chore: sync core lib and CLAUDE.md from agent-core

[avifenesh]

Automated sync of lib/ and CLAUDE.md from agent-core.

---

Note

Medium Risk
Adds symlink refusal checks around auto-fix backup/write and backup-restore operations, which changes filesystem behavior and could cause fixes/restores to error on repos that previously used symlinks. Risk is limited to the fixer tooling but touches write paths and backup handling.

Overview
Hardens the auto-fix workflow in lib/enhance/fixer.js by introducing assertNotSymlink and using it to refuse reading from or writing to symlinked paths.

applyFixes now checks the target file before reading, checks the .backup path before creating backups, and re-checks the target immediately before writing to narrow TOCTOU symlink-swap attacks; restoreFromBackup similarly refuses symlinks for both backup and restore targets. The helper is also exported for reuse.

^{Reviewed by Cursor Bugbot for commit 32858df. Configure here.}

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 32858df. Configure here.}

[cursor]

Missing TOCTOU re-check before backup file write

Low Severity

The backupPath write at fs.writeFileSync(backupPath, content, 'utf8') only gets a single assertNotSymlink check before it, with no immediate re-check before the write. In contrast, the main filePath write has an explicit re-check pattern to narrow the TOCTOU window. In the hostile-repo threat model, content (original file content) is attacker-controlled, so a race swapping backupPath for a symlink between check and write poses the same risk the re-check mitigates for filePath.

Additional Locations (1)

• lib/enhance/fixer.js#L197-L203

 

^{Reviewed by Cursor Bugbot for commit 32858df. Configure here.}