@cairnkeep/cli 2.8.0 → 2.11.0

package/docs/privacy-and-data-flow.md

@@ -16,6 +16,9 @@ request unless the corresponding endpoint and credential are configured.
 | `domain_knowledge_sync` | Files selected by the sync configuration | `ANYTHINGLLM_BASE_URL` |
 | `route_check` | A health request, with no memory or prompt content | `CAIRN_ROUTE_ENDPOINT` |
 | `context_explore` | Repository path and query are passed to the configured local executable | `CAIRN_EXPLORE_BINARY`; any further data flow is controlled by that tool |
+| Local context-pack install/list/read/substring search | None | Verified immutable files and project pointers under `CAIRN_PACK_BASE_DIR` |
+| Embedding-ranked context-pack search | Enabled file chunks not already cached, plus the query | The explicitly configured embedding endpoint; failure falls back locally |
+| Authenticated HTTP context-pack retrieval | MCP requests and enabled document/approved-skill content | The explicit Cairnkeep HTTP server; requires separate pack HTTP consent |
 | Optional Graphify workflow | The repository path, exact query/symbol names, root `graphify-out/` work directory, and local `.planning/graphs/` publication are passed to or produced by the operator-installed `graphify` executable | Local Graphify subprocess with a minimal environment and no provider credentials; managed build uses code-only `update`, never semantic document extraction |
 | Remote HTTP memory | MCP requests and responses, including memory content | The explicitly registered Cairnkeep HTTP server |
 | Opt-in trajectory capture | None | Local `<project>/.agentfs/trajectory.db` only; no model or HTTP path exists |
@@ -33,6 +36,8 @@ request unless the corresponding endpoint and credential are configured.
 | Automatic compaction recovery | None | Structured categories are injected locally; raw summary and other bodies are excluded |
 | Explicit artifact read/show | The redacted body only when HTTP is separately enabled and the operator/client explicitly reads it | Local terminal/stdio, or the explicitly registered authenticated server |
 | Opt-in evaluation coordinator | Adapter-defined inference may leave the machine only according to the explicit operator-owned adapter and inherited environment | Local adapter subprocess; Cairnkeep supplies no provider, endpoint, credential, model, or network default |
+| Guided project setup | None | Selected scaffold assets and private `.ai/cairnkeep.json` state in the target; machine sync is never automatic |
+| Pi memory extension | None | Local `cairn memory-server` stdio child; no HTTP transport is inherited |
 
 Model endpoints may be local or remote. Cairnkeep cannot determine a provider's
 retention, training, or logging policy; verify it before sending confidential
@@ -88,6 +93,35 @@ and its generated `revert.sh` restores exact bytes, modes, and layout. Explicit
 `cairn eval delete` and `prune` remove selected contained experiment trees with
 no hidden tombstone.
 
+## Guided setup and Pi bridge
+
+Guided setup performs a read-only target and Git preflight before project
+writes. Its schema-v1 `.ai/cairnkeep.json` record contains the package version,
+Git and memory choices, selected harness names, and setup-owned asset paths,
+digests, modes, and template identifiers. It does not contain credentials,
+endpoints, absolute paths, prompts, or memory values. The file is mode `0600`
+on POSIX and receives the private managed-file ACL on native Windows. Setup
+never invokes machine sync, and it does not start a harness or server child.
+
+When the explicitly installed Pi memory extension starts a session, it spawns
+`cairn memory-server` as a child in the project directory over local stdio. The
+bridge removes `MCP_HTTP_PORT` from the child environment, retains only the
+newest 16 KiB of child stderr for bounded failure diagnostics, caps startup,
+calls, catalogs, and results, and closes the child at shutdown. The child still
+inherits the remaining operator environment needed by the normal local server,
+so those environment values and the project directory are a child-process trust
+boundary even though they are not persisted by the bridge.
+
+Catalog and call replay is allow-listed to MCP tool metadata and result fields.
+Names, schemas, annotations, content, `structuredContent`, `_meta`, and error
+state are preserved without sanitizing away protocol meaning; Pi receives the
+annotations in trusted result `details` because Pi 0.84.1 has no native
+annotations field. The bridge does not log requests or results, create a second
+catalog, activate prompts or skills, add remote access, or persist a transcript.
