@openclaw/openshell-sandbox 2026.9.6 → 2026.9.7

package/node_modules/@openclaw/fs-safe/dist/archive.js

@@ -1,4 +1,4 @@
-import { createTarEntryPlanner, createArchiveEntrySelector, resolveArchiveFilteredEntryPolicy, createArchiveEntryPlanner, } from "./archive-plan.js";
+import { createTarEntryPlanner, createArchiveEntrySelector, resolveArchiveFilteredEntryPolicy, resolveArchiveEntryMode, createArchiveEntryPlanner, } from "./archive-plan.js";
 import { inspectTar, replayTar } from "./archive-tar-stream.js";
 import { runPinnedWriteHelper } from "./pinned-write.js";
 import { constants as fsConstants } from "node:fs";
@@ -11,9 +11,7 @@ import { assertArchiveEntryCountWithinLimit, createByteBudgetTracker, createExtr
 import { resolveArchiveKind } from "./archive-kind.js";
 import { prepareArchiveDestinationGuard, preparePrivateArchiveOutputPath, } from "./archive-staging.js";
 import { withStagedArchivePublication } from "./archive-merge.js";
-import { loadZipArchiveWithPreflight } from "./archive-zip-preflight.js";
-import { admittedZipEntries } from "./archive-zip-loader.js";
-import { zipEntryKind, zipEntryDeclaredSize, zipEntryMode, } from "./archive-zip-entry.js";
+import { loadZipArchiveWithAdmission } from "./archive-zip-preflight.js";
 import { createZipIntegrityTransform, normalizeZipIntegrityError, } from "./archive-zip-integrity.js";
 import { ArchiveSecurityError, ArchiveFormatError, isArchiveFormatErrorMessage, } from "./archive-errors.js";
 import { stageArchiveFileForExtraction } from "./archive-input.js";
@@ -29,10 +27,12 @@ export { resolveArchiveKind, resolvePackedRootDir } from "./archive-kind.js";
 export { readArchiveEntry } from "./archive-read.js";
 export { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError, DEFAULT_MAX_ARCHIVE_BYTES_ZIP, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_EXTRACTED_BYTES, DEFAULT_MAX_ENTRY_BYTES, DEFAULT_MAX_META_ENTRY_BYTES, DEFAULT_MAX_ENTRY_PATH_COMPONENTS, } from "./archive-limits.js";
 export { ArchiveFormatError } from "./archive-errors.js";
-export { ArchiveSecurityError } from "./archive-staging.js";
-export { createArchiveSymlinkTraversalError, mergeExtractedTreeIntoDestination, prepareArchiveDestinationDir, prepareArchiveOutputPath, withStagedArchiveDestination, } from "./archive-staging.js";
+export { ArchiveSecurityError } from "./archive-errors.js";
+export { createArchiveSymlinkTraversalError, prepareArchiveDestinationDir, prepareArchiveOutputPath, withStagedArchiveDestination, } from "./archive-staging.js";
+export { mergeExtractedTreeIntoDestination } from "./archive-merge.js";
 export { createTarEntryPreflightChecker } from "./archive-plan.js";
-export { loadZipArchiveWithPreflight, readZipCentralDirectoryEntryCount, } from "./archive-zip-preflight.js";
+export { loadZipArchiveWithPreflight } from "./archive-zip-preflight.js";
+export { readZipCentralDirectoryEntryCount } from "./archive-zip-count.js";
 const SUPPORTS_NOFOLLOW = process.platform !== "win32" && "O_NOFOLLOW" in fsConstants;
 const OPEN_WRITE_CREATE_FLAGS = fsConstants.O_WRONLY |
     fsConstants.O_CREAT |
@@ -49,7 +49,7 @@ async function readZipEntryStream(entry) {
 async function writeZipFileEntry(params) {
     params.deadline.check();
     params.budget.startEntry();
-    const readable = await readZipEntryStream(params.entry);
+    const readable = await readZipEntryStream(params.record.entry);
     const destinationPath = params.outPath;
     let tempHandle = null;
     let handleClosedByStream = false;
@@ -67,7 +67,7 @@ async function writeZipFileEntry(params) {
                     handleClosedByStream = true;
                 });
                 try {
-                    await pipeline(readable, createExtractBudgetTransform({ onChunkBytes: params.budget.addBytes }), createZipIntegrityTransform(params.entry), writable, { signal: params.deadline.signal });
+                    await pipeline(readable, createExtractBudgetTransform({ onChunkBytes: params.budget.addBytes }), createZipIntegrityTransform(params.record), writable, { signal: params.deadline.signal });
                 }
                 catch (err) {
                     throw normalizeZipIntegrityError(createPipelineTimeoutError(err, params.deadline));
@@ -101,26 +101,29 @@ async function extractZip(params) {
     deadline.check();
     const buffer = await fs.readFile(params.archivePath, { signal: deadline.signal });
     deadline.check();
-    const zip = await waitForDeadline(loadZipArchiveWithPreflight(buffer, limits), deadline);
+    const { entries } = await waitForDeadline(loadZipArchiveWithAdmission(buffer, limits), deadline);
     deadline.check();
-    const entries = admittedZipEntries(zip);
-    assertArchiveEntryCountWithinLimit(entries.length, limits);
+    assertArchiveEntryCountWithinLimit(entries.size, limits);
     const budget = createByteBudgetTracker(limits);
     await withStagedArchivePublication({ ...params, destinationGuard }, async (stagingDir) => {
         const { select } = createArchiveEntrySelector({ ...params, rootDir: stagingDir });
         const acceptedEntries = [];
-        for (const entry of entries) {
+        for (const record of entries.values()) {
             deadline.check();
-            const entryKind = zipEntryKind(entry);
-            const relPath = select({ path: entry.name, kind: entryKind, size: zipEntryDeclaredSize(entry) });
+            const { entry, kind: entryKind, size, mode: archivedMode } = record;
+            const relPath = select({ path: record.name, kind: entryKind, size });
             if (relPath === null)
                 continue;
             if (entryKind === "symlink") {
-                throw new ArchiveSecurityError("entry-link", `zip entry is a link: ${entry.name}`);
+                throw new ArchiveSecurityError("entry-link", `zip entry is a link: ${record.name}`);
             }
             if (entryKind === "other")
                 continue;
-            const mode = zipEntryMode(entry, params.entryModes);
+            const mode = resolveArchiveEntryMode({
+                kind: entry.dir ? "directory" : "file",
+                archivedMode,
+                policy: params.entryModes,
+            });
             acceptedEntries.push({ path: relPath, kind: entry.dir ? "directory" : "file", mode });
             const outPath = path.join(stagingDir, relPath);
             await preparePrivateArchiveOutputPath({
@@ -128,12 +131,12 @@ async function extractZip(params) {
                 destinationRealDir: stagingDir,
                 relPath,
                 outPath,
-                originalPath: entry.name,
+                originalPath: record.name,
                 isDirectory: entry.dir,
                 deadline,
             });
             if (!entry.dir) {
-                await writeZipFileEntry({ entry, outPath, budget, deadline });
+                await writeZipFileEntry({ record, outPath, budget, deadline });
             }
         }
         return acceptedEntries;

