@remcp/runtime 0.2.108 → 0.2.110

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.2.110 — 2026-09-25
+
+- Bulk handlers (`read_multiple_files`, `read_files`, `replace_in_files`, `write_files`, `copy_paths`, `move_paths`, `delete_paths`, `create_archive`) and the directory walk now honour client cancellation between items, so an aborted call stops at the next item boundary instead of finishing on the device; single-file and external-tool (`tar`/`unzip`) operations remain atomic and are not interrupted mid-step.
+- A file with more than one hard link now produces one warning per path: path-based confinement cannot see a shared inode, and refusing would break backup and dotfile layouts.
+- Runtime tool names, input schemas and output schemas are unchanged.
+
+## 0.2.109 — 2026-09-25
+
+- Linux file reads and recursive permission changes retain descriptor-bound parent traversal for the full operation; proc-fd anchored captures remain readable without reopening the path lexically.
+- Linux directory walks, listings, and search sessions pin allowed roots and parent descriptors, including bulk reads and edits, so ancestor swaps cannot redirect traversal.
+- `record_screen` publishes from private staging and anchors Linux destination parents; XDG portal screenshots use no-follow copying, reject symlink source/destination paths, and no longer delete an untrusted portal-returned URI.
+- Production CDP sessions reject dead sockets, recursively guard child targets and evict failed guarded new-tab sessions. Runtime tool names and schemas are unchanged.
+
 ## 0.2.108 — 2026-09-25
 
 - Standalone production runtimes keep browser control disabled unless explicitly enabled; the authenticated paired agent enables its owned local runtime. IP-literal production allowlisting and persistent CDP guards cover page and worker sessions, delayed navigation, redirects, and subresources.

package/README.md

@@ -99,10 +99,10 @@ UI actions and the XDG Screenshot portal remain separate from that low-level inp
 - file writes replace by default (`mode: "append"` to add), moves and copies replace the destination
   (`overwrite: false` refuses instead), `replace_in_files` applies immediately (`dry_run: true`
   previews), and `move_to_trash` is there when you want an undo;
-- the destructive-command guardrail defaults to `warn`: the command runs and the result carries a note
-  when it matches the catastrophic list (`mkfs`, raw device writes, repartitioning, host power
-  control, fork bombs, recursive root deletion). `allow` removes even the note, `block` refuses
-  before running, and `blockedCommands` adds your own deny list;
+- the destructive-command guardrail defaults to `block`: a catastrophic command is refused before it
+  runs when it matches the list (`mkfs`, raw device writes, repartitioning, host power control, fork
+  bombs, recursive root deletion). `warn` downgrades that to a note on the result, `allow` removes
+  even the note, and `blockedCommands` adds your own deny list;
 - `allowedRoots` is empty, so the device reaches everything the agent's account can reach. Set it to
   confine a device to specific directories, enforced against the resolved real path.
 
@@ -169,6 +169,11 @@ in `~/.config/remcp/runtime.json`. `--describe` always reports the current state
   descriptor-bound directory traversal on Linux. macOS and Windows preserve the same bounded snapshot,
   link/special-file rejection, canonical root confinement and atomic staging semantics, while using their
   portable path APIs where Node does not expose directory-fd-relative open/rename/unlink primitives.
+  Two consequences are worth knowing: on macOS and Windows `set_permissions` re-resolves each path
+  and then chmods it, so a component swap between those two steps is not descriptor-bound, and a file
+  with more than one hard link (`st_nlink > 1`) is reachable from outside the allowed roots no matter
+  which path was used. The runtime warns once per hard-linked path instead of refusing it, because
+  backups and dotfile managers create those layouts legitimately.
 - **Crash-resistant sessions.** A bogus shell, a closed stdin, or a dead parent cannot take the
   runtime down; sessions run in their own process group so `force_terminate` stops a whole pipeline;
   the agent restarts the runtime if it ever exits, so a device recovers instead of going silently

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.108",
+  "version": "0.2.110",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/extended/browser.mjs

