fs-safe 0.24.0

Highlights

• No-replace moves on more Linux filesystems: when filesystems reject renameat2 with RENAME_NOREPLACE, including reported QNAP ZFS shares and some overlay mounts, auto falls back safely: directories use plain rename that can at most replace an empty directory, and files use identity-checked link/unlink that cannot overwrite a target. Native require fails closed. (#838, fixes openclaw#165617) Thanks @StarGazer1995, original reporter @bbs2i58, and @MertBasar0.
• Synchronous guarded copies: new copyRootFileSync on advanced supports APFS cloning, reflinks, copy_file_range, and guarded byte fallback, returning an owned destination descriptor for synchronous capture hashes. (#839)
• Public capability classification: new isNoReplaceUnsupported(error) identifies unavailable no-replace rename support without matching internal native error codes. (#838)

Features

• Synchronous root-to-root copy: copyRootFileSync exclusively creates an absent destination under its admitted root, bounds the copy with maxBytes, verifies source and destination identities, and returns a disposable descriptor with copy-method and byte-count receipts. (#839)
• No-replace error classifier: export isNoReplaceUnsupported(error) from the root package and errors subpath for stable helper-unavailable capability diagnostics. (#838)

Fixes

• Linux no-replace moves: Root.move() uses retained-parent file link/unlink or directory rename when RENAME_NOREPLACE is unsupported in auto, rejects file collisions, and preserves publication/source-removal details after partial failures. (#838) Thanks @StarGazer1995, @bbs2i58, and @MertBasar0.

Performance

• Synchronous copy acceleration: reuse the native bounded copy engine for APFS clones, Linux reflinks, and copy_file_range before byte copying when copyRootFileSync is called with clone: "auto". (#839)

Compatibility

• Move fallback limits: native require keeps refusing unsupported no-replace moves. In auto, the directory fallback can replace a concurrently created empty directory; nonempty directories and non-directory competitors reject. File fallback requires hard-link support and fails closed if links are denied or unsupported. (#838)
• Synchronous copy contract: copyRootFileSync defaults to clone: "never", requires existing parents and an absent destination, and performs direct exclusive creation. Use a private capture directory; it does not promise atomic publication, crash durability, or a coherent snapshot of concurrent in-place edits. (#839)

Published packages

Package	Registry tarball	Verified integrity	Provenance
@openclaw/fs-safe-linux-x64-gnu@0.24.0	tgz	sha512-y1tJBFeJzJ9b7YFwjO0gnYORfGJWs5Ei83nVZNP6SZJXNaYcT5EGUmyq4n6Dev43jCcx2CO9ii00MCFD4UoNEg==	verified attestation
@openclaw/fs-safe-linux-x64-musl@0.24.0	tgz	sha512-63lLpF7WyWQO6jlakvNdHFdUfgEnx49RaQrLoSRCQEgcli4zmNF7F5B/G/z200GZFwg4iESo0jxovAmX66qRDQ==	verified attestation
@openclaw/fs-safe-linux-arm64-gnu@0.24.0	tgz	sha512-kQ6qu/Ahy7rALTQoxgzObn5+ed+xlLEKOUCovZNwbQEtrDZ3wGedpy1Gngk/ripE3aWQRcIkIMwmdeF+lrWh3g==	verified attestation
@openclaw/fs-safe-linux-arm64-musl@0.24.0	tgz	sha512-vGAukPKCpNosWR+f4+pDj5SldeSqz9EnFlFv/FQKsLezIJW96xaM4Z8BTnit7XAiCufhfkvtlcjvAR0iBSne/g==	verified attestation
@openclaw/fs-safe-darwin-x64@0.24.0	tgz	sha512-P52TnMBQxkwX66DbaqXfqj/gCzf96pn7XVaHVQOd5nKOwzieKIeKaJ4XEHoxgaqsMPj1CQi7jBRLNq6O8KGJtA==	verified attestation
@openclaw/fs-safe-darwin-arm64@0.24.0	tgz	sha512-Ug/tkzjVXA+9Tr8L+OVm1HIm2hMtnfNn3WEIavs448uFIVyFMSAXqa3qST2k8EilasKgwH/TE6WFjTKJKaltow==	verified attestation
@openclaw/fs-safe-win32-x64-msvc@0.24.0	tgz	sha512-xqXHo3f4azu/99MzqgFNHkAoL1jU4D/tmpDspabUNl/ztcD57POFAU17Y6reJlX2I6SKLdSGf88xiuv5EvyrrA==	verified attestation
@openclaw/fs-safe@0.24.0	tgz	sha512-jjzLChWHEzQfUBg0P0V1v7dMzCaRZWD/GG3EGDDfuvsA8AGacT6TMSJlF2k/PaHVMoEU+nFOilqTEqMD+GQC4w==	verified attestation

Release proof: GitHub Actions run.