+Sanitized test replay uses synthetic tool arguments, results, stderr, and
+project paths only; release evidence must not include credentials, private
+endpoints, memory values, or identifying local paths.
+
 ## Evaluation adapter and report flow
 
 `CAIRN_EVAL` is unset/off by default. With it off, `cairn eval` returns a fixed
@@ -166,7 +200,9 @@ network-free, and permanently scoped as framework-only evidence.
 SIGINT/SIGTERM stops new schedule admission, terminates the active adapter,
 checkpoints cancellation, performs bounded cleanup, and retains a partial
 report. POSIX process groups receive TERM followed by bounded KILL escalation.
-There is no Windows descendant-process-tree termination guarantee.
+Native Windows uses `taskkill.exe /T` for the exact child tree and `/F` for
+bounded force escalation; it does not enumerate or terminate unrelated
+processes.
 
 Turns aggregate only under exact matching compatibility IDs. Missing token
 components/totals, unknown verifier outcomes, incompatible turn semantics, and
@@ -512,3 +548,17 @@ provide tenant isolation or per-scope authorization.
 Before sharing diagnostics, remove credentials, private endpoints, database
 files, memory values, local paths, and project names. Report vulnerabilities
 through the private channel in [SECURITY.md](../SECURITY.md).
+
+## Context-pack trust boundary
+
+Pack validation proves that installed bytes match the manifest and immutable
+digest. It does not authenticate a publisher. Review the source, commit, license,
+and content before enabling a digest; signatures are not yet supported. Local
+directory installation, listing, reading, and substring search make no network
+request. Git installation/update contacts only the operator-supplied source and
+is never scheduled in the background.
+
+All enabled documents carry pack and file provenance in MCP results. Skill files
+are excluded until the current project approves the exact pack digest, path, and
+file digest. Updating the pack invalidates that approval. Approval only makes a
+skill readable; Cairnkeep never copies it into a harness or executes it.

package/docs/storage.md

@@ -21,6 +21,9 @@ registration, memory remains on that computer.
 | Opt-in session trajectories and capability callback state | `<harness project root>/.agentfs/trajectory.db` |
 | Opt-in local artifacts and compaction revisions | `<project root>/.agentfs/artifacts.db` |
 | Opt-in evaluation reports and note snapshots | `<project root>/.agentfs/eval/experiments/<experiment-id>/` |
+| Immutable context-pack objects and source records | `${CAIRN_PACK_BASE_DIR:-~/.cairnkeep/packs}/objects/` and `sources/` |
+| Digest-pinned context-pack project pointers and approvals | `${CAIRN_PACK_BASE_DIR:-~/.cairnkeep/packs}/projects/` |
+| Optional context-pack embedding cache | `${CAIRN_PACK_BASE_DIR:-~/.cairnkeep/packs}/cache/` (outside immutable objects) |
 | Opt-in derived hindsight notes | `${CAIRN_AGENTFS_BASE_DIR:-~/.cairnkeep}/notes/` |
 | Any named/global scope, such as `identity` or `work` | `${CAIRN_AGENTFS_BASE_DIR:-~/.cairnkeep}/<scope>.db` |
 
@@ -28,6 +31,17 @@ For the local launchers, the server working directory is normally the project
 root. Bootstrap installs `.agentfs/.gitignore` so private project memory is not
 accidentally committed. SQLite may also create `-wal` and `-shm` sidecar files.
 
+Private-file protection is platform-equivalent rather than mode-identical.
+Linux and macOS use `0600` files and `0700` directories. Native Windows removes
+inherited ACLs and grants access only to the current SID, Local System, and the
+built-in Administrators group. `cairn doctor` fails closed when a managed MCP
+profile or context-pack pointer has broader access. Context-pack objects also
+receive a read-only attribute after their content digest is verified.
+
+Where this document names a generated `revert.sh`, native Windows produces the
+equivalent backup manifest and `revert.ps1`; it restores exact bytes and the
+Windows ACL contract rather than emulating POSIX mode bits.
