@cairnkeep/cli 2.15.4 → 2.17.0

package/mcp-memory-server/dist/memory-proposal-cli.js

@@ -0,0 +1,110 @@
+#!/usr/bin/env node
+import { applyMemoryProposal, createMemoryProposal, doctorMemoryProposals, listMemoryProposals, showMemoryProposal, } from "./memory-proposal-store.js";
+const categories = new Set(["decision", "preference", "pattern", "pitfall", "constraint", "bug", "convention"]);
+function usage() {
+    return `cairn proposals — review-gated session memory proposals
+
+Usage:
+  cairn proposals create --session ID --scope SCOPE [--model MODEL] [--category CATEGORY] [--project PATH] [--json]
+  cairn proposals list [--project PATH] [--json]
+  cairn proposals show DIGEST [--project PATH] [--json]
+  cairn proposals apply DIGEST [--project PATH] [--json]
+  cairn proposals doctor [--project PATH] [--json]
+
+Creation is explicit and reads an already stored local trajectory. Applying requires
+the proposal's complete 64-character digest and fails atomically if its source or
+any target memory changed after proposal creation.
+`;
+}
+function valueAfter(args, flag) {
+    const index = args.indexOf(flag);
+    if (index < 0)
+        return undefined;
+    const value = args[index + 1];
+    if (!value || value.startsWith("--"))
+        throw new Error(`${flag} requires a value.`);
+    return value;
+}
+function positionals(args) {
+    const valued = new Set(["--project", "--session", "--scope", "--model", "--category"]);
+    const output = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (valued.has(arg)) {
+            index += 1;
+            continue;
+        }
+        if (arg === "--json")
+            continue;
+        if (arg.startsWith("--"))
+            throw new Error(`unknown option "${arg}".`);
+        output.push(arg);
+    }
+    return output;
+}
+function print(value, json) {
+    if (json)
+        process.stdout.write(`${JSON.stringify(value)}\n`);
+    else
+        process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+async function main() {
+    const [command = "help", ...args] = process.argv.slice(2);
+    const projectRoot = valueAfter(args, "--project") ?? process.cwd();
+    const json = args.includes("--json");
+    try {
+        if (["help", "--help", "-h"].includes(command)) {
+            process.stdout.write(usage());
+            return;
+        }
+        if (command === "create") {
+            const sessionId = valueAfter(args, "--session");
+            const scope = valueAfter(args, "--scope");
+            if (!sessionId || !scope)
+                throw new Error("create requires --session ID and --scope SCOPE.");
+            const rawCategory = valueAfter(args, "--category");
+            if (rawCategory && !categories.has(rawCategory))
+                throw new Error(`unsupported category "${rawCategory}".`);
+            if (positionals(args).length !== 0)
+                throw new Error("create accepts no positional arguments.");
+            print(await createMemoryProposal({ projectRoot, sessionId, scope, model: valueAfter(args, "--model"), category: rawCategory }), json);
+            return;
+        }
+        if (command === "list") {
+            if (positionals(args).length !== 0)
+                throw new Error("list accepts no positional arguments.");
+            const proposals = listMemoryProposals(projectRoot);
+            print({ count: proposals.length, proposals: proposals.map(({ digest, created_at, scope, source, extraction, candidates }) => ({ digest, created_at, scope, source, extraction, candidate_count: candidates.length })) }, json);
+            return;
+        }
+        if (command === "show") {
+            const values = positionals(args);
+            if (values.length !== 1)
+                throw new Error("show requires one full proposal digest.");
+            print(showMemoryProposal(values[0], projectRoot), json);
+            return;
+        }
+        if (command === "apply") {
+            const values = positionals(args);
+            if (values.length !== 1)
+                throw new Error("apply requires one full proposal digest.");
