@remcp/runtime 0.2.108 → 0.2.109

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.2.109 — 2026-09-25
+
+- Linux file reads and recursive permission changes retain descriptor-bound parent traversal for the full operation; proc-fd anchored captures remain readable without reopening the path lexically.
+- Linux directory walks, listings, and search sessions pin allowed roots and parent descriptors, including bulk reads and edits, so ancestor swaps cannot redirect traversal.
+- `record_screen` publishes from private staging and anchors Linux destination parents; XDG portal screenshots use no-follow copying, reject symlink source/destination paths, and no longer delete an untrusted portal-returned URI.
+- Production CDP sessions reject dead sockets, recursively guard child targets and evict failed guarded new-tab sessions. Runtime tool names and schemas are unchanged.
+
 ## 0.2.108 — 2026-09-25
 
 - Standalone production runtimes keep browser control disabled unless explicitly enabled; the authenticated paired agent enables its owned local runtime. IP-literal production allowlisting and persistent CDP guards cover page and worker sessions, delayed navigation, redirects, and subresources.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.108",
+  "version": "0.2.109",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/extended/browser.mjs

@@ -495,15 +495,16 @@ class CdpSession {
   }
 }
 
-async function installBrowserRequestGuard(session) {
+async function installBrowserRequestGuard(session, { closeRootTarget = async () => {} } = {}) {
   const guardedSessions = new Set();
   const childSetup = new Map();
-  const enableSession = async sessionId => {
+  const enableSession = async (sessionId, { autoAttach = false } = {}) => {
     if (guardedSessions.has(sessionId)) return;
     try {
       await session.send('Network.enable', {}, sessionId, 2000);
       await session.send('Network.setBlockedURLs', { urls:['ws://*', 'wss://*'] }, sessionId, 2000);
       await session.send('Fetch.enable', { patterns:[{ urlPattern:'*' }] }, sessionId, 2000);
+      if (autoAttach) await session.send('Target.setAutoAttach', { autoAttach:true, waitForDebuggerOnStart:true, flatten:true }, sessionId, 2000);
       guardedSessions.add(sessionId);
     } catch (error) {
       await session.send('Fetch.disable', {}, sessionId, 1000).catch(() => {});
@@ -516,11 +517,18 @@ async function installBrowserRequestGuard(session) {
     if (childSetup.has(childSessionId)) return childSetup.get(childSessionId);
     const setup = (async () => {
       try {
-        await enableSession(childSessionId);
+        await enableSession(childSessionId, { autoAttach:process.env.NODE_ENV === 'production' });
         await session.send('Runtime.runIfWaitingForDebugger', {}, childSessionId, 2000);
-      } catch {
+      } catch (error) {
         const targetId = params?.targetInfo?.targetId;
-        if (targetId) await session.send('Target.closeTarget', { targetId }, '', 2000).catch(() => {});
+        let closed = false;
+        if (targetId) {
+          try {
+            await session.send('Target.closeTarget', { targetId }, '', 2000);
+            closed = true;
+          } catch {}
+        }
+        if (!closed) throw new Error(`Browser child guard failed: ${error instanceof Error ? error.message : String(error)}`);
       }
     })();
     childSetup.set(childSessionId, setup);
@@ -543,16 +551,31 @@ async function installBrowserRequestGuard(session) {
     })();
   });
   const removeAttached = session.observe('Target.attachedToTarget', params => {
-    void guardChild(params);
+    void guardChild(params).catch(async () => {
+      await closeRootTarget().catch(() => {});
+      session.close();
+    });
   });
   await enableSession('');
   if (process.env.NODE_ENV === 'production') {
     await session.send('Target.setAutoAttach', { autoAttach:true, waitForDebuggerOnStart:true, flatten:true }, '', 2000);
-    const existing = await session.send('Target.getTargets').catch(() => ({ targetInfos:[] }));
+    let existing;
+    try {
+      existing = await session.send('Target.getTargets', {}, '', 2000);
+    } catch (error) {
+      throw new Error(`Could not enumerate browser child targets safely: ${error instanceof Error ? error.message : String(error)}`);
+    }
     for (const targetInfo of existing.targetInfos || []) {
       if (!['worker', 'service_worker', 'shared_worker', 'iframe', 'webview'].includes(targetInfo.type)) continue;
-      const attached = await session.send('Target.attachToTarget', { targetId:targetInfo.targetId, flatten:true }, '', 2000).catch(() => null);
+      const attached = await session.send('Target.attachToTarget', { targetId:targetInfo.targetId, flatten:true }, '', 2000).catch(async error => {
+        await session.send('Target.closeTarget', { targetId:targetInfo.targetId }, '', 2000).catch(() => {});
+        throw new Error(`Could not attach browser child target safely: ${error instanceof Error ? error.message : String(error)}`);
+      });
       if (attached?.sessionId) await guardChild({ sessionId:attached.sessionId, targetInfo });
+      else {
+        await session.send('Target.closeTarget', { targetId:targetInfo.targetId }, '', 2000).catch(() => {});
+        throw new Error('Browser child target did not expose a guard session');
+      }
     }
   }
   return () => {
@@ -562,6 +585,17 @@ async function installBrowserRequestGuard(session) {
   };
 }
 