+
 `CAIRN_LLM_API_URL` and `CAIRN_MEMORY_EMBEDDING_URL` select optional model
 services used to process/search memory. They do not change where the SQLite
 databases are stored. Git-provider and routing configuration do not change
@@ -493,3 +507,18 @@ bearer_token_env_var = "CAIRN_MEMORY_HTTP_TOKEN"
 "X-Cairn-Scopes" = "identity,personal,project"
 "X-Cairn-AnythingLLM-Workspaces" = "engineering-patterns"
 ```
+
+## Context-pack storage
+
+Context-pack objects are content-addressed, immutable directories. Installation
+copies verified content through a temporary directory and atomically publishes
+the digest; a failed or concurrent install never changes project enablement.
+Project pointers are separate atomic private files (`0600` on POSIX, restricted
+ACLs on Windows) keyed by canonical local project identity or a validated
+remote project ID. Updates retain old objects
+and switch only the named project after exact-digest confirmation.
+
+`cairn doctor` verifies objects, pointers, and interrupted-install remnants.
+It never chooses a pack version or grants a skill approval. `cairn pack remove`
+refuses any referenced digest. Ordinary uninstall retains this directory even
+when memory is removed; `--purge-packs` is the separate backup-first consent.

package/examples/eval/bundled-fake.json

@@ -1 +1 @@
-{"identifier":"cairn-offline-fake-v1","package_version":"2.8.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}
+{"identifier":"cairn-offline-fake-v1","package_version":"2.11.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}

package/mcp-memory-server/dist/artifact-store-windows-worker.js

@@ -0,0 +1,74 @@
+import { AgentFS } from "agentfs-sdk";
+import { deleteArtifactForWindowsWorker, doctorArtifactStore, getArtifactDbPath, listArtifacts, pruneArtifactsForWindowsWorker, putArtifact, readArtifact, readLatestCompaction, recordUnsupportedCompactionAdapter, } from "./artifact-store.js";
+async function readRequest() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(Buffer.from(chunk));
+    const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    if (!parsed || typeof parsed.operation !== "string" || typeof parsed.projectRoot !== "string") {
+        throw new Error("Invalid Windows artifact worker request.");
+    }
+    return parsed;
+}
+function resolvedOptions(options = {}) {
+    const { now, ...rest } = options;
+    return { ...rest, ...(now ? { now: new Date(now) } : {}) };
+}
+async function rawOperation(request) {
+    const agent = await AgentFS.open({ id: "artifacts", path: getArtifactDbPath(request.projectRoot) });
+    try {
+        if (request.action === "list")
+            return await agent.kv.list(request.prefix ?? "");
+        if (request.action === "get")
+            return await agent.kv.get(request.key ?? "");
+        if (request.action === "set") {
+            await agent.kv.set(request.key ?? "", request.value);
+            return null;
+        }
+        if (request.action === "delete") {
+            await agent.kv.delete(request.key ?? "");
+            return null;
+        }
+        throw new Error("Unsupported raw Windows artifact operation.");
+    }
+    finally {
+        await agent.close();
+    }
+}
+async function dispatch(request) {
+    const limits = request.limits;
+    if (request.operation === "put" && limits) {
+        return { result: await putArtifact(request.projectRoot, request.candidate, limits, resolvedOptions(request.options)) };
+    }
+    if (request.operation === "read" && request.identifier) {
+        return { result: await readArtifact(request.identifier, request.projectRoot) };
+    }
+    if (request.operation === "list") {
+        return { result: await listArtifacts(request.projectRoot, request.filters) };
+    }
+    if (request.operation === "latest") {
+        return { result: await readLatestCompaction(request.projectRoot, request.sessionRef) };
+    }
+    if (request.operation === "delete" && request.identifier) {
+        return deleteArtifactForWindowsWorker(request.identifier, request.projectRoot, request.options);
+    }
+    if (request.operation === "prune" && limits) {
+        return pruneArtifactsForWindowsWorker(request.projectRoot, limits, resolvedOptions(request.options));
+    }
+    if (request.operation === "record-unsupported") {
