@openclaw/openshell-sandbox 2026.9.5 → 2026.9.7

package/node_modules/@openclaw/fs-safe/dist/staged-directory.d.ts

@@ -1,13 +1,16 @@
-import { type BigIntStats } from "node:fs";
+import { type BigIntStats, type Stats } from "node:fs";
 import type { DirectoryReceipt } from "./directory-durability.js";
 import type { FileIdentityStat } from "./file-identity.js";
-import { type MutationDirectoryObservation } from "./pinned-mutation-observation.js";
+import type { NativeBinding } from "./native-binding.js";
+import { type MutationDirectoryObservation, type MutationDirectoryObserver } from "./pinned-mutation-observation.js";
 import type { StagedFileReceipt } from "./staged-file-types.js";
 export type StagedDirectorySnapshot = StagedFileReceipt["directory"];
 export type PolicyStagedDirectory = Readonly<{
     directory: StagedDirectorySnapshot;
     observation: MutationDirectoryObservation;
     stat: BigIntStats;
+    observeCurrent?: MutationDirectoryObserver;
+    disposeObservation?(): void;
 }>;
 export declare function exactIdentityMatches(expected: FileIdentityStat, actual: Readonly<{
     dev: bigint;
@@ -15,11 +18,10 @@ export declare function exactIdentityMatches(expected: FileIdentityStat, actual:
 }>): boolean;
 export declare function describeStagedDirectory(fd: number, pathname: string): StagedDirectorySnapshot;
 export declare function assertStagedDirectoryCurrent(receipt: StagedDirectorySnapshot): BigIntStats;
-export declare function describePolicyStagedDirectory(fd: number, pathname: string): PolicyStagedDirectory;
+export declare function describePolicyStagedDirectory(fd: number, pathname: string, binding?: NativeBinding): PolicyStagedDirectory;
 export declare function assertPolicyStagedDirectoryCurrent(captured: PolicyStagedDirectory): BigIntStats;
 export declare function refreshPolicyStagedDirectoryObservation(captured: PolicyStagedDirectory): MutationDirectoryObservation;
-export declare function openStagedDirectory(directory: string | DirectoryReceipt): {
+export declare function openStagedDirectory(directory: string | DirectoryReceipt<Stats | BigIntStats>): {
     fd: number;
     receipt: StagedDirectorySnapshot;
 };
-//# sourceMappingURL=staged-directory.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/staged-directory.js