+async function closeBrowserTarget(endpoint, targetId) {
+  if (!targetId) return false;
+  try {
+    const base = endpoint instanceof URL ? endpoint.href : endpoint;
+    await requestJson(`/json/close/${encodeURIComponent(String(targetId))}`, base, { timeout_ms:2000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function productionSessionKey(endpoint, target) {
   return `${endpoint.origin}|${String(target.id)}`;
 }
@@ -570,15 +604,19 @@ function closeProductionSession(key, record) {
   if (!record) return;
   if (record.timer) clearTimeout(record.timer);
   record.removeGuard();
+  if (record.ownedTarget && record.targetId) {
+    record.session.send('Target.closeTarget', { targetId:record.targetId }, '', 2000).catch(() => {});
+    if (record.endpoint) void closeBrowserTarget(record.endpoint, record.targetId);
+  }
   record.session.send('Fetch.disable').catch(() => {});
   record.session.close();
   if (productionBrowserSessions.get(key) === record) productionBrowserSessions.delete(key);
 }
 
-function retainProductionSession(key, session, removeGuard) {
+function retainProductionSession(key, session, removeGuard, targetId, endpoint, ownedTarget = false) {
   const existing = productionBrowserSessions.get(key);
   if (existing) closeProductionSession(key, existing);
-  const record = { session, removeGuard, timer:null };
+  const record = { session, removeGuard, targetId, endpoint, ownedTarget, timer:null };
   productionBrowserSessions.set(key, record);
   const schedule = () => {
     if (record.timer) clearTimeout(record.timer);
@@ -595,26 +633,46 @@ async function createGuardedNewTab(url, args) {
   const created = await requestJson('/json/new', args.endpoint, { method:'PUT', timeout_ms:args.timeout_ms });
   if (!created?.id) throw new Error('Browser did not return a new page target');
   const endpoint = endpointUrl(args.endpoint);
-  const target = { ...created, webSocketDebuggerUrl: validatedTargetWebSocketUrl(created, endpoint) };
-  const session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
+  let target;
+  try {
+    target = { ...created, webSocketDebuggerUrl: validatedTargetWebSocketUrl(created, endpoint) };
+  } catch (error) {
+    await closeBrowserTarget(endpoint, created.id);
+    throw error;
+  }
+  let session;
+  try {
+    session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
+  } catch (error) {
+    await closeBrowserTarget(endpoint, target.id);
+    throw error;
+  }
   let removeGuard = () => {};
   let productionRecord = null;
   let productionKey = '';
+  let operationFailed = false;
   try {
-    removeGuard = await installBrowserRequestGuard(session);
+    removeGuard = await installBrowserRequestGuard(session, { closeRootTarget:() => closeBrowserTarget(endpoint, target.id) });
     if (process.env.NODE_ENV === 'production') {
       productionKey = productionSessionKey(endpoint, target);
-      productionRecord = retainProductionSession(productionKey, session, removeGuard);
+      productionRecord = retainProductionSession(productionKey, session, removeGuard, target.id, endpoint, true);
     }
     await session.send('Page.enable');
     const loaded = session.waitFor('Page.loadEventFired', clamp(args.timeout_ms, 15_000, 500, 120_000)).catch(() => null);
     const navigation = await session.send('Page.navigate', { url });
     if (loaded) await loaded;
-    const finalUrl = await evaluate(session, 'location.href').catch(() => url);
+    const finalUrl = await evaluate(session, 'location.href');
     await assertResolvedPageUrl(finalUrl);
     return { target, navigation, finalUrl };
+  } catch (error) {
+    operationFailed = true;
+    if (!productionRecord) await closeBrowserTarget(endpoint, target.id);
+    throw error;
   } finally {
-    if (productionRecord) productionRecord.schedule();
+    if (productionRecord) {
+      if (operationFailed) closeProductionSession(productionKey, productionRecord);
+      else productionRecord.schedule();
+    }
     else {
       removeGuard();
       await session.send('Fetch.disable').catch(() => {});
@@ -637,26 +695,35 @@ async function withTarget(args, callback) {
   let session = record?.session;
   let removeGuard = record?.removeGuard || (() => {});
   if (!session) {
-    session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
     try {
+      session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
       removeGuard = await installBrowserRequestGuard(session);
-      if (production) record = retainProductionSession(key, session, removeGuard);
+      if (production) record = retainProductionSession(key, session, removeGuard, target.id, endpoint);
     } catch (error) {
       removeGuard();
-      await session.send('Fetch.disable').catch(() => {});
-      session.close();
+      if (session) {
+        await session.send('Fetch.disable').catch(() => {});
+        session.close();
+      }
       throw error;
     }
   }
+  let operationFailed = false;
   try {
-    const currentUrl = await evaluate(session, 'location.href').catch(() => target.url);
+    const currentUrl = await evaluate(session, 'location.href');
     await assertResolvedPageUrl(currentUrl);
     const result = await callback(session, target);
     const finalUrl = await evaluate(session, 'location.href').catch(() => { throw new Error('Browser page URL could not be verified after the operation'); });
     await assertResolvedPageUrl(finalUrl);
     return result;
+  } catch (error) {
+    operationFailed = true;
+    throw error;
   } finally {
-    if (production && record) record.schedule();
+    if (production && record) {
+      if (operationFailed) closeProductionSession(key, record);
+      else record.schedule();
+    }
     else {
       removeGuard();
       await session.send('Fetch.disable').catch(() => {});

