@cairnkeep/cli 2.20.0 → 2.21.0

package/mcp-memory-server/dist/security-cli.js

@@ -0,0 +1,46 @@
+import { securityDoctor } from "./security-doctor.js";
+import { projectEnvironment } from "./project-environment.js";
+function usage(exitCode = 2) {
+    process.stderr.write("Usage: cairn security doctor [--project PATH] [--json]\n");
+    process.exit(exitCode);
+}
+function option(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0)
+        return undefined;
+    const value = args[index + 1];
+    if (!value || value.startsWith("--"))
+        usage();
+    args.splice(index, 2);
+    return value;
+}
+const args = process.argv.slice(2);
+const command = args.shift();
+if (["help", "--help", "-h"].includes(command ?? ""))
+    usage(0);
+if (command !== "doctor")
+    usage();
+const jsonIndex = args.indexOf("--json");
+const json = jsonIndex >= 0;
+if (json)
+    args.splice(jsonIndex, 1);
+const projectRoot = option(args, "--project") ?? process.cwd();
+if (args.length)
+    usage();
+const loaded = projectEnvironment(projectRoot, process.env);
+const report = securityDoctor({ projectRoot, env: loaded.env, environmentIssue: loaded.issue });
+if (json) {
+    process.stdout.write(`${JSON.stringify(report)}\n`);
+}
+else {
+    process.stdout.write("cairn security doctor\n");
+    for (const check of report.checks) {
+        process.stdout.write(`  [${check.state}] ${check.summary}\n`);
+        if (check.remediation && check.state !== "PASS" && check.state !== "SKIP") {
+            process.stdout.write(`         ${check.remediation}\n`);
+        }
+    }
+    process.stdout.write(`Summary: ${report.summary.pass} pass, ${report.summary.warn} warn, ${report.summary.fail} fail, ${report.summary.skip} skip\n`);
+}
+if (!report.ok)
+    process.exitCode = 1;