+        await recordUnsupportedCompactionAdapter(request.projectRoot, request.diagnostic);
+        return { result: null };
+    }
+    if (request.operation === "doctor" && limits) {
+        return { result: await doctorArtifactStore(request.projectRoot, request.repair, limits) };
+    }
+    if (request.operation === "raw")
+        return { result: await rawOperation(request) };
+    throw new Error("Unsupported Windows artifact worker operation.");
+}
+dispatch(await readRequest())
+    .then((response) => process.stdout.write(JSON.stringify(response)))
+    .catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});

package/mcp-memory-server/dist/artifact-store.js

@@ -1,9 +1,12 @@
 import { randomUUID } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { AgentFS } from "agentfs-sdk";
 import { ARTIFACT_SCHEMA_VERSION, artifactEnvelopeSchema, artifactWriteInputSchema, canonicalBytes, canonicalJson, getArtifactLimits, sha256Hex, truncateUtf8, } from "./artifact-schema.js";
 import { redactLocalValue } from "./trajectory-redaction.js";
+import { atomicReplace } from "./platform-security.js";
 const META_KEY = "artifact/meta/schema-version";
 const FULL_PREFIX = "artifact/full/";
 const INDEX_PREFIX = "artifact/index/";
@@ -14,6 +17,40 @@ const SEQUENCE_PREFIX = "compaction/sequence/";
 const DIAGNOSTIC_PREFIX = "artifact/meta/unsupported-adapter/";
 const MAX_DIAGNOSTICS = 32;
 const mutationQueues = new Map();
+const artifactWorkerPath = fileURLToPath(new URL("./artifact-store-windows-worker.js", import.meta.url));
+function useWindowsArtifactWorker() {
+    return (process.platform === "win32" || process.env.CAIRN_TEST_WINDOWS_ARTIFACT_WORKER === "1")
+        && resolve(process.argv[1] ?? "") !== resolve(artifactWorkerPath);
+}
+async function runArtifactWorker(request) {
+    return new Promise((resolvePromise, rejectPromise) => {
+        const child = spawn(process.execPath, [artifactWorkerPath], {
+            env: process.env,
+            stdio: ["pipe", "pipe", "pipe"],
+            windowsHide: true,
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (chunk) => { stdout += chunk.toString("utf8"); });
+        child.stderr.on("data", (chunk) => {
+            stderr = `${stderr}${chunk.toString("utf8")}`.slice(-1024 * 1024);
+        });
+        child.once("error", rejectPromise);
+        child.once("close", (code) => {
+            if (code !== 0) {
+                rejectPromise(new Error(stderr.trim() || "Windows artifact worker failed."));
+                return;
+            }
+            try {
+                resolvePromise(JSON.parse(stdout));
+            }
+            catch (error) {
+                rejectPromise(error);
+            }
+        });
+        child.stdin.end(JSON.stringify(request));
+    });
+}
 export function getArtifactDbPath(projectRoot = process.cwd()) {
     return resolve(projectRoot, ".agentfs", "artifacts.db");
 }
@@ -273,7 +310,7 @@ async function rebuildPointers(agent) {
     if (latest)
         await agent.kv.set(PROJECT_LATEST_KEY, latest.artifact_id);
 }
-async function rewriteArtifactDatabase(projectRoot, rows) {
+async function rewriteArtifactDatabase(projectRoot, rows, deferReplacement = false) {
     const dbPath = getArtifactDbPath(projectRoot);
     const rewritePath = `${dbPath}.rewrite-${randomUUID()}`;
     const rewrite = await AgentFS.open({ id: "artifacts", path: rewritePath });
@@ -288,11 +325,33 @@ async function rewriteArtifactDatabase(projectRoot, rows) {
         await rewrite.close();
     }
     chmodSync(rewritePath, 0o600);
+    if (deferReplacement)
+        return rewritePath;
     for (const suffix of ["-wal", "-shm"]) {
         rmSync(`${rewritePath}${suffix}`, { force: true });
         rmSync(`${dbPath}${suffix}`, { force: true });
     }
-    renameSync(rewritePath, dbPath);
+    await atomicReplace(rewritePath, dbPath);
+    return undefined;
+}
+async function installArtifactWorkerRewrite(projectRoot, rewritePath) {
+    if (!rewritePath)
+        throw new Error("Windows artifact worker did not produce a replacement database.");
+    const dbPath = getArtifactDbPath(projectRoot);
+    if (!rewritePath.startsWith(`${dbPath}.rewrite-`) || dirname(rewritePath) !== dirname(dbPath)) {
+        throw new Error("Windows artifact worker returned an invalid replacement path.");