@@ -1,7 +1,9 @@
 import fs, {} from "node:fs";
 import path from "node:path";
+import { directoryReceiptAuthority, ownDirectoryReceipt } from "./directory-receipt.js";
 import { FsSafeError } from "./errors.js";
 import { inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { nativePolicyDirectoryObserver, NativePolicyDirectoryMismatch } from "./native-policy-directory-observation.js";
 import { checkedMutationDirectory, } from "./pinned-mutation-observation.js";
 import { realpathSync } from "./realpath.js";
 import { resolvePathPreservingWindowsRoot } from "./windows-path-alias.js";
@@ -38,12 +40,31 @@ function sameDirectoryMetadata(left, right) {
 }
 // The policy hot path is Node/POSIX-only. It deliberately uses native
 // canonicalization so a successful capture contains no JS realpath work.
-export function describePolicyStagedDirectory(fd, pathname) {
+export function describePolicyStagedDirectory(fd, pathname, binding) {
     const resolved = path.resolve(pathname);
     const descriptor = fs.fstatSync(fd, { bigint: true });
     if (!descriptor.isDirectory()) {
         throw new FsSafeError("not-file", "staging parent must be a directory");
     }
+    const observeCurrent = nativePolicyDirectoryObserver(binding, fd, resolved);
+    const observed = observeCurrent?.();
+    if (observed) {
+        if (!sameDirectoryMetadata(descriptor, observed.identity)) {
+            throw new NativePolicyDirectoryMismatch();
+        }
+        const directory = Object.freeze({
+            path: resolved,
+            realPath: observed.canonicalPath,
+            identity: Object.freeze({ dev: descriptor.dev, ino: descriptor.ino }),
+        });
+        return Object.freeze({
+            directory,
+            observation: checkedMutationDirectory(resolved, observed.canonicalPath, observed.identity, observeCurrent),
+            stat: descriptor,
+            observeCurrent,
+            disposeObservation: observeCurrent.dispose,
+        });
+    }
     const before = inspectDirectoryIdentitySync(resolved);
     const canonicalPath = path.resolve(realpathSync.native(resolved));
     const after = inspectDirectoryIdentitySync(resolved, descriptor);
@@ -64,6 +85,14 @@ export function describePolicyStagedDirectory(fd, pathname) {
     });
 }
 export function assertPolicyStagedDirectoryCurrent(captured) {
+    const observed = captured.observeCurrent?.();
+    if (observed) {
+        if (!sameDirectoryMetadata(captured.stat, observed.identity) ||
+            observed.canonicalPath !== captured.directory.realPath) {
+            throw new FsSafeError("path-mismatch", "staging directory pathname changed");
+        }
+        return captured.stat;
+    }
     const current = inspectDirectoryIdentitySync(captured.directory.path, captured.directory.identity);
     if (!sameDirectoryMetadata(captured.stat, current) ||
         path.resolve(realpathSync.native(captured.directory.path)) !== captured.directory.realPath) {
@@ -72,6 +101,14 @@ export function assertPolicyStagedDirectoryCurrent(captured) {
     return current;
 }
 export function refreshPolicyStagedDirectoryObservation(captured) {
+    const observed = captured.observeCurrent?.();
+    if (observed) {
+        if (!exactIdentityMatches(captured.directory.identity, observed.identity) ||
+            observed.canonicalPath !== captured.directory.realPath) {
+            throw new FsSafeError("path-mismatch", "staging directory pathname changed");
+        }
+        return checkedMutationDirectory(captured.directory.path, observed.canonicalPath, observed.identity, captured.observeCurrent);
+    }
     const current = inspectDirectoryIdentitySync(captured.directory.path, captured.directory.identity);
     const canonicalPath = path.resolve(realpathSync.native(captured.directory.path));
     if (canonicalPath !== captured.directory.realPath) {
@@ -80,16 +117,15 @@ export function refreshPolicyStagedDirectoryObservation(captured) {
     return checkedMutationDirectory(captured.directory.path, canonicalPath, current);
 }
 export function openStagedDirectory(directory) {
-    // Copy supplied facts before any asynchronous work; receipts are not authority.
-    const pathname = resolvePathPreservingWindowsRoot(typeof directory === "string" ? directory : directory.path);
-    const expected = typeof directory === "string" ? undefined : {
-        realPath: directory.realPath, dev: directory.identity.dev, ino: directory.identity.ino,
-    };
+    const expected = typeof directory === "string"
+        ? undefined
+        : directoryReceiptAuthority(ownDirectoryReceipt(directory));
+    const pathname = resolvePathPreservingWindowsRoot(typeof directory === "string" ? directory : expected.path);
     const before = fs.lstatSync(pathname, { bigint: true });
     if (!before.isDirectory()) {
         throw new FsSafeError("not-file", "staging parent must be a real directory");
     }
-    if (expected && (!exactIdentityMatches(expected, before) || realpathSync(pathname) !== expected.realPath)) {
+    if (expected && (!exactIdentityMatches(expected.identity, before) || realpathSync(pathname) !== expected.realPath)) {
         throw new FsSafeError("path-mismatch", "stale staging directory receipt");
     }
     const fd = fs.openSync(pathname, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);

package/node_modules/@openclaw/fs-safe/dist/staged-file-settlement.d.ts

@@ -0,0 +1,16 @@
+import type { BigIntStats } from "node:fs";
+import { FsSafeError } from "./errors.js";
+import type { StagedFileCleanupReceipt, StagedFileFailureDetails, StagedFilePublication, StagedFileReceipt } from "./staged-file-types.js";
+export declare function createStagedFileReceipt(directory: StagedFileReceipt["directory"], temporaryBasename: string, stat: BigIntStats): StagedFileReceipt;
+export declare function stagedFileFailure(error: unknown, details: StagedFileFailureDetails): FsSafeError;
+/** Finish owned cleanup and every close before surfacing publication evidence. */
+export declare function settleStagedFile(params: {
+    temporaryBasename: string;
+    publication: StagedFilePublication;
+    phase: StagedFileFailureDetails["phase"];
+    failure?: {
+        error: unknown;
+    };
+    cleanup: () => Promise<StagedFileCleanupReceipt["status"]>;
+    close: readonly (() => Promise<void> | void)[];
+}): Promise<void>;