+            print(await applyMemoryProposal(values[0], projectRoot), json);
+            return;
+        }
+        if (command === "doctor") {
+            if (positionals(args).length !== 0)
+                throw new Error("doctor accepts no positional arguments.");
+            const result = doctorMemoryProposals(projectRoot);
+            print(result, json);
+            if (!result.ok)
+                process.exitCode = 2;
+            return;
+        }
+        throw new Error(`unknown proposals command "${command}".`);
+    }
+    catch (error) {
+        process.stderr.write(`cairn proposals: ${error instanceof Error ? error.message : "unknown error"}\n`);
+        process.exitCode = 2;
+    }
+}
+await main();

package/mcp-memory-server/dist/memory-proposal-schema.js

@@ -0,0 +1,78 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+export const MEMORY_PROPOSAL_SCHEMA_VERSION = 1;
+export const MEMORY_PROPOSAL_MAX_BYTES = 1024 * 1024;
+export const MEMORY_PROPOSAL_MAX_CANDIDATES = 128;
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/);
+const candidateSchema = z.object({
+    key: z.string().min(1).max(512),
+    value: z.string().max(64 * 1024),
+    category: z.string().max(64).optional(),
+    importance: z.number().min(0).max(1).optional(),
+    operation: z.enum(["create", "update", "noop"]),
+    base_hash: digestSchema.nullable(),
+    value_hash: digestSchema,
+}).strict();
+export const memoryProposalBodySchema = z.object({
+    schema_version: z.literal(MEMORY_PROPOSAL_SCHEMA_VERSION),
+    created_at: z.iso.datetime(),
+    project_root: z.string().min(1),
+    scope: z.string().regex(/^(?:project|[a-z0-9][a-z0-9-]*)$/),
+    source: z.object({
+        kind: z.literal("trajectory"),
+        session_id: z.string().min(1).max(256),
+        digest: digestSchema,
+    }).strict(),
+    extraction: z.object({ model: z.string().min(1).max(256) }).strict(),
+    candidates: z.array(candidateSchema).min(1).max(MEMORY_PROPOSAL_MAX_CANDIDATES),
+}).strict();
+export const memoryProposalSchema = memoryProposalBodySchema.extend({ digest: digestSchema }).strict();
+export function expectedMemoryProposalOperation(baseHash, valueHash) {
+    if (baseHash === null)
+        return "create";
+    return baseHash === valueHash ? "noop" : "update";
+}
+export function assertMemoryProposalCandidateConsistency(candidate) {
+    const actualValueHash = digestText(candidate.value);
+    if (candidate.value_hash !== actualValueHash) {
+        throw new Error(`Memory proposal candidate "${candidate.key}" value hash mismatch.`);
+    }
+    const expectedOperation = expectedMemoryProposalOperation(candidate.base_hash, actualValueHash);
+    if (candidate.operation !== expectedOperation) {
+        throw new Error(`Memory proposal candidate "${candidate.key}" operation is inconsistent: expected ${expectedOperation}.`);
+    }
+}
+function assertCandidateConsistency(candidates) {
+    for (const candidate of candidates)
+        assertMemoryProposalCandidateConsistency(candidate);
+}
+export function canonicalJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    return `{${Object.entries(value)
+        .filter(([, item]) => item !== undefined)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`)
+        .join(",")}}`;
+}
+export function digestValue(value) {
+    return createHash("sha256").update(canonicalJson(value)).digest("hex");
+}
+export function digestText(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+export function sealProposal(body) {
+    const parsed = memoryProposalBodySchema.parse(body);
+    assertCandidateConsistency(parsed.candidates);
+    return memoryProposalSchema.parse({ ...parsed, digest: digestValue(parsed) });
+}
+export function verifyProposal(value) {
+    const parsed = memoryProposalSchema.parse(value);
+    const { digest, ...body } = parsed;
+    if (digestValue(body) !== digest)
+        throw new Error("Memory proposal digest mismatch.");
+    assertCandidateConsistency(parsed.candidates);
+    return parsed;
+}

