@openclaw/openshell-sandbox 2026.9.6 → 2026.9.8

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-admission.js

@@ -4,10 +4,9 @@ import path from "node:path";
 import { inspectDirectoryIdentitySync, observeDirectoryIdentitySync, } from "./directory-guard.js";
 import { admitTempWorkspaceChild, admitTempWorkspaceChildSync, assertTrustedTempWorkspaceDirectory, inspectTempWorkspaceDescriptorIdentitySync, projectTempWorkspaceNumericIdentity, TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY, } from "./temp-workspace-child-admission.js";
 import { FsSafeError } from "./errors.js";
-import { recordFileObservationFailure } from "./file-observation.js";
 import { realpathSync } from "./realpath.js";
 import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
-import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { fileIdentityMismatchError, inspectFileIdentitySync } from "./strict-file-identity.js";
 const WINDOWS = process.platform === "win32";
 function effectiveOwner() {
     // Windows mode/uid fields do not describe ACL authority. The supplied root's
@@ -37,20 +36,21 @@ function copyExactDirectoryObservation(stat) {
         dev: stat.dev,
         ino: stat.ino,
         uid: stat.uid,
+        gid: stat.gid,
         mode: stat.mode,
         directory: stat.isDirectory(),
         symbolicLink: stat.isSymbolicLink(),
     });
 }
-function snapshotFromExactObservation(dir, uid, realPath, stat) {
+function snapshotFromExactObservation(dir, uid, realPath, stat, privateDirectory = false) {
     if (stat.symbolicLink || !stat.directory) {
         throw new FsSafeError("not-file", "temp workspace root component must be a real directory");
     }
-    assertTrustedTempWorkspaceDirectory(stat, uid);
+    assertTrustedTempWorkspaceDirectory(stat, uid, privateDirectory);
     const identity = Object.freeze({ dev: stat.dev, ino: stat.ino });
     // Retain copied immutable scalars, never a mutable Stats object supplied by
     // an observation hook. Every later permission check uses a fresh snapshot.
-    return Object.freeze({ dir, identity, numericIdentity: safeNumericIdentity(stat), realPath });
+    return Object.freeze({ dir, identity, numericIdentity: safeNumericIdentity(stat), realPath, privateDirectory });
 }
 function canonicalTempWorkspacePath(dir) {
     assertNoWindowsPathAlias(dir, "filesystem");
@@ -58,10 +58,10 @@ function canonicalTempWorkspacePath(dir) {
     assertNoWindowsPathAlias(canonical, "filesystem");
     return canonical;
 }
-function snapshot(dir, uid, realPath = canonicalTempWorkspacePath(dir)) {
+function snapshot(dir, uid, realPath = canonicalTempWorkspacePath(dir), privateDirectory = false) {
     const stat = inspectDirectoryIdentitySync(dir);
     const observation = copyExactDirectoryObservation(stat);
-    return { entry: snapshotFromExactObservation(dir, uid, realPath, observation), stat };
+    return { entry: snapshotFromExactObservation(dir, uid, realPath, observation, privateDirectory), stat };
 }
 function hasCompleteExactIdentity(stat) {
     return typeof stat.dev === "bigint" && typeof stat.ino === "bigint" &&
@@ -72,11 +72,6 @@ function assertCanonicalRoot(entry) {
         throw new FsSafeError("path-mismatch", "temp workspace root ancestry changed");
     }
 }
-function identityMismatch() {
-    const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
-    recordFileObservationFailure(error, "identity");
-    throw error;
-}
 function inspectSnapshotIdentity(entry) {
     const expected = entry.numericIdentity;
     if (!expected) {
@@ -87,21 +82,21 @@ function inspectSnapshotIdentity(entry) {
     const devKnown = Number.isSafeInteger(stat.dev) && stat.dev >= 0 && (!WINDOWS || stat.dev !== 0);
     if (devKnown) {
         if (stat.dev !== expected.dev)
-            identityMismatch();
+            throw fileIdentityMismatchError();
     }
     else if (WINDOWS)
         requiresExactRetry = true;
     else
-        identityMismatch();
+        throw fileIdentityMismatchError();
     const inoKnown = Number.isSafeInteger(stat.ino) && stat.ino >= 0 && (!WINDOWS || stat.ino !== 0);
     if (inoKnown) {
         if (stat.ino !== expected.ino)
-            identityMismatch();
+            throw fileIdentityMismatchError();
     }
     else if (WINDOWS)
         requiresExactRetry = true;
     else
-        identityMismatch();
+        throw fileIdentityMismatchError();
     if (!requiresExactRetry)
         return stat;
     // Read exact identity only once. The strict helper may re-check this constant
@@ -111,16 +106,16 @@ function inspectSnapshotIdentity(entry) {
 }
 function assertSnapshot(entry, uid) {
     const stat = inspectSnapshotIdentity(entry);
-    assertTrustedTempWorkspaceDirectory(stat, uid);
+    assertTrustedTempWorkspaceDirectory(stat, uid, entry.privateDirectory);
     assertCanonicalRoot(entry);
 }
-function snapshotMissingRootComponent(parent, dir, ownerUid) {
+function snapshotMissingRootComponent(parent, dir, ownerUid, privateDirectory) {
     if (parent.dir !== parent.realPath) {
         assertSnapshot(parent, ownerUid);
-        return snapshot(dir, ownerUid);
+        return snapshot(dir, ownerUid, undefined, privateDirectory);
     }
     const current = inspectSnapshotIdentity(parent);
-    assertTrustedTempWorkspaceDirectory(current, ownerUid);
+    assertTrustedTempWorkspaceDirectory(current, ownerUid, parent.privateDirectory);
     let realPath;
     try {
         realPath = canonicalTempWorkspacePath(dir);
@@ -132,16 +127,16 @@ function snapshotMissingRootComponent(parent, dir, ownerUid) {
     }