package/src/extended/diagnostics.mjs

@@ -3,10 +3,12 @@ import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
-import { existsSync } from 'node:fs';
-import { stat } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { constants, existsSync } from 'node:fs';
+import { lstat, mkdtemp, open, rename, rm, stat, unlink } from 'node:fs/promises';
 import { assertAllowedCommand } from '../policy.mjs';
 import { isWaylandSession } from '../screenshot-portal.mjs';
+import { openDirectoryPath } from '../tools/files.mjs';
 import { resolveSafePath, text } from '../util.mjs';
 import {
   clamp,
@@ -297,38 +299,97 @@ export function recordScreenAvailable({
   return false;
 }
 
+async function openRecordingParent(destination) {
+  return openDirectoryPath(path.dirname(destination));
+}
+
+async function copyRecordingFile(source, destination) {
+  let input;
+  let output;
+  let parent;
+  let temporary;
+  try {
+    input = await open(source, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+    const sourceInfo = await input.stat();
+    if (!sourceInfo.isFile()) throw new Error('Screen recording staging path is not a regular file');
+    parent = await openRecordingParent(destination);
+    const anchoredDestination = path.join(parent.anchor, path.basename(destination));
+    const existing = await lstat(anchoredDestination).catch(() => null);
+    if (existing?.isSymbolicLink()) throw new Error('Screen recording destination cannot be a symbolic link');
+    if (existing && !existing.isFile()) throw new Error('Screen recording destination is not a regular file');
+    temporary = path.join(parent.anchor, `.${path.basename(destination)}.${randomUUID()}.tmp`);
+    output = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    const buffer = Buffer.allocUnsafe(1024 * 1024);
+    let offset = 0;
+    for (;;) {
+      const { bytesRead } = await input.read(buffer, 0, buffer.length, offset);
+      if (!bytesRead) break;
+      let written = 0;
+      while (written < bytesRead) {
+        const result = await output.write(buffer, written, bytesRead - written, offset + written);
+        if (!result.bytesWritten) throw new Error('Could not finish writing the screen recording');
+        written += result.bytesWritten;
+      }
+      offset += bytesRead;
+    }
+    await output.sync();
+    await output.close();
+    output = null;
+    await rename(temporary, anchoredDestination);
+    temporary = null;
+  } finally {
+    if (output) await output.close().catch(() => {});
+    if (temporary) await unlink(temporary).catch(() => {});
+    if (input) await input.close().catch(() => {});
+    if (parent) await parent.close().catch(() => {});
+  }
+}
+
 export async function recordScreen(args) {
   const seconds = clamp(args.duration_seconds, 5, 1, 120);
   const fps = clamp(args.fps, 15, 1, 60);
-  const destination = args.destination ? await resolveSafePath(args.destination, 'destination') : path.join(os.tmpdir(), `remcp-screen-${Date.now()}.mp4`);
+  const requestedDestination = args.destination ? await resolveSafePath(args.destination, 'destination') : '';
+  if (requestedDestination) {
+    const existing = await lstat(requestedDestination).catch(() => null);
+    if (existing?.isSymbolicLink()) throw new Error('Screen recording destination cannot be a symbolic link');
+    if (existing && !existing.isFile()) throw new Error('Screen recording destination is not a regular file');
+  }
+  const stagingDirectory = await mkdtemp(path.join(os.tmpdir(), 'remcp-screen-'));
+  const staged = path.join(stagingDirectory, `capture-${randomUUID()}.mp4`);
   const wayland = process.platform === 'linux' && isWaylandSession();
-  if (wayland && commandExists('wf-recorder') && commandExists('timeout')) {
-    const result = await runFile('timeout', ['--signal=INT', `${seconds}s`, 'wf-recorder', '-f',destination,'-r',String(fps),'-c','libx264'], { label:'screen recording', timeout:(seconds+10)*1000, allowFailure:true });
