@openclaw/signal 2026.9.6 → 2026.9.8

package/node_modules/@openclaw/fs-safe/dist/archive-zip-entry.js

@@ -1,42 +1,10 @@
-import { resolveArchiveEntryMode, } from "./archive-plan.js";
-const admittedMetadata = new WeakMap();
-/** Internal: register only after the complete decoder/admission association. */
-export function registerAdmittedZipEntry(entry, physical) {
+/** Internal: create only after the complete decoder/admission association. */
+export function createAdmittedZipEntry(entry, name, physical) {
     const mode = physical.creatorSystem === 3 ? physical.externalAttributes >>> 16 : undefined;
-    admittedMetadata.set(entry, { kind: physical.kind, mode, size: physical.size });
     entry.dir = physical.kind === "directory";
     // Previously unsupported non-UNIX symlinks must also be recognizable to
     // public preflight consumers using JSZip's conventional type inspection.
     entry.unixPermissions = mode ?? (physical.kind === "symlink" ? 0o120000 : null);
     entry.dosPermissions = physical.creatorSystem === 0 ? physical.externalAttributes & 0x3f : null;
-}
-export function zipEntryIntegrityMetadata(entry) {
-    const data = entry._data;
-    if (!data || "then" in data)
-        return undefined;
-    return data;
-}
-const ZIP_UNIX_FILE_TYPE_MASK = 0o170000;
-const ZIP_UNIX_SYMLINK_TYPE = 0o120000;
-export function isZipSymlinkEntry(entry) {
-    return zipEntryKind(entry) === "symlink";
-}
-export function zipEntryKind(entry) {
-    const metadata = admittedMetadata.get(entry);
-    if (metadata)
-        return metadata.kind;
-    return typeof entry.unixPermissions === "number" &&
-        (entry.unixPermissions & ZIP_UNIX_FILE_TYPE_MASK) === ZIP_UNIX_SYMLINK_TYPE
-        ? "symlink" : entry.dir ? "directory" : "file";
-}
-export function zipEntryMode(entry, policy) {
-    const metadata = admittedMetadata.get(entry);
-    return resolveArchiveEntryMode({
-        kind: entry.dir ? "directory" : "file",
-        archivedMode: metadata ? metadata.mode : entry.unixPermissions,
-        policy,
-    });
-}
-export function zipEntryDeclaredSize(entry) {
-    return admittedMetadata.get(entry)?.size ?? Math.max(0, Math.floor(zipEntryIntegrityMetadata(entry)?.uncompressedSize ?? 0));
+    return { entry, name, kind: physical.kind, mode, size: physical.size, crc32: physical.crc32 };
 }

package/node_modules/@openclaw/fs-safe/dist/archive-zip-integrity.d.ts

@@ -1,4 +1,4 @@
 import { Transform } from "node:stream";
-import { type ZipEntry } from "./archive-zip-entry.js";
+import type { AdmittedZipEntry } from "./archive-zip-entry.js";
 export declare function normalizeZipIntegrityError(error: unknown): Error;
-export declare function createZipIntegrityTransform(entry: ZipEntry): Transform;
+export declare function createZipIntegrityTransform(record: AdmittedZipEntry): Transform;

package/node_modules/@openclaw/fs-safe/dist/archive-zip-integrity.js

@@ -1,6 +1,5 @@
 import { Transform } from "node:stream";
 import { ArchiveFormatError } from "./archive-errors.js";
-import { zipEntryIntegrityMetadata, } from "./archive-zip-entry.js";
 import { updateCrc32 } from "./archive-crc32.js";
 export function normalizeZipIntegrityError(error) {
     if (error instanceof Error &&
@@ -9,17 +8,8 @@ export function normalizeZipIntegrityError(error) {
     }
     return error instanceof Error ? error : new Error(String(error));
 }
-export function createZipIntegrityTransform(entry) {
-    const metadata = zipEntryIntegrityMetadata(entry);
-    const expectedCrc32 = metadata?.crc32;
-    const expectedSize = metadata?.uncompressedSize;
-    if (typeof expectedCrc32 !== "number" ||
-        !Number.isInteger(expectedCrc32) ||
-        typeof expectedSize !== "number" ||
-        !Number.isSafeInteger(expectedSize) ||
-        expectedSize < 0) {
-        throw new ArchiveFormatError(`zip entry has invalid integrity metadata: ${entry.name}`);
-    }
+export function createZipIntegrityTransform(record) {
+    const { entry, crc32: expectedCrc32, size: expectedSize } = record;
     let actualCrc32 = 0;
     let actualSize = 0;
     return new Transform({