package/mcp-memory-server/dist/memory-proposal-store.js

@@ -0,0 +1,273 @@
+import { constants, closeSync, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { randomUUID } from "node:crypto";
+import { extractMemoryCandidates } from "./memory-extraction.js";
+import { MEMORY_PROPOSAL_MAX_BYTES, MEMORY_PROPOSAL_MAX_CANDIDATES, digestText, digestValue, expectedMemoryProposalOperation, memoryProposalBodySchema, sealProposal, verifyProposal, } from "./memory-proposal-schema.js";
+import { applyProposalCandidates, readMemoryBaseHashes, resolveMemoryScopePath } from "./reviewed-memory-store.js";
+import { redactLocalValue } from "./trajectory-redaction.js";
+import { showTrajectory } from "./trajectory-store.js";
+import { isTypedMemoryNodesEnabled } from "./node-schema.js";
+import { atomicReplace, hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
+const PROPOSAL_FILE_PATTERN = /^[a-f0-9]{64}\.json$/;
+const PROPOSAL_DIGEST_PATTERN = /^[a-f0-9]{64}$/;
+const MAX_PROPOSAL_FILES = 1024;
+const MAX_PROPOSAL_STORE_BYTES = 64 * 1024 * 1024;
+const MAX_EXTRACTION_INPUT_BYTES = 1024 * 1024;
+function canonicalProjectRoot(projectRoot) {
+    const resolved = resolve(projectRoot);
+    if (!existsSync(resolved) || !statSync(resolved).isDirectory())
+        throw new Error(`Project directory does not exist: ${resolved}`);
+    const root = realpathSync(resolved);
+    const info = lstatSync(root);
+    if (info.isSymbolicLink() || !info.isDirectory())
+        throw new Error(`Project directory is unsafe: ${root}`);
+    return root;
+}
+function lstatIfPresent(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function assertDirectory(path, label, requirePrivate) {
+    const info = lstatIfPresent(path);
+    if (!info)
+        return;
+    if (info.isSymbolicLink() || !info.isDirectory())
+        throw new Error(`${label} is not a regular directory.`);
+    if (requirePrivate && !privatePathIsSafe(path))
+        throw new Error(`${label} is not private.`);
+}
+export function memoryProposalDirectory(projectRoot = process.cwd()) {
+    const root = canonicalProjectRoot(projectRoot);
+    const runtimeDirectory = join(root, ".agentfs");
+    assertDirectory(runtimeDirectory, "Project .agentfs path", false);
+    const directory = join(runtimeDirectory, "memory-proposals");
+    assertDirectory(directory, "Memory proposal store", true);
+    return directory;
+}
+function ensureDirectory(projectRoot) {
+    const root = canonicalProjectRoot(projectRoot);
+    const runtimeDirectory = join(root, ".agentfs");
+    const runtimeInfo = lstatIfPresent(runtimeDirectory);
+    if (!runtimeInfo) {
+        mkdirSync(runtimeDirectory, { mode: 0o700 });
+        hardenPrivatePath(runtimeDirectory);
+    }
+    else if (runtimeInfo.isSymbolicLink() || !runtimeInfo.isDirectory()) {
+        throw new Error("Project .agentfs path is not a regular directory.");
+    }
+    assertDirectory(runtimeDirectory, "Project .agentfs path", false);
+    const directory = join(runtimeDirectory, "memory-proposals");
+    const storeInfo = lstatIfPresent(directory);
+    if (!storeInfo) {
+        mkdirSync(directory, { mode: 0o700 });
+        hardenPrivatePath(directory);
+    }
+    else if (storeInfo.isSymbolicLink() || !storeInfo.isDirectory()) {
+        throw new Error("Memory proposal store is not a regular directory.");
+    }
+    assertDirectory(directory, "Memory proposal store", true);
+    return directory;
+}
+function strictFiles(directory) {
+    const directoryInfo = lstatIfPresent(directory);
+    if (!directoryInfo)
+        return [];
+    if (directoryInfo.isSymbolicLink() || !directoryInfo.isDirectory())
+        throw new Error("Memory proposal store is not a regular directory.");
+    const names = readdirSync(directory).sort();
+    if (names.length > MAX_PROPOSAL_FILES)
+        throw new Error("Memory proposal store exceeds its file-count limit.");
+    let total = 0;
+    for (const name of names) {
+        if (!PROPOSAL_FILE_PATTERN.test(name))
+            throw new Error(`Unexpected file in memory proposal store: ${name}`);
