@wayai/cli 0.3.164 → 0.3.166

package/dist/index.js

@@ -17455,40 +17455,228 @@ var init_expected = __esm({
   }
 });
 
-// src/lib/layout.ts
+// src/lib/fs-safety.ts
 import * as fs from "fs";
 import * as path from "path";
+function fileHasBytes(abs, data) {
+  let st;
+  try {
+    st = fs.lstatSync(abs);
+  } catch {
+    return false;
+  }
+  if (!st.isFile() || st.isSymbolicLink()) return false;
+  try {
+    return fs.readFileSync(abs).equals(data);
+  } catch {
+    return false;
+  }
+}
+function realpathContained(root, abs) {
+  let realRoot;
+  let realAbs;
+  try {
+    realRoot = fs.realpathSync(root);
+    realAbs = fs.realpathSync(abs);
+  } catch {
+    return false;
+  }
+  return realAbs === realRoot || realAbs.startsWith(realRoot + path.sep);
+}
+function mkdirTolerateRace(dir) {
+  try {
+    fs.mkdirSync(dir);
+    return true;
+  } catch (err) {
+    if (err.code !== "EEXIST") throw err;
+    let st;
+    try {
+      st = fs.lstatSync(dir);
+    } catch {
+      st = void 0;
+    }
+    return !!st?.isDirectory();
+  }
+}
+function ensureRealSubdirNoSymlink(root, target, create) {
+  const rootResolved = path.resolve(root);
+  const targetResolved = path.resolve(target);
+  if (targetResolved !== rootResolved && !targetResolved.startsWith(rootResolved + path.sep)) return false;
+  try {
+    if (!fs.lstatSync(rootResolved).isDirectory()) return false;
+  } catch {
+    return false;
+  }
+  const rel = path.relative(rootResolved, targetResolved);
+  if (rel === "") return true;
+  let cur = rootResolved;
+  for (const segment of rel.split(path.sep)) {
+    cur = path.join(cur, segment);
+    let st;
+    try {
+      st = fs.lstatSync(cur);
+    } catch {
+      st = void 0;
+    }
+    if (st) {
+      if (!st.isDirectory()) return false;
+    } else if (create) {
+      if (!mkdirTolerateRace(cur)) return false;
+    } else {
+      return true;
+    }
+  }
+  return true;
+}
+function isUnder(parent, child) {
+  const rel = path.relative(parent, child);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel);
+}
+function isSymlink(p) {
+  try {
+    return fs.lstatSync(p).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function workspaceRefusal(message) {
+  const err = expected(message);
+  err.isWorkspaceRefusal = true;
+  return err;
+}
+function isWorkspaceRefusal(err) {
+  return err?.isWorkspaceRefusal === true;
+}
+function symlinkRefusal(rel, kind) {
+  return workspaceRefusal(
+    `${rel} is a symlink, is reached through one, or is not a ${kind}. The CLI never reads or writes workspace config through a symlink \u2014 make it a real ${kind}.`
+  );
+}
+function requireRealSubdirNoSymlink(root, target, create) {
+  if (ensureRealSubdirNoSymlink(root, target, create)) return;
+  throw symlinkRefusal(path.relative(path.dirname(root), target), "directory");
+}
+function requireRealHubFolder(hubFolder, create) {
+  if (!create) {
+    try {
+      fs.lstatSync(hubFolder);
+    } catch {
+      return;
+    }
+  }
+  requireRealSubdirNoSymlink(path.dirname(hubFolder), hubFolder, create);
+  for (const sub of HUB_MANAGED_SUBDIRS) {
+    requireRealSubdirNoSymlink(hubFolder, path.join(hubFolder, sub), false);
+  }
+  for (const name of HUB_CONFIG_FILES) {
+    let st;
+    try {
+      st = fs.lstatSync(path.join(hubFolder, name));
+    } catch {
+      continue;
+    }
+    if (!st.isFile()) throw symlinkRefusal(path.join(path.basename(hubFolder), name), "file");
+  }
+}
+function readRealFileOrThrow(root, abs) {
+  let st;
+  try {
+    st = fs.lstatSync(abs);
+  } catch {
+    return null;
+  }
+  const bytes = st.isFile() ? readFileNoFollow(root, abs) : null;
+  if (!bytes) throw symlinkRefusal(path.relative(path.dirname(root), abs), "file");
+  return bytes.toString("utf-8");
+}
+function readFileNoFollow(root, abs) {
+  if (!ensureRealSubdirNoSymlink(root, path.dirname(abs), false)) return null;
+  try {
+    if (!fs.lstatSync(abs).isFile()) return null;
+    return fs.readFileSync(abs);
+  } catch {
+    return null;
+  }
+}
+function writeFileNoFollow(root, abs, data) {
+  const parent = path.dirname(abs);
+  if (!ensureRealSubdirNoSymlink(root, parent, true)) return false;
+  let st;
+  try {
+    st = fs.lstatSync(abs);
+  } catch {
+  }
+  if (st?.isSymbolicLink()) fs.rmSync(abs);
+  fs.writeFileSync(abs, data);
+  return true;
+}
+function createFileNoFollow(root, abs, data) {
+  if (!ensureRealSubdirNoSymlink(root, path.dirname(abs), true)) return "refused";
+  try {
+    fs.writeFileSync(abs, data, { flag: "wx" });
+  } catch (err) {
+    if (err.code === "EEXIST") return "exists";
+    throw err;
+  }
+  return "created";
+}
+var HUB_MANAGED_SUBDIRS, HUB_CONFIG_FILES;
+var init_fs_safety = __esm({
+  "src/lib/fs-safety.ts"() {
+    "use strict";
+    init_expected();
+    HUB_MANAGED_SUBDIRS = ["agents", "evals", "journeys", "resources", "attachments"];
+    HUB_CONFIG_FILES = ["hub.yaml", "wayai.yaml"];
+  }
+});
+
+// src/lib/layout.ts
+import * as fs2 from "fs";
+import * as path2 from "path";
 function isDirectory(p) {
   try {
-    return fs.statSync(p).isDirectory();
+    return fs2.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function isRealDirectory(p) {
+  try {
+    return fs2.lstatSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function resolveLayout(gitRoot, layout = WAYAI_LAYOUT) {
-  const newWs = path.join(gitRoot, layout.wsDir);
-  const legacyWs = path.join(gitRoot, layout.legacy.wsDir);
-  const legacyOrg = path.join(gitRoot, layout.legacy.orgAtRoot);
-  const legacyExists = isDirectory(legacyWs) || isDirectory(legacyOrg);
-  const basesDir = path.join(newWs, layout.basesSubdir);
-  const hubsDir = path.join(newWs, layout.hubsSubdir);
-  const orgDir = path.join(newWs, layout.orgSubdir);
+  const newWs = path2.join(gitRoot, layout.wsDir);
+  const legacyWs = path2.join(gitRoot, layout.legacy.wsDir);
+  const legacyOrg = path2.join(gitRoot, layout.legacy.orgAtRoot);
+  const legacyExists = isRealDirectory(legacyWs) || isRealDirectory(legacyOrg);
+  const basesDir = path2.join(newWs, layout.basesSubdir);
+  const hubsDir = path2.join(newWs, layout.hubsSubdir);
+  const orgDir = path2.join(newWs, layout.orgSubdir);
   const newDisplacesLegacy = () => isDirectory(hubsDir) || isDirectory(orgDir) || isDirectory(basesDir);
+  let resolved;
   if (legacyExists && !newDisplacesLegacy()) {
-    return { hubsDir: legacyWs, orgDir: legacyOrg, basesDir, isLegacy: true, legacyAlsoPresent: false };
+    resolved = { hubsDir: legacyWs, orgDir: legacyOrg, basesDir, isLegacy: true, legacyAlsoPresent: false };
+  } else {
+    resolved = { hubsDir, orgDir, basesDir, isLegacy: false, legacyAlsoPresent: legacyExists };
   }
-  return { hubsDir, orgDir, basesDir, isLegacy: false, legacyAlsoPresent: legacyExists };
+  for (const dir of [resolved.hubsDir, resolved.orgDir, resolved.basesDir]) {
+    requireRealSubdirNoSymlink(gitRoot, dir, false);
+  }
+  return resolved;
 }
 function resolveBasesDir(gitRoot) {
   return resolveLayout(gitRoot).basesDir;
 }
 function hubsDirLabel(gitRoot) {
-  if (!gitRoot) return path.join(WAYAI_LAYOUT.wsDir, WAYAI_LAYOUT.hubsSubdir);
-  return path.relative(gitRoot, resolveLayout(gitRoot).hubsDir);
+  if (!gitRoot) return path2.join(WAYAI_LAYOUT.wsDir, WAYAI_LAYOUT.hubsSubdir);
+  return path2.relative(gitRoot, resolveLayout(gitRoot).hubsDir);
 }
 function basesDirLabel(gitRoot) {
-  if (!gitRoot) return path.join(WAYAI_LAYOUT.wsDir, WAYAI_LAYOUT.basesSubdir);
-  return path.relative(gitRoot, resolveLayout(gitRoot).basesDir);
+  if (!gitRoot) return path2.join(WAYAI_LAYOUT.wsDir, WAYAI_LAYOUT.basesSubdir);
+  return path2.relative(gitRoot, resolveLayout(gitRoot).basesDir);
 }
 function warnLayoutOnce(gitRoot) {
   const r = resolveLayout(gitRoot);
@@ -17516,6 +17704,7 @@ var init_layout = __esm({
   "src/lib/layout.ts"() {
     "use strict";
     init_dist();
+    init_fs_safety();
     WAYAI_LAYOUT = {
       ...WAYAI_WORKSPACE_LAYOUT,
       legacy: { wsDir: "workspace", orgAtRoot: "org" }
@@ -17550,8 +17739,8 @@ __export(workspace_exports, {
   scanWorkspaceHubs: () => scanWorkspaceHubs
 });
 import { execFileSync } from "child_process";
-import * as fs2 from "fs";
-import * as path2 from "path";
+import * as fs3 from "fs";
+import * as path3 from "path";
 import * as yaml from "js-yaml";
 function findGitRoot() {
   try {
@@ -17566,8 +17755,8 @@ function findGitRoot() {
 function findRepoRootSync() {
   let current = process.cwd();
   while (true) {
-    if (fs2.existsSync(path2.join(current, ".git"))) return current;
-    const parent = path2.dirname(current);
+    if (fs3.existsSync(path3.join(current, ".git"))) return current;
+    const parent = path3.dirname(current);
     if (parent === current) return null;
     current = parent;
   }
@@ -17576,7 +17765,7 @@ function detectWorkspace() {
   const gitRoot = findGitRoot();
   if (!gitRoot) return null;
   const { hubsDir } = resolveLayout(gitRoot);
-  if (!fs2.existsSync(hubsDir) || !fs2.statSync(hubsDir).isDirectory()) {
+  if (!fs3.existsSync(hubsDir) || !fs3.statSync(hubsDir).isDirectory()) {
     return null;
   }
   return { gitRoot, workspaceDir: hubsDir };
@@ -17592,10 +17781,9 @@ function resolveWorkspaceDir() {
   return resolveLayout(gitRoot).hubsDir;
 }
 function readHubYaml(yamlPath) {
-  if (!fs2.existsSync(yamlPath)) return null;
+  if (!fs3.existsSync(yamlPath) || isSymlink(yamlPath)) return null;
   try {
-    const content = fs2.readFileSync(yamlPath, "utf-8");
-    const config = yaml.load(content);
+    const config = yaml.load(fs3.readFileSync(yamlPath, "utf-8"));
     if (!config?.hub_id || !config.hub_environment) return null;
     return { hubId: config.hub_id, hubEnvironment: config.hub_environment };
   } catch {
@@ -17605,9 +17793,9 @@ function readHubYaml(yamlPath) {
 function scanWorkspaceHubs(workspaceDir) {
   const hubs = [];
   for (const top of safeReaddir(workspaceDir)) {
-    const topDir = path2.join(workspaceDir, top);
-    if (!isDirectory(topDir)) continue;
-    const meta = readHubYaml(path2.join(topDir, "hub.yaml")) || readHubYaml(path2.join(topDir, "wayai.yaml"));
+    const topDir = path3.join(workspaceDir, top);
+    if (!isRealDirectory(topDir)) continue;
+    const meta = readHubYaml(path3.join(topDir, "hub.yaml")) || readHubYaml(path3.join(topDir, "wayai.yaml"));
     if (meta) {
       hubs.push({ hubFolder: topDir, hubId: meta.hubId, hubEnvironment: meta.hubEnvironment });
     }
@@ -17621,10 +17809,9 @@ function filterPreviewHubs(hubs) {
   return hubs.filter(isPreviewHub);
 }
 function readNewHubYaml(yamlPath) {
-  if (!fs2.existsSync(yamlPath)) return null;
+  if (!fs3.existsSync(yamlPath) || isSymlink(yamlPath)) return null;
   try {
-    const content = fs2.readFileSync(yamlPath, "utf-8");
-    const config = yaml.load(content);
+    const config = yaml.load(fs3.readFileSync(yamlPath, "utf-8"));
     if (config?.hub_id) return null;
     if (!config?.hub?.name) return null;
     return { hubName: config.hub.name, hubType: config.hub.hub_type };
@@ -17635,9 +17822,9 @@ function readNewHubYaml(yamlPath) {
 function scanNewHubs(workspaceDir) {
   const hubs = [];
   for (const top of safeReaddir(workspaceDir)) {
-    const topDir = path2.join(workspaceDir, top);
-    if (!isDirectory(topDir)) continue;
-    const meta = readNewHubYaml(path2.join(topDir, "hub.yaml")) || readNewHubYaml(path2.join(topDir, "wayai.yaml"));
+    const topDir = path3.join(workspaceDir, top);
+    if (!isRealDirectory(topDir)) continue;
+    const meta = readNewHubYaml(path3.join(topDir, "hub.yaml")) || readNewHubYaml(path3.join(topDir, "wayai.yaml"));
     if (meta) {
       hubs.push({ hubFolder: topDir, hubName: meta.hubName, hubType: meta.hubType });
     }
@@ -17657,22 +17844,22 @@ function resolveHubFolder(workspaceDir, hubId, hubName, hubEnvironment, previewL
     if (match) return match.hubFolder;
   }
   const hubFolderSlug = getHubFolderSlug(hubName, hubEnvironment, hubId || "", previewLabel, branchName);
-  return path2.join(workspaceDir, hubFolderSlug);
+  return path3.join(workspaceDir, hubFolderSlug);
 }
 function findLocalHubFolder(hubId) {
   const workspace = detectWorkspace();
   const gitRoot = findGitRoot();
   const workspaceDir = workspace?.workspaceDir ?? (gitRoot ? resolveLayout(gitRoot).hubsDir : null);
-  if (!workspaceDir || !fs2.existsSync(workspaceDir)) return null;
+  if (!workspaceDir || !fs3.existsSync(workspaceDir)) return null;
   const match = scanWorkspaceHubs(workspaceDir).find((h) => h.hubId === hubId);
   return match ? match.hubFolder : null;
 }
 function getChangedHubs(workspaceDir) {
   const gitRoot = findGitRoot();
   if (!gitRoot) return [];
-  const relWorkspace = path2.relative(gitRoot, workspaceDir);
-  const normalizedRel = path2.normalize(relWorkspace);
-  if (normalizedRel.startsWith("..") || path2.isAbsolute(normalizedRel)) {
+  const relWorkspace = path3.relative(gitRoot, workspaceDir);
+  const normalizedRel = path3.normalize(relWorkspace);
+  if (normalizedRel.startsWith("..") || path3.isAbsolute(normalizedRel)) {
     return [];
   }
   let statusOutput;
@@ -17697,9 +17884,9 @@ function getChangedHubs(workspaceDir) {
   if (hubFiles.length === 0) return [];
   const hubFolders = /* @__PURE__ */ new Set();
   for (const file of hubFiles) {
-    const absFile = path2.resolve(gitRoot, file);
+    const absFile = path3.resolve(gitRoot, file);
     if (file.endsWith("hub.yaml") || file.endsWith("wayai.yaml")) {
-      hubFolders.add(path2.dirname(absFile));
+      hubFolders.add(path3.dirname(absFile));
     } else if (file.includes("/agents/")) {
       const agentsIndex = absFile.lastIndexOf("/agents/");
       hubFolders.add(absFile.substring(0, agentsIndex));
@@ -17707,7 +17894,8 @@ function getChangedHubs(workspaceDir) {
   }
   const hubs = [];
   for (const hubFolder of hubFolders) {
-    const meta = readHubYaml(path2.join(hubFolder, "hub.yaml")) || readHubYaml(path2.join(hubFolder, "wayai.yaml"));
+    if (!isRealDirectory(hubFolder)) continue;
+    const meta = readHubYaml(path3.join(hubFolder, "hub.yaml")) || readHubYaml(path3.join(hubFolder, "wayai.yaml"));
     if (meta) {
       hubs.push({ hubFolder, hubId: meta.hubId, hubEnvironment: meta.hubEnvironment });
     }
@@ -17742,19 +17930,19 @@ function resolveExplicitHubPath(hubPath) {
 }
 function findHubByFolderName(workspaceDir, hubFolderName) {
   const all = scanWorkspaceHubs(workspaceDir);
-  return all.find((h) => path2.basename(h.hubFolder) === hubFolderName) ?? null;
+  return all.find((h) => path3.basename(h.hubFolder) === hubFolderName) ?? null;
 }
 function autoRenameHubFolder(currentFolder, hubName, hubEnvironment, hubId, previewLabel, branchName) {
   const expectedSlug = getHubFolderSlug(hubName, hubEnvironment, hubId, previewLabel, branchName);
-  const currentSlug = path2.basename(currentFolder);
+  const currentSlug = path3.basename(currentFolder);
   if (currentSlug === expectedSlug) return currentFolder;
-  const targetFolder = path2.join(path2.dirname(currentFolder), expectedSlug);
-  if (fs2.existsSync(targetFolder)) {
+  const targetFolder = path3.join(path3.dirname(currentFolder), expectedSlug);
+  if (fs3.existsSync(targetFolder)) {
     console.warn(`  Warning: skipping hub folder rename ${currentSlug} \u2192 ${expectedSlug} (target already exists)`);
     return currentFolder;
   }
   try {
-    fs2.renameSync(currentFolder, targetFolder);
+    fs3.renameSync(currentFolder, targetFolder);
   } catch (err) {
     console.warn(`  Warning: could not rename ${currentSlug} \u2192 ${expectedSlug}: ${err instanceof Error ? err.message : String(err)}`);
     return currentFolder;
@@ -17765,39 +17953,37 @@ function autoRenameHubFolder(currentFolder, hubName, hubEnvironment, hubId, prev
 }
 function findEnclosingHubFolder(workspaceDir) {
   let current = process.cwd();
-  const stop = path2.resolve(workspaceDir);
-  while (true) {
-    const meta = readHubYaml(path2.join(current, "hub.yaml")) || readHubYaml(path2.join(current, "wayai.yaml"));
+  const stop = path3.resolve(workspaceDir);
+  while (isUnder(stop, current)) {
+    const meta = readHubYaml(path3.join(current, "hub.yaml")) || readHubYaml(path3.join(current, "wayai.yaml"));
     if (meta) {
       return { hubFolder: current, hubId: meta.hubId, hubEnvironment: meta.hubEnvironment };
     }
     if (current === stop) return null;
-    const parent = path2.dirname(current);
-    if (parent === current) return null;
-    current = parent;
+    current = path3.dirname(current);
   }
+  return null;
 }
 function findEnclosingNewHubFolder(workspaceDir) {
   let current = process.cwd();
-  const stop = path2.resolve(workspaceDir);
-  while (true) {
-    const meta = readNewHubYaml(path2.join(current, "hub.yaml")) || readNewHubYaml(path2.join(current, "wayai.yaml"));
+  const stop = path3.resolve(workspaceDir);
+  while (isUnder(stop, current)) {
+    const meta = readNewHubYaml(path3.join(current, "hub.yaml")) || readNewHubYaml(path3.join(current, "wayai.yaml"));
     if (meta) {
       return { hubFolder: current, hubName: meta.hubName, hubType: meta.hubType };
     }
     if (current === stop) return null;
-    const parent = path2.dirname(current);
-    if (parent === current) return null;
-    current = parent;
+    current = path3.dirname(current);
   }
+  return null;
 }
 function resolvePushTarget(workspaceDir, existingHubs, newHubs, selector) {
   if (selector) {
     const existingMatch = existingHubs.find(
-      (h) => h.hubId === selector || path2.basename(h.hubFolder) === selector
+      (h) => h.hubId === selector || path3.basename(h.hubFolder) === selector
     );
     if (existingMatch) return { ok: true, target: { kind: "existing", hub: existingMatch } };
-    const newMatch = newHubs.find((h) => path2.basename(h.hubFolder) === selector);
+    const newMatch = newHubs.find((h) => path3.basename(h.hubFolder) === selector);
     if (newMatch) return { ok: true, target: { kind: "new", hub: newMatch } };
     return { ok: false, reason: "selector_miss" };
   }
@@ -17813,10 +17999,10 @@ function resolvePushTarget(workspaceDir, existingHubs, newHubs, selector) {
 }
 function resolveNewHubForCreate(workspaceDir, existingHubs, newHubs, selector) {
   if (selector) {
-    const newMatch = newHubs.find((h) => path2.basename(h.hubFolder) === selector);
+    const newMatch = newHubs.find((h) => path3.basename(h.hubFolder) === selector);
     if (newMatch) return { ok: true, hub: newMatch };
     const existingMatch = existingHubs.find(
-      (h) => h.hubId === selector || path2.basename(h.hubFolder) === selector
+      (h) => h.hubId === selector || path3.basename(h.hubFolder) === selector
     );
     if (existingMatch) return { ok: false, reason: "exists", existing: existingMatch };
     return { ok: false, reason: "selector_miss" };
@@ -17843,7 +18029,7 @@ function resolveActiveHubId(args2) {
   const gitRoot = findGitRoot();
   const workspaceDir = workspace?.workspaceDir ?? (gitRoot ? resolveLayout(gitRoot).hubsDir : null);
   const wsLabel = hubsDirLabel(gitRoot);
-  if (!workspaceDir || !fs2.existsSync(workspaceDir)) {
+  if (!workspaceDir || !fs3.existsSync(workspaceDir)) {
     if (selector && UUID_RE2.test(selector)) return selector;
     console.error(`No ${wsLabel}/ directory found. Run \`wayai pull --hub <uuid>\` to fetch a hub, or pass --hub <uuid>.`);
     process.exit(1);
@@ -17851,7 +18037,7 @@ function resolveActiveHubId(args2) {
   const allHubs = scanWorkspaceHubs(workspaceDir);
   if (selector) {
     const match = allHubs.find(
-      (h) => h.hubId === selector || path2.basename(h.hubFolder) === selector
+      (h) => h.hubId === selector || path3.basename(h.hubFolder) === selector
     );
     if (match) return match.hubId;
     if (UUID_RE2.test(selector)) return selector;
@@ -17868,7 +18054,7 @@ function resolveActiveHubId(args2) {
   }
   console.error(`Multiple hubs in ${wsLabel}/. Pass --hub <uuid|folder-name> or run from inside a hub folder:`);
   for (const h of previewHubs) {
-    console.error(`  ${path2.basename(h.hubFolder)} (${h.hubId})`);
+    console.error(`  ${path3.basename(h.hubFolder)} (${h.hubId})`);
   }
   process.exit(1);
 }
@@ -17876,12 +18062,12 @@ function localHubEnvironment(hubId) {
   const workspace = detectWorkspace();
   const gitRoot = findGitRoot();
   const workspaceDir = workspace?.workspaceDir ?? (gitRoot ? resolveLayout(gitRoot).hubsDir : null);
-  if (!workspaceDir || !fs2.existsSync(workspaceDir)) return null;
+  if (!workspaceDir || !fs3.existsSync(workspaceDir)) return null;
   return scanWorkspaceHubs(workspaceDir).find((h) => h.hubId === hubId)?.hubEnvironment ?? null;
 }
 function safeReaddir(dir) {
   try {
-    return fs2.readdirSync(dir).filter((entry) => !entry.startsWith("."));
+    return fs3.readdirSync(dir).filter((entry) => !entry.startsWith("."));
   } catch {
     return [];
   }
@@ -17891,23 +18077,29 @@ var init_workspace = __esm({
     "use strict";
     init_utils();
     init_layout();
+    init_fs_safety();
   }
 });
 
