@cairnkeep/cli 2.20.1 → 2.21.0

package/docs/security-assurance.md

@@ -0,0 +1,122 @@
+# Security assurance and threat model
+
+This document describes Cairnkeep's security boundaries, the controls that
+enforce them, and the risks that remain. It is an engineering contract, not a
+certification. Report suspected vulnerabilities through the private process in
+[SECURITY.md](../SECURITY.md).
+
+## Security objectives
+
+Cairnkeep aims to:
+
+- keep project memory, local evidence, credentials, and approvals scoped to the
+  intended project and operator;
+- make network exposure explicit, authenticated, bounded, and closed by
+  default;
+- prevent persisted portable paths from changing meaning across POSIX and
+  Windows;
+- separate read-only observation from mutation and require explicit enablement
+  for optional authority;
+- make releases traceable to one reviewed Git tree with pinned build actions,
+  dependency checks, an SBOM, and provenance.
+
+Availability of the host, secrecy after an operating-system account compromise,
+and correctness of an external model or harness are outside those objectives.
+
+## Assets and trust boundaries
+
+| Asset | Boundary | Principal controls |
+|---|---|---|
+| Project memory and local evidence | Project root and `.agentfs/` | Canonical project identity, contained paths, private files, scoped stores |
+| Credentials and endpoint configuration | Process environment and `.ai/.env` | Local-only defaults, private-file checks, redacted diagnostics |
+| MCP mutation authority | Effective tool catalog | Complete tool annotations, capability gates, read-only/custom profiles |
+| Remote MCP transport | Authenticated HTTP listener | Fail-closed bearer auth, Host allowlist, opt-in CORS, body/header/time limits |
+| Context-pack and skill content | Immutable digest-pinned objects | Portable path validation, content digests, explicit enablement and skill approval |
+| Release artifacts | Reviewed Git tree and GitHub Actions | SHA-pinned actions, dependency review, CodeQL, SBOM, checksums and provenance |
+
+The local stdio server trusts the account that launches it and the selected
+project directory. An authenticated HTTP deployment is one trusted storage
+domain: project-routing headers select a store but are not a user ACL. Harness
+plugins and external retrieval/model services are separate principals and must
+be enabled and evaluated independently.
+
+## Threats and mitigations
+
+| Threat | Mitigation and verification | Residual risk |
+|---|---|---|
+| Traversal, alternate separators, drive paths, ADS, forbidden Windows characters/device aliases, invalid Unicode, or case collisions in portable data | One cross-platform path validator is used by context packs, OKF, artifacts, and evaluations; deterministic adversarial cases run in the smoke suite | Filesystems can have additional locale- or mount-specific semantics; containment checks remain required at every write |
+| Symlink or special-file substitution | Canonical roots, non-symlink regular-file checks, atomic replacement, and existing symlink/race regression tests | A hostile process running as the same account can race or replace resources outside Cairnkeep's process boundary |
+| Unauthenticated or rebound HTTP access | HTTP refuses to start without a token, compares it in constant time, validates `Host`, denies CORS by default, and bounds headers, request time, keep-alive time, and bodies to 8 MiB | Bearer tokens are not user identities; deploy TLS at the ingress for non-loopback traffic |
+| Excessive MCP authority | Explicit MCP annotations, restrictive profiles, capability intersection, and separate HTTP consent for sensitive optional tools | The default profile remains `full` for compatibility; operators should choose `read-only` or `custom` for observation-only clients |
+| Malicious repository or context content influencing an agent | Memory results are locators, skills need digest-bound approval, pack content stays read-only, and maintained source must be verified | Prompt injection is not solved; the harness/model must continue treating retrieved text as untrusted data |
+| Credential leakage through diagnostics | Security diagnostics report only presence, strength, file safety, and transport posture; tests assert token values never appear | A compromised process or account can read its own environment and files |
+| Dependency or CI compromise | Production audits, dependency review, CodeQL, advisory Scorecard, selected Actions, mandatory full-SHA pins, release-candidate checks, SBOMs and attestations | These controls reduce risk but do not prove dependency or publisher authenticity |
+
+## Local posture check
+
+Run the read-only check from a configured project:
+
+```sh
+cairn security doctor --project .
