@cairnkeep/cli 2.20.0 → 2.21.0

package/mcp-memory-server/dist/index.js

@@ -15,6 +15,7 @@ import { artifactIdSchema, artifactKindSchema, artifactMediaTypeSchema, artifact
 import { isCapabilityContractEnabled, resolveCapabilityStatus, } from "./capability-config.js";
 import { EmbeddingCache, cosineSimilarity, embedTexts, getEmbeddingConfig, hashText, } from "./embeddings.js";
 import { queryDomainKnowledge, resolveDomainRetrievalProvider } from "./domain-retrieval-provider.js";
+import { formatHostAuthority, normalizeHostAuthority, normalizeHttpHost, parseHttpPort, resolveHttpToken } from "./http-security.js";
 import { computeRepoState, exploreCacheKey, normalizeExploreQuery, readExploreCache, writeExploreCache, } from "./explore-cache.js";
 import { canonicalTagsSchema, isTypedMemoryNodesEnabled, memoryImportEnvelopeSchema, noteNodeSchema, nodeTypeSchema, } from "./node-schema.js";
 import { attachNodeMetadata, commitMemoryImport, createTypedNode, deleteTypedNode, getTypedNode, listTypedHistory, planMemoryImport, supersedeTypedNode, } from "./node-store.js";
@@ -1753,24 +1754,37 @@ if (cliCommand === "explore") {
         process.exit(1);
     }
 }
-const httpPort = parseInt(process.env.MCP_HTTP_PORT ?? "", 10);
-if (httpPort > 0) {
-    const httpHost = process.env.MCP_HTTP_HOST ?? "127.0.0.1";
+const httpPortResolution = parseHttpPort(process.env.MCP_HTTP_PORT);
+const MAX_HTTP_REQUEST_BYTES = 8 * 1024 * 1024;
+if ("error" in httpPortResolution) {
+    process.stderr.write("cairn-memory: MCP_HTTP_PORT must be a canonical decimal integer from 1 through 65535.\n");
+    process.exit(1);
+}
+if (httpPortResolution.enabled) {
+    const httpPort = httpPortResolution.port;
+    const httpHost = normalizeHttpHost(process.env.MCP_HTTP_HOST);
     // HTTP mode exposes every memory tool over the network, so it is guarded:
     // a bearer token is mandatory (fail closed), CORS is opt-in per origin, and
     // the Host header is validated to block DNS-rebinding. See docs/operating.md.
-    const httpToken = process.env.CAIRN_MEMORY_HTTP_TOKEN?.trim();
-    if (!httpToken) {
-        process.stderr.write("cairn-memory: HTTP mode requires CAIRN_MEMORY_HTTP_TOKEN — refusing to start an unauthenticated network server.\n");
+    const tokenResolution = resolveHttpToken(process.env, { baseDirectory: process.cwd() });
+    if (!tokenResolution.ok || !tokenResolution.token) {
+        process.stderr.write(`cairn-memory: HTTP token resolution failed (${tokenResolution.ok ? "empty" : tokenResolution.reason}) — refusing to start an unauthenticated network server.\n`);
         process.exit(1);
     }
+    const httpToken = tokenResolution.token;
     const allowedOrigins = (process.env.CAIRN_MEMORY_HTTP_ALLOWED_ORIGINS ?? "")
         .split(",").map((value) => value.trim()).filter(Boolean);
     const configuredHosts = (process.env.CAIRN_MEMORY_HTTP_ALLOWED_HOSTS ?? "")
         .split(",").map((value) => value.trim()).filter(Boolean);
-    const allowedHosts = new Set(configuredHosts.length > 0
+    const hostCandidates = configuredHosts.length > 0
         ? configuredHosts
-        : [`${httpHost}:${httpPort}`, `localhost:${httpPort}`, `127.0.0.1:${httpPort}`]);
+        : [formatHostAuthority(httpHost, httpPort), formatHostAuthority("localhost", httpPort), formatHostAuthority("127.0.0.1", httpPort)];
+    const normalizedHosts = hostCandidates.map(normalizeHostAuthority);
+    if (normalizedHosts.some((value) => !value)) {
+        process.stderr.write("cairn-memory: CAIRN_MEMORY_HTTP_ALLOWED_HOSTS contains an invalid host:port authority.\n");
+        process.exit(1);
+    }
+    const allowedHosts = new Set(normalizedHosts);
     const tokenMatches = (header) => {
         const prefix = "Bearer ";
         if (!header || !header.startsWith(prefix)) {
@@ -1805,7 +1819,12 @@ if (httpPort > 0) {
         await session.connect(transport);
         return transport.handleRequest(request);
     };
-    const httpServer = createServer(async (req, res) => {
+    const httpServer = createServer({
