@openclaw/openshell-sandbox 2026.9.5 → 2026.9.7

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-fallback.js

@@ -2,139 +2,134 @@ import syncFs, {} from "node:fs";
 import fs, {} from "node:fs/promises";
 import { readBoundedAsync, readBoundedSync } from "./bounded-read.js";
 import { FsSafeError } from "./errors.js";
-import { sameFileIdentity } from "./file-identity.js";
+import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
 import { readOwnedCopySource, readOwnedCopySourceSync } from "./replace-file-copy-source.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { hasErrorCode } from "./file-cleanup.js";
+import { writeAtomicDestination, writeAtomicDestinationSync } from "./replace-file-buffer.js";
+import { AtomicMutation } from "./replace-file-mutation.js";
+import { captureAtomicDestination, captureAtomicDestinationSync } from "./replace-file-destination.js";
 const SUPPORTS_NOFOLLOW = process.platform !== "win32" && "O_NOFOLLOW" in syncFs.constants;
 const NOFOLLOW = SUPPORTS_NOFOLLOW ? syncFs.constants.O_NOFOLLOW : 0;
 const OPEN_READ_FLAGS = resolveReadOpenFlags();
 const OPEN_READ_WRITE_FLAGS = syncFs.constants.O_RDWR | NOFOLLOW;
 const OPEN_WRITE_EXCLUSIVE_FLAGS = syncFs.constants.O_WRONLY | syncFs.constants.O_CREAT | syncFs.constants.O_EXCL | NOFOLLOW;
-function notFound(error) {
-    return error.code === "ENOENT";
+function closeSyncAfterAdmissionFailure(fsModule, fd, error) {
+    try {
+        fsModule.closeSync(fd);
+    }
+    catch {
+        // Preserve the already-selected admission failure.
+    }
+    throw error;
 }
-function assertPinnedDestination(pathname, opened, dest, hardlinks) {
-    if (pathname.isSymbolicLink()) {
+function admitDestinationKind(pathname, opened, dest, admission) {
+    if (admission === "hardlinks") {
+        if (pathname.isSymbolicLink() || !pathname.isFile()) {
+            throw new FsSafeError("path-mismatch", `Atomic replace destination changed while opening: ${dest}`);
+        }
+    }
+    else if (pathname.isSymbolicLink()) {
         throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${dest}`);
     }
-    if (!pathname.isFile() || !opened.isFile()) {
+    else if (!pathname.isFile() || !opened.isFile()) {
         throw new FsSafeError("not-file", `Copy fallback destination must be a regular file: ${dest}`);
     }
-    if (!sameFileIdentity(pathname, opened)) {
-        throw new FsSafeError("path-mismatch", `Copy fallback destination changed while opening: ${dest}`);
-    }
-    if (hardlinks === "reject" && opened.nlink > 1) {
-        throw new FsSafeError("hardlink", `Hardlinked copy fallback destination not allowed: ${dest}`);
+    return pathname;
+}
+function assertDestinationLinks(opened, dest, admission, hardlinks) {
+    if ((admission === "hardlinks" || hardlinks === "reject") && opened.nlink > 1n) {
+        throw new FsSafeError("hardlink", `Hardlinked ${admission === "hardlinks" ? "atomic replace" : "copy fallback"} destination not allowed: ${dest}`);
     }
 }
-async function openPinnedDestination(fsModule, dest, hardlinks) {
+function inspectPinnedDestinationSync(fsModule, fd, dest, admission, hardlinks) {
+    const opened = inspectFileIdentitySync(() => fsModule.fstatSync(fd, { bigint: true }));
+    inspectFileIdentitySync(() => admitDestinationKind(fsModule.lstatSync(dest, { bigint: true }), opened, dest, admission), opened);
+    assertDestinationLinks(opened, dest, admission, hardlinks);
+}
+async function openPinnedDestination(fsModule, dest, admission, hardlinks, mutation) {
     let preview;
     try {
         preview = fsModule === fs ? syncFs.lstatSync(dest) : await fsModule.lstat(dest);
     }
     catch (error) {
-        if (notFound(error))
+        if (hasErrorCode(error, "ENOENT"))
             return null;
         throw error;
     }
     if (!preview)
         return null;
-    if (preview.isSymbolicLink()) {
+    if (admission === "hardlinks" && (preview.isSymbolicLink() || !preview.isFile()))
+        return null;
+    if (admission === "restore" && preview.isSymbolicLink()) {
         throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${dest}`);
     }
-    const handle = await fsModule.open(dest, OPEN_READ_WRITE_FLAGS);
+    mutation?.assert();
+    const handle = await fsModule.open(dest, admission === "restore" ? OPEN_READ_WRITE_FLAGS : OPEN_READ_FLAGS);
     try {
-        const opened = fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
-        const current = fsModule === fs ? syncFs.lstatSync(dest) : await fsModule.lstat(dest);
-        assertPinnedDestination(current, opened, dest, hardlinks);
-        return { handle, stat: opened };
+        if (fsModule === fs)
+            inspectPinnedDestinationSync(syncFs, handle.fd, dest, admission, hardlinks);
+        else {
+            const opened = await inspectFileIdentity(() => handle.stat({ bigint: true }));
+            await inspectFileIdentity(async () => admitDestinationKind(await fsModule.lstat(dest, { bigint: true }), opened, dest, admission), opened);
+            assertDestinationLinks(opened, dest, admission, hardlinks);
+        }
+        return handle;
     }
     catch (error) {
-        await handle.close().catch(() => undefined);
+        try {
+            await handle.close();
+        }
+        catch {
+            // Preserve the already-selected admission failure.
+        }
         throw error;
     }
 }
-function openPinnedDestinationSync(fsModule, dest, hardlinks) {
+function openPinnedDestinationSync(fsModule, dest, admission, hardlinks, mutation) {
     let preview;
     try {
         preview = fsModule.lstatSync(dest);
     }
     catch (error) {
-        if (notFound(error))
+        if (hasErrorCode(error, "ENOENT"))
             return null;
         throw error;
     }
-    if (preview.isSymbolicLink()) {
+    if (admission === "hardlinks" && (preview.isSymbolicLink() || !preview.isFile()))
+        return null;
+    if (admission === "restore" && preview.isSymbolicLink()) {
         throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${dest}`);
     }
-    const fd = fsModule.openSync(dest, OPEN_READ_WRITE_FLAGS);
+    mutation?.assert();
+    const fd = fsModule.openSync(dest, admission === "restore" ? OPEN_READ_WRITE_FLAGS : OPEN_READ_FLAGS);
     try {
-        const opened = fsModule.fstatSync(fd);
-        assertPinnedDestination(fsModule.lstatSync(dest), opened, dest, hardlinks);
-        return { fd, stat: opened };
+        inspectPinnedDestinationSync(fsModule, fd, dest, admission, hardlinks);
+        return fd;
     }
     catch (error) {
-        fsModule.closeSync(fd);
-        throw error;
+        closeSyncAfterAdmissionFailure(fsModule, fd, error);
     }
 }
 export async function assertDestinationHardlinkPolicy(fsModule, dest, policy) {
     if (policy !== "reject")
         return;
-    let preview;
-    try {
-        preview = fsModule === fs ? syncFs.lstatSync(dest) : await fsModule.lstat(dest);
-    }
-    catch (error) {
-        if (notFound(error))
-            return;
-        throw error;
-    }
-    if (!preview || preview.isSymbolicLink() || !preview.isFile())
+    const handle = await openPinnedDestination(fsModule, dest, "hardlinks");
+    if (!handle)
         return;
-    const handle = await fsModule.open(dest, OPEN_READ_FLAGS);
     try {
-        const opened = fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
-        const current = fsModule === fs ? syncFs.lstatSync(dest) : await fsModule.lstat(dest);
-        if (current.isSymbolicLink() || !current.isFile() || !sameFileIdentity(current, opened)) {
-            throw new FsSafeError("path-mismatch", `Atomic replace destination changed while opening: ${dest}`);
-        }
-        if (opened.nlink > 1) {
-            throw new FsSafeError("hardlink", `Hardlinked atomic replace destination not allowed: ${dest}`);
-        }
+        await handle.close();
     }
-    finally {
-        await handle.close().catch(() => undefined);
+    catch {
+        // The asynchronous admission pin has best-effort close semantics.
