@openclaw/openshell-sandbox 2026.9.5 → 2026.9.7

package/node_modules/@openclaw/fs-safe/dist/root-path.js

@@ -5,10 +5,9 @@ import { pathEscapeError, sanitizeRootPathError, symlinkEscapeError } from "./ro
 import { FsSafeError } from "./errors.js";
 import { isNativeDirectoryObservationGuard } from "./native-directory-observation.js";
 import { assertNoNulPathInput, isNotFoundPathError, isPathRelativeEscape, } from "./path.js";
-import { absolutePathWithRawSegments, rawPathRelativeToCanonicalRoot, resolvePathViaExistingAncestor, resolvePathViaExistingAncestorSync, } from "./root-path-existing.js";
+import { absolutePathWithRawSegments, rawPathRelativeToCanonicalRoot, resolveExistingAncestor, resolveSymlinkHopPath, } from "./root-path-existing.js";
 import { admitPathInsideRoot, } from "./root-boundary.js";
 import { RootPathObservationError, captureRootPathObservedDirectory, createRootPathTraversalObservation, inspectRootPathTraversalEntry, } from "./root-path-observation.js";
-import { resolveSymlinkHopPath, resolveSymlinkHopPathSync } from "./root-path-symlink.js";
 import { assertNoDriveRelativePathSegments } from "./safe-path-segment.js";
 import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathFromBasePreservingWindowsRoot, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 export { resolvePathViaExistingAncestorSync } from "./root-path-existing.js";
@@ -24,85 +23,35 @@ export const ROOT_PATH_ALIAS_POLICIES = {
     }),
 };
 export async function resolveRootPath(params) {
-    try {
-        return await resolveRootPathInternal(params);
-    }
-    catch (error) {
-        throw sanitizeRootPathError(error);
-    }
+    return resolveRootPathInternal(params);
 }
 export async function resolveRootPathWithCanonicalRootObservation(params, observeRoot) {
-    try {
-        return await resolveRootPathInternal(params, undefined, undefined, observeRoot);
-    }
-    catch (error) {
-        throw sanitizeRootPathError(error);
-    }
-}
-async function resolveRootPathInternal(params, observationRequest, observationOutput, observeRoot, removalReceipts) {
-    const input = captureValidRootPathInputs(params);
-    const rawAbsolutePath = absolutePathWithRawSegments(input.absolutePath);
-    const rootPath = resolvePathPreservingWindowsRoot(input.rootPath);
-    const absolutePath = resolvePathPreservingWindowsRoot(rawAbsolutePath);
-    const rootCanonicalPath = input.rootCanonicalPath
-        ? resolvePathPreservingWindowsRoot(input.rootCanonicalPath)
-        : await resolvePathViaExistingAncestor(rootPath);
-    assertNoWindowsPathAlias(rootPath);
-    assertNoWindowsPathAlias(absolutePath);
-    assertNoWindowsPathAlias(rootCanonicalPath);
-    observeRoot?.(rootCanonicalPath);
-    return resolveRootPathLexicalAsync(prepareRootTraversal(input, rootPath, rootCanonicalPath, absolutePath, rawAbsolutePath), observationRequest, observationOutput, removalReceipts);
+    return resolveRootPathInternal(params, { observeRoot });
 }
 export async function resolveRootPathWithObservation(params, request) {
-    const output = {};
-    try {
-        const resolved = await resolveRootPathInternal(params, request, output);
-        return output.receipt ? { resolved, receipt: output.receipt } : { resolved };
-    }
-    catch (error) {
-        throw sanitizeRootPathError(error);
-    }
+    const observation = { request };
+    const resolved = resolveRootPathInternal(params, { observation });
+    return observation.receipt ? { resolved, receipt: observation.receipt } : { resolved };
 }
 // Removal receipts are separate from metadata observations and canonical-root
 // callbacks; the public resolver's options and result remain unchanged.
 export async function resolveRootPathForRemoval(params, receipts) {
-    try {
-        return await resolveRootPathInternal(params, undefined, undefined, undefined, receipts);
-    }
-    catch (error) {
-        throw sanitizeRootPathError(error);
-    }
+    return resolveRootPathInternal(params, { removalReceipts: receipts });
 }
 export function resolveRootPathSync(params) {
-    try {
-        return resolveRootPathSyncInternal(params);
-    }
-    catch (error) {
-        throw sanitizeRootPathError(error);
-    }
+    return resolveRootPathInternal(params, { mode: "ordinary" });
 }
 export function resolveRootPathSyncWithCanonicalRootObservation(params, observeRoot) {
+    return resolveRootPathInternal(params, { mode: "ordinary", observeRoot });
+}
+function resolveRootPathInternal(params, options = {}) {
     try {
-        return resolveRootPathSyncInternal(params, observeRoot);
+        return traverseRootPath(params, options);
     }
     catch (error) {
         throw sanitizeRootPathError(error);
     }
 }
