use shutil to avoid cross-device move problems