     }
 }
 export function assertDestinationHardlinkPolicySync(fsModule, dest, policy) {
     if (policy !== "reject")
         return;
-    let preview;
-    try {
-        preview = fsModule.lstatSync(dest);
-    }
-    catch (error) {
-        if (notFound(error))
-            return;
-        throw error;
-    }
-    if (preview.isSymbolicLink() || !preview.isFile())
-        return;
-    const fd = fsModule.openSync(dest, OPEN_READ_FLAGS);
-    try {
-        const opened = fsModule.fstatSync(fd);
-        const current = fsModule.lstatSync(dest);
-        if (current.isSymbolicLink() || !current.isFile() || !sameFileIdentity(current, opened)) {
-            throw new FsSafeError("path-mismatch", `Atomic replace destination changed while opening: ${dest}`);
-        }
-        if (opened.nlink > 1) {
-            throw new FsSafeError("hardlink", `Hardlinked atomic replace destination not allowed: ${dest}`);
-        }
-    }
-    finally {
+    const fd = openPinnedDestinationSync(fsModule, dest, "hardlinks");
+    if (fd !== null)
         fsModule.closeSync(fd);
-    }
 }
 function restoreReadOptions(stat, maxBytes) {
     return {
@@ -158,55 +153,39 @@ function readRestoreSnapshotSync(fsModule, fd, maxBytes, stat) {
         return bytesRead;
     }, restoreReadOptions(stat, maxBytes));
 }
-async function writeAll(handle, data) {
-    await handle.truncate(0);
-    let written = 0;
-    while (written < data.length) {
-        const result = await handle.write(data, written, data.length - written, written);
-        if (result.bytesWritten === 0)
-            throw new Error("Copy fallback write made no progress");
-        written += result.bytesWritten;
-    }
-    await handle.truncate(data.length);
-}
-function writeAllSync(fsModule, fd, data) {
-    fsModule.ftruncateSync(fd, 0);
-    let written = 0;
-    while (written < data.length) {
-        const bytesWritten = fsModule.writeSync(fd, data, written, data.length - written, written);
-        if (bytesWritten === 0)
-            throw new Error("Copy fallback write made no progress");
-        written += bytesWritten;
-    }
-    fsModule.ftruncateSync(fd, data.length);
-}
 function restoreFailure(writeError, cleanup, restoreError) {
     const primary = writeError instanceof Error ? writeError : new Error(String(writeError));
     const details = { cleanup };
-    const cause = restoreError
+    const cause = cleanup === "restore-failed"
         ? new AggregateError([primary, restoreError], "copy fallback and original restoration both failed")
         : primary;
     return new FsSafeError("helper-failed", cleanup === "restored"
         ? `Atomic copy fallback failed; original destination restored: ${primary.message}`
         : `Atomic copy fallback failed and original restoration failed: ${primary.message}`, { cause, details });
 }
-async function replacePinnedWithRestore(fsModule, handle, replacement, maxRestoreBytes, replacementMode) {
+async function replacePinnedWithRestore(fsModule, handle, replacement, maxRestoreBytes, replacementMode, destination, mutation) {
     const originalStat = fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
     const originalMode = originalStat.mode;
     const original = await readRestoreSnapshot(handle, maxRestoreBytes, originalStat);
     try {
-        await writeAll(handle, replacement);
+        await writeAtomicDestination(handle, replacement, destination?.beforeWrite, destination?.assertBeforeMutation, destination?.writing);
+        if (destination)
+            await destination.verify();
         await handle.chmod(replacementMode);
         await handle.sync();
     }
     catch (writeError) {
+        mutation.rethrowRefusal();
         try {
-            await writeAll(handle, original);
+            await writeAtomicDestination(handle, original, destination?.beforeRestore, destination?.assertBeforeMutation, destination?.writing);
+            if (destination)
+                await destination.verifyRestore();
             await handle.chmod(originalMode);
             await handle.sync();
             throw restoreFailure(writeError, "restored");
         }
         catch (restoreError) {
+            mutation.rethrowRefusal();
             if (restoreError instanceof FsSafeError && restoreError.details?.cleanup === "restored") {
