@cairnkeep/cli 2.22.3 → 2.22.5

package/mcp-memory-server/dist/eval-workspace.js

@@ -1,10 +1,11 @@
-import { createHash } from "node:crypto";
-import { constants, existsSync } from "node:fs";
-import { chmod, lstat, mkdir, mkdtemp, open, readFile, realpath, writeFile, } from "node:fs/promises";
+import { createHash, randomBytes } from "node:crypto";
+import { closeSync, constants, existsSync, fchmodSync, fsyncSync, linkSync, lstatSync, openSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmod, lstat, mkdir, mkdtemp, realpath, writeFile, } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { canonicalDigest } from "./eval-schema.js";
 import { EvalProcessError, runBoundedCommand, } from "./eval-process.js";
+import { readStableFile, readStableJson } from "./stable-file.js";
 const GIT_TIMEOUT_MS = 120_000;
 const GIT_OUTPUT_LIMIT = 64 * 1024;
 const CLEANUP_TIMEOUT_MS = 120_000;
@@ -53,24 +54,13 @@ async function validateBundledBinding(plan) {
     }
     if (canonicalDigest(plan.task_set) !== plan.task_set_digest)
         throw new Error("task_set_digest_mismatch");
-    let handle;
     let binding;
     try {
-        handle = await open(plan.source.binding_path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-        const info = await handle.stat();
-        if (!info.isFile() || info.size > BINDING_LIMIT)
-            throw new Error("unsafe_bundled_binding");
-        const bytes = await handle.readFile();
-        if (bytes.byteLength > BINDING_LIMIT)
-            throw new Error("unsafe_bundled_binding");
-        binding = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+        binding = readStableJson(plan.source.binding_path, { label: "Bundled evaluation binding", maxBytes: BINDING_LIMIT });
     }
     catch {
         throw new Error("invalid_bundled_binding");
     }
-    finally {
-        await handle?.close().catch(() => undefined);
-    }
     if (!binding || typeof binding !== "object" || Array.isArray(binding))
         throw new Error("invalid_bundled_binding");
     const record = binding;
@@ -109,8 +99,10 @@ async function materializeBundledSource(plan, sourcePath) {
         const info = await lstat(destination);
         if (info.isSymbolicLink() || !info.isFile())
             throw new Error("bundled_path_unsafe");
-        if (!Buffer.from(file.content, "utf8").equals(await readFile(destination)))
+        const expected = Buffer.from(file.content, "utf8");
+        if (!expected.equals(readStableFile(destination, { label: "Bundled evaluation source", maxBytes: Math.max(1, expected.byteLength) }).bytes)) {
             throw new Error("bundled_source_mismatch");
+        }
     }
     if (canonicalDigest(plan.task_set) !== plan.task_set_digest)
         throw new Error("task_set_digest_mismatch");
@@ -194,17 +186,18 @@ export async function runTaskPreparation(workspace, options = {}) {
     });
 }
 export async function applyEvalWorkspaceOverlay(workspace, overlay) {
+    const source = await assertPrivateDirectory(workspace.source_path);
     const segments = overlay.relative_path.split("/");
     if (overlay.relative_path.startsWith("/") || overlay.relative_path.endsWith("/")
         || overlay.relative_path.includes("\\") || segments.some((segment) => segment === "" || segment === "." || segment === "..")
         || /[\u0000-\u001f\u007f]/.test(overlay.relative_path)) {
         throw new Error("workspace_overlay_path_invalid");
     }
-    const target = resolve(workspace.source_path, overlay.relative_path);
-    if (!isContained(workspace.source_path, target) || target === workspace.source_path) {
+    const target = resolve(source, overlay.relative_path);
+    if (!isContained(source, target) || target === source) {
         throw new Error("workspace_overlay_path_escape");
     }
-    let cursor = workspace.source_path;
+    let cursor = source;
     for (const segment of segments.slice(0, -1)) {
         cursor = join(cursor, segment);