+cairn security doctor --project . --json
+```
+
+The command inspects project-root canonicalization and its immediate replacement
+boundary, private managed files, the
+effective MCP profile, HTTP token strength and token-file permissions, Host
+allowlisting, least authority, and remote-transport encryption. It reads token
+length, repetition, and header-safe syntax only; it never emits token content. `FAIL` makes the
+command exit non-zero. `WARN` is an explicit risk decision and does not fail;
+`SKIP` means the corresponding optional surface is disabled or absent.
+
+HTTP Bearer values must use the RFC-compatible ASCII token alphabet
+(`A-Z`, `a-z`, digits, `-._~+/`, with optional trailing `=`). Controls,
+whitespace, Unicode, and multiline values fail closed before the listener starts.
+
+The selected project's `.ai/.env` is parsed as literal assignments without
+execution through a descriptor-bound 64 KiB read; ambient variables override
+file values, and the generated launchers preserve that precedence. Relative
+token-file paths are resolved from the selected project.
+Symlinked `.ai` directories, replaceable project roots, unsafe private files,
+and ambiguous shell expressions fail closed. POSIX checks require trusted
+ownership as well as restrictive mode bits; an unquoted value is limited to a
+small non-shell metacharacter alphabet, so quote values containing spaces or
+punctuation.
+
+`cairn doctor` remains the operational dependency/store check. Run both before
+exposing HTTP, after changing tool authority, and before a security-sensitive
+release.
+
+## Repository and release controls
+
+The public repository enables dependency vulnerability alerts and automated
+security updates, secret scanning with push protection, selected GitHub
+Actions, and required full-length action SHA pins. Pull requests run CodeQL and
+dependency review. OpenSSF Scorecard runs on the default branch as advisory
+evidence; it is not an authorization oracle.
+
+The release workflow consumes the already-tested candidate for the exact Git
+tree. It verifies the candidate manifest and checksums, publishes npm with
+provenance, produces CycloneDX 1.6 and container SBOMs, and attests container
+provenance. A digest proves content integrity, not publisher identity; verify
+the repository, release tag, registry namespace, and provenance together.
+
+## Deliberate non-goals and residual risks
+
+- Cairnkeep is not a sandbox, endpoint-security product, secret manager, TLS
+  terminator, or multi-user authorization service.
+- It cannot make a malicious harness, model, plugin, repository, or retrieved
+  document trustworthy.
+- Local databases are protected by operating-system permissions, not
+  application-level encryption.
+- Same-account processes and host administrators remain trusted.
+- Security checks are point-in-time evidence. Re-run them after configuration,
+  dependency, network, or filesystem changes.
+
+## Verification evidence
+
+The maintained gates are `npm run security:baseline`, both production
+`npm audit` checks, `scripts/test-security-baseline.sh`, the memory-server
+security-assurance and HTTP-guard smoke tests, native-Windows tests, and the
+complete public test matrix. The baseline gate also rejects
+`pull_request_target` and every unpinned non-local GitHub Action.

package/examples/eval/bundled-fake.json

@@ -1 +1 @@
-{"identifier":"cairn-offline-fake-v1","package_version":"2.20.1","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}
+{"identifier":"cairn-offline-fake-v1","package_version":"2.21.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}

package/mcp-memory-server/dist/artifact-schema.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
-import { isAbsolute } from "node:path";
 import { z } from "zod";
 import { nodePathSchema } from "./node-schema.js";
+import { portableRelativePathIssue } from "./path-security.js";
 export const ARTIFACT_SCHEMA_VERSION = 1;
 export const ARTIFACT_KINDS = [
     "compaction_summary",
@@ -63,13 +63,8 @@ export const testOutputContentSchema = z.object({
     status: z.enum(["passed", "failed", "unknown"]).optional(),
 }).strict();
 export const generatedFilePathLabelSchema = z.string().min(1).max(1024).superRefine((value, context) => {
-    if (isAbsolute(value) || value.startsWith("/") || value.endsWith("/") || value.includes("\\") || /[\u0000-\u001f\u007f]/.test(value)) {
+    if (portableRelativePathIssue(value)) {
         context.addIssue({ code: "custom", message: "Generated-file path label must be project-relative." });
-        return;
-    }
