@openclaw/openshell-sandbox 2026.9.6 → 2026.9.8

package/node_modules/@openclaw/fs-safe/dist/secure-file.js

@@ -202,7 +202,8 @@ function inspectOpenedPermissions(stat, platform) {
         groupReadable: isGroupReadable(bits),
     };
 }
-async function assertSecurePermissions(options, stat, realPath, identity, fd) {
+async function assertSecurePermissions(options, opened, fd) {
+    const { pathStat: stat, realPath, identity } = opened;
     if (options.permissions?.allowInsecure) {
         return undefined;
     }
@@ -282,7 +283,7 @@ export async function readSecureFile(options) {
     const opened = await openSecureHandle(options, maxBytes);
     try {
         assertTrustedDirs(options, opened.realPath);
-        const permissions = await assertSecurePermissions(options, opened.pathStat, opened.realPath, opened.identity, opened.handle.fd);
+        const permissions = await assertSecurePermissions(options, opened, opened.handle.fd);
         const buffer = await readHandleWithTimeout(opened.handle, options.io?.timeoutMs, maxBytes);
         const finalIdentity = inspectFileIdentitySync(() => fsSync.fstatSync(opened.handle.fd, { bigint: true }), opened.identity);
         if (!finalIdentity.isFile()) {

package/node_modules/@openclaw/fs-safe/dist/secure-temp-dir.js

@@ -3,15 +3,10 @@ import { tmpdir as getOsTmpDir } from "node:os";
 import path from "node:path";
 import { directoryEntryPath } from "./directory-entry-path.js";
 import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
+import { hasNodeErrorCode } from "./path.js";
 import { assertSafePathSegment } from "./safe-path-segment.js";
 import { assertNoWindowsPathAlias, pathForWindowsFilesystem } from "./windows-path-alias.js";
 import { captureSecureTempRepairAdapter, repairSecureTempDirectory, secureTempDirectoryReceipt, } from "./secure-temp-repair.js";
-function isNodeErrorWithCode(err, code) {
-    return (typeof err === "object" &&
-        err !== null &&
-        "code" in err &&
-        err.code === code);
-}
 export function resolveSecureTempRoot(options) {
     const { fallbackPrefix: prefix, accessSync: suppliedAccess, lstatSync: suppliedLstat, mkdirSync: suppliedMkdir, descriptor: suppliedDescriptor, getuid: suppliedGetuid, tmpdir: suppliedTmpdir, platform: suppliedPlatform, preferredDir, skipPreferredOnWindows, warn: suppliedWarn, warningPrefix: suppliedWarningPrefix, unsafeFallbackLabel: suppliedFallbackLabel, } = options;
     const platform = suppliedPlatform ?? process.platform;
@@ -87,7 +82,7 @@ export function resolveSecureTempRoot(options) {
             candidate = lstatSync(candidatePath);
         }
         catch (error) {
-            return { kind: isNodeErrorWithCode(error, "ENOENT") ? "missing" : "invalid", error };
+            return { kind: hasNodeErrorCode(error, "ENOENT") ? "missing" : "invalid", error };
         }
         let receipt;
         try {

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-acquire.js

@@ -102,7 +102,7 @@ export async function acquireSidecarLock(options, context) {
             await waitForRetry();
         }
         catch (waitError) {
-            if (waitError.code === "file_lock_timeout")
+            if (waitError?.code === "file_lock_timeout")
                 throw denial;
             throw waitError;
         }
@@ -290,9 +290,9 @@ export async function acquireSidecarLock(options, context) {
                     }
                     await handle.writeFile(raw, "utf8");
                 }
-                const snapshot = { raw, payload, stat: fsSync.fstatSync(handle.fd), ownershipToken };
+                const snapshot = { raw, payload, stat: fsSync.fstatSync(handle.fd, { bigint: true }), ownershipToken };
                 createdSnapshot = snapshot;
-                if (snapshot.stat.nlink === 0) {
+                if (snapshot.stat.nlink === 0n) {
                     await handle.close();
                     handle = null;
                     await waitForRetry();
@@ -361,7 +361,7 @@ export async function acquireSidecarLock(options, context) {
                     if (handle) {
                         failedSnapshot ??= { payload: null };
                         try {
-                            failedSnapshot.stat = fsSync.fstatSync(handle.fd);
+                            failedSnapshot.stat = fsSync.fstatSync(handle.fd, { bigint: true });
                         }
                         catch {
                             // Best-effort cleanup of a failed exclusive create.