         try {
@@ -228,19 +221,85 @@ export async function applyEvalWorkspaceOverlay(workspace, overlay) {
             throw error;
     }
     const parent = await realpath(dirname(target));
-    const source = await realpath(workspace.source_path);
     if (!isContained(source, parent))
         throw new Error("workspace_overlay_parent_escape");
     const bytes = Buffer.from(overlay.content, "utf8");
     const digest = createHash("sha256").update(bytes).digest("hex");
     if (digest !== overlay.digest)
         throw new Error("workspace_overlay_digest_mismatch");
-    await writeFile(target, bytes, { mode: 0o600 });
-    await chmod(target, 0o600);
-    const storedDigest = createHash("sha256").update(await readFile(target)).digest("hex");
+    publishOverlay(source, target, bytes);
+    const storedDigest = createHash("sha256").update(readStableFile(target, { label: "Evaluation overlay", maxBytes: Math.max(1, bytes.byteLength) }).bytes).digest("hex");
     if (storedDigest !== overlay.digest)
         throw new Error("workspace_overlay_write_mismatch");
 }
+function sameTarget(left, right) {
+    return right.isFile() && !right.isSymbolicLink()
+        && left.dev === right.dev && left.ino === right.ino && left.size === right.size
+        && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs && left.mode === right.mode;
+}
+function overlayTarget(path) {
+    try {
+        const info = lstatSync(path);
+        if (!info.isFile() || info.isSymbolicLink())
+            throw new Error("workspace_overlay_target_unsafe");
+        return info;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function publishOverlay(source, target, bytes) {
+    const root = lstatSync(source);
+    const parent = lstatSync(dirname(target));
+    const before = overlayTarget(target);
+    const temporary = join(dirname(target), `.cairn-overlay-${process.pid}-${randomBytes(12).toString("hex")}.tmp`);
+    function unchangedBoundary() {
+        const rootAfter = lstatSync(source);
+        const parentAfter = lstatSync(dirname(target));
+        if (!rootAfter.isDirectory() || rootAfter.isSymbolicLink()
+            || !parentAfter.isDirectory() || parentAfter.isSymbolicLink()
+            || root.dev !== rootAfter.dev || root.ino !== rootAfter.ino
+            || parent.dev !== parentAfter.dev || parent.ino !== parentAfter.ino) {
+            throw new Error("workspace_overlay_parent_unsafe");
+        }
+    }
+    let descriptor;
+    let ownsTemporary = false;
+    try {
+        unchangedBoundary();
+        descriptor = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL
+            | (constants.O_NOFOLLOW ?? 0) | (process.platform === "win32" ? 0 : constants.O_NONBLOCK ?? 0), 0o600);
+        ownsTemporary = true;
+        unchangedBoundary();
+        writeFileSync(descriptor, bytes);
+        fchmodSync(descriptor, 0o600);
+        fsyncSync(descriptor);
+        closeSync(descriptor);
+        descriptor = undefined;
+        if (!readStableFile(temporary, { label: "Evaluation overlay temporary", maxBytes: Math.max(1, bytes.byteLength) }).bytes.equals(bytes)) {
+            throw new Error("workspace_overlay_write_mismatch");
+        }
+        unchangedBoundary();
+        const current = overlayTarget(target);
+        if (before ? !current || !sameTarget(before, current) : current !== null) {
+            throw new Error("workspace_overlay_target_changed");
+        }
+        // Atomic rename never follows the destination file. Exclusive linking
+        // also refuses a new destination that appeared after absence was checked.
+        if (before)
+            renameSync(temporary, target);
+        else
+            linkSync(temporary, target);
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+        if (ownsTemporary)
+            rmSync(temporary, { force: true });
+    }
+}
 function verifierReason(code) {
     return `verifier_${code}`;
 }

