@openclaw/openshell-sandbox 2026.9.5 → 2026.9.7

package/node_modules/@openclaw/fs-safe/dist/temp-target.js

@@ -4,8 +4,9 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { suffixWindowsReservedDeviceName } from "./filename.js";
 import { sameFileIdentityForCleanup } from "./file-identity.js";
-import { assertSafePathSegment, sanitizeSafePathSegment, trimHyphenEdges } from "./safe-path-segment.js";
+import { assertSafePathSegment, isSafePathSegment, normalizeSafePathSegment, trimHyphenEdges, } from "./safe-path-segment.js";
 import { resolveSecureTempRoot } from "./secure-temp-dir.js";
+import { hasNodeErrorCode } from "./path.js";
 import { registerTempPathForExit } from "./temp-cleanup.js";
 import { assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 const HYPHEN_CHAR_CODE = 0x2d;
@@ -59,10 +60,10 @@ function sanitizeExtension(extension) {
     return token ? `.${token}` : "";
 }
 export function sanitizeTempFileName(fileName) {
-    const sanitized = sanitizeSafePathSegment(path.basename(fileName), "download.bin", {
-        allowDotPrefix: true,
-    });
-    return suffixWindowsReservedDeviceName(sanitized);
+    // Suffix reserved stems before admission so CON.txt stays CON_.txt.
+    const suffixed = suffixWindowsReservedDeviceName(normalizeSafePathSegment(path.basename(fileName)));
+    // The suffix only inserts "_", so this value is already normalized.
+    return isSafePathSegment(suffixed, { allowDotPrefix: true }) ? suffixed : "download.bin";
 }
 export function buildRandomTempFilePath(params) {
     const rootDir = resolveTempRoot(params.rootDir);
@@ -79,31 +80,16 @@ export function buildRandomTempFilePath(params) {
     assertNoWindowsPathAlias(filePath, "filesystem", "temp file path uses a Windows filesystem namespace alias");
     return filePath;
 }
-function isNodeErrorWithCode(err, code) {
-    return (typeof err === "object" &&
-        err !== null &&
-        "code" in err &&
-        err.code === code);
-}
 async function cleanupTempDir(dir, identity, onCleanupError) {
     try {
-        let current;
-        try {
-            current = fsSync.lstatSync(dir, { bigint: true });
-        }
-        catch (error) {
-            if (isNodeErrorWithCode(error, "ENOENT")) {
-                return;
-            }
-            throw error;
-        }
+        const current = fsSync.lstatSync(dir, { bigint: true });
         if (!current || !sameFileIdentityForCleanup(current, identity)) {
             return;
         }
         await fs.rm(dir, { recursive: true, force: true });
     }
     catch (err) {
-        if (!isNodeErrorWithCode(err, "ENOENT")) {
+        if (!hasNodeErrorCode(err, "ENOENT")) {
             onCleanupError?.(err);
         }
     }
@@ -131,7 +117,7 @@ export async function createOwnedTempFile(params) {
     const prefix = `${sanitizePrefix(params.prefix)}-`;
     if (cleanupSafety === "require-bounded") {
         const initialFileName = sanitizeTempFileName(params.fileName ?? "download.bin");
-        const [{ TempWorkspaceCleanupCapability, TempWorkspaceCleanupOwner }, { admitExistingTempWorkspaceRoot }, { TempWorkspaceRetainedChild }, { validateInitialTempWorkspaceChild, admitRetainedTempWorkspaceChild }, { inspectDirectoryIdentitySync },] = await Promise.all([
+        const [{ TempWorkspaceCleanupCapability, TempWorkspaceCleanupOwner, throwTempWorkspaceCreationFailure }, { admitExistingTempWorkspaceRoot }, { TempWorkspaceRetainedChild }, { validateInitialTempWorkspaceChild }, { inspectDirectoryIdentitySync },] = await Promise.all([
             import("./temp-workspace-owner.js"),
             import("./temp-workspace-admission.js"),
             import("./temp-workspace-descriptor.js"),
@@ -159,9 +145,9 @@ export async function createOwnedTempFile(params) {
             identity = Object.freeze({ dev: initial.dev, ino: initial.ino });
             const needsModeInitialization = validateInitialTempWorkspaceChild(initial, admission.ownerUid, 0o700);
             retainedChild = TempWorkspaceRetainedChild.retain(dir, identity);
-            const modeInitialization = admitRetainedTempWorkspaceChild(retainedChild, needsModeInitialization, admission, 0o700);
-            if (modeInitialization)
-                await modeInitialization;
+            if (needsModeInitialization) {
+                await retainedChild.initializeMode(0o700, admission.ownerUid, admission.assertCurrent);
+            }
             const retainDescriptor = capability.admitChildDescriptor(retainedChild.ensureReadable());
             capability.assertAncestryCurrent();
             retainedChild.finalizeAdmission(admission.ownerUid, 0o700);
@@ -172,34 +158,7 @@ export async function createOwnedTempFile(params) {
             });
         }
         catch (error) {
-            try {
-                if (cleanupOwner)
-                    cleanupOwner.cleanupSync();
-                else {