-    const segments = value.split("/");
-    if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) {
-        context.addIssue({ code: "custom", message: "Generated-file path label contains an invalid segment." });
     }
 });
 export const generatedFileInputContentSchema = z.object({

package/mcp-memory-server/dist/context-pack.js

@@ -1,15 +1,16 @@
 import { execFile } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
-import { chmod, cp, mkdir, mkdtemp, open, readdir, readFile, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
+import { constants, existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
+import { chmod, mkdir, mkdtemp, open, readdir, readFile, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { z } from "zod";
 import { EmbeddingCache, cosineSimilarity, embedTexts, getEmbeddingConfig, hashText } from "./embeddings.js";
 import { doctorProgressiveContextCache, loadProgressiveContext, publicTree, selectHierarchicalFiles, } from "./context-pack-retrieval.js";
-import { indexOkfBundle, validateOkfBundle } from "./okf.js";
+import { indexOkfBundle, validateOkfBundle, validatedOkfFileContent } from "./okf.js";
 import { atomicReplace, hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
+import { portablePathCollisionKey, portableRelativePathIssue } from "./path-security.js";
 const execFileAsync = promisify(execFile);
 export const CONTEXT_PACK_MANIFEST = "context-pack.json";
 export const CONTEXT_PACK_MAX_FILE_BYTES = 1024 * 1024;
@@ -41,6 +42,7 @@ export const contextPackManifestSchema = z.object({
     }).strict().optional(),
     files: z.array(contextPackFileSchema).max(CONTEXT_PACK_MAX_ENTRIES),
 }).strict();
+const validatedPackContent = new WeakMap();
 function sha256(...parts) {
     const hash = createHash("sha256");
     for (const part of parts)
@@ -57,7 +59,7 @@ function objectRoot(digest) {
     return join(packBaseDir(), "objects", digest);
 }
 function normalizePackPath(value) {
-    if (!value || value.includes("\\") || isAbsolute(value) || value.split("/").some((part) => part === "" || part === "." || part === "..")) {
+    if (portableRelativePathIssue(value)) {
         throw new Error(`Unsafe context pack path: ${value}`);
     }
     return value;
@@ -116,18 +118,43 @@ async function walkFiles(root, directory = root) {
     }
     for (const entry of (await readdir(directory, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name, "en"))) {
         const absolute = join(directory, entry.name);
-        const relativePath = relative(root, absolute).split(sep).join("/");
+        const rawPath = relative(root, absolute).split(sep).join("/");
+        const canonicalPath = rawPath.normalize("NFC");
         if (entry.isSymbolicLink())
-            throw new Error(`Context packs may not contain symlinks: ${relativePath}`);
+            throw new Error(`Context packs may not contain symlinks: ${canonicalPath}`);
         if (entry.isDirectory())
             result.push(...await walkFiles(root, absolute));
         else if (entry.isFile())
-            result.push(relativePath);
+            result.push({ raw_path: rawPath, canonical_path: canonicalPath });
         else
-            throw new Error(`Context packs may contain regular files only: ${relativePath}`);
+            throw new Error(`Context packs may contain regular files only: ${canonicalPath}`);
     }
     return result;
 }
+async function physicalPackInventory(root) {
+    const files = await walkFiles(root);
+    if (files.length > CONTEXT_PACK_MAX_ENTRIES + 1)
+        throw new Error("Context pack exceeds the entry limit.");
+    const byCanonical = new Map();
+    const portable = new Map();
+    for (const physical of files) {
+        if (portableRelativePathIssue(physical.canonical_path))
+            throw new Error(`Unsafe context pack path: ${physical.canonical_path}`);
+        const portableKey = portablePathCollisionKey(physical.canonical_path);
+        const previous = portable.get(portableKey);
+        if (previous)
+            throw new Error(`Duplicate portable context pack path: ${previous}, ${physical.raw_path}`);
+        portable.set(portableKey, physical.raw_path);
+        byCanonical.set(physical.canonical_path, physical);
+    }
+    return { files, by_canonical: byCanonical };
+}
+function physicalPath(root, file) {
+    const absolute = resolve(root, ...file.raw_path.split("/"));
+    if (!contained(root, absolute))
+        throw new Error(`Unsafe context pack path: ${file.canonical_path}`);
+    return absolute;
+}
 export async function validateContextPack(directory) {