+    }
+    try {
+        for (const suffix of ["-wal", "-shm"]) {
+            rmSync(`${rewritePath}${suffix}`, { force: true });
+            rmSync(`${dbPath}${suffix}`, { force: true });
+        }
+        await atomicReplace(rewritePath, dbPath);
+    }
+    finally {
+        for (const suffix of ["", "-wal", "-shm"])
+            rmSync(`${rewritePath}${suffix}`, { force: true });
+    }
 }
 function planPrune(artifacts, limits, options) {
     const sorted = sortedOldest(artifacts);
@@ -369,6 +428,15 @@ async function pruneInTransaction(agent, limits, options) {
 export async function putArtifact(projectRoot, candidate, limits = getArtifactLimits(), options = {}) {
     const prepared = prepareInput(projectRoot, candidate, limits);
     return withMutationLock(projectRoot, async () => {
+        if (useWindowsArtifactWorker()) {
+            return (await runArtifactWorker({
+                operation: "put",
+                projectRoot: resolve(projectRoot),
+                candidate,
+                limits,
+                options,
+            })).result;
+        }
         const agent = await openArtifactStore(projectRoot, true);
         if (!agent)
             throw new Error("Unable to open the local artifact store.");
@@ -443,6 +511,13 @@ export async function putCompactionArtifact(projectRoot, candidate, limits = get
     return putArtifact(projectRoot, parsed, limits, options);
 }
 export async function readArtifact(identifier, projectRoot = process.cwd()) {
+    if (useWindowsArtifactWorker()) {
+        return (await runArtifactWorker({
+            operation: "read",
+            identifier,
+            projectRoot: resolve(projectRoot),
+        })).result;
+    }
     const agent = await openArtifactStore(projectRoot, false);
     if (!agent)
         throw new Error("Artifact not found.");
@@ -455,6 +530,13 @@ export async function readArtifact(identifier, projectRoot = process.cwd()) {
     }
 }
 export async function listArtifacts(projectRoot = process.cwd(), filters = {}) {
+    if (useWindowsArtifactWorker()) {
+        return (await runArtifactWorker({
+            operation: "list",
+            projectRoot: resolve(projectRoot),
+            filters,
+        })).result;
+    }
     const agent = await openArtifactStore(projectRoot, false);
     if (!agent)
         return { schema_version: ARTIFACT_SCHEMA_VERSION, artifacts: [], logical_bytes: 0 };
@@ -486,6 +568,13 @@ export async function listArtifacts(projectRoot = process.cwd(), filters = {}) {
     }
 }
 export async function readLatestCompaction(projectRoot = process.cwd(), sessionRef) {
+    if (useWindowsArtifactWorker()) {
+        return (await runArtifactWorker({
+            operation: "latest",
+            projectRoot: resolve(projectRoot),
+            sessionRef,
+        })).result;
+    }
     const agent = await openArtifactStore(projectRoot, false);
     if (!agent)
         return null;
@@ -505,70 +594,114 @@ export async function readLatestCompaction(projectRoot = process.cwd(), sessionR
     }
 }
 export const selectRecoveryArtifact = readLatestCompaction;
+async function deleteArtifactLocally(identifier, projectRoot, options, deferReplacement) {
+    const agent = await openArtifactStore(projectRoot, false);
+    if (!agent)
+        throw new Error("Artifact not found.");
+    let retainedRows;
+    let result;
+    try {
+        await assertCompatibleSchema(agent, false);
+        const artifact = await findByIdentifier(agent, identifier);
+        if (!options.dryRun) {
+            await inImmediateTransaction(agent, async () => {
+                await deleteArtifactRows(agent, artifact);
+                await rebuildPointers(agent);
+            });
+            await agent.getDatabase().exec("PRAGMA wal_checkpoint(TRUNCATE)");
+            retainedRows = await agent.kv.list("");
+        }
+        result = {
+            schema_version: ARTIFACT_SCHEMA_VERSION,
+            artifact_id: artifact.artifact_id,
+            deleted: !options.dryRun,
+            dry_run: Boolean(options.dryRun),
+        };
+    }
+    finally {
+        await agent.close();
+    }
+    const rewritePath = retainedRows
+        ? await rewriteArtifactDatabase(projectRoot, retainedRows, deferReplacement)
+        : undefined;
