@cairnkeep/cli 2.22.2 → 2.22.4

package/scripts/test-container-health.mjs

@@ -0,0 +1,56 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, writeFileSync, chmodSync, rmSync, symlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { hardenPrivatePath } from "../mcp-memory-server/dist/platform-security.js";
+
+const source = readFileSync(new URL("../containers/healthcheck.mjs", import.meta.url), "utf8");
+const containerfile = readFileSync(new URL("../Containerfile", import.meta.url), "utf8");
+const quadlet = readFileSync(new URL("../containers/quadlet/cairnkeep.container", import.meta.url), "utf8");
+assert.match(quadlet, /^Secret=cairnkeep-http-token,type=mount,target=http-token,uid=10001,gid=10001,mode=0400$/m,
+  "the managed container secret must satisfy the probe's private-file contract");
+assert.match(containerfile, /COPY --chmod=644 containers\/healthcheck\.mjs \/opt\/cairnkeep\/containers\/healthcheck\.mjs/, "probe imports must resolve within the packaged server");
+assert.match(containerfile, /ln -s \/opt\/cairnkeep\/containers\/healthcheck\.mjs \/usr\/local\/lib\/cairnkeep\/container-healthcheck\.mjs/, "keep the established container probe path");
+assert.match(source, /parseHttpPort/, "health destination must use the server's numeric port parser");
+assert.match(source, /resolveHttpToken/, "health tokens must use the server's bounded resolver");
+const { containerHealthcheck } = await import("../containers/healthcheck.mjs");
+const root = mkdtempSync(join(tmpdir(), "cairn-health-security-"));
+const originalFetch = globalThis.fetch;
+const token = "synthetic-health-token-0123456789";
+const requests = [];
+try {
+  globalThis.fetch = async (url, options) => {
+    requests.push({ url: String(url), options });
+    return Response.json({ result: {} });
+  };
+  assert.equal(await containerHealthcheck({}), 0);
+  for (const port of ["7801@external.example.test", "1/path", "-1", "65536", " 7801 "]) {
+    assert.equal(await containerHealthcheck({ MCP_HTTP_PORT: port, CAIRN_MEMORY_HTTP_TOKEN: token }), 1);
+  }
+  assert.equal(requests.length, 0, "disabled or invalid configuration must not fetch");
+  assert.equal(await containerHealthcheck({ MCP_HTTP_PORT: "7801", CAIRN_MEMORY_HTTP_TOKEN: token }), 0);
+  assert.equal(requests[0].url, "http://127.0.0.1:7801/mcp");
+  assert.equal(requests[0].options.redirect, "manual");
+  assert.equal(requests[0].options.headers.Authorization, `Bearer ${token}`);
+  assert.equal(JSON.parse(requests[0].options.body).method, "initialize");
+  const tokenFile = join(root, "token");
+  writeFileSync(tokenFile, token + "\n", { mode: 0o600 });
+  hardenPrivatePath(tokenFile);
+  assert.equal(await containerHealthcheck({ MCP_HTTP_PORT: "7801", CAIRN_MEMORY_HTTP_TOKEN_FILE: tokenFile }), 0);
+  if (process.platform !== "win32") {
+    chmodSync(tokenFile, 0o644);
+    assert.equal(await containerHealthcheck({ MCP_HTTP_PORT: "7801", CAIRN_MEMORY_HTTP_TOKEN_FILE: tokenFile }), 1);
+    chmodSync(tokenFile, 0o600);
+    const link = join(root, "linked-token");
+    symlinkSync(tokenFile, link);
+    assert.equal(await containerHealthcheck({ MCP_HTTP_PORT: "7801", CAIRN_MEMORY_HTTP_TOKEN_FILE: link }), 1);
+  }
+  writeFileSync(tokenFile, "x".repeat(64 * 1024 + 1));
+  assert.equal(await containerHealthcheck({ MCP_HTTP_PORT: "7801", CAIRN_MEMORY_HTTP_TOKEN_FILE: tokenFile }), 1);
+  globalThis.fetch = async () => new Response(null, { status: 302, headers: { Location: "https://external.example.test" } });
+  assert.equal(await containerHealthcheck({ MCP_HTTP_PORT: "7801", CAIRN_MEMORY_HTTP_TOKEN: token }), 1);
+} finally {
+  globalThis.fetch = originalFetch;
+  rmSync(root, { recursive: true, force: true });
+}
+console.log("PASS: container health checks remain loopback-only with bounded, safe credentials and no redirects");