 // src/lib/workspace-manifest.ts
-import * as fs3 from "fs";
-import * as path3 from "path";
+import * as fs4 from "fs";
+import * as path4 from "path";
 import * as yaml2 from "js-yaml";
 function workspaceManifestPath(gitRoot) {
-  return path3.join(gitRoot, WAYAI_LAYOUT.wsDir, WORKSPACE_MANIFEST_FILE);
+  return path4.join(gitRoot, WAYAI_LAYOUT.wsDir, WORKSPACE_MANIFEST_FILE);
 }
 function rootConfigPath(gitRoot) {
-  return path3.join(gitRoot, ROOT_CONFIG_FILE);
+  return path4.join(gitRoot, ROOT_CONFIG_FILE);
 }
 function loadYamlMapping(file) {
+  for (const p of [file, path4.dirname(file)]) {
+    if (isSymlink(p)) {
+      return { kind: "malformed", reason: `${path4.basename(p)} is a symlink \u2014 make it a real ${p === file ? "file" : "directory"}` };
+    }
+  }
   let raw;
   try {
-    raw = fs3.readFileSync(file, "utf-8");
+    raw = fs4.readFileSync(file, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") return { kind: "absent" };
     return { kind: "malformed", reason: err instanceof Error ? err.message : String(err) };
@@ -17932,6 +18124,7 @@ var init_workspace_manifest = __esm({
   "src/lib/workspace-manifest.ts"() {
     "use strict";
     init_layout();
+    init_fs_safety();
     WORKSPACE_MANIFEST_FILE = "wayai.yaml";
     WORKSPACE_MANIFEST_LABEL = `${WAYAI_LAYOUT.wsDir}/${WORKSPACE_MANIFEST_FILE}`;
     ROOT_CONFIG_FILE = ".wayai.yaml";
@@ -17950,8 +18143,7 @@ __export(repo_config_exports, {
   resolveRepoConfig: () => resolveRepoConfig,
   writeRepoConfig: () => writeRepoConfig
 });
-import * as fs4 from "fs";
-import * as path4 from "path";
+import * as path5 from "path";
 import * as yaml3 from "js-yaml";
 function noticeOnce(key, emit) {
   if (noticed.has(key)) return;
@@ -17989,7 +18181,7 @@ function legacyFieldsIn(load11) {
   if (load11.kind !== "ok") return [];
   return LEGACY_FIELDS.filter((f) => load11.doc[f] !== void 0);
 }
-function resolve2(gitRoot) {
+function resolve3(gitRoot) {
   const manifestFile = workspaceManifestPath(gitRoot);
   const manifest = declarationFrom(loadWorkspaceManifest(gitRoot));
   if (manifest.kind === "invalid") {
@@ -18098,7 +18290,7 @@ function report(r, posture) {
 function resolveRepoConfig(root) {
   const gitRoot = root ?? findGitRoot();
   if (!gitRoot) return null;
-  const r = resolve2(gitRoot);
+  const r = resolve3(gitRoot);
   report(r, "soft");
   return r.kind === "ok" ? r.resolved : null;
 }
@@ -18108,7 +18300,7 @@ function readRepoConfig(root) {
 function readRepoConfigUnlessBlocked(root) {
   const gitRoot = root ?? findGitRoot();
   if (!gitRoot) return null;
-  const r = resolve2(gitRoot);
+  const r = resolve3(gitRoot);
   switch (r.kind) {
     case "ok":
       report(r, "soft");
@@ -18123,7 +18315,7 @@ function readRepoConfigUnlessBlocked(root) {
 }
 function requireRepoConfig(root) {
   const gitRoot = root ?? findGitRoot();
-  const r = gitRoot ? resolve2(gitRoot) : { kind: "none" };
+  const r = gitRoot ? resolve3(gitRoot) : { kind: "none" };
   report(r, "hard");
   if (r.kind === "ok") return r.resolved.config;
   return process.exit(1);
@@ -18131,7 +18323,7 @@ function requireRepoConfig(root) {
 function readRepoScopeBlocker(root) {
   const gitRoot = root ?? findGitRoot();
   if (!gitRoot) return null;
-  const r = resolve2(gitRoot);
+  const r = resolve3(gitRoot);
   if (r.kind === "conflict") {
     return {
       kind: "conflict",
@@ -18168,6 +18360,7 @@ function writeRepoConfig(config, root) {
   if (!gitRoot) {
     throw expected("Not inside a git repository. Run `git init` first.");
   }
+  readRealFileOrThrow(gitRoot, workspaceManifestPath(gitRoot));
   const stale = declarationFrom(loadYamlMapping(rootConfigPath(gitRoot)));
   if (stale.kind === "declared" && stale.config.organization_id !== config.organization_id) {
     throw expected(rebindRefusal(config.organization_id, stale.config.organization_id));
@@ -18183,12 +18376,8 @@ function writeRepoConfig(config, root) {
   if (config.organization_name?.trim()) doc.organization_name = config.organization_name.trim();
   Object.assign(doc, rest);
   const file = workspaceManifestPath(gitRoot);
-  fs4.mkdirSync(path4.dirname(file), { recursive: true });
-  fs4.writeFileSync(
-    file,
-    yaml3.dump(doc, { lineWidth: -1, quotingType: '"', forceQuotes: false }),
-    "utf-8"
-  );
+  requireRealSubdirNoSymlink(gitRoot, path5.dirname(file), true);
+  writeFileNoFollow(gitRoot, file, Buffer.from(yaml3.dump(doc, { lineWidth: -1, quotingType: '"', forceQuotes: false }), "utf-8"));
   return file;
 }
 var LEGACY_FIELDS, noticed, RECONCILE_REMEDY;
@@ -18196,6 +18385,7 @@ var init_repo_config = __esm({
   "src/lib/repo-config.ts"() {
     "use strict";
     init_expected();
+    init_fs_safety();
     init_workspace();
     init_utils();
     init_workspace_manifest();
@@ -18210,7 +18400,7 @@ var init_repo_config = __esm({
 
