@remcp/runtime 0.2.106 → 0.2.108

package/src/tools/files.mjs

@@ -3,7 +3,7 @@ import os from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { constants, createReadStream } from 'node:fs';
-import { access, chmod, chown, copyFile, cp, lstat, mkdir, mkdtemp, open, readFile, readdir, rename, rm, stat, unlink, writeFile } from 'node:fs/promises';
+import { access, chmod, chown, copyFile, cp, lstat, mkdir, mkdtemp, open, readFile, readdir, rename, rm, stat, unlink } from 'node:fs/promises';
 import { pipeline } from 'node:stream/promises';
 import { liveConfig, runtimeConfig } from '../config.mjs';
 import { documentKind, readDocxText, readPdfText } from '../documents.mjs';
@@ -40,8 +40,74 @@ function assertRegularFile(info, absolute) {
   return info;
 }
 
-const READ_NOFOLLOW = constants.O_RDONLY | (constants.O_NOFOLLOW || 0);
-const READWRITE_NOFOLLOW = constants.O_RDWR | (constants.O_NOFOLLOW || 0);
+const NOFOLLOW = constants.O_NOFOLLOW || 0;
+const NONBLOCK = constants.O_NONBLOCK || 0;
+const READ_NOFOLLOW = constants.O_RDONLY | NOFOLLOW;
+const READ_NOFOLLOW_NONBLOCK = READ_NOFOLLOW | NONBLOCK;
+const READWRITE_NOFOLLOW = constants.O_RDWR | NOFOLLOW;
+const WRITE_CREATE_NOFOLLOW = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | NOFOLLOW | NONBLOCK;
+const WRITE_TRUNCATE_NOFOLLOW = constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | NOFOLLOW | NONBLOCK;
+const DIRECTORY_READ_NOFOLLOW = constants.O_RDONLY | (constants.O_DIRECTORY || 0) | NOFOLLOW | NONBLOCK;
+
+async function openDirectoryPath(absolute, { create = false } = {}) {
+  const descriptorBound = process.platform === 'linux' && Boolean(constants.O_NOFOLLOW) && Boolean(constants.O_DIRECTORY);
+  if (!descriptorBound) {
+    if (create) await mkdir(absolute, { recursive:true, mode:0o700 });
+    const info = await lstat(absolute);
+    if (info.isSymbolicLink() || !info.isDirectory()) fail('Filesystem path component is not a safe directory');
+    const handle = {
+      stat: () => stat(absolute),
+      chmod: mode => chmod(absolute, mode),
+      close: async () => {},
+    };
+    return { handle, anchor:absolute, descriptorBound:false, close: handle.close };
+  }
+  if (absolute.startsWith('/proc/self/fd/')) {
+    const handle = await open(absolute, DIRECTORY_READ_NOFOLLOW);
+    return { handle, anchor: `/proc/self/fd/${handle.fd}`, close: () => handle.close() };
+  }
+  const root = path.parse(absolute).root;
+  const parts = absolute.slice(root.length).split(path.sep).filter(Boolean);
+  if (!parts.length) {
+    const handle = await open(root, DIRECTORY_READ_NOFOLLOW);
+    return { handle, anchor: `/proc/self/fd/${handle.fd}`, close: () => handle.close() };
+  }
+  const directories = [];
+  let current = root;
+  const closeDirectories = async () => {
+    for (const handle of directories.reverse()) await handle.close().catch(() => {});
+  };
+  try {
+    for (const part of parts) {
+      const candidate = path.join(current, part);
+      if (create) {
+        await mkdir(candidate, { mode:0o700 }).catch(error => {
+          if (error?.code !== 'EEXIST') throw error;
+        });
+      }
+      const handle = await open(candidate, DIRECTORY_READ_NOFOLLOW);
+      const info = await handle.stat();
+      if (!info.isDirectory()) {
+        await handle.close().catch(() => {});
+        fail('Filesystem path component is not a directory');
+      }
+      directories.push(handle);
+      current = `/proc/self/fd/${handle.fd}`;
+    }
+    const handle = directories.pop();
+    return {
+      handle,
+      anchor: current,
+      close: async () => {
+        try { await handle.close(); }
+        finally { await closeDirectories(); }
+      },
+    };
+  } catch (error) {
+    await closeDirectories();
+    throw error;
+  }
+}
 
 async function openRegularFile(absolute, flags = READ_NOFOLLOW) {
   const handle = await open(absolute, flags);
@@ -54,6 +120,51 @@ async function openRegularFile(absolute, flags = READ_NOFOLLOW) {
   }
 }
 
+async function openWritableParent(absolute) {
+  if (process.platform === 'linux' && constants.O_NOFOLLOW && constants.O_DIRECTORY) {
+    return openDirectoryPath(absolute, { create:true });
+  }
+  await mkdir(absolute, { recursive:true });
+  const info = await lstat(absolute);
+  if (info.isSymbolicLink() || !info.isDirectory()) fail('Filesystem path component is not a directory');
+  return { anchor:absolute, close:async() => {} };
+}
+
+async function writeResolvedFile(absolute, content, { append = false } = {}) {
+  const parent = await openWritableParent(path.dirname(absolute));
+  let handle;
+  try {
+    const flags = append
+      ? constants.O_WRONLY | constants.O_CREAT | (constants.O_APPEND || 0) | NOFOLLOW | NONBLOCK
+      : WRITE_TRUNCATE_NOFOLLOW;
+    handle = await open(path.join(parent.anchor, path.basename(absolute)), flags, 0o600);
+    await handle.writeFile(content);
+  } finally {
+    if (handle) await handle.close().catch(() => {});
+    await parent.close().catch(() => {});
+  }
+}
+
+async function withWritableParent(absolute, callback) {
+  const parent = await openWritableParent(path.dirname(absolute));
+  try {
+    return await callback(path.join(parent.anchor, path.basename(absolute)));
+  } finally {
+    await parent.close().catch(() => {});
+  }
+}
+
+async function ensureDirectoryPath(absolute) {
+  if (process.platform === 'linux' && constants.O_NOFOLLOW && constants.O_DIRECTORY) {
+    const directory = await openDirectoryPath(absolute, { create:true });
+    await directory.close();
+    return;
+  }
+  await mkdir(absolute, { recursive:true });
+  const info = await lstat(absolute);
+  if (info.isSymbolicLink() || !info.isDirectory()) fail('Filesystem path component is not a directory');
+}
+
 async function readRegularBuffer(absolute, maxBytes = Infinity) {
   const { handle, info } = await openRegularFile(absolute);
   try {
@@ -325,8 +436,7 @@ export async function writeFileTool(args) {
