@openclaw/openshell-sandbox 2026.9.5 → 2026.9.7

package/node_modules/@openclaw/fs-safe/dist/root-write-lock-binding.js

@@ -0,0 +1,162 @@
+import fs from "node:fs";
+import path from "node:path";
+import { inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { hasNodeErrorCode, isNotFoundPathError } from "./path.js";
+import { admitPathInsideRoot } from "./root-boundary.js";
+import { realpathSync } from "./realpath.js";
+const lockObservations = new WeakMap();
+export function canReuseParentWithMutationAssertion(assertion, rootPath, targetPath) {
+    if (assertion === undefined)
+        return true;
+    const binding = lockObservations.get(assertion);
+    return binding?.rootPath === rootPath && binding.targetPath === targetPath;
+}
+function unsupportedSpelling() {
+    return new FsSafeError("path-alias", "Windows compatibility writes require lower-case ASCII destination components");
+}
+// Missing names have no portable case/Unicode lock key. Keep this admission
+// narrower than general Root paths and never change keys after acquisition.
+function effectiveDestination(rootPath, targetPath, rootIdentity) {
+    let effective;
+    let missingHint;
+    try {
+        effective = realpathSync.native(targetPath);
+    }
+    catch (error) {
+        if (!isNotFoundPathError(error))
+            throw error;
+        let cursor = targetPath;
+        const missing = [];
+        for (;;) {
+            try {
+                fs.lstatSync(cursor);
+                break;
+            }
+            catch (error) {
+                if (!isNotFoundPathError(error) || cursor === rootPath)
+                    throw error;
+                const parent = path.dirname(cursor);
+                if (parent === cursor)
+                    throw error;
+                missing.unshift(path.basename(cursor));
+                cursor = parent;
+            }
+        }
+        // Existing dangling links must fail resolution, not become missing names.
+        const canonicalParent = realpathSync.native(cursor);
+        effective = path.join(canonicalParent, ...missing);
+        // The hint must describe the selected route exactly. The full resolver can
+        // normalize a missing raw `..` component out of the eventual lock path.
+        if (missing.length > 1 && path.resolve(canonicalParent) === canonicalParent &&
+            missing.every(component => /^[a-z0-9._-]+$/.test(component) &&
+                component !== "." && component !== ".." && !component.endsWith("."))) {
+            missingHint = Object.freeze({ parentPath: canonicalParent, parts: Object.freeze(missing), nextIndex: 0 });
+        }
+    }
+    const admitted = admitPathInsideRoot({ rootPath, candidatePath: effective, rootIdentity });
+    if (!admitted)
+        throw unsupportedSpelling();
+    const relative = admitted.relativePath;
+    if (!relative || !relative.split(path.sep).every(component => /^[a-z0-9._-]+$/.test(component) && !component.endsWith(".")))
+        throw unsupportedSpelling();
+    return {
+        path: admitted.path,
+        // Case-folded or rebased root spellings keep the full resolver and its
+        // existing root-identity admission at every mutation.
+        missing: admitted.admission === "exact" && admitted.path === effective ? missingHint : undefined,
+    };
+}
+// The hint stores only a location. Each call freshly binds the nearest existing
+// prefix and its first absent child; no identity or authorization crosses calls.
+function observeMissingDestination(hint) {
+    // A complete parent needs only the ordinary leaf check, not a prefix fence.
+    if (hint.parts.length - hint.nextIndex < 2)
+        return undefined;
+    try {
+        let parentPath = hint.parentPath;
+        let parent = inspectDirectoryIdentitySync(parentPath);