 // src/lib/utils.ts
 import * as fs5 from "fs";
-import * as path5 from "path";
+import * as path6 from "path";
 import * as readline from "readline";
 function prompt(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
@@ -18264,7 +18454,7 @@ function readStdin() {
 }
 function resolveHubYamlPath(hubFolder) {
   for (const filename of ["hub.yaml", "wayai.yaml"]) {
-    const yamlPath = path5.join(hubFolder, filename);
+    const yamlPath = path6.join(hubFolder, filename);
     if (fs5.existsSync(yamlPath)) return yamlPath;
   }
   return null;
@@ -18730,17 +18920,17 @@ var init_registry = __esm({
 });
 
 // src/lib/version-cache.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
-import { dirname as dirname4, join as join6 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname6, join as join7 } from "path";
 import { homedir as homedir2 } from "os";
 function getVersionCachePath(filename = CLI_CACHE_FILE) {
-  return join6(homedir2(), ".wayai", filename);
+  return join7(homedir2(), ".wayai", filename);
 }
 function readVersionCache(filename = CLI_CACHE_FILE) {
   try {
     const path35 = getVersionCachePath(filename);
     if (!existsSync3(path35)) return null;
-    const parsed = JSON.parse(readFileSync5(path35, "utf-8"));
+    const parsed = JSON.parse(readFileSync6(path35, "utf-8"));
     if (typeof parsed.lastCheck !== "number") return null;
     if (parsed.latest !== null && typeof parsed.latest !== "string") return null;
     return parsed;
@@ -18761,7 +18951,7 @@ function isVersionCacheStale(filename = CLI_CACHE_FILE, maxAgeMs = MAX_AGE_24H_M
 }
 function writeVersionCache(filename, cache) {
   const path35 = getVersionCachePath(filename);
-  const dir = dirname4(path35);
+  const dir = dirname6(path35);
   if (!existsSync3(dir)) mkdirSync2(dir, { recursive: true });
   writeFileSync2(path35, JSON.stringify(cache));
 }
@@ -18780,8 +18970,8 @@ var init_version_cache = __esm({
 });
 
 // src/lib/skill-version.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync7 } from "fs";
+import { join as join8 } from "path";
 import * as yaml4 from "js-yaml";
 function skillInstallPaths(skillName) {
   return HARNESS_SKILL_DIRS.map((dir) => `${dir}/skills/${skillName}/${SKILL_FILENAME}`);
@@ -18802,11 +18992,11 @@ function parseFrontmatterVersion(content) {
 function findInstalledSkills(projectRoot, paths = SKILL_INSTALL_PATHS) {
   const found = [];
   for (const rel of paths) {
-    const path35 = join7(projectRoot, rel);
+    const path35 = join8(projectRoot, rel);
     if (!existsSync4(path35)) continue;
     let version = null;
     try {
-      version = parseFrontmatterVersion(readFileSync6(path35, "utf-8"));
+      version = parseFrontmatterVersion(readFileSync7(path35, "utf-8"));
     } catch {
     }
     found.push({ path: path35, version });
@@ -18841,13 +19031,13 @@ __export(config_exports, {
   writeConfig: () => writeConfig
 });
 import * as fs6 from "fs";
-import * as path6 from "path";
+import * as path7 from "path";
 import * as os from "os";
 function configDir() {
-  return path6.join(os.homedir(), ".wayai");
+  return path7.join(os.homedir(), ".wayai");
 }
 function configPath() {
-  return path6.join(configDir(), "config.json");
+  return path7.join(configDir(), "config.json");
 }
 function getConfigPath() {
   return configPath();
@@ -18900,13 +19090,13 @@ var init_config = __esm({
 
 // src/lib/token-store.ts
 import * as fs7 from "fs";
-import * as path7 from "path";
+import * as path8 from "path";
 import * as os2 from "os";
 function configDir2() {
-  return path7.join(os2.homedir(), ".wayai");
+  return path8.join(os2.homedir(), ".wayai");
 }
 function configPath2() {
-  return path7.join(configDir2(), "config.json");
+  return path8.join(configDir2(), "config.json");
 }
 function manualCleanupCommand(account) {
   if (process.platform === "darwin") {
@@ -19406,26 +19596,26 @@ __export(skill_symlink_exports, {
   healClaudeSkillLink: () => healClaudeSkillLink,
   healSkillLinkForCommand: () => healSkillLinkForCommand
 });
-import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync5, rmSync, symlinkSync } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync7, lstatSync as lstatSync3, mkdirSync as mkdirSync5, rmSync as rmSync2, symlinkSync } from "fs";
+import { join as join11 } from "path";
 function healClaudeSkillLink(root) {
   try {
-    const source = join10(root, ".agents", "skills", SKILL_NAME);
-    if (!existsSync7(join10(source, SKILL_FILENAME))) return false;
-    const link = join10(root, ".claude", "skills", SKILL_NAME);
-    if (existsSync7(join10(link, SKILL_FILENAME))) return false;
+    const source = join11(root, ".agents", "skills", SKILL_NAME);
+    if (!existsSync7(join11(source, SKILL_FILENAME))) return false;
+    const link = join11(root, ".claude", "skills", SKILL_NAME);
+    if (existsSync7(join11(link, SKILL_FILENAME))) return false;
     let entry = null;
     try {
-      entry = lstatSync(link);
+      entry = lstatSync3(link);
     } catch {
       entry = null;
     }
     if (entry) {
       if (!entry.isSymbolicLink()) return false;
-      rmSync(link, { force: true });
+      rmSync2(link, { force: true });
     }
-    mkdirSync5(join10(root, ".claude", "skills"), { recursive: true });
-    symlinkSync(join10("..", "..", ".agents", "skills", SKILL_NAME), link, "dir");
+    mkdirSync5(join11(root, ".claude", "skills"), { recursive: true });
+    symlinkSync(join11("..", "..", ".agents", "skills", SKILL_NAME), link, "dir");
     return true;
   } catch {
     return false;
@@ -19709,7 +19899,7 @@ var init_base_id = __esm({
 // src/lib/worktree-scope.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import * as fs8 from "fs";
-import * as path8 from "path";
+import * as path9 from "path";
 import * as yaml5 from "js-yaml";
 function axisNoun(axis) {
   return AXES[axis].noun;
@@ -19724,7 +19914,7 @@ function resolveGitDir() {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
-    gitDir = raw ? path8.resolve(cwd, raw) : null;
+    gitDir = raw ? path9.resolve(cwd, raw) : null;
   } catch {
     gitDir = null;
   }
@@ -19733,12 +19923,12 @@ function resolveGitDir() {
 }
 function getScopePath() {
   const gitDir = resolveGitDir();
-  return gitDir ? path8.join(gitDir, SCOPE_FILE) : null;
+  return gitDir ? path9.join(gitDir, SCOPE_FILE) : null;
 }
 function legacyPaths() {
   const gitDir = resolveGitDir();
   if (!gitDir) return [];
-  return AXIS_ORDER.flatMap((axis) => AXES[axis].legacyFiles).map((f) => path8.join(gitDir, f));
+  return AXIS_ORDER.flatMap((axis) => AXES[axis].legacyFiles).map((f) => path9.join(gitDir, f));
 }
 function emptyScope() {
   return { hubs: [], bases: [] };
@@ -19762,7 +19952,7 @@ function readLegacyAxis(axis) {
   for (const filename of legacyFiles) {
     let raw;
     try {
-      raw = fs8.readFileSync(path8.join(gitDir, filename), "utf-8");
+      raw = fs8.readFileSync(path9.join(gitDir, filename), "utf-8");
     } catch (err) {
       if (err.code === "ENOENT") continue;
       throw err;
@@ -19982,8 +20172,13 @@ function buildSkillState() {
 }
 function buildWorkspaceState(resolved) {
   if (!resolved) return { scoped: false, path: null, hub_count: 0 };
-  const ws = detectWorkspace();
-  const hubCount = ws ? scanWorkspaceHubs(ws.workspaceDir).length : 0;
+  let hubCount = 0;
+  try {
+    const ws = detectWorkspace();
+    hubCount = ws ? scanWorkspaceHubs(ws.workspaceDir).length : 0;
+  } catch {
+    hubCount = 0;
+  }
   return { scoped: true, path: resolved.path, hub_count: hubCount };
 }
 async function statusCommand(args2, pkg2) {
@@ -20221,12 +20416,12 @@ __export(init_exports, {
   parseArgs: () => parseArgs3
 });
 import { mkdirSync as mkdirSync6 } from "fs";
-import path9 from "path";
+import path10 from "path";
 function ensureHubsDir(gitRoot) {
   const hubsDir = resolveLayout(gitRoot).hubsDir;
   if (isDirectory(hubsDir)) return null;
   mkdirSync6(hubsDir, { recursive: true });
-  return `${path9.relative(gitRoot, hubsDir)}/`;
+  return `${path10.relative(gitRoot, hubsDir)}/`;
 }
 function parseArgs3(args2) {
   let orgId;
@@ -20355,118 +20550,8 @@ var init_init = __esm({
   }
 });
 