package/node_modules/@openclaw/fs-safe/dist/staged-file-settlement.js

@@ -0,0 +1,57 @@
+import { FsSafeError } from "./errors.js";
+export function createStagedFileReceipt(directory, temporaryBasename, stat) {
+    return Object.freeze({
+        directory,
+        temporaryBasename,
+        identity: Object.freeze({
+            dev: stat.dev, ino: stat.ino, mode: Number(stat.mode & 4095n),
+            nlink: stat.nlink, size: stat.size, uid: Number(stat.uid), gid: Number(stat.gid),
+            mtimeNs: stat.mtimeNs, ctimeNs: stat.ctimeNs,
+        }),
+    });
+}
+export function stagedFileFailure(error, details) {
+    const code = error instanceof FsSafeError
+        ? error.code
+        : error?.code === "EEXIST" ? "already-exists" : "helper-failed";
+    return new FsSafeError(code, `staged file ${details.phase} failed`, { cause: error, details });
+}
+/** Finish owned cleanup and every close before surfacing publication evidence. */
+export async function settleStagedFile(params) {
+    const errors = params.failure ? [params.failure.error] : [];
+    let status;
+    try {
+        status = await params.cleanup();
+    }
+    catch (error) {
+        status = "failed";
+        errors.push(error);
+    }
+    let resources = "closed";
+    for (const close of params.close) {
+        try {
+            await close();
+        }
+        catch (error) {
+            resources = "close-failed";
+            errors.push(error);
+        }
+    }
+    const incomplete = status === "failed" || status === "preserved" || resources === "close-failed";
+    // A settled pre-publication failure retains the producer/authority rejection exactly.
+    if (!incomplete && (!params.failure || params.publication.status === "not-published"))
+        return;
+    const error = errors.length > 1 ? new AggregateError(errors, "staged operation and settlement failed")
+        : errors.length === 1 ? errors[0] : new FsSafeError("not-removable", "staged cleanup preserved an unverified entry");
+    const cleanup = Object.freeze({
+        temporaryBasename: params.temporaryBasename,
+        publication: params.publication,
+        status,
+        resources,
+    });
+    throw stagedFileFailure(error, {
+        phase: params.failure ? params.phase : "cleanup",
+        publication: params.publication,
+        cleanup,
+    });
+}

package/node_modules/@openclaw/fs-safe/dist/staged-file-types.d.ts

@@ -53,4 +53,3 @@ export interface StagedFile extends AsyncDisposable {
     }): Promise<PublishedFileReceipt>;
     cleanup(): Promise<StagedFileCleanupReceipt>;
 }
-//# sourceMappingURL=staged-file-types.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/staged-symlink-types.d.ts

@@ -0,0 +1,39 @@
+import type { PublishedFileReceipt, StagedFileCleanupReceipt, StagedFileReceipt } from "./staged-file-types.js";
+/** Caller-captured admission evidence, never a same-target ownership heuristic. */
+export type StagedSymlinkExpected = Readonly<Pick<StagedFileReceipt["identity"], "dev" | "ino" | "uid" | "gid" | "ctimeNs"> & {
+    target: string;
+}>;
+export type StagedSymlinkReceipt = StagedFileReceipt & Readonly<{
+    target: string;
+}>;
+export type PublishedSymlinkReceipt = Readonly<Pick<PublishedFileReceipt, "status" | "basename"> & {
+    staged: StagedSymlinkReceipt;
+    overwrite: false;
+}>;
+export type StagedSymlinkPublication = Readonly<{
+    status: "not-published";
+}> | PublishedSymlinkReceipt | Readonly<{
+    status: "indeterminate";
+    basename: string;
+    overwrite: false;
+}>;
+export type StagedSymlinkRemoval = "removed" | "name-absent" | "preserved";
+export type StagedSymlinkCleanupReceipt = Readonly<Pick<StagedFileCleanupReceipt, "temporaryBasename" | "status" | "resources"> & {
+    publication: StagedSymlinkPublication;
+}>;
+export type StagedSymlinkFailureDetails = Readonly<{
+    phase: "prepare" | "publish" | "remove-published" | "cleanup";
+    publication: StagedSymlinkPublication;
+    cleanup?: StagedSymlinkCleanupReceipt;
+}>;
+export interface StagedSymlink extends AsyncDisposable {
+    readonly receipt: StagedSymlinkReceipt;
+    assertCurrent(): Promise<void>;
+    publish(basename: string): Promise<PublishedSymlinkReceipt>;
+    /** Check the published name against the still-retained original symlink. */
+    assertPublished(): Promise<void>;
+    /** Explicit recovery only. Never removes an observed foreign replacement. */
+    removePublished(): Promise<StagedSymlinkRemoval>;
+    /** Closes the owner; only an unattempted, still-owned stage is removed. */
+    cleanup(): Promise<StagedSymlinkCleanupReceipt>;
+}

