@cairnkeep/cli 2.22.2 → 2.22.4

package/docs/security-assurance.md

@@ -47,6 +47,13 @@ be enabled and evaluated independently.
 | Traversal, alternate separators, drive paths, ADS, forbidden Windows characters/device aliases, invalid Unicode, or case collisions in portable data | One cross-platform path validator is used by context packs, OKF, artifacts, and evaluations; deterministic adversarial cases run in the smoke suite | Filesystems can have additional locale- or mount-specific semantics; containment checks remain required at every write |
 | Symlink or special-file substitution | Canonical roots, non-symlink regular-file checks, atomic replacement, and existing symlink/race regression tests | A hostile process running as the same account can race or replace resources outside Cairnkeep's process boundary |
 | Replaced or growing private pack state between inspection and use | One descriptor for metadata and bounded content reads; name/parent identity rechecks, private ownership and encoding validation; deterministic replacement/denial controls | Concurrent legitimate replacement can require retry; these checks are not per-user ACLs or a defense against an account with full local control |
+| Replaced capability configuration, skill state or work evidence | Inspected/opened file identity agreement, bounded descriptor reads, metadata/name/parent rechecks and strict UTF-8; private ledgers retain owner/ACL checks while ordinary project files retain their modes | Concurrent legitimate writes can require retry; this does not make skill mutation transactional against another same-account writer |
+| Replaced or growing evaluation, OKF, graph, receipt or derived-cache inputs | Descriptor-bound byte caps and metadata/name/parent rechecks; snapshots publish the validated bytes, private receipts retain owner/ACL checks, and rejected derived summaries are rebuilt | Concurrent legitimate changes can require retry; this does not make directory traversal, graph publication or snapshot exposure transactional against another same-account writer |
+| Replaced setup policy/state/owned assets or instruction files | Bounded descriptor reads, strict UTF-8, observed-target and immediate-parent rechecks before publication, exclusive temporary files and retained instruction modes | Publication checks are point-in-time, not compare-and-swap or an all-project transaction; same-account processes remain trusted |
+| Symlinked, growing or oversized OMP staged candidates | Real staging directories, portable filenames and independent descriptor reads capped at 8 KiB; unsafe entries are omitted without blocking the session | Candidate contents are untrusted proposals; these checks neither approve them nor automatically write durable memory |
+| Evaluation overlay target substitution or denied Windows replacement | Exclusive descriptor-written temporary files, checked parents/targets, and bounded retries that never unlink live data | Final-check-to-publication races are not eliminated against hostile same-account writers; a successful publication followed by an ACL failure is not a rollback |
+| Redirected provider requests, unbounded responses or provider-error disclosure | Explicit validated endpoints, manual redirects, streaming response caps, body cancellation and payload-free diagnostics; container probes use the server's numeric port and token parsers | External retrieval still sends the selected query to the configured provider; remote AnythingLLM HTTP remains supported for compatibility and requires operator transport review |
+| Crafted failure messages exhausting regex parsing | Delimited source-path parsing without ambiguous repeated path groups; timeout-isolated adversarial controls and byte-equivalent legacy v1 fixtures | This is targeted parser regression coverage, not a general input sandbox or coverage-guided fuzzing campaign |
 | Concurrent context-pack project pointer updates | Exclusive directory locks, bounded Windows contention retries, unsafe-lock rejection, injected denial controls and native cross-process exclusion tests | A persistent lock can block progress; recovery never infers abandonment or steals the lock |
 | Unauthenticated or rebound HTTP access | HTTP refuses to start without a token, compares it in constant time, validates `Host`, denies CORS by default, and bounds headers, request time, keep-alive time, and bodies to 8 MiB | Bearer tokens are not user identities; deploy TLS at the ingress for non-loopback traffic |
 | Excessive MCP authority | Explicit MCP annotations, restrictive profiles, capability intersection, and separate HTTP consent for sensitive optional tools | The default profile remains `full` for compatibility; operators should choose `read-only` or `custom` for observation-only clients |
@@ -140,3 +147,63 @@ The native-Windows matrix runs the CLI, package, and global-install contracts on
 Node 22, 24, and 26. It deterministically partitions the complete memory-server
 smoke catalog across those lanes exactly once; the Linux matrix still runs the
 complete catalog independently on every supported Node version.
+
+The signature smoke check exercises crafted slash-heavy messages in a child
+process with a five-second deadline, plus a deterministic generated corpus.
+The runtime file-read control substitutes valid files after inspection through
+the public capability, skill and work-evidence readers, and separately checks
+growth, special-file substitution, byte limits, encoding and descriptor cleanup.
+It runs as part of `check:security-assurance`; it can also be run directly:
+
+```sh
+node mcp-memory-server/scripts/smoke-note-signatures.mjs
+node mcp-memory-server/scripts/smoke-runtime-file-reads.mjs
+node mcp-memory-server/scripts/smoke-bounded-input-reads.mjs
+node mcp-memory-server/scripts/smoke-workspace-file-security.mjs
+node mcp-memory-server/scripts/smoke-outbound-security.mjs
+node scripts/test-runtime-file-security.mjs
+node scripts/test-omp-staged-security.mjs
+node scripts/test-container-health.mjs
+```
+
+Build the server first when testing a source checkout. These regressions do not
+assert that every historical CodeQL/Scorecard alert is fixed. Triage findings
+individually and use a fresh default-branch analysis to confirm alert status;
+never dismiss an uninvestigated finding merely to improve the score.
+
+The bounded-input control exercises real evaluation, OKF import/export, graph
+status, receipt and progressive-cache readers. Valid-file substitution and
+same-inode growth are injected at actual inspection/read boundaries; the test
+checks that no unbounded `readFile` allocation follows growth. Evaluation inputs
+retain their exact-byte binding and require UTF-8. Snapshot file/count and total
+byte limits are enforced during collection, and publication uses the retained
+bytes rather than reopening mutable source paths. Private receipt permissions
+remain mandatory. Derived cache failures rebuild from the current visible
+immutable content; read-only cache diagnosis reports issues without deleting
+them. These controls do not grant pack or skill authority, and they do not
+replace the native-Windows and full CI gates.
+
+The setup/OMP/publication follow-up uses the same descriptor-first contract in
+bootstrap JavaScript, without requiring a built server for setup. Setup policy,
+state and owned-asset reads and `AGENTS.md` are capped at 1 MiB. Unrecorded
+caller-owned assets retain the metadata-only diagnosis contract and are not
+adopted or rewritten. POSIX private setup state still requires owner/mode
+checks; Windows writer ACL hardening is unchanged, and bootstrap reads do not
+introduce a new Windows ACL-verification claim. OMP candidates are capped at
+8 KiB, including `/cairn-staged` display; unsafe entries remain invisible.
+
+Workspace controls inject a target symlink at the mutation boundary and check
+that outside content remains untouched. Root controls inject concurrent caller
+edits, denied Windows replacements and colliding temporary names. Publication
+uses exclusive temporaries, descriptor writes and flushes, and rechecks the
+observed target and immediate parent. These are not directory-wide transactions
+or a same-account sandbox. Windows compressed and decompressed archive input
+is capped at 512 MiB; a multi-database import is not one atomic transaction.
+
+Outbound controls stub `fetch` without network access, verify destination and
+redirect authority, and inject oversized bodies and private failure sentinels.
+AnythingLLM successful answers retain their prior field selection and JSON
+fallback; its response cap is 8 MiB. OpenViking retains its 1 MiB cap, explicit
+consents and HTTPS-or-loopback rule. Both reject malformed UTF-8 and suppress
+network/stream diagnostics. Health probes use only `127.0.0.1` with a validated
+port and the existing private token resolver, and never follow redirects.