-// src/lib/fs-safety.ts
-import * as fs9 from "fs";
-import * as path10 from "path";
-function fileHasBytes(abs, data) {
-  let st;
-  try {
-    st = fs9.lstatSync(abs);
-  } catch {
-    return false;
-  }
-  if (!st.isFile() || st.isSymbolicLink()) return false;
-  try {
-    return fs9.readFileSync(abs).equals(data);
-  } catch {
-    return false;
-  }
-}
-function realpathContained(root, abs) {
-  let realRoot;
-  let realAbs;
-  try {
-    realRoot = fs9.realpathSync(root);
-    realAbs = fs9.realpathSync(abs);
-  } catch {
-    return false;
-  }
-  return realAbs === realRoot || realAbs.startsWith(realRoot + path10.sep);
-}
-function mkdirTolerateRace(dir) {
-  try {
-    fs9.mkdirSync(dir);
-    return true;
-  } catch (err) {
-    if (err.code !== "EEXIST") throw err;
-    let st;
-    try {
-      st = fs9.lstatSync(dir);
-    } catch {
-      st = void 0;
-    }
-    return !!st?.isDirectory();
-  }
-}
-function ensureRealSubdirNoSymlink(root, target, create) {
-  const rootResolved = path10.resolve(root);
-  const targetResolved = path10.resolve(target);
-  if (targetResolved !== rootResolved && !targetResolved.startsWith(rootResolved + path10.sep)) return false;
-  try {
-    if (!fs9.lstatSync(rootResolved).isDirectory()) return false;
-  } catch {
-    return false;
-  }
-  const rel = path10.relative(rootResolved, targetResolved);
-  if (rel === "") return true;
-  let cur = rootResolved;
-  for (const segment of rel.split(path10.sep)) {
-    cur = path10.join(cur, segment);
-    let st;
-    try {
-      st = fs9.lstatSync(cur);
-    } catch {
-      st = void 0;
-    }
-    if (st) {
-      if (!st.isDirectory()) return false;
-    } else if (create) {
-      if (!mkdirTolerateRace(cur)) return false;
-    } else {
-      return true;
-    }
-  }
-  return true;
-}
-function readFileNoFollow(root, abs) {
-  if (!ensureRealSubdirNoSymlink(root, path10.dirname(abs), false)) return null;
-  try {
-    if (!fs9.lstatSync(abs).isFile()) return null;
-    return fs9.readFileSync(abs);
-  } catch {
-    return null;
-  }
-}
-function writeFileNoFollow(root, abs, data) {
-  const parent = path10.dirname(abs);
-  if (!ensureRealSubdirNoSymlink(root, parent, true)) return false;
-  let st;
-  try {
-    st = fs9.lstatSync(abs);
-  } catch {
-  }
-  if (st?.isSymbolicLink()) fs9.rmSync(abs);
-  fs9.writeFileSync(abs, data);
-  return true;
-}
-function createFileNoFollow(root, abs, data) {
-  if (!ensureRealSubdirNoSymlink(root, path10.dirname(abs), true)) return "refused";
-  try {
-    fs9.writeFileSync(abs, data, { flag: "wx" });
-  } catch (err) {
-    if (err.code === "EEXIST") return "exists";
-    throw err;
-  }
-  return "created";
-}
-var init_fs_safety = __esm({
-  "src/lib/fs-safety.ts"() {
-    "use strict";
-  }
-});
-
 // src/lib/resource-files.ts
-import * as fs10 from "fs";
+import * as fs9 from "fs";
 import * as path11 from "path";
 import * as crypto3 from "crypto";
 function isBinaryFile(filename) {
@@ -20513,14 +20598,16 @@ function computeHash(data) {
 }
 function scanResourceFiles(dir, prefix = "") {
   const files = [];
-  const entries = fs10.readdirSync(dir, { withFileTypes: true });
+  const entries = fs9.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
     const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
-    if (entry.isDirectory()) {
+    if (entry.isSymbolicLink()) {
+      throw symlinkRefusal(relPath, "file or folder");
+    } else if (entry.isDirectory()) {
       files.push(...scanResourceFiles(path11.join(dir, entry.name), relPath));
     } else if (entry.isFile()) {
       const fullPath = path11.join(dir, entry.name);
-      const stat2 = fs10.statSync(fullPath);
+      const stat2 = fs9.statSync(fullPath);
       if (stat2.size > MAX_RESOURCE_FILE_SIZE3) {
         console.warn(`  Warning: skipping ${relPath} (${(stat2.size / 1024 / 1024).toFixed(1)}MB exceeds 10MB limit)`);
         continue;
@@ -20530,7 +20617,7 @@ function scanResourceFiles(dir, prefix = "") {
         mime_type: guessMimeType(entry.name),
         file_size: stat2.size
       };
-      const data = fs10.readFileSync(fullPath);
+      const data = fs9.readFileSync(fullPath);
       fileEntry.hash = computeHash(data);
       if (isBinaryFile(entry.name)) {
         fileEntry.content_base64 = data.toString("base64");
@@ -20590,7 +20677,7 @@ function writeResourceFileTree(resDir, files, root, log) {
     return;
   }
   if (files.length === 0) {
-    if (fs10.existsSync(resDir)) cleanOrphanFiles(resDir, "", /* @__PURE__ */ new Set(), root, log);
+    if (fs9.existsSync(resDir)) cleanOrphanFiles(resDir, "", /* @__PURE__ */ new Set(), root, log);
     return;
   }
   const writtenPaths = /* @__PURE__ */ new Set();
@@ -20611,18 +20698,18 @@ function writeResourceFileTree(resDir, files, root, log) {
       writtenPaths.delete(file.path);
     }
   }
-  if (fs10.existsSync(resDir)) cleanOrphanFiles(resDir, "", writtenPaths, root, log);
+  if (fs9.existsSync(resDir)) cleanOrphanFiles(resDir, "", writtenPaths, root, log);
 }
 function cleanOrphanFiles(dir, prefix, writtenPaths, root, log) {
-  const entries = fs10.readdirSync(dir, { withFileTypes: true });
+  const entries = fs9.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
     const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
     const fullPath = path11.join(dir, entry.name);
     if (entry.isDirectory()) {
       cleanOrphanFiles(fullPath, relPath, writtenPaths, root, log);
-      if (fs10.readdirSync(fullPath).length === 0) fs10.rmdirSync(fullPath);
+      if (fs9.readdirSync(fullPath).length === 0) fs9.rmdirSync(fullPath);
     } else if (!writtenPaths.has(relPath)) {
-      fs10.unlinkSync(fullPath);
+      fs9.unlinkSync(fullPath);
       if (log && root) log.removed.push(path11.relative(root, fullPath));
     }
   }
@@ -20643,8 +20730,8 @@ async function downloadBinaryFiles(resDir, files, root, log) {
       }
       if (file.hash) {
         try {
-          const st = fs10.lstatSync(filePath);
-          if (st.isFile() && !st.isSymbolicLink() && computeHash(fs10.readFileSync(filePath)) === file.hash) continue;
+          const st = fs9.lstatSync(filePath);
+          if (st.isFile() && !st.isSymbolicLink() && computeHash(fs9.readFileSync(filePath)) === file.hash) continue;
         } catch {
         }
       }
@@ -20698,7 +20785,7 @@ var init_resource_files = __esm({
 });
 
 // src/lib/eval-attachments.ts
-import * as fs11 from "fs";
+import * as fs10 from "fs";
 import * as path12 from "path";
 function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
   const raw = turn.attachments;
@@ -20722,7 +20809,7 @@ function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
     }
     let stat2;
     try {
-      stat2 = fs11.statSync(abs);
+      stat2 = fs10.statSync(abs);
     } catch {
     }
     if (!stat2?.isFile()) {
@@ -20736,7 +20823,7 @@ function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
         `${label}: attachment "${entry}" is ${(stat2.size / 1024 / 1024).toFixed(1)}MB, over the 10MB limit.`
       );
     }
-    const data = fs11.readFileSync(abs);
+    const data = fs10.readFileSync(abs);
     const hash = computeHash(data);
     const fileName = path12.basename(abs);
     const mimeType = guessMimeType(fileName) ?? "application/octet-stream";
@@ -20844,16 +20931,16 @@ async function downloadEvalAttachments(hubFolder, downloads) {
     console.warn(`  Warning: ${ATTACHMENTS_DIR}/ is not reachable inside the hub folder without a symlink; skipping attachment sync.`);
     return result;
   }
-  if (!fs11.existsSync(attachDir)) return result;
+  if (!fs10.existsSync(attachDir)) return result;
   for (const dl of downloads) {
     const abs = path12.resolve(hubFolder, dl.relPath);
     if (abs !== attachDir && !abs.startsWith(attachDir + path12.sep)) continue;
     let existing;
     try {
-      existing = fs11.lstatSync(abs);
+      existing = fs10.lstatSync(abs);
     } catch {
     }
-    if (existing?.isFile() && !existing.isSymbolicLink() && computeHash(fs11.readFileSync(abs)) === dl.hash) {
+    if (existing?.isFile() && !existing.isSymbolicLink() && computeHash(fs10.readFileSync(abs)) === dl.hash) {
       continue;
     }
     try {
@@ -20871,11 +20958,11 @@ async function downloadEvalAttachments(hubFolder, downloads) {
     }
   }
   const keep = new Set(downloads.map((d) => path12.resolve(hubFolder, d.relPath)));
-  for (const name of fs11.readdirSync(attachDir)) {
+  for (const name of fs10.readdirSync(attachDir)) {
     const abs = path12.join(attachDir, name);
-    const st = fs11.lstatSync(abs);
+    const st = fs10.lstatSync(abs);
     if ((st.isFile() || st.isSymbolicLink()) && !keep.has(abs)) {
-      fs11.rmSync(abs);
+      fs10.rmSync(abs);
       result.removed.push(path12.relative(hubFolder, abs));
     }
   }
@@ -20893,15 +20980,28 @@ var init_eval_attachments = __esm({
 });
 