package/mcp-memory-server/dist/failure-signature.js

@@ -46,7 +46,30 @@ function normalizeVolatile(value, root) {
         .replace(/[\t\u00a0 ]+/g, " ")
         .trim();
 }
-function parseFrames(text, root) {
+// Match each delimited path once. A repeated path-segment group is ambiguous
+// because a segment itself may contain slashes, causing exponential retries.
+function sourcePath(text) {
+    for (const match of text.matchAll(/(?:^|[\s,])(\/[^\s,:]*):\d+(?::\d+)?/gm)) {
+        if (/\/(?:src|pkg|lib|test|tests)\/[^\s,:]+$/i.test(match[1]))
+            return match[1];
+    }
+    return undefined;
+}
+function withoutSourceSuffix(message) {
+    const comma = message.lastIndexOf(",");
+    if (comma < 0)
+        return message;
+    const suffix = message.slice(comma + 1).trimStart();
+    if (!suffix.endsWith(":<line>"))
+        return message;
+    const path = suffix.slice(0, -":<line>".length);
+    if (path.toLowerCase() === "<root>" || (!/[\s,]/.test(path)
+        && /(?:^|\/)(?:src|pkg|lib|test|tests)\/[^\s,:]+$/i.test(path))) {
+        return message.slice(0, comma);
+    }
+    return message;
+}
+function parseFrames(text, root, source) {
     const frames = [];
     const add = (fn, file) => {
         const normalizedFunction = fn.replace(/^async\s+/, "").trim();
@@ -81,9 +104,8 @@ function parseFrames(text, root) {
         }
         match = line.match(/^\d+:\s+(?:0x[0-9a-f]+\s+-\s+)?(.+)$/i);
         if (match) {
-            const source = text.match(/(?:^|[\s,])((?:\/[^\s,:]+)*\/(?:src|pkg|lib|test|tests)\/[^\s,:]+):\d+(?::\d+)?/im);
             if (source)
-                add(match[1], source[1]);
+                add(match[1], source);
         }
     }
     return frames.slice(0, 16);
@@ -96,8 +118,7 @@ function selectMessage(text, root) {
     const first = lines.find((line) => !/^(?:at\s+|File\s+|stack backtrace:|\d+:\s+(?:<address>|0x))/i.test(line));
     if (!first)
         return "unknown failure";
-    return first
-        .replace(/,\s*(?:<root>|\/?(?:[^\s,]+\/)*(?:src|pkg|lib|test|tests)\/[^\s,:]+):<line>$/i, "")
+    return withoutSourceSuffix(first)
         .replace(/\s+/g, " ")
         .trim()
         .slice(0, 4096);
@@ -114,10 +135,10 @@ function familyFor(message) {
 }
 export function buildFailureSignature(text, options = {}) {
     const normalizedMessage = selectMessage(text, options.root);
-    const frames = parseFrames(text, options.root);
+    const source = sourcePath(text);
+    const frames = parseFrames(text, options.root, source);
     const explicitComponent = options.component ? safePath(options.component, options.root) : "";
-    const sourceInMessage = text.match(/(?:^|[\s,])((?:\/[^\s,:]+)*\/(?:src|pkg|lib|test|tests)\/[^\s,:]+):\d+(?::\d+)?/im);
-    const component = explicitComponent || frames[0]?.file || (sourceInMessage ? safePath(sourceInMessage[1], options.root) : "");
+    const component = explicitComponent || frames[0]?.file || (source ? safePath(source, options.root) : "");
     const family = familyFor(normalizedMessage);
     const normalizedForHash = normalizedMessage.toLocaleLowerCase("en-US");
     const stackDigest = frames.length > 0 ? hash("stack", frames) : "";