package/node_modules/@openclaw/fs-safe/dist/staged-symlink-types.js

@@ -0,0 +1 @@
+export {};

package/node_modules/@openclaw/fs-safe/dist/stat-observation.d.ts

@@ -8,4 +8,3 @@ export type StatObservationReceipt = {
 export declare function inspectStatObservationSync(inspect: (bigint: boolean) => Stats | BigIntStats, expected?: ExactStatIdentity, initial?: Stats | BigIntStats, platform?: NodeJS.Platform): StatObservationReceipt;
 /** Revalidate an exact identity without allocating a receipt that the caller will discard. */
 export declare function assertStatObservationSync(inspect: (bigint: boolean) => Stats | BigIntStats, expected: ExactStatIdentity, initial?: Stats | BigIntStats, platform?: NodeJS.Platform): Stats | BigIntStats;
-//# sourceMappingURL=stat-observation.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/stat-observation.js

@@ -1,11 +1,4 @@
-import { FsSafeError } from "./errors.js";
-import { recordFileObservationFailure } from "./file-observation.js";
-import { inspectFileIdentitySync } from "./strict-file-identity.js";
-function identityMismatch() {
-    const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
-    recordFileObservationFailure(error, "identity");
-    throw error;
-}
+import { fileIdentityMismatchError, inspectFileIdentitySync } from "./strict-file-identity.js";
 function safeNumber(value) {
     return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
@@ -35,7 +28,7 @@ function observeStatSync(inspect, expected, initial, platform = process.platform
     const ino = numericIno ? BigInt(rawIno) : typeof rawIno === "bigint" ? rawIno : undefined;
     if (expected && ((dev !== undefined && dev !== expected.dev) ||
         (ino !== undefined && ino !== expected.ino)))
-        identityMismatch();
+        throw fileIdentityMismatchError();
     if (numericDev && numericIno) {
         return (captureIdentity
             ? { stat, identity: expected ?? { dev: dev, ino: ino } }
@@ -47,7 +40,7 @@ function observeStatSync(inspect, expected, initial, platform = process.platform
         const current = inspect(true);
         if ((dev !== undefined && current.dev !== dev) ||
             (ino !== undefined && current.ino !== ino))
-            identityMismatch();
+            throw fileIdentityMismatchError();
         return current;
     }, expected, platform);
     return (captureIdentity

package/node_modules/@openclaw/fs-safe/dist/store.d.ts

@@ -1,4 +1,3 @@
 export { fileStore, fileStoreSync, type FileStore, type FileStoreOptions, type FileStorePruneOptions, type FileStoreReadOptions, type FileStoreSync, type FileStoreWriteOptions, } from "./file-store.js";
 export { jsonStore, type JsonStore, type JsonFileStoreOptions, type JsonStoreLockOptions, type JsonStoreOptions, } from "./json-store.js";
 export { ackJsonDurableQueueEntry, ensureJsonDurableQueueDirs, jsonDurableQueueEntryExists, loadJsonDurableQueueEntry, loadPendingJsonDurableQueueEntries, moveJsonDurableQueueEntryToFailed, readJsonDurableQueueEntry, resolveJsonDurableQueueEntryPaths, unlinkBestEffort, writeJsonDurableQueueEntry, type JsonDurableQueueEntryPaths, type JsonDurableQueueLoadOptions, type JsonDurableQueueReadResult, } from "./json-durable-queue.js";
-//# sourceMappingURL=store.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/strict-file-identity.d.ts