package/node_modules/@openclaw/fs-safe/dist/archive-zip-loader.d.ts

@@ -1,8 +1,12 @@
 import type { ZipDirectoryEntry } from "./archive-zip-directory.js";
-import { type ZipEntry } from "./archive-zip-entry.js";
+import { type AdmittedZipEntry } from "./archive-zip-entry.js";
 export type ZipArchiveWithFiles = {
     files: Record<string, unknown>;
 };
-export declare function admittedZipEntries(archive: ZipArchiveWithFiles): readonly ZipEntry[];
+export type ZipArchiveAdmission = {
+    archive: ZipArchiveWithFiles;
+    entries: ReadonlyMap<string, AdmittedZipEntry>;
+};
+export declare function assertZipEntryBinding(archive: ZipArchiveWithFiles, record: AdmittedZipEntry, path: string): void;
 /** Internal: the caller has admitted these unchanged bytes and their metadata. */
-export declare function loadAdmittedZipArchive(buffer: Buffer | Uint8Array, admitted: ZipDirectoryEntry[]): Promise<ZipArchiveWithFiles>;
+export declare function loadAdmittedZipArchive(buffer: Buffer | Uint8Array, admitted: ZipDirectoryEntry[]): Promise<ZipArchiveAdmission>;

package/node_modules/@openclaw/fs-safe/dist/archive-zip-loader.js

@@ -1,10 +1,13 @@
 import { ArchiveFormatError, ArchiveSecurityError } from "./archive-errors.js";
-import { validateArchiveEntryPath } from "./archive-entry.js";
-import { registerAdmittedZipEntry } from "./archive-zip-entry.js";
+import { createArchiveOutputPathTracker, validateArchiveEntryPath } from "./archive-entry.js";
+import { createAdmittedZipEntry } from "./archive-zip-entry.js";
 import { zipPathKey } from "./archive-zip-names.js";
-const orderedEntries = new WeakMap();
-export function admittedZipEntries(archive) {
-    return orderedEntries.get(archive) ?? disagreement();
+export function assertZipEntryBinding(archive, record, path) {
+    const { entry } = record;
+    const name = entry.name;
+    validateArchiveEntryPath(name, { escapeLabel: "archive root" });
+    if (archive.files[record.name] !== entry || zipPathKey(name) !== path)
+        disagreement();
 }
 function disagreement() {
     throw new ArchiveFormatError("ZIP decoder disagrees with admitted directory metadata");
@@ -24,7 +27,9 @@ function matchesData(value, physical) {
 /** Internal: the caller has admitted these unchanged bytes and their metadata. */
 export async function loadAdmittedZipArchive(buffer, admitted) {
     const physicalByPath = new Map();
+    const trackOutputPath = createArchiveOutputPathTracker();
     for (const entry of admitted) {
+        trackOutputPath(entry.portableKey, entry.portableKey);
         if (physicalByPath.has(entry.portableKey))
             collision();
         physicalByPath.set(entry.portableKey, entry);
@@ -110,7 +115,7 @@ export async function loadAdmittedZipArchive(buffer, admitted) {
     if (remaining.size || inserted.size)
         disagreement();
     const files = Object.create(null);
-    const entries = [];
+    const entries = new Map();
     for (const [name, entry, physical] of normalized) {
         const appendSlash = physical.kind === "directory" && !name.endsWith("/");
         const normalizedName = appendSlash ? `${name}/` : name;
@@ -120,12 +125,10 @@ export async function loadAdmittedZipArchive(buffer, admitted) {
             entry.name = `${entry.name}/`;
         }
         files[normalizedName] = entry;
-        registerAdmittedZipEntry(entry, physical);
-        entries.push(entry);
+        entries.set(physical.portableKey, createAdmittedZipEntry(entry, normalizedName, physical));
     }
     archive.files = files;
-    orderedEntries.set(archive, entries);
-    return archive;
+    return { archive, entries };
 }
 async function importOptionalJsZip() {
     try {

package/node_modules/@openclaw/fs-safe/dist/archive-zip-manifest.js

@@ -1,10 +1,11 @@
 import { ArchiveFormatError, ArchiveSecurityError } from "./archive-errors.js";
-import { stripArchivePath } from "./archive-entry.js";
+import { createArchiveOutputPathTracker, stripArchivePath } from "./archive-entry.js";
 /** Associate all native entries with physical admission before exposing any. */
 export function validateNativeZipManifest(manifest, admitted) {
     if (manifest.length !== admitted.length) {
         throw new ArchiveSecurityError("entry-path", "zip decoder collapsed entry names");
     }
+    const trackOutputPath = createArchiveOutputPathTracker();
     for (const [ordinal, entry] of manifest.entries()) {
         const physical = admitted[ordinal];
         const physicalPath = physical?.path;
@@ -18,5 +19,6 @@ export function validateNativeZipManifest(manifest, admitted) {
             (physical.creatorSystem === 3 && entry.mode !== physical.externalAttributes >>> 16)) {
             throw new ArchiveFormatError("ZIP decoder disagrees with admitted directory metadata");
         }
+        trackOutputPath(entry.path, entry.path);
     }
 }