+        headersTimeout: 10_000,
+        requestTimeout: 30_000,
+        keepAliveTimeout: 5_000,
+        maxHeaderSize: 32 * 1024,
+    }, async (req, res) => {
         const allowOrigin = originAllowed(req.headers.origin);
         if (allowOrigin) {
             res.setHeader("Access-Control-Allow-Origin", allowOrigin);
@@ -1813,12 +1832,23 @@ if (httpPort > 0) {
             res.setHeader("Access-Control-Allow-Methods", "POST, GET, DELETE, OPTIONS");
             res.setHeader("Access-Control-Allow-Headers", "Content-Type, mcp-session-id, Accept, Authorization, X-Cairn-Project, X-Cairn-Scopes, X-Cairn-AnythingLLM-Workspaces");
         }
+        const declaredLength = Number(req.headers["content-length"] ?? "0");
+        if (Number.isFinite(declaredLength) && declaredLength > MAX_HTTP_REQUEST_BYTES) {
+            res.writeHead(413, { "X-Cairn-Rejection": "request-body-limit" }).end("request body too large");
+            return;
+        }
+        const bodyForbidden = req.method === "GET" || req.method === "DELETE" || req.method === "OPTIONS";
+        if (bodyForbidden && (declaredLength > 0 || req.headers["transfer-encoding"])) {
+            res.writeHead(400).end("request body not allowed for this method");
+            return;
+        }
         if (req.method === "OPTIONS") {
             res.writeHead(allowOrigin ? 204 : 403).end();
             return;
         }
         // DNS-rebinding protection: only serve requests whose Host we expect.
-        if (!req.headers.host || !allowedHosts.has(req.headers.host)) {
+        const requestAuthority = normalizeHostAuthority(req.headers.host, httpPort);
+        if (!requestAuthority || !allowedHosts.has(requestAuthority)) {
             res.writeHead(403).end("host not allowed");
             return;
         }
@@ -1832,11 +1862,19 @@ if (httpPort > 0) {
             let body = null;
             if (req.method !== "GET" && req.method !== "DELETE") {
                 const chunks = [];
-                for await (const chunk of req)
+                let receivedBytes = 0;
+                for await (const rawChunk of req) {
+                    const chunk = Buffer.isBuffer(rawChunk) ? rawChunk : Buffer.from(rawChunk);
+                    receivedBytes += chunk.byteLength;
+                    if (receivedBytes > MAX_HTTP_REQUEST_BYTES) {
+                        res.writeHead(413, { "X-Cairn-Rejection": "request-body-limit" }).end("request body too large");
+                        return;
+                    }
                     chunks.push(chunk);
+                }
                 body = Buffer.concat(chunks);
             }
-            const request = new Request(`http://${req.headers.host}${req.url}`, {
+            const request = new Request(`http://${requestAuthority}${req.url}`, {
                 method: req.method,
                 headers,
                 body,

package/mcp-memory-server/dist/okf.js

@@ -4,6 +4,7 @@ import { mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile } from "node:f
 import { basename, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { parseDocument, stringify } from "yaml";
 import { z } from "zod";
+import { portablePathCollisionKey, portableRelativePathIssue } from "./path-security.js";
 import { hardenPrivatePath } from "./platform-security.js";
 import { readSharedNoteForExport } from "./note-store.js";
 import { redactLocalValue } from "./trajectory-redaction.js";
@@ -41,6 +42,8 @@ const frontmatterSchema = z.object({
     stale_after: z.string().regex(DATE).optional(),
     timestamp: z.string().min(1).max(128).optional(),
 }).passthrough();
+const okfIndexContent = new WeakMap();
+const validatedOkfContent = new WeakMap();
 function sha256(value) {
     return createHash("sha256").update(value).digest("hex");
 }
@@ -55,8 +58,7 @@ function canonical(value) {
     return JSON.stringify(value);
 }
 function normalizedPath(value) {
-    if (!value || value.includes("\\") || isAbsolute(value)
-        || value.split("/").some((part) => part === "" || part === "." || part === "..")) {