+        const path = join(directory, name);
+        const stat = lstatSync(path);
+        if (stat.isSymbolicLink() || !stat.isFile())
+            throw new Error(`Memory proposal is not a regular file: ${name}`);
+        if (stat.size > MEMORY_PROPOSAL_MAX_BYTES)
+            throw new Error(`Memory proposal exceeds its size limit: ${name}`);
+        total += stat.size;
+        if (total > MAX_PROPOSAL_STORE_BYTES)
+            throw new Error("Memory proposal store exceeds its byte limit.");
+    }
+    return names;
+}
+function parseFile(path) {
+    const info = lstatIfPresent(path);
+    if (!info)
+        throw new Error("Memory proposal not found.");
+    if (info.isSymbolicLink() || !info.isFile())
+        throw new Error("Memory proposal is not a regular file.");
+    if (info.size > MEMORY_PROPOSAL_MAX_BYTES)
+        throw new Error("Memory proposal exceeds its size limit.");
+    if (!privatePathIsSafe(path))
+        throw new Error("Memory proposal is not private.");
+    const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    let bytes;
+    try {
+        const opened = fstatSync(fd);
+        if (!opened.isFile() || opened.size > MEMORY_PROPOSAL_MAX_BYTES
+            || opened.dev !== info.dev || opened.ino !== info.ino) {
+            throw new Error("Memory proposal changed during validation.");
+        }
+        bytes = readFileSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new Error("Memory proposal is not valid UTF-8 JSON.");
+    }
+    const proposal = verifyProposal(value);
+    if (`${proposal.digest}.json` !== basename(path))
+        throw new Error("Memory proposal filename does not match its digest.");
+    return proposal;
+}
+async function writeImmutable(projectRoot, proposal) {
+    const bytes = Buffer.from(`${JSON.stringify(proposal, null, 2)}\n`, "utf8");
+    if (bytes.byteLength > MEMORY_PROPOSAL_MAX_BYTES)
+        throw new Error("Memory proposal exceeds its size limit.");
+    const directory = ensureDirectory(projectRoot);
+    const finalPath = join(directory, `${proposal.digest}.json`);
+    if (lstatIfPresent(finalPath)) {
+        const existing = parseFile(finalPath);
+        if (existing.digest !== proposal.digest)
+            throw new Error("Conflicting immutable memory proposal.");
+        return;
+    }
+    const existing = strictFiles(directory);
+    const existingBytes = existing.reduce((total, name) => total + statSync(join(directory, name)).size, 0);
+    if (existing.length >= MAX_PROPOSAL_FILES || existingBytes + bytes.byteLength > MAX_PROPOSAL_STORE_BYTES) {
+        throw new Error("Memory proposal store limit reached.");
+    }
+    const temporary = join(dirname(finalPath), `.${proposal.digest}.${randomUUID()}.tmp`);
+    let fd;
+    try {
+        fd = openSync(temporary, "wx", 0o600);
+        writeFileSync(fd, bytes);
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        hardenPrivatePath(temporary);
+        await atomicReplace(temporary, finalPath);
+        hardenPrivatePath(finalPath);
+        parseFile(finalPath);
+    }
+    catch (error) {
+        if (fd !== undefined)
+            closeSync(fd);
+        rmSync(temporary, { force: true });
+        throw error;
+    }
+}
+export async function createMemoryProposal(options) {
+    if (options.scope === "all")
+        throw new Error('Proposal scope must be concrete; "all" is not allowed.');
+    const projectRoot = canonicalProjectRoot(options.projectRoot ?? process.cwd());
+    resolveMemoryScopePath(options.scope, { cwd: projectRoot, ...options.reviewedOptions });
+    const trajectory = await showTrajectory(options.sessionId, projectRoot);
+    const sourceDigest = digestValue(trajectory);
+    const redacted = redactLocalValue(trajectory, projectRoot).value;
+    const outbound = JSON.stringify(redacted);
+    if (Buffer.byteLength(outbound, "utf8") > MAX_EXTRACTION_INPUT_BYTES)
+        throw new Error("Redacted trajectory exceeds the extraction input limit.");
+    // Persistence intentionally happens only after the outbound request succeeds.