-function resolveRootPathSyncInternal(params, observeRoot) {
-    const input = captureValidRootPathInputs(params);
-    const rawAbsolutePath = absolutePathWithRawSegments(input.absolutePath);
-    const rootPath = resolvePathPreservingWindowsRoot(input.rootPath);
-    const absolutePath = resolvePathPreservingWindowsRoot(rawAbsolutePath);
-    const rootCanonicalPath = input.rootCanonicalPath
-        ? resolvePathPreservingWindowsRoot(input.rootCanonicalPath)
-        : resolvePathViaExistingAncestorSync(rootPath);
-    assertNoWindowsPathAlias(rootPath);
-    assertNoWindowsPathAlias(absolutePath);
-    assertNoWindowsPathAlias(rootCanonicalPath);
-    observeRoot?.(rootCanonicalPath);
-    return resolveRootPathLexicalSync(prepareRootTraversal(input, rootPath, rootCanonicalPath, absolutePath, rawAbsolutePath));
-}
 function prepareRootTraversal(params, rootPath, rootCanonicalPath, absolutePath, rawAbsolutePath) {
     let raw = rawAbsolutePath;
     let trustedAbsolutePath = false;
@@ -173,27 +122,23 @@ function assertNoEmbeddedDriveRelativeSegment(filePath, label) {
     const root = path.parse(filePath).root;
     assertNoDriveRelativePathSegments(filePath.slice(root.length).replaceAll("\\", "/"), label);
 }
-function createLexicalTraversalState(params) {
-    const rawAbsolutePath = params.rawAbsolutePath;
-    const relative = admitRawPathInsideRoot(params.rootPath, rawAbsolutePath, params.params.rootIdentity)?.relativePath;
+function createLexicalTraversalContext(params) {
+    const relative = admitRawPathInsideRoot(params.rootPath, params.rawAbsolutePath, params.params.rootIdentity)?.relativePath;
     if (relative === undefined)
         throw new Error("Path traversal must begin at the root");
     const segments = splitTraversalSegments(relative);
     return {
-        segments,
-        relativePath: relative,
-        reuseLexicalCanonical: false,
-        finalComponentIndex: segments.findLastIndex((segment) => segment !== "."),
-        allowFinalSymlink: params.params.policy?.allowFinalSymlinkForUnlink === true,
-        canonicalCursor: params.rootCanonicalPath,
-        lexicalCursor: params.rootPath,
-        preserveFinalSymlink: false,
-        missingDepth: 0,
-    };
-}
-function createLexicalTraversalContext(params) {
-    return {
-        state: createLexicalTraversalState(params),
+        state: {
+            segments,
+            relativePath: relative,
+            reuseLexicalCanonical: false,
+            finalComponentIndex: segments.findLastIndex((segment) => segment !== "."),
+            allowFinalSymlink: params.params.policy?.allowFinalSymlinkForUnlink === true,
+            canonicalCursor: params.rootCanonicalPath,
+            lexicalCursor: params.rootPath,
+            preserveFinalSymlink: false,
+            missingDepth: 0,
+        },
         resolveParams: params.params,
         rootPath: params.rootPath,
         rootCanonicalPath: params.rootCanonicalPath,
@@ -263,29 +208,15 @@ function disableLexicalTraversalObservation(context, observation) {
 }
 function finalizeLexicalResolution(context, kind) {
     context.state.canonicalCursor = assertLexicalCursorInsideBoundary(context, context.state.canonicalCursor);
-    return buildResolvedRootPath({
+    return {
         absolutePath: context.absolutePath,
         canonicalPath: context.state.canonicalCursor,
         rootPath: context.rootPath,
         rootCanonicalPath: context.rootCanonicalPath,
+        relativePath: relativeInsideRoot(context.rootCanonicalPath, context.state.canonicalCursor),
+        exists: kind !== "missing",
         kind,
-    });
-}
-function handleLexicalLstatFailure(context, error, segment) {
-    if (!isNotFoundPathError(error)) {
-        return false;
-    }
-    advanceCanonicalCursorForSegment(context, segment);
-    context.state.missingDepth = 1;
-    return true;
-}
-function lexicalStatDisposition(params) {
-    if (!params.isSymbolicLink)
-        return "continue";
-    if (params.rejectFinalSymlink || (params.rejectSymlinks === true && params.isLast)) {
-        throw new FsSafeError("symlink", "symlink path component not allowed");
-    }
-    return params.allowFinalSymlink && params.isLast ? "break" : "resolve-link";
+    };
 }
 function applyResolvedSymlinkHop(context, linkCanonical) {
     let admitted;
@@ -319,10 +250,23 @@ function assertResolvedLinkDirectory(pathname, isLast) {
     const stat = fs.statSync(pathForWindowsFilesystem(pathname));
     assertDirectoryBeforeMoreSegments(stat, pathname, isLast);
 }
-async function resolveRootPathLexicalAsync(params, observationRequest, observationOutput, removalReceipts) {
-    const context = createLexicalTraversalContext(params);
+// Both public APIs use synchronous metadata; only canonicalization and ancestor