     if (path.dirname(realPath) !== parent.realPath) {
         assertCanonicalRoot(parent);
-        return snapshot(dir, ownerUid);
+        return snapshot(dir, ownerUid, undefined, privateDirectory);
     }
     // The child's canonical parent confirms the same parent name at this phase.
     // Its exact non-symlink/owner observation still precedes mode initialization.
-    return snapshot(dir, ownerUid, realPath);
+    return snapshot(dir, ownerUid, realPath, privateDirectory);
 }
 function assertChain(chain, uid) {
     for (const entry of chain) {
         const current = inspectSnapshotIdentity(entry);
-        assertTrustedTempWorkspaceDirectory(current, uid);
+        assertTrustedTempWorkspaceDirectory(current, uid, entry.privateDirectory);
     }
     const last = chain[chain.length - 1];
     assertCanonicalRoot(last);
@@ -157,14 +152,14 @@ function canonicalAncestry(root) {
 }
 function exactIdentityMatches(current, expected) {
     if (current.dev !== expected.dev || current.ino !== expected.ino)
-        identityMismatch();
+        throw fileIdentityMismatchError();
 }
 function associateTempWorkspaceRoot(entry, ownerUid, descriptorFd) {
     const stat = inspectTempWorkspaceDescriptorIdentitySync(descriptorFd, entry.identity, entry.numericIdentity);
     if (stat.isSymbolicLink() || !stat.isDirectory()) {
         throw new FsSafeError("not-file", "temp workspace cleanup parent must be a real directory");
     }
-    assertTrustedTempWorkspaceDirectory(stat, ownerUid);
+    assertTrustedTempWorkspaceDirectory(stat, ownerUid, entry.privateDirectory);
 }
 function discoverMissingTempWorkspaceAncestor(ancestor, missing, missingError) {
     // The caller already classified the first ENOENT. Keep this handoff out of
@@ -225,14 +220,14 @@ function rootPlan(rootDir) {
     const existingCanonicalRoot = missing.length === 0 && observedAncestor === ancestor &&
         !initial.symbolicLink && initial.directory && hasCompleteExactIdentity(initial);
     if (existingCanonicalRoot) {
-        const discovery = snapshotFromExactObservation(ancestor, ownerUid, ancestor, initial);
+        const discovery = snapshotFromExactObservation(ancestor, ownerUid, ancestor, initial, true);
         return {
             admission: canonicalRootAdmission(discovery, ownerUid),
             missing,
             ownerUid,
         };
     }
-    const chain = canonicalAncestry(ancestor).map((dir) => snapshot(dir, ownerUid, dir).entry);
+    const chain = canonicalAncestry(ancestor).map((dir) => snapshot(dir, ownerUid, dir, missing.length === 0 && dir === ancestor).entry);
     // Missing-component creation needs a replay before its first mutation. When
     // the complete root already exists through an alias, retain the historical
     // guarded route because discovery and mutation use different path spellings.
@@ -292,10 +287,10 @@ function canonicalRootAdmission(discovery, ownerUid) {
             const ancestry = canonicalAncestry(discovery.dir);
             const candidate = ancestry.map((dir, index) => {
                 if (!TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY || index !== ancestry.length - 1) {
-                    return snapshot(dir, ownerUid, dir).entry;
+                    return snapshot(dir, ownerUid, dir, index === ancestry.length - 1 && discovery.privateDirectory).entry;
                 }
                 const current = inspectSnapshotIdentity(discovery);
-                assertTrustedTempWorkspaceDirectory(current, ownerUid);
+                assertTrustedTempWorkspaceDirectory(current, ownerUid, discovery.privateDirectory);
                 return discovery;
             });
             const current = candidate[candidate.length - 1];
@@ -338,7 +333,7 @@ export async function admitTempWorkspaceRoot(rootDir) {
     if (admission)
         return admission;
     const guardedChain = chain;
-    for (const segment of missing) {
+    for (const [index, segment] of missing.entries()) {
         const parentEntry = guardedChain[guardedChain.length - 1];
         const parent = rootAdmission(guardedChain, ownerUid);
         const dir = path.join(parent.dir, segment);
@@ -353,7 +348,7 @@ export async function admitTempWorkspaceRoot(rootDir) {
             if (error.code !== "EEXIST")
                 throw error;
         }
-        const observed = snapshotMissingRootComponent(parentEntry, dir, ownerUid);
+        const observed = snapshotMissingRootComponent(parentEntry, dir, ownerUid, index === missing.length - 1);
         if (created) {
             const modeInitialization = admitTempWorkspaceChild(dir, observed.stat, parent, 0o700);
             if (modeInitialization)
@@ -368,7 +363,7 @@ export function admitTempWorkspaceRootSync(rootDir) {
     if (admission)
         return admission;
     const guardedChain = chain;
-    for (const segment of missing) {
+    for (const [index, segment] of missing.entries()) {
         const parentEntry = guardedChain[guardedChain.length - 1];
         const parent = rootAdmission(guardedChain, ownerUid);
         const dir = path.join(parent.dir, segment);
@@ -383,7 +378,7 @@ export function admitTempWorkspaceRootSync(rootDir) {
             if (error.code !== "EEXIST")
                 throw error;
         }
-        const observed = snapshotMissingRootComponent(parentEntry, dir, ownerUid);
+        const observed = snapshotMissingRootComponent(parentEntry, dir, ownerUid, index === missing.length - 1);
         if (created)
             admitTempWorkspaceChildSync(dir, observed.stat, parent, 0o700);
         guardedChain.push(observed.entry);

