$ the-wire · showcase
fs-safe tightens identity checks, TAR reads get buffered
By RepoJournal · Filed · About OpenClaw · Composed from the cited sources · methodology
![openclaw-docs-sync[bot]](https://avatars.githubusercontent.com/u/13697529?v=4)
fs-safe's security and performance work leads the day: effective POSIX identity for temp access, bounded read-ahead for plain TAR archives, and scratch buffers sized to the file instead of a fixed 64 KiB.
fix(security): use effective POSIX identity (#369) openclaw/fs-safe
The commit carries a fix(security): use effective POSIX identity, verifying temp access with effective credentials rather than the ambient identity, with an accompanying test proving effective-uid ownership and CI runners isolated for the credential proof. If fs-safe gates access to temp roots on your host, this is the change to review first.
perf(archive): buffer plain TAR file reads openclaw/fs-safe
Native inspection and extraction of plain TAR files used to issue a filesystem read for each header and small payload boundary; a bounded 64 KiB read-ahead now lets adjacent members share reads while the existing meter still checks every logical boundary. Memory-backed member reads and compressed decoder buffering behave as before, and the cancellation reader stays outside the buffer.
perf(hash): size scratch buffers for small files openclaw/fs-safe
Small SHA-256 hashes allocated at least 64 KiB of scratch space per call; the JavaScript scratch buffer is now sized to the file hint and byte budget and grows when a full small read reveals stale metadata or a virtual file. A 512-byte input starts at 513 bytes, reads still run through actual EOF, and no admission, identity, cancellation, or borrowed-descriptor checks were removed.
fix(plugins): release predecessor registries after replacement openclaw/openclaw
Capability resolvers that escaped the loader scope kept the previous plugin registry alive after replacement; the resolver is now built outside that lexical scope so live replacements hold their prepared facts without the chain of retired registries. The PR is explicit that this is partial: the combined ESM forced-GC endurance result still fails at 36.65 MiB against a 32 MiB limit.
fix(ops): bound subprocesses and preserve uncertain outcomes openclaw/clownfish
Nine reported hang paths could sit indefinitely inside GitHub or Git subprocesses, blocking the outer retries and capacity/backlog deadlines; operational call sites now share bounded execution with a two-minute default and a CLOWNFISH_GH_EXEC_TIMEOUT_MS override, and on macOS/Linux a timeout kills the process group so transport helpers do not outlive their parent. Its follow-up carries a report...
fix(doctor): avoid false pending migrations for bundled runtimes (#149653) openclaw/openclaw
Gateway startup reported a pending plugin migration and a degraded state whenever a configured runtime was supplied by a differently named bundled plugin; those configurations now start clean, and startup and Doctor clear the old false pending records while genuinely missing plugins still warn and retain their record. Bundled-runtime setups can drop their startup workaround.