-                    const closeErrors = [];
-                    try {
-                        retainedChild?.close();
-                    }
-                    catch (closeError) {
-                        closeErrors.push(closeError);
-                    }
-                    try {
-                        capability.close();
-                    }
-                    catch (closeError) {
-                        closeErrors.push(closeError);
-                    }
-                    if (closeErrors.length === 1)
-                        throw closeErrors[0];
-                    if (closeErrors.length > 1) {
-                        throw new AggregateError(closeErrors, "temp file admission descriptor close failed");
-                    }
-                }
-            }
-            catch (cleanupError) {
-                throw new AggregateError([error, cleanupError], "temp file creation and cleanup both failed");
-            }
-            throw error;
+            return throwTempWorkspaceCreationFailure(error, retainedChild, capability, cleanupOwner, "temp file");
         }
         const owner = cleanupOwner;
         const file = (fileName) => {
@@ -213,7 +172,7 @@ export async function createOwnedTempFile(params) {
                     await owner.cleanup();
                 }
                 catch (err) {
-                    if (!isNodeErrorWithCode(err, "ENOENT")) {
+                    if (!hasNodeErrorCode(err, "ENOENT")) {
                         params.onCleanupError?.(err);
                     }
                 }

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-admission.d.ts

@@ -1,12 +1,6 @@
-type ExactIdentity = Readonly<{
-    dev: bigint;
-    ino: bigint;
-}>;
 export type TempWorkspaceRootAdmission = {
     dir: string;
-    identity: ExactIdentity;
     ownerUid: number | undefined;
-    realPath: string;
     retainCleanupParent(descriptorFd: number): void;
     prepareCleanupProbe(descriptorFd: number): void;
     prepareChildCreation(descriptorFd?: number): void;
@@ -18,5 +12,3 @@ export type TempWorkspaceRootAdmission = {
 export declare function admitExistingTempWorkspaceRoot(rootDir: string): TempWorkspaceRootAdmission;
 export declare function admitTempWorkspaceRoot(rootDir: string): Promise<TempWorkspaceRootAdmission>;
 export declare function admitTempWorkspaceRootSync(rootDir: string): TempWorkspaceRootAdmission;
-export {};
-//# sourceMappingURL=temp-workspace-admission.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-admission.js

@@ -2,14 +2,11 @@ import fsSync, {} from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { inspectDirectoryIdentitySync, observeDirectoryIdentitySync, } from "./directory-guard.js";
-import { admitTempWorkspaceChild, admitTempWorkspaceChildSync, } from "./temp-workspace-child-admission.js";
+import { admitTempWorkspaceChild, admitTempWorkspaceChildSync, assertTrustedTempWorkspaceDirectory, inspectTempWorkspaceDescriptorIdentitySync, projectTempWorkspaceNumericIdentity, TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY, } from "./temp-workspace-child-admission.js";
 import { FsSafeError } from "./errors.js";
-import { recordFileObservationFailure } from "./file-observation.js";
 import { realpathSync } from "./realpath.js";
 import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
-import { inspectFileIdentitySync } from "./strict-file-identity.js";
-import { inspectTempWorkspaceDescriptorIdentitySync, projectTempWorkspaceNumericIdentity, TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY, } from "./temp-workspace-identity.js";
-import { assertTrustedTempWorkspaceDirectory } from "./temp-workspace-permissions.js";
+import { fileIdentityMismatchError, inspectFileIdentitySync } from "./strict-file-identity.js";
 const WINDOWS = process.platform === "win32";
 function effectiveOwner() {
     // Windows mode/uid fields do not describe ACL authority. The supplied root's
@@ -39,20 +36,21 @@ function copyExactDirectoryObservation(stat) {
         dev: stat.dev,
         ino: stat.ino,
         uid: stat.uid,
+        gid: stat.gid,
         mode: stat.mode,
         directory: stat.isDirectory(),
         symbolicLink: stat.isSymbolicLink(),
     });
 }
-function snapshotFromExactObservation(dir, uid, realPath, stat) {
+function snapshotFromExactObservation(dir, uid, realPath, stat, privateDirectory = false) {
     if (stat.symbolicLink || !stat.directory) {
         throw new FsSafeError("not-file", "temp workspace root component must be a real directory");
     }
-    assertTrustedTempWorkspaceDirectory(stat, uid);
+    assertTrustedTempWorkspaceDirectory(stat, uid, privateDirectory);
     const identity = Object.freeze({ dev: stat.dev, ino: stat.ino });
     // Retain copied immutable scalars, never a mutable Stats object supplied by
     // an observation hook. Every later permission check uses a fresh snapshot.