package/scripts/test-container.sh

@@ -110,7 +110,14 @@ done
   exit 1
 }
 cat "$tmp/write.out"
-"$ENGINE" exec "$name" node /usr/local/lib/cairnkeep/container-healthcheck.mjs
+# Exec probes see the original container environment, not the entrypoint's
+# loaded secret. The deliberately public bind fixture must be rejected.
+if "$ENGINE" exec "$name" node /usr/local/lib/cairnkeep/container-healthcheck.mjs; then
+  echo "FAIL: healthcheck accepted a non-private token file" >&2
+  exit 1
+fi
+# Exercise the same legacy entrypoint against a private, container-owned file.
+"$ENGINE" exec "$name" sh -c 'umask 077; cat /run/secrets/http-token > /tmp/health-token; CAIRN_MEMORY_HTTP_TOKEN_FILE=/tmp/health-token node /usr/local/lib/cairnkeep/container-healthcheck.mjs; status=$?; rm -f /tmp/health-token; exit "$status"'
 "$ENGINE" rm -f "$name" >/dev/null
 
 # Replacement boot with the same volume must recover the canary.

package/scripts/test-learning-docs.sh

@@ -192,5 +192,13 @@ for phrase in \
   }
 done
 grep -qF '`cairn security` | L28' "$coverage"
+for file in "$l28" "$video28" docs/security-assurance.md; do
+  for phrase in 'smoke-note-signatures.mjs' 'smoke-runtime-file-reads.mjs' 'smoke-bounded-input-reads.mjs' 'smoke-workspace-file-security.mjs' 'smoke-outbound-security.mjs' 'test-runtime-file-security.mjs' 'test-omp-staged-security.mjs' 'test-container-health.mjs' 'coverage-guided'; do
+    grep -qF -- "$phrase" "$file" || {
+      echo "Security learning document missing runtime regression boundary: $file ($phrase)" >&2
+      exit 1
+    }
+  done
+done
 
 echo "PASS: public learning path structure, readiness, links, and version alignment"