+// existence differ. Promise wrappers preserve the asynchronous rejection API.
+function traverseRootPath(params, { mode = "native", observation: observationOutput, observeRoot, removalReceipts }) {
+    const input = captureValidRootPathInputs(params);
+    const rawAbsolutePath = absolutePathWithRawSegments(input.absolutePath);
+    const rootPath = resolvePathPreservingWindowsRoot(input.rootPath);
+    const absolutePath = resolvePathPreservingWindowsRoot(rawAbsolutePath);
+    const rootCanonicalPath = input.rootCanonicalPath
+        ? resolvePathPreservingWindowsRoot(input.rootCanonicalPath)
+        : resolveExistingAncestor(rootPath, mode);
+    assertNoWindowsPathAlias(rootPath);
+    assertNoWindowsPathAlias(absolutePath);
+    assertNoWindowsPathAlias(rootCanonicalPath);
+    observeRoot?.(rootCanonicalPath);
+    const context = createLexicalTraversalContext(prepareRootTraversal(input, rootPath, rootCanonicalPath, absolutePath, rawAbsolutePath));
     const { state } = context;
-    const observation = createLexicalTraversalObservation(context, observationRequest);
+    const observation = createLexicalTraversalObservation(context, observationOutput?.request);
     for (let idx = 0; idx < state.segments.length; idx += 1) {
         const segment = state.segments[idx] ?? "";
         const isLast = idx === state.segments.length - 1;
@@ -374,9 +318,11 @@ async function resolveRootPathLexicalAsync(params, observationRequest, observati
                 // Preserve observation-only versus ordinary traversal error precedence.
                 throw new RootPathObservationError(error instanceof RootPathObservationError ? error.error : sanitizeRootPathError(error), parentReceipt, !(error instanceof RootPathObservationError));
             }
-            if (handleLexicalLstatFailure(context, error, segment))
-                continue;
-            throw error;
+            if (!isNotFoundPathError(error))
+                throw error;
+            advanceCanonicalCursorForSegment(context, segment);
+            state.missingDepth = 1;
+            continue;
         }
         if (isNativeDirectoryObservationGuard(observed)) {
             advanceCanonicalCursorForSegment(context, segment);
@@ -392,15 +338,13 @@ async function resolveRootPathLexicalAsync(params, observationRequest, observati
         const isSymbolicLink = stat.isSymbolicLink();
         if (!isSymbolicLink)
             assertDirectoryBeforeMoreSegments(stat, state.lexicalCursor, isLast);
-        const disposition = lexicalStatDisposition({
-            isSymbolicLink,
-            isLast,
-            rejectSymlinks: isSymbolicLink ? context.resolveParams.rejectSymlinks : undefined,
-            rejectFinalSymlink: context.resolveParams.rejectFinalSymlink === true && idx === state.finalComponentIndex,
-            allowFinalSymlink: state.allowFinalSymlink,
-        });
-        if (disposition !== "resolve-link") {
-            state.preserveFinalSymlink = disposition === "break";
+        if (isSymbolicLink && ((context.resolveParams.rejectFinalSymlink === true && idx === state.finalComponentIndex) ||
+            (context.resolveParams.rejectSymlinks === true && isLast))) {
+            throw new FsSafeError("symlink", "symlink path component not allowed");
+        }
+        const preserveFinalSymlink = isSymbolicLink && state.allowFinalSymlink && isLast;
+        if (!isSymbolicLink || preserveFinalSymlink) {
+            state.preserveFinalSymlink = preserveFinalSymlink;
             advanceCanonicalCursorForSegment(context, segment);
             if (observation?.enabled && isSymbolicLink) {
                 disableLexicalTraversalObservation(context, observation);
@@ -420,9 +364,7 @@ async function resolveRootPathLexicalAsync(params, observationRequest, observati
         }
         if (observation?.enabled)
             disableLexicalTraversalObservation(context, observation);
-        const linkCanonical = await resolveSymlinkHopPath(state.lexicalCursor, {
-            rejectUnresolved: context.resolveParams.rejectUnresolvedSymlinks,
-        });
+        const linkCanonical = resolveSymlinkHopPath(state.lexicalCursor, mode, context.resolveParams.rejectUnresolvedSymlinks);
         applyResolvedSymlinkHop(context, linkCanonical);
         if (context.resolveParams.rejectSymlinks === true) {
             throw new FsSafeError("symlink", "symlink path component not allowed");
@@ -432,13 +374,10 @@ async function resolveRootPathLexicalAsync(params, observationRequest, observati
     const completeObservation = observation?.enabled === true && observation.directoryGuard !== undefined &&
         observation.targetPath === state.canonicalCursor && observation.target !== undefined;