@@ -1,6 +1,7 @@
 import type { BigIntStats } from "node:fs";
+import { FsSafeError } from "./errors.js";
 type ExactFileIdentity = Pick<BigIntStats, "dev" | "ino">;
+export declare function fileIdentityMismatchError(): FsSafeError;
 export declare function inspectFileIdentity<T extends ExactFileIdentity>(inspect: () => T | Promise<T>, expected?: ExactFileIdentity, platform?: NodeJS.Platform): Promise<T>;
-export declare function inspectFileIdentitySync<T extends ExactFileIdentity>(inspect: () => T, expected?: ExactFileIdentity, platform?: NodeJS.Platform): T;
+export declare function inspectFileIdentitySync<T extends ExactFileIdentity>(inspect: () => T, expected?: ExactFileIdentity, platform?: NodeJS.Platform, mismatch?: () => Error): T;
 export {};
-//# sourceMappingURL=strict-file-identity.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/strict-file-identity.js

@@ -1,6 +1,6 @@
 import { FsSafeError } from "./errors.js";
 import { recordFileObservationFailure } from "./file-observation.js";
-function identityMismatch() {
+export function fileIdentityMismatchError() {
     const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
     recordFileObservationFailure(error, "identity");
     return error;
@@ -13,20 +13,20 @@ function identityCheck(expected, platform) {
             const value = stat[field];
             // Numeric receipts cannot recover identity bits already lost to rounding.
             if (typeof value !== "bigint")
-                throw identityMismatch();
+                throw fileIdentityMismatchError();
             if (platform === "win32" && value === 0n) {
                 complete = false;
             }
             else {
                 if (known[field] !== undefined && known[field] !== value)
-                    throw identityMismatch();
+                    throw fileIdentityMismatchError();
                 known[field] = value;
             }
         }
         return complete;
     };
     if (expected && !check(expected))
-        throw identityMismatch();
+        throw fileIdentityMismatchError();
     return check;
 }
 // Retry only unknown Windows identities, retaining every known component so a
@@ -38,21 +38,21 @@ export async function inspectFileIdentity(inspect, expected, platform = process.
         if (check(stat))
             return stat;
     }
-    throw identityMismatch();
+    throw fileIdentityMismatchError();
 }
-export function inspectFileIdentitySync(inspect, expected, platform = process.platform) {
+export function inspectFileIdentitySync(inspect, expected, platform = process.platform, mismatch = fileIdentityMismatchError) {
     let knownDev;
     let knownIno;
     if (expected) {
         knownDev = expected.dev;
         if (typeof knownDev !== "bigint")
-            throw identityMismatch();
+            throw mismatch();
         knownIno = expected.ino;
         if (typeof knownIno !== "bigint")
-            throw identityMismatch();
+            throw mismatch();
         // An unknown expected device must not bypass observation of its inode.
         if (platform === "win32" && (knownDev === 0n || knownIno === 0n))
-            throw identityMismatch();
+            throw mismatch();
     }
     for (let attempt = 0; attempt < 2; attempt++) {
         const stat = inspect();
@@ -61,28 +61,28 @@ export function inspectFileIdentitySync(inspect, expected, platform = process.pl
         // a checker closure, known-component object, or field array per inspection.
         const dev = stat.dev;
         if (typeof dev !== "bigint")
-            throw identityMismatch();
+            throw mismatch();
         if (platform === "win32" && dev === 0n) {
             complete = false;
         }
         else {
             if (knownDev !== undefined && knownDev !== dev)
-                throw identityMismatch();
+                throw mismatch();
             knownDev = dev;
         }
         const ino = stat.ino;
         if (typeof ino !== "bigint")
-            throw identityMismatch();
+            throw mismatch();
         if (platform === "win32" && ino === 0n) {
             complete = false;
         }
         else {
             if (knownIno !== undefined && knownIno !== ino)
-                throw identityMismatch();
+                throw mismatch();
             knownIno = ino;
         }
         if (complete)
             return stat;
     }
-    throw identityMismatch();
+    throw mismatch();
 }

