@cairnkeep/cli 2.20.1 → 2.21.1

package/mcp-memory-server/dist/security-cli.js

@@ -0,0 +1,46 @@
+import { securityDoctor } from "./security-doctor.js";
+import { projectEnvironment } from "./project-environment.js";
+function usage(exitCode = 2) {
+    process.stderr.write("Usage: cairn security doctor [--project PATH] [--json]\n");
+    process.exit(exitCode);
+}
+function option(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0)
+        return undefined;
+    const value = args[index + 1];
+    if (!value || value.startsWith("--"))
+        usage();
+    args.splice(index, 2);
+    return value;
+}
+const args = process.argv.slice(2);
+const command = args.shift();
+if (["help", "--help", "-h"].includes(command ?? ""))
+    usage(0);
+if (command !== "doctor")
+    usage();
+const jsonIndex = args.indexOf("--json");
+const json = jsonIndex >= 0;
+if (json)
+    args.splice(jsonIndex, 1);
+const projectRoot = option(args, "--project") ?? process.cwd();
+if (args.length)
+    usage();
+const loaded = projectEnvironment(projectRoot, process.env);
+const report = securityDoctor({ projectRoot, env: loaded.env, environmentIssue: loaded.issue });
+if (json) {
+    process.stdout.write(`${JSON.stringify(report)}\n`);
+}
+else {
+    process.stdout.write("cairn security doctor\n");
+    for (const check of report.checks) {
+        process.stdout.write(`  [${check.state}] ${check.summary}\n`);
+        if (check.remediation && check.state !== "PASS" && check.state !== "SKIP") {
+            process.stdout.write(`         ${check.remediation}\n`);
+        }
+    }
+    process.stdout.write(`Summary: ${report.summary.pass} pass, ${report.summary.warn} warn, ${report.summary.fail} fail, ${report.summary.skip} skip\n`);
+}
+if (!report.ok)
+    process.exitCode = 1;