package/mcp-memory-server/dist/security-doctor.js

@@ -0,0 +1,211 @@
+import { lstatSync, realpathSync } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
+import { normalizeHostAuthority, normalizeHttpHost, parseHttpPort, resolveHttpToken } from "./http-security.js";
+import { resolveMcpToolProfile } from "./mcp-tool-profile.js";
+import { parentReplacementBoundaryIsSafe, posixPrivateMetadataIsSafe, privatePathIsSafe, replacementBoundaryIsSafe } from "./platform-security.js";
+const PRIVATE_PROJECT_FILES = [
+    ".ai/.env",
+    ".ai/capabilities.json",
+    ".ai/mcp-tools.json",
+    ".ai/playbooks.json",
+];
+function loopbackHost(host) {
+    const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+    return normalized === "127.0.0.1" || normalized === "localhost" || normalized === "::1";
+}
+function tokenStrength(token) {
+    const bytes = Buffer.byteLength(token.trim(), "utf8");
+    if (bytes === 0)
+        return "missing";
+    if (bytes < 32 || /^(.)(?:\1)+$/.test(token.trim()))
+        return "weak";
+    return "ok";
+}
+function lstatIfPresent(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+function checkPrivateDirectory(projectRoot) {
+    const path = join(projectRoot, ".ai");
+    const info = lstatIfPresent(path);
+    if (!info)
+        return { id: "private-directory:.ai", state: "SKIP", summary: ".ai is not present" };
+    const safePermissions = process.platform === "win32"
+        ? privatePathIsSafe(path)
+        : posixPrivateMetadataIsSafe(info) && (Number(info.mode) & 0o700) === 0o700;
+    if (!info.isDirectory() || info.isSymbolicLink() || !safePermissions) {
+        return { id: "private-directory:.ai", state: "FAIL", summary: ".ai is symlinked, non-directory, inaccessible, or not private to a trusted owner", remediation: process.platform === "win32" ? "Restrict .ai to the current account and remove inherited access." : "Replace symlinks, restore trusted ownership, and run: chmod 700 .ai" };
+    }
+    return { id: "private-directory:.ai", state: "PASS", summary: ".ai is a real directory not writable by other accounts" };
+}
+function checkPrivateFile(projectRoot, relativePath, safeParent) {
+    const path = join(projectRoot, ...relativePath.split("/"));
+    if (!safeParent)
+        return { id: `private-file:${relativePath}`, state: "SKIP", summary: `${relativePath} was not followed through an unsafe .ai directory` };
+    let info;
+    try {
+        info = lstatIfPresent(path);
+    }
+    catch {
+        return { id: `private-file:${relativePath}`, state: "FAIL", summary: `${relativePath} metadata is inaccessible`, remediation: "Restore trusted ownership and private directory traversal permissions." };
+    }
+    if (!info)
+        return { id: `private-file:${relativePath}`, state: "SKIP", summary: `${relativePath} is not present` };
+    if (!info.isFile() || info.isSymbolicLink() || !privatePathIsSafe(path)) {
+        return {
+            id: `private-file:${relativePath}`,
+            state: "FAIL",
+            summary: `${relativePath} is not a private regular file`,
+            remediation: process.platform === "win32"
+                ? `Restrict ${relativePath} to the current account and remove inherited access.`
+                : `Run: chmod 600 ${relativePath}`,
+        };
+    }
+    return { id: `private-file:${relativePath}`, state: "PASS", summary: `${relativePath} is private and non-symlinked` };
+}
+function sameFileIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino && left.isDirectory() === right.isDirectory();
+}
+export function securityDoctor(options = {}) {
+    const env = options.env ?? process.env;
+    const requestedRoot = resolve(options.projectRoot ?? process.cwd());
+    const checks = [];
+    let projectRoot = requestedRoot;
+    let projectRootTrusted = false;
+    let requestedInfo;
+    try {
+        requestedInfo = lstatIfPresent(requestedRoot);
+    }
+    catch {
+        checks.push({ id: "project-root", state: "FAIL", summary: "Project root metadata is inaccessible", remediation: "Restore trusted ownership and directory traversal permissions." });
+    }
+    if (!requestedInfo) {
+        if (!checks.some(({ id }) => id === "project-root"))
+            checks.push({ id: "project-root", state: "FAIL", summary: "Project root does not exist", remediation: "Run the command from a real project directory." });
+    }
+    else {
+        const info = requestedInfo;
+        if (!info.isDirectory() || info.isSymbolicLink() || !replacementBoundaryIsSafe(requestedRoot)) {
+            checks.push({ id: "project-root", state: "FAIL", summary: "Project root is symlinked, non-directory, or writable by another account", remediation: process.platform === "win32" ? "Use a project directory whose ACL denies replacement by untrusted accounts." : "Use a canonical project directory and run: chmod go-w ." });
+        }
+        else if (!parentReplacementBoundaryIsSafe(requestedRoot)) {
+            checks.push({ id: "project-root-parent", state: "FAIL", summary: "The requested project parent directory can replace the selected project root", remediation: "Move the project below an owner-controlled directory or restrict the parent directory permissions." });
+        }
+        else {
+            try {
+                options.testBeforeCanonicalize?.();
+                const canonical = realpathSync(requestedRoot);
+                const requestedAfter = lstatSync(requestedRoot);
+                const canonicalInfo = lstatSync(canonical);
+                if (requestedAfter.isSymbolicLink() || !sameFileIdentity(info, requestedAfter) || !sameFileIdentity(info, canonicalInfo)
+                    || !parentReplacementBoundaryIsSafe(canonical))
+                    throw new Error("project identity changed");
+                projectRoot = canonical;
+                projectRootTrusted = true;
+                checks.push({ id: "project-root", state: "PASS", summary: "Project root and its immediate replacement boundary are protected" });
+            }
+            catch {
+                checks.push({ id: "project-root", state: "FAIL", summary: "Project root identity or canonical location changed during inspection", remediation: "Retry after placing the project below an owner-controlled, non-symlink directory." });
+            }
+            if (projectRootTrusted) {