     const requestedRoot = resolve(directory);
     const requestedInfo = lstatSync(requestedRoot);
@@ -140,28 +167,32 @@ export async function validateContextPack(directory) {
     if (!rootInfo.isDirectory() || lstatSync(root).isSymbolicLink())
         throw new Error("Context pack source must be a real directory.");
     const manifestPath = join(root, CONTEXT_PACK_MANIFEST);
-    const manifestInfo = lstatSync(manifestPath);
-    if (!manifestInfo.isFile() || manifestInfo.isSymbolicLink() || manifestInfo.size > CONTEXT_PACK_MAX_FILE_BYTES)
-        throw new Error("Context pack manifest is unsafe.");
-    const manifestBytes = await readFile(manifestPath);
+    const manifestBytes = await readBoundedPackFile(manifestPath, CONTEXT_PACK_MANIFEST);
     assertUtf8(manifestBytes, CONTEXT_PACK_MANIFEST);
     const manifest = contextPackManifestSchema.parse(JSON.parse(manifestBytes.toString("utf8")));
+    const inventory = await physicalPackInventory(root);
+    const physicalByCanonical = inventory.by_canonical;
     const declared = new Set();
+    const portableDeclared = new Set();
     let totalBytes = manifestBytes.byteLength;
     const hash = createHash("sha256").update(manifestBytes).update("\0");
     const content = new Map();
     for (const file of manifest.files) {
         const normalized = normalizePackPath(file.path);
-        if (normalized === CONTEXT_PACK_MANIFEST || declared.has(normalized))
+        const portableKey = portablePathCollisionKey(normalized);
+        if (portableKey === portablePathCollisionKey(CONTEXT_PACK_MANIFEST)
+            || declared.has(normalized) || portableDeclared.has(portableKey)) {
             throw new Error(`Duplicate or reserved context pack path: ${normalized}`);
+        }
         declared.add(normalized);
-        const absolute = resolve(root, normalized);
+        portableDeclared.add(portableKey);
+        const physical = physicalByCanonical.get(normalized);
+        if (!physical)
+            throw new Error(`Context pack file declaration mismatch; missing: ${normalized}`);
+        const absolute = physicalPath(root, physical);
         if (!contained(root, absolute))
             throw new Error(`Unsafe context pack path: ${normalized}`);
-        const info = lstatSync(absolute);
-        if (!info.isFile() || info.isSymbolicLink() || info.size > CONTEXT_PACK_MAX_FILE_BYTES)
-            throw new Error(`Context pack file is unsafe or too large: ${normalized}`);
-        const bytes = await readFile(absolute);
+        const bytes = await readBoundedPackFile(absolute, normalized);
         assertUtf8(bytes, normalized);
         if (sha256(bytes) !== file.sha256)
             throw new Error(`Context pack digest mismatch: ${normalized}`);
@@ -170,16 +201,18 @@ export async function validateContextPack(directory) {
             throw new Error("Context pack exceeds the total size limit.");
         content.set(normalized, bytes);
     }
-    const actual = (await walkFiles(root)).filter((path) => path !== CONTEXT_PACK_MANIFEST);
+    const actual = inventory.files.map(({ canonical_path }) => canonical_path).filter((path) => path !== CONTEXT_PACK_MANIFEST);
     const undeclared = actual.filter((path) => !declared.has(path));
-    const missing = [...declared].filter((path) => !actual.includes(path));
+    const missing = [...declared].filter((path) => !physicalByCanonical.has(path));
     if (undeclared.length || missing.length)
         throw new Error(`Context pack file declaration mismatch${undeclared.length ? `; undeclared: ${undeclared.join(", ")}` : ""}${missing.length ? `; missing: ${missing.join(", ")}` : ""}`);
     for (const path of [...declared].sort((a, b) => a.localeCompare(b, "en"))) {
         const bytes = content.get(path);
         hash.update(path, "utf8").update("\0").update(bytes).update("\0");
     }
-    return { root, manifest, manifest_bytes: manifestBytes, digest: hash.digest("hex"), total_bytes: totalBytes };
+    const validated = { root, manifest, manifest_bytes: manifestBytes, digest: hash.digest("hex"), total_bytes: totalBytes };
+    validatedPackContent.set(validated, content);
+    return validated;
 }
 async function atomicJson(path, value) {
     await mkdir(dirname(path), { recursive: true, mode: 0o700 });
@@ -210,6 +243,41 @@ async function atomicJson(path, value) {
         await rm(temporary, { force: true });
     }
 }
+async function readBoundedPackFile(path, label) {
+    const unsafeMessage = label === CONTEXT_PACK_MANIFEST
+        ? "Context pack manifest is unsafe or too large."