package/mcp-memory-server/dist/graph-cli.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { spawnSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdir, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { resolveCapabilityStatus } from "./capability-config.js";
 import { isGraphCapabilityCompatible } from "./capability-registry.js";
+import { readStableFile } from "./stable-file.js";
 const INSPECTION_TIMEOUT_MS = 30_000;
 const BUILD_TIMEOUT_MS = 300_000;
 const MAX_GRAPH_BYTES = 256 * 1024 * 1024;
@@ -33,14 +34,22 @@ function plural(count, singular) {
     return `${count} ${singular}${count === 1 ? "" : "s"}`;
 }
 async function readBoundedFile(path, maximumBytes) {
-    const info = await lstat(path);
-    if (!info.isFile() || info.isSymbolicLink() || info.size > maximumBytes) {
-        throw new Error("graph artifact is missing, unsafe, or too large.");
+    try {
+        return readStableFile(path, { label: "graph artifact", maxBytes: maximumBytes }).bytes;
+    }
+    catch (error) {
+        // Optional artifacts need a missing-file result, not an unsafe-file
+        // result. This post-failure diagnosis never authorizes another open.
+        try {
+            await lstat(path);
+        }
+        catch (inspectionError) {
+            if (inspectionError.code === "ENOENT") {
+                throw Object.assign(new Error("graph artifact not found."), { code: "ENOENT" });
+            }
+        }
+        throw error;
     }
-    const bytes = await readFile(path);
-    if (bytes.byteLength > maximumBytes)
-        throw new Error("graph artifact is too large.");
-    return bytes;
 }
 function parseGraph(bytes) {
     const value = JSON.parse(bytes.toString("utf8"));
@@ -59,8 +68,14 @@ async function readGraph(path) {
         return parseGraph(await readBoundedFile(path, MAX_GRAPH_BYTES));
     }
     catch (error) {
-        if (error.code === "ENOENT") {
-            throw new Error("no published graph found; run /graphify build first.");
+        // This check explains a failed read; it never authorizes a later open.
+        try {
+            await lstat(path);
+        }
+        catch (inspectionError) {
+            if (inspectionError.code === "ENOENT") {
+                throw new Error("no published graph found; run /graphify build first.");
+            }
         }
         throw error;
     }

package/mcp-memory-server/dist/note-store.js

@@ -6,6 +6,7 @@ import { buildFailureSignature } from "./failure-signature.js";
 import { NOTE_SCHEMA_VERSION, noteNodeSchema, } from "./note-schema.js";
 import { memoryImportEnvelopeSchema, nodePathSchema, } from "./node-schema.js";
 import { atomicReplace } from "./platform-security.js";
+import { readStableFile } from "./stable-file.js";
 const MANAGED_START = "<!-- cairnkeep:managed:v1:start -->";
 const MANAGED_END = "<!-- cairnkeep:managed:v1:end -->";
 const MAX_PROCESSED_SESSIONS_PER_PROJECT = 4096;
@@ -569,7 +570,22 @@ export function doctorNoteStore(repair = false, options = {}) {
     }
 }
 function fileHash(path) {
-    return existsSync(path) ? createHash("sha256").update(readFileSync(path)).digest("hex") : null;
+    try {
+        const { bytes } = readStableFile(path, { label: "Note transaction pre-image", maxBytes: 64 * 1024 * 1024 });
+        return createHash("sha256").update(bytes).digest("hex");
+    }
+    catch (error) {
+        // Missing targets are valid pre-images. Diagnose absence only after
+        // the descriptor-first read failed; never authorize a read by a check.
+        try {
+            lstatSync(path);
+        }
+        catch (missing) {
+            if (missing.code === "ENOENT")
+                return null;
+        }
+        throw error;
+    }
 }
 function bytesHash(bytes) {
     return bytes === null ? null : createHash("sha256").update(bytes).digest("hex");
@@ -1024,9 +1040,13 @@ export async function commitNoteImport(plan) {
 export function createNoteMutationFixture(options) {
     const notesRoot = join(options.storeRoot, ".cairnkeep-note-fixture");
     const target = join(notesRoot, "live.txt");
-    if (!existsSync(target)) {
-        mkdirSync(dirname(target), { recursive: true });
-        writeFileSync(target, "before\n");
+    mkdirSync(dirname(target), { recursive: true });
+    try {
+        writeFileSync(target, "before\n", { flag: "wx", mode: 0o600 });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
     }
     const bytes = options.operation === "delete" ? null : `${options.operation}-after\n`;
     return { schema_version: 1, operation: options.operation, notes_root: notesRoot, changes: [{ path: target, bytes, before_hash: fileHash(target), final_hash: bytesHash(bytes) }], result: { ok: true, fixture: true } };