@@ -495,15 +495,16 @@ class CdpSession {
   }
 }
 
-async function installBrowserRequestGuard(session) {
+async function installBrowserRequestGuard(session, { closeRootTarget = async () => {} } = {}) {
   const guardedSessions = new Set();
   const childSetup = new Map();
-  const enableSession = async sessionId => {
+  const enableSession = async (sessionId, { autoAttach = false } = {}) => {
     if (guardedSessions.has(sessionId)) return;
     try {
       await session.send('Network.enable', {}, sessionId, 2000);
       await session.send('Network.setBlockedURLs', { urls:['ws://*', 'wss://*'] }, sessionId, 2000);
       await session.send('Fetch.enable', { patterns:[{ urlPattern:'*' }] }, sessionId, 2000);
+      if (autoAttach) await session.send('Target.setAutoAttach', { autoAttach:true, waitForDebuggerOnStart:true, flatten:true }, sessionId, 2000);
       guardedSessions.add(sessionId);
     } catch (error) {
       await session.send('Fetch.disable', {}, sessionId, 1000).catch(() => {});
@@ -516,11 +517,18 @@ async function installBrowserRequestGuard(session) {
     if (childSetup.has(childSessionId)) return childSetup.get(childSessionId);
     const setup = (async () => {
       try {
-        await enableSession(childSessionId);
+        await enableSession(childSessionId, { autoAttach:process.env.NODE_ENV === 'production' });
         await session.send('Runtime.runIfWaitingForDebugger', {}, childSessionId, 2000);
-      } catch {
+      } catch (error) {
         const targetId = params?.targetInfo?.targetId;
-        if (targetId) await session.send('Target.closeTarget', { targetId }, '', 2000).catch(() => {});
+        let closed = false;
+        if (targetId) {
+          try {
+            await session.send('Target.closeTarget', { targetId }, '', 2000);
+            closed = true;
+          } catch {}
+        }
+        if (!closed) throw new Error(`Browser child guard failed: ${error instanceof Error ? error.message : String(error)}`);
       }
     })();
     childSetup.set(childSessionId, setup);
@@ -543,16 +551,31 @@ async function installBrowserRequestGuard(session) {
     })();
   });
   const removeAttached = session.observe('Target.attachedToTarget', params => {
-    void guardChild(params);
+    void guardChild(params).catch(async () => {
+      await closeRootTarget().catch(() => {});
+      session.close();
+    });
   });
   await enableSession('');
   if (process.env.NODE_ENV === 'production') {
     await session.send('Target.setAutoAttach', { autoAttach:true, waitForDebuggerOnStart:true, flatten:true }, '', 2000);
-    const existing = await session.send('Target.getTargets').catch(() => ({ targetInfos:[] }));
+    let existing;
+    try {
+      existing = await session.send('Target.getTargets', {}, '', 2000);
+    } catch (error) {
+      throw new Error(`Could not enumerate browser child targets safely: ${error instanceof Error ? error.message : String(error)}`);
+    }
     for (const targetInfo of existing.targetInfos || []) {
       if (!['worker', 'service_worker', 'shared_worker', 'iframe', 'webview'].includes(targetInfo.type)) continue;
-      const attached = await session.send('Target.attachToTarget', { targetId:targetInfo.targetId, flatten:true }, '', 2000).catch(() => null);
+      const attached = await session.send('Target.attachToTarget', { targetId:targetInfo.targetId, flatten:true }, '', 2000).catch(async error => {
+        await session.send('Target.closeTarget', { targetId:targetInfo.targetId }, '', 2000).catch(() => {});
+        throw new Error(`Could not attach browser child target safely: ${error instanceof Error ? error.message : String(error)}`);
+      });
       if (attached?.sessionId) await guardChild({ sessionId:attached.sessionId, targetInfo });
+      else {
+        await session.send('Target.closeTarget', { targetId:targetInfo.targetId }, '', 2000).catch(() => {});
+        throw new Error('Browser child target did not expose a guard session');
+      }
     }
   }
   return () => {
@@ -562,6 +585,17 @@ async function installBrowserRequestGuard(session) {
   };
 }
 
+async function closeBrowserTarget(endpoint, targetId) {
+  if (!targetId) return false;
+  try {
+    const base = endpoint instanceof URL ? endpoint.href : endpoint;
+    await requestJson(`/json/close/${encodeURIComponent(String(targetId))}`, base, { timeout_ms:2000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function productionSessionKey(endpoint, target) {
   return `${endpoint.origin}|${String(target.id)}`;
 }
@@ -570,15 +604,19 @@ function closeProductionSession(key, record) {
   if (!record) return;
   if (record.timer) clearTimeout(record.timer);
   record.removeGuard();
+  if (record.ownedTarget && record.targetId) {
+    record.session.send('Target.closeTarget', { targetId:record.targetId }, '', 2000).catch(() => {});
+    if (record.endpoint) void closeBrowserTarget(record.endpoint, record.targetId);
+  }
   record.session.send('Fetch.disable').catch(() => {});
   record.session.close();
   if (productionBrowserSessions.get(key) === record) productionBrowserSessions.delete(key);
 }
 