package/node_modules/@openclaw/fs-safe/dist/string-coerce.d.ts

@@ -2,4 +2,3 @@ export declare function normalizeNullableString(value: unknown): string | null;
 export declare function normalizeOptionalString(value: unknown): string | undefined;
 export declare function normalizeOptionalLowercaseString(value: unknown): string | undefined;
 export declare function normalizeLowercaseStringOrEmpty(value: unknown): string;
-//# sourceMappingURL=string-coerce.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/suppressed-error.d.ts

@@ -3,4 +3,3 @@ export type SuppressedErrorLike = Error & {
     suppressed: unknown;
 };
 export declare function createSuppressedError(error: unknown, suppressed: unknown, message: string): SuppressedErrorLike;
-//# sourceMappingURL=suppressed-error.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/symlink-parents.d.ts

@@ -9,4 +9,3 @@ export type AssertNoSymlinkParentsOptions = {
 };
 export declare function assertNoSymlinkParents(params: AssertNoSymlinkParentsOptions): Promise<void>;
 export declare function assertNoSymlinkParentsSync(params: AssertNoSymlinkParentsOptions): void;
-//# sourceMappingURL=symlink-parents.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/symlink-parents.js

@@ -3,68 +3,86 @@ import path from "node:path";
 import { FsSafeError } from "./errors.js";
 import { hasNodeErrorCode, isPathRelativeEscape } from "./path.js";
 import { assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
+function outsideRootError(params, root) {
+    return new Error(`${params.messagePrefix ?? "Path"} must stay under ${root}.`);
+}
+function pathSegments(value) {
+    return value.split(process.platform === "win32" ? /[/\\]+/ : /\/+/)
+        .filter((segment) => segment.length > 0 && segment !== ".");
+}
+function rawTargetSegments(root, targetPath) {
+    // Resolve only the drive/root or cwd, never the caller's dotdot segments.
+    const targetRoot = path.parse(targetPath).root;
+    const base = resolvePathPreservingWindowsRoot(targetRoot || ".");
+    const absoluteTarget = `${base}${path.sep}${targetPath.slice(targetRoot.length)}`;
+    const rootSegments = pathSegments(root);
+    const targetSegments = pathSegments(absoluteTarget);
+    const fold = (segment) => process.platform === "win32" ? segment.toLowerCase() : segment;
+    if (rootSegments.some((segment, index) => fold(segment) !== fold(targetSegments[index] ?? ""))) {
+        return undefined;
+    }
+    return targetSegments.slice(rootSegments.length);
+}
 function resolvePathWalk(params) {
     const rawRootDir = params.rootDir;
     assertNoWindowsPathAlias(rawRootDir, "filesystem", "root dir uses a Windows filesystem namespace alias");
     const rawTargetPath = params.targetPath;
     assertNoWindowsPathAlias(rawTargetPath, "filesystem", "target path uses a Windows filesystem namespace alias");
     const root = resolvePathPreservingWindowsRoot(rawRootDir);
-    const target = resolvePathPreservingWindowsRoot(rawTargetPath);
-    const relative = path.relative(root, target);
+    const lexicalTarget = resolvePathPreservingWindowsRoot(rawTargetPath);
+    const relative = path.relative(root, lexicalTarget);
     if (isPathRelativeEscape(relative)) {
         if (params.allowOutsideRoot) {
             return null;
         }
-        throw new Error(`${params.messagePrefix ?? "Path"} must stay under ${root}.`);
+        throw outsideRootError(params, root);
     }
-    return {
-        root,
-        segments: relative && relative !== "." ? relative.split(path.sep).filter(Boolean) : [],
-    };
+    const segments = rawTargetSegments(root, rawTargetPath);
+    // A spelling outside the root must not fall back to a normalized walk that
+    // could erase a symlink before the filesystem receives the original path.
+    if (!segments)
+        throw outsideRootError(params, root);
+    return { root, segments };
 }
 function formatUnsafePath(params, current) {
     return `${params.messagePrefix ?? "Path"} must not traverse symlinked directory: ${current}`;
 }
 export async function assertNoSymlinkParents(params) {
+    assertNoSymlinkParentsSync(params);
+}
+function isFilesystemRoot(root) {
+    return root === path.parse(root).root;
+}