       fail(`Appending ${bytes} bytes would grow ${displayPath(absolute)} to ${existingSize + bytes} bytes, above the ${runtimeConfig.maxWriteBytes}-byte write limit for this device`);
     }
   }
-  await mkdir(path.dirname(absolute), { recursive: true });
-  await writeFile(absolute, content, mode === 'append' ? { encoding: 'utf8', flag: 'a' } : 'utf8');
+  await writeResolvedFile(absolute, content, { append: mode === 'append' });
   countEvent('bytesWritten', bytes);
   return text(`${mode === 'append' ? 'Appended' : 'Wrote'} ${bytes} bytes to ${displayPath(absolute)}.`);
 }
@@ -381,8 +491,7 @@ export async function writeBinaryTool(args) {
     recordEvent('write_denied', { reason: 'size_limit' });
     fail(`Decoded content is ${buffer.length} bytes, above the ${runtimeConfig.maxWriteBytes}-byte write limit for this device`);
   }
-  await mkdir(path.dirname(absolute), { recursive: true });
-  await writeFile(absolute, buffer, mode === 'append' ? { flag: 'a' } : undefined);
+  await writeResolvedFile(absolute, buffer, { append: mode === 'append' });
   countEvent('bytesWritten', buffer.length);
   return text(`${mode === 'append' ? 'Appended' : 'Wrote'} ${buffer.length} bytes to ${displayPath(absolute)}.`);
 }
@@ -429,7 +538,7 @@ export async function editBlockTool(args) {
   if (occurrences === expected) {
     const updated = content.split(oldString).join(newString);
     assertWritableSize(updated);
-    if (!dryRun) await writeFile(absolute, updated, 'utf8');
+    if (!dryRun) await writeResolvedFile(absolute, updated);
     return text(present(updated, `Replaced ${occurrences} occurrence(s)`));
   }
   if (occurrences > 0) {
@@ -451,7 +560,7 @@ export async function editBlockTool(args) {
   // file to LF and turned a one-line change into a whole-file diff on Windows.
   const updated = `${lines.join(eol)}${endsWithNewline && lines.length ? eol : ''}`;
   assertWritableSize(updated);
-  if (!dryRun) await writeFile(absolute, updated, 'utf8');
+  if (!dryRun) await writeResolvedFile(absolute, updated);
   return text(present(updated, `Replaced ${starts.length} occurrence(s) using whitespace-tolerant matching (line endings kept as ${eol === '\r\n' ? 'CRLF' : 'LF'})`));
 }
 
@@ -476,7 +585,7 @@ export async function replaceLinesTool(args) {
   if (dryRun) {
     return text(`${summary}\n(dry run: nothing was written)\n${unifiedDiff(original, updatedText, { oldLabel: displayPath(absolute), newLabel: 'after' })}`);
   }
-  await writeFile(absolute, updatedText, 'utf8');
+  await writeResolvedFile(absolute, updatedText);
   return text(`${summary}.`);
 }
 
@@ -568,19 +677,27 @@ export async function moveToTrashTool(args) {
     } catch { destination = null; }
   }
   if (!destination) destination = path.join(path.dirname(source), '.remcp-trash');
-  await mkdir(destination, { recursive: true });
+  const existingDestination = await lstat(destination).catch(() => null);
+  if (existingDestination?.isSymbolicLink()) fail('Refusing to use a symlink as the trash directory');
+  if (existingDestination && !existingDestination.isDirectory()) fail('Trash destination is not a directory');
+  await ensureDirectoryPath(destination);
+  destination = await resolveSafePath(destination, 'trash');
+  const destinationInfo = await lstat(destination);
+  if (!destinationInfo.isDirectory() || destinationInfo.isSymbolicLink()) fail('Refusing to use a symlink as the trash directory');
   const stamp = new Date().toISOString().replace(/[:.]/g, '-');
   let target = path.join(destination, `${stamp}-${path.basename(source)}`);
   let counter = 1;
-  while (await access(target, constants.F_OK).then(() => true, () => false)) {
+  while (await lstat(target).then(value => Boolean(value), () => false)) {
     target = path.join(destination, `${stamp}-${counter}-${path.basename(source)}`);
     counter += 1;
   }
-  await rename(source, target).catch(async error => {
-    if (error?.code !== 'EXDEV') throw error;
-    if (info.isDirectory()) fail('Moving a directory to the trash across filesystems is not supported');
-    await copyFile(source, target);
-    await unlink(source);
+  await withWritableParent(target, async anchoredTarget => {
+    await rename(source, anchoredTarget).catch(async error => {
+      if (error?.code !== 'EXDEV') throw error;
+      if (info.isDirectory()) fail('Moving a directory to the trash across filesystems is not supported');
+      await copyFile(source, anchoredTarget);
+      await unlink(source);
+    });
   });
   return text(`Moved ${displayPath(source)} to ${displayPath(target)}. Restore it with move_file if this was a mistake.`);
 }
@@ -649,8 +766,7 @@ export async function writeFilesTool(args) {
       const bytes = assertWritableSize(content);
       totalBytes += bytes;
       if (totalBytes > runtimeConfig.maxWriteBytes * 4) fail(`This call would write ${totalBytes} bytes, above the ${runtimeConfig.maxWriteBytes * 4}-byte batch limit`);
-      await mkdir(path.dirname(absolute), { recursive: true });
-      await writeFile(absolute, content, entry.mode === 'append' ? { encoding: 'utf8', flag: 'a' } : 'utf8');
+      await writeResolvedFile(absolute, content, { append: entry.mode === 'append' });
       results.push(`${entry.mode === 'append' ? 'appended' : 'wrote'} ${displayPath(absolute)} (${bytes} bytes)`);
     } catch (error) {
       results.push(`failed ${target}: ${describeFilesystemFailure(error, { path: error?.path })}`);
@@ -720,8 +836,7 @@ export async function copyPathsTool(args) {
       if (!info) throw new Error('source not found');
       const existing = await stat(destination).catch(() => null);
       if (existing && !overwrite) throw new Error('destination already exists (pass overwrite: true)');
-      await mkdir(path.dirname(destination), { recursive: true });
-      await cp(source, destination, { recursive: true, force: overwrite, errorOnExist: !overwrite });
+      await withWritableParent(destination, anchoredDestination => cp(source, anchoredDestination, { recursive: true, force: overwrite, errorOnExist: !overwrite }));