package/node_modules/@openclaw/fs-safe/dist/atomic.d.ts

@@ -1,4 +1,4 @@
-export { replaceFileAtomic, replaceFileAtomicSync, type ReplaceFileAtomicFileSystem, type ReplaceFileAtomicOptions, type ReplaceFileAtomicResult, type ReplaceFileAtomicSyncFileSystem, type ReplaceFileAtomicSyncOptions, } from "./replace-file.js";
+export { replaceFileAtomic, replaceFileAtomicSync, type ReplaceFileAtomicFileSystem, type ReplaceFileAtomicOptions, type ReplaceFileAtomicResult, type ReplaceFileAtomicDestinationState, type ReplaceFileAtomicSyncFileSystem, type ReplaceFileAtomicSyncOptions, } from "./replace-file.js";
 export type { RenameIdentityPolicy } from "./pinned-write-types.js";
 export type { ReplaceFileAtomicRestoreCleanup, ReplaceFileAtomicRestoreFailureDetails, ReplaceFileCopyFallbackRestorePolicy, ReplaceFileDestinationHardlinkPolicy, } from "./replace-file-copy-fallback.js";
 export { writeTextAtomic, type WriteTextAtomicOptions } from "./text-atomic.js";

package/node_modules/@openclaw/fs-safe/dist/copy-publication.d.ts

@@ -1,9 +1,7 @@
 import type { BigIntStats } from "node:fs";
 import type { PinnedWriteParams, PublishedWriteIdentity } from "./pinned-write-types.js";
-export type RootCopyPublicationReceipt = Readonly<{
+export type RootCopyPublicationReceipt = Readonly<PublishedWriteIdentity & {
     path: string;
-    dev: bigint;
-    ino: bigint;
 }>;
 export declare function createCopyPublicationObserver(path: string, notify?: (receipt: RootCopyPublicationReceipt) => void): {
     onPublished(identity: PublishedWriteIdentity): void;