package/mcp-memory-server/dist/security-doctor.js

@@ -0,0 +1,211 @@
+import { lstatSync, realpathSync } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
+import { normalizeHostAuthority, normalizeHttpHost, parseHttpPort, resolveHttpToken } from "./http-security.js";
+import { resolveMcpToolProfile } from "./mcp-tool-profile.js";
+import { parentReplacementBoundaryIsSafe, posixPrivateMetadataIsSafe, privatePathIsSafe, replacementBoundaryIsSafe } from "./platform-security.js";
+const PRIVATE_PROJECT_FILES = [
+    ".ai/.env",
+    ".ai/capabilities.json",
+    ".ai/mcp-tools.json",
+    ".ai/playbooks.json",
+];
+function loopbackHost(host) {
+    const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
+    return normalized === "127.0.0.1" || normalized === "localhost" || normalized === "::1";
+}
+function tokenStrength(token) {
+    const bytes = Buffer.byteLength(token.trim(), "utf8");
+    if (bytes === 0)
+        return "missing";
+    if (bytes < 32 || /^(.)(?:\1)+$/.test(token.trim()))
+        return "weak";
+    return "ok";
+}
+function lstatIfPresent(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+function checkPrivateDirectory(projectRoot) {
+    const path = join(projectRoot, ".ai");
+    const info = lstatIfPresent(path);
+    if (!info)
+        return { id: "private-directory:.ai", state: "SKIP", summary: ".ai is not present" };
+    const safePermissions = process.platform === "win32"
+        ? privatePathIsSafe(path)
+        : posixPrivateMetadataIsSafe(info) && (Number(info.mode) & 0o700) === 0o700;
+    if (!info.isDirectory() || info.isSymbolicLink() || !safePermissions) {
+        return { id: "private-directory:.ai", state: "FAIL", summary: ".ai is symlinked, non-directory, inaccessible, or not private to a trusted owner", remediation: process.platform === "win32" ? "Restrict .ai to the current account and remove inherited access." : "Replace symlinks, restore trusted ownership, and run: chmod 700 .ai" };
+    }
+    return { id: "private-directory:.ai", state: "PASS", summary: ".ai is a real directory not writable by other accounts" };
+}
+function checkPrivateFile(projectRoot, relativePath, safeParent) {
+    const path = join(projectRoot, ...relativePath.split("/"));
+    if (!safeParent)
+        return { id: `private-file:${relativePath}`, state: "SKIP", summary: `${relativePath} was not followed through an unsafe .ai directory` };
+    let info;
+    try {
+        info = lstatIfPresent(path);
+    }
+    catch {
+        return { id: `private-file:${relativePath}`, state: "FAIL", summary: `${relativePath} metadata is inaccessible`, remediation: "Restore trusted ownership and private directory traversal permissions." };
+    }
+    if (!info)
+        return { id: `private-file:${relativePath}`, state: "SKIP", summary: `${relativePath} is not present` };
+    if (!info.isFile() || info.isSymbolicLink() || !privatePathIsSafe(path)) {
+        return {
+            id: `private-file:${relativePath}`,
+            state: "FAIL",
+            summary: `${relativePath} is not a private regular file`,
+            remediation: process.platform === "win32"
+                ? `Restrict ${relativePath} to the current account and remove inherited access.`
+                : `Run: chmod 600 ${relativePath}`,
+        };
+    }
+    return { id: `private-file:${relativePath}`, state: "PASS", summary: `${relativePath} is private and non-symlinked` };
+}
+function sameFileIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino && left.isDirectory() === right.isDirectory();
+}
+export function securityDoctor(options = {}) {
+    const env = options.env ?? process.env;
+    const requestedRoot = resolve(options.projectRoot ?? process.cwd());
+    const checks = [];
+    let projectRoot = requestedRoot;
+    let projectRootTrusted = false;
+    let requestedInfo;
+    try {
+        requestedInfo = lstatIfPresent(requestedRoot);
+    }
+    catch {
+        checks.push({ id: "project-root", state: "FAIL", summary: "Project root metadata is inaccessible", remediation: "Restore trusted ownership and directory traversal permissions." });
+    }
+    if (!requestedInfo) {
+        if (!checks.some(({ id }) => id === "project-root"))
+            checks.push({ id: "project-root", state: "FAIL", summary: "Project root does not exist", remediation: "Run the command from a real project directory." });
+    }
+    else {
+        const info = requestedInfo;
+        if (!info.isDirectory() || info.isSymbolicLink() || !replacementBoundaryIsSafe(requestedRoot)) {
+            checks.push({ id: "project-root", state: "FAIL", summary: "Project root is symlinked, non-directory, or writable by another account", remediation: process.platform === "win32" ? "Use a project directory whose ACL denies replacement by untrusted accounts." : "Use a canonical project directory and run: chmod go-w ." });
+        }
+        else if (!parentReplacementBoundaryIsSafe(requestedRoot)) {
+            checks.push({ id: "project-root-parent", state: "FAIL", summary: "The requested project parent directory can replace the selected project root", remediation: "Move the project below an owner-controlled directory or restrict the parent directory permissions." });
+        }
+        else {
+            try {
+                options.testBeforeCanonicalize?.();
+                const canonical = realpathSync(requestedRoot);
+                const requestedAfter = lstatSync(requestedRoot);
+                const canonicalInfo = lstatSync(canonical);
+                if (requestedAfter.isSymbolicLink() || !sameFileIdentity(info, requestedAfter) || !sameFileIdentity(info, canonicalInfo)
+                    || !parentReplacementBoundaryIsSafe(canonical))
+                    throw new Error("project identity changed");
+                projectRoot = canonical;
+                projectRootTrusted = true;
+                checks.push({ id: "project-root", state: "PASS", summary: "Project root and its immediate replacement boundary are protected" });
+            }
+            catch {
+                checks.push({ id: "project-root", state: "FAIL", summary: "Project root identity or canonical location changed during inspection", remediation: "Retry after placing the project below an owner-controlled, non-symlink directory." });
+            }
+            if (projectRootTrusted) {