                 throw restoreError;
             }
@@ -214,23 +193,27 @@ async function replacePinnedWithRestore(fsModule, handle, replacement, maxRestor
         }
     }
 }
-function replacePinnedWithRestoreSync(fsModule, fd, replacement, maxRestoreBytes, replacementMode, fchmodSync) {
+function replacePinnedWithRestoreSync(fsModule, fd, replacement, maxRestoreBytes, replacementMode, fchmodSync, destination, mutation) {
     const originalStat = fsModule.fstatSync(fd);
     const originalMode = originalStat.mode;
     const original = readRestoreSnapshotSync(fsModule, fd, maxRestoreBytes, originalStat);
     try {
-        writeAllSync(fsModule, fd, replacement);
+        writeAtomicDestinationSync(fsModule, fd, replacement, destination?.beforeWrite, destination?.writing);
+        destination?.verify();
         fchmodSync?.(fd, replacementMode);
         fsModule.fsyncSync(fd);
     }
     catch (writeError) {
+        mutation?.rethrowRefusal();
         try {
-            writeAllSync(fsModule, fd, original);
+            writeAtomicDestinationSync(fsModule, fd, original, destination?.beforeRestore, destination?.writing);
+            destination?.verifyRestore();
             fchmodSync?.(fd, originalMode);
             fsModule.fsyncSync(fd);
             throw restoreFailure(writeError, "restored");
         }
         catch (restoreError) {
+            mutation?.rethrowRefusal();
             if (restoreError instanceof FsSafeError && restoreError.details?.cleanup === "restored") {
                 throw restoreError;
             }
@@ -239,6 +222,7 @@ function replacePinnedWithRestoreSync(fsModule, fd, replacement, maxRestoreBytes
     }
 }
 export async function copyFallbackReplace(params) {
+    const mutation = params.mutation ?? new AtomicMutation({});
     const source = await readOwnedCopySource({
         fsModule: params.fsModule,
         src: params.src,
@@ -246,12 +230,17 @@ export async function copyFallbackReplace(params) {
     });
     const { replacement } = source;
     let destHandle = null;
+    let closeRequiredForSuccess = false;
+    let completed = false;
+    let destination;
     try {
         if (params.restore === "restore-original") {
-            const pinned = await openPinnedDestination(params.fsModule, params.dest, params.destinationHardlinks);
+            const pinned = await openPinnedDestination(params.fsModule, params.dest, "restore", params.destinationHardlinks, mutation);
             if (pinned) {
-                destHandle = pinned.handle;
-                await replacePinnedWithRestore(params.fsModule, destHandle, replacement, params.maxRestoreBytes, source.mode);
+                destHandle = pinned;
+                if (mutation.active)
+                    destination = await captureAtomicDestination(params.fsModule, pinned, params.dest, mutation, params.destinationHardlinks === "reject");
+                await replacePinnedWithRestore(params.fsModule, destHandle, replacement, params.maxRestoreBytes, source.mode, destination, mutation);
             }
         }
         if (!destHandle) {
@@ -261,7 +250,7 @@ export async function copyFallbackReplace(params) {
                     ? syncFs.lstatSync(params.dest) : await params.fsModule.lstat(params.dest);
             }
             catch (error) {
-                if (!notFound(error))
+                if (!hasErrorCode(error, "ENOENT"))
                     throw error;
             }
             if (destStat?.isSymbolicLink()) {
@@ -269,21 +258,47 @@ export async function copyFallbackReplace(params) {
             }
             if (destStat) {
                 await assertDestinationHardlinkPolicy(params.fsModule, params.dest, params.destinationHardlinks);
+                mutation.assert();
                 await params.fsModule.rm(params.dest, { force: true });
+                mutation.removed(params.dest);
             }
+            mutation.assert();
             destHandle = await params.fsModule.open(params.dest, OPEN_WRITE_EXCLUSIVE_FLAGS, source.mode & 0o777);
-            await destHandle.writeFile(replacement);
+            if (mutation.active) {
+                destination = await captureAtomicDestination(params.fsModule, destHandle, params.dest, mutation, params.destinationHardlinks === "reject");
+                destination.writing();