package/node_modules/@openclaw/fs-safe/dist/copy-publication.js

@@ -1,16 +1,12 @@
 import { FsSafeError } from "./errors.js";
+import { assertSynchronousCallbackResult } from "./mutation-authority.js";
 export function createCopyPublicationObserver(path, notify) {
     let rejected;
     return {
         onPublished(identity) {
             const receipt = Object.freeze({ path, dev: identity.dev, ino: identity.ino });
             try {
-                const result = notify?.(receipt);
-                if (result !== null && (typeof result === "object" || typeof result === "function") &&
-                    "then" in result && typeof result.then === "function") {
-                    void Promise.resolve(result).catch(() => undefined);
-                    throw new TypeError("onDestinationPublished must be synchronous");
-                }
+                assertSynchronousCallbackResult(notify?.(receipt), "onDestinationPublished");
             }
             catch (error) {
                 rejected = { error };

package/node_modules/@openclaw/fs-safe/dist/deny-mutation-match.d.ts

@@ -0,0 +1,2 @@
+/** Cache observations only within one synchronous policy check, never across mutations or callbacks. */
+export declare function createMutationDenyMatcher(): (target: string, denied: string, prefix: boolean, protectAncestors?: boolean) => boolean;

package/node_modules/@openclaw/fs-safe/dist/deny-mutation-match.js

@@ -0,0 +1,71 @@
+import path from "node:path";
+import { isPathInside } from "./path.js";
+import { probePathCaseInsensitiveSync } from "./path-case.js";
+import { observeMutationPath } from "./pinned-mutation-observation.js";
+function foldedName(name) {
+    // Decompose before folding so combining marks precede an expanded Greek subscript.
+    // Default folding preserves dotless i even though its uppercase mapping is I.
+    return name.normalize("NFD").replace(/[^\u0131]+/gu, part => part.toLowerCase().toUpperCase().toLowerCase()).normalize("NFC");
+}
+function asciiCasePair(left, right) {
+    return /^[\x00-\x7f]*$/.test(left) && /^[\x00-\x7f]*$/.test(right) &&
+        left.toLowerCase() === right.toLowerCase();
+}
+/** Cache observations only within one synchronous policy check, never across mutations or callbacks. */
+export function createMutationDenyMatcher() {
+    const observations = new Map();
+    const caseObservations = new Map();
+    const observe = (pathname) => {
+        if (!observations.has(pathname))
+            observations.set(pathname, observeMutationPath(pathname));
+        return observations.get(pathname);
+    };
+    const prospectiveInside = (parent, child) => {
+        const root = path.parse(parent).root;
+        if (root !== path.parse(child).root)
+            return false;
+        const left = parent.slice(root.length).split(path.sep);
+        const right = child.slice(root.length).split(path.sep).slice(0, left.length);
+        if (left.length !== right.length || !left.every((name, i) => foldedName(name) === foldedName(right[i]))) {
+            return false;
+        }
+        // Byte-identical relations were already handled without any observations.
+        if (left.every((name, i) => name === right[i]))
+            return false;
+        const alignedChild = path.join(root, ...right);
+        const a = observe(parent);
+        const b = observe(alignedChild);
+        if (!a || !b)
+            return true;
+        // Distinct existing ancestors are real objects, not prospective aliases.
+        if (a.canonicalAncestor !== b.canonicalAncestor ||
+            a.missingSegments.length === 0 || a.missingSegments.length !== b.missingSegments.length)
+            return false;
+        const missingLeft = a.missingSegments;
+        const missingRight = b.missingSegments;
+        if (!missingLeft.every((name, i) => foldedName(name) === foldedName(missingRight[i])))
+            return false;
+        const difference = missingLeft.findIndex((name, i) => name !== missingRight[i]);
+        if (difference === -1)
+            return true;
+        // A read-only ASCII observation can disprove aliasing at this existing parent.
+        // It cannot prove Unicode sensitivity or the behavior of a future directory.
+        if (difference === 0 && asciiCasePair(missingLeft[0], missingRight[0])) {
+            if (!caseObservations.has(a.canonicalAncestor)) {
+                caseObservations.set(a.canonicalAncestor, probePathCaseInsensitiveSync(path.join(a.canonicalAncestor, missingLeft[0]), { allowTemporaryProbe: false }));
+            }
+            if (caseObservations.get(a.canonicalAncestor) === false)
+                return false;
+        }
+        // Suffix probing writes directories. Policy admission has no authority for
+        // those side effects, so unproven case/normalization equivalence fails closed.
+        return true;
+    };
+    return (target, denied, prefix, protectAncestors = false) => {
+        if ((isPathInside(denied, target) && (prefix || isPathInside(target, denied))) ||
+            (protectAncestors && isPathInside(target, denied)))
+            return true;
+        return ((prefix || target.split(path.sep).length === denied.split(path.sep).length) &&
+            prospectiveInside(denied, target)) || (protectAncestors && prospectiveInside(target, denied));
+    };
+}