package/node_modules/@openclaw/fs-safe/dist/archive-zip-preflight.d.ts

@@ -1,5 +1,4 @@
 import { type ArchiveExtractLimits } from "./archive-limits.js";
-import { type ZipArchiveWithFiles } from "./archive-zip-loader.js";
-export { readZipCentralDirectoryEntryCount } from "./archive-zip-count.js";
-export type { ZipArchiveWithFiles } from "./archive-zip-loader.js";
+import { type ZipArchiveAdmission, type ZipArchiveWithFiles } from "./archive-zip-loader.js";
+export declare function loadZipArchiveWithAdmission(buffer: Buffer | Uint8Array, limits?: ArchiveExtractLimits): Promise<ZipArchiveAdmission>;
 export declare function loadZipArchiveWithPreflight(buffer: Buffer | Uint8Array, limits?: ArchiveExtractLimits): Promise<ZipArchiveWithFiles>;

package/node_modules/@openclaw/fs-safe/dist/archive-zip-preflight.js

@@ -1,13 +1,21 @@
 import { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError, resolveExtractLimits, } from "./archive-limits.js";
 import { admitZipBuffer } from "./archive-zip-admission.js";
 import { loadAdmittedZipArchive } from "./archive-zip-loader.js";
-export { readZipCentralDirectoryEntryCount } from "./archive-zip-count.js";
-export async function loadZipArchiveWithPreflight(buffer, limits) {
-    const resolvedLimits = resolveExtractLimits(limits);
-    if (buffer.byteLength > resolvedLimits.maxArchiveBytes) {
-        throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.ARCHIVE_SIZE_EXCEEDS_LIMIT);
+export function loadZipArchiveWithAdmission(buffer, limits) {
+    try {
+        const resolvedLimits = resolveExtractLimits(limits);
+        if (buffer.byteLength > resolvedLimits.maxArchiveBytes) {
+            throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.ARCHIVE_SIZE_EXCEEDS_LIMIT);
+        }
+        const entries = [];
+        admitZipBuffer(buffer, resolvedLimits, entry => { entries.push(entry); });
+        return loadAdmittedZipArchive(buffer, entries);
+    }
+    catch (error) {
+        // Keep validation failures in the promise handed to the extraction deadline.
+        return Promise.reject(error);
     }
-    const entries = [];
-    admitZipBuffer(buffer, resolvedLimits, entry => { entries.push(entry); });
-    return await loadAdmittedZipArchive(buffer, entries);
+}
+export async function loadZipArchiveWithPreflight(buffer, limits) {
+    return (await loadZipArchiveWithAdmission(buffer, limits)).archive;
 }

package/node_modules/@openclaw/fs-safe/dist/archive.d.ts

@@ -6,10 +6,13 @@ export { resolveArchiveKind, resolvePackedRootDir, type ArchiveKind } from "./ar
 export { readArchiveEntry } from "./archive-read.js";
 export { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError, DEFAULT_MAX_ARCHIVE_BYTES_ZIP, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_EXTRACTED_BYTES, DEFAULT_MAX_ENTRY_BYTES, DEFAULT_MAX_META_ENTRY_BYTES, DEFAULT_MAX_ENTRY_PATH_COMPONENTS, type ArchiveExtractLimits, type ArchiveLimitErrorCode, } from "./archive-limits.js";
 export { ArchiveFormatError, type ArchiveFormatErrorCode } from "./archive-errors.js";
-export { ArchiveSecurityError, type ArchiveSecurityErrorCode } from "./archive-staging.js";
-export { createArchiveSymlinkTraversalError, mergeExtractedTreeIntoDestination, prepareArchiveDestinationDir, prepareArchiveOutputPath, withStagedArchiveDestination, } from "./archive-staging.js";
+export { ArchiveSecurityError, type ArchiveSecurityErrorCode } from "./archive-errors.js";
+export { createArchiveSymlinkTraversalError, prepareArchiveDestinationDir, prepareArchiveOutputPath, withStagedArchiveDestination, } from "./archive-staging.js";
+export { mergeExtractedTreeIntoDestination } from "./archive-merge.js";
 export { createTarEntryPreflightChecker, type TarEntryInfo } from "./archive-plan.js";
-export { loadZipArchiveWithPreflight, readZipCentralDirectoryEntryCount, type ZipArchiveWithFiles, } from "./archive-zip-preflight.js";
+export { loadZipArchiveWithPreflight } from "./archive-zip-preflight.js";
+export { readZipCentralDirectoryEntryCount } from "./archive-zip-count.js";
+export type { ZipArchiveWithFiles } from "./archive-zip-loader.js";
 export declare function extractArchive(params: ExtractArchiveOptions): Promise<void>;
 export type InspectTarArchiveOptions = Pick<ExtractArchiveOptions, "archivePath" | "timeoutMs" | "limits" | "entryFilter" | "onFiltered">;
 export type InspectedTarEntry = Readonly<Pick<ArchivePlanEntry, "path" | "kind" | "size">>;