     const kind = completeObservation
-        ? {
-            exists: true,
-            kind: isNativeDirectoryObservationGuard(observation.target)
-                ? "directory"
-                : toResolvedKind(observation.target.stat),
-        }
-        : await getPathKind(state.canonicalCursor, state.preserveFinalSymlink);
+        ? isNativeDirectoryObservationGuard(observation.target)
+            ? "directory"
+            : toResolvedKind(observation.target.stat)
+        : getPathKindSync(state.canonicalCursor, state.preserveFinalSymlink);
     if (completeObservation && observationOutput) {
         observationOutput.receipt = {
             kind: observation.request.kind,
@@ -451,99 +390,17 @@ async function resolveRootPathLexicalAsync(params, observationRequest, observati
     }
     return finalizeLexicalResolution(context, kind);
 }
-function resolveRootPathLexicalSync(params) {
-    const context = createLexicalTraversalContext(params);
-    const { state } = context;
-    for (let idx = 0; idx < state.segments.length; idx += 1) {
-        const segment = state.segments[idx] ?? "";
-        const isLast = idx === state.segments.length - 1;
-        if (segment === ".")
-            continue;
-        if (segment === "..") {
-            applyParentTraversalStep(context);
-            continue;
-        }
-        state.lexicalCursor = path.join(state.lexicalCursor, segment);
-        if (state.missingDepth > 0) {
-            advanceCanonicalCursorForSegment(context, segment);
-            state.missingDepth += 1;
-            continue;
-        }
-        let stat;
-        try {
-            stat = fs.lstatSync(state.lexicalCursor);
-        }
-        catch (error) {
-            if (handleLexicalLstatFailure(context, error, segment))
-                continue;
-            throw error;
-        }
-        const isSymbolicLink = stat.isSymbolicLink();
-        if (!isSymbolicLink)
-            assertDirectoryBeforeMoreSegments(stat, state.lexicalCursor, isLast);
-        const disposition = lexicalStatDisposition({
-            isSymbolicLink,
-            isLast,
-            rejectSymlinks: isSymbolicLink ? context.resolveParams.rejectSymlinks : undefined,
-            rejectFinalSymlink: context.resolveParams.rejectFinalSymlink === true && idx === state.finalComponentIndex,
-            allowFinalSymlink: state.allowFinalSymlink,
-        });
-        if (disposition !== "resolve-link") {
-            state.preserveFinalSymlink = disposition === "break";
-            advanceCanonicalCursorForSegment(context, segment);
-            if (state.preserveFinalSymlink)
-                break;
-            continue;
-        }
-        const linkCanonical = resolveSymlinkHopPathSync(state.lexicalCursor, {
-            rejectUnresolved: context.resolveParams.rejectUnresolvedSymlinks,
-        });
-        applyResolvedSymlinkHop(context, linkCanonical);
-        if (context.resolveParams.rejectSymlinks === true) {
-            throw new FsSafeError("symlink", "symlink path component not allowed");
-        }
-        assertResolvedLinkDirectory(linkCanonical, isLast);
-    }
-    const kind = getPathKindSync(state.canonicalCursor, state.preserveFinalSymlink);
-    return finalizeLexicalResolution(context, kind);
-}
-function buildResolvedRootPath(params) {
-    return {
-        absolutePath: params.absolutePath,
-        canonicalPath: params.canonicalPath,
-        rootPath: params.rootPath,
-        rootCanonicalPath: params.rootCanonicalPath,
-        relativePath: relativeInsideRoot(params.rootCanonicalPath, params.canonicalPath),
-        exists: params.kind.exists,
-        kind: params.kind.kind,
-    };
-}
-async function getPathKind(absolutePath, preserveFinalSymlink) {
-    try {
-        const operationPath = pathForWindowsFilesystem(absolutePath);
-        const stat = preserveFinalSymlink
-            ? fs.lstatSync(operationPath)
-            : fs.statSync(operationPath);
-        return { exists: true, kind: toResolvedKind(stat) };
-    }
-    catch (error) {
-        if (isNotFoundPathError(error)) {
-            return { exists: false, kind: "missing" };
-        }
-        throw error;
-    }
-}
 function getPathKindSync(absolutePath, preserveFinalSymlink) {
     try {
         const operationPath = pathForWindowsFilesystem(absolutePath);
         const stat = preserveFinalSymlink
             ? fs.lstatSync(operationPath)
             : fs.statSync(operationPath);
-        return { exists: true, kind: toResolvedKind(stat) };
+        return toResolvedKind(stat);
     }
     catch (error) {
         if (isNotFoundPathError(error)) {
-            return { exists: false, kind: "missing" };
+            return "missing";
         }
         throw error;
     }