+        for (let nextIndex = hint.nextIndex; nextIndex < hint.parts.length; nextIndex++) {
+            const childPath = path.join(parentPath, hint.parts[nextIndex]);
+            let child;
+            try {
+                child = fs.lstatSync(childPath, { bigint: true });
+            }
+            catch (error) {
+                if (!hasNodeErrorCode(error, "ENOENT"))
+                    return undefined;
+                if (realpathSync.native(parentPath) !== parentPath)
+                    return undefined;
+                inspectDirectoryIdentitySync(parentPath, parent);
+                try {
+                    fs.lstatSync(childPath);
+                }
+                catch (error) {
+                    if (!hasNodeErrorCode(error, "ENOENT"))
+                        return undefined;
+                    // Absence can follow a renamed ancestor through a new alias while
+                    // preserving the directory's identity. Finish at its current name.
+                    if (realpathSync.native(parentPath) !== parentPath)
+                        return undefined;
+                    return Object.freeze({ parentPath, parts: hint.parts, nextIndex });
+                }
+                return undefined;
+            }
+            // An existing leaf always receives the historical full resolution,
+            // including final links, collisions and unsupported canonical spellings.
+            if (nextIndex === hint.parts.length - 1)
+                return undefined;
+            parent = inspectDirectoryIdentitySync(childPath, undefined, child);
+            parentPath = childPath;
+        }
+    }
+    catch {
+        // Removal, redirection and uncertain observations only discard the hint.
+        // The full resolver below still determines the destination and error.
+    }
+    return undefined;
+}
+export function assertRootFallbackWritePath(expected, actual) {
+    if (expected !== undefined && actual !== expected) {
+        throw new FsSafeError("path-mismatch", "compatibility write destination changed after lock selection");
+    }
+}
+export function createRootWriteLockBinding(params) {
+    const { rootPath } = params;
+    const rootIdentity = params.rootIdentity && Object.freeze({
+        dev: params.rootIdentity.dev, ino: params.rootIdentity.ino,
+    });
+    const selected = effectiveDestination(rootPath, params.targetPath, rootIdentity);
+    const targetPath = selected.path;
+    let missingHint = selected.missing;
+    const relativePath = path.relative(rootPath, targetPath);
+    let active = true;
+    const assertCurrent = () => {
+        if (!active)
+            throw new FsSafeError("path-mismatch", "compatibility lock observation expired");
+        const observed = missingHint && observeMissingDestination(missingHint);
+        if (observed) {
+            missingHint = observed;
+            return;
+        }
+        missingHint = undefined;
+        const current = effectiveDestination(rootPath, targetPath, rootIdentity);
+        assertRootFallbackWritePath(targetPath, current.path);
+        missingHint = current.missing;
+    };
+    // Only this library-owned, observation-only closure permits parent reuse.
+    // Callers cannot obtain that status by setting properties on their callback.
+    lockObservations.set(assertCurrent, Object.freeze({ rootPath, targetPath }));
+    return Object.freeze({
+        targetPath,
+        relativePath,
+        // The existing lock protocol uses slashes; the writer needs native spelling.
+        relativeLockPath: relativePath.split(path.sep).join("/"),
+        assertCurrent,
+        dispose() {
+            active = false;
+            missingHint = undefined;
+            lockObservations.delete(assertCurrent);
+        },
+    });
+}

