fs-safe 0.26.0

Highlights

• New platforms: native packages for FreeBSD x64/arm64 and Windows ARM64. (#905, #893)
• Native capabilities: anonymous pipes, Linux write leases, Darwin ACL inspection, ReFS block cloning, and metadata- and link-preserving Root.copyIn. (#892, #896, #920, #921)
• Android/Termux publication: staged no-replace copies and writes work when the OS refuses hard links. (#888)
• Performance: faster deep archive extraction, borrowed-handle copies and overwrites, sidecar locks, and Linux descriptor verification, with identity checks retained. (#912, #906, #902, #901, #899)

Features

• ReFS file copies: support guarded Root.copyIn block cloning on Windows ReFS and Dev Drive, with exclusive publication, cancellation cleanup, and automatic byte-copy fallback for unavailable clone capabilities. (#920)

• Guarded file copying: add Root.copyIn metadata preservation and exclusive literal-link copying, including dangling Windows file and directory links; keep permission selection separate from timestamps and attributes. (#921)

• Native filesystem capabilities: add Linux write leases on caller-owned descriptors, no-follow Darwin ACL inspection with separate file and directory inheritance facts, and Windows sharing-lock, attribute, and physical-extent test fixtures. (#896)

• Anonymous pipes: add @openclaw/fs-safe/pipe with native-owned, reopenable close-on-exec pipe ends for one-shot child input on POSIX, including safe stream closure in Workers. (#892)

Fixes

• Windows creation diagnostics: retain native Win32 error numbers through private directory and file creation failures, including the command fallback, without changing semantic error codes. (#919)
• FreeBSD native packages: add x64 and arm64 packages for FreeBSD 14.4+, with native anonymous pipes and canonicalization, and explicit capability absence for unported operations. (#905)
• Partial native bindings: select guarded fallbacks when an operation's native capabilities are absent, and report typed capability errors in required mode before mutation. (#905)
• Android/Termux publication: publish staged no-replace copies and writes when hardlinks are refused, using a verified empty placeholder before atomic replacement; include EACCES in the public hardlink-to-copy fallback classifier. Reported in openclaw/openclaw#167791. (#888)
• Native ZIP names: preserve CP437 decoding for unflagged legacy filenames after the ZIP 9 upgrade, including collision rejection and bounded entry selection; continue rejecting invalid Unicode Path checksums and encodings before decoder normalization. (#885)
• Native ZIP Unicode fields: retain rejection of invalid Unicode Comment CRCs and UTF-8 before callbacks or bounded reads, and validate sequential Unicode fields in decoder order without repeated hashing of the original name. (#887)
• Portable ZIP extraction: accept safe relative root-directory markers such as ./ from libarchive and other producers without turning them into absolute paths; root markers remain skipped before callbacks and publication. (#886)
• Durable JSON queues on Android/Termux: claim, failed-entry quarantine, and retirement recovery report typed helper-unavailable errors when hardlinks are refused, preserving pending, claimed, and retirement evidence for retry. (#889)
• Windows exclusive publication: preserve dangling destination symlinks when a refused hard link falls back to placeholder publication. (#894)
• Native mkdir collisions: Root.mkdir consistently reports not-file for an existing regular-file destination in native require mode. (#895)
• Guest directory publication: report a changed source identity instead of a false destination collision when a Linux fallback rename refuses a substituted source. (#898)
• Native recursive removal: honor a zero entry budget before ignoring a missing target, including with force. (#904)

Performance

• Linux opened-file verification: read ordinary procfs descriptor paths directly instead of walking realpath, keeping identity checks and deleted-path canonicalization; readLocalFileSafely is 25–28% faster on deep paths. (#899)
• Borrowed handles and locks: keep descriptor metadata inspection off the asynchronous I/O queue for small overwrites (26–28% faster) and copies (31–34% faster), and skip a redundant parent mkdir when acquiring sidecar locks (15–18% faster). (#901, #902, #906)
• Deep archive extraction: native extraction verifies every retained ancestor through its open descriptor instead of repeated realpath walks: about 16% faster at depth 8 and 5–6% at depth 4, with every ancestor substitution check retained. (#912)