-    return Object.freeze({ dir, identity, numericIdentity: safeNumericIdentity(stat), realPath });
+    return Object.freeze({ dir, identity, numericIdentity: safeNumericIdentity(stat), realPath, privateDirectory });
 }
 function canonicalTempWorkspacePath(dir) {
     assertNoWindowsPathAlias(dir, "filesystem");
@@ -60,10 +58,10 @@ function canonicalTempWorkspacePath(dir) {
     assertNoWindowsPathAlias(canonical, "filesystem");
     return canonical;
 }
-function snapshot(dir, uid, realPath = canonicalTempWorkspacePath(dir)) {
+function snapshot(dir, uid, realPath = canonicalTempWorkspacePath(dir), privateDirectory = false) {
     const stat = inspectDirectoryIdentitySync(dir);
     const observation = copyExactDirectoryObservation(stat);
-    return { entry: snapshotFromExactObservation(dir, uid, realPath, observation), stat };
+    return { entry: snapshotFromExactObservation(dir, uid, realPath, observation, privateDirectory), stat };
 }
 function hasCompleteExactIdentity(stat) {
     return typeof stat.dev === "bigint" && typeof stat.ino === "bigint" &&
@@ -74,11 +72,6 @@ function assertCanonicalRoot(entry) {
         throw new FsSafeError("path-mismatch", "temp workspace root ancestry changed");
     }
 }
-function identityMismatch() {
-    const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
-    recordFileObservationFailure(error, "identity");
-    throw error;
-}
 function inspectSnapshotIdentity(entry) {
     const expected = entry.numericIdentity;
     if (!expected) {
@@ -89,21 +82,21 @@ function inspectSnapshotIdentity(entry) {
     const devKnown = Number.isSafeInteger(stat.dev) && stat.dev >= 0 && (!WINDOWS || stat.dev !== 0);
     if (devKnown) {
         if (stat.dev !== expected.dev)
-            identityMismatch();
+            throw fileIdentityMismatchError();
     }
     else if (WINDOWS)
         requiresExactRetry = true;
     else
-        identityMismatch();
+        throw fileIdentityMismatchError();
     const inoKnown = Number.isSafeInteger(stat.ino) && stat.ino >= 0 && (!WINDOWS || stat.ino !== 0);
     if (inoKnown) {
         if (stat.ino !== expected.ino)
-            identityMismatch();
+            throw fileIdentityMismatchError();
     }
     else if (WINDOWS)
         requiresExactRetry = true;
     else
-        identityMismatch();
+        throw fileIdentityMismatchError();
     if (!requiresExactRetry)
         return stat;
     // Read exact identity only once. The strict helper may re-check this constant
@@ -113,13 +106,37 @@ function inspectSnapshotIdentity(entry) {
 }
 function assertSnapshot(entry, uid) {
     const stat = inspectSnapshotIdentity(entry);
-    assertTrustedTempWorkspaceDirectory(stat, uid);
+    assertTrustedTempWorkspaceDirectory(stat, uid, entry.privateDirectory);
     assertCanonicalRoot(entry);
 }
+function snapshotMissingRootComponent(parent, dir, ownerUid, privateDirectory) {
+    if (parent.dir !== parent.realPath) {
+        assertSnapshot(parent, ownerUid);
+        return snapshot(dir, ownerUid, undefined, privateDirectory);
+    }
+    const current = inspectSnapshotIdentity(parent);
+    assertTrustedTempWorkspaceDirectory(current, ownerUid, parent.privateDirectory);
+    let realPath;
+    try {
+        realPath = canonicalTempWorkspacePath(dir);
+    }
+    catch (error) {
+        // Keep parent resolution failures ahead of a missing or unreadable child.