package/node_modules/@openclaw/fs-safe/dist/root-write-mode.d.ts

@@ -5,4 +5,3 @@ export declare function inheritWriteTargetMode(params: {
     rootIdentity?: RootBoundaryIdentity;
     requestedMode?: number;
 }): Promise<number>;
-//# sourceMappingURL=root-write-mode.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-write-publication.d.ts

@@ -21,4 +21,3 @@ export declare function finishRootFallbackWrite(params: {
     }>;
     onVerificationFailure: (error: unknown) => void;
 }): Promise<void>;
-//# sourceMappingURL=root-write-publication.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-write-publication.js

@@ -4,7 +4,7 @@ import { readFileHandleBounded } from "./bounded-read.js";
 import { syncDirectoryBestEffort } from "./directory-durability.js";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentityForCleanup, sha256Hex } from "./file-identity.js";
-import { cleanupPinnedFilePath } from "./replace-file-temp-owner.js";
+import { cleanupPinnedFilePath } from "./file-cleanup.js";
 import { verifyAtomicWriteResult } from "./root-write-verification.js";
 // Compatibility callers hold the lock throughout this operation. The caller
 // owns the original write handle; this helper owns a content-verified reopen.

package/node_modules/@openclaw/fs-safe/dist/root-write-verification.d.ts

@@ -1,5 +1,5 @@
 import { type AnyAsyncDirectoryGuard } from "./directory-guard.js";
-import type { PublishedWriteIdentity } from "./pinned-write.js";
+import type { PublishedWriteIdentity } from "./pinned-write-types.js";
 import { type RootContext } from "./root-context.js";
 export declare function verifyAtomicWriteResult(params: {
     root: RootContext;
@@ -9,4 +9,3 @@ export declare function verifyAtomicWriteResult(params: {
     expectedMode?: number;
     parentGuard: AnyAsyncDirectoryGuard;
 }): Promise<void>;
-//# sourceMappingURL=root-write-verification.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-write-verification.js

@@ -1,5 +1,5 @@
 import fsSync, {} from "node:fs";
-import fs from "node:fs/promises";
+import fs, {} from "node:fs/promises";
 import { assertAsyncDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentity } from "./file-identity.js";
@@ -45,59 +45,46 @@ export async function verifyAtomicWriteResult(params) {
         return stat;
     };
     try {
-        // This descriptor remains owned by the writer, even when final mode forbids opens.
-        const stat = assertDescriptor();
-        assertPath(fsSync.lstatSync(params.targetPath, { bigint: true }));
-        const { realPath, stat: resolvedStat } = await resolveOpenedFileRealPathForFd(params.fd, stat, params.targetPath);
-        // Consume the resolver's observation only in this pass; the checks after
-        // the directory guards must still sample the current path and descriptor.
-        assertPath(resolvedStat);
-        if (!admitPathInsideRoot({
-            rootPath: params.root.rootReal,
-            candidatePath: realPath,
-            rootIdentity: params.root.rootIdentity,
-        })) {
-            throw outsideWorkspaceError();
-        }
-        await assertAsyncDirectoryGuard(params.parentGuard);
-        await assertRootIdentityCurrent(params.root);
-        // Recheck after canonical resolution and directory checks, including late links.
-        assertPath(fsSync.lstatSync(params.targetPath, { bigint: true }));
-        assertDescriptor();
-        if (needsPathOpen) {
-            // A retained fd cannot prove that an opaque Windows pathname still names it.
-            // Reopen only for publication verification: the writer's exact identity is
-            // independent proof unavailable to ordinary readers. Never read any bytes.
-            assertNoUnsafeDeviceReadPath(params.targetPath);
-            const opened = await fs.open(params.targetPath, resolveReadOpenFlags()).catch((error) => {
-                if (isSymlinkOpenError(error)) {
-                    throw new FsSafeError("symlink", "symlink open blocked", { cause: error });
-                }
-                if (hasNodeErrorCode(error, "EISDIR")) {
-                    throw new FsSafeError("not-file", "not a file");
-                }
-                throw error;
-            });
-            try {
-                const reopenedStat = assertDescriptor(opened.fd);
+        let opened;
+        try {
+            while (true) {
+                // The original descriptor remains borrowed; only a verification reopen is owned here.
+                const fd = opened?.fd ?? params.fd;
+                const stat = assertDescriptor(fd);
                 assertPath(fsSync.lstatSync(params.targetPath, { bigint: true }));
-                const { realPath: reopenedPath, stat: reopenedPathStat } = await resolveOpenedFileRealPathForFd(opened.fd, reopenedStat, params.targetPath);
-                assertPath(reopenedPathStat);
+                const { realPath, stat: resolvedStat } = await resolveOpenedFileRealPathForFd(fd, stat, params.targetPath);
+                // Consume the resolver's observation only in this pass; the checks after
+                // the directory guards must still sample the current path and descriptor.
+                assertPath(resolvedStat);
                 if (!admitPathInsideRoot({
                     rootPath: params.root.rootReal,
-                    candidatePath: reopenedPath,
+                    candidatePath: realPath,
                     rootIdentity: params.root.rootIdentity,
                 })) {
                     throw outsideWorkspaceError();
                 }
                 await assertAsyncDirectoryGuard(params.parentGuard);
                 await assertRootIdentityCurrent(params.root);
+                // Recheck after canonical resolution and directory checks, including late links.
                 assertPath(fsSync.lstatSync(params.targetPath, { bigint: true }));
-                assertDescriptor(opened.fd);
+                assertDescriptor(fd);
+                if (opened || !needsPathOpen)
+                    break;
+                // Opaque Windows pathname identity needs one independent, read-free reopen.
+                assertNoUnsafeDeviceReadPath(params.targetPath);
+                opened = await fs.open(params.targetPath, resolveReadOpenFlags()).catch((error) => {
+                    if (isSymlinkOpenError(error)) {
+                        throw new FsSafeError("symlink", "symlink open blocked", { cause: error });
+                    }
+                    if (hasNodeErrorCode(error, "EISDIR"))
+                        throw new FsSafeError("not-file", "not a file");
+                    throw error;
+                });
             }
-            finally {
+        }
+        finally {
+            if (opened)
                 await opened.close().catch(() => undefined);
-            }
         }
     }
     catch (error) {

