jinzd-ai-cli 0.4.201 → 0.4.202

package/dist/{batch-SWBDLVZO.js → batch-UF4EWYFD.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   ConfigManager
-} from "./chunk-QT5SGLTM.js";
+} from "./chunk-JCY7RQIA.js";
 import "./chunk-TZQHYZKT.js";
-import "./chunk-SDT4DCNX.js";
+import "./chunk-HZKC424D.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-JP6ESDV7.js → chunk-2NINHXEZ.js}

@@ -925,6 +925,18 @@ function toUsage(u) {
   if (cached > 0) usage.cacheReadTokens = cached;
   return usage;
 }
+function isLoopbackBaseUrl(baseUrl) {
+  if (!baseUrl) return false;
+  let host;
+  try {
+    host = new URL(baseUrl).hostname;
+  } catch {
+    return false;
+  }
+  host = host.replace(/^\[|\]$/g, "").toLowerCase();
+  if (host === "localhost" || host === "::1" || host === "0.0.0.0") return true;
+  return /^127(?:\.\d{1,3}){3}$/.test(host);
+}
 var OpenAICompatibleProvider = class extends BaseProvider {
   client;
   defaultTimeout = 6e4;
@@ -940,7 +952,7 @@ var OpenAICompatibleProvider = class extends BaseProvider {
       baseURL: options?.baseUrl ?? this.defaultBaseUrl,
       timeout: this.defaultTimeout
     };
-    const proxyUrl = options?.proxy;
+    const proxyUrl = isLoopbackBaseUrl(clientOptions.baseURL) ? void 0 : options?.proxy;
     try {
       const { Agent, ProxyAgent, fetch: undiciFetch } = await import("undici");
       const STREAM_BODY_TIMEOUT = 30 * 60 * 1e3;

package/dist/{chunk-HLOHSMTT.js → chunk-2YLYDFEX.js}

@@ -5,10 +5,10 @@ import {
 } from "./chunk-T2NL5ZIA.js";
 import {
   runTestsTool
-} from "./chunk-C46JMUDC.js";
+} from "./chunk-75SUTNYY.js";
 import {
   runTool
-} from "./chunk-YUA2KL7W.js";
+} from "./chunk-GOKVKOG3.js";
 import {
   getDangerLevel,
   isFileWriteTool,
@@ -26,7 +26,7 @@ import {
   SUBAGENT_ALLOWED_TOOLS,
   SUBAGENT_DEFAULT_MAX_ROUNDS,
   SUBAGENT_MAX_ROUNDS_LIMIT
-} from "./chunk-SDT4DCNX.js";
+} from "./chunk-HZKC424D.js";
 import {
   fileCheckpoints
 } from "./chunk-4BKXL7SM.js";

package/dist/{chunk-C46JMUDC.js → chunk-75SUTNYY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   TEST_TIMEOUT
-} from "./chunk-SDT4DCNX.js";
+} from "./chunk-HZKC424D.js";
 
 // src/tools/builtin/run-tests.ts
 import { execSync, spawnSync } from "child_process";

package/dist/{chunk-YUA2KL7W.js → chunk-GOKVKOG3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   CONFIG_DIR_NAME
-} from "./chunk-SDT4DCNX.js";
+} from "./chunk-HZKC424D.js";
 import {
   atomicWriteFileSync
 } from "./chunk-IW3Q7AE5.js";

package/dist/{chunk-SDT4DCNX.js → chunk-HZKC424D.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/core/constants.ts
-var VERSION = "0.4.201";
+var VERSION = "0.4.202";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{chunk-QT5SGLTM.js → chunk-JCY7RQIA.js}

@@ -8,7 +8,7 @@ import {
   CONFIG_FILE_NAME,
   HISTORY_DIR_NAME,
   PLUGINS_DIR_NAME
-} from "./chunk-SDT4DCNX.js";
+} from "./chunk-HZKC424D.js";
 