+                const directoryCheck = checkPrivateDirectory(projectRoot);
+                checks.push(directoryCheck);
+                for (const file of PRIVATE_PROJECT_FILES)
+                    checks.push(checkPrivateFile(projectRoot, file, directoryCheck.state !== "FAIL"));
+            }
+        }
+    }
+    if (options.environmentIssue)
+        checks.push({ id: "project-environment", state: "FAIL", summary: "Project .ai/.env could not be interpreted safely", remediation: options.environmentIssue });
+    else
+        checks.push({ id: "project-environment", state: "PASS", summary: "Project environment uses supported literal assignments or is absent" });
+    let profileMode;
+    if (!projectRootTrusted) {
+        checks.push({ id: "mcp-profile", state: "SKIP", summary: "MCP tool profile was not read through an unsafe project root" });
+    }
+    else {
+        try {
+            const profile = resolveMcpToolProfile({ projectRoot, env });
+            profileMode = profile.mode;
+            checks.push({ id: "mcp-profile", state: "PASS", summary: `MCP tool profile is valid (${profile.mode})` });
+        }
+        catch {
+            checks.push({ id: "mcp-profile", state: "FAIL", summary: "MCP tool profile is invalid or unsafe", remediation: "Run: cairn mcp-tools status --project ." });
+        }
+    }
+    const portResolution = parseHttpPort(env.MCP_HTTP_PORT);
+    if ("error" in portResolution) {
+        checks.push({ id: "http-exposure", state: "FAIL", summary: "MCP_HTTP_PORT is invalid", remediation: "Unset MCP_HTTP_PORT or choose a canonical decimal port from 1 through 65535." });
+    }
+    else if (!portResolution.enabled) {
+        checks.push({ id: "http-exposure", state: "SKIP", summary: "MCP HTTP transport is disabled" });
+    }
+    else {
+        const port = portResolution.port;
+        const host = normalizeHttpHost(env.MCP_HTTP_HOST);
+        const resolution = !projectRootTrusted && env.CAIRN_MEMORY_HTTP_TOKEN_FILE && !isAbsolute(env.CAIRN_MEMORY_HTTP_TOKEN_FILE)
+            ? { ok: false, reason: "unsafe-base" }
+            : resolveHttpToken(env, { baseDirectory: projectRoot });
+        let token;
+        if (resolution.ok) {
+            token = resolution.token;
+            if (resolution.source === "file")
+                checks.push({ id: "http-token-file", state: "PASS", summary: "HTTP token file is private and non-symlinked" });
+        }
+        else if (resolution.reason !== "missing") {
+            const id = resolution.reason === "multiple" ? "http-token-source"
+                : resolution.reason === "token-unsafe" ? "http-token"
+                    : "http-token-file";
+            checks.push({ id, state: "FAIL", summary: `HTTP token resolution failed (${resolution.reason})`, remediation: "Set exactly one token source and use a readable, private, non-symlink token file with an ASCII Bearer token." });
+        }
+        const strength = tokenStrength(token ?? "");
+        checks.push(strength === "ok"
+            ? { id: "http-token", state: "PASS", summary: "HTTP bearer token meets the minimum length" }
+            : { id: "http-token", state: "FAIL", summary: strength === "missing" ? "HTTP bearer token is missing" : "HTTP bearer token is too weak", remediation: "Generate at least 32 random bytes; for example: openssl rand -hex 32" });
+        const nonLoopback = !loopbackHost(host);
+        const hosts = (env.CAIRN_MEMORY_HTTP_ALLOWED_HOSTS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
+        const invalidHosts = hosts.filter((value) => !normalizeHostAuthority(value));
+        checks.push(invalidHosts.length > 0
+            ? { id: "http-host-allowlist", state: "FAIL", summary: "HTTP Host allowlist contains an invalid authority", remediation: `Use host:port authorities matching port ${port}; bracket IPv6 literals.` }
+            : nonLoopback && hosts.length === 0
+                ? { id: "http-host-allowlist", state: "WARN", summary: "Non-loopback HTTP binding relies on the derived Host allowlist", remediation: "Set CAIRN_MEMORY_HTTP_ALLOWED_HOSTS explicitly to the public host names and ports." }
+                : { id: "http-host-allowlist", state: "PASS", summary: nonLoopback ? "Non-loopback HTTP binding has an explicit Host allowlist" : "HTTP binding is loopback-only" });
+        if (nonLoopback && profileMode === "full") {
+            checks.push({ id: "http-least-authority", state: "WARN", summary: "Network HTTP exposure uses the full MCP tool profile", remediation: "Use CAIRN_MCP_TOOL_PROFILE=read-only or an explicit custom allowlist when mutations are unnecessary." });
+        }
+        else {
+            checks.push({ id: "http-least-authority", state: "PASS", summary: "HTTP exposure and MCP tool authority are bounded" });
+        }
+    }
+    const remote = env.CAIRN_MEMORY_REMOTE_URL?.trim();
+    if (!remote) {
+        checks.push({ id: "remote-transport", state: "SKIP", summary: "Remote memory endpoint is not configured" });
+    }
+    else {
+        try {
+            const url = new URL(remote);
+            if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) {
+                checks.push({ id: "remote-transport", state: "FAIL", summary: "Remote memory URL has an unsafe scheme or embedded credentials", remediation: "Use an HTTP(S) URL and provide credentials through the supported secret environment variable." });
+            }
+            else {
+                const local = loopbackHost(url.hostname);
+                checks.push(url.protocol === "https:" || local
+                    ? { id: "remote-transport", state: "PASS", summary: "Remote memory transport is encrypted or loopback-only" }
+                    : { id: "remote-transport", state: "WARN", summary: "Remote memory transport uses plaintext HTTP", remediation: "Use HTTPS or a separately authenticated private network." });
+            }
+        }
+        catch {
+            checks.push({ id: "remote-transport", state: "FAIL", summary: "Remote memory URL is invalid", remediation: "Set CAIRN_MEMORY_REMOTE_URL to an absolute HTTP or HTTPS URL." });
+        }
+    }
+    const summary = { pass: 0, warn: 0, fail: 0, skip: 0 };
+    for (const check of checks)
+        summary[check.state.toLowerCase()] += 1;
+    return { schema_version: 1, ok: summary.fail === 0, project_root: projectRoot, checks, summary };
+}