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-admission-parser.d.ts

@@ -1,7 +1,7 @@
 import type { Root } from "./root-impl.js";
 import type { HeldSidecarLock } from "./sidecar-lock-admission.js";
 import { readSidecarLockRawSnapshot, type SidecarLockSnapshot } from "./sidecar-lock-reclaim.js";
-type SidecarAdmissionRunner = {
+export type SidecarAdmissionRunner = {
     hasToken(): boolean;
     run<T>(callback: () => T): T;
 };
@@ -39,4 +39,3 @@ export declare function observeHeldSidecarParser(params: {
     parserAccessor(): ((raw: string) => unknown) | undefined;
     isTransientDenial(error: unknown): boolean;
 }): Promise<HeldSidecarParserObservation>;
-export {};

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-handle.d.ts

@@ -1,5 +1,4 @@
-import type { Root } from "./root-impl.js";
-import { type SidecarLockSnapshot } from "./sidecar-lock-reclaim.js";
+import type { HeldSidecarLock } from "./sidecar-lock-admission.js";
 import type { SidecarLockHandle } from "./sidecar-lock-types.js";
 export declare function stopSidecarLockMonitoring(held: {
     compromiseTimer?: NodeJS.Timeout;
@@ -14,12 +13,7 @@ export declare function createSidecarLockHandle(params: {
 }): SidecarLockHandle;
 export declare function createHeldSidecarLockHandle(params: {
     normalizedTargetPath: string;
-    held: {
-        lockPath: string;
-        snapshot: SidecarLockSnapshot;
-        lockRoot?: Root;
-        parsePayload?: (raw: string) => unknown;
-    };
+    held: Pick<HeldSidecarLock, "lockPath" | "snapshot" | "lockRoot" | "parsePayload">;
     release: (options?: {
         retry?: boolean;
     }) => Promise<unknown>;

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-policy.d.ts

@@ -1,4 +1,4 @@
-import type { SidecarLockRetryOptions } from "./sidecar-lock-types.js";
+import type { SidecarLockReclaimParams, SidecarLockRetryOptions } from "./sidecar-lock-types.js";
 export declare function validateSidecarLockRetryOptions(retry: SidecarLockRetryOptions): void;
 export declare function validateSidecarLockTimeoutMs(timeoutMs: number | undefined): void;
 export declare function validateSidecarLockStaleMs(staleMs: number | undefined): void;
@@ -11,9 +11,4 @@ export declare function sidecarLockRetryDelay(retry: SidecarLockRetryOptions, ti
 export declare const maxTransientLockDenials = 8;
 export declare function isTransientLockFileDenial(error: unknown, lockPath: string): boolean;
 export declare function sidecarLockPayloadCreatedAtMs(payload: unknown): number | null;
-export declare function defaultSidecarLockShouldReclaim(params: {
-    lockPath: string;
-    payload: unknown;
-    staleMs: number;
-    nowMs: number;
-}): Promise<boolean>;
+export declare function defaultSidecarLockShouldReclaim(params: Pick<SidecarLockReclaimParams, "lockPath" | "payload" | "staleMs" | "nowMs">): Promise<boolean>;

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.d.ts

@@ -1,4 +1,4 @@
-import { type Stats } from "node:fs";
+import { type BigIntStats, type Stats } from "node:fs";
 import type { Root } from "./root-impl.js";
 export type SidecarLockStaleSnapshot = {
     lockPath: string;
@@ -9,7 +9,7 @@ export type SidecarLockStaleSnapshot = {
 export type SidecarLockSnapshot = {
     raw?: string;
     payload: unknown;
-    stat?: Stats;
+    stat?: Stats | BigIntStats;
     ownershipToken?: string;
 };
 type SidecarLockRawSnapshot = Omit<SidecarLockSnapshot, "payload"> & {

