refactor: integrate secure file system operations across services

This commit replaces direct file system operations with a secure file system adapter to enhance security by enforcing path validation. The changes include:

- Replaced `fs` imports with `secureFs` in various services and utilities.
- Updated file operations in `agent-service`, `auto-mode-service`, `feature-loader`, and `settings-service` to use the secure file system methods.
- Ensured that all file I/O operations are validated against the ALLOWED_ROOT_DIRECTORY.

This refactor aims to prevent unauthorized file access and improve overall security posture.

Tests: All unit tests passing.

🤖 Generated with Claude Code

apps/server/src/services/agent-service.ts

@@ -5,7 +5,7 @@
 
 import { AbortError } from "@anthropic-ai/claude-agent-sdk";
 import path from "path";
-import fs from "fs/promises";
+import * as secureFs from "../lib/secure-fs.js";
 import type { EventEmitter } from "../lib/events.js";
 import { ProviderFactory } from "../providers/provider-factory.js";
 import type { ExecuteOptions } from "../providers/types.js";
@@ -63,7 +63,7 @@ export class AgentService {
   }
 
   async initialize(): Promise<void> {
-    await fs.mkdir(this.stateDir, { recursive: true });
+    await secureFs.mkdir(this.stateDir, { recursive: true });
   }
 
   /**
@@ -401,7 +401,7 @@ export class AgentService {
     const sessionFile = path.join(this.stateDir, `${sessionId}.json`);
 
     try {
-      const data = await fs.readFile(sessionFile, "utf-8");
+      const data = await secureFs.readFile(sessionFile, "utf-8") as string;
       return JSON.parse(data);
     } catch {
       return [];
@@ -412,7 +412,7 @@ export class AgentService {
     const sessionFile = path.join(this.stateDir, `${sessionId}.json`);
 
     try {
-      await fs.writeFile(
+      await secureFs.writeFile(
         sessionFile,
         JSON.stringify(messages, null, 2),
         "utf-8"
@@ -425,7 +425,7 @@ export class AgentService {
 
   async loadMetadata(): Promise<Record<string, SessionMetadata>> {
     try {
-      const data = await fs.readFile(this.metadataFile, "utf-8");
+      const data = await secureFs.readFile(this.metadataFile, "utf-8") as string;
       return JSON.parse(data);
     } catch {
       return {};
@@ -433,7 +433,7 @@ export class AgentService {
   }
 
   async saveMetadata(metadata: Record<string, SessionMetadata>): Promise<void> {
-    await fs.writeFile(
+    await secureFs.writeFile(
       this.metadataFile,
       JSON.stringify(metadata, null, 2),
       "utf-8"
@@ -551,7 +551,7 @@ export class AgentService {
     // Delete session file
     try {
       const sessionFile = path.join(this.stateDir, `${sessionId}.json`);
-      await fs.unlink(sessionFile);
+      await secureFs.unlink(sessionFile);
     } catch {
       // File may not exist
     }