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-child-admission.d.ts

@@ -14,7 +14,7 @@ export declare function projectTempWorkspaceNumericIdentity(identity: TempWorksp
 export declare function inspectTempWorkspaceDescriptorIdentitySync(fd: number, expected: TempWorkspaceIdentity, numeric: TempWorkspaceNumericIdentity | undefined): TempWorkspaceIdentityStat;
 export declare function inspectTempWorkspaceDirectoryIdentitySync(dir: string, expected: TempWorkspaceIdentity, numeric: TempWorkspaceNumericIdentity | undefined): TempWorkspaceIdentityStat;
 export declare function validateTempWorkspaceDirMode(mode: number): void;
-export declare function assertTrustedTempWorkspaceDirectory(stat: Pick<BigIntStats, "uid" | "mode"> | Pick<Stats, "uid" | "mode">, uid: number | undefined, child?: boolean): void;
+export declare function assertTrustedTempWorkspaceDirectory(stat: Pick<BigIntStats, "uid" | "gid" | "mode"> | Pick<Stats, "uid" | "gid" | "mode">, uid: number | undefined, privateDirectory?: boolean): void;
 export declare function assertTempWorkspaceChildState(stat: BigIntStats | Stats, ownerUid: number | undefined): void;
 export declare function validateInitialTempWorkspaceChild(stat: BigIntStats, ownerUid: number | undefined, mode: number): boolean;
 export declare function childHasRequestedMode(stat: BigIntStats | Stats, mode: number): boolean;