package/examples/eval/bundled-fake.json

@@ -1 +1 @@
-{"identifier":"cairn-offline-fake-v1","package_version":"2.22.2","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}
+{"identifier":"cairn-offline-fake-v1","package_version":"2.22.4","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}

package/mcp-memory-server/dist/capability-registry.js

@@ -1,6 +1,6 @@
-import { lstat, readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { isNoteDistillationEnabled } from "./note-schema.js";
+import { readStableJson } from "./stable-file.js";
 import { CAPABILITY_IDS, } from "./capability-schema.js";
 const MAX_COMPATIBILITY_CONFIG_BYTES = 64 * 1024;
 function environmentName(id) {
@@ -10,20 +10,7 @@ export async function isGraphCapabilityCompatible(projectRoot) {
     const planningDirectory = join(projectRoot, ".planning");
     const configPath = join(planningDirectory, "config.json");
     try {
-        const [directoryStat, fileStat] = await Promise.all([
-            lstat(planningDirectory),
-            lstat(configPath),
-        ]);
-        if (directoryStat.isSymbolicLink() || !directoryStat.isDirectory())
-            return false;
-        if (fileStat.isSymbolicLink() || !fileStat.isFile())
-            return false;
-        if (fileStat.size > MAX_COMPATIBILITY_CONFIG_BYTES)
-            return false;
-        const bytes = await readFile(configPath);
-        if (bytes.byteLength > MAX_COMPATIBILITY_CONFIG_BYTES)
-            return false;
-        const parsed = JSON.parse(bytes.toString("utf8"));
+        const parsed = readStableJson(configPath, { label: "Graph compatibility configuration", maxBytes: MAX_COMPATIBILITY_CONFIG_BYTES });
         if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
             return false;
         const graphify = parsed.graphify;