package/mcp-memory-server/package.json

@@ -59,9 +59,10 @@
         "check:work-evidence": "node scripts/smoke-work-evidence.mjs",
         "check:okf": "node scripts/smoke-okf.mjs",
         "check:playbook": "node scripts/smoke-playbook.mjs",
+        "check:security-assurance": "node scripts/smoke-security-assurance.mjs",
         "check:notes": "npm run build && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment",
         "test": "npm run test:smoke",
-        "test:smoke": "npm run build && npm run check:embeddings && npm run check:extract && npm run check:scope-guard && npm run check:http-guard && npm run check:remote-context && npm run check:explore-guard && npm run check:explore-cache && npm run check:explore-crossref && npm run check:route-guard && npm run check:reviewed-memory && npm run check:memory-proposals && npm run check:trajectory-roundtrip && npm run check:trajectory-redaction && npm run check:trajectory-retention && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment && npm run check:node-compat && npm run check:typed-nodes && npm run check:memory-import && npm run check:note-mcp && npm run check:node-doctor && npm run check:artifact-store && npm run check:artifact-mcp && npm run check:compaction-capture && npm run check:capability-contract && npm run check:capability-logging && npm run check:capability-harness && npm run check:capability-mcp && npm run check:eval-schema && npm run check:eval-process && npm run check:eval-statistics && npm run check:skill-lifecycle && npm run check:graph-cli && npm run check:mcp-trust && npm run check:pi-mcp-bridge && npm run check:pi-bridge-env && npm run check:pi-bridge-child && npm run check:context-pack && npm run check:context-pack-retrieval && npm run check:context-pack-v216-compat && npm run check:context-usage && npm run check:domain-retrieval && npm run check:retrieval-benchmark && npm run check:work-evidence && npm run check:okf && npm run check:playbook",
+        "test:smoke": "npm run build && node scripts/run-smoke-suite.mjs",
         "test:search": "npm run build && npm run check:search",
         "test:memory": "npm run build && npm run check:embeddings && npm run check:extract && npm run check:search",
         "test:all": "npm run test:memory",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cairnkeep/cli",
-    "version": "2.20.1",
+    "version": "2.21.1",
     "description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
     "license": "Apache-2.0",
     "type": "module",
@@ -50,7 +50,8 @@
         "test": "node scripts/run-repository-tests.mjs",
         "test:windows": "node scripts/test-windows-native.mjs",
         "audit:runtime": "node scripts/verify-dependency-security.mjs && npm audit --omit=dev --audit-level=high && npm --prefix mcp-memory-server audit --omit=dev --audit-level=high",
-        "check:public": "scripts/verify-no-private-references.sh && scripts/verify-docs-parity.sh && npm run audit:runtime && npm run build:server && npm test",
+        "security:baseline": "node scripts/verify-security-baseline.mjs",
+        "check:public": "scripts/verify-no-private-references.sh && scripts/verify-docs-parity.sh && npm run audit:runtime && npm run security:baseline && npm run build:server && npm test",
         "prepublishOnly": "npm run check:public && npm --prefix mcp-memory-server test --global=false --dry-run=false"
     },
     "repository": {

package/scripts/bootstrap.sh

@@ -72,6 +72,7 @@ install_file "$TPL/env.example.template"       "$target/.ai/env.example"       0
 install_file "$TPL/trajectory-redaction.json.template" "$target/.ai/trajectory-redaction.json" 0644
 install_file "$TPL/capabilities.json.template" "$target/.ai/capabilities.json" 0600
 install_file "$TPL/playbooks.json.template" "$target/.ai/playbooks.json" 0600
+chmod 700 "$target/.ai"
 
 if [[ $untracked -eq 0 ]]; then
   node "$CAIRN_ROOT/scripts/playbook-instructions.mjs" "$target" >/dev/null

package/scripts/cairn-cli.mjs

@@ -20,6 +20,7 @@ const NODE_COMMANDS = new Map([
   ["graph", "graph-cli.js"],
   ["evidence", "work-evidence-cli.js"],
   ["playbook", "playbook-cli.js"],
+  ["security", "security-cli.js"],
 ]);
 
 const POSIX_COMMANDS = new Map([
@@ -59,6 +60,7 @@ Usage:
   cairn graph <build|query|status|diff|explain|path>
   cairn evidence <list|show|delete|prune|doctor>
   cairn playbook <list|status|init|set|enable|disable|reset|check|record|receipts|instructions|doctor>
+  cairn security doctor [--project PATH] [--json]
   cairn memory <path|export|import>
   cairn audit-timer [--on-calendar SPEC] [--para-root PATH] [--render-only DIR]
   cairn uninstall [--dry-run] [--yes] [--purge-memory] [--purge-packs] [PROJECT ...]