package/node_modules/@openclaw/fs-safe/dist/root.d.ts

@@ -1,7 +1,2 @@
-export { DEFAULT_ROOT_MAX_BYTES, openLocalFileSafely, readLocalFileSafely, resolveOpenedFileRealPathForHandle, root, type DenyMutationPolicy, type HardlinkPolicy, type MutationSymlinkPolicy, type RenameIdentityPolicy, type OpenResult, type ReadResult, type Root, type RootAppendOptions, type RootCopyOptions, type RootCopySource, type RootCreateJsonOptions, type RootCreateOptions, type RootCreateStreamOptions, type RootDefaults, type RootMkdirOptions, type RootMoveOptions, type RootOpenOptions, type RootOpenWritableOptions, type RootOptions, type RootReadOptions, type RootRemoveOptions, type RootWriteJsonOptions, type RootWriteOptions, type SymlinkPolicy, type WritableOpenMode, type WritableOpenResult, } from "./root-impl.js";
-export type { RootCopyPublicationReceipt } from "./copy-publication.js";
-export type { CopyCloneMode } from "./copy-policy.js";
-export type { RootEntriesOptions } from "./root-entries.js";
-export type { ContainmentGuarantee } from "./containment.js";
-export type { RootWalkDataEntry, RootWalkDataEntryKind, RootWalkDirectoryErrorBehavior, RootWalkEntry, RootWalkEntryFilter, RootWalkEntryFilterResult, RootWalkEntryKind, RootWalkLimitBehavior, RootWalkOptions, RootWalkSymlinkPolicy, } from "./root-walk.js";
-//# sourceMappingURL=root.d.ts.map
+export { DEFAULT_ROOT_MAX_BYTES, openLocalFileSafely, readLocalFileSafely, resolveOpenedFileRealPathForHandle, root, type Root, } from "./root-impl.js";
+export type * from "./root-public-types.js";

package/node_modules/@openclaw/fs-safe/dist/safe-path-segment.d.ts

@@ -7,6 +7,6 @@ export declare function assertNoDriveRelativePathSegments(value: string, label:
 export declare function trimHyphenEdges(value: string): string;
 export declare function isSafePathSegment(segment: string, options?: SafePathSegmentOptions): boolean;
 export declare function assertSafePathSegment(segment: string, options?: SafePathSegmentOptions): string;
-export declare function sanitizeSafePathSegment(value: string, fallback: string, options?: SafePathSegmentOptions): string;
+export declare function normalizeSafePathSegment(value: string): string;
+export declare function sanitizeSafePathSegment(value: string): string | undefined;
 export declare function assertSafePathPrefix(prefix: string, options?: SafePathSegmentOptions): string;
-//# sourceMappingURL=safe-path-segment.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/safe-path-segment.js