+    if (portableRelativePathIssue(value)) {
         throw new Error(`Unsafe OKF path: ${value}`);
     }
     return value;
@@ -90,13 +92,14 @@ async function walk(root, directory = root) {
                 continue;
         }
         const absolute = join(directory, entry.name);
-        const path = relative(root, absolute).split(sep).join("/");
+        const rawPath = relative(root, absolute).split(sep).join("/");
+        const path = rawPath.normalize("NFC");
         if (entry.isSymbolicLink())
             throw new Error(`OKF bundles may not contain symlinks: ${path}`);
         if (entry.isDirectory())
             files.push(...await walk(root, absolute));
         else if (entry.isFile())
-            files.push(normalizedPath(path));
+            files.push({ path: normalizedPath(path), raw_path: rawPath });
         else
             throw new Error(`OKF bundles may contain regular files only: ${path}`);
         if (files.length > MAX_ENTRIES)
@@ -231,20 +234,33 @@ export async function indexOkfBundle(directory, selectedPaths, declaredVersion)
     if (!requestedInfo.isDirectory() || requestedInfo.isSymbolicLink())
         throw new Error("OKF source must be a real directory.");
     const root = requested;
-    const paths = selectedPaths ? selectedPaths.map(normalizedPath).sort((a, b) => a.localeCompare(b, "en")) : await walk(root);
+    const entries = selectedPaths
+        ? selectedPaths.map(normalizedPath).sort((a, b) => a.localeCompare(b, "en")).map((path) => ({ path, raw_path: path }))
+        : await walk(root);
+    const portablePaths = new Set();
+    for (const entry of entries) {
+        const key = portablePathCollisionKey(entry.path);
+        if (portablePaths.has(key))
+            throw new Error(`Duplicate portable OKF path: ${entry.path}`);
+        portablePaths.add(key);
+    }
+    const paths = entries.map(({ path }) => path);
     const existing = new Set(paths);
     const files = [];
+    const content = new Map();
     const diagnostics = [];
     let version = declaredVersion ?? "";
     let sawV02 = false;
-    for (const path of paths) {
-        const absolute = resolve(root, ...path.split("/"));
+    for (const entry of entries) {
+        const path = entry.path;
+        const absolute = resolve(root, ...entry.raw_path.split("/"));
         if (!contained(root, absolute))
             throw new Error(`Unsafe OKF path: ${path}`);
         const info = lstatSync(absolute);
         if (!info.isFile() || info.isSymbolicLink() || info.size > MAX_FILE_BYTES)
             throw new Error(`OKF file is unsafe or too large: ${path}`);
         const bytes = await readFile(absolute);
+        content.set(path, bytes);
         const text = utf8(bytes, path);
         const name = basename(path);
         const markdown = extname(path).toLowerCase() === ".md";
@@ -294,7 +310,9 @@ export async function indexOkfBundle(directory, selectedPaths, declaredVersion)
         version = sawV02 ? "0.2" : "0.1";
     if (!/^0\.(?:1|2)$/.test(version))
         diagnostics.unshift({ severity: "warning", code: "unsupported-version", path: "index.md", message: `OKF version ${version} is not explicitly supported; consumed on a best-effort basis.` });
-    return { schema_version: 1, version, files, diagnostics };
+    const index = { schema_version: 1, version, files, diagnostics };
+    okfIndexContent.set(index, content);
+    return index;
 }
 export async function validateOkfBundle(directory) {
     const root = resolve(directory);
@@ -302,7 +320,15 @@ export async function validateOkfBundle(directory) {
     const totalBytes = index.files.reduce((sum, file) => sum + file.bytes, 0);
     if (totalBytes > MAX_TOTAL_BYTES)
         throw new Error("OKF bundle exceeds the total size limit.");
-    return { ...index, root, concepts: index.files.flatMap((file) => file.concept ? [file.concept] : []), total_bytes: totalBytes };
+    const bundle = { ...index, root, concepts: index.files.flatMap((file) => file.concept ? [file.concept] : []), total_bytes: totalBytes };