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-child-admission.js

@@ -2,8 +2,8 @@ import fsSync, {} from "node:fs";
 import { inspectDirectoryIdentitySync, observeDirectoryIdentitySync } from "./directory-guard.js";
 import { pinNodeDirectoryForMode, pinNodeDirectoryForModeSync } from "./directory-mode-node.js";
 import { FsSafeError } from "./errors.js";
-import { recordFileObservationFailure } from "./file-observation.js";
-import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { fileIdentityMismatchError, inspectFileIdentitySync } from "./strict-file-identity.js";
+import { classifyTempWorkspaceOwner, warnUnmappedTempWorkspaceAncestor } from "./temp-workspace-ownership.js";
 export const TEMP_WORKSPACE_NUMERIC_IDENTITY_REPLAY = process.platform === "linux" || process.platform === "darwin";
 export function projectTempWorkspaceNumericIdentity(identity) {
     const dev = Number(identity.dev);
@@ -14,15 +14,10 @@ export function projectTempWorkspaceNumericIdentity(identity) {
     }
     return Object.freeze({ dev, ino });
 }
-function identityMismatch() {
-    const error = new FsSafeError("path-mismatch", "file identity changed or could not be verified");
-    recordFileObservationFailure(error, "identity");
-    throw error;
-}
 function inspectNumericIdentity(current, expected) {
     if (!Number.isSafeInteger(current.dev) || current.dev < 0 || current.dev !== expected.dev ||
         !Number.isSafeInteger(current.ino) || current.ino < 0 || current.ino !== expected.ino) {
-        identityMismatch();
+        throw fileIdentityMismatchError();
     }
     return current;
 }
@@ -48,16 +43,16 @@ export function validateTempWorkspaceDirMode(mode) {
         throw new FsSafeError("insecure-permissions", "temp workspace must not be group/world writable");
     }
 }
-export function assertTrustedTempWorkspaceDirectory(stat, uid, child = false) {
+export function assertTrustedTempWorkspaceDirectory(stat, uid, privateDirectory = false) {
     if (uid === undefined)
         return;
-    const ownedByUser = typeof stat.uid === "bigint" ? stat.uid === BigInt(uid) : stat.uid === uid;
-    const ownedByRoot = typeof stat.uid === "bigint" ? stat.uid === 0n : stat.uid === 0;
-    if (!ownedByUser && (child || !ownedByRoot)) {
-        throw new FsSafeError("not-owned", "temp workspace directory has an untrusted owner");
+    const ownership = classifyTempWorkspaceOwner(stat, uid);
+    if (ownership === "foreign" || (privateDirectory && ownership !== "user")) {
+        throw new FsSafeError("not-owned", "temp workspace directory has an untrusted owner; use a private temp root owned by the effective user under a trusted directory hierarchy");
     }
-    // A root/current-user-owned sticky directory protects children owned by us,
-    // including the usual shared system temp directory. Never chmod that parent.
+    // Unmapped host owners are unverifiable; trust the host directory hierarchy.
+    // Admit sticky ancestors so PrivateUsers keeps host /tmp and PrivateTmp usable.
+    // Leaf roots stay euid-owned/private; non-sticky writable ancestors are rejected.
     const writable = typeof stat.mode === "bigint"
         ? (stat.mode & 18n) !== 0n
         : Number.isSafeInteger(stat.mode) && stat.mode >= 0 && (stat.mode & 0o022) !== 0;
@@ -67,9 +62,13 @@ export function assertTrustedTempWorkspaceDirectory(stat, uid, child = false) {
     if (typeof stat.mode !== "bigint" && (!Number.isSafeInteger(stat.mode) || stat.mode < 0)) {
         throw new FsSafeError("insecure-permissions", "temp workspace directory permissions are invalid");
     }
-    if (writable && (child || !sticky)) {
-        throw new FsSafeError("insecure-permissions", "temp workspace directory is group/world writable without sticky protection");
+    if (writable && (privateDirectory || !sticky)) {
+        throw new FsSafeError("insecure-permissions", privateDirectory
+            ? "temp workspace root and child must not be group/world writable; use a private temp directory"
+            : "temp workspace ancestor is group/world writable without sticky protection");
     }
+    if (ownership === "unmapped")
+        warnUnmappedTempWorkspaceAncestor();
 }
 const WINDOWS = process.platform === "win32";
 export function assertTempWorkspaceChildState(stat, ownerUid) {