package/scripts/completion.sh

@@ -13,7 +13,7 @@ _cairn_complete() {
   COMPREPLY=()
   current=${COMP_WORDS[COMP_CWORD]}
   previous=${COMP_WORDS[COMP_CWORD-1]:-}
-  commands="bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help"
+  commands="bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help"
   if (( COMP_CWORD == 1 )); then
     COMPREPLY=( $(compgen -W "$commands" -- "$current") )
     return
@@ -26,6 +26,7 @@ _cairn_complete() {
     sync-kimi) COMPREPLY=( $(compgen -W "--apply --live-root" -- "$current") ) ;;
     sync-omp) COMPREPLY=( $(compgen -W "--apply --live-root" -- "$current") ) ;;
     doctor) COMPREPLY=( $(compgen -W "--repair" -- "$current") ) ;;
+    security) COMPREPLY=( $(compgen -W "doctor --project --json" -- "$current") ) ;;
     trajectory) COMPREPLY=( $(compgen -W "list show prune --json --dry-run" -- "$current") ) ;;
     artifact) COMPREPLY=( $(compgen -W "list show delete prune --kind --session --json --dry-run --include-protected" -- "$current") ) ;;
     evidence) COMPREPLY=( $(compgen -W "list show delete prune doctor --status --json --dry-run --repair" -- "$current") ) ;;
@@ -97,6 +98,7 @@ _cairn() {
     'sync-kimi:install the Kimi graph Skill'
     'sync-omp:install the oh-my-pi memory extension'
     'doctor:check runtime dependencies and endpoints'
+    'security:audit local security posture'
     'trajectory:inspect and prune local session trajectories'
     'artifact:inspect, delete, and prune local artifacts'
     'evidence:inspect and manage local Git-linked work evidence'
@@ -128,6 +130,7 @@ _cairn() {
     sync-kimi) _arguments '--apply[apply changes]' '--live-root[Kimi Code root]:directory:_files -/' ;;
     sync-omp) _arguments '--apply[apply changes]' '--live-root[omp agent root]:directory:_files -/' ;;
     doctor) _arguments '--repair[repair trajectory metadata and indexes]' ;;
+    security) _values 'security command' doctor '--project[project root]:directory:_files -/' '--json[emit JSON]' ;;
     trajectory) _values 'trajectory command' list show prune ;;
     artifact)
       case $words[3] in
@@ -191,8 +194,8 @@ EOF
   fish)
     sed "s/__CAIRN_HARNESSES__/$harnesses/g" <<'EOF'
 complete -c cairn -f
-for command in bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help
-complete -c cairn -n "not __fish_seen_subcommand_from bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help" -a $command
+for command in bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help
+complete -c cairn -n "not __fish_seen_subcommand_from bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help" -a $command
 end
 complete -c cairn -n "__fish_seen_subcommand_from sync" -l apply
 complete -c cairn -n "__fish_seen_subcommand_from sync" -l live-root -r
@@ -211,6 +214,9 @@ complete -c cairn -n "__fish_seen_subcommand_from setup" -l yes
 complete -c cairn -n "__fish_seen_subcommand_from setup" -l json
 complete -c cairn -n "__fish_seen_subcommand_from memory" -a "path export import"
 complete -c cairn -n "__fish_seen_subcommand_from doctor" -l repair
+complete -c cairn -n "__fish_seen_subcommand_from security" -a "doctor"
+complete -c cairn -n "__fish_seen_subcommand_from security" -l project -r
+complete -c cairn -n "__fish_seen_subcommand_from security" -l json
 complete -c cairn -n "__fish_seen_subcommand_from trajectory" -a "list show prune"
 complete -c cairn -n "__fish_seen_subcommand_from artifact" -a "list show delete prune"
 complete -c cairn -n "__fish_seen_subcommand_from artifact; and __fish_seen_subcommand_from list" -l kind -r

package/scripts/doctor.sh

@@ -36,15 +36,31 @@ fail() { printf '  [FAIL] %s\n' "$1"; fails=$((fails + 1)); }
 # reachable); a connect/timeout failure returns non-zero.
 reachable() { curl -sS -m 5 -o /dev/null "$1" >/dev/null 2>&1; }
 
+embedding_failure="request failed"
 embedding_works() {
-  local payload
+  local payload http_status curl_status
   payload=$(node -e 'process.stdout.write(JSON.stringify({ model: process.argv[1], input: ["cairnkeep health check"] }))' \
     "$CAIRN_MEMORY_EMBEDDING_MODEL") || return 1
-  curl -fsS -m 10 -o /dev/null \
+  http_status=$(curl -sS -m 10 -o /dev/null -w '%{http_code}' \
     -H "Authorization: Bearer $CAIRN_LLM_API_KEY" \
     -H "Content-Type: application/json" \
     --data "$payload" \
-    "${CAIRN_MEMORY_EMBEDDING_URL%/}/embeddings" >/dev/null 2>&1
+    "${CAIRN_MEMORY_EMBEDDING_URL%/}/embeddings" 2>/dev/null)
+  curl_status=$?
+  if [[ $curl_status -ne 0 ]]; then
+    embedding_failure="transport failed"
+    return 1
+  fi
+  case "$http_status" in
+    2??) return 0 ;;
+    401|403) embedding_failure="authorization rejected (HTTP $http_status)" ;;
+    404) embedding_failure="endpoint or model not found (HTTP 404)" ;;
+    408|429) embedding_failure="temporarily unavailable (HTTP $http_status)" ;;
+    5??) embedding_failure="upstream service failed (HTTP $http_status)" ;;
+    [0-9][0-9][0-9]) embedding_failure="request failed (HTTP $http_status)" ;;
+    *) embedding_failure="request failed" ;;
+  esac
+  return 1
 }
 
 echo "cairn doctor"
@@ -90,7 +106,7 @@ if [[ -n "${CAIRN_MEMORY_EMBEDDING_URL:-}" ]]; then
   elif embedding_works; then
     pass "embedding endpoint accepted model ${CAIRN_MEMORY_EMBEDDING_MODEL} (${CAIRN_MEMORY_EMBEDDING_URL})"
   else
-    fail "embedding request failed for model ${CAIRN_MEMORY_EMBEDDING_MODEL} (${CAIRN_MEMORY_EMBEDDING_URL})"
+    fail "embedding ${embedding_failure} for model ${CAIRN_MEMORY_EMBEDDING_MODEL} (${CAIRN_MEMORY_EMBEDDING_URL})"
   fi
 else
   skip "embedding endpoint (CAIRN_MEMORY_EMBEDDING_URL unset)"