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.js

@@ -90,7 +90,7 @@ export async function readSidecarLockRawSnapshot(lockPath, options = {}) {
                 const raw = (await readFileHandleBounded(opened.handle, MAX_LOCK_PAYLOAD_BYTES)).toString("utf8");
                 return {
                     raw,
-                    stat: opened.stat,
+                    stat: fsSync.fstatSync(opened.handle.fd, { bigint: true }),
                 };
             }
             finally {
@@ -99,7 +99,7 @@ export async function readSidecarLockRawSnapshot(lockPath, options = {}) {
         }
         let before;
         try {
-            before = fsSync.lstatSync(lockPath);
+            before = fsSync.lstatSync(lockPath, { bigint: true });
         }
         catch (error) {
             before = missingSnapshotPath(error);
@@ -132,7 +132,7 @@ export async function readSidecarLockRawSnapshot(lockPath, options = {}) {
             options.onOpenFailure?.(error);
             throw error;
         }
-        const opened = fsSync.fstatSync(handle.fd);
+        const opened = fsSync.fstatSync(handle.fd, { bigint: true });
         if (!opened.isFile()) {
             if (options.rejectNonFile) {
                 throw new FsSafeError("not-file", `sidecar lock is not a regular file: ${lockPath}`);
@@ -144,7 +144,7 @@ export async function readSidecarLockRawSnapshot(lockPath, options = {}) {
         const raw = (await readFileHandleBounded(handle, MAX_LOCK_PAYLOAD_BYTES)).toString("utf8");
         let after;
         try {
-            after = fsSync.lstatSync(lockPath);
+            after = fsSync.lstatSync(lockPath, { bigint: true });
         }
         catch (error) {
             after = missingSnapshotPath(error);
@@ -159,7 +159,7 @@ export async function readSidecarLockRawSnapshot(lockPath, options = {}) {
 }
 function lstatSidecarLockSync(lockPath) {
     try {
-        return fsSync.lstatSync(lockPath);
+        return fsSync.lstatSync(lockPath, { bigint: true });
     }
     catch (error) {
         return missingSnapshotPath(error);
@@ -189,7 +189,7 @@ export function readSidecarLockRawSnapshotSync(lockPath, options = {}) {
             options.onOpenFailure?.(error);
             throw error;
         }
-        const opened = fsSync.fstatSync(fd);
+        const opened = fsSync.fstatSync(fd, { bigint: true });
         if (!opened.isFile()) {
             if (options.rejectNonFile) {
                 throw new FsSafeError("not-file", `sidecar lock is not a regular file: ${lockPath}`);
@@ -357,13 +357,12 @@ export async function removeStaleSidecarLockIfAllowed(params) {
     if (params.assertGuardHeld)
         await params.assertGuardHeld();
     params.assertAuthorized?.();
+    if (params.lockRoot) {
+        await params.lockRoot.remove(relativeSidecarLockPath(params.lockRoot, params.lockPath), { assertBeforeMutation: params.assertAuthorized });
+        return "removed";
+    }
     try {
-        if (params.lockRoot) {
-            await params.lockRoot.remove(relativeSidecarLockPath(params.lockRoot, params.lockPath), { assertBeforeMutation: params.assertAuthorized });
-        }
-        else {
-            await fs.rm(params.lockPath);
-        }
+        await fs.rm(params.lockPath);
         return "removed";
     }
     catch (err) {

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock-stale-admission.d.ts

@@ -1,11 +1,7 @@
 import { type SidecarReclaimGuard } from "./sidecar-lock-reclaim.js";
-import { type SidecarLockParserState } from "./sidecar-lock-admission-parser.js";
+import { type SidecarLockParserState, type SidecarAdmissionRunner } from "./sidecar-lock-admission-parser.js";
 import type { Root } from "./root-impl.js";
 import type { SidecarLockAcquireOptions } from "./sidecar-lock-types.js";
-type SidecarAdmissionRunner = {
-    hasToken(): boolean;
-    run<T>(callback: () => T): T;
-};
 type StaleOptions = Pick<SidecarLockAcquireOptions<Record<string, unknown>>, "shouldReclaim" | "shouldRemoveStaleLock" | "staleRecovery">;
 export type SidecarLockStaleOptionsState = {
     shouldReclaimObserved?: boolean;