package/node_modules/@openclaw/fs-safe/dist/archive.js

@@ -1,4 +1,4 @@
-import { createTarEntryPlanner, createArchiveEntrySelector, resolveArchiveFilteredEntryPolicy, createArchiveEntryPlanner, } from "./archive-plan.js";
+import { createTarEntryPlanner, createArchiveEntrySelector, resolveArchiveFilteredEntryPolicy, resolveArchiveEntryMode, createArchiveEntryPlanner, } from "./archive-plan.js";
 import { inspectTar, replayTar } from "./archive-tar-stream.js";
 import { runPinnedWriteHelper } from "./pinned-write.js";
 import { constants as fsConstants } from "node:fs";
@@ -11,9 +11,7 @@ import { assertArchiveEntryCountWithinLimit, createByteBudgetTracker, createExtr
 import { resolveArchiveKind } from "./archive-kind.js";
 import { prepareArchiveDestinationGuard, preparePrivateArchiveOutputPath, } from "./archive-staging.js";
 import { withStagedArchivePublication } from "./archive-merge.js";
-import { loadZipArchiveWithPreflight } from "./archive-zip-preflight.js";
-import { admittedZipEntries } from "./archive-zip-loader.js";
-import { zipEntryKind, zipEntryDeclaredSize, zipEntryMode, } from "./archive-zip-entry.js";
+import { loadZipArchiveWithAdmission } from "./archive-zip-preflight.js";
 import { createZipIntegrityTransform, normalizeZipIntegrityError, } from "./archive-zip-integrity.js";
 import { ArchiveSecurityError, ArchiveFormatError, isArchiveFormatErrorMessage, } from "./archive-errors.js";
 import { stageArchiveFileForExtraction } from "./archive-input.js";
@@ -29,10 +27,12 @@ export { resolveArchiveKind, resolvePackedRootDir } from "./archive-kind.js";
 export { readArchiveEntry } from "./archive-read.js";
 export { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError, DEFAULT_MAX_ARCHIVE_BYTES_ZIP, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_EXTRACTED_BYTES, DEFAULT_MAX_ENTRY_BYTES, DEFAULT_MAX_META_ENTRY_BYTES, DEFAULT_MAX_ENTRY_PATH_COMPONENTS, } from "./archive-limits.js";
 export { ArchiveFormatError } from "./archive-errors.js";
-export { ArchiveSecurityError } from "./archive-staging.js";
-export { createArchiveSymlinkTraversalError, mergeExtractedTreeIntoDestination, prepareArchiveDestinationDir, prepareArchiveOutputPath, withStagedArchiveDestination, } from "./archive-staging.js";
+export { ArchiveSecurityError } from "./archive-errors.js";
+export { createArchiveSymlinkTraversalError, prepareArchiveDestinationDir, prepareArchiveOutputPath, withStagedArchiveDestination, } from "./archive-staging.js";
+export { mergeExtractedTreeIntoDestination } from "./archive-merge.js";
 export { createTarEntryPreflightChecker } from "./archive-plan.js";
-export { loadZipArchiveWithPreflight, readZipCentralDirectoryEntryCount, } from "./archive-zip-preflight.js";
+export { loadZipArchiveWithPreflight } from "./archive-zip-preflight.js";
+export { readZipCentralDirectoryEntryCount } from "./archive-zip-count.js";
 const SUPPORTS_NOFOLLOW = process.platform !== "win32" && "O_NOFOLLOW" in fsConstants;
 const OPEN_WRITE_CREATE_FLAGS = fsConstants.O_WRONLY |
     fsConstants.O_CREAT |
@@ -49,7 +49,7 @@ async function readZipEntryStream(entry) {
 async function writeZipFileEntry(params) {
     params.deadline.check();
     params.budget.startEntry();
-    const readable = await readZipEntryStream(params.entry);
+    const readable = await readZipEntryStream(params.record.entry);
     const destinationPath = params.outPath;
     let tempHandle = null;
     let handleClosedByStream = false;