package/mcp-memory-server/dist/context-pack-retrieval.js

@@ -1,6 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
-import { lstat, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdir, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
+import { readStableJson } from "./stable-file.js";
 function isDirectory(node) {
     return "type" in node && node.type === "directory";
 }
@@ -77,7 +78,7 @@ async function writeCache(path, record) {
         catch (error) {
             // Concurrent deterministic builders may publish the same record.
             try {
-                await readFile(path);
+                readStableJson(path, { label: "Progressive context cache", maxBytes: CACHE_RECORD_MAX_BYTES });
             }
             catch {
                 throw error;
@@ -94,7 +95,7 @@ async function enrichPackFiles(files, cacheBaseDirectory) {
     const cachePath = join(cacheBaseDirectory, packDigest, `${setDigest}.json`);
     let cached;
     try {
-        const parsed = JSON.parse(await readFile(cachePath, "utf8"));
+        const parsed = readStableJson(cachePath, { label: "Progressive context cache", maxBytes: CACHE_RECORD_MAX_BYTES });
         if (validCache(parsed, packDigest, setDigest, files))
             cached = parsed;
     }
@@ -381,20 +382,19 @@ export async function doctorProgressiveContextCache(cacheBaseDirectory, packs, o
         for (const cacheEntry of (await readdir(packPath, { withFileTypes: true })).sort((left, right) => left.name.localeCompare(right.name, "en"))) {
             const cachePath = join(packPath, cacheEntry.name);
             const relative = `cache/context/${packEntry.name}/${cacheEntry.name}`;
-            const cacheInfo = await lstat(cachePath);
             if (cacheEntry.name.endsWith(".tmp")) {
                 temporaryRemnants.push(relative);
                 await removeDerived(cachePath, relative);
                 continue;
             }
             const match = /^([a-f0-9]{64})\.json$/.exec(cacheEntry.name);
-            if (!match || !cacheInfo.isFile() || cacheInfo.isSymbolicLink() || cacheInfo.size > CACHE_RECORD_MAX_BYTES) {
+            if (!match) {
                 issues.push(`Invalid progressive context cache entry: ${relative}`);
                 await removeDerived(cachePath, relative);
                 continue;
             }
             try {
-                const value = JSON.parse(await readFile(cachePath, "utf8"));
+                const value = readStableJson(cachePath, { label: "Progressive context cache", maxBytes: CACHE_RECORD_MAX_BYTES });
                 const invalid = validateCacheRecord(value, packEntry.name, match[1], installedFiles);
                 if (invalid)
                     throw new Error(invalid);