+    return { result, rewritePath };
+}
+export async function deleteArtifactForWindowsWorker(identifier, projectRoot, options = {}) {
+    return deleteArtifactLocally(identifier, projectRoot, options, !options.dryRun);
+}
 export async function deleteArtifact(identifier, projectRoot = process.cwd(), options = {}) {
     return withMutationLock(projectRoot, async () => {
-        const agent = await openArtifactStore(projectRoot, false);
-        if (!agent)
-            throw new Error("Artifact not found.");
-        let retainedRows;
-        let result;
-        try {
-            await assertCompatibleSchema(agent, false);
-            const artifact = await findByIdentifier(agent, identifier);
-            if (!options.dryRun) {
-                await inImmediateTransaction(agent, async () => {
-                    await deleteArtifactRows(agent, artifact);
-                    await rebuildPointers(agent);
-                });
-                await agent.getDatabase().exec("PRAGMA wal_checkpoint(TRUNCATE)");
-                retainedRows = await agent.kv.list("");
-            }
-            result = {
-                schema_version: ARTIFACT_SCHEMA_VERSION,
-                artifact_id: artifact.artifact_id,
-                deleted: !options.dryRun,
-                dry_run: Boolean(options.dryRun),
-            };
-        }
-        finally {
-            await agent.close();
+        if (useWindowsArtifactWorker()) {
+            const response = await runArtifactWorker({
+                operation: "delete",
+                identifier,
+                projectRoot: resolve(projectRoot),
+                options,
+            });
+            if (!options.dryRun)
+                await installArtifactWorkerRewrite(projectRoot, response.rewritePath);
+            return response.result;
         }
-        if (retainedRows)
-            await rewriteArtifactDatabase(projectRoot, retainedRows);
-        return result;
+        return (await deleteArtifactLocally(identifier, projectRoot, options, false)).result;
     });
 }
+async function pruneArtifactsLocally(projectRoot, limits, options, deferReplacement) {
+    const agent = await openArtifactStore(projectRoot, false);
+    if (!agent) {
+        return { result: { schema_version: 1, dry_run: Boolean(options.dryRun), removed: [], remaining_artifacts: 0, logical_bytes: 0 } };
+    }
+    let retainedRows;
+    let result;
+    try {
+        await assertCompatibleSchema(agent, false);
+        const resolved = {
+            dryRun: options.dryRun ?? false,
+            includeProtected: options.includeProtected ?? false,
+            now: options.now ?? new Date(),
+        };
+        result = await inImmediateTransaction(agent, () => pruneInTransaction(agent, limits, resolved));
+        if (!resolved.dryRun && result.removed.length > 0) {
+            await agent.getDatabase().exec("PRAGMA wal_checkpoint(TRUNCATE)");
+            retainedRows = await agent.kv.list("");
+        }
+    }
+    finally {
+        await agent.close();
+    }
+    const rewritePath = retainedRows
+        ? await rewriteArtifactDatabase(projectRoot, retainedRows, deferReplacement)
+        : undefined;
+    return { result, ...(rewritePath ? { rewritePath } : {}) };
+}
+export async function pruneArtifactsForWindowsWorker(projectRoot, limits = getArtifactLimits(), options = {}) {
+    return pruneArtifactsLocally(projectRoot, limits, options, !options.dryRun);
+}
 export async function pruneArtifacts(projectRoot, limits = getArtifactLimits(), options = {}) {
     return withMutationLock(projectRoot, async () => {
-        const agent = await openArtifactStore(projectRoot, false);
-        if (!agent) {
-            return { schema_version: 1, dry_run: Boolean(options.dryRun), removed: [], remaining_artifacts: 0, logical_bytes: 0 };
-        }
-        let retainedRows;
-        let result;
-        try {
-            await assertCompatibleSchema(agent, false);
-            const resolved = {
-                dryRun: options.dryRun ?? false,
-                includeProtected: options.includeProtected ?? false,
-                now: options.now ?? new Date(),
-            };
-            result = await inImmediateTransaction(agent, () => pruneInTransaction(agent, limits, resolved));