+    validatedOkfContent.set(bundle, okfIndexContent.get(index) ?? new Map());
+    return bundle;
+}
+export function validatedOkfFileContent(bundle, path) {
+    const bytes = validatedOkfContent.get(bundle)?.get(path);
+    if (!bytes)
+        throw new Error(`Validated OKF bytes are unavailable: ${path}`);
+    return bytes;
 }
 function normalizeExportSource(value) {
     const path = normalizedPath(value.replaceAll("\\", "/"));

package/mcp-memory-server/dist/path-security.js

@@ -0,0 +1,49 @@
+import { posix, win32 } from "node:path";
+const WINDOWS_DEVICE = /^(?:con|prn|aux|nul|conin\$|conout\$|com[1-9¹²³]|lpt[1-9¹²³])(?:\..*)?$/i;
+function hasUnpairedSurrogate(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code >= 0xd800 && code <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (!(next >= 0xdc00 && next <= 0xdfff))
+                return true;
+            index += 1;
+        }
+        else if (code >= 0xdc00 && code <= 0xdfff)
+            return true;
+    }
+    return false;
+}
+/**
+ * Returns a stable reason when a path cannot be interpreted identically on
+ * POSIX and Windows. These paths are persisted in portable Cairnkeep formats,
+ * so validation must not depend on the host performing the validation.
+ */
+export function portableRelativePathIssue(value, options = {}) {
+    if (!value)
+        return "empty";
+    if (value !== value.normalize("NFC"))
+        return "non-canonical-unicode";
+    if (hasUnpairedSurrogate(value))
+        return "unpaired-surrogate";
+    if (/[<>:"\\|?*\u0000-\u001f\u007f]/.test(value))
+        return "separator-or-control";
+    if (posix.isAbsolute(value) || win32.isAbsolute(value))
+        return "absolute";
+    if (value === "." && options.allowCurrentDirectory)
+        return undefined;
+    const segments = value.split("/");
+    if (segments.some((segment) => segment === "" || segment === "." || segment === ".."))
+        return "invalid-segment";
+    if (segments.some((segment) => /[ .]$/.test(segment) || WINDOWS_DEVICE.test(segment))) {
+        return "non-portable-segment";
+    }
+    return undefined;
+}
+export function portablePathCollisionKey(value) {
+    // Windows' case-insensitive comparison is closer to invariant uppercase
+    // mapping than to lowercasing. In particular, final sigma (ς/σ), long-s
+    // (ſ/s), and dotless-i (ı/i) converge when uppercased but not when
+    // lowercased. NFC first also makes the key stable across macOS and Linux.
+    return value.normalize("NFC").toLocaleUpperCase("en-US");
+}

package/mcp-memory-server/dist/platform-security.js

@@ -2,13 +2,101 @@ import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { rename } from "node:fs/promises";
 import { spawnSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
+import { dirname } from "node:path";
 let cachedWindowsIdentity;
+const WINDOWS_COMMAND_TIMEOUT_MS = 10_000;
+const WINDOWS_COMMAND_MAX_BUFFER = 1024 * 1024;
+const WINDOWS_SYSTEM_SIDS = new Set(["S-1-5-18", "S-1-5-32-544"]);
+const WINDOWS_REPLACEMENT_RIGHTS = 2 | 4 | 16 | 64 | 256 | 65_536 | 262_144 | 524_288;
+function trustedWindowsSid(sid, currentSid) {
+    return sid.toUpperCase() === currentSid.toUpperCase() || WINDOWS_SYSTEM_SIDS.has(sid.toUpperCase());
+}
+export function posixOwnerIsTrusted(uid, currentUid = process.getuid?.()) {
+    return currentUid !== undefined && (uid === currentUid || uid === 0);
+}
+export function posixPrivateMetadataIsSafe(info) {
+    return posixOwnerIsTrusted(info.uid) && (info.mode & 0o077) === 0;
+}
+export function windowsPrivateAclIsSafe(snapshot, currentSid) {
+    if (!snapshot.protected || !trustedWindowsSid(snapshot.owner_sid, currentSid))
+        return false;
+    const allows = snapshot.access.filter(({ type }) => type.toLowerCase() === "allow");
+    return allows.some(({ sid }) => sid.toUpperCase() === currentSid.toUpperCase())
+        && allows.every(({ sid }) => trustedWindowsSid(sid, currentSid));
+}
+export function windowsReplacementAclIsSafe(snapshot, currentSid) {