+export function assertNoSymlinkParentsSync(params) {
     const walk = resolvePathWalk(params);
     if (!walk) {
         return;
     }
     let current = walk.root;
+    // `..` may only undo a real directory this walk already lstat'd.
+    const walked = [];
     for (const [index, segment] of walk.segments.entries()) {
-        current = path.join(current, segment);
-        try {
-            const stat = fsSync.lstatSync(current);
-            if (stat.isSymbolicLink()) {
-                if (params.allowRootChildSymlink && path.dirname(current) === walk.root) {
-                    continue;
-                }
-                throw new Error(formatUnsafePath(params, current));
+        if (segment === "..") {
+            const top = walked[walked.length - 1];
+            if (top?.kind === "dir") {
+                walked.pop();
+                current = walked[walked.length - 1]?.path ?? walk.root;
+                continue;
             }
-            if ((params.requireDirectories || index < walk.segments.length - 1) && !stat.isDirectory()) {
-                throw new FsSafeError("not-file", `${params.messagePrefix ?? "Path"} must traverse directories: ${current}`);
+            if (top?.kind === "symlink") {
+                throw new Error(formatUnsafePath(params, top.path));
             }
-        }
-        catch (err) {
-            if (hasNodeErrorCode(err, "ENOENT") && params.allowMissing !== false) {
-                return;
+            if (!isFilesystemRoot(walk.root)) {
+                throw outsideRootError(params, walk.root);
             }
-            throw err;
+            continue;
         }
-    }
-}
-export function assertNoSymlinkParentsSync(params) {
-    const walk = resolvePathWalk(params);
-    if (!walk) {
-        return;
-    }
-    let current = walk.root;
-    for (const [index, segment] of walk.segments.entries()) {
         current = path.join(current, segment);
         try {
             const stat = fsSync.lstatSync(current);
             if (stat.isSymbolicLink()) {
                 if (params.allowRootChildSymlink && path.dirname(current) === walk.root) {
+                    walked.push({ path: current, kind: "symlink" });
                     continue;
                 }
                 throw new Error(formatUnsafePath(params, current));
@@ -72,9 +90,17 @@ export function assertNoSymlinkParentsSync(params) {
             if ((params.requireDirectories || index < walk.segments.length - 1) && !stat.isDirectory()) {
                 throw new FsSafeError("not-file", `${params.messagePrefix ?? "Path"} must traverse directories: ${current}`);
             }
+            if (stat.isDirectory()) {
+                walked.push({ path: current, kind: "dir" });
+            }
         }
         catch (err) {
-            if (err.code === "ENOENT" && params.allowMissing !== false) {
+            if (hasNodeErrorCode(err, "ENOENT") && params.allowMissing !== false) {
+                // Win32 can cancel a nonexistent component before filesystem lookup.
+                // Returning early would leave later, reachable symlinks unchecked.
+                if (process.platform === "win32" && walk.segments.slice(index + 1).includes("..")) {
+                    throw new FsSafeError("invalid-path", `${params.messagePrefix ?? "Path"} must not cancel a missing directory: ${current}`);
+                }
                 return;
             }
             throw err;

package/node_modules/@openclaw/fs-safe/dist/temp-cleanup.d.ts

@@ -11,4 +11,3 @@ export declare function registerTempPathForExit(tempPath: string, options?: {
 }): TempPathRegistration;
 export declare function __cleanupRegisteredTempPathsForTest(): void;
 export declare function __cleanupRegisteredTempPathForTest(tempPath: string): void;
-//# sourceMappingURL=temp-cleanup.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/temp-target.d.ts

@@ -29,4 +29,3 @@ export declare function createOwnedTempFile(params: TempFileOptions): Promise<{
 export declare function tempFile(params: TempFileOptions): Promise<TempFile>;
 export declare function withTempFile<T>(params: TempFileOptions, fn: (tmpPath: string) => Promise<T>): Promise<T>;
 export {};
-//# sourceMappingURL=temp-target.d.ts.map