+        : `Context pack file is unsafe or too large: ${label}`;
+    let handle;
+    try {
+        const nonBlocking = process.platform === "win32" ? 0 : (constants.O_NONBLOCK ?? 0);
+        handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | nonBlocking);
+        const opened = await handle.stat();
+        if (!opened.isFile() || opened.size > CONTEXT_PACK_MAX_FILE_BYTES)
+            throw new Error(unsafeMessage);
+        const buffer = Buffer.allocUnsafe(opened.size + 1);
+        let offset = 0;
+        while (offset < buffer.byteLength) {
+            const { bytesRead } = await handle.read(buffer, offset, buffer.byteLength - offset, null);
+            if (bytesRead === 0)
+                break;
+            offset += bytesRead;
+        }
+        const bytes = buffer.subarray(0, offset);
+        const afterRead = await handle.stat();
+        const named = lstatSync(path);
+        if (named.isSymbolicLink() || !named.isFile()
+            || opened.dev !== afterRead.dev || opened.ino !== afterRead.ino || opened.size !== afterRead.size
+            || opened.mtimeMs !== afterRead.mtimeMs || opened.ctimeMs !== afterRead.ctimeMs
+            || opened.dev !== named.dev || opened.ino !== named.ino
+            || bytes.byteLength !== afterRead.size || bytes.byteLength > CONTEXT_PACK_MAX_FILE_BYTES) {
+            throw new Error(`Context pack file changed while it was being read: ${label}`);
+        }
+        return bytes;
+    }
+    finally {
+        await handle?.close();
+    }
+}
 async function makeImmutable(root) {
     const directories = [];
     const walk = async (directory) => {
@@ -344,7 +412,18 @@ async function publishContextPack(pack, source) {
     const temporary = join(objects, `.${pack.digest}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
     let published = true;
     try {
-        await cp(pack.root, temporary, { recursive: true, errorOnExist: true, force: false });
+        await mkdir(temporary, { mode: 0o700 });
+        await writeFile(join(temporary, CONTEXT_PACK_MANIFEST), pack.manifest_bytes, { mode: 0o600, flag: "wx" });
+        const content = validatedPackContent.get(pack);
+        if (!content)
+            throw new Error("Context pack validation bytes are unavailable.");
+        for (const [path, bytes] of content) {
+            const target = resolve(temporary, ...path.split("/"));
+            if (!contained(temporary, target))
+                throw new Error(`Unsafe context pack publication path: ${path}`);
+            await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+            await writeFile(target, bytes, { mode: 0o600, flag: "wx" });
+        }
         const copied = await validateContextPack(temporary);
         if (copied.digest !== pack.digest)
             throw new Error("Context pack changed during installation.");
@@ -388,12 +467,11 @@ async function prepareOkfContextPack(sourceRoot, options) {
         const okf = await validateOkfBundle(sourceRoot);
         await mkdir(staging, { recursive: true, mode: 0o700 });
         for (const file of okf.files) {
-            const source = resolve(okf.root, ...file.path.split("/"));
             const target = resolve(staging, ...file.path.split("/"));
-            if (!contained(okf.root, source) || !contained(staging, target))
+            if (!contained(staging, target))
                 throw new Error(`Unsafe OKF path: ${file.path}`);
             await mkdir(dirname(target), { recursive: true, mode: 0o700 });
-            await cp(source, target, { errorOnExist: true, force: false });
+            await writeFile(target, validatedOkfFileContent(okf, file.path), { mode: 0o600, flag: "wx" });
         }
         const title = options.title?.trim() || okf.files.find(({ path }) => path === "index.md")?.title || options.id;
         const description = options.description?.trim() || `Imported Open Knowledge Format ${okf.version} bundle.`;
@@ -1216,30 +1294,73 @@ export async function initializeContextPack(directory, options) {
     if (existsSync(manifestPath))
         throw new Error("Context pack manifest already exists.");
     const id = options.id ?? basename(root).toLocaleLowerCase("en").replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-    const files = (await walkFiles(root)).filter((path) => path !== CONTEXT_PACK_MANIFEST);