@@ -1,3 +1,4 @@
+import { isWindowsReservedDeviceName } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
 const SAFE_PATH_SEGMENT_PATTERN = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;
 const SAFE_DOT_PREFIX_PATH_SEGMENT_PATTERN = /^[A-Za-z0-9._-]+$/;
@@ -34,6 +35,8 @@ export function isSafePathSegment(segment, options = {}) {
         !segment.includes("/") &&
         !segment.includes("\\") &&
         !segment.includes("\0") &&
+        // Segments are portable identifiers: CON.json and CON.<pid>.tmp name devices on Windows.
+        !isWindowsReservedDeviceName(segment) &&
         (options.allowDotPrefix === true || !segment.startsWith(".")) &&
         (options.allowDotPrefix === true
             ? SAFE_DOT_PREFIX_PATH_SEGMENT_PATTERN.test(segment)
@@ -47,17 +50,17 @@ export function assertSafePathSegment(segment, options = {}) {
     }
     return segment;
 }
-export function sanitizeSafePathSegment(value, fallback, options = {}) {
+export function normalizeSafePathSegment(value) {
     const sanitized = value
         .trim()
         .replace(/[\\/]+/g, "-")
         .replace(/\0/g, "")
         .replace(/[^A-Za-z0-9._-]+/g, "-");
-    const trimmed = trimHyphenEdges(sanitized);
-    if (isSafePathSegment(trimmed, options)) {
-        return trimmed;
-    }
-    return assertSafePathSegment(fallback, { ...options, label: "fallback path segment" });
+    return trimHyphenEdges(sanitized);
+}
+export function sanitizeSafePathSegment(value) {
+    const trimmed = normalizeSafePathSegment(value);
+    return isSafePathSegment(trimmed, { allowDotPrefix: true }) ? trimmed : undefined;
 }
 export function assertSafePathPrefix(prefix, options = {}) {
     // Prefixes are often derived from safe filenames. Normalize harmless

package/node_modules/@openclaw/fs-safe/dist/secret-file.d.ts

@@ -13,7 +13,11 @@ type SecretFileWriteParams = {
     dirMode?: number;
     durable?: boolean;
 };
-export declare function prepareSecretFileWrite(params: Omit<SecretFileWriteParams, "content">): Promise<{
+type SecretFileCreateParams = Omit<SecretFileWriteParams, "durable"> & {
+    /** "file" requires file synchronization; directory synchronization remains best effort. */
+    durable?: boolean | "file";
+};
+export declare function prepareSecretFileWrite(params: Pick<SecretFileWriteParams, "rootDir" | "filePath" | "mode" | "dirMode">): Promise<{
     mode: number;
     rootGuard: AsyncDirectoryGuard<BigIntStats>;
     parentGuard: AsyncDirectoryGuard<BigIntStats>;
@@ -21,6 +25,5 @@ export declare function prepareSecretFileWrite(params: Omit<SecretFileWriteParam
     finalFilePath: string;
 }>;
 export declare function writeSecretFileAtomic(params: SecretFileWriteParams): Promise<void>;
-export declare function createSecretFileAtomic(params: SecretFileWriteParams): Promise<void>;
+export declare function createSecretFileAtomic(params: SecretFileCreateParams): Promise<void>;
 export {};
-//# sourceMappingURL=secret-file.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secret-file.js

