@remcp/runtime 0.2.106 → 0.2.107

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.106",
+  "version": "0.2.107",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/config.mjs

@@ -1,6 +1,6 @@
 import os from 'node:os';
 import path from 'node:path';
-import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { chmodSync, lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { expandHome } from './util.mjs';
 
 const configDir = process.env.REMCP_RUNTIME_CONFIG_DIR || path.join(os.homedir(), '.config', 'remcp');
@@ -161,7 +161,17 @@ export function persistConfigValue(key, value) {
   const file = readConfigFile();
   const next = { ...file, [key]: value };
   mkdirSync(runtimeConfigDir, { recursive: true, mode: 0o700 });
-  writeFileSync(runtimeConfigPath, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+  const existing = lstatSync(runtimeConfigPath, { throwIfNoEntry: false });
+  if (existing && (existing.isSymbolicLink() || !existing.isFile())) throw new Error('runtime configuration path must be a regular file');
+  const temporary = `${runtimeConfigPath}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    writeFileSync(temporary, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
+    renameSync(temporary, runtimeConfigPath);
+    chmodSync(runtimeConfigPath, 0o600);
+  } catch (error) {
+    try { unlinkSync(temporary); } catch {}
+    throw error;
+  }
   return runtimeConfigPath;
 }
 

package/src/documents.mjs

@@ -14,6 +14,8 @@ import { inflateRawSync, inflateSync } from 'node:zlib';
 // Nothing here writes, and nothing leaves the computer.
 
 const MAX_INFLATE_BYTES = 32 * 1024 * 1024;
+const MAX_PDF_DECODED_BYTES = 128 * 1024 * 1024;
+const MAX_PDF_STREAMS = 10_000;
 
 function inflate(buffer, raw = false) {
   try {
@@ -260,6 +262,8 @@ function pdfTextPieces(content) {
 export function readPdfText(buffer) {
   const raw = buffer.toString('latin1');
   const chunks = [];
+  let decodedBytes = 0;
+  let streamCount = 0;
   let index = 0;
   while (index < raw.length) {
     const streamStart = raw.indexOf('stream', index);
@@ -271,6 +275,9 @@ export function readPdfText(buffer) {
     if (end < 0) break;
     const body = Buffer.from(raw.slice(start, end), 'latin1');
     const decoded = body.subarray(0, 5).toString('latin1') === '<?xml' ? body : (inflate(body) ?? inflate(body, true) ?? body);
+    decodedBytes += decoded.length;
+    streamCount += 1;
+    if (decodedBytes > MAX_PDF_DECODED_BYTES || streamCount > MAX_PDF_STREAMS) throw new Error('PDF decoded content exceeds the safety limit');
     chunks.push(decoded.toString('latin1'));
     index = end + 'endstream'.length;
   }

package/src/extended/browser.mjs

@@ -1,12 +1,17 @@
 import process from 'node:process';
 import os from 'node:os';
 import path from 'node:path';
+import { isIP } from 'node:net';
 import { existsSync, mkdirSync } from 'node:fs';
 import { resolveSafePath } from '../util.mjs';
 import { clamp, commandExists, jsonResult, optionalString, requireEnum, spawnDetached, unavailable } from './common.mjs';
 
 const DEFAULT_ENDPOINT = 'http://127.0.0.1:9222';
 const MAX_DISCOVERY_BYTES = 8 * 1024 * 1024;
+const MAX_CDP_MESSAGE_BYTES = 16 * 1024 * 1024;
+const MAX_EVALUATION_BYTES = 256 * 1024;
+const BROWSER_PROTOCOLS = new Set(['http:', 'https:']);
+const BLOCKED_BROWSER_SCHEME = /(?:^|[\s"'`(=])(?:file|chrome|devtools|view-source|filesystem|blob):/i;
 
 let browserLaunchPromise = null;
 
@@ -86,11 +91,67 @@ function boundedText(value, max = 1000) {
   return text.length <= max ? text : `${text.slice(0, max)}…`;
 }
 
+function normalizedHost(hostname) {
+  return String(hostname || '').replace(/^\[|\]$/g, '').replace(/\.$/, '').toLowerCase();
+}
+
 function isLoopbackHost(hostname) {
-  const host = String(hostname || '').replace(/^\[|\]$/g, '').toLowerCase();
+  const host = normalizedHost(hostname);
   return ['localhost', '127.0.0.1', '::1'].includes(host);
 }
 
+function localBrowserNavigationAllowed() {
+  return ['REMCP_BROWSER_ALLOW_LOCAL_NAVIGATION', 'REMCP_BROWSER_ALLOW_LOCAL', 'REMCP_ALLOW_LOCAL_BROWSER_NAVIGATION']
+    .some(name => ['1', 'true', 'yes', 'on'].includes(String(process.env[name] || '').trim().toLowerCase()));
+}
+
+function isPrivateIpv4(host) {
+  if (isIP(host) !== 4) return false;
+  const parts = host.split('.').map(Number);
+  const [a, b, c] = parts;
+  return a === 0
+    || a === 10
+    || a === 127
+    || (a === 100 && b >= 64 && b <= 127)
+    || (a === 169 && b === 254)
+    || (a === 172 && b >= 16 && b <= 31)
+    || (a === 192 && b === 0 && c === 0)
+    || (a === 192 && b === 0 && c === 2)
+    || (a === 192 && b === 168)
+    || (a === 198 && (b === 18 || b === 19))
+    || (a === 198 && b === 51 && c === 100)
+    || (a === 203 && b === 0 && c === 113)
+    || a >= 224;
+}
+
+function isPrivateIpv6(host) {
+  if (isIP(host) !== 6) return false;
+  if (host === '::' || host === '::1') return true;
+  if (/^f[cd]/.test(host) || /^fe[89ab]/.test(host) || host.startsWith('ff')) return true;
+  const mapped = host.match(/^::(?:ffff:)?([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (mapped) {
+    const high = Number.parseInt(mapped[1], 16);
+    const low = Number.parseInt(mapped[2], 16);
+    return isPrivateIpv4([high >> 8, high & 255, low >> 8, low & 255].join('.'));
+  }
+  return false;
+}
+
+function isPrivateBrowserHost(hostname) {
+  const host = normalizedHost(hostname);
+  if (!host) return true;
+  if (isPrivateIpv4(host) || isPrivateIpv6(host)) return true;
+  return host === 'localhost'
+    || host.endsWith('.localhost')
+    || host.endsWith('.local')
+    || host.endsWith('.internal')
+    || host.endsWith('.home.arpa')
+    || host.endsWith('.lan')
+    || host === 'localhost.localdomain'
+    || host === 'ip6-localhost'
+    || host === 'ip6-loopback';
+}
+
 function endpointUrl(value) {
   let url;
   try { url = new URL(optionalString(value) || process.env.REMCP_CDP_URL || DEFAULT_ENDPOINT); }
@@ -100,13 +161,51 @@ function endpointUrl(value) {
   return url;
 }
 
+function safeBrowserUrl(value, field = 'url') {
+  let url;
+  try { url = new URL(String(value || '')); }
+  catch { throw new Error(`${field} must be a valid absolute URL`); }
+  if (!BROWSER_PROTOCOLS.has(url.protocol)) throw new Error(`${field} must use http or https`);
+  if (url.username || url.password) throw new Error(`${field} must not embed credentials`);
+  if (!localBrowserNavigationAllowed() && isPrivateBrowserHost(url.hostname)) {
+    throw new Error(`${field} must not target loopback, private, or link-local addresses`);
+  }
+  return url.href;
+}
+
+function safePageUrl(value, field = 'browser page URL') {
+  if (String(value || '') === 'about:blank') return value;
+  return safeBrowserUrl(value, field);
+}
+
+function expressionHasPrivateDestination(expression) {
+  const urls = expression.match(/https?:\/\/[^\s"'`<>]+/gi) || [];
+  return urls.some(value => {
+    try { return isPrivateBrowserHost(new URL(value).hostname); }
+    catch { return false; }
+  });
+}
+
+function safeEvaluationExpression(value) {
+  const expression = String(value || '');
+  if (!expression.trim()) throw new Error('expression is required');
+  if (expression.includes('\0') || Buffer.byteLength(expression, 'utf8') > MAX_EVALUATION_BYTES) {
+    throw new Error(`expression must be at most ${MAX_EVALUATION_BYTES} bytes`);
+  }
+  if (BLOCKED_BROWSER_SCHEME.test(expression)) throw new Error('expression contains a blocked local browser scheme');
+  if (!localBrowserNavigationAllowed() && expressionHasPrivateDestination(expression)) {
+    throw new Error('expression contains a blocked private browser destination');
+  }
+  return expression;
+}
+
 async function requestJson(pathname, endpoint, options = {}) {
   const base = endpointUrl(endpoint);
   const url = new URL(pathname, base);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), clamp(options.timeout_ms, 5000, 100, 30_000));
   try {
-    const response = await fetch(url, { method: options.method || 'GET', signal: controller.signal });
+    const response = await fetch(url, { method: options.method || 'GET', signal: controller.signal, redirect: 'error' });
     if (!response.ok) throw new Error(`HTTP ${response.status} ${response.statusText}`);
     const declared = Number(response.headers.get('content-length') || 0);
     if (declared > MAX_DISCOVERY_BYTES) throw new Error(`CDP discovery response is too large (${declared} bytes)`);
@@ -144,7 +243,11 @@ export async function browserCapabilityAvailable(endpoint, timeoutMs = 500) {
 export async function listBrowserTargets(endpoint) {
   await ensureBrowserEndpoint(endpoint);
   const list = await requestJson('/json/list', endpoint);
-  return Array.isArray(list) ? list : [];
+  if (!Array.isArray(list)) return [];
+  return list.filter(item => {
+    if (!item || item.type !== 'page' || !item.webSocketDebuggerUrl) return false;
+    try { safePageUrl(item.url); return true; } catch { return false; }
+  });
 }
 