       copied += 1;
       results.push(`copied ${displayPath(source)} → ${displayPath(destination)}`);
     } catch (error) {
@@ -747,14 +862,15 @@ export async function movePathsTool(args) {
       if (!info) throw new Error('source not found');
       const existing = await stat(destination).catch(() => null);
       if (existing && !overwrite) throw new Error('destination already exists (pass overwrite: true)');
-      await mkdir(path.dirname(destination), { recursive: true });
-      try {
-        await rename(source, destination);
-      } catch (error) {
-        if (error?.code !== 'EXDEV') throw error;
-        await cp(source, destination, { recursive: true, force: overwrite, errorOnExist: !overwrite });
-        await rm(source, { recursive: true, force: true });
-      }
+      await withWritableParent(destination, async anchoredDestination => {
+        try {
+          await rename(source, anchoredDestination);
+        } catch (error) {
+          if (error?.code !== 'EXDEV') throw error;
+          await cp(source, anchoredDestination, { recursive: true, force: overwrite, errorOnExist: !overwrite });
+          await rm(source, { recursive: true, force: true });
+        }
+      });
       moved += 1;
       results.push(`moved ${displayPath(source)} → ${displayPath(destination)}`);
     } catch (error) {
@@ -789,8 +905,7 @@ export async function applyPatchTool(args) {
       const stats = diffStats(original, updated);
       if (!dryRun) {
         assertWritableSize(updated);
-        await mkdir(path.dirname(absolute), { recursive: true });
-        await writeFile(absolute, updated, 'utf8');
+        await writeResolvedFile(absolute, updated);
       }
       changed += 1;
       const fuzzy = applied.filter(entry => entry.fuzz > 0).length;
@@ -855,7 +970,7 @@ export async function createDirectoryTool(args) {
   for (const entry of list) {
     try {
       const absolute = await resolveSafePath(entry);
-      await mkdir(absolute, { recursive: true });
+      await ensureDirectoryPath(absolute);
       created.push(displayPath(absolute));
     } catch (error) {
       failed.push(`${entry}: ${describeFilesystemFailure(error, { path: error?.path })}`);
@@ -881,16 +996,17 @@ export async function moveFileTool(args) {
     const entries = await readdir(destination).catch(() => []);
     if (entries.length) fail(`Destination is a non-empty directory: ${displayPath(destination)}. Move it aside or pick another name.`);
   }
-  await mkdir(path.dirname(destination), { recursive: true });
-  try {
-    await rename(source, destination);
-  } catch (error) {
-    if (error?.code !== 'EXDEV') throw error;
-    const info = await stat(source);
-    if (info.isDirectory()) fail('Moving a directory across filesystems is not supported; copy it manually or move within one volume');
-    await copyFile(source, destination);
-    await unlink(source);
-  }
+  await withWritableParent(destination, async anchoredDestination => {
+    try {
+      await rename(source, anchoredDestination);
+    } catch (error) {
+      if (error?.code !== 'EXDEV') throw error;
+      const info = await stat(source);
+      if (info.isDirectory()) fail('Moving a directory across filesystems is not supported; copy it manually or move within one volume');
+      await copyFile(source, anchoredDestination);
+      await unlink(source);
+    }
+  });
   return text(`Moved ${displayPath(source)} to ${displayPath(destination)}.`);
 }
 
@@ -902,12 +1018,393 @@ export async function copyFileTool(args) {
   if (info.isDirectory()) fail('copy_file copies single files only; create the directory and copy its files individually');
   const overwrite = args.overwrite !== false;
   if (!overwrite && await pathExists(destination)) fail(`Destination already exists: ${displayPath(destination)}. Pass overwrite: true to replace it.`);
-  await mkdir(path.dirname(destination), { recursive: true });
-  await copyFile(source, destination, overwrite ? 0 : constants.COPYFILE_EXCL);
+  await withWritableParent(destination, anchoredDestination => copyFile(source, anchoredDestination, overwrite ? 0 : constants.COPYFILE_EXCL));
   return text(`Copied ${displayPath(source)} to ${displayPath(destination)} (${info.size} bytes).`);
 }
 
 // --- archives -------------------------------------------------------------------------
+const MAX_ARCHIVE_EXPANDED_BYTES = Math.min(
+  4 * 1024 * 1024 * 1024,
+  Math.max(64 * 1024 * 1024, Number(process.env.REMCP_MAX_ARCHIVE_EXPANDED_BYTES) || 512 * 1024 * 1024),
+);
+
+function safeArchiveEntry(name) {
+  const normalized = String(name || '').replace(/\\/g, '/');
+  return Boolean(normalized) && !normalized.startsWith('/') && !/^[A-Za-z]:\//.test(normalized) && !normalized.split('/').includes('..');
+}
+
+function archiveExpandedSize(lines, pattern, label, expectedEntries = null) {
+  let total = 0;
+  let matched = 0;
+  for (const line of lines) {
+    const match = line.match(pattern);
+    if (!match) continue;
+    total += Number(match[1]);
+    matched += 1;
+    if (!Number.isSafeInteger(total) || total > MAX_ARCHIVE_EXPANDED_BYTES) fail(`${label} exceeds the ${MAX_ARCHIVE_EXPANDED_BYTES}-byte extraction limit`);
+  }
+  if ((!matched && expectedEntries !== 0) || (expectedEntries !== null && matched < expectedEntries)) fail(`Could not determine ${label} size safely`);
+  return total;
+}
+
+function tarEntrySize(line) {
+  const tokens = String(line || '').trim().split(/\s+/);
+  for (const index of [2, 3, 4]) {
+    const size = Number(tokens[index]);
+    if (!Number.isSafeInteger(size) || size < 0) continue;
+    const tail = tokens.slice(index + 1);
+    const gnuDate = /^\d{4}-\d{2}-\d{2}$/.test(tail[0] || '');
+    const bsdDate = /^[A-Z][a-z]{2}$/.test(tail[0] || '')
+      && /^\d{1,2}$/.test(tail[1] || '')
+      && ((/^\d{2}:\d{2}(?::\d{2})?$/.test(tail[2] || '') && /^\d{4}$/.test(tail[3] || ''))
+        || /^\d{4}$/.test(tail[2] || ''));
+    if (gnuDate || bsdDate) return size;
+  }
+  return null;