+        assertCanonicalRoot(parent);
+        throw error;
+    }
+    if (path.dirname(realPath) !== parent.realPath) {
+        assertCanonicalRoot(parent);
+        return snapshot(dir, ownerUid, undefined, privateDirectory);
+    }
+    // The child's canonical parent confirms the same parent name at this phase.
+    // Its exact non-symlink/owner observation still precedes mode initialization.
+    return snapshot(dir, ownerUid, realPath, privateDirectory);
+}
 function assertChain(chain, uid) {
     for (const entry of chain) {
         const current = inspectSnapshotIdentity(entry);
-        assertTrustedTempWorkspaceDirectory(current, uid);
+        assertTrustedTempWorkspaceDirectory(current, uid, entry.privateDirectory);
     }
     const last = chain[chain.length - 1];
     assertCanonicalRoot(last);
@@ -135,14 +152,14 @@ function canonicalAncestry(root) {
 }
 function exactIdentityMatches(current, expected) {
     if (current.dev !== expected.dev || current.ino !== expected.ino)
-        identityMismatch();
+        throw fileIdentityMismatchError();
 }
 function associateTempWorkspaceRoot(entry, ownerUid, descriptorFd) {
     const stat = inspectTempWorkspaceDescriptorIdentitySync(descriptorFd, entry.identity, entry.numericIdentity);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
         throw new FsSafeError("not-file", "temp workspace cleanup parent must be a real directory");
     }
-    assertTrustedTempWorkspaceDirectory(stat, ownerUid);
+    assertTrustedTempWorkspaceDirectory(stat, ownerUid, entry.privateDirectory);
 }
 function discoverMissingTempWorkspaceAncestor(ancestor, missing, missingError) {
     // The caller already classified the first ENOENT. Keep this handoff out of
@@ -203,14 +220,14 @@ function rootPlan(rootDir) {
     const existingCanonicalRoot = missing.length === 0 && observedAncestor === ancestor &&
         !initial.symbolicLink && initial.directory && hasCompleteExactIdentity(initial);
     if (existingCanonicalRoot) {
-        const discovery = snapshotFromExactObservation(ancestor, ownerUid, ancestor, initial);
+        const discovery = snapshotFromExactObservation(ancestor, ownerUid, ancestor, initial, true);
         return {
             admission: canonicalRootAdmission(discovery, ownerUid),
             missing,
             ownerUid,
         };
     }
-    const chain = canonicalAncestry(ancestor).map((dir) => snapshot(dir, ownerUid, dir).entry);
+    const chain = canonicalAncestry(ancestor).map((dir) => snapshot(dir, ownerUid, dir, missing.length === 0 && dir === ancestor).entry);
     // Missing-component creation needs a replay before its first mutation. When
     // the complete root already exists through an alias, retain the historical
     // guarded route because discovery and mutation use different path spellings.
@@ -223,9 +240,7 @@ function rootAdmission(chain, ownerUid) {
     const current = chain[chain.length - 1];
     return {
         dir: current.dir,
-        identity: current.identity,
         ownerUid,
-        realPath: current.realPath,
         retainCleanupParent: (descriptorFd) => {
             assertSnapshot(current, ownerUid);
             associateTempWorkspaceRoot(current, ownerUid, descriptorFd);
@@ -256,9 +271,7 @@ function canonicalRootAdmission(discovery, ownerUid) {
     };
     return {
         dir: discovery.dir,
-        identity: discovery.identity,
         ownerUid,
-        realPath: discovery.realPath,
         // Merely opening the cleanup-parent descriptor grants no authority. The
         // exact association is completed only at a bounded probe or the mutation
         // boundary below.
