@cairnkeep/cli 2.22.3 → 2.22.5

package/scripts/test-runtime-file-security.mjs

@@ -0,0 +1,311 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import { syncBuiltinESMExports } from "node:module";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { gzipSync } from "node:zlib";
+
+import { readSetupPolicy, buildSetupPlan } from "./setup-core.mjs";
+import { reconcileSetupPlan } from "./setup-reconcile.mjs";
+import { diagnoseSetup } from "./setup.mjs";
+import { reconcilePlaybookInstructions } from "./playbook-instructions.mjs";
+import { createTar, runWindowsCommand } from "./windows-platform.mjs";
+import { readStableFile, readStableText } from "./lib/stable-file.mjs";
+
+const root = fs.mkdtempSync(join(tmpdir(), "cairn-cli-file-security-"));
+const failures = [];
+const original = {
+  lstat: fs.lstatSync, open: fs.openSync, close: fs.closeSync,
+  read: fs.readSync, readFile: fs.readFileSync,
+  rename: fs.renameSync, write: fs.writeFileSync,
+};
+let swap = 0;
+function restore() {
+  fs.lstatSync = original.lstat;
+  fs.openSync = original.open;
+  fs.closeSync = original.close;
+  fs.readSync = original.read;
+  fs.readFileSync = original.readFile;
+  fs.renameSync = original.rename;
+  fs.writeFileSync = original.write;
+  syncBuiltinESMExports();
+}
+function write(path, value, mode = 0o600) {
+  fs.mkdirSync(dirname(path), { recursive: true });
+  fs.writeFileSync(path, value, { mode });
+}
+async function control(name, operation) {
+  try { await operation(); }
+  catch (error) { failures.push(`${name}: ${error.message}`); }
+}
+async function substitute(path, occurrence, replacement, operation) {
+  const candidate = join(root, "swaps", `${++swap}.candidate`);
+  const inspected = join(root, "swaps", `${swap}.inspected`);
+  write(candidate, replacement, fs.statSync(path).mode & 0o777);
+  let calls = 0;
+  let injected = false;
+  fs.lstatSync = (target, ...args) => {
+    const info = original.lstat(target, ...args);
+    if (target === path && ++calls === occurrence) {
+      injected = true;
+      fs.renameSync(path, inspected);
+      fs.renameSync(candidate, path);
+    }
+    return info;
+  };
+  syncBuiltinESMExports();
+  try { await operation(); }
+  finally { restore(); assert.equal(injected, true, "the actual reader must encounter replacement"); }
+}
+async function grow(path, operation) {
+  const inspectedSize = fs.statSync(path).size;
+  const descriptors = new Set();
+  let injected = false;
+  let unbounded = false;
+  const allocations = [];
+  function change() {
+    if (!injected) { injected = true; fs.appendFileSync(path, " ".repeat(2 * 1024 * 1024)); }
+  }
+  fs.openSync = (target, ...args) => {
+    const fd = original.open(target, ...args);
+    if (target === path) descriptors.add(fd);
+    return fd;
+  };
+  fs.closeSync = (fd) => { descriptors.delete(fd); return original.close(fd); };
+  fs.readSync = (fd, buffer, ...args) => {
+    if (descriptors.has(fd)) { change(); allocations.push(buffer.byteLength); }
+    return original.read(fd, buffer, ...args);
+  };
+  fs.readFileSync = (target, ...args) => {
+    if (target === path || descriptors.has(target)) { unbounded = true; change(); }
+    return original.readFile(target, ...args);
+  };
+  syncBuiltinESMExports();
+  try { await operation(); }
+  finally {
+    restore();
+    assert.equal(injected, true, "the actual reader must encounter growth");
+    assert.equal(unbounded, false, "CLI readers must not use an unbounded readFile result");
+    assert.ok(allocations.every((size) => size <= inspectedSize + 1));
+    assert.equal(descriptors.size, 0, "failed reads must close descriptors");
+  }
+}
+
+try {
+  const missingProject = join(root, "not-created-yet");
+  assert.equal(reconcilePlaybookInstructions(missingProject, { check: true }).status, "would-created");