+}
+
+function archiveTarExpandedSize(lines, label, expectedEntries) {
+  let total = 0;
+  let matched = 0;
+  for (const line of lines) {
+    const size = tarEntrySize(line);
+    if (size === null) continue;
+    total += size;
+    matched += 1;
+    if (!Number.isSafeInteger(total) || total > MAX_ARCHIVE_EXPANDED_BYTES) fail(`${label} exceeds the ${MAX_ARCHIVE_EXPANDED_BYTES}-byte extraction limit`);
+  }
+  if (matched < expectedEntries) fail(`Could not determine ${label} size safely`);
+  return total;
+}
+
+function assertArchiveExpandedSize(bytes, label) {
+  if (!Number.isSafeInteger(bytes) || bytes < 0 || bytes > MAX_ARCHIVE_EXPANDED_BYTES) {
+    fail(`${label} exceeds the ${MAX_ARCHIVE_EXPANDED_BYTES}-byte extraction limit`);
+  }
+}
+
+async function assertExtractedTree(root, state = { entries: 0, bytes: 0 }) {
+  const info = await lstat(root);
+  if (info.isSymbolicLink()) fail('Archive extraction produced a symbolic link');
+  if (!info.isDirectory() && !info.isFile()) fail('Archive extraction produced a special file');
+  state.entries += 1;
+  state.bytes += info.isFile() ? info.size : 0;
+  if (state.entries > 100_000 || state.bytes > MAX_ARCHIVE_EXPANDED_BYTES) fail('Archive extraction exceeded the safety limit');
+  if (!info.isDirectory()) return;
+  for (const entry of await readdir(root, { withFileTypes: true })) await assertExtractedTree(path.join(root, entry.name), state);
+}
+
+async function openArchiveSource(absolute) {
+  if (process.platform !== 'linux' || !constants.O_NOFOLLOW || !constants.O_DIRECTORY) {
+    const opened = await openRegularFile(absolute, READ_NOFOLLOW_NONBLOCK);
+    return { ...opened, close: () => opened.handle.close() };
+  }
+  const root = path.parse(absolute).root;
+  const parts = absolute.slice(root.length).split(path.sep).filter(Boolean);
+  if (!parts.length) return openRegularFile(absolute, READ_NOFOLLOW_NONBLOCK);
+  const directories = [];
+  let current = root;
+  const closeDirectories = async () => {
+    for (const handle of directories.reverse()) await handle.close().catch(() => {});
+  };
+  try {
+    for (const part of parts.slice(0, -1)) {
+      const handle = await open(path.join(current, part), DIRECTORY_READ_NOFOLLOW);
+      try {
+        const info = await handle.stat();
+        if (!info.isDirectory()) fail('Archive source is not a safe regular file');
+      } catch (error) {
+        await handle.close().catch(() => {});
+        throw error;
+      }
+      directories.push(handle);
+      current = `/proc/self/fd/${handle.fd}`;
+    }
+    const opened = await openRegularFile(path.join(current, parts.at(-1)), READ_NOFOLLOW_NONBLOCK);
+    return {
+      ...opened,
+      close: async () => {
+        try { await opened.handle.close(); }
+        finally { await closeDirectories(); }
+      },
+    };
+  } catch (error) {
+    await closeDirectories();
+    throw error;
+  }
+}
+
+async function snapshotRegularFile(source, destination, maxBytes) {
+  const sourceInfo = await lstat(source);
+  if (sourceInfo.isSymbolicLink()) fail(`Archive source is a symbolic link: ${displayPath(source)}`);
+  if (!sourceInfo.isFile()) fail(`Archive source is not a regular file: ${displayPath(source)}`);
+  const opened = await openArchiveSource(source);
+  const { handle, info } = opened;
+  let output;
+  try {
+    if (info.size > maxBytes) fail(`Archive is ${info.size} bytes, above the ${maxBytes}-byte snapshot limit`);
+    output = await open(destination, WRITE_CREATE_NOFOLLOW, 0o400);
+    const buffer = Buffer.allocUnsafe(1024 * 1024);
+    let offset = 0;
+    for (;;) {
+      const { bytesRead } = await handle.read(buffer, 0, buffer.length, offset);
+      if (!bytesRead) break;
+      if (!Number.isSafeInteger(offset + bytesRead) || offset + bytesRead > maxBytes) {
+        fail(`Archive grew beyond the ${maxBytes}-byte snapshot limit`);
+      }
+      let written = 0;
+      while (written < bytesRead) {
+        const result = await output.write(buffer, written, bytesRead - written, offset + written);
+        if (!result.bytesWritten) throw new Error('Could not finish writing the archive snapshot');
+        written += result.bytesWritten;
+      }
+      offset += bytesRead;
+    }
+    await output.truncate(offset);
+    await output.sync();
+    await output.chmod(0o400);
+    return offset;
+  } finally {
+    if (output) await output.close().catch(() => {});
+    await opened.close().catch(() => {});
+  }
+}
+
+async function copyOpenRegularFile(sourceHandle, sourceInfo, destinationPath, state) {
+  const mode = sourceInfo.mode & 0o777;
+  const currentBytes = state.bytes || 0;
+  if (state.maxBytes !== undefined && sourceInfo.size > state.maxBytes - currentBytes) {
+    fail(`Archive contents exceed the ${state.maxBytes}-byte extraction limit`);
+  }
+  const existing = await lstat(destinationPath).catch(() => null);
+  if (existing && (!existing.isFile() || existing.isSymbolicLink())) fail('Archive contains a link or special file; archive destination is unsafe');
+  let output;
+  try {
+    try {
+      output = await open(destinationPath, WRITE_TRUNCATE_NOFOLLOW, mode);
+    } catch (error) {
+      if (['ELOOP', 'ENOTDIR', 'EISDIR'].includes(error?.code)) fail('Archive contains a link or special file; archive destination is unsafe');
+      throw error;
+    }
+    const outputInfo = await output.stat();
+    if (!outputInfo.isFile()) fail('Archive contains a link or special file; archive destination is unsafe');
+    const buffer = Buffer.allocUnsafe(1024 * 1024);
+    let offset = 0;
+    for (;;) {
+      const { bytesRead } = await sourceHandle.read(buffer, 0, buffer.length, offset);
+      if (!bytesRead) break;
+      if (!Number.isSafeInteger(offset + bytesRead) || (state.maxBytes !== undefined && currentBytes + offset + bytesRead > state.maxBytes)) {
+        fail(`Archive contents exceed the ${state.maxBytes}-byte extraction limit`);
+      }
+      let written = 0;
+      while (written < bytesRead) {