+                const directoryCheck = checkPrivateDirectory(projectRoot);
+                checks.push(directoryCheck);
+                for (const file of PRIVATE_PROJECT_FILES)
+                    checks.push(checkPrivateFile(projectRoot, file, directoryCheck.state !== "FAIL"));
+            }
+        }
+    }
+    if (options.environmentIssue)
+        checks.push({ id: "project-environment", state: "FAIL", summary: "Project .ai/.env could not be interpreted safely", remediation: options.environmentIssue });
+    else
+        checks.push({ id: "project-environment", state: "PASS", summary: "Project environment uses supported literal assignments or is absent" });
+    let profileMode;
+    if (!projectRootTrusted) {
+        checks.push({ id: "mcp-profile", state: "SKIP", summary: "MCP tool profile was not read through an unsafe project root" });
+    }
+    else {
+        try {
+            const profile = resolveMcpToolProfile({ projectRoot, env });
+            profileMode = profile.mode;
+            checks.push({ id: "mcp-profile", state: "PASS", summary: `MCP tool profile is valid (${profile.mode})` });
+        }
+        catch {
+            checks.push({ id: "mcp-profile", state: "FAIL", summary: "MCP tool profile is invalid or unsafe", remediation: "Run: cairn mcp-tools status --project ." });
+        }
+    }
+    const portResolution = parseHttpPort(env.MCP_HTTP_PORT);
+    if ("error" in portResolution) {
+        checks.push({ id: "http-exposure", state: "FAIL", summary: "MCP_HTTP_PORT is invalid", remediation: "Unset MCP_HTTP_PORT or choose a canonical decimal port from 1 through 65535." });
+    }
+    else if (!portResolution.enabled) {
+        checks.push({ id: "http-exposure", state: "SKIP", summary: "MCP HTTP transport is disabled" });
+    }
+    else {
+        const port = portResolution.port;
+        const host = normalizeHttpHost(env.MCP_HTTP_HOST);
+        const resolution = !projectRootTrusted && env.CAIRN_MEMORY_HTTP_TOKEN_FILE && !isAbsolute(env.CAIRN_MEMORY_HTTP_TOKEN_FILE)
+            ? { ok: false, reason: "unsafe-base" }
+            : resolveHttpToken(env, { baseDirectory: projectRoot });
+        let token;
+        if (resolution.ok) {
+            token = resolution.token;
+            if (resolution.source === "file")
+                checks.push({ id: "http-token-file", state: "PASS", summary: "HTTP token file is private and non-symlinked" });
+        }
+        else if (resolution.reason !== "missing") {
+            const id = resolution.reason === "multiple" ? "http-token-source"
+                : resolution.reason === "token-unsafe" ? "http-token"
+                    : "http-token-file";
+            checks.push({ id, state: "FAIL", summary: `HTTP token resolution failed (${resolution.reason})`, remediation: "Set exactly one token source and use a readable, private, non-symlink token file with an ASCII Bearer token." });
+        }
+        const strength = tokenStrength(token ?? "");
+        checks.push(strength === "ok"
+            ? { id: "http-token", state: "PASS", summary: "HTTP bearer token meets the minimum length" }
+            : { id: "http-token", state: "FAIL", summary: strength === "missing" ? "HTTP bearer token is missing" : "HTTP bearer token is too weak", remediation: "Generate at least 32 random bytes; for example: openssl rand -hex 32" });
+        const nonLoopback = !loopbackHost(host);
+        const hosts = (env.CAIRN_MEMORY_HTTP_ALLOWED_HOSTS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
+        const invalidHosts = hosts.filter((value) => !normalizeHostAuthority(value));
+        checks.push(invalidHosts.length > 0
+            ? { id: "http-host-allowlist", state: "FAIL", summary: "HTTP Host allowlist contains an invalid authority", remediation: `Use host:port authorities matching port ${port}; bracket IPv6 literals.` }
+            : nonLoopback && hosts.length === 0
+                ? { id: "http-host-allowlist", state: "WARN", summary: "Non-loopback HTTP binding relies on the derived Host allowlist", remediation: "Set CAIRN_MEMORY_HTTP_ALLOWED_HOSTS explicitly to the public host names and ports." }
+                : { id: "http-host-allowlist", state: "PASS", summary: nonLoopback ? "Non-loopback HTTP binding has an explicit Host allowlist" : "HTTP binding is loopback-only" });
+        if (nonLoopback && profileMode === "full") {
+            checks.push({ id: "http-least-authority", state: "WARN", summary: "Network HTTP exposure uses the full MCP tool profile", remediation: "Use CAIRN_MCP_TOOL_PROFILE=read-only or an explicit custom allowlist when mutations are unnecessary." });
+        }
+        else {
+            checks.push({ id: "http-least-authority", state: "PASS", summary: "HTTP exposure and MCP tool authority are bounded" });
+        }
+    }
+    const remote = env.CAIRN_MEMORY_REMOTE_URL?.trim();
+    if (!remote) {
+        checks.push({ id: "remote-transport", state: "SKIP", summary: "Remote memory endpoint is not configured" });
+    }
+    else {
+        try {
+            const url = new URL(remote);
+            if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) {
+                checks.push({ id: "remote-transport", state: "FAIL", summary: "Remote memory URL has an unsafe scheme or embedded credentials", remediation: "Use an HTTP(S) URL and provide credentials through the supported secret environment variable." });
+            }
+            else {
+                const local = loopbackHost(url.hostname);
+                checks.push(url.protocol === "https:" || local
+                    ? { id: "remote-transport", state: "PASS", summary: "Remote memory transport is encrypted or loopback-only" }
+                    : { id: "remote-transport", state: "WARN", summary: "Remote memory transport uses plaintext HTTP", remediation: "Use HTTPS or a separately authenticated private network." });
+            }
+        }
+        catch {
+            checks.push({ id: "remote-transport", state: "FAIL", summary: "Remote memory URL is invalid", remediation: "Set CAIRN_MEMORY_REMOTE_URL to an absolute HTTP or HTTPS URL." });
+        }
+    }
+    const summary = { pass: 0, warn: 0, fail: 0, skip: 0 };
+    for (const check of checks)
+        summary[check.state.toLowerCase()] += 1;
+    return { schema_version: 1, ok: summary.fail === 0, project_root: projectRoot, checks, summary };
+}