+    const inventory = await physicalPackInventory(root);
+    const files = inventory.files.filter(({ canonical_path }) => canonical_path !== CONTEXT_PACK_MANIFEST);
+    if (files.length > CONTEXT_PACK_MAX_ENTRIES)
+        throw new Error("Context pack exceeds the entry limit.");
     const entries = [];
-    for (const path of files) {
-        const bytes = await readFile(join(root, path));
+    let totalBytes = 0;
+    for (const file of files) {
+        const path = file.canonical_path;
+        if (portablePathCollisionKey(path) === portablePathCollisionKey(CONTEXT_PACK_MANIFEST)) {
+            throw new Error(`Duplicate or reserved context pack path: ${path}`);
+        }
+        const source = physicalPath(root, file);
+        const bytes = await readBoundedPackFile(source, path);
         assertUtf8(bytes, path);
+        totalBytes += bytes.byteLength;
+        if (totalBytes > CONTEXT_PACK_MAX_TOTAL_BYTES)
+            throw new Error("Context pack exceeds the total size limit.");
         entries.push({ path, kind: "document", title: basename(path).replace(/\.[^.]+$/, ""), description: "", keywords: [], sha256: sha256(bytes) });
     }
     const manifest = contextPackManifestSchema.parse({ schema_version: 1, id, version: options.version ?? "0.1.0", title: options.title ?? id, description: options.description ?? `Context pack ${id}`, license: options.license ?? "UNLICENSED", files: entries });
+    const manifestBytes = Buffer.from(`${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+    if (manifestBytes.byteLength > CONTEXT_PACK_MAX_FILE_BYTES || totalBytes + manifestBytes.byteLength > CONTEXT_PACK_MAX_TOTAL_BYTES) {
+        throw new Error("Context pack manifest or total pack exceeds the size limit.");
+    }
     await atomicJson(manifestPath, manifest);
     return manifest;
 }
 export async function lockContextPack(directory) {
-    const path = join(resolve(directory), CONTEXT_PACK_MANIFEST);
-    const value = contextPackManifestSchema.parse(JSON.parse(await readFile(path, "utf8")));
+    const root = resolve(directory);
+    const path = join(root, CONTEXT_PACK_MANIFEST);
+    const manifestBytes = await readBoundedPackFile(path, CONTEXT_PACK_MANIFEST);
+    const value = contextPackManifestSchema.parse(JSON.parse(manifestBytes.toString("utf8")));
+    const inventory = await physicalPackInventory(root);
+    const actual = new Set(inventory.files.map(({ canonical_path }) => canonical_path).filter((candidate) => candidate !== CONTEXT_PACK_MANIFEST));
+    const declared = new Set();
+    const portableDeclared = new Set();
     const files = [];
+    let contentBytes = 0;
     for (const entry of value.files) {
         const normalized = normalizePackPath(entry.path);
-        const bytes = await readFile(join(resolve(directory), normalized));
+        const portableKey = portablePathCollisionKey(normalized);
+        if (portableKey === portablePathCollisionKey(CONTEXT_PACK_MANIFEST) || declared.has(normalized) || portableDeclared.has(portableKey)) {
+            throw new Error(`Duplicate or reserved context pack path: ${normalized}`);
+        }
+        declared.add(normalized);
+        portableDeclared.add(portableKey);
+        const physical = inventory.by_canonical.get(normalized);
+        if (!physical)
+            throw new Error(`Context pack file declaration mismatch; missing: ${normalized}`);
+        const source = physicalPath(root, physical);
+        const bytes = await readBoundedPackFile(source, normalized);
         assertUtf8(bytes, normalized);
         if (bytes.byteLength > CONTEXT_PACK_MAX_FILE_BYTES)
             throw new Error(`Context pack file is too large: ${normalized}`);
+        contentBytes += bytes.byteLength;
+        if (contentBytes > CONTEXT_PACK_MAX_TOTAL_BYTES)
+            throw new Error("Context pack exceeds the total size limit.");
         files.push({ ...entry, sha256: sha256(bytes) });
     }
+    const undeclared = [...actual].filter((candidate) => !declared.has(candidate));
+    if (undeclared.length)
+        throw new Error(`Context pack file declaration mismatch; undeclared: ${undeclared.join(", ")}`);
     const locked = { ...value, files };