package/scripts/test-omp-staged-security.mjs

@@ -0,0 +1,110 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import { syncBuiltinESMExports } from "node:module";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const repository = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const root = fs.mkdtempSync(join(tmpdir(), "cairn-omp-staged-security-"));
+const originalRead = fs.readFileSync;
+const originalDescriptorRead = fs.readSync;
+const originalOpen = fs.openSync;
+const failures = [];
+function restore() {
+  fs.readFileSync = originalRead;
+  fs.readSync = originalDescriptorRead;
+  fs.openSync = originalOpen;
+  syncBuiltinESMExports();
+}
+function mock() {
+  const handlers = new Map();
+  const commands = new Map();
+  const messages = [];
+  return {
+    handlers, commands, messages,
+    pi: {
+      on(event, handler) { handlers.set(event, handler); },
+      registerCommand(name, command) { commands.set(name, command); },
+      getAllTools() { return []; },
+      sendMessage(payload) { messages.push(payload); },
+    },
+  };
+}
+function context(project, ui) {
+  return { cwd: project, agent: { kind: "main" }, hasUI: true, ui: { notify(text) { ui.push(text); } } };
+}
+async function control(name, operation) {
+  try { await operation(); }
+  catch (error) { failures.push(`${name}: ${error.message}`); }
+}
+try {
+  fs.writeFileSync(join(root, "package.json"), '{"type":"module"}');
+  const extension = join(root, "capture.ts");
+  fs.writeFileSync(extension, fs.readFileSync(join(repository, "omp", "extensions", "cairnkeep-capture.ts"), "utf8").replaceAll("@@INFRA_ROOT@@", repository.replaceAll("\\", "/")));
+  const { default: factory } = await import(pathToFileURL(extension).href);
+  const project = join(root, "project");
+  const staging = join(project, ".planning", "memory-staging");
+  fs.mkdirSync(staging, { recursive: true });
+  const staged = join(staging, "fixture.json");
+  const payload = '{"candidates":[{"value":"reviewed fixture"}]}';
+  fs.writeFileSync(staged, payload);
+  let instance = mock();
+  factory(instance.pi);
+  let ui = [];
+  await instance.handlers.get("session_start")({}, context(project, ui));
+  assert.equal(instance.messages.length, 1);
+  assert.match(ui[0], /1 memory candidate file/);
+  assert.match(instance.messages[0].content, /memory_write/);
+
+  const outside = join(root, "outside.json");
+  fs.writeFileSync(outside, '{"candidates":[{"value":"private-external-sentinel"}]}');
+  if (process.platform !== "win32") {
+    fs.symlinkSync(outside, join(staging, "linked.json"));
+    await control("OMP staged symlink exclusion", async () => {
+      instance = mock(); factory(instance.pi); ui = [];
+      await instance.handlers.get("session_start")({}, context(project, ui));
+      assert.match(ui[0], /1 memory candidate file/);
+      ui = [];
+      await instance.commands.get("cairn-staged").handler("", context(project, ui));
+      assert.equal(ui.join("\n").includes("private-external-sentinel"), false);
+    });
+    fs.unlinkSync(join(staging, "linked.json"));
+  }
+  await control("OMP staged growth", async () => {
+    const descriptors = new Set();
+    let grew = false;
+    let unbounded = false;
+    const change = () => {
+      if (!grew) { grew = true; fs.appendFileSync(staged, " ".repeat(64 * 1024)); }
+    };
+    fs.openSync = (path, ...args) => {
+      const fd = originalOpen(path, ...args);
+      if (path === staged) descriptors.add(fd);
+      return fd;
+    };
+    fs.readSync = (fd, ...args) => { if (descriptors.has(fd)) change(); return originalDescriptorRead(fd, ...args); };
+    fs.readFileSync = (path, ...args) => {
+      if (path === staged || descriptors.has(path)) { unbounded = true; change(); }
+      return originalRead(path, ...args);
+    };
+    syncBuiltinESMExports();
+    instance = mock(); factory(instance.pi); ui = [];
+    try {
+      await instance.handlers.get("session_start")({}, context(project, ui));
+      assert.equal(grew, true);
+      assert.equal(unbounded, false);
+      assert.equal(instance.messages.length, 0, "changed staged content must not become wakeup evidence");
+    } finally { restore(); }
+  });
+  fs.writeFileSync(staged, payload);
+  fs.writeFileSync(join(staging, "oversized.json"), '{"candidates":[{"value":"oversized-sentinel"}]}' + " ".repeat(8192));
+  ui = []; instance = mock(); factory(instance.pi);
+  await instance.commands.get("cairn-staged").handler("", context(project, ui));
+  await control("OMP listing bound", () => { assert.equal(ui.join("\n").includes("oversized-sentinel"), false); });
+  assert.deepEqual(failures, [], "staged inspection must be bounded, contained and fail open without trusting unsafe content");
+} finally {
+  restore();
+  fs.rmSync(root, { recursive: true, force: true });
+}
+console.log("PASS: OMP staged inspection rejects symlinks, growth and oversized content without blocking the session");