package/mcp-memory-server/package.json

@@ -59,9 +59,10 @@
         "check:work-evidence": "node scripts/smoke-work-evidence.mjs",
         "check:okf": "node scripts/smoke-okf.mjs",
         "check:playbook": "node scripts/smoke-playbook.mjs",
+        "check:security-assurance": "node scripts/smoke-security-assurance.mjs",
         "check:notes": "npm run build && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment",
         "test": "npm run test:smoke",
-        "test:smoke": "npm run build && npm run check:embeddings && npm run check:extract && npm run check:scope-guard && npm run check:http-guard && npm run check:remote-context && npm run check:explore-guard && npm run check:explore-cache && npm run check:explore-crossref && npm run check:route-guard && npm run check:reviewed-memory && npm run check:memory-proposals && npm run check:trajectory-roundtrip && npm run check:trajectory-redaction && npm run check:trajectory-retention && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment && npm run check:node-compat && npm run check:typed-nodes && npm run check:memory-import && npm run check:note-mcp && npm run check:node-doctor && npm run check:artifact-store && npm run check:artifact-mcp && npm run check:compaction-capture && npm run check:capability-contract && npm run check:capability-logging && npm run check:capability-harness && npm run check:capability-mcp && npm run check:eval-schema && npm run check:eval-process && npm run check:eval-statistics && npm run check:skill-lifecycle && npm run check:graph-cli && npm run check:mcp-trust && npm run check:pi-mcp-bridge && npm run check:pi-bridge-env && npm run check:pi-bridge-child && npm run check:context-pack && npm run check:context-pack-retrieval && npm run check:context-pack-v216-compat && npm run check:context-usage && npm run check:domain-retrieval && npm run check:retrieval-benchmark && npm run check:work-evidence && npm run check:okf && npm run check:playbook",
+        "test:smoke": "npm run build && npm run check:embeddings && npm run check:extract && npm run check:scope-guard && npm run check:http-guard && npm run check:remote-context && npm run check:explore-guard && npm run check:explore-cache && npm run check:explore-crossref && npm run check:route-guard && npm run check:reviewed-memory && npm run check:memory-proposals && npm run check:trajectory-roundtrip && npm run check:trajectory-redaction && npm run check:trajectory-retention && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment && npm run check:node-compat && npm run check:typed-nodes && npm run check:memory-import && npm run check:note-mcp && npm run check:node-doctor && npm run check:artifact-store && npm run check:artifact-mcp && npm run check:compaction-capture && npm run check:capability-contract && npm run check:capability-logging && npm run check:capability-harness && npm run check:capability-mcp && npm run check:eval-schema && npm run check:eval-process && npm run check:eval-statistics && npm run check:skill-lifecycle && npm run check:graph-cli && npm run check:mcp-trust && npm run check:pi-mcp-bridge && npm run check:pi-bridge-env && npm run check:pi-bridge-child && npm run check:context-pack && npm run check:context-pack-retrieval && npm run check:context-pack-v216-compat && npm run check:context-usage && npm run check:domain-retrieval && npm run check:retrieval-benchmark && npm run check:work-evidence && npm run check:okf && npm run check:playbook && npm run check:security-assurance",
         "test:search": "npm run build && npm run check:search",
         "test:memory": "npm run build && npm run check:embeddings && npm run check:extract && npm run check:search",
         "test:all": "npm run test:memory",
@@ -71,11 +72,11 @@
     "dependencies": {
         "@modelcontextprotocol/sdk": "^1.32.1",
         "agentfs-sdk": "^0.6.4",
-        "yaml": "2.9.0",
-        "zod": "^4.4.3"
+        "yaml": "2.9.1",
+        "zod": "^4.6.5"
     },
     "devDependencies": {
-        "@types/node": "^22.20.1",
+        "@types/node": "^22.20.5",
         "typescript": "^7.0.2"
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cairnkeep/cli",
-    "version": "2.20.0",
+    "version": "2.21.0",
     "description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
     "license": "Apache-2.0",
     "type": "module",
@@ -40,8 +40,8 @@
     "dependencies": {
         "@modelcontextprotocol/sdk": "^1.32.1",
         "agentfs-sdk": "^0.6.4",
-        "yaml": "2.9.0",
-        "zod": "^4.4.3"
+        "yaml": "2.9.1",
+        "zod": "^4.6.5"
     },
     "scripts": {
         "build:server": "npm --prefix mcp-memory-server ci --include=dev --global=false --dry-run=false && npm --prefix mcp-memory-server run build --global=false --dry-run=false",
@@ -50,7 +50,8 @@
         "test": "node scripts/run-repository-tests.mjs",
         "test:windows": "node scripts/test-windows-native.mjs",
         "audit:runtime": "node scripts/verify-dependency-security.mjs && npm audit --omit=dev --audit-level=high && npm --prefix mcp-memory-server audit --omit=dev --audit-level=high",
-        "check:public": "scripts/verify-no-private-references.sh && scripts/verify-docs-parity.sh && npm run audit:runtime && npm run build:server && npm test",
+        "security:baseline": "node scripts/verify-security-baseline.mjs",
+        "check:public": "scripts/verify-no-private-references.sh && scripts/verify-docs-parity.sh && npm run audit:runtime && npm run security:baseline && npm run build:server && npm test",
         "prepublishOnly": "npm run check:public && npm --prefix mcp-memory-server test --global=false --dry-run=false"
     },
     "repository": {