package/scripts/setup-reconcile.mjs

@@ -263,6 +263,7 @@ export async function writeSetupStateAtomic(path, state, options = {}) {
   if (!existsSync(target)) throw new Error("Setup state target does not exist.");
   assertExistingAncestors(target, path);
   safeMkdirChain(target, directory);
+  hardenPrivatePath(directory);
   const bytes = Buffer.from(`${JSON.stringify(normalized, null, 2)}\n`, "utf8");
   if (existsSync(path) && readFileSync(path).equals(bytes) && (statSync(path).mode & 0o777) === 0o600) return normalized;
   await atomicWrite(path, bytes, 0o600, options.atomicReplace ?? defaultAtomicReplace, true);
@@ -285,6 +286,8 @@ export async function reconcileSetupPlan(plan, options = {}) {
   for (const asset of selected) assertExistingAncestors(target, asset.destination);
   const statePath = join(target, ".ai", "cairnkeep.json");
   assertExistingAncestors(target, statePath);
+  safeMkdirChain(target, dirname(statePath));
+  hardenPrivatePath(dirname(statePath));
   const previousState = options.previousState === undefined ? readPriorState(statePath) : options.previousState === null ? null : normalizeState(options.previousState);
 
   const decisions = selected.map((asset) => {

package/scripts/test-bootstrap-untracked.sh

@@ -84,6 +84,8 @@ grep -qxF "/.ai/" "$tmp/repo/.git/info/exclude" || fail "missing /.ai/ exclude e
 grep -qxF "/.planning/" "$tmp/repo/.git/info/exclude" || fail "missing /.planning/ exclude entry"
 grep -qxF "/.agentfs/" "$tmp/repo/.git/info/exclude" || fail "missing /.agentfs/ exclude entry"
 [[ -f "$tmp/repo/.ai/capabilities.json" ]] || fail "capability configuration missing"
+node -e 'const fs=require("fs"); const mode=fs.statSync(process.argv[1]).mode & 0o777; if (mode !== 0o700) process.exit(1)' "$tmp/repo/.ai" ||
+  fail ".ai directory must be private mode 0700"
 [[ ! -e "$tmp/repo/.agentfs/trajectory.db" ]] || fail "fresh bootstrap created a callback database"
 
 # Existing scaffold and operator configuration bytes are preserved on rerun.

package/scripts/test-ci-sharding.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+node --input-type=module - "$ROOT" <<'NODE'
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const root = process.argv[2];
+const { buildShardPlan, smokeChecks } = await import(
+  pathToFileURL(join(root, "mcp-memory-server", "scripts", "run-smoke-suite.mjs")));
+const plan = buildShardPlan(3);
+const flattened = plan.flatMap(({ checks }) => checks.map(({ name }) => name));
+assert.equal(flattened.length, smokeChecks.length);
+assert.equal(new Set(flattened).size, smokeChecks.length);
+assert.deepEqual([...flattened].sort(), smokeChecks.map(({ name }) => name).sort());
+assert.ok(plan.every(({ checks }) => checks.length > 0));
+const weights = plan.map(({ weight }) => weight);
+assert.ok(Math.max(...weights) - Math.min(...weights) <= 5,
+  `native Windows shards are imbalanced: ${weights.join(", ")}`);
+
+const pkg = JSON.parse(readFileSync(join(root, "mcp-memory-server", "package.json"), "utf8"));
+assert.match(pkg.scripts["test:smoke"], /run-smoke-suite\.mjs/);
+const workflow = readFileSync(join(root, ".github", "workflows", "ci.yml"), "utf8");
+assert.match(workflow, /name: native-windows \(\$\{\{ matrix\.node \}\}\)/);
+for (const shard of ["1/3", "2/3", "3/3"]) assert.ok(workflow.includes(`shard: "${shard}"`));
+assert.match(workflow, /run-smoke-suite\.mjs --shard \$\{\{ matrix\.shard \}\}/);
+assert.doesNotMatch(workflow.match(/  native-windows:[\s\S]*?\n  repository:/)?.[0] ?? "",
+  /npm --prefix mcp-memory-server test/);
+console.log(`PASS: ${smokeChecks.length} memory-server contracts split once across balanced Windows shards (${weights.join(", ")})`);
+NODE