 async function chooseTarget(args = {}) {
@@ -152,12 +255,17 @@ async function chooseTarget(args = {}) {
   const id = optionalString(args.target_id || args.targetId);
   const title = optionalString(args.title);
   const urlContains = optionalString(args.url_contains || args.urlContains);
-  const target = targets.find(item =>
+  const matched = targets.find(item =>
     (!id || item.id === id) &&
     (!title || String(item.title || '').toLowerCase().includes(title.toLowerCase())) &&
     (!urlContains || String(item.url || '').toLowerCase().includes(urlContains.toLowerCase()))
-  ) || targets[0];
-  if (!target) unavailable('Browser control', 'no debuggable page target is available');
+  );
+  const hasSelector = Boolean(id || title || urlContains);
+  const target = matched || (hasSelector ? null : targets[0]);
+  if (!target) {
+    if (hasSelector) throw new Error('No browser page target matched the requested selector');
+    unavailable('Browser control', 'no debuggable page target is available');
+  }
   let socketUrl;
   try { socketUrl = new URL(String(target.webSocketDebuggerUrl)); }
   catch { throw new Error('Browser returned an invalid CDP WebSocket URL'); }
@@ -192,8 +300,13 @@ class CdpSession {
   }
 
   onMessage(event) {
+    const raw = String(event.data);
+    if (Buffer.byteLength(raw, 'utf8') > MAX_CDP_MESSAGE_BYTES) {
+      this.close();
+      return;
+    }
     let message;
-    try { message = JSON.parse(String(event.data)); } catch { return; }
+    try { message = JSON.parse(raw); } catch { return; }
     if (message.id && this.pending.has(message.id)) {
       const pending = this.pending.get(message.id);
       this.pending.delete(message.id);
@@ -277,8 +390,13 @@ class CdpSession {
 
 async function withTarget(args, callback) {
   const target = await chooseTarget(args);
+  safePageUrl(target.url);
   const session = await new CdpSession(target.webSocketDebuggerUrl, clamp(args.timeout_ms, 10_000, 100, 120_000)).open();
-  try { return await callback(session, target); } finally { session.close(); }
+  try {
+    const currentUrl = await evaluate(session, 'location.href').catch(() => target.url);
+    safePageUrl(currentUrl);
+    return await callback(session, target);
+  } finally { session.close(); }
 }
 
 async function evaluate(session, expression, awaitPromise = true) {
@@ -338,8 +456,9 @@ async function waitForHistoryReady(session, expectedUrl, timeoutMs) {
 }
 
 export async function browserNavigate(args = {}) {
-  const url = optionalString(args.url);
-  const action = requireEnum(args.action || (url ? 'url' : 'reload'), 'action', ['url','new_tab','back','forward','reload']);
+  const requestedUrl = optionalString(args.url);
+  const action = requireEnum(args.action || (requestedUrl ? 'url' : 'reload'), 'action', ['url','new_tab','back','forward','reload']);
+  const url = ['url','new_tab'].includes(action) ? safeBrowserUrl(requestedUrl) : null;
   if (['url','new_tab'].includes(action) && !url) throw new Error('url is required when action=url or new_tab');
   if (action === 'new_tab') {
     await ensureBrowserEndpoint(args.endpoint);
@@ -347,7 +466,7 @@ export async function browserNavigate(args = {}) {
     return jsonResult({
       target_id:created?.id || null,
       action,
-      url:created?.url || url,
+      url:created?.url ? safePageUrl(created.url) : url,
       title:created?.title || '',
     });
   }
@@ -372,7 +491,7 @@ export async function browserNavigate(args = {}) {
       const nextIndex = action === 'back' ? current - 1 : current + 1;
       const entry = Array.isArray(history.entries) ? history.entries[nextIndex] : null;
       if (!entry) throw new Error(`Cannot navigate ${action}: no history entry is available`);
-      historyUrl = entry.url || null;
+      historyUrl = entry.url ? safePageUrl(entry.url, 'history URL') : null;
       await session.send('Page.navigateToHistoryEntry', { entryId: entry.id });
     }
     if (loaded) await loaded;
@@ -380,6 +499,7 @@ export async function browserNavigate(args = {}) {
       await waitForHistoryReady(session, historyUrl, timeoutMs);
     }
     const currentUrl = await evaluate(session, 'location.href').catch(() => url || target.url || null);
+    if (currentUrl) safePageUrl(currentUrl);
     return jsonResult({ target_id: target.id, action, url: currentUrl, frame_id: frameId, error_text: errorText });
   });
 }
@@ -701,6 +821,7 @@ export async function browserWait(args = {}) {
   const idleMs = clamp(args.idle_ms, 500, 100, 10_000);
   const wanted = optionalString(args.selector || args.text || args.value || args.expression);
   if (['selector','text','url_contains','expression'].includes(condition) && !wanted) throw new Error('selector/text/value/expression is required for this condition');
+  if (condition === 'expression') safeEvaluationExpression(wanted);
   return withTarget(args, async (session, target) => {
     const started = Date.now();
     const initialUrl = await evaluate(session, 'location.href').catch(() => target.url || '');
@@ -770,8 +891,7 @@ export async function browserWait(args = {}) {
 }
 
 export async function browserEvaluate(args) {
-  const expression = optionalString(args.expression);
-  if (!expression) throw new Error('expression is required');
+  const expression = safeEvaluationExpression(args.expression);
   return withTarget(args, async (session, target) => jsonResult({ target_id: target.id, value: await evaluate(session, expression, args.await_promise !== false) }));
 }
 

package/src/extended/documents.mjs

@@ -1,6 +1,8 @@
 import path from 'node:path';
 import process from 'node:process';
-import { copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { copyFile, lstat, mkdir, mkdtemp, open, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { readDocxText, readPdfText } from '../documents.mjs';
 import { resolveSafePath, text } from '../util.mjs';
 import {
@@ -26,6 +28,51 @@ function xmlUnescape(value) {
 
 const MAX_OOXML_ENTRIES = 10_000;
 const MAX_OOXML_UNCOMPRESSED_BYTES = 512 * 1024 * 1024;
+const MAX_DOCUMENT_BYTES = 128 * 1024 * 1024;
+
+async function readDocumentFile(filePath) {
+  const info = await lstat(filePath);
+  if (!info.isFile()) throw new Error('Document path must be a regular file');
+  if (info.size > MAX_DOCUMENT_BYTES) throw new Error(`Document is too large (maximum ${MAX_DOCUMENT_BYTES} bytes)`);
+  return readFile(filePath);
+}
+
+async function copyRegularNoFollow(source, destination) {
+  const sourceHandle = await open(source, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+  try {
+    const info = await sourceHandle.stat();
+    if (!info.isFile()) throw new Error('Document path must be a regular file');
+    if (info.size > MAX_DOCUMENT_BYTES) throw new Error(`Document is too large (maximum ${MAX_DOCUMENT_BYTES} bytes)`);
+    const destinationHandle = await open(destination, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    try {
+      await destinationHandle.writeFile(await sourceHandle.readFile());
+    } finally {
+      await destinationHandle.close();
+    }
+  } finally {
+    await sourceHandle.close();
+  }
+}
+
+async function assertSafeExtractedTree(root, state = { entries: 0 }) {
+  const info = await lstat(root);
+  if (info.isSymbolicLink()) throw new Error('OOXML archive contains a symbolic link');
+  if (!info.isDirectory() && !info.isFile()) throw new Error('OOXML archive contains a special file');
+  state.entries += 1;
+  if (state.entries > MAX_OOXML_ENTRIES) throw new Error('OOXML archive has too many extracted entries');
+  if (!info.isDirectory()) return;
+  for (const entry of await readdir(root, { withFileTypes: true })) {
+    await assertSafeExtractedTree(path.join(root, entry.name), state);
+  }
+}
+
+function safePdfPattern(value, fallback) {
+  const pattern = String(value || fallback);
+  if (!pattern || pattern.length > 240 || pattern.includes('\0') || path.isAbsolute(pattern) || /[\\/]/.test(pattern) || pattern.split(/[\\/]/).includes('..')) {
+    throw new Error('PDF split pattern must be a filename without path separators');
+  }
+  return pattern;
+}
 