package/scripts/bootstrap.sh

@@ -72,6 +72,7 @@ install_file "$TPL/env.example.template"       "$target/.ai/env.example"       0
 install_file "$TPL/trajectory-redaction.json.template" "$target/.ai/trajectory-redaction.json" 0644
 install_file "$TPL/capabilities.json.template" "$target/.ai/capabilities.json" 0600
 install_file "$TPL/playbooks.json.template" "$target/.ai/playbooks.json" 0600
+chmod 700 "$target/.ai"
 
 if [[ $untracked -eq 0 ]]; then
   node "$CAIRN_ROOT/scripts/playbook-instructions.mjs" "$target" >/dev/null

package/scripts/cairn-cli.mjs

@@ -20,6 +20,7 @@ const NODE_COMMANDS = new Map([
   ["graph", "graph-cli.js"],
   ["evidence", "work-evidence-cli.js"],
   ["playbook", "playbook-cli.js"],
+  ["security", "security-cli.js"],
 ]);
 
 const POSIX_COMMANDS = new Map([
@@ -59,6 +60,7 @@ Usage:
   cairn graph <build|query|status|diff|explain|path>
   cairn evidence <list|show|delete|prune|doctor>
   cairn playbook <list|status|init|set|enable|disable|reset|check|record|receipts|instructions|doctor>
+  cairn security doctor [--project PATH] [--json]
   cairn memory <path|export|import>
   cairn audit-timer [--on-calendar SPEC] [--para-root PATH] [--render-only DIR]
   cairn uninstall [--dry-run] [--yes] [--purge-memory] [--purge-packs] [PROJECT ...]