package/node_modules/@openclaw/fs-safe/dist/deny-mutations.js

@@ -1,7 +1,8 @@
 import fs from "node:fs";
 import path from "node:path";
+import { createMutationDenyMatcher } from "./deny-mutation-match.js";
 import { FsSafeError } from "./errors.js";
-import { assertNoNulPathInput, isNotFoundPathError, isPathInside } from "./path.js";
+import { assertNoNulPathInput, isNotFoundPathError } from "./path.js";
 import { realpathSync } from "./realpath.js";
 import { resolveExistingAncestor } from "./root-path-existing.js";
 import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
@@ -65,6 +66,7 @@ export function assertMutationNotDenied(filePath, policy, options = {}, mode = "
     const strict = mode === "sync-root-lock";
     const comparablePaths = strict ? strictMutationComparablePaths : resolveMutationComparablePaths;
     const targets = comparablePaths(filePath);
+    const matches = createMutationDenyMatcher();
     // Validate one complete phase at a time. A paths denial must not read or
     // canonicalize prefixes, and invalid later paths retain validation precedence.
     for (const kind of ["paths", "prefixes"]) {
@@ -72,8 +74,7 @@ export function assertMutationNotDenied(filePath, policy, options = {}, mode = "
             const deniedPaths = comparablePaths(entry);
             for (const target of targets) {
                 for (const denied of deniedPaths) {
-                    if ((isPathInside(denied, target) && (kind === "prefixes" || isPathInside(target, denied))) ||
-                        (options.protectAncestors === true && isPathInside(target, denied))) {
+                    if (matches(target, denied, kind === "prefixes", options.protectAncestors)) {
                         throw new FsSafeError("denied-path", "path is denied by denyMutations policy");
                     }
                 }

package/node_modules/@openclaw/fs-safe/dist/directory-guard.d.ts

@@ -36,7 +36,6 @@ export declare function createNearestExistingDirectoryGuard(rootReal: string, ta
 export declare function createNearestExistingDirectoryGuard(rootReal: string, targetPath: string, options: {
     bigint: boolean;
 }): Promise<AnyAsyncDirectoryGuard>;
-export declare function createNearestExistingSyncDirectoryGuard(rootReal: string, targetPath: string): SyncDirectoryGuard;
 export declare function inspectDirectoryIdentity(dir: string, expected?: Pick<BigIntStats, "dev" | "ino">): Promise<BigIntStats>;
 export declare function observeDirectoryIdentitySync(dir: string, options: {
     bigint: true;

package/node_modules/@openclaw/fs-safe/dist/directory-guard.js

@@ -84,9 +84,6 @@ function assertDirectoryGuard(guard, mode) {
 export async function createNearestExistingDirectoryGuard(rootReal, targetPath, options = { bigint: false }) {
     return nearestExistingDirectoryGuard(rootReal, targetPath, "native", options);
 }
-export function createNearestExistingSyncDirectoryGuard(rootReal, targetPath) {
-    return nearestExistingDirectoryGuard(rootReal, targetPath, "normalized");
-}
 function nearestExistingDirectoryGuard(rootReal, targetPath, mode, options) {
     assertNoWindowsPathAlias(rootReal, "filesystem");
     assertNoWindowsPathAlias(targetPath, "filesystem");

package/node_modules/@openclaw/fs-safe/dist/directory-mode-node.d.ts

@@ -1,5 +1,23 @@
-import { type BigIntStats } from "node:fs";
-import { type DirectoryModeOwner } from "./directory-mode-owner.js";
+import { type BigIntStats, type Stats } from "node:fs";
+export type DirectoryModeChecks = {
+    check?: () => void;
+    beforeChmod?: () => Promise<void>;
+};
+export type DirectoryModeOwner = {
+    verify(check?: () => void): Promise<void>;
+    apply(mode: number, checks?: DirectoryModeChecks): Promise<void>;
+    close(): Promise<void>;
+};
+export declare function assertOwnedDirectory(expected: Stats | BigIntStats, actual: Stats | BigIntStats): void;
+/** Serializes use and close: even a queued path-based fd operation retains its descriptor. */
+export declare function ownDirectoryMode(params: {
+    inspect: () => Promise<number>;
+    chmod: (mode: number) => Promise<void>;
+    prepareChmod?: () => Promise<void>;
+    verifyChmod?: () => Promise<void>;
+    close: () => Promise<void>;
+    ignoreChmodError?: boolean;
+}): DirectoryModeOwner;
 /** Darwin descriptor inspection avoids requesting directory-content reads. */
 export declare function nodeDarwinDirectoryMetadataFlags(): number;
 export declare function nodeDirectorySearchOnlyFlags(): {