+        const result = await output.write(buffer, written, bytesRead - written, offset + written);
+        if (!result.bytesWritten) throw new Error('Could not finish copying archive contents');
+        written += result.bytesWritten;
+      }
+      offset += bytesRead;
+    }
+    await output.truncate(offset);
+    await output.sync();
+    await output.chmod(mode);
+    state.bytes = currentBytes + offset;
+  } finally {
+    if (output) await output.close().catch(() => {});
+  }
+}
+
+async function copyTreeContents(source, destination, state = { entries: 0, bytes: 0, maxBytes: MAX_ARCHIVE_EXPANDED_BYTES }) {
+  const initial = await lstat(source);
+  if (initial.isSymbolicLink() || (!initial.isDirectory() && !initial.isFile())) fail('Archive contains symbolic links or special files; archive destination is unsafe');
+  state.entries += 1;
+  if (state.entries > 100_000) fail('Archive contains too many entries');
+  if (initial.isFile()) {
+    const opened = source.startsWith('/proc/self/fd/')
+      ? await openRegularFile(source, READ_NOFOLLOW_NONBLOCK)
+      : await openArchiveSource(source);
+    try { await copyOpenRegularFile(opened.handle, opened.info, destination, state); }
+    finally { if (opened.close) await opened.close(); else await opened.handle.close(); }
+    return;
+  }
+  let directoryHandle = null;
+  let sourcePath = source;
+  let info = initial;
+  try {
+    try {
+      directoryHandle = await openDirectoryPath(source);
+      info = await directoryHandle.handle.stat();
+      if (!info.isDirectory()) fail('Archive contains a link or special file; archive destination is unsafe');
+      sourcePath = directoryHandle.anchor;
+    } catch (error) {
+      if (['ELOOP', 'ENOTDIR'].includes(error?.code)) fail('Archive contains a link or special file; archive destination is unsafe');
+      throw error;
+    }
+    const mode = info.mode & 0o777;
+    const existing = await lstat(destination).catch(() => null);
+    if (existing && (!existing.isDirectory() || existing.isSymbolicLink())) fail('Archive contains a link or special file; archive destination is unsafe');
+    try { await mkdir(destination, { mode: mode | 0o700 }); }
+    catch (error) { if (error?.code !== 'EEXIST') throw error; }
+    const destinationInfo = await lstat(destination);
+    if (!destinationInfo.isDirectory() || destinationInfo.isSymbolicLink()) fail('Archive contains a link or special file; archive destination is unsafe');
+    let destinationHandle;
+    try {
+      destinationHandle = await openDirectoryPath(destination);
+      const openedDestination = await destinationHandle.handle.stat();
+      if (!openedDestination.isDirectory()) fail('Archive contains a link or special file; archive destination is unsafe');
+      await destinationHandle.handle.chmod(mode | 0o700);
+      const destinationAnchor = destinationHandle.anchor;
+      for (const name of await readdir(sourcePath)) {
+        await copyTreeContents(path.join(sourcePath, name), path.join(destinationAnchor, name), state);
+      }
+      await destinationHandle.handle.chmod(mode);
+    } finally {
+      if (destinationHandle) await destinationHandle.close().catch(() => {});
+    }
+  } finally {
+    if (directoryHandle) await directoryHandle.close().catch(() => {});
+  }
+}
+
+async function removeExtractionArtifact(target) {
+  const info = await lstat(target).catch(() => null);
+  if (!info) return;
+  if (info.isDirectory() && !info.isSymbolicLink()) await rm(target, { recursive: true, force: true });
+  else await unlink(target).catch(error => { if (error?.code !== 'ENOENT') throw error; });
+}
+
+async function recoverExtractionArtifacts(parent, destination, prefix) {
+  const parentDirectory = await openDirectoryPath(parent, { create:true });
+  const anchor = parentDirectory.anchor;
+  const destinationPath = path.join(anchor, path.basename(destination));
+  try {
+    const entries = await readdir(anchor, { withFileTypes: true });
+    const staleBefore = Date.now() - 60 * 60 * 1000;
+    for (const entry of entries) {
+      if (!entry.name.startsWith('.remcp-extract-txn-')) continue;
+      const candidate = path.join(anchor, entry.name);
+      const info = await lstat(candidate).catch(() => null);
+      if (info && info.mtimeMs < staleBefore) await removeExtractionArtifact(candidate);
+    }
+    const backups = entries.filter(entry => entry.name.startsWith(prefix)).map(entry => path.join(anchor, entry.name));
+    for (const backup of backups) {
+      const destinationInfo = await lstat(destinationPath).catch(() => null);
+      if (destinationInfo) {
+        await removeExtractionArtifact(backup);
+        continue;
+      }
+      const backupInfo = await lstat(backup).catch(() => null);
+      if (!backupInfo) continue;
+      if (backupInfo.isSymbolicLink() || !backupInfo.isDirectory()) {
+        await removeExtractionArtifact(backup);
+        continue;
+      }
+      try {
+        await rename(backup, destinationPath);
+      } catch {
+        continue;
+      }
+    }
+  } finally {
+    await parentDirectory.close().catch(() => {});
+  }
+}
+
+async function restoreExtractionBackup(backup, destination) {
+  if (await lstat(destination).catch(() => null)) return false;
+  const info = await lstat(backup).catch(() => null);
+  if (!info) return false;
+  if (info.isSymbolicLink() || !info.isDirectory()) {
+    await removeExtractionArtifact(backup);
+    return false;
+  }
+  try {
+    await rename(backup, destination);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function installExtractedTree(source, destination) {
+  const parent = path.dirname(destination);
+  if (destination === path.parse(destination).root) fail('Archive destination cannot be a filesystem root');
+  const backupPrefix = `.remcp-extract-backup-${createHash('sha256').update(destination).digest('hex').slice(0, 16)}-`;
+  await recoverExtractionArtifacts(parent, destination, backupPrefix);
+  const parentDirectory = await openDirectoryPath(parent, { create:true });