package/node_modules/@openclaw/fs-safe/dist/sidecar-lock.js

@@ -1,6 +1,6 @@
 import fsSync from "node:fs";
 import { FsSafeError } from "./errors.js";
-import { sameFileIdentity } from "./file-identity.js";
+import { sameFileIdentityForCleanup } from "./file-identity.js";
 import { removeSidecarLockIfUnchanged, sidecarLockSnapshotMatches, } from "./sidecar-lock-reclaim.js";
 import { acquireSidecarLock } from "./sidecar-lock-acquire.js";
 import { createHeldSidecarLockHandle, stopSidecarLockMonitoring } from "./sidecar-lock-handle.js";
@@ -50,7 +50,7 @@ function resolveManagerState(key) {
 function snapshotMatchesSync(lockPath, observed) {
     let fd;
     try {
-        const beforeStat = fsSync.lstatSync(lockPath);
+        const beforeStat = fsSync.lstatSync(lockPath, { bigint: true });
         if (!beforeStat.isFile()) {
             return false;
         }
@@ -60,16 +60,18 @@ function snapshotMatchesSync(lockPath, observed) {
                 : 0) |
             (typeof fsSync.constants.O_NONBLOCK === "number" ? fsSync.constants.O_NONBLOCK : 0);
         fd = fsSync.openSync(lockPath, openFlags);
-        const openedStat = fsSync.fstatSync(fd);
-        if (!openedStat.isFile()) {
+        const openedStat = fsSync.fstatSync(fd, { bigint: true });
+        // Token-owned files can have different descriptor/path identities on VirtioFS.
+        // Require a known descriptor identity without rejecting that supported drift.
+        if (!openedStat.isFile() || !sameFileIdentityForCleanup(openedStat, openedStat)) {
             return false;
         }
-        if (observed.raw !== undefined && openedStat.size !== Buffer.byteLength(observed.raw)) {
+        if (observed.raw !== undefined && openedStat.size !== BigInt(Buffer.byteLength(observed.raw))) {
             return false;
         }
         const raw = fsSync.readFileSync(fd, "utf8");
-        const afterStat = fsSync.lstatSync(lockPath);
-        if (!afterStat.isFile() || !sameFileIdentity(beforeStat, afterStat)) {
+        const afterStat = fsSync.lstatSync(lockPath, { bigint: true });
+        if (!afterStat.isFile() || !sameFileIdentityForCleanup(beforeStat, afterStat)) {
             return false;
         }
         return sidecarLockSnapshotMatches({ raw, payload: null, stat: afterStat }, observed);

package/node_modules/@openclaw/fs-safe/dist/staged-symlink-types.d.ts

@@ -0,0 +1,39 @@
+import type { PublishedFileReceipt, StagedFileCleanupReceipt, StagedFileReceipt } from "./staged-file-types.js";
+/** Caller-captured admission evidence, never a same-target ownership heuristic. */
+export type StagedSymlinkExpected = Readonly<Pick<StagedFileReceipt["identity"], "dev" | "ino" | "uid" | "gid" | "ctimeNs"> & {
+    target: string;
+}>;
+export type StagedSymlinkReceipt = StagedFileReceipt & Readonly<{
+    target: string;
+}>;
+export type PublishedSymlinkReceipt = Readonly<Pick<PublishedFileReceipt, "status" | "basename"> & {
+    staged: StagedSymlinkReceipt;
+    overwrite: false;
+}>;
+export type StagedSymlinkPublication = Readonly<{
+    status: "not-published";
+}> | PublishedSymlinkReceipt | Readonly<{
+    status: "indeterminate";
+    basename: string;
+    overwrite: false;
+}>;
+export type StagedSymlinkRemoval = "removed" | "name-absent" | "preserved";
+export type StagedSymlinkCleanupReceipt = Readonly<Pick<StagedFileCleanupReceipt, "temporaryBasename" | "status" | "resources"> & {
+    publication: StagedSymlinkPublication;
+}>;
+export type StagedSymlinkFailureDetails = Readonly<{
+    phase: "prepare" | "publish" | "remove-published" | "cleanup";
+    publication: StagedSymlinkPublication;
+    cleanup?: StagedSymlinkCleanupReceipt;
+}>;
+export interface StagedSymlink extends AsyncDisposable {
+    readonly receipt: StagedSymlinkReceipt;
+    assertCurrent(): Promise<void>;
+    publish(basename: string): Promise<PublishedSymlinkReceipt>;
+    /** Check the published name against the still-retained original symlink. */
+    assertPublished(): Promise<void>;
+    /** Explicit recovery only. Never removes an observed foreign replacement. */
+    removePublished(): Promise<StagedSymlinkRemoval>;
+    /** Closes the owner; only an unattempted, still-owned stage is removed. */
+    cleanup(): Promise<StagedSymlinkCleanupReceipt>;
+}