+  assert.equal(fs.existsSync(missingProject), false, "instruction preflight must not create a new project");
+  assert.throws(() => reconcilePlaybookInstructions(missingProject), /ENOENT/);
+  const helperFixture = join(root, "helper.txt");
+  write(helperFixture, "bounded", 0o644);
+  assert.equal(readStableText(helperFixture, { label: "Fixture", maxBytes: 7 }).text, "bounded");
+  fs.readSync = (descriptor, buffer, offset, length, position) => original.read(descriptor, buffer, offset, Math.min(2, length), position);
+  syncBuiltinESMExports();
+  try { assert.equal(readStableText(helperFixture, { label: "Fixture", maxBytes: 7 }).text, "bounded", "partial reads must assemble complete content"); }
+  finally { restore(); }
+  let readAttempts = 0;
+  fs.readSync = (...args) => { readAttempts += 1; return original.read(...args); };
+  syncBuiltinESMExports();
+  try {
+    assert.throws(() => readStableFile(helperFixture, { label: "Fixture", maxBytes: 6 }), /unsafe/);
+    if (process.platform !== "win32") assert.throws(() => readStableFile("/dev/null", { label: "Fixture", maxBytes: 7 }), /unsafe/);
+    assert.equal(readAttempts, 0, "oversized and special files must be rejected before content reads");
+  } finally { restore(); }
+  write(helperFixture, Buffer.from([0xff]), 0o644);
+  assert.throws(() => readStableText(helperFixture, { label: "Fixture", maxBytes: 7 }), /UTF-8/);
+  if (process.platform !== "win32") assert.throws(() => readStableFile(helperFixture, { label: "Fixture", maxBytes: 7, privateMode: 0o600 }), /unsafe/);
+
+  const policyPath = join(root, "policy.json");
+  write(policyPath, '{"schema_version":1,"defaults":{},"constraints":{}}', 0o644);
+  assert.equal(readSetupPolicy(policyPath).schema_version, 1);
+  await control("setup policy growth", () => grow(policyPath, () => {
+    assert.throws(() => readSetupPolicy(policyPath), /unsafe|changed|limit/i);
+  }));
+
+  const project = join(root, "project");
+  fs.mkdirSync(project);
+  const plan = buildSetupPlan({
+    target: project,
+    preflight: { targetState: "empty", gitExecutable: "available", repository: "work-tree" },
+    choices: { git: "existing", harnesses: ["claude"], memory: "local", confirmed: true },
+  });
+  const created = await reconcileSetupPlan(plan);
+  assert.equal(diagnoseSetup(project).status, "complete");
+  const rerun = await reconcileSetupPlan(plan, { previousState: created.state });
+  assert.deepEqual(rerun.counts, { created: 0, updated: 0, unchanged: plan.assets.length, skipped: 0 },
+    "native mode representation must not discard generated-file ownership");
+  const statePath = join(project, ".ai", "cairnkeep.json");
+  const stateBytes = fs.readFileSync(statePath);
+  await control("setup diagnosis state growth", () => grow(statePath, () => {
+    assert.equal(diagnoseSetup(project).status, "incomplete");
+  }));
+  write(statePath, stateBytes);
+  const owned = join(project, ".ai", "start-claude.sh");
+  const ownedBytes = fs.readFileSync(owned);
+  write(owned, "# Caller-owned launcher.\n", 0o755);
+  await control("setup diagnosis owned replacement", () => substitute(owned, 1, ownedBytes, () => {
+    assert.equal(diagnoseSetup(project).status, "incomplete", "replacement must not restore recorded ownership");
+  }));
+  write(owned, "# Caller-owned launcher.\n", 0o755);
+  await control("setup reconciliation ownership replacement", () => substitute(owned, 2, ownedBytes, async () => {
+    await assert.rejects(() => reconcileSetupPlan(plan, { previousState: created.state }), /unsafe|changed/i);
+  }));
+  write(owned, ownedBytes, 0o755);
+  await control("setup mutation ownership recheck", async () => {
+    const update = { ...plan, assets: [ { ...plan.assets.find((asset) => asset.path === ".ai/start-claude.sh"), bytes: Buffer.from("# Generated update.\n") } ] };
+    let observed;
+    let inspected = false;