 // src/lib/parser.ts
-import * as fs12 from "fs";
+import * as fs11 from "fs";
 import * as path13 from "path";
 import * as yaml6 from "js-yaml";
+function refuseConsumedLink(hubFolder, dir, entry) {
+  if (!entry.isSymbolicLink()) return;
+  const abs = path13.join(dir, entry.name);
+  let toDir = false;
+  try {
+    toDir = fs11.statSync(abs).isDirectory();
+  } catch {
+  }
+  if (toDir || entry.name.endsWith(".yaml")) {
+    throw symlinkRefusal(path13.relative(hubFolder, abs), "file or folder");
+  }
+}
 function parseHubFolder(hubFolder, opts) {
+  requireRealHubFolder(hubFolder, false);
   const yamlPath = resolveHubYamlPath(hubFolder);
   if (!yamlPath) {
     throw expected(`hub.yaml not found in ${hubFolder}`);
   }
-  const yamlContent = fs12.readFileSync(yamlPath, "utf-8");
+  const yamlContent = readRealFileOrThrow(hubFolder, yamlPath) ?? "";
   let config;
   try {
     config = yaml6.load(yamlContent);
@@ -20929,8 +21029,14 @@ function parseHubFolder(hubFolder, opts) {
     if (typeof resolved.instructions === "string" && resolved.instructions.endsWith(".md")) {
       const instrValue = resolved.instructions;
       const instructionsPath = instrValue.startsWith("agents/") ? path13.join(hubFolder, instrValue) : path13.join(hubFolder, "agents", instrValue);
-      if (fs12.existsSync(instructionsPath)) {
-        resolved.instructions = fs12.readFileSync(instructionsPath, "utf-8");
+      if (!isUnder(path13.join(hubFolder, "agents"), instructionsPath)) {
+        throw workspaceRefusal(
+          `Agent instructions path "${instrValue}" (agent "${agent.name}") must stay inside agents/.`
+        );
+      }
+      const instructions = readRealFileOrThrow(hubFolder, instructionsPath);
+      if (instructions !== null) {
+        resolved.instructions = instructions;
       } else {
         throw expected(
           `Agent instructions file not found: ${instructionsPath} (referenced by agent "${agent.name}")`
@@ -20938,9 +21044,8 @@ function parseHubFolder(hubFolder, opts) {
       }
     } else if (resolved.instructions === void 0 && typeof agent.name === "string") {
       const conventionPath = path13.join(hubFolder, "agents", `${slugify(agent.name)}.md`);
-      if (fs12.existsSync(conventionPath)) {
-        resolved.instructions = fs12.readFileSync(conventionPath, "utf-8");
-      }
+      const instructions = readRealFileOrThrow(hubFolder, conventionPath);
+      if (instructions !== null) resolved.instructions = instructions;
     }
     return resolved;
   });
@@ -20994,18 +21099,20 @@ function parseHubFolder(hubFolder, opts) {
 }
 function scanEvalYamlFiles(hubFolder, bytesByHash) {
   const evalsDir = path13.join(hubFolder, "evals");
-  if (!fs12.existsSync(evalsDir)) return [];
+  if (!fs11.existsSync(evalsDir)) return [];
   const evals = [];
   const seen = /* @__PURE__ */ new Set();
-  const topEntries = fs12.readdirSync(evalsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  const topEntries = fs11.readdirSync(evalsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of topEntries) {
+    refuseConsumedLink(hubFolder, evalsDir, entry);
     if (entry.isFile() && entry.name.endsWith(".yaml")) {
       collectEval(evals, seen, path13.join(evalsDir, entry.name), `evals/${entry.name}`, null, hubFolder, bytesByHash);
     } else if (entry.isDirectory()) {
       const setName = entry.name;
       const setDir = path13.join(evalsDir, setName);
-      const setEntries = fs12.readdirSync(setDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+      const setEntries = fs11.readdirSync(setDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
       for (const sub of setEntries) {
+        refuseConsumedLink(hubFolder, setDir, sub);
         if (sub.isDirectory()) {
           throw expected(
             `Nested scenario sets are not supported: ${path13.relative(hubFolder, path13.join(setDir, sub.name))}. Move scenarios up to evals/${setName}/.`
@@ -21033,7 +21140,7 @@ function collectEval(evals, seen, filePath, relPath, setName, hubFolder, bytesBy
   evals.push(evalEntry);
 }
 function parseEvalYaml(filePath, relPath, setName, hubFolder, bytesByHash) {
-  const content = fs12.readFileSync(filePath, "utf-8");
+  const content = fs11.readFileSync(filePath, "utf-8");
   let raw;
   try {
     raw = yaml6.load(content);
@@ -21136,11 +21243,12 @@ function parseFixtureField(raw, label, key) {
 }
 function scanJourneyYamlFiles(hubFolder, bytesByHash) {
   const journeysDir = path13.join(hubFolder, "journeys");
-  if (!fs12.existsSync(journeysDir)) return [];
+  if (!fs11.existsSync(journeysDir)) return [];
   const journeys = [];
   const seen = /* @__PURE__ */ new Set();
-  const entries = fs12.readdirSync(journeysDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  const entries = fs11.readdirSync(journeysDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of entries) {
+    refuseConsumedLink(hubFolder, journeysDir, entry);
     if (entry.isDirectory()) {
       throw expected(
         `Subfolders are not supported under journeys/: ${path13.relative(hubFolder, path13.join(journeysDir, entry.name))}. A journey owns its own managed scenario set \u2014 put each journey in a single journeys/<slug>.yaml file.`
@@ -21160,7 +21268,7 @@ function scanJourneyYamlFiles(hubFolder, bytesByHash) {
   return journeys;
 }
 function parseJourneyYaml(filePath, relPath, hubFolder, bytesByHash) {
-  const content = fs12.readFileSync(filePath, "utf-8");
+  const content = fs11.readFileSync(filePath, "utf-8");
   let raw;
   try {
     raw = yaml6.load(content);
@@ -21216,13 +21324,13 @@ function parseJourneyYaml(filePath, relPath, hubFolder, bytesByHash) {
 }
 function scanAgentYamlFiles(hubFolder) {
   const agentsDir = path13.join(hubFolder, "agents");
-  if (!fs12.existsSync(agentsDir)) return [];
-  const yamlFiles = fs12.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml")).sort();
+  if (!fs11.existsSync(agentsDir)) return [];
+  const yamlFiles = fs11.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml")).sort();
   if (yamlFiles.length === 0) return [];
   const agents = [];
   for (const file of yamlFiles) {
     const filePath = path13.join(agentsDir, file);
-    const content = fs12.readFileSync(filePath, "utf-8");
+    const content = readRealFileOrThrow(hubFolder, filePath) ?? "";
     let agent;
     try {
       agent = yaml6.load(content);
@@ -21257,7 +21365,8 @@ function parseResources(hubFolder, configResources) {
     if (res.skill_name) resource.skill_name = res.skill_name;
     const resSlug = slugify(resource.name);
     const resDir = path13.join(resourcesDir, resSlug);
-    if (fs12.existsSync(resDir)) {
+    requireRealSubdirNoSymlink(hubFolder, resDir, false);
+    if (fs11.existsSync(resDir)) {
       const files = scanResourceFiles(resDir, "");
       if (files.length > 0) {
         resource.files = files;
@@ -21274,6 +21383,7 @@ var init_parser = __esm({
     init_resource_files();
     init_eval_attachments();
     init_expected();
+    init_fs_safety();
   }
 });
 
@@ -21331,7 +21441,7 @@ var init_workspace_files = __esm({
 });
 
 // src/lib/yaml-writer.ts
-import * as fs13 from "fs";
+import * as fs12 from "fs";
 import * as path15 from "path";
 import * as yaml7 from "js-yaml";
 function writeFileIfChanged(hubFolder, absPath, content, log) {
@@ -21382,11 +21492,11 @@ function buildEvalYamlObject(evalEntry, slug) {
 function writeHubFolder(hubFolder, payload, options = {}) {
   const log = { changed: [], removed: [] };
   const agentsDir = path15.join(hubFolder, "agents");
-  if (!fs13.existsSync(hubFolder)) {
-    fs13.mkdirSync(hubFolder, { recursive: true });
+  if (!fs12.existsSync(hubFolder)) {
+    fs12.mkdirSync(hubFolder, { recursive: true });
   }
-  if (!fs13.existsSync(agentsDir)) {
-    fs13.mkdirSync(agentsDir, { recursive: true });
+  if (!fs12.existsSync(agentsDir)) {
+    fs12.mkdirSync(agentsDir, { recursive: true });
   }
   const yamlPayload = buildYamlPayload(payload);
   const agentFiles = extractAgentFiles(payload);
@@ -21401,8 +21511,8 @@ function writeHubFolder(hubFolder, payload, options = {}) {
     if (seeded) log.changed.push(seeded);
   }
   const oldYamlPath = path15.join(hubFolder, "wayai.yaml");
-  if (fs13.existsSync(oldYamlPath)) {
-    fs13.unlinkSync(oldYamlPath);
+  if (fs12.existsSync(oldYamlPath)) {
+    fs12.unlinkSync(oldYamlPath);
     log.removed.push(path15.relative(hubFolder, oldYamlPath));
   }
   const yamlSlugs = writeAgentYamlFiles(hubFolder, agentsDir, payload.agents || [], log);
@@ -21411,20 +21521,20 @@ function writeHubFolder(hubFolder, payload, options = {}) {
     mdSlugs.add(slug);
     writeFileIfChanged(hubFolder, path15.join(agentsDir, `${slug}.md`), content, log);
   }
-  const existingFiles = fs13.readdirSync(agentsDir);
+  const existingFiles = fs12.readdirSync(agentsDir);
   for (const file of existingFiles) {
     if (file.endsWith(".yaml")) {
       const slug = file.slice(0, -5);
       if (!yamlSlugs.has(slug)) {
         const orphan = path15.join(agentsDir, file);
-        fs13.unlinkSync(orphan);
+        fs12.unlinkSync(orphan);
         log.removed.push(path15.relative(hubFolder, orphan));
       }
     } else if (file.endsWith(".md")) {
       const slug = file.slice(0, -3);
       if (!mdSlugs.has(slug)) {
         const orphan = path15.join(agentsDir, file);
-        fs13.unlinkSync(orphan);
+        fs12.unlinkSync(orphan);
         log.removed.push(path15.relative(hubFolder, orphan));
       }
     }
@@ -21435,12 +21545,13 @@ function writeHubFolder(hubFolder, payload, options = {}) {
   return log;
 }
 function setPreviewLabelInHubYaml(hubFolder, label) {
+  requireRealHubFolder(hubFolder, false);
   const yamlPath = resolveHubYamlPath(hubFolder);
   if (!yamlPath) return;
-  const obj = yaml7.load(fs13.readFileSync(yamlPath, "utf-8")) ?? {};
+  const obj = yaml7.load(readRealFileOrThrow(hubFolder, yamlPath) ?? "") ?? {};
   if (label) obj.preview_label = label;
   else delete obj.preview_label;
-  fs13.writeFileSync(yamlPath, yaml7.dump(obj, YAML_DUMP_OPTIONS), "utf-8");
+  writeFileNoFollow(hubFolder, yamlPath, Buffer.from(yaml7.dump(obj, YAML_DUMP_OPTIONS), "utf-8"));
 }
 function buildYamlPayload(payload) {
   const result = {
@@ -21505,17 +21616,17 @@ function extractAgentFiles(payload) {
 function writeEvalYamlFiles(hubFolder, evals, log) {
   const evalsDir = path15.join(hubFolder, "evals");
   if (evals.length === 0) {
-    if (fs13.existsSync(evalsDir)) {
+    if (fs12.existsSync(evalsDir)) {
       cleanEvalOrphans(hubFolder, evalsDir, /* @__PURE__ */ new Set(), log);
       try {
-        if (fs13.readdirSync(evalsDir).length === 0) fs13.rmdirSync(evalsDir);
+        if (fs12.readdirSync(evalsDir).length === 0) fs12.rmdirSync(evalsDir);
       } catch {
       }
     }
     return;
   }
-  if (!fs13.existsSync(evalsDir)) {
-    fs13.mkdirSync(evalsDir, { recursive: true });
+  if (!fs12.existsSync(evalsDir)) {
+    fs12.mkdirSync(evalsDir, { recursive: true });
   }
   const writtenRelPaths = /* @__PURE__ */ new Set();
   for (const evalEntry of evals) {
@@ -21527,12 +21638,6 @@ function writeEvalYamlFiles(hubFolder, evals, log) {
       console.warn(`  Warning: skipping eval "${evalEntry.name}" (scenario set "${setName}" escapes evals/ \u2014 possible bad backend data)`);
       continue;
     }
-    if (setName) {
-      const setDir = path15.join(evalsDir, setName);
-      if (!fs13.existsSync(setDir)) {
-        fs13.mkdirSync(setDir, { recursive: true });
-      }
-    }
     const yamlContent = yaml7.dump(buildEvalYamlObject(evalEntry, slug), YAML_DUMP_OPTIONS);
     writeFileIfChanged(hubFolder, targetPath, yamlContent, log);
     writtenRelPaths.add(relPath);
@@ -21540,31 +21645,31 @@ function writeEvalYamlFiles(hubFolder, evals, log) {
   cleanEvalOrphans(hubFolder, evalsDir, writtenRelPaths, log);
 }
 function cleanEvalOrphans(hubFolder, evalsDir, writtenRelPaths, log) {
-  const entries = fs13.readdirSync(evalsDir, { withFileTypes: true });
+  const entries = fs12.readdirSync(evalsDir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = path15.join(evalsDir, entry.name);
     if (entry.isFile()) {
       if (entry.name.endsWith(".yaml") && !writtenRelPaths.has(entry.name)) {
-        fs13.unlinkSync(fullPath);
+        fs12.unlinkSync(fullPath);
         log.removed.push(path15.relative(hubFolder, fullPath));
       }
       continue;
     }
     if (entry.isDirectory()) {
       const setName = entry.name;
-      const subEntries = fs13.readdirSync(fullPath, { withFileTypes: true });
+      const subEntries = fs12.readdirSync(fullPath, { withFileTypes: true });
       for (const sub of subEntries) {
         if (sub.isFile() && sub.name.endsWith(".yaml")) {
           const relPath = `${setName}/${sub.name}`;
           if (!writtenRelPaths.has(relPath)) {
             const orphan = path15.join(fullPath, sub.name);
-            fs13.unlinkSync(orphan);
+            fs12.unlinkSync(orphan);
             log.removed.push(path15.relative(hubFolder, orphan));
           }
         }
       }
       try {
-        if (fs13.readdirSync(fullPath).length === 0) fs13.rmdirSync(fullPath);
+        if (fs12.readdirSync(fullPath).length === 0) fs12.rmdirSync(fullPath);
       } catch {
       }
     }
@@ -21603,17 +21708,17 @@ function buildJourneyYamlObject(journeyEntry, slug) {
 function writeJourneyYamlFiles(hubFolder, journeys, log) {
   const journeysDir = path15.join(hubFolder, "journeys");
   if (journeys.length === 0) {
-    if (fs13.existsSync(journeysDir)) {
+    if (fs12.existsSync(journeysDir)) {
       cleanJourneyOrphans(hubFolder, journeysDir, /* @__PURE__ */ new Set(), log);
       try {
-        if (fs13.readdirSync(journeysDir).length === 0) fs13.rmdirSync(journeysDir);
+        if (fs12.readdirSync(journeysDir).length === 0) fs12.rmdirSync(journeysDir);
       } catch {
       }
     }
     return;
   }
-  if (!fs13.existsSync(journeysDir)) {
-    fs13.mkdirSync(journeysDir, { recursive: true });
+  if (!fs12.existsSync(journeysDir)) {
+    fs12.mkdirSync(journeysDir, { recursive: true });
   }
   const writtenFiles = /* @__PURE__ */ new Set();
   const usedSlugs = /* @__PURE__ */ new Set();
@@ -21627,11 +21732,11 @@ function writeJourneyYamlFiles(hubFolder, journeys, log) {
   cleanJourneyOrphans(hubFolder, journeysDir, writtenFiles, log);
 }
 function cleanJourneyOrphans(hubFolder, journeysDir, writtenFiles, log) {
-  const entries = fs13.readdirSync(journeysDir, { withFileTypes: true });
+  const entries = fs12.readdirSync(journeysDir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && entry.name.endsWith(".yaml") && !writtenFiles.has(entry.name)) {
       const orphan = path15.join(journeysDir, entry.name);
-      fs13.unlinkSync(orphan);
+      fs12.unlinkSync(orphan);
       log.removed.push(path15.relative(hubFolder, orphan));
     }
   }
@@ -21645,12 +21750,12 @@ function writeResourceFiles(hubFolder, resources, log) {
     const resDir = path15.join(resourcesDir, resSlug);
     writeResourceFileTree(resDir, resource.files || [], hubFolder, log);
   }
-  if (fs13.existsSync(resourcesDir)) {
-    const existingDirs = fs13.readdirSync(resourcesDir, { withFileTypes: true });
+  if (fs12.existsSync(resourcesDir)) {
+    const existingDirs = fs12.readdirSync(resourcesDir, { withFileTypes: true });
     for (const entry of existingDirs) {
       if (entry.isDirectory() && !currentSlugs.has(entry.name)) {
         const orphanDir = path15.join(resourcesDir, entry.name);
-        fs13.rmSync(orphanDir, { recursive: true, force: true });
+        fs12.rmSync(orphanDir, { recursive: true, force: true });
         log.removed.push(`${path15.relative(hubFolder, orphanDir)}/`);
       }
     }
@@ -21687,6 +21792,7 @@ async function materializeHubFolder(hubFolder, payload, options = {}) {
     );
   }
   materialized.add(payload);
+  requireRealHubFolder(hubFolder, true);
   const attachmentDownloads = rewriteEvalAttachmentsToLocalPaths(payload);
   const writeLog = writeHubFolder(hubFolder, payload, options);
   const resourceDownloads = await downloadBinaryResourceFiles(hubFolder, payload);
@@ -21718,6 +21824,7 @@ var init_hub_materializer = __esm({
     init_yaml_writer();
     init_eval_attachments();
     init_resource_files();
+    init_fs_safety();
     init_utils();
     materialized = /* @__PURE__ */ new WeakSet();
   }
@@ -21739,7 +21846,7 @@ var init_terminal_output = __esm({
 });
 