 // src/config/config-manager.ts
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";

package/dist/{chunk-3UWMMYCQ.js → chunk-Q2MBPMTW.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   truncateForPersist
-} from "./chunk-HLOHSMTT.js";
+} from "./chunk-2YLYDFEX.js";
 import {
   APP_NAME,
   CONFIG_DIR_NAME,
@@ -11,7 +11,7 @@ import {
   MCP_PROTOCOL_VERSION,
   MCP_TOOL_PREFIX,
   VERSION
-} from "./chunk-SDT4DCNX.js";
+} from "./chunk-HZKC424D.js";
 
 // src/mcp/client.ts
 import { spawn } from "child_process";

package/dist/{chunk-IAWXC2SO.js → chunk-SB77W6XS.js}

@@ -2,7 +2,7 @@
 import {
   CONFIG_DIR_NAME,
   VERSION
-} from "./chunk-SDT4DCNX.js";
+} from "./chunk-HZKC424D.js";
 
 // src/diagnostics/crash-log.ts
 import {

package/dist/{chunk-WFGCP2GF.js → chunk-Y6U6FMVV.js}

@@ -6,7 +6,7 @@ import { platform } from "os";
 import chalk from "chalk";
 
 // src/core/constants.ts
-var VERSION = "0.4.201";
+var VERSION = "0.4.202";
 var APP_NAME = "ai-cli";
 var CONFIG_DIR_NAME = ".aicli";
 var CONFIG_FILE_NAME = "config.json";

package/dist/{ci-O3JM5YAA.js → ci-YOJTTP4J.js}

@@ -6,15 +6,15 @@ import {
 } from "./chunk-HLWUDRBO.js";
 import {
   ProviderRegistry
-} from "./chunk-JP6ESDV7.js";
+} from "./chunk-2NINHXEZ.js";
 import "./chunk-5UR6ZOF4.js";
 import {
   ConfigManager
-} from "./chunk-QT5SGLTM.js";
+} from "./chunk-JCY7RQIA.js";
 import "./chunk-TZQHYZKT.js";
 import {
   VERSION
-} from "./chunk-SDT4DCNX.js";
+} from "./chunk-HZKC424D.js";
 
 // src/cli/ci.ts
 import { execFileSync, execSync } from "child_process";

package/dist/{constants-QUKKMYWZ.js → constants-VP7TYJL7.js}

@@ -36,7 +36,7 @@ import {
   TEST_TIMEOUT,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-SDT4DCNX.js";
+} from "./chunk-HZKC424D.js";
 export {
   AGENTIC_BEHAVIOR_GUIDELINE,
   APP_NAME,

package/dist/{doctor-cli-6XY3PJM5.js → doctor-cli-PCIKXTNV.js}

@@ -2,26 +2,26 @@
 import {
   getConfigDirUsage,
   listRecentCrashes
-} from "./chunk-IAWXC2SO.js";
+} from "./chunk-SB77W6XS.js";
 import {
   ProviderRegistry
-} from "./chunk-JP6ESDV7.js";
+} from "./chunk-2NINHXEZ.js";
 import {
   getStatsSnapshot,
   getTopFailingTools,
   getTopUsedTools,
   resetStats
-} from "./chunk-YUA2KL7W.js";
+} from "./chunk-GOKVKOG3.js";
 import "./chunk-5UR6ZOF4.js";
 import {
   ConfigManager
-} from "./chunk-QT5SGLTM.js";
+} from "./chunk-JCY7RQIA.js";
 import "./chunk-TZQHYZKT.js";
 import {
   DEV_STATE_FILE_NAME,
   MEMORY_FILE_NAME,
   VERSION
-} from "./chunk-SDT4DCNX.js";
+} from "./chunk-HZKC424D.js";
 import "./chunk-IW3Q7AE5.js";
 