package/mcp-memory-server/dist/okf.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes } from "node:crypto";
 import { existsSync, lstatSync } from "node:fs";
-import { mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { parseDocument, stringify } from "yaml";
 import { z } from "zod";
@@ -8,6 +8,7 @@ import { portablePathCollisionKey, portableRelativePathIssue } from "./path-secu
 import { hardenPrivatePath } from "./platform-security.js";
 import { readSharedNoteForExport } from "./note-store.js";
 import { redactLocalValue } from "./trajectory-redaction.js";
+import { readStableFile } from "./stable-file.js";
 const MAX_FILE_BYTES = 1024 * 1024;
 const MAX_ENTRIES = 1024;
 const MAX_TOTAL_BYTES = 64 * 1024 * 1024;
@@ -256,10 +257,7 @@ export async function indexOkfBundle(directory, selectedPaths, declaredVersion)
         const absolute = resolve(root, ...entry.raw_path.split("/"));
         if (!contained(root, absolute))
             throw new Error(`Unsafe OKF path: ${path}`);
-        const info = lstatSync(absolute);
-        if (!info.isFile() || info.isSymbolicLink() || info.size > MAX_FILE_BYTES)
-            throw new Error(`OKF file is unsafe or too large: ${path}`);
-        const bytes = await readFile(absolute);
+        const { bytes } = readStableFile(absolute, { label: "OKF file", maxBytes: MAX_FILE_BYTES });
         content.set(path, bytes);
         const text = utf8(bytes, path);
         const name = basename(path);
@@ -377,10 +375,7 @@ async function exportMaterial(options) {
         const absolute = resolve(projectRoot, ...source.split("/"));
         if (!contained(projectRoot, absolute))
             throw new Error(`Unsafe OKF export source: ${source}`);
-        const sourceInfo = lstatSync(absolute);
-        if (!sourceInfo.isFile() || sourceInfo.isSymbolicLink() || sourceInfo.size > MAX_FILE_BYTES)
-            throw new Error(`OKF export source is unsafe or too large: ${source}`);
-        const bytes = await readFile(absolute);
+        const { bytes } = readStableFile(absolute, { label: "OKF export source", maxBytes: MAX_FILE_BYTES });
         const text = utf8(bytes, source);
         const redacted = redactLocalValue(text, projectRoot);
         replacements += redacted.replacement_count;

package/mcp-memory-server/dist/playbook-receipt.js

@@ -1,10 +1,11 @@
 import { createHash, randomBytes } from "node:crypto";
-import { constants, existsSync, readdirSync } from "node:fs";
+import { existsSync, readdirSync } from "node:fs";
 import { link, lstat, mkdir, open, realpath, rm } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { z } from "zod";
 import { hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
 import { playbookProjectIdentity, resolvePlaybookStatus } from "./playbook.js";
+import { readStableJson } from "./stable-file.js";
 import { PLAYBOOK_SCHEMA_VERSION, playbookActionIdSchema, playbookActorSchema, playbookEventSchema, playbookOutcomeSchema, playbookReasonSchema, } from "./playbook-schema.js";
 const MAX_RECEIPT_BYTES = 8 * 1024;
 const MAX_RECEIPTS = 10_000;
@@ -64,22 +65,7 @@ async function ensureStore(projectRoot) {
     return target.receipts;
 }
 async function safeRead(path) {
-    const info = await lstat(path);
-    if (!info.isFile() || info.isSymbolicLink() || info.size > MAX_RECEIPT_BYTES || !privatePathIsSafe(path)) {
-        throw new Error("Unsafe playbook receipt.");
-    }
-    let handle;
-    try {
-        handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-        const opened = await handle.stat();
-        if (!opened.isFile() || opened.size > MAX_RECEIPT_BYTES || opened.dev !== info.dev || opened.ino !== info.ino) {
-            throw new Error("Playbook receipt changed during validation.");
-        }
-        return receiptSchema.parse(JSON.parse((await handle.readFile()).toString("utf8")));
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-    }
+    return receiptSchema.parse(readStableJson(path, { label: "Playbook receipt", maxBytes: MAX_RECEIPT_BYTES, private: true }));
 }
 async function atomicReceipt(path, value) {
     const bytes = Buffer.from(`${JSON.stringify(value, null, 2)}\n`, "utf8");