package/node_modules/@openclaw/fs-safe/dist/staged-symlink-types.js

@@ -0,0 +1 @@
+export {};

package/node_modules/@openclaw/fs-safe/dist/stat-observation.js

@@ -1,11 +1,4 @@
-import { FsSafeError } from "./errors.js";
-import { recordFileObservationFailure } from "./file-observation.js";
-import { inspectFileIdentitySync } from "./strict-file-identity.js";
-function identityMismatch() {
-    const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
-    recordFileObservationFailure(error, "identity");
-    throw error;
-}
+import { fileIdentityMismatchError, inspectFileIdentitySync } from "./strict-file-identity.js";
 function safeNumber(value) {
     return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
@@ -35,7 +28,7 @@ function observeStatSync(inspect, expected, initial, platform = process.platform
     const ino = numericIno ? BigInt(rawIno) : typeof rawIno === "bigint" ? rawIno : undefined;
     if (expected && ((dev !== undefined && dev !== expected.dev) ||
         (ino !== undefined && ino !== expected.ino)))
-        identityMismatch();
+        throw fileIdentityMismatchError();
     if (numericDev && numericIno) {
         return (captureIdentity
             ? { stat, identity: expected ?? { dev: dev, ino: ino } }
@@ -47,7 +40,7 @@ function observeStatSync(inspect, expected, initial, platform = process.platform
         const current = inspect(true);
         if ((dev !== undefined && current.dev !== dev) ||
             (ino !== undefined && current.ino !== ino))
-            identityMismatch();
+            throw fileIdentityMismatchError();
         return current;
     }, expected, platform);
     return (captureIdentity

package/node_modules/@openclaw/fs-safe/dist/strict-file-identity.d.ts

@@ -1,5 +1,7 @@
 import type { BigIntStats } from "node:fs";
+import { FsSafeError } from "./errors.js";
 type ExactFileIdentity = Pick<BigIntStats, "dev" | "ino">;
+export declare function fileIdentityMismatchError(): FsSafeError;
 export declare function inspectFileIdentity<T extends ExactFileIdentity>(inspect: () => T | Promise<T>, expected?: ExactFileIdentity, platform?: NodeJS.Platform): Promise<T>;
 export declare function inspectFileIdentitySync<T extends ExactFileIdentity>(inspect: () => T, expected?: ExactFileIdentity, platform?: NodeJS.Platform, mismatch?: () => Error): T;
 export {};

package/node_modules/@openclaw/fs-safe/dist/strict-file-identity.js

@@ -1,6 +1,6 @@
 import { FsSafeError } from "./errors.js";
 import { recordFileObservationFailure } from "./file-observation.js";
-function identityMismatch() {
+export function fileIdentityMismatchError() {
     const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
     recordFileObservationFailure(error, "identity");
     return error;
@@ -13,20 +13,20 @@ function identityCheck(expected, platform) {
             const value = stat[field];
             // Numeric receipts cannot recover identity bits already lost to rounding.
             if (typeof value !== "bigint")
-                throw identityMismatch();
+                throw fileIdentityMismatchError();
             if (platform === "win32" && value === 0n) {
                 complete = false;
             }
             else {
                 if (known[field] !== undefined && known[field] !== value)
-                    throw identityMismatch();
+                    throw fileIdentityMismatchError();
                 known[field] = value;
             }
         }
         return complete;
     };
     if (expected && !check(expected))
-        throw identityMismatch();
+        throw fileIdentityMismatchError();
     return check;
 }
 // Retry only unknown Windows identities, retaining every known component so a
@@ -38,9 +38,9 @@ export async function inspectFileIdentity(inspect, expected, platform = process.
         if (check(stat))
             return stat;
     }
-    throw identityMismatch();
+    throw fileIdentityMismatchError();
 }
-export function inspectFileIdentitySync(inspect, expected, platform = process.platform, mismatch = identityMismatch) {
+export function inspectFileIdentitySync(inspect, expected, platform = process.platform, mismatch = fileIdentityMismatchError) {
     let knownDev;
     let knownIno;
     if (expected) {