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-descriptor.js

@@ -1,7 +1,6 @@
 import fsSync from "node:fs";
 import fs from "node:fs/promises";
-import { nodeDirectorySearchOnlyFlags } from "./directory-mode-node.js";
-import { assertOwnedDirectory } from "./directory-mode-owner.js";
+import { nodeDirectorySearchOnlyFlags, assertOwnedDirectory } from "./directory-mode-node.js";
 import { FsSafeError } from "./errors.js";
 import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-owner.js

@@ -14,13 +14,6 @@ function isNativeCleanupBinding(binding) {
         typeof binding.removeOwnedTreeSync === "function" &&
         typeof binding.ownedTreeRemovalAvailable === "function";
 }
-function nativeRemovalError(result) {
-    if (!result.errorCode)
-        return undefined;
-    return Object.assign(new Error(result.errorMessage ?? "native owned-tree cleanup failed"), {
-        code: result.errorCode,
-    });
-}
 export class TempWorkspaceCleanupCapability {
     binding;
     parent;
@@ -309,8 +302,10 @@ export class TempWorkspaceCleanupOwner {
         this.#capability.assertCurrent();
     }
     #mapRemoval(result) {
-        const error = nativeRemovalError(result);
-        if (error) {
+        if (result.errorCode) {
+            const error = Object.assign(new Error(result.errorMessage ?? "native owned-tree cleanup failed"), {
+                code: result.errorCode,
+            });
             if (error.code === "path-mismatch")
                 return "indeterminate";
             throw error;

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-ownership.d.ts

@@ -0,0 +1,8 @@
+type DirectoryOwner = {
+    uid: number | bigint;
+    gid: number | bigint;
+};
+export type TempWorkspaceOwnership = "user" | "root" | "unmapped" | "foreign";
+export declare function classifyTempWorkspaceOwner(stat: DirectoryOwner, uid: number): TempWorkspaceOwnership;
+export declare function warnUnmappedTempWorkspaceAncestor(): void;
+export {};

package/node_modules/@openclaw/fs-safe/dist/temp-workspace-ownership.js

@@ -0,0 +1,52 @@
+import fs from "node:fs";
+let warned = false;
+function overflowId(kind) {
+    try {
+        const value = Number(fs.readFileSync(`/proc/sys/kernel/overflow${kind}`, "utf8").trim());
+        if (Number.isSafeInteger(value) && value >= 0 && value < 0xffffffff)
+            return value;
+    }
+    catch {
+        // Linux defaults when the sysctl files are unavailable in the service mount.
+    }
+    return 65534;
+}
+function unmappedId(kind) {
+    const mappings = fs.readFileSync(`/proc/self/${kind}_map`, "utf8").trim()
+        .split("\n").map((line) => line.trim().split(/\s+/).map(Number));
+    if (!mappings.every((row) => row.length === 3 && row.every((id) => Number.isSafeInteger(id) && id >= 0 && id <= 0xffffffff) && row[2] > 0))
+        return null;
+    if (mappings.length === 1 && mappings[0][0] === 0 &&
+        mappings[0][1] === 0 && mappings[0][2] === 0xffffffff)
+        return null;
+    const id = overflowId(kind);
+    // Recheck every admission: an explicitly mapped overflow-number ID is real ownership.
+    return mappings.some(([start, , count]) => id >= start && id < start + count) ? null : id;
+}
+export function classifyTempWorkspaceOwner(stat, uid) {
+    if (stat.uid === uid || stat.uid === BigInt(uid))
+        return "user";
+    if (stat.uid === 0 || stat.uid === 0n)
+        return "root";
+    if (process.platform !== "linux")
+        return "foreign";
+    try {
+        const overflowUid = unmappedId("uid");
+        const overflowGid = unmappedId("gid");
+        return overflowUid !== null && overflowGid !== null &&
+            (stat.uid === overflowUid || stat.uid === BigInt(overflowUid)) &&
+            (stat.gid === overflowGid || stat.gid === BigInt(overflowGid))
+            ? "unmapped"
+            : "foreign";
+    }
+    catch {
+        // Unavailable mapping evidence cannot authorize the namespace exception.
+        return "foreign";
+    }
+}
+export function warnUnmappedTempWorkspaceAncestor() {
+    if (warned)
+        return;
+    warned = true;
+    process.emitWarning("Temp workspace ancestor ownership is unverifiable in this user namespace; trusting the host directory hierarchy while enforcing ancestor modes and a process-owned private root.", { code: "FS_SAFE_UNMAPPED_TEMP_ANCESTOR", type: "FsSafeWarning" });
+}