package/scripts/test-cli-dispatch.sh

@@ -22,6 +22,7 @@ tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT
 "$cairn" help | grep -q "cairn mcp-tools <list|status|set|reset>" || fail "help missing mcp-tools"
 "$cairn" help | grep -q "cairn pack <init|lock|validate|install|list|show|remove|enable|disable|update|skills|approve-skill|revoke-skill>" || fail "help missing pack"
 "$cairn" help | grep -q "cairn graph <build|query|status|diff|explain|path>" || fail "help missing graph"
+"$cairn" help | grep -q "cairn security doctor" || fail "help missing security doctor"
 "$cairn" sync --help >/dev/null 2>&1 || fail "cairn sync dispatch"
 "$cairn" sync-pi --help >/dev/null 2>&1 || fail "cairn sync-pi dispatch"
 "$cairn" sync-kimi --help >/dev/null 2>&1 || fail "cairn sync-kimi dispatch"
@@ -48,6 +49,20 @@ CAIRN_PACK_BASE_DIR="$tmp/pack-store" "$cairn" pack list --json >"$tmp/packs.jso
 node -e 'const v=require(process.argv[1]);if(v.schema_version!==1||!Array.isArray(v.tools))process.exit(1)' "$tmp/mcp-tools.json" || fail "mcp-tools JSON contract"
 node -e 'const v=require(process.argv[1]);if(v.schema_version!==1||!Array.isArray(v.packs))process.exit(1)' "$tmp/packs.json" || fail "pack JSON contract"
 "$cairn" graph --help | grep -q "cairn graph explain <symbol>" || fail "cairn graph dispatch"
+( cd "$tmp" && "$cairn" security doctor --json ) >"$tmp/security.json" || fail "cairn security doctor dispatch"
+node -e 'const v=require(process.argv[1]);if(v.schema_version!==1||v.ok!==true||!Array.isArray(v.checks))process.exit(1)' "$tmp/security.json" || fail "security doctor JSON contract"
+mkdir -m 700 "$tmp/security-project" "$tmp/security-project/.ai"
+printf '%s\n' 'MCP_HTTP_PORT=7801' 'MCP_HTTP_HOST=0.0.0.0' 'CAIRN_MEMORY_HTTP_TOKEN=short' >"$tmp/security-project/.ai/.env"
+chmod 600 "$tmp/security-project/.ai/.env"
+set +e
+env -u MCP_HTTP_PORT -u MCP_HTTP_HOST -u CAIRN_MEMORY_HTTP_TOKEN -u CAIRN_MEMORY_HTTP_TOKEN_FILE \
+  "$cairn" security doctor --project "$tmp/security-project" --json >"$tmp/security-project.json"
+security_status=$?
+set -e
+[[ "$security_status" -eq 1 ]] || fail "project .ai/.env weak token should fail security doctor"
+node -e 'const v=require(process.argv[1]);if(v.checks.find((x)=>x.id==="http-token")?.state!=="FAIL")process.exit(1)' "$tmp/security-project.json" || fail "security doctor ignored project .ai/.env"
+CAIRN_MEMORY_HTTP_TOKEN=ambient-synthetic-token-0123456789abcdef \
+  "$cairn" security doctor --project "$tmp/security-project" --json >"$tmp/security-override.json" || fail "ambient environment should override project .ai/.env"
 grep -qxF 'MCP capability changes require a memory-server restart. Operating capability' "$tmp/capabilities-help" || fail "capability help missing exact restart wording"
 grep -qxF 'changes apply on the next invocation.' "$tmp/capabilities-help" || fail "capability help missing exact invocation wording"
 if grep -Eq '^  cairn capabilities (guard|start|finish|doctor)' "$tmp/capabilities-help"; then
@@ -88,4 +103,4 @@ CAIRN_AGENTFS_BASE_DIR="$tmp/store" "$cairn" memory path | grep -qx "$tmp/store"
 "$cairn" audit-timer --render-only "$tmp/u" >/dev/null || fail "cairn audit-timer dispatch"
 [[ -f "$tmp/u/memory-wiki-audit.timer" ]] || fail "audit-timer render via cairn produced no units"
 
-echo "PASS: cairn dispatch (doctor, memory, artifact, evidence, audit-timer)"
+echo "PASS: cairn dispatch (doctor, security, memory, artifact, evidence, audit-timer)"

package/scripts/test-completion.sh

@@ -46,6 +46,8 @@ for shell in bash zsh fish; do
   grep -q 'mcp-tools' "$tmp/$shell"
   grep -q 'full.*read-only.*custom\|full read-only custom' "$tmp/$shell"
   grep -q 'pack' "$tmp/$shell"
+  grep -q 'security' "$tmp/$shell"
+  grep -q -- '--project\|-l project' "$tmp/$shell"
   grep -q 'init.*lock.*validate.*install.*list.*show.*remove.*enable.*disable.*update.*skills.*approve-skill.*revoke-skill.*doctor\|init lock validate install list show remove enable disable update skills approve-skill revoke-skill doctor' "$tmp/$shell"
   grep -q -- '--repair\|-l repair' "$tmp/$shell"
   grep -q 'proposals' "$tmp/$shell"
@@ -84,6 +86,7 @@ grep -qF 'cairn skill <harvest|list|show|review|propose|evaluate|apply|rollback>
 grep -qF 'cairn evidence <list|show|delete|prune|doctor>' "$tmp/root-help"
 grep -qF 'cairn playbook <list|status|init|set|enable|disable|reset|check|record|receipts|instructions|doctor>' "$tmp/root-help"
 grep -qF 'cairn proposals <create|list|show|apply|doctor>' "$tmp/root-help"
+grep -qF 'cairn security doctor [--project PATH] [--json]' "$tmp/root-help"
 node "$ROOT/mcp-memory-server/dist/skill-cli.js" --help >"$tmp/skill-help"
 for command in $skill_commands; do
   grep -q "cairn skill $command" "$tmp/skill-help"

package/scripts/test-container-runner.sh

@@ -65,6 +65,13 @@ fi
 grep -Fq "mode 400 or 600" "$tmp/err"
 chmod 600 "$token"
 