 // src/diagnostics/doctor-cli.ts

package/dist/electron-server.js

@@ -36,7 +36,7 @@ import {
   VERSION,
   buildUserIdentityPrompt,
   runTestsTool
-} from "./chunk-WFGCP2GF.js";
+} from "./chunk-Y6U6FMVV.js";
 import {
   hasSemanticIndex,
   semanticSearch
@@ -2563,6 +2563,18 @@ function toUsage(u) {
   if (cached > 0) usage.cacheReadTokens = cached;
   return usage;
 }
+function isLoopbackBaseUrl(baseUrl) {
+  if (!baseUrl) return false;
+  let host;
+  try {
+    host = new URL(baseUrl).hostname;
+  } catch {
+    return false;
+  }
+  host = host.replace(/^\[|\]$/g, "").toLowerCase();
+  if (host === "localhost" || host === "::1" || host === "0.0.0.0") return true;
+  return /^127(?:\.\d{1,3}){3}$/.test(host);
+}
 var OpenAICompatibleProvider = class extends BaseProvider {
   client;
   defaultTimeout = 6e4;
@@ -2578,7 +2590,7 @@ var OpenAICompatibleProvider = class extends BaseProvider {
       baseURL: options?.baseUrl ?? this.defaultBaseUrl,
       timeout: this.defaultTimeout
     };
-    const proxyUrl = options?.proxy;
+    const proxyUrl = isLoopbackBaseUrl(clientOptions.baseURL) ? void 0 : options?.proxy;
     try {
       const { Agent: Agent2, ProxyAgent, fetch: undiciFetch } = await import("undici");
       const STREAM_BODY_TIMEOUT = 30 * 60 * 1e3;
@@ -14292,7 +14304,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-T4NPP36U.js");
+          const { executeTests } = await import("./run-tests-AXPZOPX7.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {

package/dist/{hub-HJTJM2RT.js → hub-N2ZRAXRO.js}

@@ -154,7 +154,7 @@ ${content}`);
   }
 }
 async function runTaskMode(config, providers, configManager, topic) {
-  const { TaskOrchestrator } = await import("./task-orchestrator-BS2FKLGM.js");
+  const { TaskOrchestrator } = await import("./task-orchestrator-FM4EXIBZ.js");
   const orchestrator = new TaskOrchestrator(config, providers, configManager);
   let interrupted = false;
   const onSigint = () => {