package/node_modules/@openclaw/fs-safe/dist/test-hooks.d.ts

@@ -1,6 +1,10 @@
 import type { FileHandle } from "node:fs/promises";
 import type { FileIdentityStat } from "./file-identity.js";
 export type FsSafeTestHooks = {
+    beforeWatchRegistration?: (path: string) => void | Promise<void>;
+    afterWatchRegistration?: (path: string) => void | Promise<void>;
+    afterWatchBackendOverflow?: (root: string, phase: "received" | "reconciled") => void;
+    afterWatchBackendCreated?: (root: string, emit: (batch: import("./watch-native.js").NativeWatchBatch) => void, nativeEvent?: (path: string, flags: number) => void) => void;
     afterPreOpenLstat?: (filePath: string) => Promise<void> | void;
     beforeOpen?: (filePath: string, flags: number) => Promise<void> | void;
     afterOpen?: (filePath: string, handle: FileHandle) => Promise<void> | void;
@@ -25,7 +29,7 @@ export type FsSafeTestHooks = {
     beforeTempWorkspaceNativeRemovalSync?: (quarantinePath: string) => void;
     beforeTrashMove?: (targetPath: string, destPath: string) => void;
     afterPublishTargetCreated?: (method: "hardlink" | "exclusive-copy" | "rename-noreplace", targetPath: string, identity: FileIdentityStat) => Promise<void> | void;
-    beforePublishDirectorySync?: (method: "hardlink" | "exclusive-copy" | "rename-noreplace", targetPath: string, identity: FileIdentityStat) => Promise<void> | void;
+    beforePublishDirectorySync?: NonNullable<FsSafeTestHooks["afterPublishTargetCreated"]>;
 };
 export declare function getFsSafeTestHooks(): FsSafeTestHooks | undefined;
 export declare function __setFsSafeTestHooksForTest(hooks?: FsSafeTestHooks): void;

package/node_modules/@openclaw/fs-safe/dist/text-atomic.d.ts

@@ -1,4 +1,5 @@
-export type WriteTextAtomicOptions = {
+import { type ReplaceFileAtomicOptions } from "./replace-file.js";
+export type WriteTextAtomicOptions = Pick<ReplaceFileAtomicOptions, "beforeRename" | "tempPrefix"> & {
     mode?: number;
     dirMode?: number;
     trailingNewline?: boolean;

package/node_modules/@openclaw/fs-safe/dist/text-atomic.js

@@ -12,5 +12,7 @@ export async function writeTextAtomic(filePath, content, options) {
         copyFallbackOnPermissionError: true,
         syncTempFile: durable,
         syncParentDir: durable,
+        beforeRename: options?.beforeRename,
+        tempPrefix: options?.tempPrefix,
     });
 }

