fs-safe 0.21.2

Highlights

• require mode confines mutations under hostile concurrency: with FS_SAFE_NATIVE_MODE=require (or configureFsSafeNative({ mode: "require" })), remove, recursive remove, mkdir, writable-open creation and overwrite move now run through retained, identity-checked native parents: descriptor-relative unlinkat, mkdirat and renameat2 on POSIX, and handle-relative operations on Windows. An adversarial race fuzzer observed no outside or denied-path effects across about 2.8 million racing calls on Linux (with and without openat2), macOS and Windows. auto keeps its documented best-effort paths and performance. See the operation/platform matrix. (#744, #751, #750, #752)
• Watch on macOS: entry scopes use identity-checked kqueue descriptors instead of recursive FSEvents streams, ending overflow storms for shallow ancestor scopes above busy trees. (#753)
• Faster watch scans: watch readiness and reconciliation are 27–34% faster on large trees. (#747)

Fixes

• Watch cancellation: a subscription's signal closes it even when another abort listener stops event propagation. (#738)
• Walk cancellation: walks stop without yielding the current entry when a synchronous filter aborts the signal. (#739)
• Writes with mkdir: false: the JavaScript fallback writes through existing in-root parent aliases using the same guarded walk, instead of rejecting them. (#740)
• Descriptor exhaustion: native writes that fail with EMFILE/ENFILE report helper-failed with the exhaustion code, the indeterminate publication outcome and the preserved stage, instead of a misleading path error. (#742)
• Walk memory: walkDirectory() and walkDirectorySync() stop reading a directory once maxEntries is reached instead of enumerating it completely first. Root.walk() sorted mode stays deterministic. (#743)

Compatibility

• In require mode, the operations above now reject with helper-unavailable where no confining native primitive exists, instead of silently falling back to JavaScript. Examples are recursive removal on Linux without openat2 and recursive directory removal on Windows. Use auto for the best-effort fallback. These require-mode mutations also do more identity-checked work and are slower than before, while auto is unchanged. (#744, #751, #750)
• Create-only writes to an existing directory report already-exists in every implementation (previously not-file on some Windows paths). With mutationSymlinks omitted, Windows native and legacy JavaScript writes still differ for final links and parent junctions; set mutationSymlinks: "reject" for uniform behavior. (#745)

Published packages

Package	Registry tarball	Verified integrity	Provenance
@openclaw/fs-safe-linux-x64-gnu@0.21.2	tgz	sha512-ew5c+nBG/I/6ub6iTRtWxhYRzEJaIFat+rIVIHXErCPgOqFUcMdGxHKfLlkOXgYa5kavcRwWVgN2e/a3BMpSew==	verified attestation
@openclaw/fs-safe-linux-x64-musl@0.21.2	tgz	sha512-5ArSwa/lpMobnmV7nbwettiYCim146vbnwW3NrYATrXT6tK/pTfQFUp3Es9px3nbbvZ+Cg49NdxlQq4+Lce2gg==	verified attestation
@openclaw/fs-safe-linux-arm64-gnu@0.21.2	tgz	sha512-OIJUzIP6ZgCKF56TkMtyBtQ3EE/JyzQNeARRcDNrq9nZKqVSWLb1I1OXxW3XfeufXuLquaNO6w+wRkUKGpawRQ==	verified attestation
@openclaw/fs-safe-linux-arm64-musl@0.21.2	tgz	sha512-+hVS8c4ARX0f6BZU33e997YjytT2lJDY8e/37Y/B9vZySm92wQvR2Z+D2PG/94c5X/guH1sxXZAT1y8mZ++hYw==	verified attestation
@openclaw/fs-safe-darwin-x64@0.21.2	tgz	sha512-CDgHTssC+GoCYWrwmnje7K73fEq67fC4EUfRmYNd/r7DuAYMLhdiIhsxop8kYx3NFKIbcVXW7MmgqtVfx8zDfA==	verified attestation
@openclaw/fs-safe-darwin-arm64@0.21.2	tgz	sha512-mie3RqEyhQ7eeJvxHj/X+1zlZr5geBlWX9tdsfiZPTw5uZ+DtnYykXyMa8yBtTZN1qBKm9SF97hqWdJoLpNH7w==	verified attestation
@openclaw/fs-safe-win32-x64-msvc@0.21.2	tgz	sha512-JMXU14K/unt+R8NR7LayMme9BufjJqloJUhfcF59/qDlsjWEX0QYGe32byqT1rvyzyiGCw9Sx3lFTzzHI49eTg==	verified attestation
@openclaw/fs-safe@0.21.2	tgz	sha512-KP1cys7gJTCCFFsnp9HBQScSh+zDEqK+b89Ubc/kQI82U0TuJ1SY6MlwRnT7JPDn8Q06CmBlvaZqWGjzBnhnew==	verified attestation

Release proof: GitHub Actions run.