@@ -67,7 +67,7 @@ async function writeZipFileEntry(params) {
                     handleClosedByStream = true;
                 });
                 try {
-                    await pipeline(readable, createExtractBudgetTransform({ onChunkBytes: params.budget.addBytes }), createZipIntegrityTransform(params.entry), writable, { signal: params.deadline.signal });
+                    await pipeline(readable, createExtractBudgetTransform({ onChunkBytes: params.budget.addBytes }), createZipIntegrityTransform(params.record), writable, { signal: params.deadline.signal });
                 }
                 catch (err) {
                     throw normalizeZipIntegrityError(createPipelineTimeoutError(err, params.deadline));
@@ -101,26 +101,29 @@ async function extractZip(params) {
     deadline.check();
     const buffer = await fs.readFile(params.archivePath, { signal: deadline.signal });
     deadline.check();
-    const zip = await waitForDeadline(loadZipArchiveWithPreflight(buffer, limits), deadline);
+    const { entries } = await waitForDeadline(loadZipArchiveWithAdmission(buffer, limits), deadline);
     deadline.check();
-    const entries = admittedZipEntries(zip);
-    assertArchiveEntryCountWithinLimit(entries.length, limits);
+    assertArchiveEntryCountWithinLimit(entries.size, limits);
     const budget = createByteBudgetTracker(limits);
     await withStagedArchivePublication({ ...params, destinationGuard }, async (stagingDir) => {
         const { select } = createArchiveEntrySelector({ ...params, rootDir: stagingDir });
         const acceptedEntries = [];
-        for (const entry of entries) {
+        for (const record of entries.values()) {
             deadline.check();
-            const entryKind = zipEntryKind(entry);
-            const relPath = select({ path: entry.name, kind: entryKind, size: zipEntryDeclaredSize(entry) });
+            const { entry, kind: entryKind, size, mode: archivedMode } = record;
+            const relPath = select({ path: record.name, kind: entryKind, size });
             if (relPath === null)
                 continue;
             if (entryKind === "symlink") {
-                throw new ArchiveSecurityError("entry-link", `zip entry is a link: ${entry.name}`);
+                throw new ArchiveSecurityError("entry-link", `zip entry is a link: ${record.name}`);
             }
             if (entryKind === "other")
                 continue;
-            const mode = zipEntryMode(entry, params.entryModes);
+            const mode = resolveArchiveEntryMode({
+                kind: entry.dir ? "directory" : "file",
+                archivedMode,
+                policy: params.entryModes,
+            });
             acceptedEntries.push({ path: relPath, kind: entry.dir ? "directory" : "file", mode });
             const outPath = path.join(stagingDir, relPath);
             await preparePrivateArchiveOutputPath({
@@ -128,12 +131,12 @@ async function extractZip(params) {
                 destinationRealDir: stagingDir,
                 relPath,
                 outPath,
-                originalPath: entry.name,
+                originalPath: record.name,
                 isDirectory: entry.dir,
                 deadline,
             });
             if (!entry.dir) {
-                await writeZipFileEntry({ entry, outPath, budget, deadline });
+                await writeZipFileEntry({ record, outPath, budget, deadline });
             }
         }
         return acceptedEntries;