package/node_modules/@openclaw/fs-safe/dist/trash.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { assertSyncDirectoryGuard, createSyncDirectoryGuard } from "./directory-guard.js";
 import { sameFileIdentity } from "./file-identity.js";
 import { guardedRenameSync, guardedRmSync } from "./guarded-mutation.js";
 import { realpathSync } from "./realpath.js";
@@ -72,6 +73,22 @@ function resolveTrashTargetPath(targetPath) {
     assertNoTrashPathAlias(resolvedPath, "target path");
     return { path: resolvedPath, resolved: true };
 }
+function resolveTrashEntryParent(lexicalTarget, targetPath) {
+    const lexicalParent = path.dirname(lexicalTarget);
+    assertNoTrashPathAlias(lexicalParent, "target path");
+    let realParent;
+    try {
+        // The renamed name lives in this parent. rename follows intermediate
+        // symlinks, so a lexical parent inside an allowed root is not enough.
+        realParent = realpathSync.native(lexicalParent);
+    }
+    catch {
+        throw new Error(`Refusing to trash path outside allowed roots: ${targetPath}`);
+    }
+    const resolvedParent = path.resolve(realParent);
+    assertNoTrashPathAlias(resolvedParent, "target path");
+    return resolvedParent;
+}
 function assertAllowedTrashTarget(targetPath, allowedRoots) {
     assertNoTrashPathAlias(targetPath, "target path");
     const lexicalTarget = path.resolve(targetPath);
@@ -79,11 +96,19 @@ function assertAllowedTrashTarget(targetPath, allowedRoots) {
     const stat = fs.lstatSync(lexicalTarget);
     const resolvedTarget = resolveTrashTargetPath(targetPath);
     const resolvedTargetPath = resolvedTarget.path;
-    const isAllowed = resolveAllowedTrashRoots(allowedRoots).some((root) => resolvedTargetPath !== root && isSameOrChildPath(resolvedTargetPath, root));
+    const parent = createSyncDirectoryGuard(path.dirname(lexicalTarget));
+    // Admit the directory entry only when its parent really stays inside an
+    // allowed root. Do not admit it because the symlink target is inside.
+    const resolvedParent = resolveTrashEntryParent(lexicalTarget, targetPath);
+    const isAllowed = resolveAllowedTrashRoots(allowedRoots).some((root) => isSameOrChildPath(resolvedParent, root));
     if (!isAllowed) {
         throw new Error(`Refusing to trash path outside allowed roots: ${targetPath}`);
     }
+    // Sync and native realpath can use different Windows short-name spellings.
+    // Recheck the retained guard around native containment instead of comparing them.
+    assertSyncDirectoryGuard(parent);
     return {
+        parent,
         path: lexicalTarget,
         realPath: resolvedTargetPath,
         realPathResolved: resolvedTarget.resolved,
@@ -91,6 +116,7 @@ function assertAllowedTrashTarget(targetPath, allowedRoots) {
     };
 }
 function assertTrashTargetGuard(guard) {
+    assertSyncDirectoryGuard(guard.parent);
     const stat = fs.lstatSync(guard.path);
     if (!sameFileIdentity(stat, guard.stat)) {
         throw new Error(`Refusing to trash path after it changed: ${guard.path}`);

package/node_modules/@openclaw/fs-safe/dist/walk.d.ts

@@ -20,12 +20,9 @@ export type AsyncWalkDirectoryOptions = Omit<WalkDirectoryOptions, "include" | "
     include?: (entry: WalkDirectoryEntry) => boolean | Promise<boolean>;
     descend?: (entry: WalkDirectoryEntry) => boolean | Promise<boolean>;
 };
-export type WalkDirectoryFailure = {
-    path: string;
-    relativePath: string;
-    depth: number;
+export type WalkDirectoryFailure = Pick<WalkDirectoryEntry & {
     error: unknown;
-};
+}, "path" | "relativePath" | "depth" | "error">;
 export type WalkDirectoryResult = {
     entries: WalkDirectoryEntry[];
     scannedEntryCount: number;

package/node_modules/@openclaw/fs-safe/dist/watch-alias.d.ts

@@ -0,0 +1,6 @@
+import { type RootContext } from "./root-context.js";
+import type { NativeWatchBatch } from "./watch-native.js";
+import type { WatchSnapshot } from "./watch-scan.js";
+import type { WatchChange, WatchScope } from "./watch-types.js";
+/** Resolve native spelling aliases without treating case folding as identity. */
+export declare function admittedNativeChanges(root: RootContext, scopes: readonly WatchScope[], before: WatchSnapshot | undefined, after: WatchSnapshot, batch: NativeWatchBatch, signal: AbortSignal, limit: number): Promise<WatchChange[] | undefined>;