package/dist/index.js

@@ -15,7 +15,7 @@ import {
   saveDevState,
   sessionHasMeaningfulContent,
   setupProxy
-} from "./chunk-3UWMMYCQ.js";
+} from "./chunk-Q2MBPMTW.js";
 import {
   ToolExecutor,
   ToolRegistry,
@@ -35,10 +35,10 @@ import {
   spawnAgentContext,
   theme,
   undoStack
-} from "./chunk-HLOHSMTT.js";
+} from "./chunk-2YLYDFEX.js";
 import "./chunk-T2NL5ZIA.js";
 import "./chunk-BXP6YZ2P.js";
-import "./chunk-C46JMUDC.js";
+import "./chunk-75SUTNYY.js";
 import {
   SessionManager,
   getContentText
@@ -55,16 +55,16 @@ import {
   getConfigDirUsage,
   listRecentCrashes,
   writeCrashLog
-} from "./chunk-IAWXC2SO.js";
+} from "./chunk-SB77W6XS.js";
 import {
   ProviderRegistry
-} from "./chunk-JP6ESDV7.js";
+} from "./chunk-2NINHXEZ.js";
 import {
   getStatsSnapshot,
   getTopFailingTools,
   getTopUsedTools,
   installFlushOnExit
-} from "./chunk-YUA2KL7W.js";
+} from "./chunk-GOKVKOG3.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   TEE_FINAL_USER_NUDGE,
@@ -85,7 +85,7 @@ import {
 } from "./chunk-5UR6ZOF4.js";
 import {
   ConfigManager
-} from "./chunk-QT5SGLTM.js";
+} from "./chunk-JCY7RQIA.js";
 import {
   AuthError,
   ProviderError,
@@ -112,7 +112,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-SDT4DCNX.js";
+} from "./chunk-HZKC424D.js";
 import {
   formatGitContextForPrompt,
   getGitContext,
@@ -1827,7 +1827,7 @@ No tools match "${filter}".
           const { join: join5 } = await import("path");
           const { existsSync: existsSync5 } = await import("fs");
           const { getGitRoot: getGitRoot2 } = await import("./git-context-EXOEHQSF.js");
-          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-QUKKMYWZ.js");
+          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-VP7TYJL7.js");
           const { approveProject, hashMcpFile } = await import("./project-trust-NKYHL3VZ.js");
           const cwd = process.cwd();
           const projectRoot = getGitRoot2(cwd) ?? cwd;
@@ -2888,7 +2888,7 @@ ${hint}` : "")
       usage: "/test [command|filter]",
       async execute(args, ctx) {
         try {
-          const { executeTests } = await import("./run-tests-OEPVJDXJ.js");
+          const { executeTests } = await import("./run-tests-RNU733RF.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -7265,7 +7265,7 @@ program.command("web").description("Start Web UI server with browser-based chat
     console.error("Error: Invalid port number. Must be between 1 and 65535.");
     process.exit(1);
   }
-  const { startWebServer } = await import("./server-NBPF74CY.js");
+  const { startWebServer } = await import("./server-SLFGYGBO.js");
   await startWebServer({ port, host: options.host });
 });
 program.command("user [action] [username]").description("Manage Web UI users (list | create <name> | delete <name> | reset-password <name> | logout-all <name> | migrate <name>)").action(async (action, username) => {
@@ -7432,16 +7432,16 @@ program.command("sessions").description("List recent conversation sessions").opt
   console.log(footer + "\n");
 });
 program.command("usage").description("Show token + cost usage grouped by provider/model (cross-session)").option("--days <n>", "Only the last N days (inclusive of today)").option("--month <ym>", "Only a specific month, format YYYY-MM (e.g. 2026-06)").option("--json", "Output as JSON (for scripting)").action(async (options) => {
-  const { runUsageCli } = await import("./usage-DPM6T4ZZ.js");
+  const { runUsageCli } = await import("./usage-QFW2XPF3.js");
   await runUsageCli(options);
 });
 program.command("doctor").description("Health check: API keys, config, MCP, recent crashes, tool usage, disk usage").option("--json", "Output as JSON (for scripting)").option("--reset-stats", "Reset accumulated tool usage statistics").action(async (options) => {
-  const { runDoctorCli } = await import("./doctor-cli-6XY3PJM5.js");
+  const { runDoctorCli } = await import("./doctor-cli-PCIKXTNV.js");
   await runDoctorCli({ json: !!options.json, resetStats: !!options.resetStats });
 });
 program.command("batch <action> [arg] [arg2]").description("Anthropic Message Batches: submit | list | status <id> | results <id> [out] | cancel <id>").option("--dry-run", "Parse and validate input without submitting (submit only)").action(async (action, arg, arg2, options) => {
   try {
-    const batch = await import("./batch-SWBDLVZO.js");
+    const batch = await import("./batch-UF4EWYFD.js");
     switch (action) {
       case "submit":
         if (!arg) {
@@ -7484,7 +7484,7 @@ program.command("batch <action> [arg] [arg2]").description("Anthropic Message Ba
   }
 });
 program.command("mcp-serve").description("Start an MCP server over STDIO, exposing aicli's built-in tools to Claude Desktop / Cursor / other MCP clients").option("--allow-destructive", "Allow bash / run_interactive / task_create (always destructive in MCP mode)").option("--allow-outside-cwd", "Allow tool path arguments to escape the sandbox root \u2014 disabled by default").option("--tools <list>", "Comma-separated whitelist of tools to expose (default: all eligible tools)").option("--cwd <path>", "Working directory AND sandbox root (default: current directory)").action(async (options) => {
-  const { startMcpServer } = await import("./server-TZDUN5V3.js");
+  const { startMcpServer } = await import("./server-YIBPZJ34.js");
   await startMcpServer({
     allowDestructive: !!options.allowDestructive,
     allowOutsideCwd: !!options.allowOutsideCwd,
@@ -7493,7 +7493,7 @@ program.command("mcp-serve").description("Start an MCP server over STDIO, exposi
   });
 });
 program.command("ci").description("Headless PR review (code + security) \u2014 reads git/gh diff, optionally posts to PR. Designed for GitHub Actions.").option("--pr <num>", "PR number; diff fetched via `gh pr diff <num>`", (v) => parseInt(v, 10)).option("--base <ref>", "Base ref for `git diff <ref>...HEAD` (ignored when --pr set)").option("--post", "Post review as a PR comment (requires gh CLI + GH_TOKEN, needs --pr)").option("--no-update", "Always create a new comment instead of updating the previous aicli review").option("--skip-code", "Skip the code review section").option("--skip-security", "Skip the security review section").option("--detailed", "Use the detailed code-review prompt").option("--max-diff <n>", "Max diff chars sent to the model (default 30000)", (v) => parseInt(v, 10)).option("--provider <id>", "Override provider (default: config.defaultProvider)").option("--model <id>", "Override model").option("--dry-run", "Print result to stdout instead of posting (overrides --post)").action(async (options) => {
-  const { runCi } = await import("./ci-O3JM5YAA.js");
+  const { runCi } = await import("./ci-YOJTTP4J.js");
   const result = await runCi({
     pr: options.pr,
     base: options.base,
@@ -7639,7 +7639,7 @@ program.command("hub [topic]").description("Start multi-agent hub (discuss / bra
     }),
     config.get("customProviders")
   );
-  const { startHub } = await import("./hub-HJTJM2RT.js");
+  const { startHub } = await import("./hub-N2ZRAXRO.js");
   await startHub(
     {
       topic: topic ?? "",