-function retainProductionSession(key, session, removeGuard) {
+function retainProductionSession(key, session, removeGuard, targetId, endpoint, ownedTarget = false) {
   const existing = productionBrowserSessions.get(key);
   if (existing) closeProductionSession(key, existing);
-  const record = { session, removeGuard, timer:null };
+  const record = { session, removeGuard, targetId, endpoint, ownedTarget, timer:null };
   productionBrowserSessions.set(key, record);
   const schedule = () => {
     if (record.timer) clearTimeout(record.timer);
@@ -595,26 +633,46 @@ async function createGuardedNewTab(url, args) {
   const created = await requestJson('/json/new', args.endpoint, { method:'PUT', timeout_ms:args.timeout_ms });
   if (!created?.id) throw new Error('Browser did not return a new page target');
   const endpoint = endpointUrl(args.endpoint);
-  const target = { ...created, webSocketDebuggerUrl: validatedTargetWebSocketUrl(created, endpoint) };
-  const session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
+  let target;
+  try {
+    target = { ...created, webSocketDebuggerUrl: validatedTargetWebSocketUrl(created, endpoint) };
+  } catch (error) {
+    await closeBrowserTarget(endpoint, created.id);
+    throw error;
+  }
+  let session;
+  try {
+    session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
+  } catch (error) {
+    await closeBrowserTarget(endpoint, target.id);
+    throw error;
+  }
   let removeGuard = () => {};
   let productionRecord = null;
   let productionKey = '';
+  let operationFailed = false;
   try {
-    removeGuard = await installBrowserRequestGuard(session);
+    removeGuard = await installBrowserRequestGuard(session, { closeRootTarget:() => closeBrowserTarget(endpoint, target.id) });
     if (process.env.NODE_ENV === 'production') {
       productionKey = productionSessionKey(endpoint, target);
-      productionRecord = retainProductionSession(productionKey, session, removeGuard);
+      productionRecord = retainProductionSession(productionKey, session, removeGuard, target.id, endpoint, true);
     }
     await session.send('Page.enable');
     const loaded = session.waitFor('Page.loadEventFired', clamp(args.timeout_ms, 15_000, 500, 120_000)).catch(() => null);
     const navigation = await session.send('Page.navigate', { url });
     if (loaded) await loaded;
-    const finalUrl = await evaluate(session, 'location.href').catch(() => url);
+    const finalUrl = await evaluate(session, 'location.href');
     await assertResolvedPageUrl(finalUrl);
     return { target, navigation, finalUrl };
+  } catch (error) {
+    operationFailed = true;
+    if (!productionRecord) await closeBrowserTarget(endpoint, target.id);
+    throw error;
   } finally {
-    if (productionRecord) productionRecord.schedule();
+    if (productionRecord) {
+      if (operationFailed) closeProductionSession(productionKey, productionRecord);
+      else productionRecord.schedule();
+    }
     else {
       removeGuard();
       await session.send('Fetch.disable').catch(() => {});
@@ -637,26 +695,35 @@ async function withTarget(args, callback) {
   let session = record?.session;
   let removeGuard = record?.removeGuard || (() => {});
   if (!session) {
-    session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
     try {
+      session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
       removeGuard = await installBrowserRequestGuard(session);
-      if (production) record = retainProductionSession(key, session, removeGuard);
+      if (production) record = retainProductionSession(key, session, removeGuard, target.id, endpoint);
     } catch (error) {
       removeGuard();
-      await session.send('Fetch.disable').catch(() => {});
-      session.close();
+      if (session) {
+        await session.send('Fetch.disable').catch(() => {});
+        session.close();
+      }
       throw error;
     }
   }
+  let operationFailed = false;
   try {
-    const currentUrl = await evaluate(session, 'location.href').catch(() => target.url);
+    const currentUrl = await evaluate(session, 'location.href');
     await assertResolvedPageUrl(currentUrl);
     const result = await callback(session, target);
     const finalUrl = await evaluate(session, 'location.href').catch(() => { throw new Error('Browser page URL could not be verified after the operation'); });
     await assertResolvedPageUrl(finalUrl);
     return result;
+  } catch (error) {
+    operationFailed = true;
+    throw error;
   } finally {
-    if (production && record) record.schedule();
+    if (production && record) {
+      if (operationFailed) closeProductionSession(key, record);
+      else record.schedule();
+    }
     else {
       removeGuard();
       await session.send('Fetch.disable').catch(() => {});

