fix: update fs-safe fallback dependency

steipete · steipete · commit 1a7669bc63a0 · 2026-05-20T19:35:08.000+01:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -16,6 +16,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Dependencies: update `@openclaw/fs-safe` to `0.2.7` so OpenClaw's default Python-helper-off policy keeps best-effort Node write fallbacks for private stores, secret writes, run logs, and media attachments on Linux/macOS.
 - Status: show the configured default, session-selected model, reason, clear hint, and docs link when a session remains pinned to a model that differs from `agents.defaults.model.primary`.
 - Mac app: keep local packaging signed with a stable app identity for permission testing and fix Control UI production builds under current Vite/Highlight.js exports.
 - macOS app: update the embedded Peekaboo bridge to 3.2.1 so OpenClaw-hosted UI automation works with current Peekaboo CLI capture flows.
diff --git a/package.json b/package.json
@@ -1780,7 +1780,7 @@
     "@lydell/node-pty": "1.2.0-beta.12",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@mozilla/readability": "0.6.0",
-    "@openclaw/fs-safe": "0.2.6",
+    "@openclaw/fs-safe": "0.2.7",
     "@openclaw/proxyline": "0.3.3",
     "ajv": "8.20.0",
     "chalk": "5.6.2",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
@@ -7,7 +7,7 @@ packages:
 minimumReleaseAge: 2880
 
 minimumReleaseAgeExclude:
-  - "@openclaw/fs-safe@0.2.4"
+  - "@openclaw/fs-safe@0.2.7"
   - "@openclaw/proxyline@0.3.3"
   - "acpx"
   - "tokenjuice"
diff --git a/scripts/control-ui-i18n.ts b/scripts/control-ui-i18n.ts
@@ -85,7 +85,7 @@ const CONTROL_UI_I18N_WORKFLOW = 1;
 const DEFAULT_OPENAI_MODEL = "gpt-5.5";
 const DEFAULT_ANTHROPIC_MODEL = "claude-opus-4-6";
 const DEFAULT_PROVIDER = "openai";
-export const DEFAULT_PI_PACKAGE_VERSION = "0.75.1";
+export const DEFAULT_PI_PACKAGE_VERSION = "0.75.3";
 const PI_PACKAGE_NAME = "@earendil-works/pi-coding-agent";
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(HERE, "..");
diff --git a/src/security/windows-acl.test.ts b/src/security/windows-acl.test.ts
@@ -929,13 +929,6 @@ Successfully processed 1 files`;
       expectTrustedOnly([aclEntry({ principal: "AUTORIDAD NT\\SYSTEM" })]);
     });
 
-    it("classifies principal with diacritic not in TRUSTED_BASE but matching stripped suffix (line 145)", () => {
-      // "NT Authority\\Syst\u00e9me" has \u00e9 (e-acute) which is not in TRUSTED_BASE directly.
-      // After diacritic stripping: "nt authority\\systeme" which ends with stripped("\\syst\u00e8me") = "\\systeme".
-      // This exercises the classifyPrincipal diacritic-strip fallback at line 145.
-      expectTrustedOnly([aclEntry({ principal: "NT Authority\\Syst\u00e9me" })]);
-    });
-
     it("French Windows full scenario: user + Système only → no untrusted", () => {
       const entries: WindowsAclEntry[] = [
         aclEntry({ principal: "MYPC\\Pierre" }),
diff --git a/test/scripts/root-package-overrides.test.ts b/test/scripts/root-package-overrides.test.ts
@@ -32,7 +32,7 @@ describe("root package override guardrails", () => {
 
     expect(manifest.dependencies).not.toHaveProperty(packageName);
     expect(npmOverride).toBeUndefined();
-    expect(pnpmOverride).toBe("3.1045.0");
+    expect(pnpmOverride).toBe("3.1048.0");
   });
 
   it("pins the node-domexception alias exactly in npm and pnpm overrides", () => {
