IronClaw's path guard treated a dangling final symbolic link as a missing path inside the sandbox. The repair explicitly rejects that link before allowing a file operation.

@@ -100,6 +114,13 @@+            // Walk up to the nearest existing ancestor directory, canonicalize it,+            // then re-append the remaining tail. This handles the case where a+            // symlink sits above the new file.+            let mut ancestor = resolved.as_path();+            let mut tail_parts: Vec<&std::ffi::OsStr> = Vec::new();+            loop {+                if ancestor.exists() {+                    let canonical_ancestor = ancestor                         .canonicalize()-                        .unwrap_or_else(|_| parent.to_path_buf());

-                    if let Some(filename) = resolved.file_name() {-                        canonical_parent.join(filename)-                    } else {-                        resolved.clone()+                        .unwrap_or_else(|_| ancestor.to_path_buf());+                    let mut result = canonical_ancestor;+                    for part in tail_parts.into_iter().rev() {+                        result = result.join(part);

@@ -95,9 +95,17 @@         // For existing paths, canonicalize to resolve symlinks.         // For non-existent paths, the lexical normalization above already removed         // all `..` components, so starts_with is reliable.         let check_path = if resolved.exists() {             resolved.canonicalize().unwrap_or_else(|_| resolved.clone())+        } else if std::fs::symlink_metadata(&resolved)+            .map(|m| m.file_type().is_symlink())+            .unwrap_or(false)+        {

+            return Err(ToolError::NotAuthorized(format!(+                "Path is a dangling symlink: {}",+                path_str+            )));         } else {             // Walk up to the nearest existing ancestor directory, canonicalize it,             // then re-append the remaining tail. This handles the case where a             // symlink sits above the new file.