@@ -5,44 +5,20 @@ import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
 import { canonicalPathFromExistingAncestor } from "./absolute-path.js";
 import { readFileDescriptorBoundedSync } from "./bounded-read.js";
 import { assertAsyncDirectoryGuard, createAsyncDirectoryGuard, inspectDirectoryIdentity } from "./directory-guard.js";
-import { pinNodeDirectoryForMode } from "./directory-mode-node.js";
-import { assertOwnedDirectory } from "./directory-mode-owner.js";
-import { assertNoUnsafeDeviceReadPath } from "./device-path.js";
+import { pinNodeDirectoryForMode, assertOwnedDirectory } from "./directory-mode-node.js";
 import { FsSafeError } from "./errors.js";
-import { resolveHomeRelativePath } from "./home-dir.js";
 import { openPinnedFileSync } from "./pinned-open.js";
 import { runPinnedWriteHelper } from "./pinned-write.js";
 import { ensureTrailingSep } from "./root-context.js";
 import { verifyAtomicWriteResult } from "./root-write-verification.js";
-import { assertSecretFilePreview, resolveSecretReadPolicy, secretPathErrorCode, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
+import { prepareSecretRead, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
 import { serializePathWrite } from "./write-queue.js";
 import { assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 export const PRIVATE_SECRET_DIR_MODE = 0o700;
 export const PRIVATE_SECRET_FILE_MODE = 0o600;
 export function readSecretFileSync(filePath, label, options = {}) {
-    const { resolvedPath, maxBytes } = resolveSecretReadPolicy(filePath, label, options);
-    let rejectSymlink;
-    let previewStat;
-    try {
-        assertNoUnsafeDeviceReadPath(resolvedPath);
-        rejectSymlink = Boolean(options.rejectSymlink);
-        previewStat = inspectFileIdentitySync(() => inspectInput(`${label} file at ${resolvedPath} must not be a symlink.`));
-    }
-    catch (error) {
-        throw secretReadError(error instanceof FsSafeError ? error.code : secretPathErrorCode(error), "inspect", label, resolvedPath, error);
-    }
-    function inspectInput(symlinkMessage) {
-        const stat = rejectSymlink
-            ? fs.lstatSync(resolvedPath, { bigint: true })
-            : fs.statSync(resolvedPath, { bigint: true });
-        if (rejectSymlink && stat.isSymbolicLink()) {
-            throw new FsSafeError("symlink", symlinkMessage);
-        }
-        return stat;
-    }
-    const rejectHardlinks = options.rejectHardlinks !== false;
-    assertSecretFilePreview(previewStat, label, resolvedPath, maxBytes, rejectHardlinks);
+    const { resolvedPath, maxBytes, rejectSymlink, rejectHardlinks, previewStat, inspectInput } = prepareSecretRead(filePath, label, options);
     const opened = openPinnedFileSync({
         filePath: resolvedPath,
         rejectPathSymlink: rejectSymlink,
@@ -53,29 +29,19 @@ export function readSecretFileSync(filePath, label, options = {}) {
     }
     let raw;
     try {
-        const openedIdentity = inspectFileIdentitySync(() => {
-            const stat = fs.fstatSync(opened.fd, { bigint: true });
-            if (!stat.isFile() || (rejectHardlinks && stat.nlink > 1n)) {
-                throw new FsSafeError("path-mismatch", "security validation failed");
-            }
-            return stat;
-        }, previewStat);
-        inspectFileIdentitySync(() => {
-            const stat = fs.lstatSync(opened.path, { bigint: true });
-            if (!stat.isFile() || (rejectHardlinks && stat.nlink > 1n)) {
-                throw new FsSafeError("path-mismatch", "security validation failed");
-            }
-            return stat;
-        }, openedIdentity);
+        // The pin already compared the descriptor and resolved name without yielding.
+        const openedIdentity = inspectFileIdentitySync(() => opened.identity, previewStat);
         inspectFileIdentitySync(() => inspectInput("secret path became a symlink"), openedIdentity);