+    const lockedBytes = Buffer.from(`${JSON.stringify(locked, null, 2)}\n`, "utf8");
+    if (lockedBytes.byteLength > CONTEXT_PACK_MAX_FILE_BYTES || contentBytes + lockedBytes.byteLength > CONTEXT_PACK_MAX_TOTAL_BYTES) {
+        throw new Error("Context pack manifest or total pack exceeds the size limit.");
+    }
     await atomicJson(path, locked);
     await validateContextPack(directory);
     return locked;

package/mcp-memory-server/dist/eval-schema.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
-import { isAbsolute } from "node:path";
 import { z } from "zod";
 import { CAPABILITY_IDS, capabilityIdSchema } from "./capability-schema.js";
+import { portablePathCollisionKey, portableRelativePathIssue } from "./path-security.js";
 export const EVAL_SCHEMA_VERSION = 1;
 export const EVAL_ADAPTER_RESULT_STATUSES = ["completed", "adapter_error"];
 export const EVAL_OBSERVATION_TERMINAL_STATES = [
@@ -30,13 +30,13 @@ const boundedTextSchema = z.string().max(MAX_TEXT_BYTES);
 const nonnegativeIntegerSchema = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
 const positiveIntegerSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
 export const evalRelativePathSchema = z.string().min(1).max(1024).superRefine((value, context) => {
-    if (isAbsolute(value) || value.startsWith("/") || value.endsWith("/") || value.includes("\\") || /[\u0000-\u001f\u007f]/.test(value)) {
+    if (portableRelativePathIssue(value, { allowCurrentDirectory: true })) {
         context.addIssue({ code: "custom", message: "Evaluation paths must be relative canonical paths." });
-        return;
     }
-    const segments = value.split("/");
-    if (segments.some((segment) => segment === "" || segment === "..")) {
-        context.addIssue({ code: "custom", message: "Evaluation path contains an invalid segment." });
+});
+export const evalFileRelativePathSchema = z.string().min(1).max(1024).superRefine((value, context) => {
+    if (portableRelativePathIssue(value)) {
+        context.addIssue({ code: "custom", message: "Evaluation file paths must be relative canonical file paths." });
     }
 });
 export const evalCommandSchema = z.strictObject({
@@ -53,7 +53,7 @@ const gitSourceSchema = z.strictObject({
     revision: commitSchema,
 });
 const bundledFileSchema = z.strictObject({
-    path: evalRelativePathSchema,
+    path: evalFileRelativePathSchema,
     content: z.string().max(256 * 1024),
 });
 const bundledFakeSourceSchema = z.strictObject({
@@ -62,10 +62,11 @@ const bundledFakeSourceSchema = z.strictObject({
     files: z.array(bundledFileSchema).min(1).max(1024).superRefine((files, context) => {
         const seen = new Set();
         for (const [index, file] of files.entries()) {
-            if (seen.has(file.path)) {
-                context.addIssue({ code: "custom", path: [index, "path"], message: "Bundled file paths must be unique." });
+            const key = portablePathCollisionKey(file.path);
+            if (seen.has(key)) {
+                context.addIssue({ code: "custom", path: [index, "path"], message: "Bundled file paths must be portably unique." });
             }
-            seen.add(file.path);
+            seen.add(key);
         }
     }),
 });
@@ -116,7 +117,7 @@ export const evalAdapterRequestSchema = z.strictObject({
     limits: evalLimitsSchema,
     seed: z.string().min(1).max(256),
     expected_capability_digest: digestSchema,
-    output_path: evalRelativePathSchema,
+    output_path: evalFileRelativePathSchema,
 });
 const usageSchema = z.strictObject({
     input_tokens: nonnegativeIntegerSchema.optional(),
@@ -168,7 +169,7 @@ const verifierObservationSchema = z.strictObject({
     reason: valueFreeCodeSchema.nullable(),
 });
 const noteSnapshotEntrySchema = z.strictObject({
-    path: evalRelativePathSchema,
+    path: evalFileRelativePathSchema,
     digest: digestSchema,
     bytes: nonnegativeIntegerSchema,
 });

package/mcp-memory-server/dist/http-security.js

@@ -0,0 +1,104 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from "node:fs";
+import { resolve } from "node:path";
+import { privatePathIsSafe } from "./platform-security.js";
+export function bearerTokenIsSafe(token) {
+    return /^[A-Za-z0-9._~+/-]+=*$/.test(token);
+}
+export function normalizeHttpHost(raw) {
+    return raw?.trim() || "127.0.0.1";
+}