package/scripts/test-runtime-file-security.mjs

@@ -0,0 +1,311 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import { syncBuiltinESMExports } from "node:module";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { gzipSync } from "node:zlib";
+
+import { readSetupPolicy, buildSetupPlan } from "./setup-core.mjs";
+import { reconcileSetupPlan } from "./setup-reconcile.mjs";
+import { diagnoseSetup } from "./setup.mjs";
+import { reconcilePlaybookInstructions } from "./playbook-instructions.mjs";
+import { createTar, runWindowsCommand } from "./windows-platform.mjs";
+import { readStableFile, readStableText } from "./lib/stable-file.mjs";
+
+const root = fs.mkdtempSync(join(tmpdir(), "cairn-cli-file-security-"));
+const failures = [];
+const original = {
+  lstat: fs.lstatSync, open: fs.openSync, close: fs.closeSync,
+  read: fs.readSync, readFile: fs.readFileSync,
+  rename: fs.renameSync, write: fs.writeFileSync,
+};
+let swap = 0;
+function restore() {
+  fs.lstatSync = original.lstat;
+  fs.openSync = original.open;
+  fs.closeSync = original.close;
+  fs.readSync = original.read;
+  fs.readFileSync = original.readFile;
+  fs.renameSync = original.rename;
+  fs.writeFileSync = original.write;
+  syncBuiltinESMExports();
+}
+function write(path, value, mode = 0o600) {
+  fs.mkdirSync(dirname(path), { recursive: true });
+  fs.writeFileSync(path, value, { mode });
+}
+async function control(name, operation) {
+  try { await operation(); }
+  catch (error) { failures.push(`${name}: ${error.message}`); }
+}
+async function substitute(path, occurrence, replacement, operation) {
+  const candidate = join(root, "swaps", `${++swap}.candidate`);
+  const inspected = join(root, "swaps", `${swap}.inspected`);
+  write(candidate, replacement, fs.statSync(path).mode & 0o777);
+  let calls = 0;
+  let injected = false;
+  fs.lstatSync = (target, ...args) => {
+    const info = original.lstat(target, ...args);
+    if (target === path && ++calls === occurrence) {
+      injected = true;
+      fs.renameSync(path, inspected);
+      fs.renameSync(candidate, path);
+    }
+    return info;
+  };
+  syncBuiltinESMExports();
+  try { await operation(); }
+  finally { restore(); assert.equal(injected, true, "the actual reader must encounter replacement"); }
+}
+async function grow(path, operation) {
+  const inspectedSize = fs.statSync(path).size;
+  const descriptors = new Set();
+  let injected = false;
+  let unbounded = false;
+  const allocations = [];
+  function change() {
+    if (!injected) { injected = true; fs.appendFileSync(path, " ".repeat(2 * 1024 * 1024)); }
+  }
+  fs.openSync = (target, ...args) => {
+    const fd = original.open(target, ...args);
+    if (target === path) descriptors.add(fd);
+    return fd;
+  };
+  fs.closeSync = (fd) => { descriptors.delete(fd); return original.close(fd); };
+  fs.readSync = (fd, buffer, ...args) => {
+    if (descriptors.has(fd)) { change(); allocations.push(buffer.byteLength); }
+    return original.read(fd, buffer, ...args);
+  };
+  fs.readFileSync = (target, ...args) => {
+    if (target === path || descriptors.has(target)) { unbounded = true; change(); }
+    return original.readFile(target, ...args);
+  };
+  syncBuiltinESMExports();
+  try { await operation(); }
+  finally {
+    restore();
+    assert.equal(injected, true, "the actual reader must encounter growth");
+    assert.equal(unbounded, false, "CLI readers must not use an unbounded readFile result");
+    assert.ok(allocations.every((size) => size <= inspectedSize + 1));
+    assert.equal(descriptors.size, 0, "failed reads must close descriptors");
+  }
+}
+
+try {
+  const missingProject = join(root, "not-created-yet");
+  assert.equal(reconcilePlaybookInstructions(missingProject, { check: true }).status, "would-created");