 function safeArchiveEntry(name) {
   const normalized = String(name || '').replace(/\\/g, '/');
@@ -51,14 +98,22 @@ async function validateZipArchive(source) {
 }
 
 async function extractZip(source, destination) {
-  await validateZipArchive(source);
-  await mkdir(destination, { recursive:true });
-  if (process.platform === 'win32') {
-    await runPowerShell(`Add-Type -AssemblyName System.IO.Compression.FileSystem;[IO.Compression.ZipFile]::ExtractToDirectory('${escapePowerShellSingle(source)}','${escapePowerShellSingle(destination)}')`, { label:'extract OOXML archive', timeout:30_000 });
-    return;
+  const sourceDirectory = await tempDir('remcp-ooxml-source-');
+  const sourceCopy = path.join(sourceDirectory, 'source.zip');
+  try {
+    await copyRegularNoFollow(source, sourceCopy);
+    await validateZipArchive(sourceCopy);
+    await mkdir(destination, { recursive:true });
+    if (process.platform === 'win32') {
+      await runPowerShell(`Add-Type -AssemblyName System.IO.Compression.FileSystem;[IO.Compression.ZipFile]::ExtractToDirectory('${escapePowerShellSingle(sourceCopy)}','${escapePowerShellSingle(destination)}')`, { label:'extract OOXML archive', timeout:30_000 });
+    } else {
+      if (!commandExists('unzip')) unavailable('OOXML document editing', 'unzip is required');
+      await runFile('unzip', ['-qq',sourceCopy,'-d',destination], { label:'extract OOXML archive', timeout:30_000 });
+    }
+    await assertSafeExtractedTree(destination);
+  } finally {
+    await removeTemp(sourceDirectory);
   }
-  if (!commandExists('unzip')) unavailable('OOXML document editing', 'unzip is required');
-  await runFile('unzip', ['-qq',source,'-d',destination], { label:'extract OOXML archive', timeout:30_000 });
 }
 
 async function createZip(sourceDir, destination) {
@@ -71,6 +126,26 @@ async function createZip(sourceDir, destination) {
   await runFile('zip', ['-qr',destination,'.'], { cwd:sourceDir, label:'create OOXML archive', timeout:30_000 });
 }
 
+async function commitDocumentOutput(staged, destination) {
+  try {
+    await rename(staged, destination);
+    return;
+  } catch (error) {
+    if (!['EEXIST', 'EPERM', 'ENOTEMPTY'].includes(error?.code)) throw error;
+  }
+  const backup = `${destination}.remcp-old-${randomUUID()}`;
+  let moved = false;
+  try {
+    await rename(destination, backup);
+    moved = true;
+    await rename(staged, destination);
+    await rm(backup, { force: true }).catch(() => {});
+  } catch (error) {
+    if (moved && !await lstat(destination).catch(() => null)) await rename(backup, destination).catch(() => {});
+    throw error;
+  }
+}
+
 async function ensureCreateTargetIsNew(filePath) {
   try {
     await stat(filePath);
@@ -188,7 +263,7 @@ async function readPdfDocument(filePath, data) {
 export async function readDocument(args) {
   const filePath = await resolveSafePath(args.path,'path');
   const lower = filePath.toLowerCase();
-  const data = await readFile(filePath);
+  const data = await readDocumentFile(filePath);
   if (lower.endsWith('.docx')) return text(readDocxText(data));
   if (lower.endsWith('.pdf')) return text(await readPdfDocument(filePath,data));
   if (lower.endsWith('.xlsx')) return jsonResult(await readXlsx(filePath,args));
@@ -275,8 +350,12 @@ export async function editSpreadsheet(args) {
   const edits = expandSpreadsheetEdits(requestedEdits);
   const output = args.output ? await resolveSafePath(args.output,'output') : filePath;
   const dir = await tempDir(create ? 'remcp-xlsx-create-' : 'remcp-xlsx-edit-');
-  const tempOut = path.join(path.dirname(output), `.remcp-${Date.now()}-${path.basename(output)}`);
+  let outputStage = '';
+  let tempOut = '';
   try {
+    await mkdir(path.dirname(output), { recursive:true });
+    outputStage = await mkdtemp(path.join(path.dirname(output), '.remcp-xlsx-output-'));
+    tempOut = path.join(outputStage, path.basename(output));
     if (create) {
       await ensureCreateTargetIsNew(filePath);
       await createBlankXlsxTree(dir, optionalString(args.sheet));
@@ -290,12 +369,12 @@ export async function editSpreadsheet(args) {
     let xml = await readFile(worksheetPath,'utf8');
     for (const edit of edits) xml = setWorksheetCell(xml,String(edit.cell || '').toUpperCase(),edit.value,edit.formula);
     await writeFile(worksheetPath,xml,'utf8');
-    await mkdir(path.dirname(output), { recursive:true });
     await createZip(dir,tempOut);
-    await copyFile(tempOut,output);
+    await commitDocumentOutput(tempOut,output);
     return jsonResult({ path:output, sheet:sheet.name, edited_cells:edits.length, bytes:(await stat(output)).size, created:create });
   } finally {
-    await rm(tempOut,{force:true}).catch(() => {});
+    if (tempOut) await rm(tempOut,{force:true}).catch(() => {});
+    if (outputStage) await rm(outputStage,{recursive:true, force:true}).catch(() => {});
     await removeTemp(dir);
   }
 }
@@ -356,9 +435,13 @@ export async function editDocument(args) {
   if (!operations.length || operations.length > 100) throw new Error('operations must contain 1..100 edits');
   const output = args.output ? await resolveSafePath(args.output,'output') : filePath;
   const dir = await tempDir(create ? 'remcp-docx-create-' : 'remcp-docx-edit-');
-  const tempOut = path.join(path.dirname(output), `.remcp-${Date.now()}-${path.basename(output)}`);
+  let outputStage = '';
+  let tempOut = '';
   let changes = 0;
   try {
+    await mkdir(path.dirname(output), { recursive:true });
+    outputStage = await mkdtemp(path.join(path.dirname(output), '.remcp-docx-output-'));
+    tempOut = path.join(outputStage, path.basename(output));
     if (create) {
       await ensureCreateTargetIsNew(filePath);
       await createBlankDocxTree(dir);
@@ -383,12 +466,12 @@ export async function editDocument(args) {
       }
     }
     await writeFile(documentPath,xml,'utf8');
-    await mkdir(path.dirname(output), { recursive:true });
     await createZip(dir,tempOut);
-    await copyFile(tempOut,output);
+    await commitDocumentOutput(tempOut,output);
     return jsonResult({ path:output, operations:operations.length, changes, bytes:(await stat(output)).size, created:create });
   } finally {
-    await rm(tempOut,{force:true}).catch(() => {});
+    if (tempOut) await rm(tempOut,{force:true}).catch(() => {});
+    if (outputStage) await rm(outputStage,{recursive:true, force:true}).catch(() => {});
     await removeTemp(dir);
   }
 }
@@ -437,12 +520,12 @@ export async function pdfAction(args) {
   const action = requireEnum(args.action,'action',['merge','split','extract_pages','annotations','info']);
   if (action === 'annotations') {
     const source = await resolveSafePath(args.path,'path');
-    return jsonResult({ path:source, annotations:pdfAnnotations(await readFile(source)) });
+    return jsonResult({ path:source, annotations:pdfAnnotations(await readDocumentFile(source)) });
   }
   if (action === 'info') {
     const source = await resolveSafePath(args.path,'path');
     if (commandExists('pdfinfo')) return text((await runFile('pdfinfo',[source],{label:'pdfinfo'})).stdout);
-    const data = await readFile(source); return jsonResult({ path:source, bytes:data.length, annotation_count:pdfAnnotations(data).length });
+    const data = await readDocumentFile(source); return jsonResult({ path:source, bytes:data.length, annotation_count:pdfAnnotations(data).length });
   }
   if (action === 'merge') {
     const requested = Array.isArray(args.paths) ? args.paths : [];
@@ -456,8 +539,11 @@ export async function pdfAction(args) {
   }
   const source=await resolveSafePath(args.path,'path');
   if(action==='split'){
-    const outputDir=await resolveSafePath(args.output_dir || path.dirname(source),'output_dir'); await mkdir(outputDir,{recursive:true});
-    const pattern=path.join(outputDir,optionalString(args.pattern)||`${path.basename(source,path.extname(source))}-%d.pdf`);
+    const requestedOutputDir=await resolveSafePath(args.output_dir || path.dirname(source),'output_dir');
+    await mkdir(requestedOutputDir,{recursive:true});
+    const outputDir=await resolveSafePath(requestedOutputDir,'output_dir');
+    const patternName=safePdfPattern(optionalString(args.pattern),`${path.basename(source,path.extname(source))}-%d.pdf`);
+    const pattern=path.join(outputDir,patternName);
     if(commandExists('pdfseparate')) await runFile('pdfseparate',[source,pattern],{label:'PDF split',timeout:60_000});
     else unavailable('PDF split','install poppler-utils (pdfseparate)');
     return jsonResult({action,output_dir:outputDir,files:(await readdir(outputDir)).filter(name=>name.toLowerCase().endsWith('.pdf')).sort()});