+    let injected = false;
+    fs.openSync = (path, ...args) => {
+      const descriptor = original.open(path, ...args);
+      if (path === owned) observed = descriptor;
+      return descriptor;
+    };
+    fs.closeSync = (descriptor) => {
+      if (descriptor === observed) inspected = true;
+      return original.close(descriptor);
+    };
+    fs.lstatSync = (path, ...args) => {
+      if (inspected && !injected && path === dirname(owned)) {
+        injected = true;
+        original.write(owned, "# Concurrent caller rule.\n");
+      }
+      return original.lstat(path, ...args);
+    };
+    syncBuiltinESMExports();
+    try {
+      await assert.rejects(() => reconcileSetupPlan(update, { previousState: created.state }), /changed|unsafe/i);
+      assert.equal(injected, true);
+      assert.equal(fs.readFileSync(owned, "utf8"), "# Concurrent caller rule.\n");
+    } finally { restore(); write(owned, ownedBytes, 0o755); }
+  });
+
+  const agents = join(project, "AGENTS.md");
+  write(agents, "# User rules\n\nRetain this line.\n", 0o640);
+  assert.equal(reconcilePlaybookInstructions(project, { check: true }).status, "would-updated");
+  await control("playbook instructions growth", () => grow(agents, () => {
+    assert.throws(() => reconcilePlaybookInstructions(project, { check: true }), /unsafe|changed|bounded/i);
+  }));
+  write(agents, "# User rules\n\nRetain this line.\n", 0o640);
+  fs.chmodSync(agents, 0o640);
+  assert.equal(reconcilePlaybookInstructions(project).status, "updated");
+  assert.match(fs.readFileSync(agents, "utf8"), /Retain this line/);
+  if (process.platform !== "win32") assert.equal(fs.statSync(agents).mode & 0o777, 0o640);
+  assert.equal(reconcilePlaybookInstructions(project).status, "unchanged");
+  await control("instruction mutation ownership recheck", () => {
+    write(agents, "# Prior instructions\n", 0o640);
+    let injected = false;
+    fs.writeFileSync = (path, ...args) => {
+      if (!injected && typeof path === "string" && basename(path).startsWith(".AGENTS.md.")) {
+        injected = true;
+        original.write(agents, "# Concurrent caller rule.\n");
+      }
+      return original.write(path, ...args);
+    };
+    fs.openSync = (path, ...args) => {
+      if (!injected && typeof path === "string" && basename(path).startsWith(".AGENTS.md.")) {
+        injected = true;
+        original.write(agents, "# Concurrent caller rule.\n");
+      }
+      return original.open(path, ...args);
+    };
+    syncBuiltinESMExports();
+    try {
+      assert.throws(() => reconcilePlaybookInstructions(project), /changed|unsafe/i);
+      assert.equal(injected, true);
+      assert.equal(fs.readFileSync(agents, "utf8"), "# Concurrent caller rule.\n");
+      assert.equal(fs.readdirSync(project).some((name) => name.startsWith(".AGENTS.md.")), false);
+    } finally { restore(); }
+  });
+  const unapproved = join(root, "unapproved");
+  fs.mkdirSync(unapproved);
+  write(join(unapproved, "AGENTS.md"), "# Private rule\n", 0o640);
+  if (process.platform !== "win32") {
+    const linkedProject = join(root, "linked-project");
+    fs.symlinkSync(unapproved, linkedProject, "dir");
+    await control("playbook project symlink", () => {
+      assert.throws(() => reconcilePlaybookInstructions(linkedProject), /unsafe|symlink|directory/i);
+      assert.equal(fs.readFileSync(join(unapproved, "AGENTS.md"), "utf8"), "# Private rule\n");
+    });
+  }
+
+  const archive = join(root, "memory.tgz");
+  const archiveBytes = gzipSync(createTar([["project.db", Buffer.from("New database fixture.")]]));
+  write(archive, archiveBytes);
+  const memory = join(root, "memory");
+  const database = join(memory, "project.db");
+  write(database, "Prior database fixture.");
+  const repository = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+  const previousBase = process.env.CAIRN_AGENTFS_BASE_DIR;