package/mcp-memory-server/dist/skill-store.js

@@ -6,6 +6,7 @@ import { EvalProcessError, runBoundedJsonProcess } from "./eval-process.js";
 import { noteNodeSchema } from "./node-schema.js";
 import { getNoteLayout, listAddressedNotes } from "./note-store.js";
 import { hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
+import { readStableJson, readStableText } from "./stable-file.js";
 import { MAX_SKILL_BYTES, SKILL_SCHEMA_VERSION, skillAdapterConfigSchema, skillApplicationSchema, skillCandidateSchema, skillEvaluationSchema, skillProposalRequestSchema, skillProposalResponseSchema, skillProposalSchema, skillRelativePathSchema, } from "./skill-schema.js";
 const MAX_ARTIFACT_BYTES = 2 * 1024 * 1024;
 const PROTECTED_ADAPTER_ENVIRONMENT = new Set([
@@ -114,17 +115,7 @@ function atomicWrite(path, value) {
     hardenPrivatePath(path);
 }
 function readJson(path) {
-    const info = lstatSync(path);
-    if (info.isSymbolicLink() || !info.isFile() || info.size > MAX_ARTIFACT_BYTES || !privatePathIsSafe(path)) {
-        throw new Error(`Unsafe skill artifact: ${path}`);
-    }
-    const descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-    try {
-        return JSON.parse(readFileSync(descriptor, "utf8"));
-    }
-    finally {
-        closeSync(descriptor);
-    }
+    return readStableJson(path, { label: "Skill artifact", maxBytes: MAX_ARTIFACT_BYTES, private: true });
 }
 function listJson(directory, parse) {
     if (!existsSync(directory))
@@ -261,18 +252,13 @@ function assertSafeTarget(projectRoot, relativePath) {
     if (!isContained(root, target) || target === root)
         throw new Error("Skill target escapes the project.");
     let cursor = root;
-    for (const segment of canonicalPath.split("/")) {
+    for (const segment of canonicalPath.split("/").slice(0, -1)) {
         cursor = join(cursor, segment);
         const info = lstatSync(cursor);
         if (info.isSymbolicLink())
             throw new Error("Skill target crosses a symlink.");
     }
-    const info = lstatSync(target);
-    if (!info.isFile() || info.size > MAX_SKILL_BYTES)
-        throw new Error("Skill target must be a regular file no larger than 256 KiB.");
-    const content = readFileSync(target, "utf8");
-    if (Buffer.byteLength(content, "utf8") > MAX_SKILL_BYTES)
-        throw new Error("Skill target exceeds 256 KiB.");
+    const { text: content, stat: info } = readStableText(target, { label: "Skill target", maxBytes: MAX_SKILL_BYTES });
     return { path: target, content, digest: sha256(content), mode: info.mode & 0o777 };
 }
 export function readSkillTarget(projectRoot, relativePath) {
@@ -520,7 +506,7 @@ export function applySkillProposal(options) {
     hardenPrivatePath(backupPath);
     try {
