fs-safe 0.15.0

Highlights

• Enforce Root authority throughout synchronous lock admission, stale recovery, and cleanup; keep asynchronous reclaim guards inside the Root capability.
• Preserve directory and archive-source identity across publication, callbacks, and recovery, and reject corrupt portable ZIP payloads and metadata.
• Support asynchronous walk filters, configurable-depth suffix probing, and bounded synchronous descriptor copying.

Compatibility and upgrade notes

• Directory replacement now requires compatible native identity-fenced, no-replace support, including when the destination is absent. Disabled, missing, or older helpers reject before target-parent creation.
• Treat ordinary post-dispatch native rename errors as indeterminate. Preserve staged files and directory backups when a rename may have committed before its reply was lost; automatic retry and rollback require explicit evidence that dispatch never occurred.
• Synchronous Root locks require a genuine registered Root handle and enforce its policies. Interrupted asynchronous Root reclaim guards can remain after process exit or reset; recover them only after an application-owned liveness check proves the attempt ended.
• Root lock authority checks add measurable overhead. Removing redundant observations reduces some cost, but these paths remain slower than the earlier implementation that did not enforce the same boundary.

Security and correctness

• Serialize sidecar admission across raw and Root-based synchronous callers, retain separate cleanup authority, and recheck asynchronous authorization at the final stale-removal boundary.
• Keep asynchronous Root reclaim-guard creation, token/byte ownership checks, and removal inside the capability. Preserve unsettled guards instead of following replaced parents through raw cleanup.
• Create native Root lock records through retained-parent exclusive opens so racing contenders retry normally. Ordinary Root writes retain private staging. Treat raw reclaim guards disappearing or changing during collision inspection as contention.
• Verify reclaim-guard ownership after the final sidecar snapshot and parser, preserving mutation authorization and parser failures. Evaluate stale age after snapshot parsing and reject cleanup when exact identity is unknown.
• Retain source-root and child-directory authority during archive merges and bind file identity and mode to the admitted copy descriptor, including exact large Windows identities.
• Preserve ZIP payloads and physical entry metadata during portable loading so extraction rejects corrupt empty content and honors admitted directory, symlink, and special-file kinds without reordering callbacks.
• Snapshot FileStore policies before asynchronous work, streams, source reads, and JSON serialization; snapshot JsonStore durability/newline options before queued mutations and updater callbacks.
• Snapshot external-output and sibling-temp options before asynchronous setup while preserving callback receivers.
• Enforce Windows native parent mutation policies before creating each missing component and retain originating native descriptor ownership through cleanup.
• Preserve files and symlinks replacing an observed empty FileStore directory, and leave directories that become nonempty untouched.
• Recheck child entries before walk descent so symlink replacements during filters honor the selected policy.
• Keep Windows owner/ACL diagnostics bounded and fail-closed for hostile thrown values. Preserve ordinary diagnostics and the original cause without invoking getters, proxy traps, coercion, or altered buffer properties.

APIs and failure handling

• Allow asynchronous include/descend callbacks in walkDirectory() and entryFilter in Root.walk(), retaining serial selection, callback receivers, budgets, cancellation, and post-callback identity checks.
• Add maxDepth to probePathSuffixAliasesSync() with proportional budgets, a 32,768-forward-observation ceiling, unchanged defaults and string limits, and complete owned cleanup.
• Add copyFileDescriptorSync() for bounded positional transfers between caller-owned regular-file descriptors, preserving cursors, destination suffixes, descriptor lifetime, and caller-owned durability/publication.
• Preserve the first tree-copy operation failure, including falsy values and existing codes, while closing each owned resource once. Successful operations retain output-before-input and source-before-parent close-failure precedence.
• Preserve falsy atomic operation, cleanup, close, restoration, temporary-workspace removal, and Windows native cleanup failures; consume retained handles before close to prevent repeated release.
• Propagate portable ZIP fallback-close failures before publication and copy-fallback writer close failures after successful unsynchronized writes, including restoration with an absent destination.
• Preserve synchronous destination-admission failures when best-effort close also fails, and preserve directory-mode authority/deadline failures before and after dispatch.

Performance and maintenance

• Bound path-prefix queue consumption on long paths while preserving short-path behavior and resolution checks.
• Reuse eligible Windows parent-creation receipts, equivalent Root identity observations, and guarded regular-file unlink paths while retaining final identity and policy checks.
• Consolidate native copy ownership, regular/secret read admission, copy-fallback admission, and temporary-workspace setup and settlement; remove redundant wrappers, write-admission storage, and permission-diagnostic work.
• Bind public copy, ZIP extraction, atomic settlement, and permission benchmarks to verified workload receipts; keep setup, content checks, and cleanup verification outside timing.
• Update @napi-rs/cli to 3.10.0 and the locked Node type definitions to 26.6.0, and align Vitest/coverage on 5.0.1.
• Expand security-owner coverage to native/archive code, platform packages, executable benchmarks, and build/test/release configuration.
• Raise publication and release-proof job ceilings to 90 minutes, retaining bounded registry retries and fail-closed artifact, signature, and provenance checks.

Published packages

Package	Registry tarball	Verified integrity	Provenance
@openclaw/fs-safe-linux-x64-gnu@0.15.0	tgz	sha512-o7xBONVeYOOFsiP86pzuzUiUKnZT0MhA83Qu3LdN9k+Je6seF2svvo3stOLQR2py2mfa7Yb+iWXhZ07BjuaAsw==	verified attestation
@openclaw/fs-safe-linux-x64-musl@0.15.0	tgz	sha512-tNlunzDr1Aelt8bFf/u4Xf3fRG0qbf7OWPQJkRVV6AmvySbuGMOUhr6y1jsDttyTmwdvEYQGxWUQeShF510+9Q==	verified attestation
@openclaw/fs-safe-linux-arm64-gnu@0.15.0	tgz	sha512-6vguoUWPJt6eMG9jhCkykblQ2BNh3Wm+6RoeKI19lXlAXq0Dvgx9E/bVABQFP25QaVAeljVCUxkY9OMYiGlAOw==	verified attestation
@openclaw/fs-safe-linux-arm64-musl@0.15.0	tgz	sha512-NyvUYLhGjyFLPFC/CzJqCWJGlDsI+wfXImEiOmS2sRq/ykEgm3E8DJpBoE/onPwQCIpWJ1crImNL2GB4L/ZeIA==	verified attestation
@openclaw/fs-safe-darwin-x64@0.15.0	tgz	sha512-cBBaukTHIO/dNVaDUS3M6/DkWN/xIRRHJgfW+bw4gZqgFqJlljcn4glB2bMOpmTb0wowPY53uTtDB9+3qhwofA==	verified attestation
@openclaw/fs-safe-darwin-arm64@0.15.0	tgz	sha512-4T6rUy6fy1IXiu27UQdMzoN+jjuVtAtLsaZN0L1BinGat81S68LAHn43PtEnvhzO3P1L5Al+OuRcT0fOUa9J0Q==	verified attestation
@openclaw/fs-safe-win32-x64-msvc@0.15.0	tgz	sha512-jyYhHx7ObtZ9X3120FfVA8sSIxhmwliztJwzsy4++eWDQ2f+Lc4x/IdxQkJMZVTlTT34zcc/0db/jFY2MVFBvA==	verified attestation
@openclaw/fs-safe@0.15.0	tgz	sha512-np+OHOn7eeENHgwoMzc3h0PjXjepIv0VDAk4Qfwwut9b8VGdroYnJlG8Ea36kZYQvrkUjbT+aSpBlra8KNXKcg==	verified attestation

Release proof: GitHub Actions run.