package/node_modules/@openclaw/fs-safe/dist/directory-mode-node.js

@@ -3,7 +3,83 @@ import fs from "node:fs/promises";
 import { FsSafeError } from "./errors.js";
 import { inspectDirectoryIdentity, inspectDirectoryIdentitySync } from "./directory-guard.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
-import { assertOwnedDirectory, ownDirectoryMode } from "./directory-mode-owner.js";
+import { sameFileIdentityForCleanup } from "./file-identity.js";
+export function assertOwnedDirectory(expected, actual) {
+    if (actual.isSymbolicLink() || !actual.isDirectory()) {
+        throw new FsSafeError("not-file", "directory mode target must be a real directory");
+    }
+    if (!sameFileIdentityForCleanup(expected, actual)) {
+        throw new FsSafeError("path-mismatch", "directory changed before its mode could be applied");
+    }
+}
+/** Serializes use and close: even a queued path-based fd operation retains its descriptor. */
+export function ownDirectoryMode(params) {
+    let pending = Promise.resolve();
+    let closing;
+    const enqueue = (run) => {
+        if (closing)
+            return Promise.reject(new FsSafeError("path-mismatch", "directory mode owner is closed"));
+        const operation = pending.then(run);
+        pending = operation.catch(() => undefined);
+        return operation;
+    };
+    return {
+        verify: (check) => enqueue(async () => {
+            check?.();
+            await params.inspect();
+            check?.();
+        }),
+        apply: (mode, checks = {}) => enqueue(async () => {
+            // inspect() reports permission bits only; chmod ignores file-type bits,
+            // so tolerate raw stat modes (e.g. S_IFDIR | 0o755) by masking up front.
+            mode &= 0o7777;
+            checks.check?.();
+            const currentMode = await params.inspect();
+            checks.check?.();
+            if (currentMode === mode && !checks.beforeChmod && !checks.check)
+                return;
+            if (currentMode !== mode) {
+                await params.prepareChmod?.();
+                checks.check?.();
+            }
+            await checks.beforeChmod?.();
+            checks.check?.();
+            // Hooks/ancestor checks can yield; recheck the original named association.
+            await params.inspect();
+            checks.check?.();
+            let dispatchDeadlineFailure;
+            if (currentMode !== mode) {
+                checks.check?.();
+                try {
+                    await params.chmod(mode);
+                }
+                catch (error) {
+                    if (!params.ignoreChmodError)
+                        throw error;
+                }
+                // Expiry cannot release the fd while post-dispatch verification is pending.
+                try {
+                    checks.check?.();
+                }
+                catch (error) {
+                    dispatchDeadlineFailure = { error };
+                }
+                await params.verifyChmod?.();
+            }
+            const finalMode = await params.inspect();
+            if (dispatchDeadlineFailure)
+                throw dispatchDeadlineFailure.error;
+            checks.check?.();
+            if (!params.ignoreChmodError && finalMode !== mode) {
+                throw new FsSafeError("path-mismatch", "directory final mode could not be verified");
+            }
+        }),
+        close() {
+            closing ??= pending.then(params.close);
+            return closing;
+        },
+    };
+}
 /** Darwin descriptor inspection avoids requesting directory-content reads. */
 export function nodeDarwinDirectoryMetadataFlags() {
     if (process.platform !== "darwin" || (process.arch !== "x64" && process.arch !== "arm64")) {

package/node_modules/@openclaw/fs-safe/dist/directory-receipt.js

@@ -70,11 +70,6 @@ function snapshotDirectoryMetadata(stat, identity) {
 export function directoryReceiptAuthority(receipt) {
     return authorities.get(receipt) ?? snapshotDirectoryReceipt(receipt);
 }
-function rememberReceipt(receipt, authority) {
-    authorities.set(receipt, authority);
-    identities.set(receipt.identity, authority);
-    return receipt;
-}
 export function ownDirectoryReceipt(receipt) {
     return receiptFromAuthority(snapshotDirectoryReceipt(receipt));
 }
@@ -83,11 +78,14 @@ export function copyRetainedDirectoryReceipt(receipt) {
     return receiptFromAuthority(authority);
 }
 function receiptFromAuthority(authority) {
-    return rememberReceipt({
+    const receipt = {
         path: authority.path,
         realPath: authority.realPath,
         identity: Object.assign(Object.create(fs.Stats.prototype), authority.metadata),
-    }, authority);
+    };
+    authorities.set(receipt, authority);
+    identities.set(receipt.identity, authority);
+    return receipt;
 }
 // The caller already admitted the exact observation and its paths.
 export function createDirectoryReceiptFromIdentity(pathname, realPath, exactStat) {