+    if (!trustedWindowsSid(snapshot.owner_sid, currentSid))
+        return false;
+    return snapshot.access.every(({ sid, type, rights }) => type.toLowerCase() !== "allow"
+        || trustedWindowsSid(sid, currentSid)
+        || (rights & WINDOWS_REPLACEMENT_RIGHTS) === 0);
+}
+export function windowsPrivateAclHardeningPlan(snapshot, identity, directory) {
+    const grant = directory ? `*${identity.sid}:(OI)(CI)(F)` : `*${identity.sid}:(F)`;
+    const untrustedAllows = [...new Set(snapshot.access
+            .filter(({ sid, type }) => type.toLowerCase() === "allow" && !trustedWindowsSid(sid, identity.sid))
+            .map(({ sid }) => sid.toUpperCase()))];
+    const denies = [...new Set(snapshot.access
+            .filter(({ type }) => type.toLowerCase() === "deny")
+            .map(({ sid }) => sid.toUpperCase()))];
+    return [
+        ["/grant:r", grant],
+        ["/inheritance:r"],
+        ...untrustedAllows.map((sid) => ["/remove:g", `*${sid}`]),
+        ...denies.map((sid) => ["/remove:d", `*${sid}`]),
+        ["/setowner", identity.account],
+    ];
+}
+function windowsAclSnapshot(path) {
+    const script = [
+        "$ErrorActionPreference='Stop'",
+        "$sections=[System.Security.AccessControl.AccessControlSections]::Owner -bor [System.Security.AccessControl.AccessControlSections]::Access",
+        "$acl=if([System.IO.Directory]::Exists($env:CK_INTERNAL_ACL_PATH)){[System.Security.AccessControl.DirectorySecurity]::new($env:CK_INTERNAL_ACL_PATH,$sections)}else{[System.Security.AccessControl.FileSecurity]::new($env:CK_INTERNAL_ACL_PATH,$sections)}",
+        "$owner=$acl.Owner",
+        "try{$owner=([System.Security.Principal.NTAccount]$owner).Translate([System.Security.Principal.SecurityIdentifier]).Value}catch{}",
+        "$access=@($acl.Access|ForEach-Object{$sid=$_.IdentityReference.Value;try{$sid=$_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value}catch{};[pscustomobject]@{sid=$sid;type=$_.AccessControlType.ToString();rights=[int64]$_.FileSystemRights}})",
+        "[pscustomobject]@{owner_sid=$owner;protected=$acl.AreAccessRulesProtected;access=$access}|ConvertTo-Json -Compress -Depth 4",
+    ].join(";");
+    const result = spawnSync("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
+        encoding: "utf8",
+        windowsHide: true,
+        timeout: WINDOWS_COMMAND_TIMEOUT_MS,
+        maxBuffer: WINDOWS_COMMAND_MAX_BUFFER,
+        env: { ...process.env, CK_INTERNAL_ACL_PATH: path },
+    });
+    if (result.status !== 0 || !result.stdout.trim()) {
+        const detail = result.error?.message || result.stderr.trim();
+        throw new Error(`Unable to inspect Windows ACL${detail ? `: ${detail}` : "."}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(result.stdout);
+    }
+    catch {
+        throw new Error("Unable to parse the Windows ACL inspection result.");
+    }
+    if (typeof parsed.owner_sid !== "string" || typeof parsed.protected !== "boolean" || !Array.isArray(parsed.access)) {
+        throw new Error("Windows ACL inspection returned an invalid structure.");
+    }
+    const access = parsed.access.filter((ace) => Boolean(ace)
+        && typeof ace.sid === "string" && typeof ace.type === "string" && Number.isSafeInteger(ace.rights));
+    if (access.length !== parsed.access.length)
+        throw new Error("Windows ACL inspection returned an invalid access rule.");
+    return { owner_sid: parsed.owner_sid, protected: parsed.protected, access };
+}
 function currentWindowsIdentity() {
     if (cachedWindowsIdentity)
         return cachedWindowsIdentity;
-    const result = spawnSync("whoami.exe", ["/user", "/fo", "csv", "/nh"], { encoding: "utf8", windowsHide: true });
-    if (result.status !== 0)
-        throw new Error("Unable to resolve the current Windows security identity.");
+    const result = spawnSync("whoami.exe", ["/user", "/fo", "csv", "/nh"], {
+        encoding: "utf8",
+        windowsHide: true,
+        timeout: WINDOWS_COMMAND_TIMEOUT_MS,
+        maxBuffer: WINDOWS_COMMAND_MAX_BUFFER,