+  assert.equal(fs.existsSync(missingProject), false, "instruction preflight must not create a new project");
+  assert.throws(() => reconcilePlaybookInstructions(missingProject), /ENOENT/);
+  const helperFixture = join(root, "helper.txt");
+  write(helperFixture, "bounded", 0o644);
+  assert.equal(readStableText(helperFixture, { label: "Fixture", maxBytes: 7 }).text, "bounded");
+  fs.readSync = (descriptor, buffer, offset, length, position) => original.read(descriptor, buffer, offset, Math.min(2, length), position);
+  syncBuiltinESMExports();
+  try { assert.equal(readStableText(helperFixture, { label: "Fixture", maxBytes: 7 }).text, "bounded", "partial reads must assemble complete content"); }
+  finally { restore(); }
+  let readAttempts = 0;
+  fs.readSync = (...args) => { readAttempts += 1; return original.read(...args); };
+  syncBuiltinESMExports();
+  try {
+    assert.throws(() => readStableFile(helperFixture, { label: "Fixture", maxBytes: 6 }), /unsafe/);
+    if (process.platform !== "win32") assert.throws(() => readStableFile("/dev/null", { label: "Fixture", maxBytes: 7 }), /unsafe/);
+    assert.equal(readAttempts, 0, "oversized and special files must be rejected before content reads");
+  } finally { restore(); }
+  write(helperFixture, Buffer.from([0xff]), 0o644);
+  assert.throws(() => readStableText(helperFixture, { label: "Fixture", maxBytes: 7 }), /UTF-8/);
+  if (process.platform !== "win32") assert.throws(() => readStableFile(helperFixture, { label: "Fixture", maxBytes: 7, privateMode: 0o600 }), /unsafe/);
+
+  const policyPath = join(root, "policy.json");
+  write(policyPath, '{"schema_version":1,"defaults":{},"constraints":{}}', 0o644);
+  assert.equal(readSetupPolicy(policyPath).schema_version, 1);
+  await control("setup policy growth", () => grow(policyPath, () => {
+    assert.throws(() => readSetupPolicy(policyPath), /unsafe|changed|limit/i);
+  }));
+
+  const project = join(root, "project");
+  fs.mkdirSync(project);
+  const plan = buildSetupPlan({
+    target: project,
+    preflight: { targetState: "empty", gitExecutable: "available", repository: "work-tree" },
+    choices: { git: "existing", harnesses: ["claude"], memory: "local", confirmed: true },
+  });
+  const created = await reconcileSetupPlan(plan);
+  assert.equal(diagnoseSetup(project).status, "complete");
+  const rerun = await reconcileSetupPlan(plan, { previousState: created.state });
+  assert.deepEqual(rerun.counts, { created: 0, updated: 0, unchanged: plan.assets.length, skipped: 0 },
+    "native mode representation must not discard generated-file ownership");
+  const statePath = join(project, ".ai", "cairnkeep.json");
+  const stateBytes = fs.readFileSync(statePath);
+  await control("setup diagnosis state growth", () => grow(statePath, () => {
+    assert.equal(diagnoseSetup(project).status, "incomplete");
+  }));
+  write(statePath, stateBytes);
+  const owned = join(project, ".ai", "start-claude.sh");
+  const ownedBytes = fs.readFileSync(owned);
+  write(owned, "# Caller-owned launcher.\n", 0o755);
+  await control("setup diagnosis owned replacement", () => substitute(owned, 1, ownedBytes, () => {
+    assert.equal(diagnoseSetup(project).status, "incomplete", "replacement must not restore recorded ownership");
+  }));
+  write(owned, "# Caller-owned launcher.\n", 0o755);
+  await control("setup reconciliation ownership replacement", () => substitute(owned, 2, ownedBytes, async () => {
+    await assert.rejects(() => reconcileSetupPlan(plan, { previousState: created.state }), /unsafe|changed/i);
+  }));
+  write(owned, ownedBytes, 0o755);
+  await control("setup mutation ownership recheck", async () => {
+    const update = { ...plan, assets: [ { ...plan.assets.find((asset) => asset.path === ".ai/start-claude.sh"), bytes: Buffer.from("# Generated update.\n") } ] };
+    let observed;
+    let inspected = false;