package/mcp-memory-server/dist/domain-retrieval-provider.js

@@ -1,5 +1,6 @@
 import { isIP } from "node:net";
 const OPENVIKING_RESPONSE_LIMIT = 1024 * 1024;
+const ANYTHINGLLM_RESPONSE_LIMIT = 8 * 1024 * 1024;
 const OPENVIKING_DEFAULT_TIMEOUT_MS = 30_000;
 const OPENVIKING_MAX_TIMEOUT_MS = 120_000;
 export function resolveDomainRetrievalProvider(env = process.env) {
@@ -56,14 +57,13 @@ function openVikingTimeout(env) {
     return timeout;
 }
 function openVikingTargetUri(workspace) {
-    if (!workspace.startsWith("viking://")) {
-        return `viking://resources/${encodeURIComponent(workspace)}`;
-    }
-    if (workspace !== "viking://resources"
-        && !/^viking:\/\/resources\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]+$/.test(workspace)) {
+    const target = workspace.startsWith("viking://")
+        ? workspace : `viking://resources/${encodeURIComponent(workspace)}`;
+    if (target !== "viking://resources"
+        && !/^viking:\/\/resources\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]+$/.test(target)) {
         throw new Error("OpenViking workspace URI must stay below viking://resources.");
     }
-    const path = workspace.slice("viking://resources".length);
+    const path = target.slice("viking://resources".length);
     let decoded;
     try {
         decoded = decodeURIComponent(path);
@@ -74,28 +74,49 @@ function openVikingTargetUri(workspace) {
     if (decoded.split("/").some((segment) => segment === "." || segment === "..")) {
         throw new Error("OpenViking workspace URI must not contain traversal segments.");
     }
-    return workspace;
+    return target;
+}
+class ResponseReadError extends Error {
+}
+async function discardResponse(response) {
+    try {
+        await response.body?.cancel();
+    }
+    catch { /* Cleanup must not leak provider diagnostics. */ }
 }
-async function boundedResponseText(response) {
+async function boundedResponseText(response, maximumBytes = OPENVIKING_RESPONSE_LIMIT, label = "OpenViking") {
     const advertisedLength = Number(response.headers.get("content-length"));
-    if (Number.isFinite(advertisedLength) && advertisedLength > OPENVIKING_RESPONSE_LIMIT) {
-        throw new Error("OpenViking response is too large.");
+    if (Number.isFinite(advertisedLength) && advertisedLength > maximumBytes) {
+        await discardResponse(response);
+        throw new ResponseReadError(`${label} response is too large.`);
     }
     if (!response.body)
         return "";
     const reader = response.body.getReader();
     const chunks = [];
     let length = 0;
-    while (true) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        length += value.byteLength;
-        if (length > OPENVIKING_RESPONSE_LIMIT) {
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            length += value.byteLength;
+            if (length > maximumBytes)
+                throw new ResponseReadError(`${label} response is too large.`);
+            chunks.push(value);
+        }
+    }
+    catch (error) {
+        try {
             await reader.cancel();
-            throw new Error("OpenViking response is too large.");
         }
-        chunks.push(value);
+        catch { /* Preserve the payload-free failure. */ }
+        if (error instanceof ResponseReadError)
+            throw error;
+        throw new ResponseReadError(`${label} response could not be read or timed out.`);
+    }
+    finally {
+        reader.releaseLock();
     }
     const joined = new Uint8Array(length);
     let offset = 0;
@@ -103,7 +124,12 @@ async function boundedResponseText(response) {
         joined.set(chunk, offset);
         offset += chunk.byteLength;
     }
-    return new TextDecoder("utf-8", { fatal: true }).decode(joined);
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(joined);
+    }
+    catch {
+        throw new ResponseReadError(`${label} response is not valid UTF-8.`);
+    }
 }
 async function callAnythingLLM(workspace, query, env) {
     const apiKey = env.ANYTHINGLLM_API_KEY;
@@ -111,23 +137,56 @@ async function callAnythingLLM(workspace, query, env) {
         throw new Error("ANYTHINGLLM_API_KEY is not set.");
     }
     const baseUrl = env.ANYTHINGLLM_BASE_URL ?? "http://localhost:3001";
-    const response = await fetch(`${baseUrl}/api/v1/workspace/${encodeURIComponent(workspace)}/chat`, {
-        method: "POST",
-        headers: {
-            Authorization: `Bearer ${apiKey}`,
-            "Content-Type": "application/json",
-        },
-        body: JSON.stringify({
-            message: query,
-            mode: "query",
-        }),
-        signal: AbortSignal.timeout(120000),
-    });
+    let endpoint;
+    try {
+        endpoint = new URL(baseUrl);
+    }
+    catch {
+        throw new Error("AnythingLLM base URL must be a valid HTTP(S) URL.");
+    }
+    if (endpoint.protocol !== "http:" && endpoint.protocol !== "https:")
+        throw new Error("AnythingLLM base URL must use HTTP or HTTPS.");
+    if (endpoint.username || endpoint.password)
+        throw new Error("AnythingLLM base URL must not contain embedded credentials.");
+    if (endpoint.search || endpoint.hash)
+        throw new Error("AnythingLLM base URL must not contain a query string or fragment.");
+    if (!workspace || workspace === "." || workspace === "..")
+        throw new Error("AnythingLLM workspace must not be empty or a dot segment.");
+    endpoint.pathname = `${endpoint.pathname.replace(/\/+$/, "")}/api/v1/workspace/${encodeURIComponent(workspace)}/chat`;
+    let response;
+    try {
+        response = await fetch(endpoint, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                message: query,
+                mode: "query",
+            }),
+            redirect: "manual",
+            signal: AbortSignal.timeout(120000),
+        });
+    }
+    catch {
+        throw new Error("AnythingLLM request failed or timed out.");
+    }
     if (!response.ok) {
-        const text = await response.text();
-        throw new Error(`AnythingLLM request failed with ${response.status}: ${text}`);
+        await discardResponse(response);
+        throw new Error(`AnythingLLM request failed with ${response.status}.`);
+    }
+    const text = await boundedResponseText(response, ANYTHINGLLM_RESPONSE_LIMIT, "AnythingLLM");
+    let payload;
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error();
+        payload = parsed;
+    }
+    catch {
+        throw new Error("AnythingLLM response is not a JSON object.");
     }
-    const payload = (await response.json());
     const directText = [
         payload.textResponse,
         payload.response,
@@ -204,6 +263,7 @@ async function callOpenViking(workspace, query, remote, env) {
     }
     const endpoint = openVikingEndpoint(env);
     const timeout = openVikingTimeout(env);
+    const targetUri = openVikingTargetUri(workspace);
     const apiKey = (env.CAIRN_OPENVIKING_API_KEY ?? env.OPENVIKING_API_KEY)?.trim();
     let response;
     try {
@@ -215,7 +275,7 @@ async function callOpenViking(workspace, query, remote, env) {
             },
             body: JSON.stringify({
                 query,
-                target_uri: openVikingTargetUri(workspace),
+                target_uri: targetUri,
                 context_type: ["resource"],
                 limit: 10,
             }),
@@ -227,26 +287,21 @@ async function callOpenViking(workspace, query, remote, env) {
         if (error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError")) {
             throw new Error("OpenViking request timed out.");
         }
-        throw new Error(`OpenViking request failed: ${error instanceof Error ? error.message : String(error)}`);
+        throw new Error("OpenViking request failed.");
     }
     if (response.status >= 300 && response.status < 400) {
+        await discardResponse(response);
         throw new Error(`OpenViking request refused redirect status ${response.status}.`);
     }
     if (!response.ok) {
+        await discardResponse(response);
         throw new Error(`OpenViking request failed with ${response.status}.`);
     }
     if (!(response.headers.get("content-type") ?? "").toLowerCase().includes("application/json")) {
+        await discardResponse(response);
         throw new Error("OpenViking response is not JSON.");
     }
-    let text;
-    try {
-        text = await boundedResponseText(response);
-    }
-    catch (error) {
-        if (error instanceof TypeError)
-            throw new Error("OpenViking response is not valid UTF-8.");
-        throw error;
-    }
+    const text = await boundedResponseText(response);
     return JSON.stringify(parseOpenVikingResult(text), null, 2);
 }
 export async function queryDomainKnowledge({ workspace, query, remote = false, env = process.env, }) {