package/node_modules/@openclaw/fs-safe/dist/root-paths-lexical.d.ts

@@ -6,4 +6,3 @@ export declare function resolvePathWithinRoot(params: ResolvePathWithinRootParam
     ok: false;
     error: string;
 };
-//# sourceMappingURL=root-paths-lexical.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-paths.d.ts

@@ -1,3 +1,4 @@
+import { type ResolvePathWithinRootParams } from "./path-scope-lexical.js";
 import { type DirectoryResult } from "./root-directory.js";
 export { resolvePathWithinRoot } from "./root-paths-lexical.js";
 export { ensureDirectoryWithinRoot } from "./root-directory.js";
@@ -44,12 +45,7 @@ export type PathScope = {
         mode?: number;
     }): Promise<DirectoryResult>;
 };
-export declare function resolveWritablePathWithinRoot(params: {
-    rootDir: string;
-    requestedPath: string;
-    scopeLabel: string;
-    defaultFileName?: string;
-}): Promise<{
+export declare function resolveWritablePathWithinRoot(params: ResolvePathWithinRootParams): Promise<{
     ok: true;
     path: string;
 } | {
@@ -60,4 +56,3 @@ export declare function resolvePathsWithinRoot(params: ResolvePathsWithinRootPar
 export declare function resolveExistingPathsWithinRoot(params: ResolvePathsWithinRootParams): Promise<ResolvePathsWithinRootResult>;
 export declare function resolveStrictExistingPathsWithinRoot(params: ResolvePathsWithinRootParams): Promise<ResolvePathsWithinRootResult>;
 export declare function pathScope(rootDir: string, options: PathScopeOptions): PathScope;
-//# sourceMappingURL=root-paths.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-public-types.d.ts