-    if (![0, 124, 130].includes(Number(result.code))) throw new Error(result.stderr.trim() || `wf-recorder exited ${result.code}`);
-  } else {
-    const ffmpeg = resolveRecordScreenFfmpeg();
-    if (wayland) {
-      unavailable('Screen recording', 'wf-recorder and timeout are required on Wayland');
-    }
-    if (process.platform === 'linux' && !String(process.env.DISPLAY || '').trim()) {
-      unavailable('Screen recording', 'an active X11 DISPLAY is required on Linux X11');
-    }
-    if (!ffmpeg) {
-      if (process.platform === 'darwin') unavailable('Screen recording', 'ffmpeg is required on macOS');
-      if (process.platform === 'win32') unavailable('Screen recording', 'ffmpeg is required on Windows');
-      unavailable('Screen recording', 'ffmpeg is required on X11');
+  let keepStaging = false;
+  try {
+    if (wayland && commandExists('wf-recorder') && commandExists('timeout')) {
+      const result = await runFile('timeout', ['--signal=INT', `${seconds}s`, 'wf-recorder', '-f',staged,'-r',String(fps),'-c','libx264'], { label:'screen recording', timeout:(seconds+10)*1000, allowFailure:true });
+      if (![0, 124, 130].includes(Number(result.code))) throw new Error(result.stderr.trim() || `wf-recorder exited ${result.code}`);
+    } else {
+      const ffmpeg = resolveRecordScreenFfmpeg();
+      if (wayland) unavailable('Screen recording', 'wf-recorder and timeout are required on Wayland');
+      if (process.platform === 'linux' && !String(process.env.DISPLAY || '').trim()) unavailable('Screen recording', 'an active X11 DISPLAY is required on Linux X11');
+      if (!ffmpeg) {
+        if (process.platform === 'darwin') unavailable('Screen recording', 'ffmpeg is required on macOS');
+        if (process.platform === 'win32') unavailable('Screen recording', 'ffmpeg is required on Windows');
+        unavailable('Screen recording', 'ffmpeg is required on X11');
+      }
+      let argv;
+      if (process.platform === 'win32') argv=['-y','-f','gdigrab','-framerate',String(fps),'-i','desktop','-t',String(seconds),'-pix_fmt','yuv420p',staged];
+      else if (process.platform === 'darwin') {
+        const input = await avfoundationScreenInput(ffmpeg);
+        argv=['-y','-f','avfoundation','-framerate',String(fps),'-i',`${input}:none`,'-t',String(seconds),'-pix_fmt','yuv420p',staged];
+      } else argv=['-y','-f','x11grab','-framerate',String(fps),'-i',process.env.DISPLAY,'-t',String(seconds),'-pix_fmt','yuv420p',staged];
+      await runFile(ffmpeg, argv, { label:'screen recording', timeout:(seconds+20)*1000, maxBuffer:8*1024*1024 });
     }
-    let argv;
-    if (process.platform === 'win32') argv=['-y','-f','gdigrab','-framerate',String(fps),'-i','desktop','-t',String(seconds),'-pix_fmt','yuv420p',destination];
-    else if (process.platform === 'darwin') {
-      const input = await avfoundationScreenInput(ffmpeg);
-      argv=['-y','-f','avfoundation','-framerate',String(fps),'-i',`${input}:none`,'-t',String(seconds),'-pix_fmt','yuv420p',destination];
+    if (requestedDestination) {
+      await copyRecordingFile(staged, requestedDestination);
+      await rm(stagingDirectory, { recursive:true, force:true });
     }
-    else argv=['-y','-f','x11grab','-framerate',String(fps),'-i',process.env.DISPLAY,'-t',String(seconds),'-pix_fmt','yuv420p',destination];
-    await runFile(ffmpeg, argv, { label:'screen recording', timeout:(seconds+20)*1000, maxBuffer:8*1024*1024 });
+    const output = requestedDestination || staged;
+    const info = await stat(output);
+    keepStaging = !requestedDestination;
+    return jsonResult({ path:output, bytes:info.size, duration_seconds:seconds, format:path.extname(output).slice(1) || 'mp4' });
+  } finally {
+    if (!keepStaging) await rm(stagingDirectory, { recursive:true, force:true }).catch(() => {});
   }
-  const info = await stat(destination);
-  return jsonResult({ path:destination, bytes:info.size, duration_seconds:seconds, format:path.extname(destination).slice(1) || 'mp4' });
 }
 