package/node_modules/@openclaw/fs-safe/dist/symlink-parents.js

@@ -3,24 +3,46 @@ import path from "node:path";
 import { FsSafeError } from "./errors.js";
 import { hasNodeErrorCode, isPathRelativeEscape } from "./path.js";
 import { assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
+function outsideRootError(params, root) {
+    return new Error(`${params.messagePrefix ?? "Path"} must stay under ${root}.`);
+}
+function pathSegments(value) {
+    return value.split(process.platform === "win32" ? /[/\\]+/ : /\/+/)
+        .filter((segment) => segment.length > 0 && segment !== ".");
+}
+function rawTargetSegments(root, targetPath) {
+    // Resolve only the drive/root or cwd, never the caller's dotdot segments.
+    const targetRoot = path.parse(targetPath).root;
+    const base = resolvePathPreservingWindowsRoot(targetRoot || ".");
+    const absoluteTarget = `${base}${path.sep}${targetPath.slice(targetRoot.length)}`;
+    const rootSegments = pathSegments(root);
+    const targetSegments = pathSegments(absoluteTarget);
+    const fold = (segment) => process.platform === "win32" ? segment.toLowerCase() : segment;
+    if (rootSegments.some((segment, index) => fold(segment) !== fold(targetSegments[index] ?? ""))) {
+        return undefined;
+    }
+    return targetSegments.slice(rootSegments.length);
+}
 function resolvePathWalk(params) {
     const rawRootDir = params.rootDir;
     assertNoWindowsPathAlias(rawRootDir, "filesystem", "root dir uses a Windows filesystem namespace alias");
     const rawTargetPath = params.targetPath;
     assertNoWindowsPathAlias(rawTargetPath, "filesystem", "target path uses a Windows filesystem namespace alias");
     const root = resolvePathPreservingWindowsRoot(rawRootDir);
-    const target = resolvePathPreservingWindowsRoot(rawTargetPath);
-    const relative = path.relative(root, target);
+    const lexicalTarget = resolvePathPreservingWindowsRoot(rawTargetPath);
+    const relative = path.relative(root, lexicalTarget);
     if (isPathRelativeEscape(relative)) {
         if (params.allowOutsideRoot) {
             return null;
         }
-        throw new Error(`${params.messagePrefix ?? "Path"} must stay under ${root}.`);
+        throw outsideRootError(params, root);
     }
-    return {
-        root,
-        segments: relative && relative !== "." ? relative.split(path.sep).filter(Boolean) : [],
-    };
+    const segments = rawTargetSegments(root, rawTargetPath);
+    // A spelling outside the root must not fall back to a normalized walk that
+    // could erase a symlink before the filesystem receives the original path.
+    if (!segments)
+        throw outsideRootError(params, root);
+    return { root, segments };
 }
 function formatUnsafePath(params, current) {
     return `${params.messagePrefix ?? "Path"} must not traverse symlinked directory: ${current}`;
@@ -28,18 +50,39 @@ function formatUnsafePath(params, current) {
 export async function assertNoSymlinkParents(params) {
     assertNoSymlinkParentsSync(params);
 }
+function isFilesystemRoot(root) {
+    return root === path.parse(root).root;
+}
 export function assertNoSymlinkParentsSync(params) {
     const walk = resolvePathWalk(params);
     if (!walk) {
         return;
     }
     let current = walk.root;
+    // `..` may only undo a real directory this walk already lstat'd.
+    const walked = [];
     for (const [index, segment] of walk.segments.entries()) {
+        if (segment === "..") {
+            const top = walked[walked.length - 1];
+            if (top?.kind === "dir") {
+                walked.pop();
+                current = walked[walked.length - 1]?.path ?? walk.root;
+                continue;
+            }
+            if (top?.kind === "symlink") {
+                throw new Error(formatUnsafePath(params, top.path));
+            }
+            if (!isFilesystemRoot(walk.root)) {
+                throw outsideRootError(params, walk.root);
+            }
+            continue;
+        }
         current = path.join(current, segment);
         try {
             const stat = fsSync.lstatSync(current);
             if (stat.isSymbolicLink()) {
                 if (params.allowRootChildSymlink && path.dirname(current) === walk.root) {
+                    walked.push({ path: current, kind: "symlink" });
                     continue;
                 }
                 throw new Error(formatUnsafePath(params, current));
@@ -47,9 +90,17 @@ export function assertNoSymlinkParentsSync(params) {
             if ((params.requireDirectories || index < walk.segments.length - 1) && !stat.isDirectory()) {
                 throw new FsSafeError("not-file", `${params.messagePrefix ?? "Path"} must traverse directories: ${current}`);
             }
+            if (stat.isDirectory()) {
+                walked.push({ path: current, kind: "dir" });
+            }
         }
         catch (err) {
             if (hasNodeErrorCode(err, "ENOENT") && params.allowMissing !== false) {
+                // Win32 can cancel a nonexistent component before filesystem lookup.
+                // Returning early would leave later, reachable symlinks unchecked.
+                if (process.platform === "win32" && walk.segments.slice(index + 1).includes("..")) {
+                    throw new FsSafeError("invalid-path", `${params.messagePrefix ?? "Path"} must not cancel a missing directory: ${current}`);
+                }
                 return;
             }
             throw err;