package/node_modules/@openclaw/fs-safe/dist/watch-alias.js

@@ -0,0 +1,88 @@
+import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { isNotFoundPathError } from "./path.js";
+import { assertRootIdentityCurrent, resolvePathInRoot } from "./root-context.js";
+import { createRootDirectoryObservationGuard, assertRootDirectoryObservationGuard } from "./root-directory-list.js";
+import { lookupRootDirectoryEntry } from "./root-directory-entry.js";
+import { excludedWatchPath, nativeChanges, scopedChanges } from "./watch-hints.js";
+/** Resolve native spelling aliases without treating case folding as identity. */
+export async function admittedNativeChanges(root, scopes, before, after, batch, signal, limit) {
+    if (!nativeChanges(scopes, before, batch, limit, after))
+        return undefined;
+    const result = new Map();
+    const candidates = new Map([...before?.targets ?? [], ...after.targets, ...after.directories]);
+    const add = (change) => {
+        if (!result.has(change.path) && result.size >= limit)
+            return false;
+        const prior = result.get(change.path);
+        result.set(change.path, prior?.type === "structural" ? prior : change);
+        return true;
+    };
+    for (const hint of batch.hints) {
+        signal.throwIfAborted();
+        const name = hint.name; // nativeChanges rejected unknown or non-literal names.
+        let parent = hint.directory;
+        const relative = parent ? path.join(parent, name) : name;
+        if (excludedWatchPath(before, relative) || excludedWatchPath(after, relative))
+            continue;
+        let guard;
+        let expected = after.directories.get(parent);
+        if (!expected) {
+            // Native recursion observes one Root handle and may report descendants of
+            // unselected/entry-only directories. Admit a parent alias by exact identity,
+            // not by lowercasing, and do not turn unselected descendants into events.
+            try {
+                const resolved = await resolvePathInRoot(root, parent ? "./" + parent : ".", { rejectSymlinks: true });
+                guard = await createRootDirectoryObservationGuard(root, resolved.resolved);
+            }
+            catch (error) {
+                await assertRootIdentityCurrent(root);
+                if (isNotFoundPathError(error) || (error instanceof FsSafeError && ["not-found", "path-alias", "outside-workspace", "symlink", "not-file"].includes(error.code)))
+                    continue;
+                throw error;
+            }
+            const admitted = [...after.directories].find(([, identity]) => identity.dev === guard.stat.dev && identity.ino === guard.stat.ino);
+            if (!admitted)
+                continue;
+            [parent, expected] = admitted;
+        }
+        const candidate = parent ? path.join(parent, name) : name;
+        if (excludedWatchPath(before, candidate) || excludedWatchPath(after, candidate))
+            continue;
+        const selected = scopedChanges(scopes, { path: candidate,
+            type: hint.event === "change" && before?.entries.get(candidate)?.startsWith("file:") ? "content" : "structural" });
+        if (selected.length) {
+            for (const change of selected)
+                if (!add(change))
+                    return undefined;
+            continue;
+        }
+        if (!guard) {
+            const resolved = await resolvePathInRoot(root, parent ? "./" + parent : ".", { rejectSymlinks: true });
+            guard = await createRootDirectoryObservationGuard(root, resolved.resolved);
+        }
+        if (guard.stat.dev !== expected.dev || guard.stat.ino !== expected.ino) {
+            throw new FsSafeError("path-mismatch", "watch hint parent changed during reconciliation");
+        }
+        const found = await lookupRootDirectoryEntry(root, guard, name);
+        signal.throwIfAborted();
+        // A missing unselected sibling is not evidence of lost selected detail.
+        // Previously observed selected deletions remain visible in the snapshot diff;
+        // an unseen, already-gone name has no identity proving a selected alias.
+        if (!found)
+            continue;
+        for (const [relative, identity] of candidates) {
+            if (!relative || (path.dirname(relative) === "." ? "" : path.dirname(relative)) !== parent)
+                continue;
+            if (identity.dev !== found.identity.dev || identity.ino !== found.identity.ino)
+                continue;
+            for (const change of scopedChanges(scopes, { path: relative, type: "structural" }))
+                if (!add(change))
+                    return undefined;
+        }
+        await assertRootDirectoryObservationGuard(root, guard);
+    }
+    await assertRootIdentityCurrent(root);
+    signal.throwIfAborted();
+    return [...result.values()];
+}

package/node_modules/@openclaw/fs-safe/dist/watch-hints.d.ts

@@ -0,0 +1,9 @@
+import type { NativeWatchBatch } from "./watch-native.js";
+import type { WatchSnapshot } from "./watch-scan.js";
+import type { WatchChange, WatchScope } from "./watch-types.js";
+export declare function excludedWatchPath(snapshot: WatchSnapshot | undefined, name: string): boolean;
+export declare function scopedChanges(scopes: readonly WatchScope[], change: WatchChange): WatchChange[];
+export declare function nativeChanges(scopes: readonly WatchScope[], snapshot: WatchSnapshot | undefined, batch: NativeWatchBatch, limit?: number, after?: WatchSnapshot): WatchChange[] | undefined;
+export declare function changedEntries(before: WatchSnapshot | undefined, after: WatchSnapshot, limit: number): WatchChange[] | undefined;
+/** Backend names never establish authority to publish a pathname. */
+export declare function guardedHintChanges(scopes: readonly WatchScope[], before: WatchSnapshot | undefined, after: WatchSnapshot, hints: readonly WatchChange[] | undefined, observed: readonly WatchChange[] | undefined, limit: number): WatchChange[] | undefined;