@@ -153,3 +153,151 @@ it('refuses oversized import files before any workspace mutation or bulk allocat
     )
   ).toMatchObject({ ok: false, error: expect.stringContaining('64 MB') })
 })
+
+it.each(['file', 'directory'] as const)(
+  'rejects %s symlinks outside the import source during manifest and chunk reads',
+  async (kind) => {
+    const source = join(root, 'selected')
+    const outside = join(root, 'selected-other')
+    await mkdir(source)
+    await mkdir(outside)
+    await writeFile(join(outside, 'private.txt'), 'outside content')
+    const target = kind === 'file' ? join(outside, 'private.txt') : outside
+    await symlink(target, join(source, 'link'))
+    const authorization = {
+      toolName: 'import_local_files',
+      args: { path: source, targetWorkspaceId: 'target' },
+    }
+    expect(await executeLocalFileRequest({ operation: 'manifest' }, authorization)).toMatchObject({
+      ok: false,
+      error: expect.stringContaining('outside this import source'),
+    })
+    const outsideManifest = await executeLocalFileRequest(
+      { operation: 'manifest' },
+      { toolName: 'import_local_files', args: { path: target, targetWorkspaceId: 'target' } }
+    )
+    if (!outsideManifest.ok || outsideManifest.data.kind !== 'manifest')
+      throw new Error('Expected manifest')
+    const entry = outsideManifest.data.entries.find((item) => item.kind === 'file')!
+    expect(
+      await executeLocalFileRequest(
+        {
+          operation: 'chunk',
+          relativePath: kind === 'file' ? 'link' : 'link/private.txt',
+          revision: entry.revision,
+          offset: 0,
+        },
+        authorization
+      )
+    ).toMatchObject({ ok: false, error: expect.stringContaining('outside this import source') })
+  }
+)
+
+it('supports internal symlinks and an explicitly selected symlink root, but rejects a retargeted child', async () => {
+  const source = join(root, 'selected')
+  await mkdir(source)
+  await writeFile(join(source, 'notes.txt'), 'inside')
+  await symlink(join(source, 'notes.txt'), join(source, 'alias.txt'))
+  const selectedAlias = join(root, 'selected-alias')
+  await symlink(source, selectedAlias)
+  const authorization = {
+    toolName: 'import_local_files',
+    args: { path: selectedAlias, targetWorkspaceId: 'target' },
+  }
+  const manifest = await executeLocalFileRequest({ operation: 'manifest' }, authorization)
+  if (!manifest.ok || manifest.data.kind !== 'manifest') throw new Error('Expected manifest')
+  const entry = manifest.data.entries.find((item) => item.relativePath === 'alias.txt')!
+  const request = {
+    operation: 'chunk',
+    relativePath: 'alias.txt',
+    revision: entry.revision,
+    offset: 0,
+  }
+  expect(await executeLocalFileRequest(request, authorization)).toEqual({
+    ok: true,
+    data: { kind: 'chunk', bytes: new Uint8Array(Buffer.from('inside')), eof: true },
+  })
+  await writeFile(join(root, 'outside.txt'), 'outside')
+  await rm(join(source, 'alias.txt'))
+  await symlink(join(root, 'outside.txt'), join(source, 'alias.txt'))
+  expect(await executeLocalFileRequest(request, authorization)).toMatchObject({
+    ok: false,
+    error: expect.stringContaining('outside this import source'),
+  })
+})
+
+it.each(['é', '界', '😀', '\uFEFF'])(
+  'preserves %s across the default text-page boundary',
+  async (character) => {
+    const path = join(root, 'unicode.txt')
+    const prefix = 'a'.repeat(63_999)
+    const content = `${prefix}${character}end`
+    await writeFile(path, content)
+    const first = await executeLocalFileRequest(
+      { operation: 'read' },
+      {
+        toolName: 'read_local_file',
+        args: { path },
+      }
+    )
+    expect(first).toMatchObject({
+      ok: true,
+      data: {
+        representation: 'text',
+        text: prefix,
+        offset: 0,
+        nextOffset: 63_999,
+        truncated: true,
+      },
+    })
+    if (!first.ok || first.data.kind !== 'read') throw new Error('Expected text')
+    const second = await executeLocalFileRequest(
+      { operation: 'read' },
+      {
+        toolName: 'read_local_file',
+        args: { path, offset: first.data.nextOffset },
+      }
+    )
+    expect(second).toMatchObject({
+      ok: true,
+      data: {
+        representation: 'text',
+        text: `${character}end`,
+        nextOffset: Buffer.byteLength(content),