+export function parseHttpPort(raw) {
+    if (raw === undefined || raw === "")
+        return { enabled: false };
+    if (!/^[1-9][0-9]{0,4}$/.test(raw))
+        return { enabled: false, error: "invalid" };
+    const port = Number(raw);
+    return port <= 65535 ? { enabled: true, port } : { enabled: false, error: "invalid" };
+}
+export function formatHostAuthority(host, port) {
+    const normalized = host.trim();
+    return `${normalized.includes(":") && !normalized.startsWith("[") ? `[${normalized}]` : normalized}:${port}`;
+}
+export function normalizeHostAuthority(raw, defaultPort) {
+    if (!raw || raw.trim() !== raw || /[/\\@]/.test(raw))
+        return undefined;
+    const explicit = /^\[([^\]]+)\]:([0-9]+)$/.exec(raw) ?? /^([^:]+):([0-9]+)$/.exec(raw);
+    const implicit = defaultPort === undefined ? undefined : /^\[([^\]]+)\]$/.exec(raw) ?? /^([^:]+)$/.exec(raw);
+    const match = explicit ?? implicit;
+    if (!match)
+        return undefined;
+    const port = parseHttpPort(explicit ? match[2] : String(defaultPort));
+    if (!port.enabled || "error" in port)
+        return undefined;
+    try {
+        const bracketed = raw.startsWith("[");
+        const parsed = new URL(`http://${bracketed ? `[${match[1]}]` : match[1]}/`);
+        if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash)
+            return undefined;
+        return `${parsed.hostname}:${port.port}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readBoundedDescriptor(descriptor, approvedSize) {
+    const buffer = Buffer.allocUnsafe(approvedSize + 1);
+    let offset = 0;
+    while (offset < buffer.byteLength) {
+        const bytesRead = readSync(descriptor, buffer, offset, buffer.byteLength - offset, null);
+        if (bytesRead === 0)
+            break;
+        offset += bytesRead;
+    }
+    return buffer.subarray(0, offset);
+}
+export function resolveHttpToken(env, options = {}) {
+    const direct = env.CAIRN_MEMORY_HTTP_TOKEN?.trim();
+    const rawFile = env.CAIRN_MEMORY_HTTP_TOKEN_FILE?.trim();
+    if (direct && rawFile)
+        return { ok: false, reason: "multiple", file: rawFile };
+    if (direct)
+        return bearerTokenIsSafe(direct)
+            ? { ok: true, source: "environment", token: direct }
+            : { ok: false, reason: "token-unsafe" };
+    if (!rawFile)
+        return { ok: false, reason: "missing" };
+    const file = resolve(options.baseDirectory ?? process.cwd(), rawFile);
+    let descriptor;
+    try {
+        const nonBlocking = process.platform === "win32" ? 0 : (constants.O_NONBLOCK ?? 0);
+        descriptor = openSync(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | nonBlocking);
+        const opened = fstatSync(descriptor);
+        if (!opened.isFile() || opened.size > 64 * 1024)
+            return { ok: false, reason: "file-unsafe", file };
+        const tokenBytes = readBoundedDescriptor(descriptor, opened.size);
+        const afterRead = fstatSync(descriptor);
+        const named = lstatSync(file);
+        if (named.isSymbolicLink() || !named.isFile()
+            || opened.dev !== afterRead.dev || opened.ino !== afterRead.ino || opened.size !== afterRead.size
+            || opened.mtimeMs !== afterRead.mtimeMs || opened.ctimeMs !== afterRead.ctimeMs
+            || opened.dev !== named.dev || opened.ino !== named.ino
+            || tokenBytes.byteLength !== afterRead.size || tokenBytes.byteLength > 64 * 1024) {
+            return { ok: false, reason: "file-changed", file };
+        }
+        if (!privatePathIsSafe(file))
+            return { ok: false, reason: "file-unsafe", file };
+        const namedAfterAcl = lstatSync(file);
+        if (namedAfterAcl.dev !== opened.dev || namedAfterAcl.ino !== opened.ino || namedAfterAcl.isSymbolicLink()) {
+            return { ok: false, reason: "file-changed", file };
+        }
+        const token = tokenBytes.toString("utf8").trim();
+        return bearerTokenIsSafe(token)
+            ? { ok: true, source: "file", token, file }
+            : { ok: false, reason: "token-unsafe", file };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { ok: false, reason: "file-missing", file };
+        return { ok: false, reason: "file-unreadable", file };
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
+}