@@ -274,10 +287,10 @@ function canonicalRootAdmission(discovery, ownerUid) {
             const ancestry = canonicalAncestry(discovery.dir);
             const candidate = ancestry.map((dir, index) => {
                 if (!TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY || index !== ancestry.length - 1) {
-                    return snapshot(dir, ownerUid, dir).entry;
+                    return snapshot(dir, ownerUid, dir, index === ancestry.length - 1 && discovery.privateDirectory).entry;
                 }
                 const current = inspectSnapshotIdentity(discovery);
-                assertTrustedTempWorkspaceDirectory(current, ownerUid);
+                assertTrustedTempWorkspaceDirectory(current, ownerUid, discovery.privateDirectory);
                 return discovery;
             });
             const current = candidate[candidate.length - 1];
@@ -320,7 +333,8 @@ export async function admitTempWorkspaceRoot(rootDir) {
     if (admission)
         return admission;
     const guardedChain = chain;
-    for (const segment of missing) {
+    for (const [index, segment] of missing.entries()) {
+        const parentEntry = guardedChain[guardedChain.length - 1];
         const parent = rootAdmission(guardedChain, ownerUid);
         const dir = path.join(parent.dir, segment);
         assertNoWindowsPathAlias(dir, "filesystem");
@@ -334,8 +348,7 @@ export async function admitTempWorkspaceRoot(rootDir) {
             if (error.code !== "EEXIST")
                 throw error;
         }
-        parent.assertCurrent();
-        const observed = snapshot(dir, ownerUid);
+        const observed = snapshotMissingRootComponent(parentEntry, dir, ownerUid, index === missing.length - 1);
         if (created) {
             const modeInitialization = admitTempWorkspaceChild(dir, observed.stat, parent, 0o700);
             if (modeInitialization)
@@ -350,7 +363,8 @@ export function admitTempWorkspaceRootSync(rootDir) {
     if (admission)
         return admission;
     const guardedChain = chain;
-    for (const segment of missing) {
+    for (const [index, segment] of missing.entries()) {
+        const parentEntry = guardedChain[guardedChain.length - 1];
         const parent = rootAdmission(guardedChain, ownerUid);
         const dir = path.join(parent.dir, segment);
         assertNoWindowsPathAlias(dir, "filesystem");
@@ -364,8 +378,7 @@ export function admitTempWorkspaceRootSync(rootDir) {
             if (error.code !== "EEXIST")
                 throw error;
         }
-        parent.assertCurrent();
-        const observed = snapshot(dir, ownerUid);
+        const observed = snapshotMissingRootComponent(parentEntry, dir, ownerUid, index === missing.length - 1);
         if (created)
             admitTempWorkspaceChildSync(dir, observed.stat, parent, 0o700);
         guardedChain.push(observed.entry);

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-child-admission.d.ts

@@ -1,13 +1,23 @@
-import type { BigIntStats, Stats } from "node:fs";
+import { type BigIntStats, type Stats } from "node:fs";
 import type { TempWorkspaceRootAdmission } from "./temp-workspace-admission.js";
-import type { TempWorkspaceRetainedChild } from "./temp-workspace-descriptor.js";
-import { type TempWorkspaceIdentityStat } from "./temp-workspace-identity.js";
+export type TempWorkspaceIdentity = Readonly<{
+    dev: bigint;
+    ino: bigint;
+}>;
+export type TempWorkspaceNumericIdentity = Readonly<{
+    dev: number;
+    ino: number;
+}>;
+export type TempWorkspaceIdentityStat = BigIntStats | Stats;
+export declare const TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY: boolean;
+export declare function projectTempWorkspaceNumericIdentity(identity: TempWorkspaceIdentity): TempWorkspaceNumericIdentity | undefined;
+export declare function inspectTempWorkspaceDescriptorIdentitySync(fd: number, expected: TempWorkspaceIdentity, numeric: TempWorkspaceNumericIdentity | undefined): TempWorkspaceIdentityStat;
+export declare function inspectTempWorkspaceDirectoryIdentitySync(dir: string, expected: TempWorkspaceIdentity, numeric: TempWorkspaceNumericIdentity | undefined): TempWorkspaceIdentityStat;
+export declare function validateTempWorkspaceDirMode(mode: number): void;
+export declare function assertTrustedTempWorkspaceDirectory(stat: Pick<BigIntStats, "uid" | "gid" | "mode"> | Pick<Stats, "uid" | "gid" | "mode">, uid: number | undefined, privateDirectory?: boolean): void;
 export declare function assertTempWorkspaceChildState(stat: BigIntStats | Stats, ownerUid: number | undefined): void;
 export declare function validateInitialTempWorkspaceChild(stat: BigIntStats, ownerUid: number | undefined, mode: number): boolean;