+    let injected = false;
+    fs.openSync = (path, ...args) => {
+      const descriptor = original.open(path, ...args);
+      if (path === owned) observed = descriptor;
+      return descriptor;
+    };
+    fs.closeSync = (descriptor) => {
+      if (descriptor === observed) inspected = true;
+      return original.close(descriptor);
+    };
+    fs.lstatSync = (path, ...args) => {
+      if (inspected && !injected && path === dirname(owned)) {
+        injected = true;
+        original.write(owned, "# Concurrent caller rule.\n");
+      }
+      return original.lstat(path, ...args);
+    };
+    syncBuiltinESMExports();
+    try {
+      await assert.rejects(() => reconcileSetupPlan(update, { previousState: created.state }), /changed|unsafe/i);
+      assert.equal(injected, true);
+      assert.equal(fs.readFileSync(owned, "utf8"), "# Concurrent caller rule.\n");
+    } finally { restore(); write(owned, ownedBytes, 0o755); }
+  });
+
+  const agents = join(project, "AGENTS.md");
+  write(agents, "# User rules\n\nRetain this line.\n", 0o640);
+  assert.equal(reconcilePlaybookInstructions(project, { check: true }).status, "would-updated");
+  await control("playbook instructions growth", () => grow(agents, () => {
+    assert.throws(() => reconcilePlaybookInstructions(project, { check: true }), /unsafe|changed|bounded/i);
+  }));
+  write(agents, "# User rules\n\nRetain this line.\n", 0o640);
+  fs.chmodSync(agents, 0o640);
+  assert.equal(reconcilePlaybookInstructions(project).status, "updated");
+  assert.match(fs.readFileSync(agents, "utf8"), /Retain this line/);
+  if (process.platform !== "win32") assert.equal(fs.statSync(agents).mode & 0o777, 0o640);
+  assert.equal(reconcilePlaybookInstructions(project).status, "unchanged");
+  await control("instruction mutation ownership recheck", () => {
+    write(agents, "# Prior instructions\n", 0o640);
+    let injected = false;
+    fs.writeFileSync = (path, ...args) => {
+      if (!injected && typeof path === "string" && basename(path).startsWith(".AGENTS.md.")) {
+        injected = true;
+        original.write(agents, "# Concurrent caller rule.\n");
+      }
+      return original.write(path, ...args);
+    };
+    fs.openSync = (path, ...args) => {
+      if (!injected && typeof path === "string" && basename(path).startsWith(".AGENTS.md.")) {
+        injected = true;
+        original.write(agents, "# Concurrent caller rule.\n");
+      }
+      return original.open(path, ...args);
+    };
+    syncBuiltinESMExports();
+    try {
+      assert.throws(() => reconcilePlaybookInstructions(project), /changed|unsafe/i);
+      assert.equal(injected, true);
+      assert.equal(fs.readFileSync(agents, "utf8"), "# Concurrent caller rule.\n");
+      assert.equal(fs.readdirSync(project).some((name) => name.startsWith(".AGENTS.md.")), false);
+    } finally { restore(); }
+  });
+  const unapproved = join(root, "unapproved");
+  fs.mkdirSync(unapproved);
+  write(join(unapproved, "AGENTS.md"), "# Private rule\n", 0o640);
+  if (process.platform !== "win32") {
+    const linkedProject = join(root, "linked-project");
+    fs.symlinkSync(unapproved, linkedProject, "dir");
+    await control("playbook project symlink", () => {
+      assert.throws(() => reconcilePlaybookInstructions(linkedProject), /unsafe|symlink|directory/i);
+      assert.equal(fs.readFileSync(join(unapproved, "AGENTS.md"), "utf8"), "# Private rule\n");
+    });
+  }
+
+  const archive = join(root, "memory.tgz");
+  const archiveBytes = gzipSync(createTar([["project.db", Buffer.from("New database fixture.")]]));
+  write(archive, archiveBytes);
+  const memory = join(root, "memory");
+  const database = join(memory, "project.db");
+  write(database, "Prior database fixture.");
+  const repository = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+  const previousBase = process.env.CAIRN_AGENTFS_BASE_DIR;