+                await writeAtomicDestination(destHandle, replacement, destination.beforeWrite, destination.assertBeforeMutation);
+                await destination.verify();
+            }
+            else {
+                await destHandle.writeFile(replacement);
+            }
             await destHandle.chmod(source.mode);
             if (params.sync) {
                 await destHandle.sync();
             }
+            closeRequiredForSuccess = !params.sync;
         }
+        if (destination)
+            await destination.verify();
+        destination?.published();
+        completed = true;
     }
     finally {
-        await destHandle?.close().catch(() => undefined);
+        if (destHandle) {
+            try {
+                await destHandle.close();
+            }
+            catch (closeError) {
+                if (closeRequiredForSuccess && completed) {
+                    throw closeError;
+                }
+            }
+        }
     }
 }
 export function copyFallbackReplaceSync(params) {
+    const mutation = params.mutation ?? new AtomicMutation({});
     const source = readOwnedCopySourceSync({
         fsModule: params.fsModule,
         src: params.src,
@@ -291,12 +306,17 @@ export function copyFallbackReplaceSync(params) {
     });
     const { replacement } = source;
     let destFd;
+    let closeRequiredForSuccess = false;
+    let completed = false;
+    let destination;
     try {
         if (params.restore === "restore-original") {
-            const pinned = openPinnedDestinationSync(params.fsModule, params.dest, params.destinationHardlinks);
-            if (pinned) {
-                destFd = pinned.fd;
-                replacePinnedWithRestoreSync(params.fsModule, destFd, replacement, params.maxRestoreBytes, source.mode, params.fchmodSync);
+            const pinned = openPinnedDestinationSync(params.fsModule, params.dest, "restore", params.destinationHardlinks, mutation);
+            if (pinned !== null) {
+                destFd = pinned;
+                if (mutation.active)
+                    destination = captureAtomicDestinationSync(params.fsModule, pinned, params.dest, mutation, params.destinationHardlinks === "reject");
+                replacePinnedWithRestoreSync(params.fsModule, destFd, replacement, params.maxRestoreBytes, source.mode, params.fchmodSync, destination, mutation);
             }
         }
         if (destFd === undefined) {
@@ -305,7 +325,7 @@ export function copyFallbackReplaceSync(params) {
                 destStat = params.fsModule.lstatSync(params.dest);
             }
             catch (error) {
-                if (!notFound(error))
+                if (!hasErrorCode(error, "ENOENT"))
                     throw error;
             }
             if (destStat?.isSymbolicLink()) {
@@ -313,23 +333,36 @@ export function copyFallbackReplaceSync(params) {
             }
             if (destStat) {
                 assertDestinationHardlinkPolicySync(params.fsModule, params.dest, params.destinationHardlinks);
+                mutation.assert();
                 params.fsModule.rmSync(params.dest, { force: true });
+                mutation.removed(params.dest);
             }
+            mutation.assert();
             destFd = params.fsModule.openSync(params.dest, OPEN_WRITE_EXCLUSIVE_FLAGS, source.mode & 0o777);
-            writeAllSync(params.fsModule, destFd, replacement);
+            if (mutation.active)
+                destination = captureAtomicDestinationSync(params.fsModule, destFd, params.dest, mutation, params.destinationHardlinks === "reject");
+            destination?.writing();
+            writeAtomicDestinationSync(params.fsModule, destFd, replacement, destination?.beforeWrite);
+            destination?.verify();
             params.fchmodSync?.(destFd, source.mode);
             if (params.sync) {
                 params.fsModule.fsyncSync(destFd);
             }
+            closeRequiredForSuccess = !params.sync;
         }
+        destination?.verify();
+        destination?.published();
+        completed = true;
     }
     finally {
         if (destFd !== undefined) {
             try {
                 params.fsModule.closeSync(destFd);
             }
-            catch {
-                // Best-effort close after fallback replacement.