         atomicWriteTarget(target.path, proposal.candidate_content, proposal.target_mode);
-        if (sha256(readFileSync(target.path)) !== proposal.candidate_content_digest) {
+        if (assertSafeTarget(store.project_root, proposal.target_path).digest !== proposal.candidate_content_digest) {
             throw new Error("Applied skill digest verification failed.");
         }
         atomicWrite(artifactPath(store.applications, application.id), application);
@@ -529,7 +515,7 @@ export function applySkillProposal(options) {
         const reason = error instanceof Error ? error.message : String(error);
         let currentDigest = null;
         try {
-            currentDigest = sha256(readFileSync(target.path));
+            currentDigest = assertSafeTarget(store.project_root, proposal.target_path).digest;
         }
         catch {
             // The private backup remains available for manual recovery.
@@ -538,7 +524,7 @@ export function applySkillProposal(options) {
             let restored = false;
             try {
                 atomicWriteTarget(target.path, target.content, target.mode);
-                if (sha256(readFileSync(target.path)) !== target.digest)
+                if (assertSafeTarget(store.project_root, proposal.target_path).digest !== target.digest)
                     throw new Error("restore_digest_mismatch");
                 restored = true;
             }
@@ -576,16 +562,14 @@ export function rollbackSkillApplication(options) {
     if (target.digest !== application.applied_digest)
         throw new Error("Skill target changed after application; rollback requires manual resolution.");
     const backup = resolve(store.project_root, application.backup_path);
-    const backupInfo = lstatSync(backup);
-    if (!isContained(store.backups, backup) || backupInfo.isSymbolicLink() || !backupInfo.isFile()
-        || backupInfo.size > MAX_SKILL_BYTES || !privatePathIsSafe(backup)) {
+    if (!isContained(store.backups, backup)) {
         throw new Error("Skill backup is missing or unsafe.");
     }
-    const original = readFileSync(backup, "utf8");
+    const { text: original } = readStableText(backup, { label: "Skill backup", maxBytes: MAX_SKILL_BYTES, private: true });
     if (sha256(original) !== application.before_digest)
         throw new Error("Skill backup digest does not match the application ledger.");
     atomicWriteTarget(target.path, original, application.target_mode);
-    if (sha256(readFileSync(target.path)) !== application.before_digest) {
+    if (assertSafeTarget(store.project_root, application.target_path).digest !== application.before_digest) {
         throw new Error("Skill rollback digest verification failed; the application remains marked as applied.");
     }
     const rolledBack = skillApplicationSchema.parse({