 // src/lib/base-workspace.ts
-import * as fs14 from "fs";
+import * as fs13 from "fs";
 import * as path17 from "path";
 import * as yaml8 from "js-yaml";
 function readBaseMeta(folder) {
@@ -21757,7 +21864,7 @@ function readBaseMeta(folder) {
 function listBaseFolders(basesDir) {
   let entries;
   try {
-    entries = fs14.readdirSync(basesDir).filter((entry) => !entry.startsWith("."));
+    entries = fs13.readdirSync(basesDir).filter((entry) => !entry.startsWith("."));
   } catch {
     return [];
   }
@@ -21776,10 +21883,6 @@ function isProductionFolder(meta) {
 function filterEditableBases(bases) {
   return bases.filter((b) => !isProductionFolder(b.meta));
 }
-function isUnder(parent, child) {
-  const rel = path17.relative(parent, child);
-  return rel === "" || !rel.startsWith("..") && !path17.isAbsolute(rel);
-}
 function findEnclosingBaseFolder(basesDir, cwd) {
   let dir = path17.resolve(cwd);
   const stop = path17.resolve(basesDir);
@@ -21844,7 +21947,7 @@ function resolveBaseSelectorToId(gitRoot, selector) {
 }
 function hasBaseMetaFile(folder) {
   try {
-    return fs14.lstatSync(path17.join(folder, BASE_META_FILE)).isFile();
+    return fs13.lstatSync(path17.join(folder, BASE_META_FILE)).isFile();
   } catch {
     return false;
   }
@@ -21857,6 +21960,7 @@ var init_base_workspace = __esm({
     init_expected();
     init_base_id();
     init_fs_safety();
+    init_fs_safety();
     BASE_META_FILE = "base.yaml";
   }
 });
@@ -22157,7 +22261,7 @@ var init_client = __esm({
 });
 
 // src/data/helpers.ts
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 function pathSegment(id, label = "id") {
   if (!isPathSafeId(id)) {
     throw expected(`Invalid ${label}: ${JSON.stringify(id)}. An id may use ${PATH_SAFE_ID_RULE}.`);
@@ -22185,7 +22289,7 @@ function parseData(data, flag) {
   let text = data;
   if (source !== void 0) {
     try {
-      text = readFileSync15(source, "utf-8");
+      text = readFileSync14(source, "utf-8");
     } catch (e) {
       throw expected(`${prefix}${source}: ${e instanceof Error ? e.message : "could not be read"}`);
     }
@@ -22310,7 +22414,7 @@ var init_types2 = __esm({
 });
 
 // src/data/config-as-code/config-writer.ts
-import * as fs15 from "fs";
+import * as fs14 from "fs";
 import * as path19 from "path";
 import * as yaml9 from "js-yaml";
 function dump5(value) {
@@ -22345,14 +22449,14 @@ function pruneOrphans(folder, dir, keep, log) {
   if (!ensureRealSubdirNoSymlink(folder, dir, false)) return;
   let entries;
   try {
-    entries = fs15.readdirSync(dir);
+    entries = fs14.readdirSync(dir);
   } catch {
     return;
   }
   for (const file of entries) {
     if (!file.endsWith(".yaml") || keep.has(file)) continue;
     const abs = path19.join(dir, file);
-    fs15.rmSync(abs);
+    fs14.rmSync(abs);
     log.removed.push(path19.relative(folder, abs));
   }
 }
@@ -22366,7 +22470,7 @@ function metaFileObject(meta) {
 function writeBaseFolder(folder, meta, config) {
   const delta = { changed: [], removed: [] };
   const parent = path19.dirname(folder);
-  fs15.mkdirSync(parent, { recursive: true });
+  fs14.mkdirSync(parent, { recursive: true });
   if (!ensureRealSubdirNoSymlink(parent, folder, true)) {
     throw expected(
       `Refusing to write ${folder}: the path crosses a symlink. Remove it and pull again.`
@@ -22393,7 +22497,7 @@ function writeBaseFolder(folder, meta, config) {
   for (const deprecated of DEPRECATED_ENTITY_DIRS) {
     const dir = path19.join(folder, deprecated);
     if (ensureRealSubdirNoSymlink(folder, dir, false)) {
-      fs15.rmSync(dir, { recursive: true, force: true });
+      fs14.rmSync(dir, { recursive: true, force: true });
     }
   }
   return delta;
@@ -22545,7 +22649,7 @@ var init_api = __esm({
 });
 