package/node_modules/@openclaw/fs-safe/dist/atomic.d.ts

@@ -1,4 +1,4 @@
-export { replaceFileAtomic, replaceFileAtomicSync, type ReplaceFileAtomicFileSystem, type ReplaceFileAtomicOptions, type ReplaceFileAtomicResult, type ReplaceFileAtomicSyncFileSystem, type ReplaceFileAtomicSyncOptions, } from "./replace-file.js";
+export { replaceFileAtomic, replaceFileAtomicSync, type ReplaceFileAtomicFileSystem, type ReplaceFileAtomicOptions, type ReplaceFileAtomicResult, type ReplaceFileAtomicDestinationState, type ReplaceFileAtomicSyncFileSystem, type ReplaceFileAtomicSyncOptions, } from "./replace-file.js";
 export type { RenameIdentityPolicy } from "./pinned-write-types.js";
 export type { ReplaceFileAtomicRestoreCleanup, ReplaceFileAtomicRestoreFailureDetails, ReplaceFileCopyFallbackRestorePolicy, ReplaceFileDestinationHardlinkPolicy, } from "./replace-file-copy-fallback.js";
 export { writeTextAtomic, type WriteTextAtomicOptions } from "./text-atomic.js";

package/node_modules/@openclaw/fs-safe/dist/copy-publication.d.ts

@@ -1,9 +1,7 @@
 import type { BigIntStats } from "node:fs";
 import type { PinnedWriteParams, PublishedWriteIdentity } from "./pinned-write-types.js";
-export type RootCopyPublicationReceipt = Readonly<{
+export type RootCopyPublicationReceipt = Readonly<PublishedWriteIdentity & {
     path: string;
-    dev: bigint;
-    ino: bigint;
 }>;
 export declare function createCopyPublicationObserver(path: string, notify?: (receipt: RootCopyPublicationReceipt) => void): {
     onPublished(identity: PublishedWriteIdentity): void;

package/node_modules/@openclaw/fs-safe/dist/copy-publication.js

@@ -1,16 +1,12 @@
 import { FsSafeError } from "./errors.js";
+import { assertSynchronousCallbackResult } from "./mutation-authority.js";
 export function createCopyPublicationObserver(path, notify) {
     let rejected;
     return {
         onPublished(identity) {
             const receipt = Object.freeze({ path, dev: identity.dev, ino: identity.ino });
             try {
-                const result = notify?.(receipt);
-                if (result !== null && (typeof result === "object" || typeof result === "function") &&
-                    "then" in result && typeof result.then === "function") {
-                    void Promise.resolve(result).catch(() => undefined);
-                    throw new TypeError("onDestinationPublished must be synchronous");
-                }
+                assertSynchronousCallbackResult(notify?.(receipt), "onDestinationPublished");
             }
             catch (error) {
                 rejected = { error };

package/node_modules/@openclaw/fs-safe/dist/deny-mutation-match.d.ts

@@ -0,0 +1,2 @@
+/** Cache observations only within one synchronous policy check, never across mutations or callbacks. */
+export declare function createMutationDenyMatcher(): (target: string, denied: string, prefix: boolean, protectAncestors?: boolean) => boolean;

package/node_modules/@openclaw/fs-safe/dist/deny-mutation-match.js

@@ -0,0 +1,71 @@
+import path from "node:path";
+import { isPathInside } from "./path.js";
+import { probePathCaseInsensitiveSync } from "./path-case.js";
+import { observeMutationPath } from "./pinned-mutation-observation.js";
+function foldedName(name) {
+    // Decompose before folding so combining marks precede an expanded Greek subscript.
+    // Default folding preserves dotless i even though its uppercase mapping is I.
+    return name.normalize("NFD").replace(/[^\u0131]+/gu, part => part.toLowerCase().toUpperCase().toLowerCase()).normalize("NFC");
+}
+function asciiCasePair(left, right) {
+    return /^[\x00-\x7f]*$/.test(left) && /^[\x00-\x7f]*$/.test(right) &&
+        left.toLowerCase() === right.toLowerCase();
+}
+/** Cache observations only within one synchronous policy check, never across mutations or callbacks. */
+export function createMutationDenyMatcher() {
+    const observations = new Map();
+    const caseObservations = new Map();
+    const observe = (pathname) => {
+        if (!observations.has(pathname))
+            observations.set(pathname, observeMutationPath(pathname));
+        return observations.get(pathname);
+    };
+    const prospectiveInside = (parent, child) => {
+        const root = path.parse(parent).root;
+        if (root !== path.parse(child).root)
+            return false;
+        const left = parent.slice(root.length).split(path.sep);
+        const right = child.slice(root.length).split(path.sep).slice(0, left.length);
+        if (left.length !== right.length || !left.every((name, i) => foldedName(name) === foldedName(right[i]))) {
+            return false;
+        }
+        // Byte-identical relations were already handled without any observations.
+        if (left.every((name, i) => name === right[i]))
+            return false;
+        const alignedChild = path.join(root, ...right);
+        const a = observe(parent);
+        const b = observe(alignedChild);
+        if (!a || !b)
+            return true;
+        // Distinct existing ancestors are real objects, not prospective aliases.
+        if (a.canonicalAncestor !== b.canonicalAncestor ||
+            a.missingSegments.length === 0 || a.missingSegments.length !== b.missingSegments.length)
+            return false;
+        const missingLeft = a.missingSegments;
+        const missingRight = b.missingSegments;
+        if (!missingLeft.every((name, i) => foldedName(name) === foldedName(missingRight[i])))
+            return false;
+        const difference = missingLeft.findIndex((name, i) => name !== missingRight[i]);
+        if (difference === -1)
+            return true;
+        // A read-only ASCII observation can disprove aliasing at this existing parent.
+        // It cannot prove Unicode sensitivity or the behavior of a future directory.
+        if (difference === 0 && asciiCasePair(missingLeft[0], missingRight[0])) {
+            if (!caseObservations.has(a.canonicalAncestor)) {
+                caseObservations.set(a.canonicalAncestor, probePathCaseInsensitiveSync(path.join(a.canonicalAncestor, missingLeft[0]), { allowTemporaryProbe: false }));
+            }
+            if (caseObservations.get(a.canonicalAncestor) === false)
+                return false;
+        }
+        // Suffix probing writes directories. Policy admission has no authority for
+        // those side effects, so unproven case/normalization equivalence fails closed.
+        return true;
+    };
+    return (target, denied, prefix, protectAncestors = false) => {
+        if ((isPathInside(denied, target) && (prefix || isPathInside(target, denied))) ||
+            (protectAncestors && isPathInside(target, denied)))
+            return true;
+        return ((prefix || target.split(path.sep).length === denied.split(path.sep).length) &&
+            prospectiveInside(denied, target)) || (protectAncestors && prospectiveInside(target, denied));
+    };
+}

