Why

Local folder mounts must not allow symlink paths inside a mount to escape the configured root. The mount-only runtime now owns filesystem access directly, so this check is security-critical.

What changed

• Added realpath containment checks before list/read/write/remove operations.
• Validates missing write targets against their nearest existing ancestor so writes through symlinked parent directories are rejected.
• Skips listed entries whose real path resolves outside the mount root.
• Added symlink escape tests for direct provider access and text-index access.

How

The storage provider now resolves the mount root and candidate paths through fs.realpath(). Existing targets must resolve under the mount root; missing write targets must have an existing ancestor that resolves under the mount root.

Changed files

• src/context/storage-provider.ts - realpath containment checks for local folder operations.
• tests/storage-provider.test.ts - direct symlink escape coverage.
• tests/text-index.test.ts - index/read/write symlink escape coverage.

Verification

npm run verify
verify passed