+  const parentAnchor = parentDirectory.anchor;
+  const destinationPath = path.join(parentAnchor, path.basename(destination));
+  const existing = await lstat(destinationPath).catch(() => null);
+  const destinationMode = existing?.isDirectory() ? existing.mode & 0o777 : 0o700;
+  let transaction = '';
+  let backup = '';
+  let backupOwned = false;
+  let preserveBackup = false;
+  try {
+    transaction = await mkdtemp(path.join(parentAnchor, '.remcp-extract-txn-'));
+    if (existing) {
+      backup = path.join(parentAnchor, `${backupPrefix}${randomUUID()}`);
+      try {
+        await rename(destinationPath, backup);
+        backupOwned = true;
+      } catch (error) {
+        if (error?.code !== 'ENOENT') throw error;
+        backup = '';
+      }
+    }
+    if (backupOwned) {
+      const backupInfo = await lstat(backup);
+      if (backupInfo.isSymbolicLink() || !backupInfo.isDirectory()) fail('Archive destination is not a safe directory');
+      await copyTreeContents(backup, transaction);
+    }
+    await copyTreeContents(source, transaction);
+    await chmod(transaction, destinationMode);
+    await rename(transaction, destinationPath);
+    if (backupOwned) {
+      await removeExtractionArtifact(backup);
+      backupOwned = false;
+    }
+  } catch (error) {
+    if (backupOwned) {
+      try {
+        await restoreExtractionBackup(backup, destinationPath);
+        if (!await lstat(backup).catch(() => null)) backupOwned = false;
+        else preserveBackup = true;
+      } catch (restoreError) {
+        preserveBackup = true;
+        throw new AggregateError([error, restoreError], 'Could not restore archive destination after extraction failure');
+      }
+    }
+    throw error;
+  } finally {
+    if (transaction) await rm(transaction, { recursive: true, force: true });
+    if (backupOwned && !preserveBackup) await removeExtractionArtifact(backup);
+    await parentDirectory.close().catch(() => {});
+  }
+}
+
+async function moveArchiveFile(source, destination) {
+  const parent = path.dirname(destination);
+  const parentDirectory = await openDirectoryPath(parent, { create:true });
+  const destinationPath = path.join(parentDirectory.anchor, path.basename(destination));
+  try {
+    try {
+      await rename(source, destinationPath);
+    } catch (error) {
+      if (!['EXDEV', 'EPERM'].includes(error?.code)) throw error;
+      const temporary = path.join(parentDirectory.anchor, `.${path.basename(destination)}.remcp-${randomUUID()}.tmp`);
+      try {
+        await copyFile(source, temporary, constants.COPYFILE_EXCL);
+        await rename(temporary, destinationPath);
+      } finally {
+        await unlink(temporary).catch(() => {});
+      }
+      await unlink(source);
+    }
+  } finally {
+    await parentDirectory.close().catch(() => {});
+  }
+}
+
 function archiveTool() {
   const probe = (name, versionArgs = ['--version']) => {
     const result = spawnSync(name, versionArgs, { encoding: 'utf8' });
@@ -925,56 +1422,129 @@ export async function createArchiveTool(args) {
   const resolved = [];
   for (const entry of sources) resolved.push(await resolveSafePath(entry, 'paths[]'));
   const destination = await resolveSafePath(args.destination, 'destination');
+  const existingDestination = await lstat(destination).catch(() => null);
+  if (existingDestination?.isSymbolicLink()) fail('Archive destination cannot be a symbolic link');
   const format = String(args.format || (destination.endsWith('.zip') ? 'zip' : 'tar.gz')).toLowerCase();
-  await mkdir(path.dirname(destination), { recursive: true });
   const baseDir = path.dirname(resolved[0]);
   const names = resolved.map(entry => path.relative(baseDir, entry));
-  // An archive written inside the tree it packs makes tar abort with "file changed as we
-  // read it" (the directory mtime moves while it is being read), so build it outside the
-  // tree first and move it into place afterwards.
-  const destinationRelative = path.relative(baseDir, destination);
-  const selfInside = !destinationRelative.startsWith('..') && !path.isAbsolute(destinationRelative);
+  if (names.some(name => !name || name.startsWith('..') || path.isAbsolute(name))) fail('Archive sources must share one parent directory');
+  const archiveNames = names.map(name => name.startsWith('-') ? `./${name}` : name);
   const suffix = format === 'zip' ? '.zip' : format === 'tar' ? '.tar' : '.tar.gz';
-  const staging = selfInside ? path.join(os.tmpdir(), `remcp-archive-${Date.now()}-${process.pid}${suffix}`) : destination;
-  const output = staging;
-  if (format === 'zip') {
-    if (!tools.zip) fail('zip is not installed on this device; use format "tar.gz"');
-    const result = spawnSync(tools.zip, ['-r', '-q', output, ...names], { cwd: baseDir, encoding: 'utf8' });
-    if (result.status !== 0) fail(`zip failed: ${(result.stderr || result.stdout || '').trim() || `exit ${result.status}`}`);
-  } else if (format === 'tar' || format === 'tar.gz' || format === 'tgz') {
-    if (!tools.tar) fail('tar is not installed on this device');
-    const flags = format === 'tar' ? '-cf' : '-czf';
-    const result = spawnSync(tools.tar, [flags, output, ...names], { cwd: baseDir, encoding: 'utf8' });
-    if (result.status !== 0) fail(`tar failed: ${(result.stderr || '').trim() || `exit ${result.status}`}`);
-  } else {
-    fail('format must be tar, tar.gz, or zip');
+  const stagingDirectory = await mkdtemp(path.join(os.tmpdir(), 'remcp-archive-'));
+  if (resolved.some(entry => !path.relative(entry, stagingDirectory).startsWith('..') && !path.isAbsolute(path.relative(entry, stagingDirectory)))) {
+    await rm(stagingDirectory, { recursive: true, force: true });
+    fail('Archive source must not contain the system temporary directory');
   }
-  if (selfInside) {
-    await mkdir(path.dirname(destination), { recursive: true });
-    await rename(staging, destination);
+   const staging = path.join(stagingDirectory, `payload${suffix}`);