         raw = readFileDescriptorBoundedSync(opened.fd, maxBytes).toString("utf8");
     }
     catch (error) {
+        try {
+            fs.closeSync(opened.fd);
+        }
+        catch { /* Preserve the read failure. */ }
         throw secretReadError(error instanceof FsSafeError ? error.code : "read-failed", "read", label, resolvedPath, error);
     }
-    finally {
-        fs.closeSync(opened.fd);
-    }
+    fs.closeSync(opened.fd);
     return trimSecretFileContent(raw, label, resolvedPath);
 }
 export function tryReadSecretFileSync(filePath, label, options = {}) {
@@ -232,7 +198,11 @@ async function ensurePrivateDirectory(rootDir, targetDir, mode) {
     }
     return { rootGuard, parentGuard: targetGuard };
 }
-function snapshotSecretFileWriteParams(params, rootDir, filePath) {
+function snapshotSecretFileWriteParams(params) {
+    const rootDir = params.rootDir;
+    const filePath = params.filePath;
+    assertNoWindowsPathAlias(rootDir, "filesystem", "private secret root uses a Windows filesystem namespace alias");
+    assertNoWindowsPathAlias(filePath, "filesystem", "private secret path uses a Windows filesystem namespace alias");
     return {
         rootDir,
         filePath,
@@ -313,7 +283,9 @@ async function materializeSecretFileAtomic(params, createOnly) {
         basename: fileName,
         mkdir: false,
         mode,
+        verifyPosixMode: true,
         sync: params.durable !== false,
+        strictFileSync: createOnly && params.durable === "file",
         overwrite: !createOnly,
         input: { kind: "buffer", data: typeof params.content === "string" ? params.content : Buffer.from(params.content) },
         rootIdentity: { dev: parentGuard.stat.dev, ino: parentGuard.stat.ino },
@@ -337,31 +309,23 @@ async function materializeSecretFileAtomic(params, createOnly) {
     });
 }
 export async function writeSecretFileAtomic(params) {
-    const rootDir = params.rootDir;
-    const filePath = params.filePath;
-    assertNoWindowsPathAlias(rootDir, "filesystem", "private secret root uses a Windows filesystem namespace alias");
-    assertNoWindowsPathAlias(filePath, "filesystem", "private secret path uses a Windows filesystem namespace alias");
-    const ownedParams = snapshotSecretFileWriteParams(params, rootDir, filePath);
-    const canonicalPath = await secretFileWriteQueueKey(filePath);
+    const ownedParams = snapshotSecretFileWriteParams(params);
+    const canonicalPath = await secretFileWriteQueueKey(ownedParams.filePath);
     await serializePathWrite(canonicalPath, async () => {
         await materializeSecretFileAtomic(ownedParams, false);
     });
 }
 export async function createSecretFileAtomic(params) {
     try {
-        const rootDir = params.rootDir;
-        const filePath = params.filePath;
-        assertNoWindowsPathAlias(rootDir, "filesystem", "private secret root uses a Windows filesystem namespace alias");
-        assertNoWindowsPathAlias(filePath, "filesystem", "private secret path uses a Windows filesystem namespace alias");
-        const ownedParams = snapshotSecretFileWriteParams(params, rootDir, filePath);
-        const canonicalPath = await secretFileWriteQueueKey(filePath);
+        const ownedParams = snapshotSecretFileWriteParams(params);
+        const canonicalPath = await secretFileWriteQueueKey(ownedParams.filePath);
         await serializePathWrite(canonicalPath, async () => {
             await materializeSecretFileAtomic(ownedParams, true);
         });
     }
     catch (error) {
         if ((error instanceof FsSafeError && error.code === "already-exists") ||
-            error.code === "EEXIST") {
+            error?.code === "EEXIST") {
             throw new FsSafeError("secret-exists", "Private secret file already exists.", { cause: error });
         }
         throw error;