@@ -0,0 +1,11 @@
+export type { OpenResult, WritableOpenResult, } from "./root-impl.js";
+export type { HardlinkPolicy, RootAppendOptions, RootCopyOptions, RootCopySource, RootCreateJsonOptions, RootCreateOptions, RootCreateStreamOptions, RootDefaults, RootMkdirOptions, RootMoveOptions, RootOpenOptions, RootOpenWritableOptions, RootOptions, RootReadOptions, RootRemoveOptions, RootWriteJsonOptions, RootWriteOptions, WritableOpenMode, } from "./root-options.js";
+export type { DenyMutationPolicy } from "./deny-mutations.js";
+export type { RenameIdentityPolicy } from "./pinned-write-types.js";
+export type { MutationSymlinkPolicy, SymlinkPolicy, } from "./root-symlink-policy.js";
+export type { ReadResult } from "./read-opened-file.js";
+export type { RootCopyPublicationReceipt } from "./copy-publication.js";
+export type { CopyCloneMode } from "./copy-policy.js";
+export type { RootEntriesOptions } from "./root-entries.js";
+export type { ContainmentGuarantee } from "./containment.js";
+export type { RootWalkDataEntry, RootWalkDataEntryKind, RootWalkDirectoryErrorBehavior, RootWalkEntry, RootWalkEntryFilter, RootWalkEntryFilterResult, RootWalkEntryKind, RootWalkLimitBehavior, RootWalkOptions, RootWalkSymlinkPolicy, } from "./root-walk.js";

package/node_modules/@openclaw/fs-safe/dist/root-public-types.js

@@ -0,0 +1 @@
+export {};

package/node_modules/@openclaw/fs-safe/dist/root-read-admission.d.ts

@@ -23,4 +23,3 @@ export declare function admitRootReadHandle<T extends OwnedRootReadHandle>(param
     realPath: string;
 }>;
 export {};
-//# sourceMappingURL=root-read-admission.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-read-admission.js

@@ -31,36 +31,6 @@ export function inspectOpenedPathIdentitySync(filePath, symlinks) {
     }
     return stat;
 }
-function assertRootReadAdmissionCurrent(params) {
-    assertRootIdentityCurrentSync(params.root);
-    const admittedPath = (() => {
-        try {
-            inspectFileIdentitySync(() => inspectOpenedPathIdentitySync(params.filePath, params.symlinks), params.identity);
-            const canonicalPath = resolveFinalOpenedRealPath(params.filePath);
-            assertNoWindowsPathAlias(canonicalPath, "filesystem", "resolved file path uses a Windows filesystem namespace alias");
-            const admittedRealPath = admitPathInsideRoot({
-                rootPath: params.root.rootReal,
-                candidatePath: canonicalPath,
-                rootIdentity: params.root.rootIdentity,
-            });
-            if (!admittedRealPath) {
-                throw openedPathResolutionError(outsideWorkspaceError());
-            }
-            // This is a fresh no-follow observation even when canonicalPath and
-            // filePath have the same spelling; realpath may have raced a replacement.
-            inspectFileIdentitySync(() => inspectOpenedPathIdentitySync(canonicalPath, undefined), params.identity);
-            return admittedRealPath.path;
-        }
-        catch (error) {
-            throw isNotFoundPathError(error)
-                ? openedPathResolutionError(fileNotFoundError())
-                : error;
-        }
-    })();
-    params.afterPathIdentityCheck?.(params.filePath, params.handle);
-    assertRootIdentityCurrentSync(params.root);
-    return admittedPath;
-}
 export async function admitRootReadHandle(params) {
     try {
         if (params.hardlinks !== "allow" && params.opened.stat.nlink > 1) {
@@ -70,15 +40,37 @@ export async function admitRootReadHandle(params) {
             await params.beforeFinalFence(params.filePath, params.opened.handle);
         }
         try {
-            const finalRealPath = assertRootReadAdmissionCurrent({
-                root: params.root,
-                filePath: params.filePath,
-                handle: params.opened.handle,
-                identity: params.identity,
-                symlinks: params.symlinks,
-                afterPathIdentityCheck: params.afterPathIdentityCheck,
-            });
-            return { ...params.opened, realPath: finalRealPath };
+            assertRootIdentityCurrentSync(params.root);
+            let realPath;
+            try {
+                const current = inspectFileIdentitySync(() => inspectOpenedPathIdentitySync(params.filePath, params.symlinks), params.identity);
+                if (params.hardlinks !== "allow" && current.nlink > 1n)
+                    throw hardlinkedPathNotAllowedError();
+                const canonicalPath = resolveFinalOpenedRealPath(params.filePath);
+                assertNoWindowsPathAlias(canonicalPath, "filesystem", "resolved file path uses a Windows filesystem namespace alias");
+                const admittedRealPath = admitPathInsideRoot({
+                    rootPath: params.root.rootReal,
+                    candidatePath: canonicalPath,
+                    rootIdentity: params.root.rootIdentity,
+                });
+                if (!admittedRealPath) {
+                    throw openedPathResolutionError(outsideWorkspaceError());
+                }
+                // This is a fresh no-follow observation even when canonicalPath and
+                // filePath have the same spelling; realpath may have raced a replacement.
+                const canonical = inspectFileIdentitySync(() => inspectOpenedPathIdentitySync(canonicalPath, undefined), params.identity);
+                if (params.hardlinks !== "allow" && canonical.nlink > 1n)
+                    throw hardlinkedPathNotAllowedError();
+                realPath = admittedRealPath.path;
+            }
+            catch (error) {
+                throw isNotFoundPathError(error)
+                    ? openedPathResolutionError(fileNotFoundError())
+                    : error;
+            }
+            params.afterPathIdentityCheck?.(params.filePath, params.opened.handle);
+            assertRootIdentityCurrentSync(params.root);
+            return { ...params.opened, realPath };
         }
         catch (error) {
             if (params.identity.nlink <= 1n) {