package/dist/{run-tests-T4NPP36U.js → run-tests-AXPZOPX7.js}

@@ -1,7 +1,7 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-WFGCP2GF.js";
+} from "./chunk-Y6U6FMVV.js";
 export {
   executeTests,
   runTestsTool

package/dist/{run-tests-OEPVJDXJ.js → run-tests-RNU733RF.js}

@@ -2,8 +2,8 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-C46JMUDC.js";
-import "./chunk-SDT4DCNX.js";
+} from "./chunk-75SUTNYY.js";
+import "./chunk-HZKC424D.js";
 export {
   executeTests,
   runTestsTool

package/dist/{server-NBPF74CY.js → server-SLFGYGBO.js}

@@ -19,7 +19,7 @@ import {
   loadDevState,
   persistToolRound,
   setupProxy
-} from "./chunk-3UWMMYCQ.js";
+} from "./chunk-Q2MBPMTW.js";
 import {
   ToolExecutor,
   ToolRegistry,
@@ -38,10 +38,10 @@ import {
   spawnAgentContext,
   truncateOutput,
   undoStack
-} from "./chunk-HLOHSMTT.js";
+} from "./chunk-2YLYDFEX.js";
 import "./chunk-T2NL5ZIA.js";
 import "./chunk-BXP6YZ2P.js";
-import "./chunk-C46JMUDC.js";
+import "./chunk-75SUTNYY.js";
 import {
   SessionManager,
   getContentText
@@ -52,10 +52,10 @@ import {
 } from "./chunk-E44DTERW.js";
 import {
   ProviderRegistry
-} from "./chunk-JP6ESDV7.js";
+} from "./chunk-2NINHXEZ.js";
 import {
   runTool
-} from "./chunk-YUA2KL7W.js";
+} from "./chunk-GOKVKOG3.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   TEE_FINAL_USER_NUDGE,
@@ -73,7 +73,7 @@ import {
 } from "./chunk-5UR6ZOF4.js";
 import {
   ConfigManager
-} from "./chunk-QT5SGLTM.js";
+} from "./chunk-JCY7RQIA.js";
 import "./chunk-TZQHYZKT.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
@@ -93,7 +93,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-SDT4DCNX.js";
+} from "./chunk-HZKC424D.js";
 import {
   formatGitContextForPrompt,
   getGitContext,
@@ -2454,7 +2454,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-OEPVJDXJ.js");
+          const { executeTests } = await import("./run-tests-RNU733RF.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {

package/dist/{server-TZDUN5V3.js → server-YIBPZJ34.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   ToolRegistry
-} from "./chunk-HLOHSMTT.js";
+} from "./chunk-2YLYDFEX.js";
 import "./chunk-T2NL5ZIA.js";
 import "./chunk-BXP6YZ2P.js";
-import "./chunk-C46JMUDC.js";
+import "./chunk-75SUTNYY.js";
 import {
   runTool
-} from "./chunk-YUA2KL7W.js";
+} from "./chunk-GOKVKOG3.js";
 import {
   getDangerLevel,
   schemaToJsonSchema
@@ -15,7 +15,7 @@ import {
 import "./chunk-TZQHYZKT.js";
 import {
   VERSION
-} from "./chunk-SDT4DCNX.js";
+} from "./chunk-HZKC424D.js";
 import "./chunk-4BKXL7SM.js";
 import "./chunk-TB4W4Y4T.js";
 import "./chunk-KHYD3WXE.js";
@@ -26,7 +26,7 @@ import "./chunk-IW3Q7AE5.js";
 
 // src/mcp/server.ts
 import { createInterface } from "readline";
-import { resolve } from "path";
+import { resolve, dirname, basename } from "path";
 import { realpathSync } from "fs";
 var STDIN_TOOLS = /* @__PURE__ */ new Set(["ask_user", "spawn_agent"]);
 function looksLikePath(s) {
@@ -62,6 +62,21 @@ var TOOL_PATH_ARGS = {
   bash: ["cwd"],
   run_interactive: ["cwd"]
 };
+function realpathExistingPrefix(abs) {
+  let current = abs;
+  const tail = [];
+  for (; ; ) {
+    try {
+      const real = realpathSync(current);
+      return tail.length ? resolve(real, ...tail) : real;
+    } catch {
+      const parent = dirname(current);
+      if (parent === current) return abs;
+      tail.unshift(basename(current));
+      current = parent;
+    }
+  }
+}
 var McpServer = class {
   registry;
   opts;
@@ -243,10 +258,12 @@ var McpServer = class {
    * Validate that every known path-bearing argument of `toolName` resolves
    * inside the sandbox root. Returns an error message on violation, else undef.
    *
-   * We do NOT realpath() per-call: write_file targets may not exist yet, and
-   * realpath on every call is a syscall per arg. The root itself is realpath'd
-   * once at construction, which stops the "sandbox root is a symlink pointing
-   * elsewhere" class of attack. Symlinks inside the tree are allowed.
+   * Each candidate is canonicalized via {@link realpathExistingPrefix} before the
+   * containment check so symlinks in the existing prefix (notably the sandbox root
+   * itself — `/var`→`/private/var` on macOS) match the realpath'd root. write_file
+   * targets that don't exist yet are handled by realpath-ing only the existing
+   * ancestor. The root is also realpath'd once at construction, stopping the
+   * "sandbox root is a symlink pointing elsewhere" class of attack.
    */
   validatePathArgs(toolName, args) {
     if (this.opts.allowOutsideCwd) return void 0;
@@ -258,7 +275,7 @@ var McpServer = class {
         const list = Array.isArray(value) ? value : [value];
         for (const entry of list) {
           if (typeof entry !== "string" || entry.length === 0) continue;
-          const abs = resolve(this.sandboxRoot, entry);
+          const abs = realpathExistingPrefix(resolve(this.sandboxRoot, entry));
           if (!this.isInsideSandbox(abs)) {
             return `Path '${entry}' escapes sandbox root '${this.sandboxRoot}'. Pass --allow-outside-cwd to permit.`;
           }
@@ -270,7 +287,7 @@ var McpServer = class {
       if (knownKeys.has(k)) continue;
       if (typeof v !== "string" || v.length === 0) continue;
       if (!looksLikePath(v)) continue;
-      const abs = resolve(this.sandboxRoot, v);
+      const abs = realpathExistingPrefix(resolve(this.sandboxRoot, v));
       if (!this.isInsideSandbox(abs)) {
         return `Path-like argument '${k}=${v}' escapes sandbox root '${this.sandboxRoot}'. Pass --allow-outside-cwd to permit.`;
       }