+            catch (closeError) {
+                if (closeRequiredForSuccess && completed) {
+                    throw closeError;
+                }
             }
         }
     }

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-source.d.ts

@@ -18,4 +18,3 @@ export declare function readOwnedCopySourceSync(params: {
     mode: number;
 };
 export {};
-//# sourceMappingURL=replace-file-copy-source.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/replace-file-copy-source.js

@@ -3,8 +3,8 @@ import fs, {} from "node:fs/promises";
 import { readBoundedSync } from "./bounded-read.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { FsSafeError } from "./errors.js";
-import { sameFileIdentity } from "./file-identity.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
+import { hasErrorCode } from "./file-cleanup.js";
 const OPEN_READ_FLAGS = resolveReadOpenFlags();
 function assertSourcePreview(source, src) {
     if (source.isSymbolicLink()) {
@@ -17,6 +17,14 @@ function assertSourcePreview(source, src) {
         throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${src}`);
     }
 }
+function assertOpenedSource(opened, current, src) {
+    if (!opened.isFile() || current.isSymbolicLink()) {
+        throw new FsSafeError("path-mismatch", `Copy fallback source changed while opening: ${src}`);
+    }
+    if (opened.nlink !== 1n) {
+        throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${src}`);
+    }
+}
 function sourceSymlinkError(src, cause) {
     return new FsSafeError("symlink", `Refusing copy fallback from non-file source: ${src}`, {
         cause,
@@ -27,7 +35,7 @@ async function openSource(fsModule, src) {
         return await fsModule.open(src, OPEN_READ_FLAGS);
     }
     catch (error) {
-        if (error.code === "ELOOP") {
+        if (hasErrorCode(error, "ELOOP")) {
             throw sourceSymlinkError(src, error);
         }
         throw error;
@@ -38,7 +46,7 @@ function openSourceSync(fsModule, src) {
         return fsModule.openSync(src, OPEN_READ_FLAGS);
     }
     catch (error) {
-        if (error.code === "ELOOP") {
+        if (hasErrorCode(error, "ELOOP")) {
             throw sourceSymlinkError(src, error);
         }
         throw error;
@@ -57,44 +65,30 @@ export async function readOwnedCopySource(params) {
         ? syncFs.lstatSync(params.src) : await params.fsModule.lstat(params.src), params.src);
     const handle = await openSource(params.fsModule, params.src);
     try {
-        if (params.expectedIdentity) {
-            const exact = await inspectFileIdentity(() => params.fsModule === fs
-                ? syncFs.fstatSync(handle.fd, { bigint: true }) : handle.stat({ bigint: true }), params.expectedIdentity);
-            await inspectFileIdentity(() => params.fsModule === fs
-                ? syncFs.lstatSync(params.src, { bigint: true }) : params.fsModule.lstat(params.src, { bigint: true }), exact);
-        }
-        const opened = params.fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
-        const current = params.fsModule === fs
-            ? syncFs.lstatSync(params.src) : await params.fsModule.lstat(params.src);
-        if (!opened.isFile() || current.isSymbolicLink() || !sameFileIdentity(opened, current)) {
-            throw new FsSafeError("path-mismatch", `Copy fallback source changed while opening: ${params.src}`);
-        }
-        if (opened.nlink !== 1) {
-            throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${params.src}`);
-        }
-        return { replacement: await handle.readFile(), mode: opened.mode };
+        const opened = await inspectFileIdentity(() => params.fsModule === fs
+            ? syncFs.fstatSync(handle.fd, { bigint: true }) : handle.stat({ bigint: true }), params.expectedIdentity);
+        const current = await inspectFileIdentity(() => params.fsModule === fs
+            ? syncFs.lstatSync(params.src, { bigint: true }) : params.fsModule.lstat(params.src, { bigint: true }), opened);
+        assertOpenedSource(opened, current, params.src);
+        return { replacement: await handle.readFile(), mode: Number(opened.mode) };
     }
     finally {
-        await handle.close().catch(() => undefined);
+        try {
+            await handle.close();
+        }
+        catch {
+            // Best-effort close includes synchronous adapter throws.