 export declare function childHasRequestedMode(stat: BigIntStats | Stats, mode: number): boolean;
 export declare function admitTempWorkspaceChild(dir: string, expected: BigIntStats, parent: TempWorkspaceRootAdmission, mode: number): Promise<void> | undefined;
 export declare function admitTempWorkspaceChildSync(dir: string, expected: BigIntStats, parent: TempWorkspaceRootAdmission, mode: number): void;
-export declare function admitRetainedTempWorkspaceChild(retained: TempWorkspaceRetainedChild, needsModeInitialization: boolean, parent: TempWorkspaceRootAdmission, mode: number): Promise<void> | undefined;
-export declare function admitRetainedTempWorkspaceChildSync(retained: TempWorkspaceRetainedChild, needsModeInitialization: boolean, parent: TempWorkspaceRootAdmission, mode: number): void;
 export declare function validateAdmittedTempWorkspaceChild(current: TempWorkspaceIdentityStat, ownerUid: number | undefined, mode: number): TempWorkspaceIdentityStat;
-//# sourceMappingURL=temp-workspace-child-admission.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-child-admission.js

@@ -1,8 +1,75 @@
-import { inspectDirectoryIdentitySync } from "./directory-guard.js";
+import fsSync, {} from "node:fs";
+import { inspectDirectoryIdentitySync, observeDirectoryIdentitySync } from "./directory-guard.js";
 import { pinNodeDirectoryForMode, pinNodeDirectoryForModeSync } from "./directory-mode-node.js";
 import { FsSafeError } from "./errors.js";
-import { TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY, } from "./temp-workspace-identity.js";
-import { assertTrustedTempWorkspaceDirectory } from "./temp-workspace-permissions.js";
+import { fileIdentityMismatchError, inspectFileIdentitySync } from "./strict-file-identity.js";
+import { classifyTempWorkspaceOwner, warnUnmappedTempWorkspaceAncestor } from "./temp-workspace-ownership.js";
+export const TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY = process.platform === "linux" || process.platform === "darwin";
+export function projectTempWorkspaceNumericIdentity(identity) {
+    const dev = Number(identity.dev);
+    const ino = Number(identity.ino);
+    if (!Number.isSafeInteger(dev) || dev < 0 || BigInt(dev) !== identity.dev ||
+        !Number.isSafeInteger(ino) || ino < 0 || BigInt(ino) !== identity.ino) {
+        return undefined;
+    }
+    return Object.freeze({ dev, ino });
+}
+function inspectNumericIdentity(current, expected) {
+    if (!Number.isSafeInteger(current.dev) || current.dev < 0 || current.dev !== expected.dev ||
+        !Number.isSafeInteger(current.ino) || current.ino < 0 || current.ino !== expected.ino) {
+        throw fileIdentityMismatchError();
+    }
+    return current;
+}
+export function inspectTempWorkspaceDescriptorIdentitySync(fd, expected, numeric) {
+    // A malformed or mismatched numeric observation is definite and never
+    // retried. Unsafe receipts and other platforms retain exact replay.
+    if (TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY && numeric) {
+        return inspectNumericIdentity(fsSync.fstatSync(fd), numeric);
+    }
+    return inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }), expected);
+}
+export function inspectTempWorkspaceDirectoryIdentitySync(dir, expected, numeric) {
+    if (TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY && numeric) {
+        return inspectNumericIdentity(observeDirectoryIdentitySync(dir), numeric);
+    }
+    return inspectFileIdentitySync(() => observeDirectoryIdentitySync(dir, { bigint: true }), expected);
+}
+export function validateTempWorkspaceDirMode(mode) {
+    if (!Number.isInteger(mode) || mode < 0 || mode > 0o7777) {
+        throw new FsSafeError("insecure-permissions", "temp workspace dirMode must be permission bits");
+    }
+    if (process.platform !== "win32" && (mode & 0o022) !== 0) {
+        throw new FsSafeError("insecure-permissions", "temp workspace must not be group/world writable");
+    }
+}
+export function assertTrustedTempWorkspaceDirectory(stat, uid, privateDirectory = false) {
+    if (uid === undefined)
+        return;
+    const ownership = classifyTempWorkspaceOwner(stat, uid);
+    if (ownership === "foreign" || (privateDirectory && ownership !== "user")) {
+        throw new FsSafeError("not-owned", "temp workspace directory has an untrusted owner; use a private temp root owned by the effective user under a trusted directory hierarchy");
+    }
+    // Unmapped host owners are unverifiable; trust the host directory hierarchy.
+    // Admit sticky ancestors so PrivateUsers keeps host /tmp and PrivateTmp usable.
+    // Leaf roots stay euid-owned/private; non-sticky writable ancestors are rejected.