+  process.env.CAIRN_AGENTFS_BASE_DIR = memory;
+  try {
+    await control("Windows archive growth", () => grow(archive, async () => {
+      await assert.rejects(() => runWindowsCommand({ command: "memory", args: ["import", archive], root: repository }), /unsafe|changed/i);
+    }));
+    write(archive, archiveBytes);
+    fs.renameSync = (source, destination) => {
+      if (destination === database) throw Object.assign(new Error("Synthetic denied replacement."), { code: "EPERM" });
+      return original.rename(source, destination);
+    };
+    syncBuiltinESMExports();
+    await control("Windows denied replacement retention", async () => {
+      try {
+        await assert.rejects(() => runWindowsCommand({ command: "memory", args: ["import", archive], root: repository }), /denied/i);
+        assert.equal(fs.readFileSync(database, "utf8"), "Prior database fixture.", "replacement failure must retain the live database");
+        assert.deepEqual(fs.readdirSync(memory).filter((name) => name.includes(".tmp-")), [], "failed replacement must clean its own temporary files");
+      } finally { restore(); }
+    });
+    write(database, "Prior database fixture.");
+    let denied = 0;
+    fs.renameSync = (source, destination) => {
+      if (destination === database && denied++ < 2) {
+        assert.equal(fs.readFileSync(database, "utf8"), "Prior database fixture.");
+        throw Object.assign(new Error("Synthetic transient sharing violation."), { code: "EBUSY" });
+      }
+      return original.rename(source, destination);
+    };
+    syncBuiltinESMExports();
+    try {
+      await runWindowsCommand({ command: "memory", args: ["import", archive], root: repository });
+      assert.equal(denied, 3);
+      assert.equal(fs.readFileSync(database, "utf8"), "New database fixture.");
+    } finally { restore(); }
+    write(database, "Prior database fixture.");
+    if (process.platform !== "win32") {
+      const outside = join(root, "outside-target");
+      write(outside, "Outside sentinel.");
+      let injected = false;
+      let collidingTemporary;
+      function substituteTemporary(path) {
+        if (!injected && typeof path === "string" && dirname(path) === memory
+            && basename(path).startsWith("project.db.tmp-")) {
+          injected = true;
+          collidingTemporary = path;
+          fs.symlinkSync(outside, path);
+        }
+      }
+      fs.openSync = (path, ...args) => { substituteTemporary(path); return original.open(path, ...args); };
+      fs.writeFileSync = (path, ...args) => { substituteTemporary(path); return original.write(path, ...args); };
+      syncBuiltinESMExports();
+      await control("Windows exclusive temporary publication", async () => {
+        try {
+          await assert.rejects(() => runWindowsCommand({ command: "memory", args: ["import", archive], root: repository }), /exist|unsafe/i);
+          assert.equal(injected, true);
+          assert.equal(fs.readFileSync(outside, "utf8"), "Outside sentinel.", "temporary symlink must not receive private content");
+          assert.equal(fs.readFileSync(database, "utf8"), "Prior database fixture.");
+          assert.equal(fs.lstatSync(collidingTemporary).isSymbolicLink(), true, "a collision must not delete an unowned temporary name");
+        } finally { restore(); }
+      });
+    }
+  } finally {
+    if (previousBase === undefined) delete process.env.CAIRN_AGENTFS_BASE_DIR;
+    else process.env.CAIRN_AGENTFS_BASE_DIR = previousBase;
+  }
+
+  assert.deepEqual(failures, [], "CLI file boundaries must fail closed without changing ownership");
+} finally {
+  restore();
+  fs.rmSync(root, { recursive: true, force: true });
+}
+console.log("PASS: bounded setup/instruction/archive reads and denied/exclusive Windows publication");