+        }
     }
 }
 export function readOwnedCopySourceSync(params) {
     assertSourcePreview(params.fsModule.lstatSync(params.src), params.src);
     const fd = openSourceSync(params.fsModule, params.src);
     try {
-        if (params.expectedIdentity) {
-            const exact = inspectFileIdentitySync(() => params.fsModule.fstatSync(fd, { bigint: true }), params.expectedIdentity);
-            inspectFileIdentitySync(() => params.fsModule.lstatSync(params.src, { bigint: true }), exact);
-        }
-        const opened = params.fsModule.fstatSync(fd);
-        const current = params.fsModule.lstatSync(params.src);
-        if (!opened.isFile() || current.isSymbolicLink() || !sameFileIdentity(opened, current)) {
-            throw new FsSafeError("path-mismatch", `Copy fallback source changed while opening: ${params.src}`);
-        }
-        if (opened.nlink !== 1) {
-            throw new FsSafeError("hardlink", `Hardlinked copy fallback source not allowed: ${params.src}`);
-        }
-        return { replacement: readAllSync(params.fsModule, fd, opened.size), mode: opened.mode };
+        const opened = inspectFileIdentitySync(() => params.fsModule.fstatSync(fd, { bigint: true }), params.expectedIdentity);
+        const current = inspectFileIdentitySync(() => params.fsModule.lstatSync(params.src, { bigint: true }), opened);
+        assertOpenedSource(opened, current, params.src);
+        return { replacement: readAllSync(params.fsModule, fd, Number(opened.size)), mode: Number(opened.mode) };
     }
     finally {
         try {

package/node_modules/@openclaw/fs-safe/dist/replace-file-descriptor.d.ts

@@ -1,6 +1,7 @@
 import syncFs, { type BigIntStats } from "node:fs";
 import fs, { type FileHandle } from "node:fs/promises";
-import { type DirectoryModeOwner } from "./directory-mode-owner.js";
+import { type DirectoryModeOwner } from "./directory-mode-node.js";
+import type { AtomicMutation } from "./replace-file-mutation.js";
 type AsyncTempFileSystem = Pick<typeof fs, "lstat" | "open" | "writeFile">;
 type SyncTempFileSystem = Pick<typeof syncFs, "closeSync" | "fstatSync" | "fsyncSync" | "lstatSync" | "openSync" | "writeFileSync">;
 export type SyncFchmod = (fd: number, mode: number) => void;
@@ -11,18 +12,17 @@ export declare function pinDirectoryForMode(params: {
     dirPath: string;
     /** Compatibility for best-effort directory modes; admission and close still fail closed. */
     ignoreChmodError?: boolean;
+    mutation?: AtomicMutation;
 }): Promise<DirectoryModeOwner | undefined>;
-export declare function applyDirectoryMode(params: {
-    fsModule: AsyncTempFileSystem;
-    dirPath: string;
+export declare function applyDirectoryMode(params: Parameters<typeof pinDirectoryForMode>[0] & {
     mode: number;
-    ignoreChmodError?: boolean;
 }): Promise<void>;
 export declare function applyDirectoryModeSync(params: {
     fsModule: SyncTempFileSystem;
     dirPath: string;
     mode: number;
     fchmodSync?: SyncFchmod;
+    mutation?: AtomicMutation;
 }): void;
 export declare function writeTempFile(params: {
     fsModule: AsyncTempFileSystem;
@@ -31,21 +31,16 @@ export declare function writeTempFile(params: {
     mode: number;
     sync: boolean;
     onIdentity?: (identity: BigIntStats) => void;
+    mutation?: AtomicMutation;
 }): Promise<{
     handle: FileHandle;
     identity: BigIntStats;
 }>;
-export declare function writeTempFileSync(params: {
+export declare function writeTempFileSync(params: Omit<Parameters<typeof writeTempFile>[0], "fsModule"> & {
     fsModule: SyncTempFileSystem;
-    tempPath: string;
-    content: string | Uint8Array;
-    mode: number;
     fchmodSync?: SyncFchmod;
-    sync: boolean;
-    onIdentity?: (identity: BigIntStats) => void;
 }): {
     fd: number;
     identity: BigIntStats;
 };
 export {};
-//# sourceMappingURL=replace-file-descriptor.d.ts.map