package/scripts/completion.sh

@@ -13,7 +13,7 @@ _cairn_complete() {
   COMPREPLY=()
   current=${COMP_WORDS[COMP_CWORD]}
   previous=${COMP_WORDS[COMP_CWORD-1]:-}
-  commands="bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help"
+  commands="bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help"
   if (( COMP_CWORD == 1 )); then
     COMPREPLY=( $(compgen -W "$commands" -- "$current") )
     return
@@ -26,6 +26,7 @@ _cairn_complete() {
     sync-kimi) COMPREPLY=( $(compgen -W "--apply --live-root" -- "$current") ) ;;
     sync-omp) COMPREPLY=( $(compgen -W "--apply --live-root" -- "$current") ) ;;
     doctor) COMPREPLY=( $(compgen -W "--repair" -- "$current") ) ;;
+    security) COMPREPLY=( $(compgen -W "doctor --project --json" -- "$current") ) ;;
     trajectory) COMPREPLY=( $(compgen -W "list show prune --json --dry-run" -- "$current") ) ;;
     artifact) COMPREPLY=( $(compgen -W "list show delete prune --kind --session --json --dry-run --include-protected" -- "$current") ) ;;
     evidence) COMPREPLY=( $(compgen -W "list show delete prune doctor --status --json --dry-run --repair" -- "$current") ) ;;
@@ -97,6 +98,7 @@ _cairn() {
     'sync-kimi:install the Kimi graph Skill'
     'sync-omp:install the oh-my-pi memory extension'
     'doctor:check runtime dependencies and endpoints'
+    'security:audit local security posture'
     'trajectory:inspect and prune local session trajectories'
     'artifact:inspect, delete, and prune local artifacts'
     'evidence:inspect and manage local Git-linked work evidence'
@@ -128,6 +130,7 @@ _cairn() {
     sync-kimi) _arguments '--apply[apply changes]' '--live-root[Kimi Code root]:directory:_files -/' ;;
     sync-omp) _arguments '--apply[apply changes]' '--live-root[omp agent root]:directory:_files -/' ;;
     doctor) _arguments '--repair[repair trajectory metadata and indexes]' ;;
+    security) _values 'security command' doctor '--project[project root]:directory:_files -/' '--json[emit JSON]' ;;
     trajectory) _values 'trajectory command' list show prune ;;
     artifact)
       case $words[3] in
@@ -191,8 +194,8 @@ EOF
   fish)
     sed "s/__CAIRN_HARNESSES__/$harnesses/g" <<'EOF'
 complete -c cairn -f
-for command in bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help
-complete -c cairn -n "not __fish_seen_subcommand_from bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help" -a $command
+for command in bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help
+complete -c cairn -n "not __fish_seen_subcommand_from bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help" -a $command
 end
 complete -c cairn -n "__fish_seen_subcommand_from sync" -l apply
 complete -c cairn -n "__fish_seen_subcommand_from sync" -l live-root -r
@@ -211,6 +214,9 @@ complete -c cairn -n "__fish_seen_subcommand_from setup" -l yes
 complete -c cairn -n "__fish_seen_subcommand_from setup" -l json
 complete -c cairn -n "__fish_seen_subcommand_from memory" -a "path export import"
 complete -c cairn -n "__fish_seen_subcommand_from doctor" -l repair
+complete -c cairn -n "__fish_seen_subcommand_from security" -a "doctor"
+complete -c cairn -n "__fish_seen_subcommand_from security" -l project -r
+complete -c cairn -n "__fish_seen_subcommand_from security" -l json
 complete -c cairn -n "__fish_seen_subcommand_from trajectory" -a "list show prune"
 complete -c cairn -n "__fish_seen_subcommand_from artifact" -a "list show delete prune"
 complete -c cairn -n "__fish_seen_subcommand_from artifact; and __fish_seen_subcommand_from list" -l kind -r

package/scripts/setup-reconcile.mjs

@@ -263,6 +263,7 @@ export async function writeSetupStateAtomic(path, state, options = {}) {
   if (!existsSync(target)) throw new Error("Setup state target does not exist.");
   assertExistingAncestors(target, path);
   safeMkdirChain(target, directory);
+  hardenPrivatePath(directory);
   const bytes = Buffer.from(`${JSON.stringify(normalized, null, 2)}\n`, "utf8");
   if (existsSync(path) && readFileSync(path).equals(bytes) && (statSync(path).mode & 0o777) === 0o600) return normalized;
   await atomicWrite(path, bytes, 0o600, options.atomicReplace ?? defaultAtomicReplace, true);
@@ -285,6 +286,8 @@ export async function reconcileSetupPlan(plan, options = {}) {
   for (const asset of selected) assertExistingAncestors(target, asset.destination);
   const statePath = join(target, ".ai", "cairnkeep.json");
   assertExistingAncestors(target, statePath);
+  safeMkdirChain(target, dirname(statePath));
+  hardenPrivatePath(dirname(statePath));
   const previousState = options.previousState === undefined ? readPriorState(statePath) : options.previousState === null ? null : normalizeState(options.previousState);
 
   const decisions = selected.map((asset) => {

package/scripts/test-bootstrap-untracked.sh

@@ -84,6 +84,8 @@ grep -qxF "/.ai/" "$tmp/repo/.git/info/exclude" || fail "missing /.ai/ exclude e
 grep -qxF "/.planning/" "$tmp/repo/.git/info/exclude" || fail "missing /.planning/ exclude entry"
 grep -qxF "/.agentfs/" "$tmp/repo/.git/info/exclude" || fail "missing /.agentfs/ exclude entry"
 [[ -f "$tmp/repo/.ai/capabilities.json" ]] || fail "capability configuration missing"
+node -e 'const fs=require("fs"); const mode=fs.statSync(process.argv[1]).mode & 0o777; if (mode !== 0o700) process.exit(1)' "$tmp/repo/.ai" ||
+  fail ".ai directory must be private mode 0700"
 [[ ! -e "$tmp/repo/.agentfs/trajectory.db" ]] || fail "fresh bootstrap created a callback database"
 
