OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes

Summary

OpenShell FS bridge reads pin and verify the opened file before returning bytes

Affected Packages / Versions

• Package: openclaw (npm)
• Affected versions: <= 2026.4.21
• Fixed version: 2026.4.22

Impact

A time-of-check/time-of-use race around OpenShell sandbox filesystem reads could let a symlink swap cause bytes outside the intended mount root to be read.

Fix

OpenShell reads now open the file with no-follow semantics where available, validate the pinned file descriptor against the canonical mount root, reject unsafe hardlink/symlink cases, and use a strict fallback ancestor walk on platforms without fd-path readback.

Fix Commit(s)

• 95119017c847c737bd113f0bff728c4666d79c45

Verification

• The fix commit is contained in the public v2026.4.22 tag.
• [email protected] is published on npm and the compiled package contains the fix.
• Focused regression coverage for this path passed before publication.

Thanks @VladimirEliTokarev for reporting.