package/node_modules/@openclaw/fs-safe/dist/secret-read-async.d.ts

@@ -1,4 +1,3 @@
 import { type SecretFileReadOptions } from "./secret-read-policy.js";
 export declare function readSecretFile(filePath: string, label: string, options?: SecretFileReadOptions): Promise<string>;
 export declare function tryReadSecretFile(filePath: string | undefined, label: string, options?: SecretFileReadOptions): Promise<string | undefined>;
-//# sourceMappingURL=secret-read-async.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/secret-read-async.js

@@ -5,32 +5,11 @@ import { assertNoUnsafeDeviceReadPath } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { realpathSync } from "./realpath.js";
-import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
-import { assertSecretFilePreview, resolveSecretReadPolicy, secretPathErrorCode, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { prepareSecretRead, secretPathErrorCode, secretReadError, trimSecretFileContent, } from "./secret-read-policy.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export async function readSecretFile(filePath, label, options = {}) {
-    const { resolvedPath, maxBytes } = resolveSecretReadPolicy(filePath, label, options);
-    let rejectSymlink;
-    let previewStat;
-    try {
-        assertNoUnsafeDeviceReadPath(resolvedPath);
-        rejectSymlink = Boolean(options.rejectSymlink);
-        previewStat = inspectFileIdentitySync(() => inspectInput(`${label} file at ${resolvedPath} must not be a symlink.`));
-    }
-    catch (error) {
-        throw secretReadError(error instanceof FsSafeError ? error.code : secretPathErrorCode(error), "inspect", label, resolvedPath, error);
-    }
-    function inspectInput(symlinkMessage) {
-        const stat = rejectSymlink
-            ? fsSync.lstatSync(resolvedPath, { bigint: true })
-            : fsSync.statSync(resolvedPath, { bigint: true });
-        if (rejectSymlink && stat.isSymbolicLink()) {
-            throw new FsSafeError("symlink", symlinkMessage);
-        }
-        return stat;
-    }
-    const rejectHardlinks = options.rejectHardlinks !== false;
-    assertSecretFilePreview(previewStat, label, resolvedPath, maxBytes, rejectHardlinks);
+    const { resolvedPath, maxBytes, rejectHardlinks, previewStat, inspectInput } = prepareSecretRead(filePath, label, options);
     let handle;
     let raw;
     try {
@@ -39,20 +18,20 @@ export async function readSecretFile(filePath, label, options = {}) {
         assertNoUnsafeDeviceReadPath(realPath);
         handle = await fs.open(realPath, resolveReadOpenFlags());
         const openedHandle = handle;
-        const openedStat = await inspectFileIdentity(async () => {
+        const openedStat = inspectFileIdentitySync(() => {
             const stat = fsSync.fstatSync(openedHandle.fd, { bigint: true });
             if (!stat.isFile() || (rejectHardlinks && stat.nlink > 1n)) {
                 throw new FsSafeError("path-mismatch", "security validation failed");
             }
             return stat;
         }, previewStat);
-        await inspectFileIdentity(async () => {
+        inspectFileIdentitySync(() => {
             const stat = fsSync.lstatSync(realPath, { bigint: true });
             if (!stat.isFile())
                 throw new FsSafeError("path-mismatch", "security validation failed");
             return stat;
         }, openedStat);
-        await inspectFileIdentity(() => inspectInput("secret path became a symlink"), openedStat);
+        inspectFileIdentitySync(() => inspectInput("secret path became a symlink"), openedStat);
         raw = (await readFileHandleBounded(handle, maxBytes)).toString("utf8");
     }
     catch (error) {

package/node_modules/@openclaw/fs-safe/dist/secret-read-policy.d.ts

@@ -1,4 +1,4 @@
-import type { BigIntStats } from "node:fs";
+import { type BigIntStats } from "node:fs";
 import { FsSafeError, type FsSafeErrorCode } from "./errors.js";
 export declare const DEFAULT_SECRET_FILE_MAX_BYTES: number;
 export type SecretFileReadOptions = {
@@ -10,8 +10,11 @@ export declare function secretPathErrorCode(error: unknown): FsSafeErrorCode;
 export declare function secretReadError(code: FsSafeErrorCode, action: "inspect" | "read", label: string, resolvedPath: string, error: unknown): FsSafeError;
 export declare function assertSecretFilePreview(stat: BigIntStats, label: string, resolvedPath: string, maxBytes: number, rejectHardlinks: boolean): void;
 export declare function trimSecretFileContent(raw: string, label: string, resolvedPath: string): string;
-export declare function resolveSecretReadPolicy(filePath: string, label: string, options: SecretFileReadOptions): {
+export declare function prepareSecretRead(filePath: string, label: string, options: SecretFileReadOptions): {
     resolvedPath: string;
     maxBytes: number;
+    rejectSymlink: boolean;
+    rejectHardlinks: boolean;
+    previewStat: BigIntStats;
+    inspectInput: (symlinkMessage: string) => BigIntStats;
 };
-//# sourceMappingURL=secret-read-policy.d.ts.map