fs-safe 0.26.7

Highlights

• Windows idle watch CPU: share native identity and physical-path queries while retaining directory checks. (#1000)
• Root containment: preserve kernel parent semantics through nested and dangling symlink chains, and reject redirected sibling-output parents. (#993)
• Legacy native policy migration: removed Python-mode settings now fail with an actionable migration error when no explicit native policy is selected. (#995)

Fixes

• Windows watch scan CPU: share native identity and physical-path queries while retaining every listed entry's directory checks. Thanks @martinderm for reporting the idle Gateway CPU regression in openclaw#174341. (#1000)
• ZIP integrity: update the native ZIP decoder while preserving format-error and byte-limit classifications for entries that exceed their declared size. (#997)
• Release dry runs: keep generated unsigned package artifacts outside source-provenance checks so the final package smoke test can complete without signing or publishing. (#996)
• Root containment: resolve nested and dangling symlink chains with kernel parent semantics, and reject redirected sibling-output parents before invoking external writers. Thanks @yetval for #987 and #986. (#993)
• Watch invalidations: refresh the admitted parent after transient create/delete activity so consumer caches cannot retain a file absent from both watcher scans. (#993)

Compatibility

• Legacy native policy migration: reject removed FS_SAFE_PYTHON_MODE and OPENCLAW_FS_SAFE_PYTHON_MODE settings with an actionable migration error when no explicit native policy is selected, instead of silently changing require or off to auto. Set the corresponding native-mode variable to the same value before upgrading. (#995)

Published packages

Package	Registry tarball	Verified integrity	Provenance
@openclaw/fs-safe-win32-arm64-msvc@0.26.7	tgz	sha512-7O33Uyc7DHhHNJ9nJBshlB+ZRBIdmfJw0NhjodDmj6TMfmBPnRFlIKuKLxHJn9qzN+twozL7IgiydXrLgWlqRQ==	verified attestation
@openclaw/fs-safe-linux-x64-gnu@0.26.7	tgz	sha512-cbUPK7YFbNmnLDGvxbzYevb+QXV474dtCTm78J6wvq3uPiQOOnWpeR70ejdLqz4xjhwc3K5sIe0aMMFWG1GQiQ==	verified attestation
@openclaw/fs-safe-linux-x64-musl@0.26.7	tgz	sha512-fjiseF32MDmElHaBbQqBERI5B6dwIy23KnJ0wh0FQ3sw9E71DCpiy0a9qcRvEnHSbtMZdYVLu7cIISY02MrIkw==	verified attestation
@openclaw/fs-safe-linux-arm64-gnu@0.26.7	tgz	sha512-3ALRGuZZBi+y3kVHEFNLOoOkY7Z5KfWDsJMVGRgARedxgJCugxW9IoFIyI722CIwISdQ9yV/AT23gaVxul3JJQ==	verified attestation
@openclaw/fs-safe-linux-arm64-musl@0.26.7	tgz	sha512-zXJiZrHZXFMB7VWnDZPP5fa7EeTU+ZihvLxl8xU4HcWtoBDJXG9jGz9CdXuyGlzegq22gXRFRDy+HNyHuQCKZw==	verified attestation
@openclaw/fs-safe-darwin-x64@0.26.7	tgz	sha512-kQ70MAhO6nnv4VbBltL3vzxuGKjf0Qj/6z8Ks5fI5DR37x43muKBvb6jEwCYTO9xHlP60Muso2VbJCCAu42m9g==	verified attestation
@openclaw/fs-safe-darwin-arm64@0.26.7	tgz	sha512-yCypltt55C3heV+eTWna7qSy9BAKOzj5FfMm/2WEp1ycPEAACGCCc7KlB1S9ltec6+HvbjjnMOm/vXtmQJCxww==	verified attestation
@openclaw/fs-safe-win32-x64-msvc@0.26.7	tgz	sha512-p+Wa3BaEJaXPkxEUAJ4VOJdXGicjUVa3EjRGjVslLSdzu2ZOsani22/QyXGy9GwsPrbODSXyUe46V6AOsgLZow==	verified attestation
@openclaw/fs-safe-freebsd-x64@0.26.7	tgz	sha512-jh8bLawOTSbGnkLO19ll8Smj3Kot76DRQxjJlSLfaAsPDvt7L9nk5EuBqAemWs/n+gYfJEaQpLPPFOfiJ5eDrw==	verified attestation
@openclaw/fs-safe-freebsd-arm64@0.26.7	tgz	sha512-ZFuulQJnNoDq+5hRsT01h21KvsIkfhYuHz6va7wmrAvljBvPzNvoLgxeuG1eTnJnlZRw2rxDWB7eMhW/NJNlXg==	verified attestation
@openclaw/fs-safe@0.26.7	tgz	sha512-DVdVaDsuwC1Cs+mzSgc8RAjDOo0Na54JchgiR9gaOJwvyjLKav5O142U80pQwl3ryV/uoWwSX6eL+CiEBhmD7Q==	verified attestation

Release proof: GitHub Actions run.