package/src/policy.mjs

@@ -1,3 +1,4 @@
+import path from 'node:path';
 import { runtimeConfig } from './config.mjs';
 import { recordEvent } from './telemetry.mjs';
 import { fail } from './util.mjs';
@@ -10,7 +11,10 @@ import { fail } from './util.mjs';
 // Rules are matched against the *command word* of each shell segment, so a read-only
 // command that merely mentions a dangerous word (`grep -n format README.md`,
 // `cat notes/shutdown.md`) is not refused.
-const WRAPPERS = new Set(['sudo', 'doas', 'env', 'nohup', 'command', 'builtin', 'time', 'nice', 'ionice', 'stdbuf', 'timeout', 'setsid', 'exec']);
+const WRAPPERS = new Set(['sudo', 'doas', 'env', 'nohup', 'command', 'builtin', 'time', 'nice', 'ionice', 'stdbuf', 'timeout', 'setsid', 'exec', 'busybox']);
+const SHELL_WRAPPERS = /^(?:sh|bash|zsh|dash|ksh|fish|cmd(?:\.exe)?|powershell(?:\.exe)?|pwsh(?:\.exe)?)$/i;
+const INTERPRETER_EXECUTION = /\b(?:os\.system|subprocess\.(?:run|call|check_call|check_output|Popen)|child_process|\bexec\s*\(|\beval\s*\(|\bspawn\s*\()/i;
+const CATASTROPHIC_TEXT = /(?:mkfs(?:\.[a-z0-9]+)?\b|\b(?:fdisk|sfdisk|cfdisk|parted|diskpart|gdisk)\b|\bdd\b[^\n]*(?:\bof=\s*\/dev\/|\bof=\s*\\\\\.\\)|\b(?:shutdown|reboot|halt|poweroff|restart-computer|stop-computer)\b|\brm\b[^\n]*(?:--recursive|--force|-[a-z]*r[a-z]*f[a-z]*|-[a-z]*f[a-z]*r[a-z]*)[^\n]*(?:\s|\s*\/\s*|\s*~\s*|\s*\$HOME\b|\s*\$\{HOME\})|\bpython[0-9.]*\b[^\n]*(?:os\.system|subprocess|rm\s+-[^\n]*r[^\n]*f))/i;
 
 const DANGEROUS_RULES = [
   { id: 'filesystem-format', description: 'formats a filesystem', commands: /^mkfs(\.[a-z0-9]+)?$/i, args: () => true },
@@ -18,15 +22,19 @@ const DANGEROUS_RULES = [
   { id: 'disk-partition', description: 'repartitions a disk', commands: /^(fdisk|sfdisk|cfdisk|parted|diskpart|gdisk)$/i, args: () => true },
   { id: 'redirect-to-device', description: 'redirects output into a block device', commands: null, anySegment: />>?\s*\/dev\/(sd|hd|vd|nvme|mmcblk|disk)/i },
   { id: 'host-power', description: 'powers off or reboots the machine', commands: /^(shutdown|reboot|halt|poweroff|restart-computer|stop-computer)$/i, args: () => true },
+  { id: 'service-power', description: 'changes system power through a service manager', commands: /^systemctl$/i, args: segment => /\b(?:poweroff|reboot|halt|shutdown)\b/i.test(segment) },
   { id: 'init-runlevel', description: 'changes the init runlevel', commands: /^init$/i, args: segment => /\binit\s+[06]\b/i.test(segment) },
   { id: 'fork-bomb', description: 'starts a fork bomb', commands: null, anySegment: /:\s*\(\s*\)\s*\{[^}]*\}\s*;\s*:/ },
   {
     id: 'recursive-root-delete',
     description: 'recursively deletes a root or home path',
     commands: /^rm$/i,
-    args: segment => /(^|\s)-[a-z]*r[a-z]*(\s|$)/i.test(segment)
-      && /(^|\s)-[a-z]*f[a-z]*(\s|$)/i.test(segment)
-      && /(\s)(\/|\/\*|~|~\/\*|\$HOME|\$\{HOME\})(\s|$)/i.test(segment),
+    args: segment => {
+      const recursive = /(^|\s)(?:--recursive|-[a-z]*r[a-z]*)(?=\s|$)/i.test(segment);
+      const force = /(^|\s)(?:--force|-[a-z]*f[a-z]*)(?=\s|$)/i.test(segment);
+      const rootTarget = /(\s)(\/|\/\*|~|~\/\*|\$HOME|\$\{HOME\})(\s|$)/i.test(segment);
+      return recursive && force && rootTarget;
+    },
   },
   { id: 'chmod-root', description: 'recursively rewrites permissions on a root path', commands: /^chmod$/i, args: segment => /(\s)(\/|\/\*)(\s|$)/.test(segment) },
   { id: 'chown-root', description: 'recursively rewrites ownership on a root path', commands: /^chown$/i, args: segment => /(\s)(\/|\/\*)(\s|$)/.test(segment) },
@@ -39,6 +47,10 @@ function normalize(command) {
   return String(command).replace(/\s+/g, ' ').trim();
 }
 
+function matchingText(value) {
+  return String(value).replace(/(["'])(.*?)\1/g, '$2').replace(/\\(["'\\$`])/g, '$1');
+}
+
 // Split on shell control operators so each simple command is judged on its own command
 // word instead of on every word in the line.
 function segments(command) {
@@ -49,14 +61,15 @@ function segments(command) {
 }
 
 function commandWord(segment) {
-  const tokens = segment.split(' ').filter(Boolean);
+  const tokens = matchingText(segment).split(' ').filter(Boolean);
   while (tokens.length) {
     const token = tokens[0];
     if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) { tokens.shift(); continue; }
-    if (WRAPPERS.has(token.toLowerCase())) {
+    const tokenName = path.basename(token).replace(/\.(exe|cmd|bat)$/i, '').toLowerCase();
+    if (WRAPPERS.has(tokenName)) {
       tokens.shift();
       while (tokens.length && tokens[0].startsWith('-')) tokens.shift();
-      if (token.toLowerCase() === 'timeout' && tokens.length && /^\d+[smhd]?$/.test(tokens[0])) tokens.shift();
+      if (tokenName === 'timeout' && tokens.length && /^\d+[smhd]?$/.test(tokens[0])) tokens.shift();
       continue;
     }
     break;
@@ -65,22 +78,42 @@ function commandWord(segment) {
   return word.replace(/^.*[\\/]/, '').replace(/\.(exe|cmd|bat)$/i, '');
 }
 
+function nestedCommandValues(command) {
+  const values = [];
+  const normalized = String(command || '');
+  const substitution = /\$\(([\s\S]*?)\)|`([^`]*)`/g;
+  for (const match of normalized.matchAll(substitution)) values.push(match[1] || match[2] || '');
+  const shellCommand = /(^|\s)(?:-c|--command|-e|--eval)\s+(?:"([\s\S]*?)"|'([\s\S]*?)'|([^\s;]+))/g;
+  for (const match of normalized.matchAll(shellCommand)) values.push(match[2] || match[3] || match[4] || '');
+  return values;
+}
+
+function nestedExecutionIsDangerous(command) {
+  const normalized = String(command || '');
+  const shell = normalized.split(/\s+/).some(token => SHELL_WRAPPERS.test(path.basename(token).replace(/\.(exe|cmd|bat)$/i, '')));
+  return (shell || INTERPRETER_EXECUTION.test(normalized)) && CATASTROPHIC_TEXT.test(normalized);
+}
+
 export function checkCommand(command) {
   if (runtimeConfig.unrestricted) return { warned: false, mode: 'allow', unrestricted: true, findings: [] };
   const normalized = normalize(command);
-  const parts = segments(normalized);
+  const nested = nestedCommandValues(normalized);
+  const commands = [normalized, ...nested];
+  const parts = commands.flatMap(segments);
   const findings = [];
   for (const blocked of runtimeConfig.blockedCommands) {
     if (normalized.toLowerCase().includes(blocked.toLowerCase())) findings.push({ id: 'policy', description: blocked, source: 'device-policy' });
   }
   if (runtimeConfig.dangerousCommands !== 'allow') {
     for (const part of parts) {
+      const matchText = matchingText(part);
       const word = commandWord(part);
       for (const rule of DANGEROUS_RULES) {
-        const matches = rule.anySegment ? rule.anySegment.test(part) : Boolean(word && rule.commands?.test(word) && rule.args(part));
+        const matches = rule.anySegment ? rule.anySegment.test(matchText) : Boolean(word && rule.commands?.test(word) && rule.args(matchText));
         if (matches) findings.push({ id: rule.id, description: rule.description, source: 'builtin' });
       }
     }
+    if (nestedExecutionIsDangerous(matchingText(normalized))) findings.push({ id: 'nested-catastrophic-command', description: 'executes a catastrophic command through a shell or interpreter', source: 'builtin' });
   }
   if (!findings.length) return { warned: false, mode: runtimeConfig.dangerousCommands };
   const unique = [...new Map(findings.map(item => [item.id + item.description, item])).values()];

package/src/tools/files.mjs

@@ -40,8 +40,14 @@ function assertRegularFile(info, absolute) {
   return info;
 }
 