+    });
+    if (result.status !== 0) {
+        const detail = result.error?.message || result.stderr.trim();
+        throw new Error(`Unable to resolve the current Windows security identity${detail ? `: ${detail}` : "."}`);
+    }
     const match = result.stdout.match(/^"([^"]+)","(S-1-[0-9-]+)"/im);
     if (!match)
         throw new Error("Unable to resolve the current Windows security identity.");
@@ -21,15 +109,30 @@ export function hardenPrivatePath(path) {
         return;
     }
     const identity = currentWindowsIdentity();
-    const args = [
-        path,
-        "/inheritance:r",
-        "/remove:g", "*S-1-5-18", "*S-1-5-32-544",
-        "/grant:r", `*${identity.sid}:(F)`,
-    ];
-    const result = spawnSync("icacls.exe", args, { encoding: "utf8", windowsHide: true });
-    if (result.status !== 0)
-        throw new Error("Unable to restrict Windows ACLs for private Cairnkeep state.");
+    const directory = lstatSync(path).isDirectory();
+    let snapshot;
+    try {
+        snapshot = windowsAclSnapshot(path);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`Unable to inspect Windows ACLs before hardening private Cairnkeep state: ${detail}`);
+    }
+    for (const operation of windowsPrivateAclHardeningPlan(snapshot, identity, directory)) {
+        const args = [path, ...operation];
+        const result = spawnSync("icacls.exe", args, {
+            encoding: "utf8",
+            windowsHide: true,
+            timeout: WINDOWS_COMMAND_TIMEOUT_MS,
+            maxBuffer: WINDOWS_COMMAND_MAX_BUFFER,
+        });
+        if (result.status !== 0) {
+            const detail = result.error?.message || result.stderr.trim() || result.stdout.trim();
+            throw new Error(`Unable to restrict Windows ACLs for private Cairnkeep state${detail ? `: ${detail}` : "."}`);
+        }
+    }
+    if (!privatePathIsSafe(path))
+        throw new Error("Unable to verify private Windows ACLs after hardening.");
 }
 export function privatePathIsSafe(path) {
     if (!existsSync(path))
@@ -38,30 +141,46 @@ export function privatePathIsSafe(path) {
     if (info.isSymbolicLink())
         return false;
     if (process.platform !== "win32")
-        return (info.mode & 0o077) === 0;
+        return posixPrivateMetadataIsSafe(info);
     try {
-        const account = currentWindowsIdentity().account.toLowerCase();
-        const result = spawnSync("icacls.exe", [path], { encoding: "utf8", windowsHide: true });
-        if (result.status !== 0 || !result.stdout)
-            return false;
-        const grants = result.stdout.split(/\r?\n/).filter((line) => {
-            const body = line.trim();
-            const marker = body.indexOf(":(");
-            if (marker < 0)
-                return false;
-            const permissions = body.slice(marker + 1).toUpperCase();
-            return !permissions.includes("(DENY)") && !permissions.includes("(NW)");
-        });
-        const normalized = grants.map((grant) => grant.toLowerCase());
-        const currentMarker = `${account}:(`;
-        return normalized.some((grant) => grant.includes(currentMarker))
-            && normalized.every((grant) => grant.includes(currentMarker)
-                || /\\logonsessionid_[0-9]+_[0-9]+:\(rx\)$/.test(grant.trim()));
+        const identity = currentWindowsIdentity();
+        const snapshot = windowsAclSnapshot(path);
+        return Boolean(snapshot && windowsPrivateAclIsSafe(snapshot, identity.sid));
+    }
+    catch {
+        return false;
+    }
+}
+export function replacementBoundaryIsSafe(path) {
+    if (!existsSync(path))
+        return false;
+    const info = lstatSync(path);
+    if (!info.isDirectory() || info.isSymbolicLink())
+        return false;
+    if (process.platform !== "win32")
+        return posixOwnerIsTrusted(info.uid) && (info.mode & 0o022) === 0;
+    try {
+        const identity = currentWindowsIdentity();
+        const snapshot = windowsAclSnapshot(path);
+        return Boolean(snapshot && windowsReplacementAclIsSafe(snapshot, identity.sid));