 # Existing scaffold and operator configuration bytes are preserved on rerun.

package/scripts/test-cli-dispatch.sh

@@ -22,6 +22,7 @@ tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT
 "$cairn" help | grep -q "cairn mcp-tools <list|status|set|reset>" || fail "help missing mcp-tools"
 "$cairn" help | grep -q "cairn pack <init|lock|validate|install|list|show|remove|enable|disable|update|skills|approve-skill|revoke-skill>" || fail "help missing pack"
 "$cairn" help | grep -q "cairn graph <build|query|status|diff|explain|path>" || fail "help missing graph"
+"$cairn" help | grep -q "cairn security doctor" || fail "help missing security doctor"
 "$cairn" sync --help >/dev/null 2>&1 || fail "cairn sync dispatch"
 "$cairn" sync-pi --help >/dev/null 2>&1 || fail "cairn sync-pi dispatch"
 "$cairn" sync-kimi --help >/dev/null 2>&1 || fail "cairn sync-kimi dispatch"
@@ -48,6 +49,20 @@ CAIRN_PACK_BASE_DIR="$tmp/pack-store" "$cairn" pack list --json >"$tmp/packs.jso
 node -e 'const v=require(process.argv[1]);if(v.schema_version!==1||!Array.isArray(v.tools))process.exit(1)' "$tmp/mcp-tools.json" || fail "mcp-tools JSON contract"
 node -e 'const v=require(process.argv[1]);if(v.schema_version!==1||!Array.isArray(v.packs))process.exit(1)' "$tmp/packs.json" || fail "pack JSON contract"
 "$cairn" graph --help | grep -q "cairn graph explain <symbol>" || fail "cairn graph dispatch"
+( cd "$tmp" && "$cairn" security doctor --json ) >"$tmp/security.json" || fail "cairn security doctor dispatch"
+node -e 'const v=require(process.argv[1]);if(v.schema_version!==1||v.ok!==true||!Array.isArray(v.checks))process.exit(1)' "$tmp/security.json" || fail "security doctor JSON contract"
+mkdir -m 700 "$tmp/security-project" "$tmp/security-project/.ai"
+printf '%s\n' 'MCP_HTTP_PORT=7801' 'MCP_HTTP_HOST=0.0.0.0' 'CAIRN_MEMORY_HTTP_TOKEN=short' >"$tmp/security-project/.ai/.env"
+chmod 600 "$tmp/security-project/.ai/.env"
+set +e
+env -u MCP_HTTP_PORT -u MCP_HTTP_HOST -u CAIRN_MEMORY_HTTP_TOKEN -u CAIRN_MEMORY_HTTP_TOKEN_FILE \
+  "$cairn" security doctor --project "$tmp/security-project" --json >"$tmp/security-project.json"
+security_status=$?
+set -e
+[[ "$security_status" -eq 1 ]] || fail "project .ai/.env weak token should fail security doctor"
+node -e 'const v=require(process.argv[1]);if(v.checks.find((x)=>x.id==="http-token")?.state!=="FAIL")process.exit(1)' "$tmp/security-project.json" || fail "security doctor ignored project .ai/.env"
+CAIRN_MEMORY_HTTP_TOKEN=ambient-synthetic-token-0123456789abcdef \
+  "$cairn" security doctor --project "$tmp/security-project" --json >"$tmp/security-override.json" || fail "ambient environment should override project .ai/.env"
 grep -qxF 'MCP capability changes require a memory-server restart. Operating capability' "$tmp/capabilities-help" || fail "capability help missing exact restart wording"
 grep -qxF 'changes apply on the next invocation.' "$tmp/capabilities-help" || fail "capability help missing exact invocation wording"
 if grep -Eq '^  cairn capabilities (guard|start|finish|doctor)' "$tmp/capabilities-help"; then
@@ -88,4 +103,4 @@ CAIRN_AGENTFS_BASE_DIR="$tmp/store" "$cairn" memory path | grep -qx "$tmp/store"
 "$cairn" audit-timer --render-only "$tmp/u" >/dev/null || fail "cairn audit-timer dispatch"
 [[ -f "$tmp/u/memory-wiki-audit.timer" ]] || fail "audit-timer render via cairn produced no units"
 