package/src/extended/diagnostics.mjs

@@ -3,10 +3,12 @@ import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
-import { existsSync } from 'node:fs';
-import { stat } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { constants, existsSync } from 'node:fs';
+import { lstat, mkdtemp, open, rename, rm, stat, unlink } from 'node:fs/promises';
 import { assertAllowedCommand } from '../policy.mjs';
 import { isWaylandSession } from '../screenshot-portal.mjs';
+import { openDirectoryPath } from '../tools/files.mjs';
 import { resolveSafePath, text } from '../util.mjs';
 import {
   clamp,
@@ -297,38 +299,97 @@ export function recordScreenAvailable({
   return false;
 }
 
+async function openRecordingParent(destination) {
+  return openDirectoryPath(path.dirname(destination));
+}
+
+async function copyRecordingFile(source, destination) {
+  let input;
+  let output;
+  let parent;
+  let temporary;
+  try {
+    input = await open(source, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+    const sourceInfo = await input.stat();
+    if (!sourceInfo.isFile()) throw new Error('Screen recording staging path is not a regular file');
+    parent = await openRecordingParent(destination);
+    const anchoredDestination = path.join(parent.anchor, path.basename(destination));
+    const existing = await lstat(anchoredDestination).catch(() => null);
+    if (existing?.isSymbolicLink()) throw new Error('Screen recording destination cannot be a symbolic link');
+    if (existing && !existing.isFile()) throw new Error('Screen recording destination is not a regular file');
+    temporary = path.join(parent.anchor, `.${path.basename(destination)}.${randomUUID()}.tmp`);
+    output = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    const buffer = Buffer.allocUnsafe(1024 * 1024);
+    let offset = 0;
+    for (;;) {
+      const { bytesRead } = await input.read(buffer, 0, buffer.length, offset);
+      if (!bytesRead) break;
+      let written = 0;
+      while (written < bytesRead) {
+        const result = await output.write(buffer, written, bytesRead - written, offset + written);
+        if (!result.bytesWritten) throw new Error('Could not finish writing the screen recording');
+        written += result.bytesWritten;
+      }
+      offset += bytesRead;
+    }
+    await output.sync();
+    await output.close();
+    output = null;
+    await rename(temporary, anchoredDestination);
+    temporary = null;
+  } finally {
+    if (output) await output.close().catch(() => {});
+    if (temporary) await unlink(temporary).catch(() => {});
+    if (input) await input.close().catch(() => {});
+    if (parent) await parent.close().catch(() => {});
+  }
+}
+
 export async function recordScreen(args) {
   const seconds = clamp(args.duration_seconds, 5, 1, 120);
   const fps = clamp(args.fps, 15, 1, 60);
-  const destination = args.destination ? await resolveSafePath(args.destination, 'destination') : path.join(os.tmpdir(), `remcp-screen-${Date.now()}.mp4`);
+  const requestedDestination = args.destination ? await resolveSafePath(args.destination, 'destination') : '';
+  if (requestedDestination) {
+    const existing = await lstat(requestedDestination).catch(() => null);
+    if (existing?.isSymbolicLink()) throw new Error('Screen recording destination cannot be a symbolic link');
+    if (existing && !existing.isFile()) throw new Error('Screen recording destination is not a regular file');
+  }
+  const stagingDirectory = await mkdtemp(path.join(os.tmpdir(), 'remcp-screen-'));
+  const staged = path.join(stagingDirectory, `capture-${randomUUID()}.mp4`);
   const wayland = process.platform === 'linux' && isWaylandSession();
-  if (wayland && commandExists('wf-recorder') && commandExists('timeout')) {
-    const result = await runFile('timeout', ['--signal=INT', `${seconds}s`, 'wf-recorder', '-f',destination,'-r',String(fps),'-c','libx264'], { label:'screen recording', timeout:(seconds+10)*1000, allowFailure:true });
-    if (![0, 124, 130].includes(Number(result.code))) throw new Error(result.stderr.trim() || `wf-recorder exited ${result.code}`);
-  } else {
-    const ffmpeg = resolveRecordScreenFfmpeg();
-    if (wayland) {
-      unavailable('Screen recording', 'wf-recorder and timeout are required on Wayland');
-    }
-    if (process.platform === 'linux' && !String(process.env.DISPLAY || '').trim()) {