+  process.env.CAIRN_AGENTFS_BASE_DIR = memory;
+  try {
+    await control("Windows archive growth", () => grow(archive, async () => {
+      await assert.rejects(() => runWindowsCommand({ command: "memory", args: ["import", archive], root: repository }), /unsafe|changed/i);
+    }));
+    write(archive, archiveBytes);
+    fs.renameSync = (source, destination) => {
+      if (destination === database) throw Object.assign(new Error("Synthetic denied replacement."), { code: "EPERM" });
+      return original.rename(source, destination);
+    };
+    syncBuiltinESMExports();
+    await control("Windows denied replacement retention", async () => {
+      try {
+        await assert.rejects(() => runWindowsCommand({ command: "memory", args: ["import", archive], root: repository }), /denied/i);
+        assert.equal(fs.readFileSync(database, "utf8"), "Prior database fixture.", "replacement failure must retain the live database");
+        assert.deepEqual(fs.readdirSync(memory).filter((name) => name.includes(".tmp-")), [], "failed replacement must clean its own temporary files");
+      } finally { restore(); }
+    });
+    write(database, "Prior database fixture.");
+    let denied = 0;
+    fs.renameSync = (source, destination) => {
+      if (destination === database && denied++ < 2) {
+        assert.equal(fs.readFileSync(database, "utf8"), "Prior database fixture.");
+        throw Object.assign(new Error("Synthetic transient sharing violation."), { code: "EBUSY" });
+      }
+      return original.rename(source, destination);
+    };
+    syncBuiltinESMExports();
+    try {
+      await runWindowsCommand({ command: "memory", args: ["import", archive], root: repository });
+      assert.equal(denied, 3);
+      assert.equal(fs.readFileSync(database, "utf8"), "New database fixture.");
+    } finally { restore(); }
+    write(database, "Prior database fixture.");
+    if (process.platform !== "win32") {
+      const outside = join(root, "outside-target");
+      write(outside, "Outside sentinel.");
+      let injected = false;
+      let collidingTemporary;
+      function substituteTemporary(path) {
+        if (!injected && typeof path === "string" && dirname(path) === memory
+            && basename(path).startsWith("project.db.tmp-")) {
+          injected = true;
+          collidingTemporary = path;
+          fs.symlinkSync(outside, path);
+        }
+      }
+      fs.openSync = (path, ...args) => { substituteTemporary(path); return original.open(path, ...args); };
+      fs.writeFileSync = (path, ...args) => { substituteTemporary(path); return original.write(path, ...args); };
+      syncBuiltinESMExports();
+      await control("Windows exclusive temporary publication", async () => {
+        try {
+          await assert.rejects(() => runWindowsCommand({ command: "memory", args: ["import", archive], root: repository }), /exist|unsafe/i);
+          assert.equal(injected, true);
+          assert.equal(fs.readFileSync(outside, "utf8"), "Outside sentinel.", "temporary symlink must not receive private content");
+          assert.equal(fs.readFileSync(database, "utf8"), "Prior database fixture.");
+          assert.equal(fs.lstatSync(collidingTemporary).isSymbolicLink(), true, "a collision must not delete an unowned temporary name");
+        } finally { restore(); }
+      });
+    }
+  } finally {
+    if (previousBase === undefined) delete process.env.CAIRN_AGENTFS_BASE_DIR;
+    else process.env.CAIRN_AGENTFS_BASE_DIR = previousBase;
+  }
+
+  assert.deepEqual(failures, [], "CLI file boundaries must fail closed without changing ownership");
+} finally {
+  restore();
+  fs.rmSync(root, { recursive: true, force: true });
+}
+console.log("PASS: bounded setup/instruction/archive reads and denied/exclusive Windows publication");