 // src/data/config-as-code/config-parser.ts
-import * as fs16 from "fs";
+import * as fs15 from "fs";
 import * as path20 from "path";
 import * as yaml10 from "js-yaml";
 function readEntityDir(folder, dir) {
@@ -22554,7 +22658,7 @@ function readEntityDir(folder, dir) {
   }
   if (!isDirectory(dir)) return [];
   const out = [];
-  for (const file of fs16.readdirSync(dir).sort()) {
+  for (const file of fs15.readdirSync(dir).sort()) {
     if (!file.endsWith(".yaml")) continue;
     const abs = path20.join(dir, file);
     const bytes = readFileNoFollow(folder, abs);
@@ -22941,7 +23045,7 @@ __export(push_exports, {
   shouldWarnIgnoredPreviewLabel: () => shouldWarnIgnoredPreviewLabel,
   syncAfterPush: () => syncAfterPush
 });
-import * as fs17 from "fs";
+import * as fs16 from "fs";
 import * as path22 from "path";
 import * as yaml11 from "js-yaml";
 function parseArgs5(args2) {
@@ -23050,13 +23154,14 @@ function printLocalFileChanges(delta) {
   emit(delta.changed, "~");
 }
 async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, remoteConfig) {
+  requireRealHubFolder(hubFolder, false);
   const agentsDir = path22.join(hubFolder, "agents");
   let agentsWithIds = [];
-  if (fs17.existsSync(agentsDir)) {
-    const yamlFiles = fs17.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml"));
+  if (fs16.existsSync(agentsDir)) {
+    const yamlFiles = fs16.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml"));
     for (const file of yamlFiles) {
+      const content = readRealFileOrThrow(hubFolder, path22.join(agentsDir, file)) ?? "";
       try {
-        const content = fs17.readFileSync(path22.join(agentsDir, file), "utf-8");
         const agent = yaml11.load(content);
         if (agent?.id && agent.name) {
           agentsWithIds.push({ id: agent.id, name: agent.name });
@@ -23069,7 +23174,7 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
   if (agentsWithIds.length === 0) {
     const yamlPath = resolveHubYamlPath(hubFolder);
     if (!yamlPath) return;
-    const yamlContent = fs17.readFileSync(yamlPath, "utf-8");
+    const yamlContent = readRealFileOrThrow(hubFolder, yamlPath) ?? "";
     const config = yaml11.load(yamlContent);
     agentsWithIds = (config.agents || []).filter((a) => !!a.id && !!a.name);
   }
@@ -23101,18 +23206,18 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
     }
   }
   if (renames.length === 0) return;
-  if (!fs17.existsSync(agentsDir)) return;
-  for (const file of fs17.readdirSync(agentsDir)) {
+  if (!fs16.existsSync(agentsDir)) return;
+  for (const file of fs16.readdirSync(agentsDir)) {
     if (file.startsWith("__rename_temp_") && (file.endsWith(".md") || file.endsWith(".yaml"))) {
       console.warn(`  Warning: removing orphaned temp file agents/${file}`);
-      fs17.unlinkSync(path22.join(agentsDir, file));
+      fs16.unlinkSync(path22.join(agentsDir, file));
     }
   }
   const renameFileIfExists = (dir, oldName, newName) => {
     const oldPath = path22.join(dir, oldName);
     const newPath = path22.join(dir, newName);
-    if (!fs17.existsSync(oldPath)) return false;
-    fs17.renameSync(oldPath, newPath);
+    if (!fs16.existsSync(oldPath)) return false;
+    fs16.renameSync(oldPath, newPath);
     return true;
   };
   const oldSlugs = new Set(renames.map((r) => r.oldSlug));
@@ -23145,9 +23250,9 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
     }
   } else {
     for (const { oldSlug, newSlug } of renames) {
-      const hasOldFile = extensions.some((ext) => fs17.existsSync(path22.join(agentsDir, `${oldSlug}${ext}`)));
+      const hasOldFile = extensions.some((ext) => fs16.existsSync(path22.join(agentsDir, `${oldSlug}${ext}`)));
       if (!hasOldFile) continue;
-      const hasNewFile = extensions.some((ext) => fs17.existsSync(path22.join(agentsDir, `${newSlug}${ext}`)));
+      const hasNewFile = extensions.some((ext) => fs16.existsSync(path22.join(agentsDir, `${newSlug}${ext}`)));
       if (hasNewFile) {
         console.warn(`  Warning: skipping rename agents/${oldSlug}.* \u2192 agents/${newSlug}.* (target already exists)`);
         continue;
@@ -23162,7 +23267,7 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
   if (completedRenames.length === 0) return;
   const mainYamlPath = resolveHubYamlPath(hubFolder);
   if (mainYamlPath) {
-    const mainYamlContent = fs17.readFileSync(mainYamlPath, "utf-8");
+    const mainYamlContent = readRealFileOrThrow(hubFolder, mainYamlPath) ?? "";
     const substitutionMap = /* @__PURE__ */ new Map();
     for (const { oldSlug, newSlug } of completedRenames) {
       substitutionMap.set(`agents/${oldSlug}.md`, `agents/${newSlug}.md`);
@@ -23173,7 +23278,7 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
       (_match, prefix, pathMatch) => `${prefix}${substitutionMap.get(pathMatch) ?? pathMatch}`
     );
     if (updatedYaml !== mainYamlContent) {
-      fs17.writeFileSync(mainYamlPath, updatedYaml, "utf-8");
+      writeFileNoFollow(hubFolder, mainYamlPath, Buffer.from(updatedYaml, "utf-8"));
       console.log(`  Updated instructions paths in ${path22.basename(mainYamlPath)}`);
     }
   }
@@ -23267,11 +23372,13 @@ New hub: "${newHub.hubName}" (${hubType})`);
       return;
     }
   }
+  requireRealHubFolder(newHub.hubFolder, false);
   const hubYamlPath = resolveHubYamlPath(newHub.hubFolder);
   if (!hubYamlPath) {
     console.error(`hub.yaml not found in ${newHub.hubFolder}. Cannot proceed with hub creation.`);
     process.exit(1);
   }
+  const content = readRealFileOrThrow(newHub.hubFolder, hubYamlPath) ?? "";
   console.log("Creating hub...");
   const createResult = await client.createHub(opts.organizationId, {
     hubName: newHub.hubName,
@@ -23285,7 +23392,6 @@ New hub: "${newHub.hubName}" (${hubType})`);
     process.exit(1);
   }
   console.log(`Hub created: ${createdHub.hub_name} (${hubId})`);
-  const content = fs17.readFileSync(hubYamlPath, "utf-8");
   const hasVersion = content.match(/^version:\s/m);
   let updated;
   if (hasVersion) {
@@ -23301,7 +23407,7 @@ hub_id: "${hubId}"
 hub_environment: preview
 ${content}`;
   }
-  fs17.writeFileSync(hubYamlPath, updated, "utf-8");
+  writeFileNoFollow(newHub.hubFolder, hubYamlPath, Buffer.from(updated, "utf-8"));
   seedScopeIfEmpty("hubs", hubId);
   await pushSingleHub(client, hubId, newHub.hubFolder, opts.autoConfirm, opts.organizationId, { skipAgentRename: true });
 }
@@ -23347,7 +23453,7 @@ async function pushCommand(args2) {
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
   const workspaceDir = resolveWorkspaceDir();
   const wsLabel = hubsDirLabel(gitRoot);
-  if (!fs17.existsSync(workspaceDir)) {
+  if (!fs16.existsSync(workspaceDir)) {
     console.error(`No ${wsLabel}/ directory found. Run \`wayai pull\` first or create hub files in ${wsLabel}/<hub>/hub.yaml.`);
     process.exit(1);
   }
@@ -23391,6 +23497,7 @@ var init_push = __esm({
     init_repo_config();
     init_worktree_scope();
     init_subtree_routing();
+    init_fs_safety();
     LOCAL_CHANGE_LIST_CAP = 20;
   }
 });
@@ -23403,7 +23510,7 @@ __export(pull_exports, {
   resolveHubTarget: () => resolveHubTarget,
   writeProductionMirror: () => writeProductionMirror2
 });
-import * as fs18 from "fs";
+import * as fs17 from "fs";
 import * as path23 from "path";
 function parseArgs6(args2) {
   return { autoConfirm: args2.includes("--yes") || args2.includes("-y") };
@@ -23470,7 +23577,7 @@ async function pullCommand(args2) {
       payload.preview_label,
       payload.branch_name
     );
-    fs18.mkdirSync(path23.dirname(hubFolder), { recursive: true });
+    fs17.mkdirSync(path23.dirname(hubFolder), { recursive: true });
     console.log("Writing hub configuration...");
     await materializeHubFolder(hubFolder, payload);
     const finalFolder = autoRenameHubFolder(hubFolder, payload.hub.name, payload.hub_environment, payload.hub_id, payload.preview_label, payload.branch_name);
@@ -23499,7 +23606,8 @@ async function pullCommand(args2) {
         }
         action = "apply";
       }
-    } catch {
+    } catch (err) {
+      if (isWorkspaceRefusal(err)) throw err;
       action = "overwrite";
     }
     if (action === "overwrite") console.log("Writing hub configuration...");
@@ -23524,7 +23632,7 @@ async function pullCommand(args2) {
 }
 async function writeProductionMirror2(workspaceDir, prodPayload) {
   const folder = resolveHubFolder(workspaceDir, prodPayload.hub_id, prodPayload.hub.name, "production", null, null);
-  fs18.mkdirSync(path23.dirname(folder), { recursive: true });
+  fs17.mkdirSync(path23.dirname(folder), { recursive: true });
   await materializeHubFolder(folder, prodPayload, { seedAgentContext: false });
   const finalFolder = autoRenameHubFolder(folder, prodPayload.hub.name, "production", prodPayload.hub_id, null, null);
   prependMirrorMarker(finalFolder, prodPayload.hub_id);
@@ -23542,11 +23650,11 @@ async function mirrorLinkedProduction2(client, workspaceDir, productionHubId, or
 function prependMirrorMarker(hubFolder, productionHubId) {
   const hubYaml = path23.join(hubFolder, "hub.yaml");
   try {
-    const content = fs18.readFileSync(hubYaml, "utf-8");
+    const content = fs17.readFileSync(hubYaml, "utf-8");
     if (content.startsWith(MIRROR_MARKER_PREFIX2)) return;
     const marker = `${MIRROR_MARKER_PREFIX2} ${productionHubId}. Edits are ignored; push is blocked. Edit the linked preview hub instead.
 `;
-    fs18.writeFileSync(hubYaml, marker + content, "utf-8");
+    fs17.writeFileSync(hubYaml, marker + content, "utf-8");
   } catch {
   }
 }
@@ -23574,6 +23682,7 @@ var init_pull = __esm({
     init_utils();
     init_resource_files();
     init_hub_materializer();
+    init_fs_safety();
     init_push();
     init_workspace();
     init_layout();
@@ -23590,7 +23699,7 @@ __export(create_exports, {
   createCommand: () => createCommand
 });
 import * as path24 from "path";
-import * as fs19 from "fs";
+import * as fs18 from "fs";
 function parseArgs7(args2) {
   let autoConfirm = false;
   let folderSelector;
@@ -23617,7 +23726,7 @@ async function createCommand(args2) {
   const gitRoot = findGitRoot();
   const wsLabel = hubsDirLabel(gitRoot);
   if (gitRoot) warnLayoutOnce(gitRoot);
-  if (!fs19.existsSync(workspaceDir)) {
+  if (!fs18.existsSync(workspaceDir)) {
     console.error(`No ${wsLabel}/ directory found. Create hub files in ${wsLabel}/<hub>/hub.yaml with \`hub: { name: ... }\` first.`);
     process.exit(1);
   }
@@ -23751,7 +23860,7 @@ var replicate_exports = {};
 __export(replicate_exports, {
   replicateCommand: () => replicateCommand
 });
-import * as fs20 from "fs";
+import * as fs19 from "fs";
 import * as path25 from "path";
 function parseArgs9(args2) {
   let label;
@@ -23798,8 +23907,8 @@ async function replicateCommand(args2) {
     payload.preview_label,
     payload.branch_name
   );
-  const folderPreExisted = fs20.existsSync(hubFolder);
-  fs20.mkdirSync(path25.dirname(hubFolder), { recursive: true });
+  const folderPreExisted = fs19.existsSync(hubFolder);
+  fs19.mkdirSync(path25.dirname(hubFolder), { recursive: true });
   const delta = await materializeHubFolder(hubFolder, payload);
   hubFolder = autoRenameHubFolder(
     hubFolder,
@@ -24226,7 +24335,7 @@ __export(migrate_exports, {
   migrateCommand: () => migrateCommand
 });
 import { execFileSync as execFileSync3 } from "child_process";
-import * as fs21 from "fs";
+import * as fs20 from "fs";
 import * as path29 from "path";
 function isTracked(gitRoot, p) {
   try {
@@ -24240,7 +24349,7 @@ function isTracked(gitRoot, p) {
   }
 }
 function moveDir(gitRoot, from, to) {
-  fs21.mkdirSync(path29.dirname(to), { recursive: true });
+  fs20.mkdirSync(path29.dirname(to), { recursive: true });
   if (isTracked(gitRoot, from)) {
     try {
       execFileSync3("git", ["mv", path29.relative(gitRoot, from), path29.relative(gitRoot, to)], {
@@ -24251,7 +24360,7 @@ function moveDir(gitRoot, from, to) {
     } catch {
     }
   }
-  fs21.renameSync(from, to);
+  fs20.renameSync(from, to);
   return "fs";
 }
 async function migrateCommand(_args) {
@@ -24266,8 +24375,11 @@ async function migrateCommand(_args) {
   const legacyOrg = path29.join(gitRoot, WAYAI_LAYOUT.legacy.orgAtRoot);
   const newHubs = path29.join(newWs, WAYAI_LAYOUT.hubsSubdir);
   const newOrg = path29.join(newWs, WAYAI_LAYOUT.orgSubdir);
-  const hasLegacyWs = isDirectory(legacyWs);
-  const hasLegacyOrg = isDirectory(legacyOrg);
+  requireRealSubdirNoSymlink(gitRoot, newHubs, false);
+  requireRealSubdirNoSymlink(gitRoot, newOrg, false);
+  readRealFileOrThrow(gitRoot, workspaceManifestPath(gitRoot));
+  const hasLegacyWs = isRealDirectory(legacyWs);
+  const hasLegacyOrg = isRealDirectory(legacyOrg);
   const orgPlan = planOrgMigration(gitRoot);
   if (orgPlan.kind === "refuse") {
     console.error(orgPlan.message);
@@ -24331,6 +24443,7 @@ var init_migrate = __esm({
     "use strict";
     init_workspace();
     init_layout();
+    init_fs_safety();
     init_repo_config();
     init_workspace_manifest();
   }
@@ -24414,12 +24527,12 @@ var send_message_exports = {};
 __export(send_message_exports, {
   sendMessageCommand: () => sendMessageCommand
 });
-import * as fs22 from "fs";
+import * as fs21 from "fs";
 import * as path30 from "path";
 function statAttachment(filePath) {
   let stat2;
   try {
-    stat2 = fs22.statSync(filePath);
+    stat2 = fs21.statSync(filePath);
   } catch {
     console.error(`Error: file not found: ${filePath}`);
     process.exit(1);
@@ -24435,7 +24548,7 @@ function readAttachment(filePath, size) {
   const ext = path30.extname(fileName).replace(/^\./, "");
   return {
     file_name: fileName,
-    file_binary: fs22.readFileSync(filePath).toString("base64"),
+    file_binary: fs21.readFileSync(filePath).toString("base64"),
     file_size: size,
     ...ext && { file_extension: ext }
   };
@@ -26634,7 +26747,7 @@ var eval_capture_exports = {};
 __export(eval_capture_exports, {
   evalCaptureCommand: () => evalCaptureCommand
 });
-import * as fs23 from "fs";
+import * as fs22 from "fs";
 import * as path31 from "path";
 import * as yaml12 from "js-yaml";
 function isValidSetName(name) {
@@ -26708,7 +26821,17 @@ async function evalCaptureCommand(args2) {
     console.error(`Resolved path "${path31.relative(hubFolder, targetPath)}" escapes evals/. Aborting.`);
     process.exit(1);
   }
-  if (fs23.existsSync(targetPath)) {
+  if (!ensureRealSubdirNoSymlink(hubFolder, targetDir, false)) {
+    console.error(`${path31.relative(hubFolder, targetDir)} is reached through a symlink. Aborting.`);
+    process.exit(1);
+  }
+  let targetTaken = true;
+  try {
+    fs22.lstatSync(targetPath);
+  } catch {
+    targetTaken = false;
+  }
+  if (targetTaken) {
     console.error(`File already exists: ${path31.relative(hubFolder, targetPath)}. Use --name to choose a different name.`);
     process.exit(1);
   }
@@ -26741,8 +26864,13 @@ async function evalCaptureCommand(args2) {
     ...captured.evaluator_instructions ? { evaluator_instructions: captured.evaluator_instructions } : {}
   };
   const yamlObj = buildEvalYamlObject(evalEntry, slug);
-  fs23.mkdirSync(targetDir, { recursive: true });
-  fs23.writeFileSync(targetPath, yaml12.dump(yamlObj, YAML_DUMP_OPTIONS), "utf-8");
+  const outcome = createFileNoFollow(hubFolder, targetPath, Buffer.from(yaml12.dump(yamlObj, YAML_DUMP_OPTIONS), "utf-8"));
+  if (outcome !== "created") {
+    console.error(
+      `Could not write ${path31.relative(hubFolder, targetPath)} (${outcome === "exists" ? "it appeared meanwhile" : "its folder is reached through a symlink"}). The scenario was created on the platform as ${captured.eval_id} \u2014 run \`wayai pull\` to fetch it.`
+    );
+    process.exit(1);
+  }
   const relPath = path31.relative(process.cwd(), targetPath);
   console.log(`
 Wrote ${relPath}`);
@@ -26757,6 +26885,7 @@ var init_eval_capture = __esm({
     init_workspace();
     init_utils();
     init_yaml_writer();
+    init_fs_safety();
   }
 });
 
@@ -28114,23 +28243,21 @@ var init_set_connection_credential = __esm({
 });
 