package/scripts/test-setup-reconcile.mjs

@@ -18,6 +18,7 @@ import {
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { readStableFile } from "./lib/stable-file.mjs";
 
 const EXPECTED_RED_EXIT = 86;
 const RED_MARKER = "PHASE26_RED:SETUP_RECONCILE_MISSING";
@@ -172,8 +173,9 @@ async function testOwnershipBranches(reconciler, fixture, baseline) {
 
   writeFileSync(ownedPath, "operator-owned\n");
   chmodSync(ownedPath, 0o700);
-  const userBytes = readFileSync(ownedPath);
-  const userMtime = statSync(ownedPath).mtimeMs;
+  const userSnapshot = readStableFile(ownedPath, { label: "Operator-owned setup fixture", maxBytes: 1024 * 1024 });
+  const userBytes = userSnapshot.bytes;
+  const userMtime = userSnapshot.stat.mtimeMs;
   const diverged = await reconciler.reconcileSetupPlan(plan(fixture.target, [fixture.first]), { previousState: updated.state });
   assertCounts(diverged, { created: 0, updated: 0, unchanged: 0, skipped: 1 });
   assert.deepEqual(readFileSync(ownedPath), userBytes);

package/scripts/test-windows-native.mjs

@@ -21,6 +21,10 @@ import { HARNESS_IDS } from "./harness-registry.mjs";
 const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
 // Runs on real Windows and POSIX, independently of shell-only doctor checks.
 await import("./test-setup-diagnosis.mjs");
+await import("./test-runtime-file-security.mjs");
+await import("./test-container-health.mjs");
+await import("./test-omp-staged-security.mjs");
+await import("./test-release-verification.mjs");
 const sandbox = mkdtempSync(join(tmpdir(), "cairn-windows-native-"));
 const originalBase = process.env.CAIRN_AGENTFS_BASE_DIR;
 const originalPackBase = process.env.CAIRN_PACK_BASE_DIR;

package/scripts/verify-omp-capture.mjs

@@ -79,6 +79,7 @@ function writeFakeInfra(sandbox) {
   writeFileSync(stub, STUB_SERVER);
   chmodSync(stub, 0o755);
   copyFileSync(stageWrapper, join(fakeRoot, "scripts", "lib", "omp-capture-stage.mjs"));
+  copyFileSync(join(root, "scripts", "lib", "stable-file.mjs"), join(fakeRoot, "scripts", "lib", "stable-file.mjs"));
   return fakeRoot;
 }
 

package/scripts/verify-phase19-runtime-evidence.mjs

@@ -2,6 +2,8 @@
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
+import fs from "node:fs";
+import { syncBuiltinESMExports } from "node:module";
 import {
   existsSync,
   lstatSync,
@@ -15,6 +17,7 @@ import {
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { readStableFile } from "./lib/stable-file.mjs";
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const EVIDENCE_RELATIVE = join(
@@ -250,9 +253,7 @@ function assertNoSentinels(bytes, label) {
 function readOwnedFile(root, relative) {
   const label = safeRelative(relative, "evidence file");
   const path = join(root, label);
-  const info = lstatSync(path);
-  if (!info.isFile() || info.isSymbolicLink() || info.size > 16 * 1024 * 1024) throw new Error(`${label}: unsafe evidence file`);
-  const bytes = readFileSync(path);
+  const { bytes } = readStableFile(path, { label: "Runtime evidence file", maxBytes: 16 * 1024 * 1024 });
   assertNoSentinels(bytes, label);
   return bytes;
 }
@@ -762,6 +763,44 @@ function expectFailure(label, operation) {
   assert.throws(operation, undefined, label);
 }
 
+function testEvidenceReadRaces(root) {
+  const path = join(root, "read-race.log");
+  const original = { readFileSync: fs.readFileSync, readSync: fs.readSync, lstatSync: fs.lstatSync };
+  let injected = false;
+  const grow = () => {
+    if (!injected) { injected = true; fs.appendFileSync(path, "changed-after-inspection\n"); }
+  };
+  writeFileSync(path, "original\n");
+  fs.readFileSync = (candidate, ...args) => { if (candidate === path) grow(); return original.readFileSync(candidate, ...args); };
+  fs.readSync = (...args) => { grow(); return original.readSync(...args); };
+  syncBuiltinESMExports();
+  try {
+    assert.throws(() => readOwnedFile(root, "read-race.log"), /unsafe|changed/,
+      "evidence reader accepted bytes changed after inspection");
+    assert.equal(injected, true, "evidence growth race was not exercised");
+  } finally { Object.assign(fs, original); syncBuiltinESMExports(); }
+
+  writeFileSync(path, "original\n");
+  const replacement = join(root, "replacement.log");
+  writeFileSync(replacement, "replacement\n");
+  injected = false;
+  fs.lstatSync = (candidate, ...args) => {
+    const result = original.lstatSync(candidate, ...args);
+    if (candidate === path && !injected) {
+      injected = true;
+      renameSync(path, join(root, "old.log"));
+      renameSync(replacement, path);
+    }
+    return result;
+  };
+  syncBuiltinESMExports();
+  try {
+    assert.throws(() => readOwnedFile(root, "read-race.log"), /unsafe|changed/,
+      "evidence reader accepted a pathname replacement");
+    assert.equal(injected, true, "evidence replacement race was not exercised");
+  } finally { Object.assign(fs, original); syncBuiltinESMExports(); }
+}
+
 function selfTest() {
   const sourceCommit = requireSuccess(git(ROOT, ["rev-parse", "HEAD"]), "read self-test source commit");
   requireCommit(sourceCommit);
@@ -787,6 +826,7 @@ function selfTest() {
     "published contract mutation did not change its digest");
   const root = mkdtempSync(join(tmpdir(), "cairn-phase19-evidence-"));
   try {
+    testEvidenceReadRaces(root);
     const valid = join(root, "valid");
     writeFixture(valid, sourceCommit);
     verifyEvidence(valid, sourceCommit);