-echo "PASS: cairn dispatch (doctor, memory, artifact, evidence, audit-timer)"
+echo "PASS: cairn dispatch (doctor, security, memory, artifact, evidence, audit-timer)"

package/scripts/test-completion.sh

@@ -46,6 +46,8 @@ for shell in bash zsh fish; do
   grep -q 'mcp-tools' "$tmp/$shell"
   grep -q 'full.*read-only.*custom\|full read-only custom' "$tmp/$shell"
   grep -q 'pack' "$tmp/$shell"
+  grep -q 'security' "$tmp/$shell"
+  grep -q -- '--project\|-l project' "$tmp/$shell"
   grep -q 'init.*lock.*validate.*install.*list.*show.*remove.*enable.*disable.*update.*skills.*approve-skill.*revoke-skill.*doctor\|init lock validate install list show remove enable disable update skills approve-skill revoke-skill doctor' "$tmp/$shell"
   grep -q -- '--repair\|-l repair' "$tmp/$shell"
   grep -q 'proposals' "$tmp/$shell"
@@ -84,6 +86,7 @@ grep -qF 'cairn skill <harvest|list|show|review|propose|evaluate|apply|rollback>
 grep -qF 'cairn evidence <list|show|delete|prune|doctor>' "$tmp/root-help"
 grep -qF 'cairn playbook <list|status|init|set|enable|disable|reset|check|record|receipts|instructions|doctor>' "$tmp/root-help"
 grep -qF 'cairn proposals <create|list|show|apply|doctor>' "$tmp/root-help"
+grep -qF 'cairn security doctor [--project PATH] [--json]' "$tmp/root-help"
 node "$ROOT/mcp-memory-server/dist/skill-cli.js" --help >"$tmp/skill-help"
 for command in $skill_commands; do
   grep -q "cairn skill $command" "$tmp/skill-help"

package/scripts/test-container-runner.sh

@@ -65,6 +65,13 @@ fi
 grep -Fq "mode 400 or 600" "$tmp/err"
 chmod 600 "$token"
 
+env -u CAIRN_MEMORY_HTTP_TOKEN CAIRN_MEMORY_HTTP_TOKEN_FILE="$token" \
+  "$ROOT/containers/entrypoint.sh" sh -c \
+  'test "$CAIRN_MEMORY_HTTP_TOKEN" = token && test -z "${CAIRN_MEMORY_HTTP_TOKEN_FILE:-}"' || {
+    echo "FAIL: container entrypoint did not canonicalize the token source" >&2
+    exit 1
+  }
+
 run_launcher workspace --repo "$repo" --image example/workspace:1 \
   --workspace-volume example-workspace -- echo sandbox
 has_arg "$repo:/source:ro,Z"

package/scripts/test-launcher-env-precedence.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+project="$tmp/project"
+fake_bin="$tmp/bin"
+mkdir -p "$project/.ai" "$fake_bin"
+cp "$ROOT/templates/start-codex.sh.template" "$project/.ai/start-codex.sh"
+chmod +x "$project/.ai/start-codex.sh"
+cat > "$project/.ai/.env" <<'EOF'
+CAIRN_PRECEDENCE_TEST=file
+CAIRN_FILE_ONLY=file-only
+EOF
+chmod 600 "$project/.ai/.env"
+cat > "$fake_bin/codex" <<'EOF'
+#!/usr/bin/env bash
+printf '%s|%s\n' "$CAIRN_PRECEDENCE_TEST" "$CAIRN_FILE_ONLY"
+EOF
+chmod +x "$fake_bin/codex"
+
+output=$(PATH="$fake_bin:$PATH" CAIRN_PRECEDENCE_TEST=ambient "$project/.ai/start-codex.sh")
+[[ "$output" == "ambient|file-only" ]] || {
+  echo "FAIL: launcher environment precedence drifted: $output" >&2
+  exit 1
+}
+
+echo "PASS: POSIX launcher keeps ambient overrides and adds project-only values"

package/scripts/test-learning-docs.sh

@@ -166,4 +166,23 @@ grep -qF 'course-13-playbooks' "$coverage"
 grep -qF 'L25-playbooks.md' docs/learning/tracks/practitioner.md
 grep -qF 'L25-playbooks.md' docs/learning/tracks/operator.md
 
+l28=docs/learning/lessons/L28-security-assurance.md
+video28=docs/learning/video-scripts/V28-security-assurance.md
+for file in "$l28" "$video28" docs/security-assurance.md; do
+  [[ -f "$file" ]]
+done
+grep -qF "Tested with:** Cairnkeep $version" "$l28"
+for phrase in \
+  'cairn security doctor --project' \
+  'npm run security:baseline' \
+  'check:security-assurance' \
+  'check:http-guard' \
+  'not a certification'; do
+  grep -qF -- "$phrase" "$l28" || {
+    echo "L28 missing security-assurance boundary: $phrase" >&2
+    exit 1
+  }
+done
+grep -qF '`cairn security` | L28' "$coverage"
+
 echo "PASS: public learning path structure, readiness, links, and version alignment"

package/scripts/test-security-baseline.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+node "$ROOT/scripts/verify-security-baseline.mjs"