+    const extraction = await extractMemoryCandidates(outbound, options.model, options.category);
+    if (extraction.candidates.length > MEMORY_PROPOSAL_MAX_CANDIDATES) {
+        throw new Error(`Extraction returned more than ${MEMORY_PROPOSAL_MAX_CANDIDATES} candidates.`);
+    }
+    const deduped = new Map();
+    for (const candidate of extraction.candidates) {
+        if (candidate.key.length > 512 || Buffer.byteLength(candidate.value, "utf8") > 64 * 1024) {
+            throw new Error(`Extraction candidate "${candidate.key.slice(0, 80)}" exceeds proposal limits.`);
+        }
+        if (deduped.has(candidate.key))
+            throw new Error(`Extraction returned duplicate memory key "${candidate.key}".`);
+        deduped.set(candidate.key, candidate);
+    }
+    if (deduped.size === 0)
+        throw new Error("Extraction produced no durable memory candidates; no proposal was stored.");
+    const bases = await readMemoryBaseHashes(options.scope, [...deduped.keys()], { cwd: projectRoot, ...options.reviewedOptions });
+    const candidates = [...deduped.values()].map((candidate) => {
+        const base = bases.get(candidate.key);
+        const valueHash = digestText(candidate.value);
+        return {
+            ...candidate,
+            operation: expectedMemoryProposalOperation(base.hash, valueHash),
+            base_hash: base.hash,
+            value_hash: valueHash,
+        };
+    });
+    const body = memoryProposalBodySchema.parse({
+        schema_version: 1,
+        created_at: new Date().toISOString(),
+        project_root: projectRoot,
+        scope: options.scope,
+        source: { kind: "trajectory", session_id: trajectory.session_id, digest: sourceDigest },
+        extraction: { model: extraction.model },
+        candidates,
+    });
+    const proposal = sealProposal(body);
+    await writeImmutable(projectRoot, proposal);
+    return proposal;
+}
+export function listMemoryProposals(projectRoot = process.cwd()) {
+    const directory = memoryProposalDirectory(projectRoot);
+    return strictFiles(directory).map((name) => parseFile(join(directory, name)));
+}
+export function showMemoryProposal(digest, projectRoot = process.cwd()) {
+    if (!PROPOSAL_DIGEST_PATTERN.test(digest))
+        throw new Error("Proposal apply/show requires the full exact SHA-256 digest.");
+    const directory = memoryProposalDirectory(projectRoot);
+    const path = join(directory, `${digest}.json`);
+    if (!lstatIfPresent(path))
+        throw new Error(`Memory proposal ${digest} not found.`);
+    return parseFile(path);
+}
+export async function applyMemoryProposal(digest, projectRoot = process.cwd()) {
+    const root = canonicalProjectRoot(projectRoot);
+    const proposal = showMemoryProposal(digest, root);
+    if (proposal.project_root !== root)
+        throw new Error("Memory proposal belongs to a different project.");
+    const trajectory = await showTrajectory(proposal.source.session_id, root);
+    if (digestValue(trajectory) !== proposal.source.digest)
+        throw new Error("Memory proposal source trajectory is stale.");
+    return applyProposalCandidates(proposal.scope, proposal.digest, proposal.candidates, {
+        cwd: root,
+        typed: isTypedMemoryNodesEnabled(),
+    });
+}
+export function doctorMemoryProposals(projectRoot = process.cwd()) {
+    let directory = join(resolve(projectRoot), ".agentfs", "memory-proposals");
+    const issues = [];
+    let count = 0;
+    try {
+        directory = memoryProposalDirectory(projectRoot);
+        const names = strictFiles(directory);
+        count = names.length;
+        for (const name of names) {
+            const path = join(directory, name);
+            try {
+                parseFile(path);
+            }
+            catch (error) {
+                issues.push(`${name}: ${error instanceof Error ? error.message : "invalid proposal"}`);
+            }
+        }
+    }