+    const writable = typeof stat.mode === "bigint"
+        ? (stat.mode & 18n) !== 0n
+        : Number.isSafeInteger(stat.mode) && stat.mode >= 0 && (stat.mode & 0o022) !== 0;
+    const sticky = typeof stat.mode === "bigint"
+        ? (stat.mode & 512n) !== 0n
+        : Number.isSafeInteger(stat.mode) && stat.mode >= 0 && (stat.mode & 0o1000) !== 0;
+    if (typeof stat.mode !== "bigint" && (!Number.isSafeInteger(stat.mode) || stat.mode < 0)) {
+        throw new FsSafeError("insecure-permissions", "temp workspace directory permissions are invalid");
+    }
+    if (writable && (privateDirectory || !sticky)) {
+        throw new FsSafeError("insecure-permissions", privateDirectory
+            ? "temp workspace root and child must not be group/world writable; use a private temp directory"
+            : "temp workspace ancestor is group/world writable without sticky protection");
+    }
+    if (ownership === "unmapped")
+        warnUnmappedTempWorkspaceAncestor();
+}
 const WINDOWS = process.platform === "win32";
 export function assertTempWorkspaceChildState(stat, ownerUid) {
     const exactIdentity = typeof stat.dev === "bigint" && typeof stat.ino === "bigint" &&
@@ -74,18 +141,6 @@ export function admitTempWorkspaceChildSync(dir, expected, parent, mode) {
         owner.close();
     }
 }
-export function admitRetainedTempWorkspaceChild(retained, needsModeInitialization, parent, mode) {
-    if (!needsModeInitialization)
-        return undefined;
-    return retained.initializeMode(mode, parent.ownerUid, parent.assertCurrent);
-}
-export function admitRetainedTempWorkspaceChildSync(retained, needsModeInitialization, parent, mode) {
-    if (!needsModeInitialization) {
-        retained.discardInitialReceipt();
-        return;
-    }
-    retained.initializeModeSync(mode, parent.ownerUid, parent.assertCurrent);
-}
 export function validateAdmittedTempWorkspaceChild(current, ownerUid, mode) {
     assertTempWorkspaceChildState(current, ownerUid);
     if (!childHasRequestedMode(current, mode)) {

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-descriptor.d.ts

@@ -1,18 +1,13 @@
 import fsSync from "node:fs";
 import type { FileIdentityStat } from "./file-identity.js";
 import type { TempWorkspaceRootAdmission } from "./temp-workspace-admission.js";
-import { type TempWorkspaceIdentityStat } from "./temp-workspace-identity.js";
+import { type TempWorkspaceIdentityStat } from "./temp-workspace-child-admission.js";
 type DirectoryDescriptorAccess = "read" | "search";
 export type RetainedDirectory = {
     fd: number;
     access: DirectoryDescriptorAccess;
     receipt: Readonly<{
         path: string;
-        realPath: string;
-        identity: Readonly<{
-            dev: bigint;
-            ino: bigint;
-        }>;
     }>;
 };
 export type RetainedChildDirectory = {
@@ -45,4 +40,3 @@ export declare class TempWorkspaceRetainedChild {
     close(): void;
 }
 export {};
-//# sourceMappingURL=temp-workspace-descriptor.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-descriptor.js

@@ -1,12 +1,10 @@
 import fsSync from "node:fs";
 import fs from "node:fs/promises";
-import { nodeDirectorySearchOnlyFlags } from "./directory-mode-node.js";
-import { assertOwnedDirectory } from "./directory-mode-owner.js";
+import { nodeDirectorySearchOnlyFlags, assertOwnedDirectory } from "./directory-mode-node.js";
 import { FsSafeError } from "./errors.js";
 import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
-import { assertTempWorkspaceChildState, childHasRequestedMode, validateAdmittedTempWorkspaceChild, } from "./temp-workspace-child-admission.js";
-import { inspectTempWorkspaceDescriptorIdentitySync, inspectTempWorkspaceDirectoryIdentitySync, projectTempWorkspaceNumericIdentity, TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY, } from "./temp-workspace-identity.js";
+import { assertTempWorkspaceChildState, childHasRequestedMode, validateAdmittedTempWorkspaceChild, inspectTempWorkspaceDescriptorIdentitySync, inspectTempWorkspaceDirectoryIdentitySync, projectTempWorkspaceNumericIdentity, TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY, } from "./temp-workspace-child-admission.js";
 function assertRetainedChildDirectory(stat) {
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
         throw new FsSafeError("not-file", "temp workspace child must be a real directory");