-            if (!resolved.dryRun && result.removed.length > 0) {
-                await agent.getDatabase().exec("PRAGMA wal_checkpoint(TRUNCATE)");
-                retainedRows = await agent.kv.list("");
-            }
-        }
-        finally {
-            await agent.close();
+        if (useWindowsArtifactWorker()) {
+            const response = await runArtifactWorker({
+                operation: "prune",
+                projectRoot: resolve(projectRoot),
+                limits,
+                options,
+            });
+            if (!options.dryRun && response.rewritePath)
+                await installArtifactWorkerRewrite(projectRoot, response.rewritePath);
+            return response.result;
         }
-        if (retainedRows)
-            await rewriteArtifactDatabase(projectRoot, retainedRows);
-        return result;
+        return (await pruneArtifactsLocally(projectRoot, limits, options, false)).result;
     });
 }
 export async function recordUnsupportedCompactionAdapter(projectRoot, diagnostic = {}) {
     await withMutationLock(projectRoot, async () => {
+        if (useWindowsArtifactWorker()) {
+            await runArtifactWorker({
+                operation: "record-unsupported",
+                projectRoot: resolve(projectRoot),
+                diagnostic,
+            });
+            return;
+        }
         const agent = await openArtifactStore(projectRoot, true);
         if (!agent)
             return;
@@ -727,6 +860,14 @@ function inspectRetentionState(artifacts, limits) {
     return issues;
 }
 export async function doctorArtifactStore(projectRoot = process.cwd(), repair = false, limits = getArtifactLimits()) {
+    if (useWindowsArtifactWorker()) {
+        return (await runArtifactWorker({
+            operation: "doctor",
+            projectRoot: resolve(projectRoot),
+            repair,
+            limits,
+        })).result;
+    }
     const dbPath = getArtifactDbPath(projectRoot);
     if (!existsSync(dbPath)) {
         return { schema_version: 1, exists: false, ok: true, repaired: false, integrity: "not_present", valid_artifacts: 0, indexed_artifacts: 0, issues: [] };

package/mcp-memory-server/dist/capability-cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { lstat } from "node:fs/promises";
 import { join } from "node:path";
+import { privatePathIsSafe } from "./platform-security.js";
 import { capabilityAdapterClassificationSchema, finishOperatingCapability, operatingCapabilityBypassResultSchema, operatingCapabilityHandleSchema, startOperatingCapability, } from "./capability-adapter.js";
 import { readCapabilityConfig, resetCapabilityLogging, resetCapabilityOverride, resolveCapabilityStatus, setCapabilityLogging, setCapabilityOverride, } from "./capability-config.js";
 import { CAPABILITY_CALLBACK_SCHEMA_VERSION, doctorCapabilityRecords, } from "./capability-store.js";
@@ -226,7 +227,7 @@ async function configDoctor() {
     try {
         const info = await lstat(path);
         exists = true;
-        unsafePermissions = info.isSymbolicLink() || !info.isFile() || (info.mode & 0o077) !== 0;
+        unsafePermissions = info.isSymbolicLink() || !info.isFile() || !privatePathIsSafe(path);
     }
     catch (error) {
         if (error.code !== "ENOENT")

package/mcp-memory-server/dist/capability-config.js

@@ -1,7 +1,8 @@
 import { createHash, randomBytes } from "node:crypto";
 import { constants } from "node:fs";
-import { chmod, lstat, mkdir, open, rename, rm, } from "node:fs/promises";
+import { lstat, mkdir, open, rename, rm, } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
+import { hardenPrivatePath } from "./platform-security.js";
 import { CAPABILITY_REGISTRY } from "./capability-registry.js";
 import { CAPABILITY_IDS, CAPABILITY_SCHEMA_VERSION, capabilityIdSchema, capabilityManagedConfigSchema, capabilityStatusSchema, } from "./capability-schema.js";
 const MAX_CONFIG_BYTES = 64 * 1024;
@@ -247,9 +248,9 @@ async function atomicWriteConfig(path, config) {
         await handle.sync();
         await handle.close();
         handle = undefined;
-        await chmod(temporary, 0o600);
+        hardenPrivatePath(temporary);
         await rename(temporary, path);
-        await chmod(path, 0o600);
+        hardenPrivatePath(path);
     }
     finally {
         if (handle)