspaceRetainedChild } from "./temp-workspace-descriptor.js";
-import { type TempWorkspaceIdentityStat } from "./temp-workspace-identity.js";
+export type TempWorkspaceIdentity = Readonly<{
+    dev: bigint;
+    ino: bigint;
+}>;
+export type TempWorkspaceNumericIdentity = Readonly<{
+    dev: number;
+    ino: number;
+}>;
+export type TempWorkspaceIdentityStat = BigIntStats | Stats;
+export declare const TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY: boolean;
+export declare function projectTempWorkspaceNumericIdentity(identity: TempWorkspaceIdentity): TempWorkspaceNumericIdentity | undefined;
+export declare function inspectTempWorkspaceDescriptorIdentitySync(fd: number, expected: TempWorkspaceIdentity, numeric: TempWorkspaceNumericIdentity | undefined): TempWorkspaceIdentityStat;
+export declare function inspectTempWorkspaceDirectoryIdentitySync(dir: string, expected: TempWorkspaceIdentity, numeric: TempWorkspaceNumericIdentity | undefined): TempWorkspaceIdentityStat;
+export declare function validateTempWorkspaceDirMode(mode: number): void;
+export declare function assertTrustedTempWorkspaceDirectory(stat: Pick<BigIntStats, "uid" | "mode"> | Pick<Stats, "uid" | "mode">, uid: number | undefined, child?: boolean): void;
 export declare function assertTempWorkspaceChildState(stat: BigIntStats | Stats, ownerUid: number | undefined): void;
 export declare function validateInitialTempWorkspaceChild(stat: BigIntStats, ownerUid: number | undefined, mode: number): boolean;
 export declare function childHasRequestedMode(stat: BigIntStats | Stats, mode: number): boolean;
 export declare function admitTempWorkspaceChild(dir: string, expected: BigIntStats, parent: TempWorkspaceRootAdmission, mode: number): Promise<void> | undefined;
 export declare function admitTempWorkspaceChildSync(dir: string, expected: BigIntStats, parent: TempWorkspaceRootAdmission, mode: number): void;
-export declare function admitRetainedTempWorkspaceChild(retained: TempWorkspaceRetainedChild, needsModeInitialization: boolean, parent: TempWorkspaceRootAdmission, mode: number): Promise<void> | undefined;
-export declare function admitRetainedTempWorkspaceChildSync(retained: TempWorkspaceRetainedChild, needsModeInitialization: boolean, parent: TempWorkspaceRootAdmission, mode: number): void;
 export declare function validateAdmittedTempWorkspaceChild(current: TempWorkspaceIdentityStat, ownerUid: number | undefined, mode: number): TempWorkspaceIdentityStat;
-//# sourceMappingURL=temp-workspace-child-admission.d.ts.map