package/node_modules/@openclaw/fs-safe/dist/root-remove-identity.d.ts

@@ -1,9 +1,7 @@
 import type { BigIntStats } from "node:fs";
 type ExactDirectoryIdentity = Readonly<Pick<BigIntStats, "dev" | "ino">>;
-export type RemovalDirectoryAssertion = Readonly<{
+export type RemovalDirectoryAssertion = ExactDirectoryIdentity & Readonly<{
     path: string;
-    dev: bigint;
-    ino: bigint;
     numericDev?: number;
     numericIno?: number;
     platform: NodeJS.Platform;
@@ -12,4 +10,3 @@ export type RemovalDirectoryAssertion = Readonly<{
 export declare function createRemovalDirectoryAssertion(path: string, identity: ExactDirectoryIdentity, realPath?: string, platform?: NodeJS.Platform): RemovalDirectoryAssertion;
 export declare function assertRemovalDirectoryCurrent(assertion: RemovalDirectoryAssertion): void;
 export {};
-//# sourceMappingURL=root-remove-identity.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-remove-identity.js

@@ -2,12 +2,10 @@ import fsSync from "node:fs";
 import { inspectDirectoryIdentitySync } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { realpathSync } from "./realpath.js";
-import { directoryComponentNotDirectoryError } from "./root-errors.js";
+import { directoryComponentNotDirectoryError, errorCauseOptions } from "./root-errors.js";
 const MAX_SAFE_DIRECTORY_IDENTITY = BigInt(Number.MAX_SAFE_INTEGER);
 function identityMismatch(cause) {
-    return new FsSafeError("path-mismatch", "removal ancestor identity changed or could not be verified", {
-        cause: cause instanceof Error ? cause : undefined,
-    });
+    return new FsSafeError("path-mismatch", "removal ancestor identity changed or could not be verified", errorCauseOptions(cause));
 }
 function safeIdentityNumber(value) {
     if (value < 0n || value > MAX_SAFE_DIRECTORY_IDENTITY)

package/node_modules/@openclaw/fs-safe/dist/root-remove-receipt.d.ts

@@ -14,4 +14,3 @@ export declare class RemovalPathReceipts {
         directories: readonly CapturedRemovalDirectory[];
     } | undefined;
 }
-//# sourceMappingURL=root-remove-receipt.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-remove.d.ts

@@ -1,6 +1,6 @@
 import { type RootContext } from "./root-context.js";
 import type { RootRemoveOptions } from "./root-options.js";
 import type { RemovalPathReceipts } from "./root-remove-receipt.js";
+export declare const nonrecursiveRemovalKind: unique symbol;
 export declare function validateRemoveOptions(options: RootRemoveOptions): void;
 export declare function removePathInRootFallback(root: RootContext, targetPath: string, options: RootRemoveOptions, receipts?: RemovalPathReceipts): Promise<void>;
-//# sourceMappingURL=root-remove.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-remove.js