+        truncated: false,
+      },
+    })
+  }
+)
+
+it('preserves a UTF-8 BOM and rejects split offsets and limits that cannot fit a character', async () => {
+  const path = join(root, 'unicode.txt')
+  await writeFile(path, '\uFEFF😀end')
+  expect(
+    await executeLocalFileRequest(
+      { operation: 'read' },
+      {
+        toolName: 'read_local_file',
+        args: { path, limit: 4 },
+      }
+    )
+  ).toMatchObject({ ok: true, data: { text: '\uFEFF', nextOffset: 3, truncated: true } })
+  expect(
+    await executeLocalFileRequest(
+      { operation: 'read' },
+      {
+        toolName: 'read_local_file',
+        args: { path, offset: 4 },
+      }
+    )
+  ).toMatchObject({ ok: false, error: expect.stringContaining('UTF-8') })
+  expect(
+    await executeLocalFileRequest(
+      { operation: 'read' },
+      {
+        toolName: 'read_local_file',
+        args: { path, offset: 3, limit: 1 },
+      }
+    )
+  ).toMatchObject({ ok: false, error: expect.stringContaining('limit') })
+})
@@ -42,6 +42,12 @@ function boundedInteger(value: unknown, fallback: number, max: number): number {
   return value
 }
 
+function assertImportPath(root: string, candidate: string): void {
+  const rel = relative(root, candidate)
+  if (isAbsolute(rel) || rel === '..' || rel.startsWith(`..${sep}`))
+    throw new Error('The file is outside this import source.')
+}
+
 async function inspect(path: string, args: Record<string, unknown>): Promise<DesktopLocalFileRead> {
   const info = await stat(path)
   if (info.isDirectory()) {
@@ -135,14 +141,26 @@ async function inspect(path: string, args: Record<string, unknown>): Promise<Des
         representation: 'binary',
         note: 'Binary content cannot be decoded as text. Import this file into Workspace Files for document extraction.',
       }
+    /** Retain partial characters for the next page; preserving BOM keeps byte offsets exact. */
+    let text: string
+    try {
+      text = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes, {
+        stream: offset + bytesRead < info.size,
+      })
+    } catch {
+      throw new Error('Text reads require valid UTF-8 and an offset at a character boundary.')
+    }
+    const textBytes = Buffer.byteLength(text)
+    if (bytesRead > 0 && textBytes === 0)
+      throw new Error('The read limit must fit at least one complete UTF-8 character.')
     return {
       kind: 'read',
       path,
       representation: 'text',
-      text: bytes.toString('utf8'),
+      text,
       offset,
-      nextOffset: offset + bytesRead,
-      truncated: offset + bytesRead < info.size,
+      nextOffset: offset + textBytes,
+      truncated: offset + textBytes < info.size,
     }
   } finally {
     await file.close()
@@ -154,13 +172,15 @@ async function manifest(
   args: Record<string, unknown>
 ): Promise<DesktopLocalFileManifest> {
   if (typeof args.targetWorkspaceId !== 'string') throw new Error('A target workspace is required.')
+  const root = await realpath(path)
   const entries: DesktopLocalFileEntry[] = []
   async function walk(current: string, ancestors: ReadonlySet<string>): Promise<void> {
     if (entries.length >= MAX_ENTRIES)
       throw new Error(
         'The directory exceeds 1,000 entries. Import smaller subdirectories separately.'
       )
     const canonical = await realpath(current)
+    assertImportPath(root, canonical)
     const info = await stat(canonical)
     if (!info.isDirectory() && !info.isFile())
       throw new Error(`Cannot import special filesystem entry: ${current}`)
@@ -211,11 +231,12 @@ export async function executeLocalFileRequest(
     )
       throw new Error('Invalid file chunk request.')
     const child = resolve(path, request.relativePath)
-    const rel = relative(path, child)
-    if (isAbsolute(rel) || rel === '..' || rel.startsWith(`..${sep}`))
-      throw new Error('The file is outside this import source.')
+    assertImportPath(path, child)
+    const root = await realpath(path)
+    const canonical = await realpath(child)
+    assertImportPath(root, canonical)
     const offset = boundedInteger(request.offset, 0, Number.MAX_SAFE_INTEGER)
-    const file = await open(child, 'r')
+    const file = await open(canonical, 'r')
     try {
       const info = await file.stat()
       if (!info.isFile() || revision(info) !== request.revision)