     }
     catch {
         return false;
     }
 }
+export function parentReplacementBoundaryIsSafe(path) {
+    const parentPath = dirname(path);
+    if (!existsSync(parentPath))
+        return false;
+    const info = lstatSync(parentPath);
+    if (!info.isDirectory() || info.isSymbolicLink())
+        return false;
+    if (process.platform === "win32")
+        return replacementBoundaryIsSafe(parentPath);
+    const writableByOthers = (info.mode & 0o022) !== 0;
+    const sticky = (info.mode & 0o1000) !== 0;
+    return posixOwnerIsTrusted(info.uid) && (!writableByOthers || sticky);
+}
 function delay(milliseconds) {
     return new Promise((resolveDelay) => setTimeout(resolveDelay, milliseconds));
 }
@@ -86,6 +205,8 @@ export async function atomicReplace(source, destination) {
                 ], {
                     encoding: "utf8",
                     windowsHide: true,
+                    timeout: WINDOWS_COMMAND_TIMEOUT_MS,
+                    maxBuffer: WINDOWS_COMMAND_MAX_BUFFER,
                     env: {
                         ...process.env,
                         CK_INTERNAL_ATOMIC_SOURCE: source,
@@ -98,7 +219,9 @@ export async function atomicReplace(source, destination) {
                     return;
                 }
                 rmSync(backup, { force: true });
-                lastError = result.stderr.trim() || result.stdout.trim() || lastError;
+                if (result.error)
+                    throw new Error(`Windows atomic replacement failed: ${result.error.message}`);
+                lastError = result.stderr?.trim() || result.stdout?.trim() || lastError;
             }
             await delay(25 * (attempt + 1));
         }

package/mcp-memory-server/dist/project-environment.js

@@ -0,0 +1,132 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { parentReplacementBoundaryIsSafe, posixPrivateMetadataIsSafe, privatePathIsSafe, replacementBoundaryIsSafe } from "./platform-security.js";
+const ASSIGNMENT = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
+const MAX_PROJECT_ENV_BYTES = 64 * 1024;
+function readBoundedDescriptor(descriptor, approvedSize) {
+    const buffer = Buffer.allocUnsafe(approvedSize + 1);
+    let offset = 0;
+    while (offset < buffer.byteLength) {
+        const bytesRead = readSync(descriptor, buffer, offset, buffer.byteLength - offset, null);
+        if (bytesRead === 0)
+            break;
+        offset += bytesRead;
+    }
+    return buffer.subarray(0, offset);
+}
+function literalValue(raw, line) {
+    if (/[\x00-\x1f\x7f]/.test(raw))
+        throw new Error(`.ai/.env line ${line} contains a control character`);
+    if (/^\s/.test(raw))
+        throw new Error(`.ai/.env line ${line} has whitespace after the assignment operator`);
+    const value = raw.trim();
+    if (!value)
+        return "";
+    if (/^'[^']*'$/.test(value))
+        return value.slice(1, -1);
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+        const inner = value.slice(1, -1);
+        if (!/^(?:[^"\\$`]|\\[\\"])*$/.test(inner)) {
+            throw new Error(`.ai/.env line ${line} is not a literal double-quoted value`);
+        }
+        return inner.replace(/\\([\\"])/g, "$1");
+    }
+    const withoutComment = value.replace(/\s+#.*$/, "").trim();
+    if (!/^[A-Za-z0-9_./:@%+,=-]*$/.test(withoutComment))
+        throw new Error(`.ai/.env line ${line} is not a literal assignment`);
+    return withoutComment;
+}
+export function projectEnvironment(projectRoot, ambient) {
+    const requestedRoot = resolve(projectRoot);
+    let approvedRootInfo;
+    try {
+        approvedRootInfo = lstatSync(requestedRoot);
+        if (!approvedRootInfo.isDirectory() || approvedRootInfo.isSymbolicLink()
+            || !replacementBoundaryIsSafe(requestedRoot) || !parentReplacementBoundaryIsSafe(requestedRoot)) {
+            return { env: { ...ambient }, issue: "project root and its parent must be owner-controlled real directories" };
+        }
+    }
+    catch {