@@ -8,7 +8,7 @@ import { sameFileIdentityForCleanup } from "./file-identity.js";
 import { MutationAuthorityError } from "./mutation-authority.js";
 import { isNotFoundPathError, isPathInside } from "./path.js";
 import { assertRootIdentityCurrent } from "./root-context.js";
-import { normalizeRemoveGuardError, normalizeRemovePathError, rootPathChangedError } from "./root-errors.js";
+import { errorCauseOptions, normalizeRemoveGuardError, normalizeRemovePathError, rootPathChangedError } from "./root-errors.js";
 import { assertRemovalDirectoryCurrent, createRemovalDirectoryAssertion, } from "./root-remove-identity.js";
 import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
@@ -16,6 +16,7 @@ import { createSuppressedError } from "./suppressed-error.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
 const DEFAULT_MAX_ENTRIES = 100_000;
 const DEFAULT_MAX_DEPTH = 64;
+export const nonrecursiveRemovalKind = Symbol("nonrecursive removal kind");
 export function validateRemoveOptions(options) {
     if (options.order !== undefined && options.order !== "filesystem" && options.order !== "sorted") {
         throw new TypeError("remove order must be filesystem or sorted");
@@ -43,9 +44,7 @@ function assertNotAborted(signal) {
     }
 }
 function removalAncestorChanged(error) {
-    return new FsSafeError("path-mismatch", "removal ancestor changed during operation", {
-        cause: error instanceof Error ? error : undefined,
-    });
+    return new FsSafeError("path-mismatch", "removal ancestor changed during operation", errorCauseOptions(error));
 }
 function sameCanonicalDirectory(left, right) {
     return left === right || (isPathInside(left, right) && isPathInside(right, left));
@@ -219,10 +218,21 @@ async function removeOne(root, targetPath, options, receipts) {
         throw normalizeRemoveGuardError(error);
     }
     try {
-        const isDirectory = fsSync.lstatSync(targetPath).isDirectory();
+        const identity = options.assertBeforeMutation
+            ? inspectFileIdentitySync(() => fsSync.lstatSync(targetPath, { bigint: true })) : undefined;
+        const isDirectory = (identity ?? fsSync.lstatSync(targetPath)).isDirectory();
+        if (!isDirectory && options[nonrecursiveRemovalKind] === "directory") {
+            throw new FsSafeError("path-mismatch", "store entry is no longer a directory");
+        }
         assertFinalSymlinkRejected(targetPath, options.mutationSymlinks !== undefined);
         assertNotAborted(options.signal);
         options.assertBeforeMutation?.();
+        if (identity) {
+            assertNotAborted(options.signal);
+            admission.assertCurrent();
+            inspectFileIdentitySync(() => fsSync.lstatSync(targetPath, { bigint: true }), identity);
+            assertFinalSymlinkRejected(targetPath, options.mutationSymlinks !== undefined);
+        }
         await (isDirectory ? fs.rmdir(targetPath) : fs.unlink(targetPath));
     }
     catch (error) {
@@ -432,6 +442,12 @@ export async function removePathInRootFallback(root, targetPath, options, receip
         assertFinalSymlinkRejected(target, options.mutationSymlinks !== undefined, details(target, "remove"));
         assertNotAborted(options.signal);
         options.assertBeforeMutation?.();
+        if (options.assertBeforeMutation) {
+            assertNotAborted(options.signal);
+            if (!inspect(target, initial))
+                return;
+            assertFinalSymlinkRejected(target, options.mutationSymlinks !== undefined, details(target, "remove"));
+        }
         try {
             await (initial.isDirectory() ? fs.rmdir(target) : fs.unlink(target));
         }

package/node_modules/@openclaw/fs-safe/dist/root-symlink-policy.d.ts

@@ -11,4 +11,3 @@ export declare function mutationSymlinkResolution(symlinks: MutationSymlinkPolic
     resolveCanonical: boolean;
 };
 export declare function assertFinalSymlinkRejected(targetPath: string, reject: boolean | undefined, details?: FsSafeErrorDetails): void;
-//# sourceMappingURL=root-symlink-policy.d.ts.map