package/mcp-memory-server/dist/eval-plan.js

@@ -1,10 +1,11 @@
 import { spawnSync } from "node:child_process";
 import { constants } from "node:fs";
-import { accessSync, closeSync, existsSync, fstatSync, lstatSync, openSync, readFileSync, realpathSync, } from "node:fs";
+import { accessSync, existsSync, lstatSync, realpathSync, } from "node:fs";
 import { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CAPABILITY_IDS } from "./capability-schema.js";
 import { EVAL_SCHEMA_VERSION, canonicalDigest, canonicalJson, evalAdapterConfigSchema, evalTaskSetSchema, } from "./eval-schema.js";
+import { readStableFile } from "./stable-file.js";
 const MAX_INPUT_BYTES = 4 * 1024 * 1024;
 const MAX_GIT_OUTPUT_BYTES = 8 * 1024 * 1024;
 const MAX_REPETITIONS = 1_000;
@@ -37,30 +38,22 @@ function assertRealDirectory(path, label) {
 }
 function readBoundedJson(path, label) {
     const absolute = resolve(path);
-    const pathInfo = lstatSync(absolute);
-    if (pathInfo.isSymbolicLink() || !pathInfo.isFile())
-        throw new Error(`${label} must be a regular non-symlink file.`);
-    const flags = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0);
-    const descriptor = openSync(absolute, flags);
+    const { bytes } = readStableFile(absolute, { label, maxBytes: MAX_INPUT_BYTES });
+    let text;
     try {
-        const info = fstatSync(descriptor);
-        if (!info.isFile() || info.size > MAX_INPUT_BYTES)
-            throw new Error(`${label} exceeds the ${MAX_INPUT_BYTES}-byte limit.`);
-        const bytes = readFileSync(descriptor);
-        if (bytes.byteLength > MAX_INPUT_BYTES)
-            throw new Error(`${label} exceeds the ${MAX_INPUT_BYTES}-byte limit.`);
-        let value;
-        try {
-            value = JSON.parse(bytes.toString("utf8"));
-        }
-        catch {
-            throw new Error(`${label} is not valid JSON.`);
-        }
-        return { path: realpathSync(absolute), value, bytes };
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new Error(`${label} contains invalid UTF-8.`);
     }
-    finally {
-        closeSync(descriptor);
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${label} is not valid JSON.`);
     }
+    return { path: realpathSync(absolute), value, bytes };
 }
 function git(repository, args, label) {
     const result = spawnSync("git", ["-C", repository, ...args], {