+   const snapshotRoot = path.join(stagingDirectory, 'source');
+   try {
+      await ensureDirectoryPath(snapshotRoot);
+
+     const snapshotState = { entries: 0, bytes: 0, maxBytes: MAX_ARCHIVE_EXPANDED_BYTES };
+     for (let index = 0; index < resolved.length; index += 1) {
+       const snapshotPath = path.join(snapshotRoot, names[index]);
+        await ensureDirectoryPath(path.dirname(snapshotPath));
+
+       await copyTreeContents(resolved[index], snapshotPath, snapshotState);
+     }
+     if (format === 'zip') {
+       if (!tools.zip) fail('zip is not installed on this device; use format "tar.gz"');
+       const result = spawnSync(tools.zip, ['-r', '-q', '-y', staging, '--', ...archiveNames], { cwd: snapshotRoot, encoding: 'utf8', timeout: 120_000, maxBuffer: 16 * 1024 * 1024 });
+      if (result.status !== 0) fail(`zip failed: ${(result.stderr || result.stdout || '').trim() || `exit ${result.status}`}`);
+    } else if (format === 'tar' || format === 'tar.gz' || format === 'tgz') {
+      if (!tools.tar) fail('tar is not installed on this device');
+      const flags = format === 'tar' ? '-cf' : '-czf';
+       const result = spawnSync(tools.tar, [flags, staging, '--', ...archiveNames], { cwd: snapshotRoot, encoding: 'utf8', timeout: 120_000, maxBuffer: 16 * 1024 * 1024 });
+      if (result.status !== 0) fail(`tar failed: ${(result.stderr || result.stdout || '').trim() || `exit ${result.status}`}`);
+     } else {
+       fail('format must be tar, tar.gz, or zip');
+     }
+      const stagedInfo = await stat(staging);
+      assertArchiveExpandedSize(stagedInfo.size, 'archive output');
+
+      await moveArchiveFile(staging, destination);
+
+     const info = await stat(destination).catch(() => null);
+     const note = ' (built outside the tree in temporary staging and committed atomically)';
+
+    return text(`Created ${displayPath(destination)} (${format}, ${info?.size ?? 0} bytes) from ${resolved.length} path(s)${note}.`);
+  } finally {
+    if (stagingDirectory) await rm(stagingDirectory, { recursive: true, force: true });
   }
-  const info = await stat(destination).catch(() => null);
-  const note = selfInside ? ' (built outside the tree so it does not include itself)' : '';
-  return text(`Created ${displayPath(destination)} (${format}, ${info?.size ?? 0} bytes) from ${resolved.length} path(s)${note}.`);
+}
+
+function archiveFormatForPath(value) {
+  if (/\.zip$/i.test(value)) return 'zip';
+  if (/\.(tar\.gz|tgz)$/i.test(value)) return 'tar.gz';
+  if (/\.(tar\.bz2|tbz2?)$/i.test(value)) return 'tar.bz2';
+  if (/\.tar\.xz$/i.test(value)) return 'tar.xz';
+  return 'tar';
+}
+
+function archiveSnapshotSuffix(format) {
+  if (format === 'zip') return '.zip';
+  if (format === 'tar.bz2') return '.tar.bz2';
+  if (format === 'tar.xz') return '.tar.xz';
+  if (format === 'tar.gz') return '.tar.gz';
+  return '.tar';
 }
 
 export async function extractArchiveTool(args) {
   const tools = archiveTool();
   const archive = await resolveSafePath(args.archive, 'archive');
   const destination = await resolveSafePath(args.destination || path.dirname(archive), 'destination');
-  await mkdir(destination, { recursive: true });
-  if (/\.zip$/i.test(archive)) {
-    if (!tools.unzip) fail('unzip is not installed on this device');
-    const result = spawnSync(tools.unzip, ['-o', '-q', archive, '-d', destination], { encoding: 'utf8' });
-    if (result.status !== 0) fail(`unzip failed: ${(result.stderr || result.stdout || '').trim() || `exit ${result.status}`}`);
-  } else {
-    if (!tools.tar) fail('tar is not installed on this device');
-    const flags = /\.(tar\.gz|tgz)$/i.test(archive) ? '-xzf' : /\.(tar\.bz2|tbz2?)$/i.test(archive) ? '-xjf' : /\.tar\.xz$/i.test(archive) ? '-xJf' : '-xf';
-    const result = spawnSync(tools.tar, [flags, archive, '-C', destination], { encoding: 'utf8' });
-    if (result.status !== 0) fail(`tar failed: ${(result.stderr || '').trim() || `exit ${result.status}`}`);
+  if (destination === path.parse(destination).root) fail('Archive destination cannot be a filesystem root');
+  const parent = path.dirname(destination);
+  const backupPrefix = `.remcp-extract-backup-${createHash('sha256').update(destination).digest('hex').slice(0, 16)}-`;
+  const format = archiveFormatForPath(archive);
+  const stagingDirectory = await mkdtemp(path.join(os.tmpdir(), 'remcp-extract-'));
+  const archiveSnapshot = path.join(stagingDirectory, `source${archiveSnapshotSuffix(format)}`);
+  const staging = path.join(stagingDirectory, 'tree');
+  try {
+    await mkdir(staging, { mode: 0o700 });
+    await snapshotRegularFile(archive, archiveSnapshot, MAX_ARCHIVE_EXPANDED_BYTES);
+    await recoverExtractionArtifacts(parent, destination, backupPrefix);
+    const existingDestination = await lstat(destination).catch(() => null);
+    if (existingDestination?.isSymbolicLink() || (existingDestination && !existingDestination.isDirectory())) fail('Archive destination is not a safe directory');
+    if (format === 'zip') {
+      if (!tools.unzip) fail('unzip is not installed on this device');
+      const listing = spawnSync(tools.unzip, ['-Z', '-1', archiveSnapshot], { encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024 });
+      if (listing.error || listing.status !== 0) fail(`Could not inspect ZIP archive: ${(listing.stderr || listing.error?.message || `exit ${listing.status}`).trim()}`);
+      const names = String(listing.stdout || '').split(/\r?\n/).filter(Boolean);
+      if (names.length > 100_000 || names.some(name => !safeArchiveEntry(name))) fail('ZIP archive contains an unsafe path or too many entries');
+      const details = spawnSync(tools.unzip, ['-Z', '-v', archiveSnapshot], { encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024 });
+      if (details.error || details.status !== 0) fail(`Could not inspect ZIP sizes: ${(details.stderr || details.error?.message || `exit ${details.status}`).trim()}`);
+      const detailText = String(details.stdout || '');