+        return { env: { ...ambient }, issue: "project root metadata could not be inspected" };
+    }
+    let canonicalRoot;
+    try {
+        canonicalRoot = realpathSync(requestedRoot);
+        const requestedAfter = lstatSync(requestedRoot);
+        const canonicalInfo = lstatSync(canonicalRoot);
+        if (requestedAfter.dev !== approvedRootInfo.dev || requestedAfter.ino !== approvedRootInfo.ino
+            || canonicalInfo.dev !== approvedRootInfo.dev || canonicalInfo.ino !== approvedRootInfo.ino
+            || requestedAfter.isSymbolicLink() || !parentReplacementBoundaryIsSafe(canonicalRoot)) {
+            return { env: { ...ambient }, issue: "project root changed while it was being inspected" };
+        }
+    }
+    catch {
+        return { env: { ...ambient }, issue: "project root could not be canonicalized safely" };
+    }
+    const directory = join(canonicalRoot, ".ai");
+    const path = join(directory, ".env");
+    try {
+        const directoryInfo = lstatSync(directory);
+        if (!directoryInfo.isDirectory() || directoryInfo.isSymbolicLink() || !replacementBoundaryIsSafe(directory))
+            return { env: { ...ambient }, issue: ".ai must be an owner-controlled real directory" };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { env: { ...ambient } };
+        return { env: { ...ambient }, issue: ".ai/.env metadata could not be inspected" };
+    }
+    let text;
+    let descriptor;
+    try {
+        const nonBlocking = process.platform === "win32" ? 0 : (constants.O_NONBLOCK ?? 0);
+        descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | nonBlocking);
+        const opened = fstatSync(descriptor);
+        if (!opened.isFile() || opened.size > MAX_PROJECT_ENV_BYTES)
+            return { env: { ...ambient }, issue: ".ai/.env must be a private regular file no larger than 64 KiB" };
+        const bytes = readBoundedDescriptor(descriptor, opened.size);
+        const afterRead = fstatSync(descriptor);
+        const named = lstatSync(path);
+        const descriptorPrivate = process.platform === "win32" || posixPrivateMetadataIsSafe(opened);
+        if (!descriptorPrivate || named.isSymbolicLink() || !named.isFile()
+            || opened.dev !== afterRead.dev || opened.ino !== afterRead.ino || opened.size !== afterRead.size
+            || opened.mtimeMs !== afterRead.mtimeMs || opened.ctimeMs !== afterRead.ctimeMs
+            || named.dev !== opened.dev || named.ino !== opened.ino
+            || bytes.byteLength !== afterRead.size || bytes.byteLength > MAX_PROJECT_ENV_BYTES) {
+            return { env: { ...ambient }, issue: ".ai/.env changed while it was being inspected" };
+        }
+        if (process.platform === "win32") {
+            if (!privatePathIsSafe(path))
+                return { env: { ...ambient }, issue: ".ai/.env must be a private regular file no larger than 64 KiB" };
+            const namedAfterAcl = lstatSync(path);
+            if (namedAfterAcl.dev !== opened.dev || namedAfterAcl.ino !== opened.ino || namedAfterAcl.isSymbolicLink()) {
+                return { env: { ...ambient }, issue: ".ai/.env changed while it was being inspected" };
+            }
+        }
+        text = bytes.toString("utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { env: { ...ambient } };
+        return { env: { ...ambient }, issue: ".ai/.env is unreadable" };
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
+    const loaded = {};
+    try {
+        for (const [index, source] of text.split(/\r?\n/).entries()) {
+            const line = source.trim();
+            if (!line || line.startsWith("#"))
+                continue;
+            const match = ASSIGNMENT.exec(line);
+            if (!match)
+                throw new Error(`.ai/.env line ${index + 1} is not an assignment`);
+            loaded[match[1]] = literalValue(match[2], index + 1);
+        }
+    }
+    catch (error) {
+        return { env: { ...loaded, ...ambient }, issue: error instanceof Error ? error.message : String(error) };
+    }
+    return { env: { ...loaded, ...ambient } };
+}