+env -u CAIRN_MEMORY_HTTP_TOKEN CAIRN_MEMORY_HTTP_TOKEN_FILE="$token" \
+  "$ROOT/containers/entrypoint.sh" sh -c \
+  'test "$CAIRN_MEMORY_HTTP_TOKEN" = token && test -z "${CAIRN_MEMORY_HTTP_TOKEN_FILE:-}"' || {
+    echo "FAIL: container entrypoint did not canonicalize the token source" >&2
+    exit 1
+  }
+
 run_launcher workspace --repo "$repo" --image example/workspace:1 \
   --workspace-volume example-workspace -- echo sandbox
 has_arg "$repo:/source:ro,Z"

package/scripts/test-doctor.sh

@@ -92,13 +92,15 @@ const server = createServer((request, response) => {
   request.on("end", () => {
     let body = {};
     try { body = JSON.parse(Buffer.concat(chunks).toString("utf8")); } catch {}
-    const valid = request.url === "/v1/embeddings"
-      && request.headers.authorization === "Bearer test-key"
-      && body.model === "test-embedding";
-    response.writeHead(valid ? 200 : 404, { "Content-Type": "application/json" });
-    response.end(JSON.stringify(valid
+    const routeValid = request.url === "/v1/embeddings";
+    const keyValid = request.headers.authorization === "Bearer test-key";
+    const modelValid = body.model === "test-embedding";
+    const unauthorized = body.model === "unauthorized-model";
+    const status = routeValid && keyValid && modelValid ? 200 : unauthorized ? 403 : 404;
+    response.writeHead(status, { "Content-Type": "application/json" });
+    response.end(JSON.stringify(status === 200
       ? { data: [{ index: 0, embedding: [1, 0] }] }
-      : { error: "invalid request" }));
+      : { message: "private upstream detail must not leak", request_id: "private-request-id" }));
   });
 });
 server.listen(0, "127.0.0.1", () => {
@@ -122,17 +124,33 @@ EOF
   grep -q "\[PASS\] embedding endpoint accepted model test-embedding" "$tmp/out3" ||
     fail "expected a functional embedding PASS line"
 
-  proj4="$tmp/embedding-wrong-model"; mkdir -p "$proj4/.ai"
+  proj4="$tmp/embedding-unauthorized"; mkdir -p "$proj4/.ai"
   cat > "$proj4/.ai/.env" <<EOF
 CAIRN_MEMORY_EMBEDDING_URL=http://127.0.0.1:$port/v1
-CAIRN_MEMORY_EMBEDDING_MODEL=missing-model
+CAIRN_MEMORY_EMBEDDING_MODEL=unauthorized-model
 CAIRN_LLM_API_KEY=test-key
 EOF
   if ( cd "$proj4" && "$doctor" ) >"$tmp/out4" 2>&1; then
-    fail "doctor should reject a missing embedding model:\n$(cat "$tmp/out4")"
+    fail "doctor should reject an unauthorized embedding request:\n$(cat "$tmp/out4")"
+  fi
+  grep -q "\[FAIL\] embedding authorization rejected (HTTP 403) for model unauthorized-model" "$tmp/out4" ||
+    fail "expected a sanitized embedding authorization diagnostic"
+  ! grep -q "private upstream detail\|private-request-id" "$tmp/out4" ||
+    fail "embedding diagnostic leaked an upstream body or request id"
+
+  proj5="$tmp/embedding-missing-model"; mkdir -p "$proj5/.ai"
+  cat > "$proj5/.ai/.env" <<EOF
+CAIRN_MEMORY_EMBEDDING_URL=http://127.0.0.1:$port/v1
+CAIRN_MEMORY_EMBEDDING_MODEL=missing-model
+CAIRN_LLM_API_KEY=test-key
+EOF
+  if ( cd "$proj5" && "$doctor" ) >"$tmp/out5" 2>&1; then
+    fail "doctor should reject a missing embedding model:\n$(cat "$tmp/out5")"
   fi
-  grep -q "\[FAIL\] embedding request failed for model missing-model" "$tmp/out4" ||
-    fail "expected a functional embedding FAIL line"
+  grep -q "\[FAIL\] embedding endpoint or model not found (HTTP 404) for model missing-model" "$tmp/out5" ||
+    fail "expected a sanitized missing embedding model diagnostic"
+  ! grep -q "private upstream detail\|private-request-id" "$tmp/out5" ||
+    fail "missing-model diagnostic leaked an upstream body or request id"
 fi
 
 # 5. Artifact doctor passes a valid store, repairs only derived state, and