package/scripts/verify-published-release.mjs

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { readStableFile } from "./lib/stable-file.mjs";
+import { releaseAttestationArguments, validateReleaseOptions, verifyPublishedRelease } from "./lib/release-verification.mjs";
+
+const usage = "Usage: node scripts/verify-published-release.mjs --version X.Y.Z --commit SHA --tree SHA --ci-run ID --security-run ID --publish-run ID --out FILE [--repo OWNER/REPO] [--gh PATH] [--npm PATH]";
+function optionsFrom(args) {
+  const options = { repo: "cairnkeep/cairnkeep", gh: "gh", npm: "npm" };
+  const keys = new Map([["--version", "version"], ["--commit", "commit"], ["--tree", "tree"], ["--ci-run", "ciRun"],
+    ["--security-run", "securityRun"], ["--publish-run", "publishRun"], ["--repo", "repo"], ["--gh", "gh"], ["--npm", "npm"], ["--out", "out"]]);
+  const seen = new Set();
+  for (let i = 0; i < args.length; i += 2) {
+    const key = keys.get(args[i]);
+    if (!key || seen.has(key) || !args[i + 1] || args[i + 1].startsWith("--")) throw new Error(usage);
+    seen.add(key); options[key] = args[i + 1];
+  }
+  if (!options.out) throw new Error(usage);
+  validateReleaseOptions(options);
+  return options;
+}
+
+function run(command, args, options = {}) {
+  const result = spawnSync(command, args, { encoding: "utf8", timeout: 60000, maxBuffer: 16 * 1024 * 1024, ...options });
+  if (result.error || result.status !== 0) {
+    const operation = ["api", "run", "release", "install", "audit", "attestation"].includes(args[0]) ? args[0] : "required";
+    throw new Error(`Release verification failed: ${operation} command unavailable, timed out or failed.`);
+  }
+  return result.stdout;
+}
+
+async function bytesFrom(url, maxBytes, headers = {}, blobRedirects = false) {
+  const signal = AbortSignal.timeout(30000);
+  let response;
+  for (let redirects = 0; redirects <= 3; redirects++) {
+    response = await fetch(url, { headers, redirect: "manual", signal });
+    if (![301, 302, 303, 307, 308].includes(response.status)) break;
+    const next = new URL(response.headers.get("location"), url);
+    await response.body?.cancel();
+    if (!blobRedirects || redirects === 3 || next.protocol !== "https:"
+      || next.hostname !== "pkg-containers.githubusercontent.com" || next.username || next.password || next.port) {
+      throw new Error("Release verification failed: unexpected registry redirect.");
+    }
+    url = next.href; headers = {}; // Never forward registry authorization.
+  }
+  if (!response.ok || !response.body) throw new Error("Release verification failed: remote response unavailable.");
+  const declared = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > maxBytes) { await response.body.cancel(); throw new Error("Release verification failed: remote byte limit."); }
+  const reader = response.body.getReader();
+  const chunks = []; let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read(); if (done) break;
+      total += value.byteLength;
+      if (total > maxBytes) throw new Error("Release verification failed: remote byte limit.");
+      chunks.push(Buffer.from(value));
+    }
+    return Buffer.concat(chunks, total);
+  } finally { await reader.cancel().catch(() => {}); reader.releaseLock(); }
+}
+const parse = bytes => JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+const digest = bytes => `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+
+async function main(args) {
+  if (args.length === 1 && ["--help", "-h"].includes(args[0])) { console.log(usage); return; }
+  const options = optionsFrom(args);
+  const { gh, npm, out, ...expected } = options;
+  const output = resolve(out);
+  try { fs.lstatSync(output); throw new Error("Release verification failed: output already exists."); }
+  catch (error) { if (error.code !== "ENOENT") throw error; }