package/mcp-memory-server/dist/stable-file.js

@@ -0,0 +1,85 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from "node:fs";
+import { dirname } from "node:path";
+import { posixPrivateMetadataIsSafe, privatePathIsSafe } from "./platform-security.js";
+function sameFile(left, right) {
+    return right.isFile() && !right.isSymbolicLink()
+        && left.dev === right.dev && left.ino === right.ino && left.size === right.size
+        && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs
+        && left.uid === right.uid && left.gid === right.gid && left.mode === right.mode;
+}
+/** Bind bounded runtime reads to the inspected file, not a later pathname. */
+export function readStableFile(path, options) {
+    const { label, maxBytes } = options;
+    let descriptor;
+    try {
+        if (!Number.isSafeInteger(maxBytes) || maxBytes < 1)
+            throw new Error();
+        // Opening never relies on a prior pathname check. Nonblocking/no-ctty
+        // flags make special-file admission bounded before descriptor inspection.
+        descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0)
+            | (constants.O_NOCTTY ?? 0) | (process.platform === "win32" ? 0 : constants.O_NONBLOCK ?? 0));
+        const opened = fstatSync(descriptor);
+        if (!opened.isFile() || opened.size > maxBytes)
+            throw new Error();
+        const parent = lstatSync(dirname(path));
+        const named = lstatSync(path);
+        if (named.isSymbolicLink() || parent.isSymbolicLink())
+            throw new Error(`${label} crosses a symlink.`);
+        if (!parent.isDirectory() || !sameFile(opened, named))
+            throw new Error();
+        if (options.private) {
+            if (process.platform === "win32" ? !privatePathIsSafe(path) : !posixPrivateMetadataIsSafe(opened))
+                throw new Error();
+            if (!sameFile(opened, lstatSync(path)))
+                throw new Error();
+        }
+        // One extra byte detects growth without following it or growing allocation.
+        const buffer = Buffer.allocUnsafe(opened.size + 1);
+        let offset = 0;
+        while (offset < buffer.length) {
+            const count = readSync(descriptor, buffer, offset, buffer.length - offset, null);
+            if (count === 0)
+                break;
+            offset += count;
+        }
+        const after = fstatSync(descriptor);
+        const parentAfter = lstatSync(dirname(path));
+        if (!sameFile(opened, after) || offset !== opened.size
+            || !parentAfter.isDirectory() || parentAfter.isSymbolicLink()
+            || parent.dev !== parentAfter.dev || parent.ino !== parentAfter.ino
+            || (options.private && process.platform === "win32" && !privatePathIsSafe(path))
+            || !sameFile(opened, lstatSync(path)))
+            throw new Error();
+        return { bytes: buffer.subarray(0, offset), stat: opened };
+    }
+    catch (error) {
+        // Do not quote paths, private payloads or operating-system diagnostics.
+        if (error instanceof Error && error.message === `${label} crosses a symlink.`)
+            throw error;
+        if (error.code === "ELOOP")
+            throw new Error(`${label} crosses a symlink.`);
+        throw new Error(`${label} is unsafe, changed or unreadable.`);
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
+}
+export function readStableText(path, options) {
+    const { bytes, stat } = readStableFile(path, options);
+    try {
+        return { text: new TextDecoder("utf-8", { fatal: true }).decode(bytes), stat };
+    }
+    catch {
+        throw new Error(`${options.label} contains invalid UTF-8.`);
+    }
+}
+export function readStableJson(path, options) {
+    const { text } = readStableText(path, options);
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${options.label} contains invalid JSON.`);
+    }
+}

package/mcp-memory-server/dist/work-evidence-store.js

@@ -1,10 +1,11 @@
 import { createHash, randomUUID } from "node:crypto";
-import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { execFileSync, spawnSync } from "node:child_process";
 import { basename, dirname, join, resolve } from "node:path";
 import { getArtifactLimits, isArtifactStoreEnabled } from "./artifact-schema.js";
 import { putArtifact } from "./artifact-store.js";
-import { hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
+import { hardenPrivatePath } from "./platform-security.js";
+import { readStableJson } from "./stable-file.js";
 import { WORK_EVIDENCE_SCHEMA_VERSION, completeWorkEvidenceSchema, contextUsageReceiptInputSchema, getWorkEvidenceLimits, isWorkEvidenceEnabled, isWorkEvidencePatchEnabled, pendingWorkEvidenceSchema, storedWorkEvidenceSchema, workEvidenceIdSchema, workEvidenceLinkSchema, } from "./work-evidence-schema.js";
 const MAX_RECORD_BYTES = 1024 * 1024;
 const STALE_PENDING_MS = 24 * 60 * 60 * 1000;
@@ -97,11 +98,12 @@ function atomicJson(path, value) {
     hardenPrivatePath(path);
 }
 function readJson(path) {
-    const info = lstatSync(path);
-    if (!info.isFile() || info.isSymbolicLink() || info.size > MAX_RECORD_BYTES || !privatePathIsSafe(path)) {
+    try {
+        return readStableJson(path, { label: "Work-evidence record", maxBytes: MAX_RECORD_BYTES, private: true });
+    }
+    catch {
         throw new Error("Unsafe work-evidence record.");
     }
-    return JSON.parse(readFileSync(path, "utf8"));
 }
 function gitBuffer(root, args, maxBuffer = 16 * 1024 * 1024) {
     return execFileSync("git", ["-C", root, ...args], {