-      unavailable('Screen recording', 'an active X11 DISPLAY is required on Linux X11');
-    }
-    if (!ffmpeg) {
-      if (process.platform === 'darwin') unavailable('Screen recording', 'ffmpeg is required on macOS');
-      if (process.platform === 'win32') unavailable('Screen recording', 'ffmpeg is required on Windows');
-      unavailable('Screen recording', 'ffmpeg is required on X11');
+  let keepStaging = false;
+  try {
+    if (wayland && commandExists('wf-recorder') && commandExists('timeout')) {
+      const result = await runFile('timeout', ['--signal=INT', `${seconds}s`, 'wf-recorder', '-f',staged,'-r',String(fps),'-c','libx264'], { label:'screen recording', timeout:(seconds+10)*1000, allowFailure:true });
+      if (![0, 124, 130].includes(Number(result.code))) throw new Error(result.stderr.trim() || `wf-recorder exited ${result.code}`);
+    } else {
+      const ffmpeg = resolveRecordScreenFfmpeg();
+      if (wayland) unavailable('Screen recording', 'wf-recorder and timeout are required on Wayland');
+      if (process.platform === 'linux' && !String(process.env.DISPLAY || '').trim()) unavailable('Screen recording', 'an active X11 DISPLAY is required on Linux X11');
+      if (!ffmpeg) {
+        if (process.platform === 'darwin') unavailable('Screen recording', 'ffmpeg is required on macOS');
+        if (process.platform === 'win32') unavailable('Screen recording', 'ffmpeg is required on Windows');
+        unavailable('Screen recording', 'ffmpeg is required on X11');
+      }
+      let argv;
+      if (process.platform === 'win32') argv=['-y','-f','gdigrab','-framerate',String(fps),'-i','desktop','-t',String(seconds),'-pix_fmt','yuv420p',staged];
+      else if (process.platform === 'darwin') {
+        const input = await avfoundationScreenInput(ffmpeg);
+        argv=['-y','-f','avfoundation','-framerate',String(fps),'-i',`${input}:none`,'-t',String(seconds),'-pix_fmt','yuv420p',staged];
+      } else argv=['-y','-f','x11grab','-framerate',String(fps),'-i',process.env.DISPLAY,'-t',String(seconds),'-pix_fmt','yuv420p',staged];
+      await runFile(ffmpeg, argv, { label:'screen recording', timeout:(seconds+20)*1000, maxBuffer:8*1024*1024 });
     }
-    let argv;
-    if (process.platform === 'win32') argv=['-y','-f','gdigrab','-framerate',String(fps),'-i','desktop','-t',String(seconds),'-pix_fmt','yuv420p',destination];
-    else if (process.platform === 'darwin') {
-      const input = await avfoundationScreenInput(ffmpeg);
-      argv=['-y','-f','avfoundation','-framerate',String(fps),'-i',`${input}:none`,'-t',String(seconds),'-pix_fmt','yuv420p',destination];
+    if (requestedDestination) {
+      await copyRecordingFile(staged, requestedDestination);
+      await rm(stagingDirectory, { recursive:true, force:true });
     }
-    else argv=['-y','-f','x11grab','-framerate',String(fps),'-i',process.env.DISPLAY,'-t',String(seconds),'-pix_fmt','yuv420p',destination];
-    await runFile(ffmpeg, argv, { label:'screen recording', timeout:(seconds+20)*1000, maxBuffer:8*1024*1024 });
+    const output = requestedDestination || staged;
+    const info = await stat(output);
+    keepStaging = !requestedDestination;
+    return jsonResult({ path:output, bytes:info.size, duration_seconds:seconds, format:path.extname(output).slice(1) || 'mp4' });
+  } finally {
+    if (!keepStaging) await rm(stagingDirectory, { recursive:true, force:true }).catch(() => {});
   }
-  const info = await stat(destination);
-  return jsonResult({ path:destination, bytes:info.size, duration_seconds:seconds, format:path.extname(destination).slice(1) || 'mp4' });
 }
 
 export const diagnosticHandlers = {

package/src/extended/documents.mjs

@@ -4,6 +4,7 @@ import { randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
 import { copyFile, link, lstat, mkdir, mkdtemp, open, readFile, readdir, rename, rm, stat, unlink, writeFile } from 'node:fs/promises';
 import { readDocxText, readPdfText } from '../documents.mjs';
+import { openDirectoryPath } from '../tools/files.mjs';
 import { resolveSafePath, text } from '../util.mjs';
 import {
   clamp,
@@ -30,7 +31,6 @@ const MAX_OOXML_ENTRIES = 10_000;
 const MAX_OOXML_UNCOMPRESSED_BYTES = 512 * 1024 * 1024;
 const MAX_DOCUMENT_BYTES = 128 * 1024 * 1024;
 const DOCUMENT_READ_FLAGS = constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0);
-const DOCUMENT_DIRECTORY_FLAGS = constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0);
 