@@ -80,8 +78,6 @@ export function openTempWorkspaceCleanupParent(root, admission) {
             access: opened.access,
             receipt: Object.freeze({
                 path: pathname,
-                realPath: admission.realPath,
-                identity: admission.identity,
             }),
         };
     }
@@ -185,18 +181,15 @@ export class TempWorkspaceRetainedChild {
         return descriptor;
     }
     async #assertProcAuthority(fd, ownerUid) {
-        if ((await fs.statfs("/proc/self/fd", { bigint: true })).type !== 0x9fa0n) {
-            throw new FsSafeError("path-mismatch", "directory mode requires a trusted procfs fd namespace");
-        }
-        const procPath = `/proc/self/fd/${fd}`;
-        const opened = inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }), this.#identity);
-        const followed = inspectFileIdentitySync(() => fsSync.statSync(procPath, { bigint: true }), this.#identity);
-        assertOwnedDirectory(opened, followed);
-        assertTempWorkspaceChildState(opened, ownerUid);
-        assertTempWorkspaceChildState(followed, ownerUid);
+        const filesystem = await fs.statfs("/proc/self/fd", { bigint: true });
+        this.#assertProcDescriptorAuthority(fd, ownerUid, filesystem.type);
     }
     #assertProcAuthoritySync(fd, ownerUid) {
-        if (fsSync.statfsSync("/proc/self/fd", { bigint: true }).type !== 0x9fa0n) {
+        const filesystem = fsSync.statfsSync("/proc/self/fd", { bigint: true });
+        this.#assertProcDescriptorAuthority(fd, ownerUid, filesystem.type);
+    }
+    #assertProcDescriptorAuthority(fd, ownerUid, filesystemType) {
+        if (filesystemType !== 0x9fa0n) {
             throw new FsSafeError("path-mismatch", "directory mode requires a trusted procfs fd namespace");
         }
         const procPath = `/proc/self/fd/${fd}`;
@@ -309,13 +302,7 @@ export class TempWorkspaceRetainedChild {
         catch (error) {
             // The readable replacement has not been installed. Give it exactly one
             // close attempt and leave neither indeterminate descriptor owned here.
-            try {
-                fsSync.closeSync(fd);
-            }
-            catch (closeError) {
-                throw new AggregateError([error, closeError], "temp workspace child descriptor replacement close failed");
-            }
-            throw error;
+            closeAfterAdmissionFailure(fd, error, "temp workspace child descriptor replacement close failed");
         }
         this.#fd = fd;
         this.#access = "read";
@@ -334,16 +321,7 @@ export class TempWorkspaceRetainedChild {
         const fd = this.#fd;
         this.#fd = undefined;
         if (retainDescriptor && !this.canEnumerate) {
-            try {
-                fsSync.closeSync(fd);
-            }
-            catch (closeError) {
-                throw new AggregateError([
-                    new FsSafeError("helper-unavailable", "temp workspace cleanup requires a readable child descriptor"),
-                    closeError,
-                ], "temp workspace child descriptor rejection and close failed");
-            }
-            throw new FsSafeError("helper-unavailable", "temp workspace cleanup requires a readable child descriptor");
+            closeAfterAdmissionFailure(fd, new FsSafeError("helper-unavailable", "temp workspace cleanup requires a readable child descriptor"), "temp workspace child descriptor rejection and close failed");
         }
         if (!retainDescriptor) {
             fsSync.closeSync(fd);

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-owner.d.ts

@@ -15,10 +15,10 @@ export declare class TempWorkspaceCleanupCapability {
     assertAncestryCurrent(): void;
     close(): void;
 }
+export declare function throwTempWorkspaceCreationFailure(error: unknown, retainedChild: TempWorkspaceRetainedChild | undefined, capability: TempWorkspaceCleanupCapability, owner?: TempWorkspaceCleanupOwner, label?: string): never;
 export declare class TempWorkspaceCleanupOwner {
     #private;
     constructor(retained: TempWorkspaceRetainedChild, capability: TempWorkspaceCleanupCapability, retainDescriptor: boolean);
     cleanup(): Promise<TempWorkspaceCleanupResult>;
     cleanupSync(): TempWorkspaceCleanupResult;
 }
-//# sourceMappingURL=temp-workspace-owner.d.ts.map