+    catch (error) {
+        issues.push(error instanceof Error ? error.message : "invalid proposal store");
+    }
+    return { ok: issues.length === 0, directory, count, issues };
+}

package/mcp-memory-server/dist/platform-security.js

@@ -2,27 +2,30 @@ import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { rename } from "node:fs/promises";
 import { spawnSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
-function currentWindowsSid() {
+let cachedWindowsIdentity;
+function currentWindowsIdentity() {
+    if (cachedWindowsIdentity)
+        return cachedWindowsIdentity;
     const result = spawnSync("whoami.exe", ["/user", "/fo", "csv", "/nh"], { encoding: "utf8", windowsHide: true });
     if (result.status !== 0)
         throw new Error("Unable to resolve the current Windows security identity.");
-    const match = result.stdout.match(/"(S-1-[0-9-]+)"/i);
+    const match = result.stdout.match(/^"([^"]+)","(S-1-[0-9-]+)"/im);
     if (!match)
         throw new Error("Unable to resolve the current Windows security identity.");
-    return match[1];
+    cachedWindowsIdentity = { account: match[1], sid: match[2] };
+    return cachedWindowsIdentity;
 }
 export function hardenPrivatePath(path) {
     if (process.platform !== "win32") {
         chmodSync(path, lstatSync(path).isDirectory() ? 0o700 : 0o600);
         return;
     }
-    const sid = currentWindowsSid();
+    const identity = currentWindowsIdentity();
     const args = [
         path,
         "/inheritance:r",
-        "/grant:r", `*${sid}:(F)`,
-        "/grant:r", "*S-1-5-18:(F)",
-        "/grant:r", "*S-1-5-32-544:(F)",
+        "/remove:g", "*S-1-5-18", "*S-1-5-32-544",
+        "/grant:r", `*${identity.sid}:(F)`,
     ];
     const result = spawnSync("icacls.exe", args, { encoding: "utf8", windowsHide: true });
     if (result.status !== 0)
@@ -36,25 +39,28 @@ export function privatePathIsSafe(path) {
         return false;
     if (process.platform !== "win32")
         return (info.mode & 0o077) === 0;
-    const script = [
-        "$p=$env:CK_INTERNAL_PRIVATE_PATH",
-        "$me=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value",
-        "$ok=@($me,'S-1-5-18','S-1-5-32-544')",
-        "$acl=Get-Acl -LiteralPath $p",
-        "foreach($a in $acl.Access){",
-        "if($a.AccessControlType -eq 'Allow'){",
-        "try{$sid=$a.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value}catch{exit 1}",
-        "if($ok -notcontains $sid){exit 1}",
-        "}",
-        "}",
-        "exit 0",
-    ].join(";");
-    const result = spawnSync("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
-        encoding: "utf8",
-        windowsHide: true,
-        env: { ...process.env, CK_INTERNAL_PRIVATE_PATH: path },
-    });
-    return result.status === 0;
+    try {
+        const account = currentWindowsIdentity().account.toLowerCase();
+        const result = spawnSync("icacls.exe", [path], { encoding: "utf8", windowsHide: true });
+        if (result.status !== 0 || !result.stdout)
+            return false;
+        const grants = result.stdout.split(/\r?\n/).filter((line) => {
+            const body = line.trim();
+            const marker = body.indexOf(":(");
+            if (marker < 0)
+                return false;
+            const permissions = body.slice(marker + 1).toUpperCase();
+            return !permissions.includes("(DENY)") && !permissions.includes("(NW)");
+        });
+        const normalized = grants.map((grant) => grant.toLowerCase());
+        const currentMarker = `${account}:(`;
+        return normalized.some((grant) => grant.includes(currentMarker))
+            && normalized.every((grant) => grant.includes(currentMarker)
+                || /\\logonsessionid_[0-9]+_[0-9]+:\(rx\)$/.test(grant.trim()));
+    }
+    catch {
+        return false;
+    }
 }
 function delay(milliseconds) {
     return new Promise((resolveDelay) => setTimeout(resolveDelay, milliseconds));