 function descriptorAnchorsAvailable() {
   return process.platform === 'linux' && Boolean(constants.O_NOFOLLOW) && Boolean(constants.O_DIRECTORY);
@@ -48,93 +48,29 @@ async function openDocumentSource(filePath) {
       throw error;
     }
   }
-  const root = path.parse(filePath).root;
-  const parts = filePath.slice(root.length).split(path.sep).filter(Boolean);
-  if (!parts.length) throw new Error('Document path must be a regular file');
-  const directories = [];
-  let current = root;
-  const closeDirectories = async () => {
-    for (const handle of directories.reverse()) await handle.close().catch(() => {});
-  };
+  const parent = await openDirectoryPath(path.dirname(filePath));
+  let handle;
   try {
-    for (const part of parts.slice(0, -1)) {
-      const handle = await open(path.join(current, part), DOCUMENT_DIRECTORY_FLAGS);
-      const info = await handle.stat();
-      if (!info.isDirectory()) {
-        await handle.close().catch(() => {});
-        throw new Error('Document path parent is not a directory');
-      }
-      directories.push(handle);
-      current = `/proc/self/fd/${handle.fd}`;
-    }
-    const handle = await open(path.join(current, parts.at(-1)), DOCUMENT_READ_FLAGS);
+    handle = await open(path.join(parent.anchor, path.basename(filePath)), DOCUMENT_READ_FLAGS);
+    const info = await handle.stat();
+    if (!info.isFile()) throw new Error('Document path must be a regular file');
     return {
       handle,
       close: async () => {
         try { await handle.close(); }
-        finally { await closeDirectories(); }
+        finally { await parent.close().catch(() => {}); }
       },
     };
   } catch (error) {
-    await closeDirectories();
+    if (handle) await handle.close().catch(() => {});
+    await parent.close().catch(() => {});
     throw error;
   }
 }
 
 async function openDocumentDirectoryPath(directory, { create = false } = {}) {
-  if (!descriptorAnchorsAvailable()) {
-    if (create) await mkdir(directory, { recursive:true, mode:0o700 });
-    const handle = await open(directory, DOCUMENT_DIRECTORY_FLAGS);
-    try {
-      const info = await handle.stat();
-      if (!info.isDirectory()) throw new Error('Document path parent is not a directory');
-      return { handle, anchor:directory, descriptorBound:false, close: () => handle.close() };
-    } catch (error) {
-      await handle.close().catch(() => {});
-      throw error;
-    }
-  }
-  const root = path.parse(directory).root;
-  const parts = directory.slice(root.length).split(path.sep).filter(Boolean);
-  if (!parts.length) {
-    const handle = await open(root, DOCUMENT_DIRECTORY_FLAGS);
-    return { anchor: `/proc/self/fd/${handle.fd}`, close: () => handle.close() };
-  }
-  const directories = [];
-  let current = root;
-  const closeDirectories = async () => {
-    for (const handle of directories.reverse()) await handle.close().catch(() => {});
-  };
-  try {
-    for (const part of parts) {
-      const candidate = path.join(current, part);
-      if (create) {
-        await mkdir(candidate, { mode:0o700 }).catch(error => {
-          if (error?.code !== 'EEXIST') throw error;
-        });
-      }
-      const handle = await open(candidate, DOCUMENT_DIRECTORY_FLAGS);
-      const info = await handle.stat();
-      if (!info.isDirectory()) {
-        await handle.close().catch(() => {});
-        throw new Error('Document path parent is not a directory');
-      }
-      directories.push(handle);
-      current = `/proc/self/fd/${handle.fd}`;
-    }
-    const handle = directories.pop();
-    if (!handle) throw new Error('Document directory path is empty');
-    return {
-      anchor: current,
-      close: async () => {
-        try { await handle.close(); }
-        finally { await closeDirectories(); }
-      },
-    };
-  } catch (error) {
-    await closeDirectories();
-    throw error;
-  }
+  const opened = await openDirectoryPath(directory, { create });
+  return { ...opened, descriptorBound:opened.anchor !== directory || process.platform === 'linux' };
 }
 
 async function createAnchoredTempDirectory(parent, prefix) {