-const READ_NOFOLLOW = constants.O_RDONLY | (constants.O_NOFOLLOW || 0);
-const READWRITE_NOFOLLOW = constants.O_RDWR | (constants.O_NOFOLLOW || 0);
+const NOFOLLOW = constants.O_NOFOLLOW || 0;
+const NONBLOCK = constants.O_NONBLOCK || 0;
+const READ_NOFOLLOW = constants.O_RDONLY | NOFOLLOW;
+const READ_NOFOLLOW_NONBLOCK = READ_NOFOLLOW | NONBLOCK;
+const READWRITE_NOFOLLOW = constants.O_RDWR | NOFOLLOW;
+const WRITE_CREATE_NOFOLLOW = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | NOFOLLOW | NONBLOCK;
+const WRITE_TRUNCATE_NOFOLLOW = constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | NOFOLLOW | NONBLOCK;
+const DIRECTORY_READ_NOFOLLOW = constants.O_RDONLY | (constants.O_DIRECTORY || 0) | NOFOLLOW | NONBLOCK;
 
 async function openRegularFile(absolute, flags = READ_NOFOLLOW) {
   const handle = await open(absolute, flags);
@@ -568,11 +574,17 @@ export async function moveToTrashTool(args) {
     } catch { destination = null; }
   }
   if (!destination) destination = path.join(path.dirname(source), '.remcp-trash');
-  await mkdir(destination, { recursive: true });
+  const existingDestination = await lstat(destination).catch(() => null);
+  if (existingDestination?.isSymbolicLink()) fail('Refusing to use a symlink as the trash directory');
+  if (existingDestination && !existingDestination.isDirectory()) fail('Trash destination is not a directory');
+  await mkdir(destination, { recursive: true, mode: 0o700 });
+  destination = await resolveSafePath(destination, 'trash');
+  const destinationInfo = await lstat(destination);
+  if (!destinationInfo.isDirectory() || destinationInfo.isSymbolicLink()) fail('Refusing to use a symlink as the trash directory');
   const stamp = new Date().toISOString().replace(/[:.]/g, '-');
   let target = path.join(destination, `${stamp}-${path.basename(source)}`);
   let counter = 1;
-  while (await access(target, constants.F_OK).then(() => true, () => false)) {
+  while (await lstat(target).then(value => Boolean(value), () => false)) {
     target = path.join(destination, `${stamp}-${counter}-${path.basename(source)}`);
     counter += 1;
   }
@@ -908,6 +920,384 @@ export async function copyFileTool(args) {
 }
 