package/node_modules/@openclaw/fs-safe/dist/effective-uid.js

@@ -1,6 +1,3 @@
-function isValidUid(value) {
-    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
-}
 function unavailable(cause) {
     return new Error("Effective user identity is unavailable.", {
         ...(cause === undefined ? {} : { cause }),
@@ -18,7 +15,7 @@ export function resolveEffectiveUid() {
     catch (cause) {
         throw unavailable(cause);
     }
-    if (!isValidUid(uid)) {
+    if (!(typeof uid === "number" && Number.isSafeInteger(uid) && uid >= 0)) {
         throw unavailable();
     }
     return uid;

package/node_modules/@openclaw/fs-safe/dist/errors.d.ts

@@ -1,6 +1,7 @@
-export type FsSafeErrorCode = "already-exists" | "denied-path" | "device-path" | "hardlink" | "helper-failed" | "helper-unavailable" | "invalid-path" | "insecure-permissions" | "not-empty" | "not-file" | "not-found" | "not-owned" | "not-removable" | "outside-workspace" | "path-alias" | "path-mismatch" | "permission-unverified" | "read-failed" | "secret-exists" | "store-reentrant-update" | "symlink" | "timeout" | "too-large" | "unsupported-platform";
+export type FsSafeErrorCode = (typeof OPERATIONAL_CODE_VALUES)[number] | "already-exists" | "denied-path" | "device-path" | "hardlink" | "invalid-path" | "insecure-permissions" | "not-file" | "not-owned" | "outside-workspace" | "path-alias" | "path-mismatch" | "secret-exists" | "store-reentrant-update" | "symlink" | "too-large";
 export type FsSafeErrorCategory = "policy" | "operational";
 export type FsSafeErrorDetails = Readonly<Record<string, unknown>>;
+declare const OPERATIONAL_CODE_VALUES: readonly ["helper-failed", "helper-unavailable", "not-empty", "not-found", "not-removable", "permission-unverified", "read-failed", "timeout", "unsupported-platform"];
 export declare function categorizeFsSafeError(code: FsSafeErrorCode): FsSafeErrorCategory;
 export declare class FsSafeError extends Error {
     readonly code: FsSafeErrorCode;
@@ -11,3 +12,4 @@ export declare class FsSafeError extends Error {
         details?: FsSafeErrorDetails;
     });
 }
+export {};

package/node_modules/@openclaw/fs-safe/dist/errors.js

@@ -1,4 +1,4 @@
-const OPERATIONAL_CODES = new Set([
+const OPERATIONAL_CODE_VALUES = [
     "helper-failed",
     "helper-unavailable",
     "not-empty",
@@ -8,7 +8,8 @@ const OPERATIONAL_CODES = new Set([
     "read-failed",
     "timeout",
     "unsupported-platform",
-]);
+];
+const OPERATIONAL_CODES = new Set(OPERATIONAL_CODE_VALUES);
 export function categorizeFsSafeError(code) {
     return OPERATIONAL_CODES.has(code) ? "operational" : "policy";
 }

package/node_modules/@openclaw/fs-safe/dist/file-identity.js

@@ -22,9 +22,17 @@ export function sameFileIdentity(left, right, platform = process.platform) {
     return (!isStatValueProvablyDifferent(left.dev, right.dev, platform) &&
         !isStatValueProvablyDifferent(left.ino, right.ino, platform));
 }
+function sameCleanupStatValue(left, right) {
+    // Converting an unsafe number to bigint cannot recover an already rounded ID.
+    if (typeof left === "number" && !Number.isSafeInteger(left))
+        return false;
+    if (typeof right === "number" && !Number.isSafeInteger(right))
+        return false;
+    return sameStatValue(left, right);
+}
 export function sameFileIdentityForCleanup(left, right, platform = process.platform) {
     if (platform !== "win32") {
-        return sameStatValue(left.dev, right.dev) && sameStatValue(left.ino, right.ino);
+        return sameCleanupStatValue(left.dev, right.dev) && sameCleanupStatValue(left.ino, right.ino);
     }
     // A zero Windows device or inode is unknown, not proof that a pathname still
     // names the object we created. Cleanup must fail closed rather than delete a
@@ -44,5 +52,5 @@ export function sameFileIdentityForCleanup(left, right, platform = process.platf
     const rightIno = right.ino;
     if (isZero(rightIno))
         return false;
-    return sameStatValue(leftDev, rightDev) && sameStatValue(leftIno, rightIno);
+    return sameCleanupStatValue(leftDev, rightDev) && sameCleanupStatValue(leftIno, rightIno);
 }