 export const diagnosticHandlers = {

package/src/extended/documents.mjs

@@ -4,6 +4,7 @@ import { randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
 import { copyFile, link, lstat, mkdir, mkdtemp, open, readFile, readdir, rename, rm, stat, unlink, writeFile } from 'node:fs/promises';
 import { readDocxText, readPdfText } from '../documents.mjs';
+import { openDirectoryPath } from '../tools/files.mjs';
 import { resolveSafePath, text } from '../util.mjs';
 import {
   clamp,
@@ -30,7 +31,6 @@ const MAX_OOXML_ENTRIES = 10_000;
 const MAX_OOXML_UNCOMPRESSED_BYTES = 512 * 1024 * 1024;
 const MAX_DOCUMENT_BYTES = 128 * 1024 * 1024;
 const DOCUMENT_READ_FLAGS = constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0);
-const DOCUMENT_DIRECTORY_FLAGS = constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0);
 
 function descriptorAnchorsAvailable() {
   return process.platform === 'linux' && Boolean(constants.O_NOFOLLOW) && Boolean(constants.O_DIRECTORY);
@@ -48,93 +48,29 @@ async function openDocumentSource(filePath) {
       throw error;
     }
   }
-  const root = path.parse(filePath).root;
-  const parts = filePath.slice(root.length).split(path.sep).filter(Boolean);
-  if (!parts.length) throw new Error('Document path must be a regular file');
-  const directories = [];
-  let current = root;
-  const closeDirectories = async () => {
-    for (const handle of directories.reverse()) await handle.close().catch(() => {});
-  };
+  const parent = await openDirectoryPath(path.dirname(filePath));
+  let handle;
   try {
-    for (const part of parts.slice(0, -1)) {
-      const handle = await open(path.join(current, part), DOCUMENT_DIRECTORY_FLAGS);
-      const info = await handle.stat();
-      if (!info.isDirectory()) {
-        await handle.close().catch(() => {});
-        throw new Error('Document path parent is not a directory');
-      }
-      directories.push(handle);
-      current = `/proc/self/fd/${handle.fd}`;
-    }
-    const handle = await open(path.join(current, parts.at(-1)), DOCUMENT_READ_FLAGS);
+    handle = await open(path.join(parent.anchor, path.basename(filePath)), DOCUMENT_READ_FLAGS);
+    const info = await handle.stat();
+    if (!info.isFile()) throw new Error('Document path must be a regular file');
     return {
       handle,
       close: async () => {
         try { await handle.close(); }
-        finally { await closeDirectories(); }
+        finally { await parent.close().catch(() => {}); }
       },
     };
   } catch (error) {
-    await closeDirectories();
+    if (handle) await handle.close().catch(() => {});
+    await parent.close().catch(() => {});
     throw error;
   }
 }
 