package/node_modules/@openclaw/fs-safe/dist/deny-mutations.js

@@ -1,7 +1,8 @@
 import fs from "node:fs";
 import path from "node:path";
+import { createMutationDenyMatcher } from "./deny-mutation-match.js";
 import { FsSafeError } from "./errors.js";
-import { assertNoNulPathInput, isNotFoundPathError, isPathInside } from "./path.js";
+import { assertNoNulPathInput, isNotFoundPathError } from "./path.js";
 import { realpathSync } from "./realpath.js";
 import { resolveExistingAncestor } from "./root-path-existing.js";
 import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
@@ -65,6 +66,7 @@ export function assertMutationNotDenied(filePath, policy, options = {}, mode = "
     const strict = mode === "sync-root-lock";
     const comparablePaths = strict ? strictMutationComparablePaths : resolveMutationComparablePaths;
     const targets = comparablePaths(filePath);
+    const matches = createMutationDenyMatcher();
     // Validate one complete phase at a time. A paths denial must not read or
     // canonicalize prefixes, and invalid later paths retain validation precedence.
     for (const kind of ["paths", "prefixes"]) {
@@ -72,8 +74,7 @@ export function assertMutationNotDenied(filePath, policy, options = {}, mode = "
             const deniedPaths = comparablePaths(entry);
             for (const target of targets) {
                 for (const denied of deniedPaths) {
-                    if ((isPathInside(denied, target) && (kind === "prefixes" || isPathInside(target, denied))) ||
-                        (options.protectAncestors === true && isPathInside(target, denied))) {
+                    if (matches(target, denied, kind === "prefixes", options.protectAncestors)) {
                         throw new FsSafeError("denied-path", "path is denied by denyMutations policy");
                     }
                 }

package/node_modules/@openclaw/fs-safe/dist/directory-guard.d.ts

@@ -36,7 +36,6 @@ export declare function createNearestExistingDirectoryGuard(rootReal: string, ta
 export declare function createNearestExistingDirectoryGuard(rootReal: string, targetPath: string, options: {
     bigint: boolean;
 }): Promise<AnyAsyncDirectoryGuard>;
-export declare function createNearestExistingSyncDirectoryGuard(rootReal: string, targetPath: string): SyncDirectoryGuard;
 export declare function inspectDirectoryIdentity(dir: string, expected?: Pick<BigIntStats, "dev" | "ino">): Promise<BigIntStats>;
 export declare function observeDirectoryIdentitySync(dir: string, options: {
     bigint: true;

package/node_modules/@openclaw/fs-safe/dist/directory-guard.js

@@ -84,9 +84,6 @@ function assertDirectoryGuard(guard, mode) {
 export async function createNearestExistingDirectoryGuard(rootReal, targetPath, options = { bigint: false }) {
     return nearestExistingDirectoryGuard(rootReal, targetPath, "native", options);
 }
-export function createNearestExistingSyncDirectoryGuard(rootReal, targetPath) {
-    return nearestExistingDirectoryGuard(rootReal, targetPath, "normalized");
-}
 function nearestExistingDirectoryGuard(rootReal, targetPath, mode, options) {
     assertNoWindowsPathAlias(rootReal, "filesystem");
     assertNoWindowsPathAlias(targetPath, "filesystem");