package/node_modules/@openclaw/fs-safe/dist/file-lock-sync-acquisition.js

@@ -66,7 +66,7 @@ export class SyncLockAcquisition {
         }
         catch (waitError) {
             // Exhausted backoff must preserve the filesystem denial diagnosis.
-            if (waitError.code === "file_lock_timeout")
+            if (waitError?.code === "file_lock_timeout")
                 throw error;
             throw waitError;
         }

package/node_modules/@openclaw/fs-safe/dist/file-lock-sync-admission.js

@@ -30,7 +30,11 @@ export function defaultSyncShouldReclaim(snapshot, staleMs, nowMs) {
     const createdAtMs = sidecarLockPayloadCreatedAtMs(snapshot.payload);
     if (createdAtMs !== null)
         return nowMs - createdAtMs > staleMs;
-    return !snapshot.stat || nowMs - snapshot.stat.mtimeMs > staleMs;
+    if (!snapshot.stat)
+        return true;
+    const mtimeMs = "mtimeNs" in snapshot.stat
+        ? Number(snapshot.stat.mtimeNs) / 1e6 : snapshot.stat.mtimeMs;
+    return nowMs - mtimeMs > staleMs;
 }
 export function syncReclaimGuardExists(reclaimGuardPath) {
     try {

package/node_modules/@openclaw/fs-safe/dist/file-lock-sync-root-held.d.ts

@@ -1,5 +1,6 @@
+import { type SyncHeldLock } from "./file-lock-sync-admission.js";
+import type { SidecarLockOptionFields } from "./sidecar-lock-types.js";
 import type { FileLockSyncHandle } from "./file-lock-sync.js";
-import { type SidecarLockSnapshot } from "./sidecar-lock-reclaim.js";
 import { type FileLockSyncRootAuthority, type FileLockSyncRootPath } from "./file-lock-sync-root.js";
 import { type FileLockSyncRootFileReceipt, type FileLockSyncRootSnapshot } from "./file-lock-sync-root-io.js";
 type RootSyncHeldLockReleaseState = "active" | "releasing" | "exit-cleaning" | "released";
@@ -7,22 +8,14 @@ type RootSyncHeldLockHandleDisposition = {
     held: RootSyncHeldLock;
     released: boolean;
 };
-export type RootSyncHeldLock = {
+export type RootSyncHeldLock = SidecarLockOptionFields<SyncHeldLock & {
     deferredExitReleases?: Set<RootSyncHeldLockHandleDisposition>;
-    fd: number | undefined;
-    lockPath: string;
-    normalizedTargetPath: string;
-    parsePayload?: (raw: string) => unknown;
-    refCount: number;
-    reentrantOwner?: string;
     releaseState: RootSyncHeldLockReleaseState;
     revision: number;
     rootAuthority: FileLockSyncRootAuthority;
     rootPath: FileLockSyncRootPath;
     rootReceipt: FileLockSyncRootFileReceipt;
-    snapshot: SidecarLockSnapshot;
-    timer?: NodeJS.Timeout;
-};
+}>;
 export declare function readRootSidecarSnapshotSync(rootPath: FileLockSyncRootPath, parsePayload?: (raw: string) => unknown, onOpenFailure?: (error: unknown) => void, expectedReceipt?: FileLockSyncRootFileReceipt): FileLockSyncRootSnapshot | null;
 export declare function getRootSyncHeldLocks(): Map<string, RootSyncHeldLock>;
 export declare function ensureRootSyncExitCleanupRegistered(): void;

package/node_modules/@openclaw/fs-safe/dist/file-lock-sync-root-held.js

@@ -53,9 +53,6 @@ export function getRootSyncHeldLocks() {
     }
     return globalWithState[ROOT_SYNC_HELD_LOCKS_KEY];
 }
-function existingRootSyncHeldLocks() {
-    return globalThis[ROOT_SYNC_HELD_LOCKS_KEY];
-}
 function reactivateExactHeldLock(heldLocks, held, restoreConsumedReference) {
     if (heldLocks.get(held.normalizedTargetPath) !== held || held.releaseState === "released") {
         return false;
@@ -123,7 +120,7 @@ function releaseAllRootSyncHeldLocks() {
     try {
         // A newListener callback can invoke the candidate handler before
         // registration succeeds. Do not create acquisition state in that window.
-        const heldLocks = existingRootSyncHeldLocks();
+        const heldLocks = globalThis[ROOT_SYNC_HELD_LOCKS_KEY];
         if (!heldLocks)
             return;
         getSyncLockAdmissions().clear();