 // --- archives -------------------------------------------------------------------------
+async function assertNoSymlinkTree(root, state = { entries: 0 }) {
+  const info = await lstat(root);
+  if (info.isSymbolicLink()) fail(`Archive sources cannot contain symbolic links: ${displayPath(root)}`);
+  if (!info.isDirectory() && !info.isFile()) fail(`Archive sources cannot contain special files: ${displayPath(root)}`);
+  state.entries += 1;
+  if (state.entries > 100_000) fail('Archive source contains too many entries');
+  if (state.maxBytes !== undefined && info.isFile()) {
+    state.bytes = (state.bytes || 0) + info.size;
+    if (state.bytes > state.maxBytes) fail('Archive source exceeds the safety limit');
+  }
+  if (!info.isDirectory()) return;
+  const entries = await readdir(root, { withFileTypes: true });
+  for (const entry of entries) await assertNoSymlinkTree(path.join(root, entry.name), state);
+}
+
+const MAX_ARCHIVE_EXPANDED_BYTES = Math.min(
+  4 * 1024 * 1024 * 1024,
+  Math.max(64 * 1024 * 1024, Number(process.env.REMCP_MAX_ARCHIVE_EXPANDED_BYTES) || 512 * 1024 * 1024),
+);
+
+function safeArchiveEntry(name) {
+  const normalized = String(name || '').replace(/\\/g, '/');
+  return Boolean(normalized) && !normalized.startsWith('/') && !/^[A-Za-z]:\//.test(normalized) && !normalized.split('/').includes('..');
+}
+
+function archiveExpandedSize(lines, pattern, label, expectedEntries = null) {
+  let total = 0;
+  let matched = 0;
+  for (const line of lines) {
+    const match = line.match(pattern);
+    if (!match) continue;
+    total += Number(match[1]);
+    matched += 1;
+    if (!Number.isSafeInteger(total) || total > MAX_ARCHIVE_EXPANDED_BYTES) fail(`${label} exceeds the ${MAX_ARCHIVE_EXPANDED_BYTES}-byte extraction limit`);
+  }
+  if ((!matched && expectedEntries !== 0) || (expectedEntries !== null && matched < expectedEntries)) fail(`Could not determine ${label} size safely`);
+  return total;
+}
+
+function tarEntrySize(line) {
+  const tokens = String(line || '').trim().split(/\s+/);
+  for (const index of [2, 3, 4]) {
+    const size = Number(tokens[index]);
+    if (!Number.isSafeInteger(size) || size < 0) continue;
+    const tail = tokens.slice(index + 1);
+    const gnuDate = /^\d{4}-\d{2}-\d{2}$/.test(tail[0] || '');
+    const bsdDate = /^[A-Z][a-z]{2}$/.test(tail[0] || '')
+      && /^\d{1,2}$/.test(tail[1] || '')
+      && ((/^\d{2}:\d{2}(?::\d{2})?$/.test(tail[2] || '') && /^\d{4}$/.test(tail[3] || ''))
+        || /^\d{4}$/.test(tail[2] || ''));
+    if (gnuDate || bsdDate) return size;
+  }
+  return null;
+}
+
+function archiveTarExpandedSize(lines, label, expectedEntries) {
+  let total = 0;
+  let matched = 0;
+  for (const line of lines) {
+    const size = tarEntrySize(line);
+    if (size === null) continue;
+    total += size;
+    matched += 1;
+    if (!Number.isSafeInteger(total) || total > MAX_ARCHIVE_EXPANDED_BYTES) fail(`${label} exceeds the ${MAX_ARCHIVE_EXPANDED_BYTES}-byte extraction limit`);
+  }
+  if (matched < expectedEntries) fail(`Could not determine ${label} size safely`);
+  return total;
+}
+
+function assertArchiveExpandedSize(bytes, label) {
+  if (!Number.isSafeInteger(bytes) || bytes < 0 || bytes > MAX_ARCHIVE_EXPANDED_BYTES) {
+    fail(`${label} exceeds the ${MAX_ARCHIVE_EXPANDED_BYTES}-byte extraction limit`);
+  }
+}
+
+async function assertExtractedTree(root, state = { entries: 0, bytes: 0 }) {
+  const info = await lstat(root);
+  if (info.isSymbolicLink()) fail('Archive extraction produced a symbolic link');
+  if (!info.isDirectory() && !info.isFile()) fail('Archive extraction produced a special file');
+  state.entries += 1;
+  state.bytes += info.isFile() ? info.size : 0;
+  if (state.entries > 100_000 || state.bytes > MAX_ARCHIVE_EXPANDED_BYTES) fail('Archive extraction exceeded the safety limit');
+  if (!info.isDirectory()) return;
+  for (const entry of await readdir(root, { withFileTypes: true })) await assertExtractedTree(path.join(root, entry.name), state);
+}
+
+async function openArchiveSource(absolute) {
+  if (process.platform !== 'linux') {
+    const opened = await openRegularFile(absolute, READ_NOFOLLOW_NONBLOCK);
+    return { ...opened, close: () => opened.handle.close() };
+  }
+  const root = path.parse(absolute).root;
+  const parts = absolute.slice(root.length).split(path.sep).filter(Boolean);
+  if (!parts.length) return openRegularFile(absolute, READ_NOFOLLOW_NONBLOCK);
+  const directories = [];
+  let current = root;
+  const closeDirectories = async () => {
+    for (const handle of directories.reverse()) await handle.close().catch(() => {});
+  };
+  try {
+    for (const part of parts.slice(0, -1)) {
+      const handle = await open(path.join(current, part), DIRECTORY_READ_NOFOLLOW);
+      try {
+        const info = await handle.stat();
+        if (!info.isDirectory()) fail('Archive source is not a safe regular file');
+      } catch (error) {
+        await handle.close().catch(() => {});
+        throw error;
+      }
+      directories.push(handle);
+      current = `/proc/self/fd/${handle.fd}`;
+    }
+    const opened = await openRegularFile(path.join(current, parts.at(-1)), READ_NOFOLLOW_NONBLOCK);
+    return {
+      ...opened,
+      close: async () => {
+        try { await opened.handle.close(); }
+        finally { await closeDirectories(); }
+      },
+    };
+  } catch (error) {
+    await closeDirectories();
+    throw error;
+  }
+}
+
+async function snapshotRegularFile(source, destination, maxBytes) {
+  const sourceInfo = await lstat(source);
+  if (sourceInfo.isSymbolicLink()) fail(`Archive source is a symbolic link: ${displayPath(source)}`);
+  if (!sourceInfo.isFile()) fail(`Archive source is not a regular file: ${displayPath(source)}`);
+  const opened = await openArchiveSource(source);
+  const { handle, info } = opened;
+  let output;
+  try {
+    if (info.size > maxBytes) fail(`Archive is ${info.size} bytes, above the ${maxBytes}-byte snapshot limit`);
+    output = await open(destination, WRITE_CREATE_NOFOLLOW, 0o400);
+    const buffer = Buffer.allocUnsafe(1024 * 1024);
+    let offset = 0;
+    for (;;) {
+      const { bytesRead } = await handle.read(buffer, 0, buffer.length, offset);
+      if (!bytesRead) break;
+      if (!Number.isSafeInteger(offset + bytesRead) || offset + bytesRead > maxBytes) {
+        fail(`Archive grew beyond the ${maxBytes}-byte snapshot limit`);
+      }
+      let written = 0;
+      while (written < bytesRead) {
+        const result = await output.write(buffer, written, bytesRead - written, offset + written);
+        if (!result.bytesWritten) throw new Error('Could not finish writing the archive snapshot');
+        written += result.bytesWritten;
+      }
+      offset += bytesRead;
+    }
+    await output.truncate(offset);
+    await output.sync();
+    await output.chmod(0o400);
+    return offset;
+  } finally {
+    if (output) await output.close().catch(() => {});
+    await opened.close().catch(() => {});
+  }
+}
+
+async function copyOpenRegularFile(sourceHandle, sourceInfo, destinationPath, state) {
+  const mode = sourceInfo.mode & 0o777;
+  const currentBytes = state.bytes || 0;
+  if (state.maxBytes !== undefined && sourceInfo.size > state.maxBytes - currentBytes) {
+    fail(`Archive contents exceed the ${state.maxBytes}-byte extraction limit`);
+  }
+  const existing = await lstat(destinationPath).catch(() => null);
+  if (existing && (!existing.isFile() || existing.isSymbolicLink())) fail('Archive contains a link or special file; archive destination is unsafe');
+  let output;
+  try {
+    try {
+      output = await open(destinationPath, WRITE_TRUNCATE_NOFOLLOW, mode);
+    } catch (error) {
+      if (['ELOOP', 'ENOTDIR', 'EISDIR'].includes(error?.code)) fail('Archive contains a link or special file; archive destination is unsafe');
+      throw error;
+    }
+    const outputInfo = await output.stat();
+    if (!outputInfo.isFile()) fail('Archive contains a link or special file; archive destination is unsafe');
+    const buffer = Buffer.allocUnsafe(1024 * 1024);
+    let offset = 0;
+    for (;;) {
+      const { bytesRead } = await sourceHandle.read(buffer, 0, buffer.length, offset);
+      if (!bytesRead) break;
+      if (!Number.isSafeInteger(offset + bytesRead) || (state.maxBytes !== undefined && currentBytes + offset + bytesRead > state.maxBytes)) {
+        fail(`Archive contents exceed the ${state.maxBytes}-byte extraction limit`);
+      }
+      let written = 0;
+      while (written < bytesRead) {
+        const result = await output.write(buffer, written, bytesRead - written, offset + written);
+        if (!result.bytesWritten) throw new Error('Could not finish copying archive contents');
+        written += result.bytesWritten;
+      }
+      offset += bytesRead;
+    }
+    await output.truncate(offset);
+    await output.sync();
+    await output.chmod(mode);
+    state.bytes = currentBytes + offset;
+  } finally {
+    if (output) await output.close().catch(() => {});
+  }
+}
+
+async function copyTreeContents(source, destination, state = { entries: 0, bytes: 0, maxBytes: MAX_ARCHIVE_EXPANDED_BYTES }) {
+  const initial = await lstat(source);
+  if (initial.isSymbolicLink() || (!initial.isDirectory() && !initial.isFile())) fail('Archive contains a link or special file; archive destination is unsafe');
+  state.entries += 1;
+  if (state.entries > 100_000) fail('Archive contains too many entries');
+  if (initial.isFile()) {
+    const opened = await openRegularFile(source, READ_NOFOLLOW_NONBLOCK);
+    try { await copyOpenRegularFile(opened.handle, opened.info, destination, state); }
+    finally { await opened.handle.close(); }
+    return;
+  }
+  let directoryHandle = null;
+  let sourcePath = source;
+  let info = initial;
+  try {
+    if (process.platform === 'linux') {
+      try {
+        directoryHandle = await open(source, DIRECTORY_READ_NOFOLLOW);
+        info = await directoryHandle.stat();
+        if (!info.isDirectory()) fail('Archive contains a link or special file; archive destination is unsafe');
+        sourcePath = `/proc/self/fd/${directoryHandle.fd}`;
+      } catch (error) {
+        if (['ELOOP', 'ENOTDIR'].includes(error?.code)) fail('Archive contains a link or special file; archive destination is unsafe');
+        throw error;
+      }
+    }
+    const mode = info.mode & 0o777;
+    const existing = await lstat(destination).catch(() => null);
+    if (existing && (!existing.isDirectory() || existing.isSymbolicLink())) fail('Archive contains a link or special file; archive destination is unsafe');
+    try { await mkdir(destination, { mode: mode | 0o700 }); }
+    catch (error) { if (error?.code !== 'EEXIST') throw error; }
+    const destinationInfo = await lstat(destination);
+    if (!destinationInfo.isDirectory() || destinationInfo.isSymbolicLink()) fail('Archive contains a link or special file; archive destination is unsafe');
+    let destinationHandle;
+    try {
+      destinationHandle = await open(destination, DIRECTORY_READ_NOFOLLOW);
+      const openedDestination = await destinationHandle.stat();
+      if (!openedDestination.isDirectory()) fail('Archive contains a link or special file; archive destination is unsafe');
+      await destinationHandle.chmod(mode | 0o700);
+      for (const name of await readdir(sourcePath)) {
+        await copyTreeContents(path.join(sourcePath, name), path.join(destination, name), state);
+      }
+      await destinationHandle.chmod(mode);
+    } finally {
+      if (destinationHandle) await destinationHandle.close().catch(() => {});
+    }
+  } finally {
+    if (directoryHandle) await directoryHandle.close().catch(() => {});
+  }
+}
+
+async function removeExtractionArtifact(target) {
+  const info = await lstat(target).catch(() => null);
+  if (!info) return;
+  if (info.isDirectory() && !info.isSymbolicLink()) await rm(target, { recursive: true, force: true });
+  else await unlink(target).catch(error => { if (error?.code !== 'ENOENT') throw error; });
+}
+
+async function recoverExtractionArtifacts(parent, destination, prefix) {
+  const entries = await readdir(parent, { withFileTypes: true });
+  const staleBefore = Date.now() - 60 * 60 * 1000;
+  for (const entry of entries) {
+    if (!entry.name.startsWith('.remcp-extract-txn-')) continue;
+    const candidate = path.join(parent, entry.name);
+    const info = await lstat(candidate).catch(() => null);
+    if (info && info.mtimeMs < staleBefore) await removeExtractionArtifact(candidate);
+  }
+  const backups = entries.filter(entry => entry.name.startsWith(prefix)).map(entry => path.join(parent, entry.name));
+  for (const backup of backups) {
+    const destinationInfo = await lstat(destination).catch(() => null);
+    if (destinationInfo) {
+      await removeExtractionArtifact(backup);
+      continue;
+    }
+    const backupInfo = await lstat(backup).catch(() => null);
+    if (!backupInfo) continue;
+    if (backupInfo.isSymbolicLink() || !backupInfo.isDirectory()) {
+      await removeExtractionArtifact(backup);
+      continue;
+    }
+    try {
+      await rename(backup, destination);
+    } catch {
+      continue;
+    }
+  }
+}
+
+async function restoreExtractionBackup(backup, destination) {
+  if (await lstat(destination).catch(() => null)) return false;
+  const info = await lstat(backup).catch(() => null);
+  if (!info) return false;
+  if (info.isSymbolicLink() || !info.isDirectory()) {
+    await removeExtractionArtifact(backup);
+    return false;
+  }
+  try {
+    await rename(backup, destination);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function installExtractedTree(source, destination) {
+  const parent = path.dirname(destination);
+  if (destination === path.parse(destination).root) fail('Archive destination cannot be a filesystem root');
+  await mkdir(parent, { recursive: true, mode: 0o700 });
+  const backupPrefix = `.remcp-extract-backup-${createHash('sha256').update(destination).digest('hex').slice(0, 16)}-`;
+  await recoverExtractionArtifacts(parent, destination, backupPrefix);
+  const existing = await lstat(destination).catch(() => null);
+  const destinationMode = existing?.isDirectory() ? existing.mode & 0o777 : 0o700;
+  const transaction = await mkdtemp(path.join(parent, '.remcp-extract-txn-'));
+  let backup = '';
+  let backupOwned = false;
+  let preserveBackup = false;
+  try {
+    if (existing) {
+      backup = path.join(parent, `${backupPrefix}${randomUUID()}`);
+      try {
+        await rename(destination, backup);
+        backupOwned = true;
+      } catch (error) {
+        if (error?.code !== 'ENOENT') throw error;
+        backup = '';
+      }
+    }
+    if (backupOwned) {
+      const backupInfo = await lstat(backup);
+      if (backupInfo.isSymbolicLink() || !backupInfo.isDirectory()) fail('Archive destination is not a safe directory');
+      await copyTreeContents(backup, transaction);
+    }
+    await copyTreeContents(source, transaction);
+    await chmod(transaction, destinationMode);
+    await rename(transaction, destination);
+    if (backupOwned) {
+      await removeExtractionArtifact(backup);
+      backupOwned = false;
+    }
+  } catch (error) {
+    if (backupOwned) {
+      try {
+        await restoreExtractionBackup(backup, destination);
+        if (!await lstat(backup).catch(() => null)) backupOwned = false;
+        else preserveBackup = true;
+      } catch (restoreError) {
+        preserveBackup = true;
+        throw new AggregateError([error, restoreError], 'Could not restore archive destination after extraction failure');
+      }
+    }
+    throw error;
+  } finally {
+    await rm(transaction, { recursive: true, force: true });
+    if (backupOwned && !preserveBackup) await removeExtractionArtifact(backup);
+  }
+}
+
+async function moveArchiveFile(source, destination) {
+  try {
+    await rename(source, destination);
+  } catch (error) {
+    if (!['EXDEV', 'EPERM'].includes(error?.code)) throw error;
+    const temporary = path.join(path.dirname(destination), `.${path.basename(destination)}.remcp-${randomUUID()}.tmp`);
+    try {
+      await copyFile(source, temporary, constants.COPYFILE_EXCL);
+      await rename(temporary, destination);
+    } finally {
+      await unlink(temporary).catch(() => {});
+    }
+    await unlink(source);
+  }
+}
+
 function archiveTool() {
   const probe = (name, versionArgs = ['--version']) => {
     const result = spawnSync(name, versionArgs, { encoding: 'utf8' });
@@ -924,57 +1314,132 @@ export async function createArchiveTool(args) {
   if (!sources.length) fail('paths must list at least one file or directory');
   const resolved = [];
   for (const entry of sources) resolved.push(await resolveSafePath(entry, 'paths[]'));
+  const sourceState = { entries: 0, bytes: 0, maxBytes: MAX_ARCHIVE_EXPANDED_BYTES };
+  for (const entry of resolved) await assertNoSymlinkTree(entry, sourceState);
   const destination = await resolveSafePath(args.destination, 'destination');
+  const existingDestination = await lstat(destination).catch(() => null);
+  if (existingDestination?.isSymbolicLink()) fail('Archive destination cannot be a symbolic link');
   const format = String(args.format || (destination.endsWith('.zip') ? 'zip' : 'tar.gz')).toLowerCase();
   await mkdir(path.dirname(destination), { recursive: true });
   const baseDir = path.dirname(resolved[0]);
   const names = resolved.map(entry => path.relative(baseDir, entry));
-  // An archive written inside the tree it packs makes tar abort with "file changed as we
-  // read it" (the directory mtime moves while it is being read), so build it outside the
-  // tree first and move it into place afterwards.
-  const destinationRelative = path.relative(baseDir, destination);
-  const selfInside = !destinationRelative.startsWith('..') && !path.isAbsolute(destinationRelative);
+  if (names.some(name => !name || name.startsWith('..') || path.isAbsolute(name))) fail('Archive sources must share one parent directory');
+  const archiveNames = names.map(name => name.startsWith('-') ? `./${name}` : name);
   const suffix = format === 'zip' ? '.zip' : format === 'tar' ? '.tar' : '.tar.gz';
-  const staging = selfInside ? path.join(os.tmpdir(), `remcp-archive-${Date.now()}-${process.pid}${suffix}`) : destination;
-  const output = staging;
-  if (format === 'zip') {
-    if (!tools.zip) fail('zip is not installed on this device; use format "tar.gz"');
-    const result = spawnSync(tools.zip, ['-r', '-q', output, ...names], { cwd: baseDir, encoding: 'utf8' });
-    if (result.status !== 0) fail(`zip failed: ${(result.stderr || result.stdout || '').trim() || `exit ${result.status}`}`);
-  } else if (format === 'tar' || format === 'tar.gz' || format === 'tgz') {
-    if (!tools.tar) fail('tar is not installed on this device');
-    const flags = format === 'tar' ? '-cf' : '-czf';
-    const result = spawnSync(tools.tar, [flags, output, ...names], { cwd: baseDir, encoding: 'utf8' });
-    if (result.status !== 0) fail(`tar failed: ${(result.stderr || '').trim() || `exit ${result.status}`}`);
-  } else {
-    fail('format must be tar, tar.gz, or zip');
+  const stagingDirectory = await mkdtemp(path.join(os.tmpdir(), 'remcp-archive-'));
+  if (resolved.some(entry => !path.relative(entry, stagingDirectory).startsWith('..') && !path.isAbsolute(path.relative(entry, stagingDirectory)))) {
+    await rm(stagingDirectory, { recursive: true, force: true });
+    fail('Archive source must not contain the system temporary directory');
   }
-  if (selfInside) {
-    await mkdir(path.dirname(destination), { recursive: true });
-    await rename(staging, destination);
+   const staging = path.join(stagingDirectory, `payload${suffix}`);
+   const snapshotRoot = path.join(stagingDirectory, 'source');
+   try {
+     await mkdir(snapshotRoot, { mode: 0o700 });
+     const snapshotState = { entries: 0, bytes: 0, maxBytes: MAX_ARCHIVE_EXPANDED_BYTES };
+     for (let index = 0; index < resolved.length; index += 1) {
+       const snapshotPath = path.join(snapshotRoot, names[index]);
+       await mkdir(path.dirname(snapshotPath), { recursive: true, mode: 0o700 });
+       await copyTreeContents(resolved[index], snapshotPath, snapshotState);
+     }
+     if (format === 'zip') {
+       if (!tools.zip) fail('zip is not installed on this device; use format "tar.gz"');
+       const result = spawnSync(tools.zip, ['-r', '-q', '-y', staging, '--', ...archiveNames], { cwd: snapshotRoot, encoding: 'utf8', timeout: 120_000, maxBuffer: 16 * 1024 * 1024 });
+      if (result.status !== 0) fail(`zip failed: ${(result.stderr || result.stdout || '').trim() || `exit ${result.status}`}`);
+    } else if (format === 'tar' || format === 'tar.gz' || format === 'tgz') {
+      if (!tools.tar) fail('tar is not installed on this device');
+      const flags = format === 'tar' ? '-cf' : '-czf';
+       const result = spawnSync(tools.tar, [flags, staging, '--', ...archiveNames], { cwd: snapshotRoot, encoding: 'utf8', timeout: 120_000, maxBuffer: 16 * 1024 * 1024 });
+      if (result.status !== 0) fail(`tar failed: ${(result.stderr || result.stdout || '').trim() || `exit ${result.status}`}`);
+     } else {
+       fail('format must be tar, tar.gz, or zip');
+     }
+     const stagedInfo = await stat(staging);
+     assertArchiveExpandedSize(stagedInfo.size, 'archive output');
+     await mkdir(path.dirname(destination), { recursive: true });
+
+     await moveArchiveFile(staging, destination);
+     const info = await stat(destination).catch(() => null);
+     const note = ' (built outside the tree in temporary staging and committed atomically)';
+
+    return text(`Created ${displayPath(destination)} (${format}, ${info?.size ?? 0} bytes) from ${resolved.length} path(s)${note}.`);
+  } finally {
+    if (stagingDirectory) await rm(stagingDirectory, { recursive: true, force: true });
   }
-  const info = await stat(destination).catch(() => null);
-  const note = selfInside ? ' (built outside the tree so it does not include itself)' : '';
-  return text(`Created ${displayPath(destination)} (${format}, ${info?.size ?? 0} bytes) from ${resolved.length} path(s)${note}.`);
+}
+
+function archiveFormatForPath(value) {
+  if (/\.zip$/i.test(value)) return 'zip';
+  if (/\.(tar\.gz|tgz)$/i.test(value)) return 'tar.gz';
+  if (/\.(tar\.bz2|tbz2?)$/i.test(value)) return 'tar.bz2';
+  if (/\.tar\.xz$/i.test(value)) return 'tar.xz';
+  return 'tar';
+}
+
+function archiveSnapshotSuffix(format) {
+  if (format === 'zip') return '.zip';
+  if (format === 'tar.bz2') return '.tar.bz2';
+  if (format === 'tar.xz') return '.tar.xz';
+  if (format === 'tar.gz') return '.tar.gz';
+  return '.tar';
 }
 