package/mcp-memory-server/dist/eval-runner.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
-import { chmod, copyFile, lstat, mkdtemp, mkdir, readFile, readdir, realpath, rm, } from "node:fs/promises";
+import { chmod, copyFile, lstat, mkdtemp, mkdir, readdir, realpath, rm, writeFile, } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -11,6 +11,7 @@ import { EvalProcessError, runBoundedCommand, runBoundedJsonAdapter, } from "./e
 import { checkpointEvalReport, createEvalReportStore, } from "./eval-report.js";
 import { applyEvalWorkspaceOverlay, cleanupEvalWorkspace, createEvalWorkspace, runTaskPreparation, runTaskVerifier, } from "./eval-workspace.js";
 import { resolveMcpToolProfile } from "./mcp-tool-profile.js";
+import { readStableFile } from "./stable-file.js";
 const moduleDirectory = dirname(fileURLToPath(import.meta.url));
 const publishedReportSchemaPath = resolve(moduleDirectory, "..", "..", "schemas", "eval-report.schema.json");
 let reportSchemaDigestsCache;
@@ -240,25 +241,30 @@ async function checkpoint(reportStore, report) {
 }
 async function collectSnapshotFiles(root) {
     const files = [];
+    let totalBytes = 0;
     const walk = async (directory) => {
         const entries = await readdir(directory, { withFileTypes: true });
         for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name, "en"))) {
             const absolute = join(directory, entry.name);
-            const info = await lstat(absolute);
-            if (info.isSymbolicLink())
+            if (entry.isSymbolicLink())
                 throw new Error("unsafe_note_snapshot");
-            if (info.isDirectory()) {
+            if (entry.isDirectory()) {
+                const info = await lstat(absolute);
+                if (!info.isDirectory() || info.isSymbolicLink())
+                    throw new Error("unsafe_note_snapshot");
                 await walk(absolute);
                 continue;
             }
-            if (!info.isFile())
+            if (!entry.isFile())
                 throw new Error("unsafe_note_snapshot");
-            const bytes = await readFile(absolute);
-            files.push({ path: relative(root, absolute).split(sep).join("/"), bytes });
-            if (files.length > MAX_SNAPSHOT_FILES
-                || files.reduce((total, file) => total + file.bytes.byteLength, 0) > MAX_SNAPSHOT_BYTES) {
+            if (files.length >= MAX_SNAPSHOT_FILES) {
                 throw new Error("note_snapshot_limit");
             }
+            const { bytes } = readStableFile(absolute, { label: "Evaluation note snapshot", maxBytes: MAX_SNAPSHOT_BYTES - totalBytes || 1 });
+            files.push({ path: relative(root, absolute).split(sep).join("/"), bytes });
+            totalBytes += bytes.byteLength;
+            if (totalBytes > MAX_SNAPSHOT_BYTES)
+                throw new Error("note_snapshot_limit");
         }
     };
     await walk(root);
@@ -300,7 +306,8 @@ export async function snapshotTaskNotes(options) {
             if (!isContained(root, destination) || destination === root)
                 throw new Error("unsafe_note_snapshot");
             await mkdir(dirname(destination), { recursive: true, mode: 0o700 });
-            await copyFile(join(sourceRoot, ...file.path.split("/")), destination);
+            // Publish the validated bytes, never reopen the mutable source.
+            await writeFile(destination, file.bytes, { flag: "wx", mode: 0o600 });
             await chmod(destination, 0o400);
             manifest.push({ path: file.path, digest: sha256(file.bytes), bytes: file.bytes.byteLength });
         }