+  const scratch = fs.mkdtempSync(join(tmpdir(), "cairn-release-verification-"));
+  fs.chmodSync(scratch, 0o700);
+  const ghRun = args => run(gh, args);
+  const readDirectory = directory => new Map(fs.readdirSync(directory).map(name => [name,
+    readStableFile(join(directory, name), { label: "Release verification input", maxBytes: 64 * 1024 * 1024 }).bytes]));
+  const tokens = new Map();
+  try {
+    const io = {
+      api: async suffix => JSON.parse(ghRun(["api", `repos/${expected.repo}/${suffix}`])),
+      candidate: async artifact => {
+        const directory = join(scratch, "candidate");
+        ghRun(["run", "download", expected.ciRun, "--repo", expected.repo, "--name", artifact.name, "--dir", directory]);
+        return readDirectory(directory);
+      },
+      release: async () => {
+        const directory = join(scratch, "release");
+        ghRun(["release", "download", `v${expected.version}`, "--repo", expected.repo, "--dir", directory]);
+        return readDirectory(directory);
+      },
+      registry: async () => parse(await bytesFrom(`https://registry.npmjs.org/@cairnkeep%2fcli/${expected.version}`, 8 * 1024 * 1024)),
+      tarball: async url => bytesFrom(url, 64 * 1024 * 1024),
+      verifyNpm: async tarball => {
+        const prefix = join(scratch, "npm");
+        run(npm, ["install", "--prefix", prefix, `@cairnkeep/cli@${expected.version}`, "--ignore-scripts", "--no-audit", "--no-fund", "--registry", "https://registry.npmjs.org"]);
+        const lock = parse(readStableFile(join(prefix, "package-lock.json"), { label: "Verification install lock", maxBytes: 8 * 1024 * 1024 }).bytes);
+        if (lock.packages?.["node_modules/@cairnkeep/cli"]?.integrity !== `sha512-${createHash("sha512").update(tarball).digest("base64")}`) {
+          throw new Error("Release verification failed: audited package/candidate binding.");
+        }
+        const audited = run(npm, ["audit", "signatures", "--prefix", prefix, "--registry", "https://registry.npmjs.org"]);
+        return /[1-9][0-9]* packages have verified registry signatures/.test(audited)
+          && /[1-9][0-9]* packages have verified attestations/.test(audited);
+      },
+      oci: async (image, kind, ref) => {
+        if (!tokens.has(image)) {
+          const result = parse(await bytesFrom(`https://ghcr.io/token?service=ghcr.io&scope=repository:${image}:pull`, 64 * 1024));
+          if (typeof result.token !== "string" || !result.token) throw new Error("Release verification failed: anonymous OCI access.");
+          tokens.set(image, result.token);
+        }
+        const bytes = await bytesFrom(`https://ghcr.io/v2/${image}/${kind}/${ref}`, 16 * 1024 * 1024, {
+          Authorization: `Bearer ${tokens.get(image)}`,
+          Accept: "application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json",
+        }, kind === "blobs");
+        return { digest: digest(bytes), value: parse(bytes) };
+      },
+      verifyAttestation: async (image, imageDigest) => {
+        const verified = JSON.parse(ghRun(releaseAttestationArguments(image, imageDigest, expected)));
+        return Array.isArray(verified) && verified.length > 0;
+      },
+    };
+    const report = await verifyPublishedRelease(expected, io);
+    fs.writeFileSync(output, `${JSON.stringify(report, null, 2)}\n`, { flag: "wx", mode: 0o600 });
+    console.log(JSON.stringify(report));
+  } finally { fs.rmSync(scratch, { recursive: true, force: true }); }
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const previousMask = process.umask(0o077);
+  try { await main(process.argv.slice(2)); }
+  catch (error) {
+    console.error(error.message === usage || error.message?.startsWith("Release verification failed:")
+      ? error.message : "Release verification failed; no verified report was written.");
+    process.exitCode = 1;
+  } finally { process.umask(previousMask); }
+}