 export async function extractArchiveTool(args) {
   const tools = archiveTool();
   const archive = await resolveSafePath(args.archive, 'archive');
   const destination = await resolveSafePath(args.destination || path.dirname(archive), 'destination');
-  await mkdir(destination, { recursive: true });
-  if (/\.zip$/i.test(archive)) {
-    if (!tools.unzip) fail('unzip is not installed on this device');
-    const result = spawnSync(tools.unzip, ['-o', '-q', archive, '-d', destination], { encoding: 'utf8' });
-    if (result.status !== 0) fail(`unzip failed: ${(result.stderr || result.stdout || '').trim() || `exit ${result.status}`}`);
-  } else {
-    if (!tools.tar) fail('tar is not installed on this device');
-    const flags = /\.(tar\.gz|tgz)$/i.test(archive) ? '-xzf' : /\.(tar\.bz2|tbz2?)$/i.test(archive) ? '-xjf' : /\.tar\.xz$/i.test(archive) ? '-xJf' : '-xf';
-    const result = spawnSync(tools.tar, [flags, archive, '-C', destination], { encoding: 'utf8' });
-    if (result.status !== 0) fail(`tar failed: ${(result.stderr || '').trim() || `exit ${result.status}`}`);
+  if (destination === path.parse(destination).root) fail('Archive destination cannot be a filesystem root');
+  const parent = path.dirname(destination);
+  const backupPrefix = `.remcp-extract-backup-${createHash('sha256').update(destination).digest('hex').slice(0, 16)}-`;
+  const format = archiveFormatForPath(archive);
+  const stagingDirectory = await mkdtemp(path.join(os.tmpdir(), 'remcp-extract-'));
+  const archiveSnapshot = path.join(stagingDirectory, `source${archiveSnapshotSuffix(format)}`);
+  const staging = path.join(stagingDirectory, 'tree');
+  try {
+    await mkdir(staging, { mode: 0o700 });
+    await snapshotRegularFile(archive, archiveSnapshot, MAX_ARCHIVE_EXPANDED_BYTES);
+    await mkdir(parent, { recursive: true, mode: 0o700 });
+    await recoverExtractionArtifacts(parent, destination, backupPrefix);
+    const existingDestination = await lstat(destination).catch(() => null);
+    if (existingDestination?.isSymbolicLink() || (existingDestination && !existingDestination.isDirectory())) fail('Archive destination is not a safe directory');
+    if (format === 'zip') {
+      if (!tools.unzip) fail('unzip is not installed on this device');
+      const listing = spawnSync(tools.unzip, ['-Z', '-1', archiveSnapshot], { encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024 });
+      if (listing.error || listing.status !== 0) fail(`Could not inspect ZIP archive: ${(listing.stderr || listing.error?.message || `exit ${listing.status}`).trim()}`);
+      const names = String(listing.stdout || '').split(/\r?\n/).filter(Boolean);
+      if (names.length > 100_000 || names.some(name => !safeArchiveEntry(name))) fail('ZIP archive contains an unsafe path or too many entries');
+      const details = spawnSync(tools.unzip, ['-Z', '-v', archiveSnapshot], { encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024 });
+      if (details.error || details.status !== 0) fail(`Could not inspect ZIP sizes: ${(details.stderr || details.error?.message || `exit ${details.status}`).trim()}`);
+      const detailText = String(details.stdout || '');
+      if (/symbolic link|Unix file attributes \([^)]*\b12\d{4}/i.test(detailText)) fail('ZIP archive contains a symbolic link');
+      const expandedBytes = archiveExpandedSize(detailText.split(/\r?\n/), /uncompressed size:\s*(\d+)\s*bytes/i, 'ZIP archive', names.length);
+      assertArchiveExpandedSize(expandedBytes, 'ZIP archive');
+      const result = spawnSync(tools.unzip, ['-o', '-q', archiveSnapshot, '-d', staging], { encoding: 'utf8', timeout: 120_000, maxBuffer: 16 * 1024 * 1024 });
+      if (result.status !== 0) fail(`unzip failed: ${(result.stderr || result.stdout || '').trim() || `exit ${result.status}`}`);
+    } else {
+      if (!tools.tar) fail('tar is not installed on this device');
+      const listFlags = format === 'tar.gz' ? '-tzf' : format === 'tar.bz2' ? '-tjf' : format === 'tar.xz' ? '-tJf' : '-tf';
+      const listing = spawnSync(tools.tar, [listFlags, archiveSnapshot], { encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024 });
+      if (listing.error || listing.status !== 0) fail(`Could not inspect archive: ${(listing.stderr || listing.error?.message || `exit ${listing.status}`).trim()}`);
+      const names = String(listing.stdout || '').split(/\r?\n/).filter(Boolean);
+      if (names.length > 100_000 || names.some(name => !safeArchiveEntry(name))) fail('Archive contains an unsafe path or too many entries');
+      const verboseFlags = format === 'tar.gz' ? '-tvzf' : format === 'tar.bz2' ? '-tvjf' : format === 'tar.xz' ? '-tvJf' : '-tvf';
+      const details = spawnSync(tools.tar, [verboseFlags, archiveSnapshot], { encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024 });
+      if (details.error || details.status !== 0) fail(`Could not inspect archive sizes: ${(details.stderr || details.error?.message || `exit ${details.status}`).trim()}`);
+      const detailLines = String(details.stdout || '').split(/\r?\n/);
+      if (detailLines.some(line => /^[bclph]/.test(line))) fail('Archive contains a link or special file; archive destination is unsafe');
+      const expandedBytes = archiveTarExpandedSize(detailLines, 'archive', names.length);
+      assertArchiveExpandedSize(expandedBytes, 'archive');
+      const flags = format === 'tar.gz' ? '-xzf' : format === 'tar.bz2' ? '-xjf' : format === 'tar.xz' ? '-xJf' : '-xf';
+      const result = spawnSync(tools.tar, [flags, archiveSnapshot, '-C', staging], { encoding: 'utf8', timeout: 120_000, maxBuffer: 16 * 1024 * 1024 });
+      if (result.status !== 0) fail(`tar failed: ${(result.stderr || result.stdout || '').trim() || `exit ${result.status}`}`);
+    }
+    await assertExtractedTree(staging);
+    await installExtractedTree(staging, destination);
+    const entries = await readdir(destination).catch(() => []);
+    return text(`Extracted ${displayPath(archive)} into ${displayPath(destination)} (${entries.length} top-level entries).`);
+  } finally {
+    await rm(stagingDirectory, { recursive: true, force: true });
   }
-  const entries = await readdir(destination).catch(() => []);
-  return text(`Extracted ${displayPath(archive)} into ${displayPath(destination)} (${entries.length} top-level entries).`);
 }
 