 // src/lib/org-workspace.ts
-import * as fs24 from "fs";
+import * as fs23 from "fs";
 import * as path32 from "path";
 import * as yaml13 from "js-yaml";
 function getOrgDir(gitRoot) {
   return resolveLayout(gitRoot).orgDir;
 }
 function orgManifestExists(orgDir) {
-  return fs24.existsSync(path32.join(orgDir, ORG_MANIFEST_NAME));
+  return fs23.existsSync(path32.join(orgDir, ORG_MANIFEST_NAME));
 }
 function parseOrgResources(orgDir) {
-  const manifestPath = path32.join(orgDir, ORG_MANIFEST_NAME);
-  let manifest = {};
-  if (fs24.existsSync(manifestPath)) {
-    manifest = yaml13.load(fs24.readFileSync(manifestPath, "utf-8")) ?? {};
-  }
-  const rawResources = Array.isArray(manifest.resources) ? manifest.resources : [];
   const resourcesDir = path32.join(orgDir, "resources");
+  requireRealSubdirNoSymlink(orgDir, resourcesDir, false);
+  const manifestText = readRealFileOrThrow(orgDir, path32.join(orgDir, ORG_MANIFEST_NAME));
+  const manifest = (manifestText !== null ? yaml13.load(manifestText) : null) ?? {};
+  const rawResources = Array.isArray(manifest.resources) ? manifest.resources : [];
   const resources = rawResources.map((res) => {
     const resource = { name: res.name };
     if (res.id) resource.id = res.id;
@@ -28143,7 +28270,8 @@ function parseOrgResources(orgDir) {
     if (Array.isArray(res.tags)) resource.tags = res.tags;
     if (Array.isArray(res.folders)) resource.folders = res.folders;
     const resDir = path32.join(resourcesDir, slugify(resource.name));
-    if (fs24.existsSync(resDir)) {
+    requireRealSubdirNoSymlink(orgDir, resDir, false);
+    if (fs23.existsSync(resDir)) {
       const files = scanResourceFiles(resDir, "");
       if (files.length > 0) resource.files = files;
     }
@@ -28152,28 +28280,29 @@ function parseOrgResources(orgDir) {
   return { version: 1, resources };
 }
 function writeOrgResources(orgDir, payload) {
-  fs24.mkdirSync(orgDir, { recursive: true });
+  fs23.mkdirSync(orgDir, { recursive: true });
+  const resourcesDir = path32.join(orgDir, "resources");
+  requireRealSubdirNoSymlink(orgDir, resourcesDir, false);
   const resources = payload.resources ?? [];
   const manifestResources = resources.map((r) => {
     const { files: _files, ...rest } = r;
     return rest;
   });
-  fs24.writeFileSync(
+  writeFileNoFollow(
+    orgDir,
     path32.join(orgDir, ORG_MANIFEST_NAME),
-    yaml13.dump({ version: 1, resources: manifestResources }, YAML_DUMP_OPTIONS),
-    "utf-8"
+    Buffer.from(yaml13.dump({ version: 1, resources: manifestResources }, YAML_DUMP_OPTIONS), "utf-8")
   );
-  const resourcesDir = path32.join(orgDir, "resources");
   const currentSlugs = /* @__PURE__ */ new Set();
   for (const resource of resources) {
     const resSlug = slugify(resource.name);
     currentSlugs.add(resSlug);
     writeResourceFileTree(path32.join(resourcesDir, resSlug), resource.files || [], orgDir);
   }
-  if (fs24.existsSync(resourcesDir)) {
-    for (const entry of fs24.readdirSync(resourcesDir, { withFileTypes: true })) {
+  if (fs23.existsSync(resourcesDir)) {
+    for (const entry of fs23.readdirSync(resourcesDir, { withFileTypes: true })) {
       if (entry.isDirectory() && !currentSlugs.has(entry.name)) {
-        fs24.rmSync(path32.join(resourcesDir, entry.name), { recursive: true, force: true });
+        fs23.rmSync(path32.join(resourcesDir, entry.name), { recursive: true, force: true });
       }
     }
   }
@@ -28193,6 +28322,7 @@ var init_org_workspace = __esm({
     "use strict";
     init_utils();
     init_layout();
+    init_fs_safety();
     init_resource_files();
     init_yaml_writer();
     ORG_MANIFEST_NAME = "resources.yaml";
@@ -28478,7 +28608,7 @@ var init_report_edit_args = __esm({
 });
 
 // src/lib/file-map.ts
-import * as fs25 from "fs";
+import * as fs24 from "fs";
 import * as path33 from "path";
 function isSafeRelPath(rel) {
   if (rel.length === 0 || rel.length > 300) return false;
@@ -28495,8 +28625,8 @@ function writeFileMap(targetDir, files) {
       throw new Error(`Refusing to write unsafe path: ${rel}`);
     }
     const abs = path33.join(targetDir, rel);
-    fs25.mkdirSync(path33.dirname(abs), { recursive: true });
-    fs25.writeFileSync(abs, body, "utf-8");
+    fs24.mkdirSync(path33.dirname(abs), { recursive: true });
+    fs24.writeFileSync(abs, body, "utf-8");
     written.push(rel);
   }
   return written;
@@ -28512,7 +28642,7 @@ var admin_exports = {};
 __export(admin_exports, {
   adminCommand: () => adminCommand
 });
-import * as fs26 from "fs";
+import * as fs25 from "fs";
 import * as path34 from "path";
 async function adminCommand(args2) {
   const [group, ...afterGroup] = args2;
@@ -28828,7 +28958,7 @@ async function runArchiveRead(positional, flagArgs) {
       exitOnApiError(err);
       throw err;
     }
-    fs26.writeFileSync(outPath, zip);
+    fs25.writeFileSync(outPath, zip);
     console.log(`Wrote ${zip.byteLength} bytes to ${outPath}`);
     return;
   }
@@ -28970,7 +29100,7 @@ async function runSkillInstall(positional) {
     throw err;
   }
   const root = findGitRoot() ?? process.cwd();
-  const present = HARNESS_SKILL_DIRS.filter((dir) => fs26.existsSync(path34.join(root, dir)));
+  const present = HARNESS_SKILL_DIRS.filter((dir) => fs25.existsSync(path34.join(root, dir)));
   const targets = present.length > 0 ? present : HARNESS_SKILL_DIRS;
   const fileCount = Object.keys(res.files).length;
   const relDirs = targets.map((harness) => {
@@ -30528,7 +30658,7 @@ var init_actions = __esm({
 
 // src/data/commands/attachments.ts
 import { Command as Command2 } from "commander";
-import { readFileSync as readFileSync20 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 function findAttachmentByFilename(attachments, filename) {
   return attachments.find((a) => a.key.endsWith(`/${filename}`)) ?? null;
 }
@@ -30569,7 +30699,7 @@ function buildAttachmentsCommand() {
       printOutput(data, outputFormat(this));
       return;
     }
-    const body = readFileSync20(opts.file);
+    const body = readFileSync17(opts.file);
     await client.upload(uploadPathFrom(data?.upload_url), body, opts.contentType);
     printOutput({ ...data, uploaded: true }, outputFormat(this));
   });
@@ -30969,7 +31099,7 @@ var init_import = __esm({
 
 // src/data/commands/providers.ts
 import { Command as Command5 } from "commander";
-import { writeFileSync as writeFileSync14 } from "fs";
+import { writeFileSync as writeFileSync9 } from "fs";
 function providerSegment(provider) {
   if (!VALID_PROVIDERS.includes(provider)) {
     throw expected(`Unknown provider ${JSON.stringify(provider)}. Expected one of: ${VALID_PROVIDERS_HELP}.`);
@@ -31002,7 +31132,7 @@ function buildBasesProvidersCommand() {
     );
     if (opts.to) {
       try {
-        writeFileSync14(opts.to, JSON.stringify(data, null, 2));
+        writeFileSync9(opts.to, JSON.stringify(data, null, 2));
       } catch (e) {
         throw expected(`--to ${opts.to}: ${e instanceof Error ? e.message : "could not be written"}`);
       }
@@ -31049,8 +31179,8 @@ var init_providers = __esm({
 
 // src/data/commands/report.ts
 import { Command as Command6 } from "commander";
-import { readFileSync as readFileSync21 } from "fs";
-import { dirname as dirname12, join as join30 } from "path";
+import { readFileSync as readFileSync18 } from "fs";
+import { dirname as dirname13, join as join30 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function resolveCliVersion() {
   for (const candidate of [
@@ -31058,7 +31188,7 @@ function resolveCliVersion() {
     join30(here, "..", "..", "..", "package.json")
   ]) {
     try {
-      const version = JSON.parse(readFileSync21(candidate, "utf-8")).version;
+      const version = JSON.parse(readFileSync18(candidate, "utf-8")).version;
       if (typeof version === "string" && version) return version;
     } catch {
     }
@@ -31254,13 +31384,13 @@ var init_report2 = __esm({
     init_terminal_output();
     init_workspace();
     init_skill_version();
-    here = dirname12(fileURLToPath2(import.meta.url));
+    here = dirname13(fileURLToPath2(import.meta.url));
   }
 });
 
 // src/data/commands/credentials.ts
 import { Command as Command7 } from "commander";
-import { readFileSync as readFileSync22 } from "fs";
+import { readFileSync as readFileSync19 } from "fs";
 function withValueSourceOptions(cmd, what) {
   return cmd.option(
     "--file <path>",
@@ -31273,7 +31403,7 @@ async function resolveValue(opts, label) {
       throw expected("--file cannot be combined with --value-stdin or --value-prompt \u2014 pass one.");
     }
     try {
-      return readFileSync22(opts.file).toString("base64");
+      return readFileSync19(opts.file).toString("base64");
     } catch (e) {
       throw expected(`--file ${opts.file}: ${e instanceof Error ? e.message : "could not be read"}`);
     }
@@ -31422,7 +31552,7 @@ var init_credentials = __esm({
 
 // src/data/commands/sql.ts
 import { Command as Command8 } from "commander";
-import { readFileSync as readFileSync23 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
 function buildBasesSqlCommand() {
   return withBaseOption(new Command8("sql")).description("Execute a read-only SQL query against base data").argument("[query]", "SQL query (SELECT only)").option("--file <path>", "Read SQL from a file instead of the argument").option(
     "--param <kv...>",
@@ -31432,7 +31562,7 @@ function buildBasesSqlCommand() {
     let query;
     if (opts.file) {
       try {
-        query = readFileSync23(opts.file, "utf-8").trim();
+        query = readFileSync20(opts.file, "utf-8").trim();
       } catch (e) {
         throw expected(`--file ${opts.file}: ${e instanceof Error ? e.message : "could not be read"}`);
       }
@@ -32087,8 +32217,8 @@ var init_file_types = __esm({
 
 // src/data/commands/files.ts
 import { Command as Command12 } from "commander";
-import { readFileSync as readFileSync24, writeFileSync as writeFileSync15 } from "fs";
-import { basename as basename18 } from "path";
+import { readFileSync as readFileSync21, writeFileSync as writeFileSync10 } from "fs";
+import { basename as basename20 } from "path";
 function renderFileDiff(fileType, filePath, from, to, d) {
   console.log(sanitizeTerminalText(`${fileType}/${filePath}: v${from} \u2192 v${to}`));
   const md = d.metadata_delta;
@@ -32120,7 +32250,7 @@ function renderFileDiff(fileType, filePath, from, to, d) {
 }
 function downloadTarget(remotePath, to) {
   if (to) return to;
-  const derived = basename18(remotePath);
+  const derived = basename20(remotePath);
   if (derived === "" || derived === "." || derived === "..") {
     throw expected(
       `Cannot derive a local filename from "${remotePath}" \u2014 pass --to <local> to name it.`
@@ -32136,7 +32266,7 @@ function buildFilesCommand() {
     "Upload a local file to a path (e.g. wayai files put reports q3/summary.pdf --file ./summary.pdf)"
   ).requiredOption("--file <local>", "Local file to upload").option("--content-type <type>", "MIME type", "application/octet-stream").action(async function(fileType, filePath, opts) {
     const base = pathSegment(requireBase(this), "--base");
-    const body = readFileSync24(opts.file);
+    const body = readFileSync21(opts.file);
     const client = await createDataClient();
     printOutput(
       await client.upload(
@@ -32167,7 +32297,7 @@ function buildFilesCommand() {
     const { bytes } = await client.download(
       `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${encoded}${versionQs ? `?${versionQs}` : ""}`
     );
-    writeFileSync15(out, bytes);
+    writeFileSync10(out, bytes);
     console.log(`Downloaded to ${out}`);
   });
   files.command("history <file_type> <path>").description("List the content versions of a file (newest first)").option("--limit <n>", "Max versions to return").option("--offset <n>", "Pagination offset").action(async function(fileType, filePath, opts) {
@@ -33185,9 +33315,9 @@ init_errors2();
 init_mask_secrets();
 init_utils();
 init_registry();
-import { readFileSync as readFileSync25 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname13, join as join31 } from "path";
+import { dirname as dirname14, join as join31 } from "path";
 
 // src/lib/version-refresh.ts
 init_version_cache();
@@ -33342,8 +33472,8 @@ Run \`wayai admin skill install\` to update.`);
 }
 
 // src/index.ts
-var __dirname = dirname13(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync25(join31(__dirname, "..", "package.json"), "utf-8"));
+var __dirname = dirname14(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync22(join31(__dirname, "..", "package.json"), "utf-8"));
 var [, , command, ...args] = process.argv;
 var isBackgroundRefresh = command === REFRESH_COMMAND;
 if (!isBackgroundRefresh) initSentry(command, pkg.version);