package/scripts/test-setup-diagnosis.mjs

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+import assert from "node:assert/strict";
+import { chmodSync, existsSync, mkdtempSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { buildSetupPlan } from "./setup-core.mjs";
+import { reconcileSetupPlan } from "./setup-reconcile.mjs";
+import { diagnoseSetup } from "./setup.mjs";
+
+const sandbox = mkdtempSync(join(tmpdir(), "cairn-setup-diagnosis-"));
+try {
+  const project = join(sandbox, "project");
+  mkdirSync(project);
+  const plan = buildSetupPlan({
+    target: project,
+    preflight: { targetState: "empty", gitExecutable: "available", repository: "work-tree" },
+    choices: { git: "existing", harnesses: ["claude", "opencode", "omp"], memory: "local", confirmed: true },
+  });
+  const customPaths = [".ai/env.example", ".ai/start-claude.sh", ".ai/start-opencode.sh", ".planning/graphs/policy.md"];
+  for (const path of customPaths) {
+    const file = join(project, path);
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file, path.endsWith(".sh") ? "#!/bin/sh\n# Project-owned launcher\nexit 0\n" : "Project-owned configuration\n");
+    chmodSync(file, path.endsWith(".sh") ? 0o755 : 0o640);
+  }
+  const before = new Map(customPaths.map(path => [path, { bytes: readFileSync(join(project, path)), mode: statSync(join(project, path)).mode, mtime: statSync(join(project, path)).mtimeMs }]));
+  const result = await reconcileSetupPlan(plan);
+  assert.equal(result.counts.skipped, customPaths.length);
+  for (const path of customPaths) assert.equal(Object.hasOwn(result.state.assets, path), false, "custom file became setup-owned");
+  const statePath = join(project, ".ai/cairnkeep.json");
+  const stateBytes = readFileSync(statePath);
+  assert.equal(diagnoseSetup(project).status, "complete", "safe preserved custom assets must not make setup incomplete");
+  for (const [path, saved] of before) {
+    assert.deepEqual(readFileSync(join(project, path)), saved.bytes);
+    assert.equal(statSync(join(project, path)).mode, saved.mode);
+    assert.equal(statSync(join(project, path)).mtimeMs, saved.mtime);
+  }
+  assert.deepEqual(readFileSync(statePath), stateBytes, "diagnosis rewrote ownership state");
+
+  for (const path of customPaths) {
+    const file = join(project, path), saved = `${file}.saved`;
+    renameSync(file, saved);
+    assert.equal(diagnoseSetup(project).status, "incomplete", "missing unowned asset accepted");
+    mkdirSync(file);
+    assert.equal(diagnoseSetup(project).status, "incomplete", "directory asset accepted");
+    rmSync(file, { recursive: true });
+    if (process.platform !== "win32") {
+      symlinkSync(saved, file);
+      assert.equal(diagnoseSetup(project).status, "incomplete", "symlink asset accepted");
+      rmSync(file);
+    }
+    renameSync(saved, file);
+  }
+  if (process.platform !== "win32") {
+    const launcher = join(project, ".ai/start-claude.sh");
+    chmodSync(launcher, 0o644);
+    assert.equal(diagnoseSetup(project).status, "incomplete", "non-executable custom launcher accepted");
+    chmodSync(launcher, 0o755);
+    const directory = join(project, ".planning/graphs"), saved = `${directory}.saved`;
+    renameSync(directory, saved);
+    symlinkSync(saved, directory, "dir");
+    assert.equal(diagnoseSetup(project).status, "incomplete", "symlinked asset ancestor accepted");
+    rmSync(directory);
+    renameSync(saved, directory);
+  }
+  const owned = join(project, ".ai/start-omp.sh"), ownedBytes = readFileSync(owned);
+  writeFileSync(owned, "owned drift\n");
+  assert.equal(diagnoseSetup(project).status, "incomplete", "owned digest drift accepted");
+  writeFileSync(owned, ownedBytes);
+  assert.equal(diagnoseSetup(project).status, "complete");
+
+  // An ownership map can legitimately be empty when every asset was preserved.
+  const unowned = { ...result.state, assets: {} };
+  writeFileSync(statePath, JSON.stringify(unowned) + "\n");
+  chmodSync(statePath, 0o600);
+  assert.equal(diagnoseSetup(project).status, "complete", "all-custom setup falsely requires owned files");
+  assert.deepEqual(JSON.parse(readFileSync(statePath)), unowned);
+  assert.equal(existsSync(join(project, ".ai/start-omp.sh")), true);
+
+  const codexProject = join(sandbox, "codex");
+  mkdirSync(codexProject);
+  const codexPlan = buildSetupPlan({
+    target: codexProject,
+    preflight: { targetState: "empty", gitExecutable: "available", repository: "work-tree" },
+    choices: { git: "existing", harnesses: ["codex"], memory: "local", confirmed: true },
+  });
+  const codexResult = await reconcileSetupPlan(codexPlan);
+  const codexState = join(codexProject, ".ai/cairnkeep.json");
+  writeFileSync(codexState, JSON.stringify({ ...codexResult.state, assets: {} }) + "\n");
+  chmodSync(codexState, 0o600);
+  assert.equal(diagnoseSetup(codexProject).status, "complete");
+  writeFileSync(join(codexProject, ".codex/config.toml"), "# Caller-owned but no memory server configured\n");
+  assert.equal(diagnoseSetup(codexProject).status, "incomplete", "empty ownership map bypassed Codex MCP validation");
+  console.log("PASS: setup diagnosis preserves custom ownership and rejects missing, unsafe, non-executable and drifted assets");
+} finally {
+  rmSync(sandbox, { recursive: true, force: true });
+}

package/scripts/test-windows-native.mjs

@@ -19,6 +19,11 @@ import { runNativeContainer } from "./cairn-container-cli.mjs";
 import { HARNESS_IDS } from "./harness-registry.mjs";
 
 const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+// Runs on real Windows and POSIX, independently of shell-only doctor checks.
+await import("./test-setup-diagnosis.mjs");
+await import("./test-runtime-file-security.mjs");
+await import("./test-container-health.mjs");
+await import("./test-omp-staged-security.mjs");
 const sandbox = mkdtempSync(join(tmpdir(), "cairn-windows-native-"));
 const originalBase = process.env.CAIRN_AGENTFS_BASE_DIR;
 const originalPackBase = process.env.CAIRN_PACK_BASE_DIR;

package/scripts/verify-omp-capture.mjs

@@ -79,6 +79,7 @@ function writeFakeInfra(sandbox) {
   writeFileSync(stub, STUB_SERVER);
   chmodSync(stub, 0o755);
   copyFileSync(stageWrapper, join(fakeRoot, "scripts", "lib", "omp-capture-stage.mjs"));
+  copyFileSync(join(root, "scripts", "lib", "stable-file.mjs"), join(fakeRoot, "scripts", "lib", "stable-file.mjs"));
   return fakeRoot;
 }