 // --- screenshots ----------------------------------------------------------------------

package/src/tools/terminal.mjs

@@ -221,8 +221,10 @@ export async function interactWithProcessTool(args, extra = {}) {
   const session = getProcessSession(pid);
   if (!session) fail(`No ReMCP session with pid ${pid}`);
   if (session.exited) fail(`Process ${pid} already exited`);
-  const input = typeof args.input === 'string' ? args.input : fail('input must be a string');
-  const timeoutMs = clampInteger(args.timeout_ms, 1000, 0, 120000);
+   const input = typeof args.input === 'string' ? args.input : fail('input must be a string');
+   assertAllowedCommand(input);
+   const timeoutMs = clampInteger(args.timeout_ms, 1000, 0, 120000);
+
   session.cursor = session.droppedLines + session.lines.length;
   session.waitCursor = session.cursor;
   session.lastPartialRead = null;

package/src/util.mjs

@@ -1,6 +1,6 @@
 import os from 'node:os';
 import path from 'node:path';
-import { realpath } from 'node:fs/promises';
+import { lstat, realpath } from 'node:fs/promises';
 import { liveConfig, runtimeConfig } from './config.mjs';
 
 export class ToolError extends Error {}
@@ -93,6 +93,12 @@ export async function resolveSafePath(value, field = 'path') {
   const absolute = path.resolve(raw);
   if (!runtimeConfig.allowedRoots.length) return absolute;
 
+  const leaf = await lstat(absolute).catch(error => {
+    if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') return null;
+    throw error;
+  });
+  if (leaf?.isSymbolicLink()) fail(`Path is a symbolic link: ${absolute}`);
+
   // Canonicalize both sides before enforcing confinement. This matters on macOS where
   // /var is a symlink to /private/var: a safe path returned by an earlier canonicalization
   // must not be rejected merely because its lexical prefix differs from the configured root.