+      if (/symbolic link|Unix file attributes \([^)]*\b12\d{4}/i.test(detailText)) fail('ZIP archive contains a symbolic link');
+      const expandedBytes = archiveExpandedSize(detailText.split(/\r?\n/), /uncompressed size:\s*(\d+)\s*bytes/i, 'ZIP archive', names.length);
+      assertArchiveExpandedSize(expandedBytes, 'ZIP archive');
+      const result = spawnSync(tools.unzip, ['-o', '-q', archiveSnapshot, '-d', staging], { encoding: 'utf8', timeout: 120_000, maxBuffer: 16 * 1024 * 1024 });
+      if (result.status !== 0) fail(`unzip failed: ${(result.stderr || result.stdout || '').trim() || `exit ${result.status}`}`);
+    } else {
+      if (!tools.tar) fail('tar is not installed on this device');
+      const listFlags = format === 'tar.gz' ? '-tzf' : format === 'tar.bz2' ? '-tjf' : format === 'tar.xz' ? '-tJf' : '-tf';
+      const listing = spawnSync(tools.tar, [listFlags, archiveSnapshot], { encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024 });
+      if (listing.error || listing.status !== 0) fail(`Could not inspect archive: ${(listing.stderr || listing.error?.message || `exit ${listing.status}`).trim()}`);
+      const names = String(listing.stdout || '').split(/\r?\n/).filter(Boolean);
+      if (names.length > 100_000 || names.some(name => !safeArchiveEntry(name))) fail('Archive contains an unsafe path or too many entries');
+      const verboseFlags = format === 'tar.gz' ? '-tvzf' : format === 'tar.bz2' ? '-tvjf' : format === 'tar.xz' ? '-tvJf' : '-tvf';
+      const details = spawnSync(tools.tar, [verboseFlags, archiveSnapshot], { encoding: 'utf8', timeout: 30_000, maxBuffer: 16 * 1024 * 1024 });
+      if (details.error || details.status !== 0) fail(`Could not inspect archive sizes: ${(details.stderr || details.error?.message || `exit ${details.status}`).trim()}`);
+      const detailLines = String(details.stdout || '').split(/\r?\n/);
+      if (detailLines.some(line => /^[bclph]/.test(line))) fail('Archive contains a link or special file; archive destination is unsafe');
+      const expandedBytes = archiveTarExpandedSize(detailLines, 'archive', names.length);
+      assertArchiveExpandedSize(expandedBytes, 'archive');
+      const flags = format === 'tar.gz' ? '-xzf' : format === 'tar.bz2' ? '-xjf' : format === 'tar.xz' ? '-xJf' : '-xf';
+      const result = spawnSync(tools.tar, [flags, archiveSnapshot, '-C', staging], { encoding: 'utf8', timeout: 120_000, maxBuffer: 16 * 1024 * 1024 });
+      if (result.status !== 0) fail(`tar failed: ${(result.stderr || result.stdout || '').trim() || `exit ${result.status}`}`);
+    }
+    await assertExtractedTree(staging);
+    await installExtractedTree(staging, destination);
+    const entries = await readdir(destination).catch(() => []);
+    return text(`Extracted ${displayPath(archive)} into ${displayPath(destination)} (${entries.length} top-level entries).`);
+  } finally {
+    await rm(stagingDirectory, { recursive: true, force: true });
   }
-  const entries = await readdir(destination).catch(() => []);
-  return text(`Extracted ${displayPath(archive)} into ${displayPath(destination)} (${entries.length} top-level entries).`);
 }
 
 // --- screenshots ----------------------------------------------------------------------
@@ -1028,8 +1598,17 @@ export async function takeScreenshotTool(args) {
   const requestedDirectory = args.directory ? await resolveSafePath(args.directory, 'directory') : '';
   const temporaryDirectory = requestedDirectory ? '' : await mkdtemp(path.join(os.tmpdir(), 'remcp-screenshot-'));
   const directory = requestedDirectory || temporaryDirectory;
-  if (requestedDirectory) await mkdir(directory, { recursive: true });
-  const file = path.join(directory, `capture-${randomUUID()}.png`);
+  let outputDirectory = null;
+  if (requestedDirectory) {
+    await ensureDirectoryPath(directory);
+    outputDirectory = await openWritableParent(directory);
+  }
+  const outputAnchor = outputDirectory
+    ? outputDirectory.anchor.replace('/proc/self/fd/', `/proc/${process.pid}/fd/`)
+    : directory;
+  const fileName = `capture-${randomUUID()}.png`;
+  const file = path.join(outputAnchor, fileName);
+  const displayFile = path.join(directory, fileName);
   const attempts = [];
   let preserveCapture = false;
   try {
@@ -1065,12 +1644,12 @@ export async function takeScreenshotTool(args) {
         const buffer = await handle.readFile();
         preserveCapture = args.keep === true;
         return multi([
-          { type: 'text', text: `Screenshot of ${os.hostname()} (${info.size} bytes)${preserveCapture ? (' saved at ' + displayPath(file)) : ''}` },
+          { type: 'text', text: `Screenshot of ${os.hostname()} (${info.size} bytes)${preserveCapture ? (' saved at ' + displayPath(displayFile)) : ''}` },
           image(buffer.toString('base64'), 'image/png'),
         ]);
       }
       preserveCapture = true;
-      return text(`Screenshot of ${os.hostname()} captured: ${info.size} bytes, above the ${MAX_IMAGE_BYTES}-byte inline limit, so it is saved at ${displayPath(file)} instead of being returned as an image. Fetch it with read_binary using chunks of up to ${MAX_BINARY_CHUNK_BYTES} bytes (offset_bytes and length_bytes), or ask for a smaller region.`);
+      return text(`Screenshot of ${os.hostname()} captured: ${info.size} bytes, above the ${MAX_IMAGE_BYTES}-byte inline limit, so it is saved at ${displayPath(displayFile)} instead of being returned as an image. Fetch it with read_binary using chunks of up to ${MAX_BINARY_CHUNK_BYTES} bytes (offset_bytes and length_bytes), or ask for a smaller region.`);
     } finally {
       await handle.close();
     }
@@ -1079,6 +1658,7 @@ export async function takeScreenshotTool(args) {
       if (temporaryDirectory) await rm(temporaryDirectory, { recursive: true, force: true }).catch(() => {});
       else await rm(file, { force: true }).catch(() => {});
     }
+    if (outputDirectory) await outputDirectory.close().catch(() => {});
   }
 }
 export const fileToolHandlers = {