package/node_modules/@openclaw/fs-safe/dist/directory-mode-node.d.ts

@@ -1,5 +1,23 @@
-import { type BigIntStats } from "node:fs";
-import { type DirectoryModeOwner } from "./directory-mode-owner.js";
+import { type BigIntStats, type Stats } from "node:fs";
+export type DirectoryModeChecks = {
+    check?: () => void;
+    beforeChmod?: () => Promise<void>;
+};
+export type DirectoryModeOwner = {
+    verify(check?: () => void): Promise<void>;
+    apply(mode: number, checks?: DirectoryModeChecks): Promise<void>;
+    close(): Promise<void>;
+};
+export declare function assertOwnedDirectory(expected: Stats | BigIntStats, actual: Stats | BigIntStats): void;
+/** Serializes use and close: even a queued path-based fd operation retains its descriptor. */
+export declare function ownDirectoryMode(params: {
+    inspect: () => Promise<number>;
+    chmod: (mode: number) => Promise<void>;
+    prepareChmod?: () => Promise<void>;
+    verifyChmod?: () => Promise<void>;
+    close: () => Promise<void>;
+    ignoreChmodError?: boolean;
+}): DirectoryModeOwner;
 /** Darwin descriptor inspection avoids requesting directory-content reads. */
 export declare function nodeDarwinDirectoryMetadataFlags(): number;
 export declare function nodeDirectorySearchOnlyFlags(): {

package/node_modules/@openclaw/fs-safe/dist/directory-mode-node.js

@@ -3,7 +3,83 @@ import fs from "node:fs/promises";
 import { FsSafeError } from "./errors.js";
 import { inspectDirectoryIdentity, inspectDirectoryIdentitySync } from "./directory-guard.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
-import { assertOwnedDirectory, ownDirectoryMode } from "./directory-mode-owner.js";
+import { sameFileIdentityForCleanup } from "./file-identity.js";
+export function assertOwnedDirectory(expected, actual) {
+    if (actual.isSymbolicLink() || !actual.isDirectory()) {
+        throw new FsSafeError("not-file", "directory mode target must be a real directory");
+    }
+    if (!sameFileIdentityForCleanup(expected, actual)) {
+        throw new FsSafeError("path-mismatch", "directory changed before its mode could be applied");
+    }
+}
+/** Serializes use and close: even a queued path-based fd operation retains its descriptor. */
+export function ownDirectoryMode(params) {
+    let pending = Promise.resolve();
+    let closing;
+    const enqueue = (run) => {
+        if (closing)
+            return Promise.reject(new FsSafeError("path-mismatch", "directory mode owner is closed"));
+        const operation = pending.then(run);
+        pending = operation.catch(() => undefined);
+        return operation;
+    };
+    return {
+        verify: (check) => enqueue(async () => {
+            check?.();
+            await params.inspect();
+            check?.();
+        }),
+        apply: (mode, checks = {}) => enqueue(async () => {
+            // inspect() reports permission bits only; chmod ignores file-type bits,
+            // so tolerate raw stat modes (e.g. S_IFDIR | 0o755) by masking up front.
+            mode &= 0o7777;
+            checks.check?.();
+            const currentMode = await params.inspect();
+            checks.check?.();
+            if (currentMode === mode && !checks.beforeChmod && !checks.check)
+                return;
+            if (currentMode !== mode) {
+                await params.prepareChmod?.();
+                checks.check?.();
+            }
+            await checks.beforeChmod?.();
+            checks.check?.();
+            // Hooks/ancestor checks can yield; recheck the original named association.
+            await params.inspect();
+            checks.check?.();
+            let dispatchDeadlineFailure;
+            if (currentMode !== mode) {
+                checks.check?.();
+                try {
+                    await params.chmod(mode);
+                }
+                catch (error) {
+                    if (!params.ignoreChmodError)
+                        throw error;
+                }
+                // Expiry cannot release the fd while post-dispatch verification is pending.
+                try {
+                    checks.check?.();
+                }
+                catch (error) {
+                    dispatchDeadlineFailure = { error };
+                }
+                await params.verifyChmod?.();
+            }
+            const finalMode = await params.inspect();
+            if (dispatchDeadlineFailure)
+                throw dispatchDeadlineFailure.error;
+            checks.check?.();
+            if (!params.ignoreChmodError && finalMode !== mode) {
+                throw new FsSafeError("path-mismatch", "directory final mode could not be verified");
+            }
+        }),
+        close() {
+            closing ??= pending.then(params.close);
+            return closing;
+        },
+    };
+}
 /** Darwin descriptor inspection avoids requesting directory-content reads. */
 export function nodeDarwinDirectoryMetadataFlags() {
     if (process.platform !== "darwin" || (process.arch !== "x64" && process.arch !== "arm64")) {