package/node_modules/@openclaw/fs-safe/dist/temp-target.js

@@ -4,8 +4,9 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { suffixWindowsReservedDeviceName } from "./filename.js";
 import { sameFileIdentityForCleanup } from "./file-identity.js";
-import { assertSafePathSegment, sanitizeSafePathSegment, trimHyphenEdges } from "./safe-path-segment.js";
+import { assertSafePathSegment, isSafePathSegment, normalizeSafePathSegment, trimHyphenEdges, } from "./safe-path-segment.js";
 import { resolveSecureTempRoot } from "./secure-temp-dir.js";
+import { hasNodeErrorCode } from "./path.js";
 import { registerTempPathForExit } from "./temp-cleanup.js";
 import { assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 const HYPHEN_CHAR_CODE = 0x2d;
@@ -59,7 +60,10 @@ function sanitizeExtension(extension) {
     return token ? `.${token}` : "";
 }
 export function sanitizeTempFileName(fileName) {
-    return suffixWindowsReservedDeviceName(sanitizeSafePathSegment(path.basename(fileName)) ?? "download.bin");
+    // Suffix reserved stems before admission so CON.txt stays CON_.txt.
+    const suffixed = suffixWindowsReservedDeviceName(normalizeSafePathSegment(path.basename(fileName)));
+    // The suffix only inserts "_", so this value is already normalized.
+    return isSafePathSegment(suffixed, { allowDotPrefix: true }) ? suffixed : "download.bin";
 }
 export function buildRandomTempFilePath(params) {
     const rootDir = resolveTempRoot(params.rootDir);
@@ -76,12 +80,6 @@ export function buildRandomTempFilePath(params) {
     assertNoWindowsPathAlias(filePath, "filesystem", "temp file path uses a Windows filesystem namespace alias");
     return filePath;
 }
-function isNodeErrorWithCode(err, code) {
-    return (typeof err === "object" &&
-        err !== null &&
-        "code" in err &&
-        err.code === code);
-}
 async function cleanupTempDir(dir, identity, onCleanupError) {
     try {
         const current = fsSync.lstatSync(dir, { bigint: true });
@@ -91,7 +89,7 @@ async function cleanupTempDir(dir, identity, onCleanupError) {
         await fs.rm(dir, { recursive: true, force: true });
     }
     catch (err) {
-        if (!isNodeErrorWithCode(err, "ENOENT")) {
+        if (!hasNodeErrorCode(err, "ENOENT")) {
             onCleanupError?.(err);
         }
     }
@@ -174,7 +172,7 @@ export async function createOwnedTempFile(params) {
                     await owner.cleanup();
                 }
                 catch (err) {
-                    if (!isNodeErrorWithCode(err, "ENOENT")) {
+                    if (!hasNodeErrorCode(err, "ENOENT")) {
                         params.onCleanupError?.(err);
                     }
                 }