 async function openDocumentDirectoryPath(directory, { create = false } = {}) {
-  if (!descriptorAnchorsAvailable()) {
-    if (create) await mkdir(directory, { recursive:true, mode:0o700 });
-    const handle = await open(directory, DOCUMENT_DIRECTORY_FLAGS);
-    try {
-      const info = await handle.stat();
-      if (!info.isDirectory()) throw new Error('Document path parent is not a directory');
-      return { handle, anchor:directory, descriptorBound:false, close: () => handle.close() };
-    } catch (error) {
-      await handle.close().catch(() => {});
-      throw error;
-    }
-  }
-  const root = path.parse(directory).root;
-  const parts = directory.slice(root.length).split(path.sep).filter(Boolean);
-  if (!parts.length) {
-    const handle = await open(root, DOCUMENT_DIRECTORY_FLAGS);
-    return { anchor: `/proc/self/fd/${handle.fd}`, close: () => handle.close() };
-  }
-  const directories = [];
-  let current = root;
-  const closeDirectories = async () => {
-    for (const handle of directories.reverse()) await handle.close().catch(() => {});
-  };
-  try {
-    for (const part of parts) {
-      const candidate = path.join(current, part);
-      if (create) {
-        await mkdir(candidate, { mode:0o700 }).catch(error => {
-          if (error?.code !== 'EEXIST') throw error;
-        });
-      }
-      const handle = await open(candidate, DOCUMENT_DIRECTORY_FLAGS);
-      const info = await handle.stat();
-      if (!info.isDirectory()) {
-        await handle.close().catch(() => {});
-        throw new Error('Document path parent is not a directory');
-      }
-      directories.push(handle);
-      current = `/proc/self/fd/${handle.fd}`;
-    }
-    const handle = directories.pop();
-    if (!handle) throw new Error('Document directory path is empty');
-    return {
-      anchor: current,
-      close: async () => {
-        try { await handle.close(); }
-        finally { await closeDirectories(); }
-      },
-    };
-  } catch (error) {
-    await closeDirectories();
-    throw error;
-  }
+  const opened = await openDirectoryPath(directory, { create });
+  return { ...opened, descriptorBound:opened.anchor !== directory || process.platform === 'linux' };
 }
 
 async function createAnchoredTempDirectory(parent, prefix) {

package/src/screenshot-portal.mjs

@@ -1,5 +1,8 @@
 import process from 'node:process';
-import { copyFile, rm } from 'node:fs/promises';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, open, rename, unlink } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 
 const PORTAL_NAME = 'org.freedesktop.portal.Desktop';
@@ -133,6 +136,115 @@ function createResponseCollector(bus, dbus, initialPath, timeoutMs) {
   };
 }
 