Docs and Tooling

• Docs accuracy: correct native-mode migration guidance for removed Python settings and bundled TAR fallbacks, clarify Root streaming ownership, create-only visibility, and Linux no-clobber move fallback limits, and fix the JSON-store and stale-lock examples so denied process probes keep live locks; README and docs examples are now type-checked in CI. (#897, #900, #903)

Compatibility

• Windows ARM64: add a native ARM64 package with real Windows 11 ARM64 and x64-emulation validation, including private ACL creation and Worker descriptor ownership. (#893)

• Native ZIP metadata: invalid UTF-8-flagged names now reject instead of decoding lossily or falling back to CP437. Public ZIP extraction, preflight, and reads already reject these names during physical admission. (#885)

Published packages

Package	Registry tarball	Verified integrity	Provenance
@openclaw/fs-safe-win32-arm64-msvc@0.26.0	tgz	sha512-cKUMfA1rlsimftCZrbxc1UfZ2h9u9ktoPTxY9LQkSOsTlnANVO83XBurY79rv4wq9xl4SgAppOTArP18ET7A6Q==	verified attestation
@openclaw/fs-safe-linux-x64-gnu@0.26.0	tgz	sha512-yZC6kP/EnTAFFLuws25nCy4iS4wy1l4bDGvJRFtAcdLBl+M9FOLIWM6p/TcliezYmaezWGb1i+VgxghJ3uB/mg==	verified attestation
@openclaw/fs-safe-linux-x64-musl@0.26.0	tgz	sha512-kxcOv7ANmdpHXD5PdNrRFrbcesZ04x9T4JYNV55eKDbiIgK4Xe2Uo9GmaMcGouDeTrX0Oh+subsOZtUXZnFeFg==	verified attestation
@openclaw/fs-safe-linux-arm64-gnu@0.26.0	tgz	sha512-P78xFe+KQ9z2Tqb8p7eou22CUNbywO5qyiUS6VlfOxo5Qwpj1O1RNw2xIoPWqxGpBnK+R0OEzTT0NXCu7Nz/8g==	verified attestation
@openclaw/fs-safe-linux-arm64-musl@0.26.0	tgz	sha512-5ZHnjuW4vWZrSWI+6JDFrjc8QUcQ+1BnAjk+etnMeYhtJhnxau4Q9hJASWjvLsGcNrhHyNR4OmppRYvMxr5iwQ==	verified attestation
@openclaw/fs-safe-darwin-x64@0.26.0	tgz	sha512-pX8E6FW9xF1INFXyp8rSv9PQyj7LFNovhgytmZD2/EdFlG2OXu1VZ6UQfcfDOwFARtoy0bwqqgEMkQZEBFH9PA==	verified attestation
@openclaw/fs-safe-darwin-arm64@0.26.0	tgz	sha512-Lyt1rhoDUxCikH7CdkXzYqGdinKGZy3f8MC+D1/VAngXYIGUMSBu6AuR7pTo/vqrdyOI7vHpAW7QEDFobaG2ww==	verified attestation
@openclaw/fs-safe-win32-x64-msvc@0.26.0	tgz	sha512-kNZIpWO7ydMpVS0rFGrmux89LYakG+i/rKuxUIUeB/zK8S35MMAJKmif4w0Px4WSG/FYlxPogav0MXkvgd0/yw==	verified attestation
@openclaw/fs-safe-freebsd-x64@0.26.0	tgz	sha512-MSrO0yeScP6Gs2GvUTGeSAdTXJSGRtaDkwwM1LIxwc0Ja2lICUmSpAAsArOnvR7asEi+vAJ3KYlJgcHzcW3J4g==	verified attestation
@openclaw/fs-safe-freebsd-arm64@0.26.0	tgz	sha512-UNPfDJhOTArrNuKVG+a15UpKsQSH2m7ZnOl+KbKwGFHSHSrVqF0RUwBueooBbuuc+xzH1Y47HmUvQkM+T39K0Q==	verified attestation
@openclaw/fs-safe@0.26.0	tgz	sha512-tLpVEBUEcFS4YtT43DwM4R8XqPNcJxJzIb23+v8Lyj0vElEHUox2t5+4buv0OiSZ3r3EsVXe5odI3FZDZWcHqg==	verified attestation

Release proof: GitHub Actions run.