package/node_modules/@openclaw/fs-safe/dist/file-lock-sync-root-io.d.ts

@@ -1,4 +1,4 @@
-import { type BigIntStats, type Stats } from "node:fs";
+import { type BigIntStats } from "node:fs";
 import type { RootDefaults } from "./root-options.js";
 import { type FileLockSyncRootPath } from "./file-lock-sync-root.js";
 export type ExactIdentity = Readonly<{
@@ -14,15 +14,12 @@ export type FileLockSyncRootFileReceipt = Readonly<{
     identity: ExactIdentity;
     parent: DirectoryReceipt;
 }>;
-export type FileLockSyncRootDirectoryReceipt = Readonly<{
-    identity: ExactIdentity;
-    parent: DirectoryReceipt;
-}>;
+export type FileLockSyncRootDirectoryReceipt = FileLockSyncRootFileReceipt;
 export type FileLockSyncRootDiskSnapshot = {
     ownershipToken?: never;
     payload: unknown;
     raw: string;
-    stat: Stats;
+    stat: BigIntStats;
 };
 export type FileLockSyncRootSnapshot = Readonly<{
     receipt: FileLockSyncRootFileReceipt;

package/node_modules/@openclaw/fs-safe/dist/file-lock-sync-root-io.js

@@ -143,7 +143,7 @@ export function readFileLockSyncRootSnapshot(pathAuthority, options = {}) {
             throw error;
         }
         assertRegularFile(after, pathAuthority.authority.hardlinks);
-        const stat = fs.fstatSync(fd);
+        const stat = fs.fstatSync(fd, { bigint: true });
         if (expectedReceipt) {
             assertRetainedParentCurrent(pathAuthority, parent);
         }

package/node_modules/@openclaw/fs-safe/dist/file-lock-sync-root-options.d.ts

@@ -1,19 +1,11 @@
 import type { FileLockSyncAcquireOptions } from "./file-lock-sync.js";
-import type { SidecarLockCompromisedInfo, SidecarLockRetryOptions, SidecarLockStaleRecovery } from "./sidecar-lock-types.js";
-type CapturedRootSyncAcquireOptions<TPayload extends Record<string, unknown>> = Readonly<{
-    compromiseCheckIntervalMs?: number;
-    lockPath?: string;
-    onCompromised?: (info: SidecarLockCompromisedInfo) => void;
+import type { SidecarLockRetryOptions } from "./sidecar-lock-types.js";
+type CapturedRootSyncAcquireOptions<TPayload extends Record<string, unknown>> = Readonly<Pick<FileLockSyncAcquireOptions<TPayload>, "compromiseCheckIntervalMs" | "lockPath" | "onCompromised" | "parsePayload" | "payload" | "reentrantOwner" | "staleRecovery" | "timeoutMs"> & {
     optionsReceiver: FileLockSyncAcquireOptions<TPayload>;
-    parsePayload?: (raw: string) => unknown;
-    payload: () => TPayload;
-    reentrantOwner?: string;
     retry: Readonly<SidecarLockRetryOptions>;
     shouldReclaim?: FileLockSyncAcquireOptions<TPayload>["shouldReclaim"];
     shouldRemoveStaleLock?: FileLockSyncAcquireOptions<TPayload>["shouldRemoveStaleLock"];
     staleMs: number;
-    staleRecovery?: SidecarLockStaleRecovery;
-    timeoutMs?: number;
 }>;
 export declare function captureRootSyncAcquireOptions<TPayload extends Record<string, unknown>>(options: FileLockSyncAcquireOptions<TPayload>): CapturedRootSyncAcquireOptions<TPayload>;
 export {};

package/node_modules/@openclaw/fs-safe/dist/file-lock-sync-root.d.ts

@@ -1,3 +1,4 @@
+import { type DenyMutationPolicy } from "./deny-mutations.js";
 import { type RootContext } from "./root-context.js";
 import type { Root } from "./root-impl.js";
 import type { RootDefaults } from "./root-options.js";
@@ -7,10 +8,7 @@ export type FileLockSyncRootAuthority = Readonly<{
     adapter: object;
     context: RootContext;
     assertBeforeMutation?: () => void;
-    denyMutations?: Readonly<{
-        paths?: readonly string[];
-        prefixes?: readonly string[];
-    }>;
+    denyMutations?: Readonly<DenyMutationPolicy>;
     hardlinks?: RootDefaults["hardlinks"];
     mutationPolicy: RootPathResolutionPolicy;
     readPolicy: RootPathResolutionPolicy;