+async function openDirectoryNoFollow(directory) {
+  if (process.platform !== 'linux' || !constants.O_NOFOLLOW || !constants.O_DIRECTORY) {
+    const info = await lstat(directory);
+    if (info.isSymbolicLink() || !info.isDirectory()) throw new Error('screenshot path parent is not a safe directory');
+    return { anchor:directory, close:async() => {} };
+  }
+  const descriptor = directory.match(/^(\/proc\/(?:self|\d+)\/fd\/\d+)(?:\/(.*))?$/);
+  const directories = [];
+  let current;
+  try {
+    if (descriptor) {
+      const base = await open(`${descriptor[1]}/.`, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+      directories.push(base);
+      current = `/proc/self/fd/${base.fd}`;
+    } else {
+      const root = path.parse(directory).root;
+      current = root;
+      const parts = directory.slice(root.length).split(path.sep).filter(Boolean);
+      if (!parts.length) {
+        const handle = await open(root, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        return { anchor:`/proc/self/fd/${handle.fd}`, close:() => handle.close() };
+      }
+      for (const part of parts) {
+        const handle = await open(path.join(current, part), constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        const info = await handle.stat();
+        if (!info.isDirectory()) {
+          await handle.close().catch(() => {});
+          throw new Error('screenshot path parent is not a safe directory');
+        }
+        directories.push(handle);
+        current = `/proc/self/fd/${handle.fd}`;
+      }
+      const handle = directories.pop();
+      return {
+        anchor:current,
+        close:async() => {
+          try { await handle.close(); }
+          finally { for (const entry of directories.reverse()) await entry.close().catch(() => {}); }
+        },
+      };
+    }
+    for (const part of (descriptor?.[2] || '').split(path.sep).filter(Boolean)) {
+      const handle = await open(path.join(current, part), constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+      const info = await handle.stat();
+      if (!info.isDirectory()) {
+        await handle.close().catch(() => {});
+        throw new Error('screenshot path parent is not a safe directory');
+      }
+      directories.push(handle);
+      current = `/proc/self/fd/${handle.fd}`;
+    }
+    const handle = directories.pop();
+    return {
+      anchor:current,
+      close:async() => {
+        try { await handle.close(); }
+        finally { for (const entry of directories.reverse()) await entry.close().catch(() => {}); }
+      },
+    };
+  } catch (error) {
+    for (const entry of directories.reverse()) await entry.close().catch(() => {});
+    throw error;
+  }
+}
+
+async function copyPortalFile(source, destination) {
+  let sourceParent;
+  let destinationParent;
+  let input;
+  let output;
+  let temporary;
+  try {
+    sourceParent = await openDirectoryNoFollow(path.dirname(source));
+    destinationParent = await openDirectoryNoFollow(path.dirname(destination));
+    input = await open(path.join(sourceParent.anchor, path.basename(source)), constants.O_RDONLY | constants.O_NOFOLLOW);
+    const info = await input.stat();
+    if (!info.isFile()) throw new Error('desktop portal returned a non-regular screenshot file');
+    const destinationPath = path.join(destinationParent.anchor, path.basename(destination));
+    const existing = await lstat(destinationPath).catch(() => null);
+    if (existing?.isSymbolicLink()) throw new Error('desktop portal screenshot destination cannot be a symbolic link');
+    temporary = path.join(destinationParent.anchor, `.${path.basename(destination)}.${randomUUID()}.tmp`);
+    output = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+    const buffer = Buffer.allocUnsafe(1024 * 1024);
+    let offset = 0;
+    for (;;) {
+      const { bytesRead } = await input.read(buffer, 0, buffer.length, offset);
+      if (!bytesRead) break;
+      let written = 0;
+      while (written < bytesRead) {
+        const result = await output.write(buffer, written, bytesRead - written, offset + written);
+        if (!result.bytesWritten) throw new Error('Could not finish copying the desktop portal screenshot');
+        written += result.bytesWritten;
+      }
+      offset += bytesRead;
+    }
+    await output.sync();
+    await output.close();
+    output = null;
+    await rename(temporary, destinationPath);
+    temporary = null;
+  } finally {
+    if (output) await output.close().catch(() => {});
+    if (temporary) await unlink(temporary).catch(() => {});
+    if (input) await input.close().catch(() => {});
+    if (destinationParent) await destinationParent.close().catch(() => {});
+    if (sourceParent) await sourceParent.close().catch(() => {});
+  }
+}
+
 export async function capturePortalScreenshot(destination, {
   timeoutMs = DEFAULT_TIMEOUT_MS,
   loadDbus = () => import('@jellybrick/dbus-next'),
@@ -184,12 +296,9 @@ export async function capturePortalScreenshot(destination, {
     const uri = results?.uri?.value;
     if (typeof uri !== 'string') throw new Error('desktop portal returned no screenshot URI');
     const sourceUrl = new URL(uri);
-    if (sourceUrl.protocol !== 'file:') throw new Error(`desktop portal returned unsupported URI scheme ${sourceUrl.protocol}`);
+    if (sourceUrl.protocol !== 'file:' || (sourceUrl.hostname && sourceUrl.hostname !== 'localhost')) throw new Error('desktop portal returned an unsupported file URI');
     const source = fileURLToPath(sourceUrl);
-    await copyFile(source, destination);
-    // GNOME commonly writes the portal result to ~/Pictures. The runtime owns this capture, so remove
-    // that portal-created intermediate after copying it to the caller-selected temporary location.
-    if (source !== destination) await rm(source, { force: true }).catch(() => {});
+    await copyPortalFile(source, destination);
     return destination;
   } catch (error) {
     const wrapped = new Error(`xdg-desktop-portal: ${cleanError(error)}`);

package/src/sessions.mjs

@@ -190,6 +190,7 @@ export function createSearchSession({ type, pattern, path, filePattern }) {
     error: null,
     warning: null,
     cancel: null,
+    release: null,
     waiters: [],
     lastActivityAt: Date.now(),
   };
@@ -209,6 +210,9 @@ export function finishSearchSession(session, status, error = null) {
   session.error = error ? String(error) : null;
   session.finishedAt = Date.now();
   session.cancel = null;
+  const release = session.release;
+  session.release = null;
+  if (release) void Promise.resolve(release()).catch(() => {});
   notify(session);
 }