@cairnkeep/cli 2.8.0 → 2.11.0

package/mcp-memory-server/dist/capability-harness.js

@@ -1,13 +1,14 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { constants } from "node:fs";
 import { homedir } from "node:os";
-import { chmod, lstat, mkdir, open, readdir, realpath, rename, rm, stat, } from "node:fs/promises";
+import { lstat, mkdir, open, readdir, realpath, rename, rm, stat, } from "node:fs/promises";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { z } from "zod";
 import { isCapabilityContractEnabled, resolveCapabilityStatus, } from "./capability-config.js";
 import { operatingCapabilityHandleSchema, } from "./capability-adapter.js";
 import { CAPABILITY_CALLBACK_SCHEMA_VERSION, isOperatingCapabilitySettled, issueOperatingCapability, settleOperatingCapability, } from "./capability-store.js";
 import { isTrajectoryCaptureEnabled } from "./trajectory-schema.js";
+import { hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
 const LEASE_DIRECTORY_NAME = "capability-leases-v1";
 const LEASE_SCHEMA_VERSION = 1;
 const MAX_LEASE_BYTES = 4_096;
@@ -124,12 +125,13 @@ async function ensureLeaseDirectory(options = {}) {
     const rootInfo = await lstat(root);
     if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink())
         throw new Error("Harness state root is unsafe.");
+    hardenPrivatePath(root);
     const directory = getHarnessCapabilityLeaseDirectory(options);
     await mkdir(directory, { recursive: true, mode: 0o700 });
     const info = await lstat(directory);
     if (!info.isDirectory() || info.isSymbolicLink())
         throw new Error("Harness lease directory is unsafe.");
-    await chmod(directory, 0o700);
+    hardenPrivatePath(directory);
     return directory;
 }
 async function canonicalProjectBinding(rawRoot) {
@@ -185,9 +187,9 @@ async function writeLease(lease, options = {}) {
         await handle.sync();
         await handle.close();
         handle = undefined;
-        await chmod(temporary, 0o600);
+        hardenPrivatePath(temporary);
         await rename(temporary, path);
-        await chmod(path, 0o600);
+        hardenPrivatePath(path);
     }
     finally {
         if (handle)
@@ -200,7 +202,7 @@ async function readLease(path) {
     try {
         handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
         const info = await handle.stat();
-        if (!info.isFile() || info.size > MAX_LEASE_BYTES || (info.mode & 0o077) !== 0)
+        if (!info.isFile() || info.size > MAX_LEASE_BYTES || !privatePathIsSafe(path))
             return undefined;
         const bytes = await handle.readFile();
         if (bytes.byteLength > MAX_LEASE_BYTES)
@@ -216,7 +218,32 @@ async function readLease(path) {
     }
 }
 async function removeLease(path) {
-    await rm(path, { force: true });
+    let lastError;
+    for (let attempt = 0; attempt < 12; attempt += 1) {
+        try {
+            await rm(path, { force: true });
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== "EPERM" && code !== "EBUSY")
+                throw error;
+            lastError = error;
+            if (process.platform === "win32" && attempt === 0) {
+                try {
+                    const info = await lstat(path);
+                    if (info.isFile() && !info.isSymbolicLink())
+                        hardenPrivatePath(path);
+                }
+                catch (aclError) {
+                    if (aclError.code === "ENOENT")
+                        return;
+                }
+            }
+            await new Promise((resolveDelay) => setTimeout(resolveDelay, 25 * (attempt + 1)));
+        }
+    }
+    throw lastError;
 }
 function capabilityState(snapshot, id) {
     const state = snapshot.capabilities.find((row) => row.id === id);
@@ -280,7 +307,7 @@ async function matchingLeases(input, options = {}) {
     let entries;
     try {
         const info = await lstat(directory);
-        if (!info.isDirectory() || info.isSymbolicLink() || (info.mode & 0o077) !== 0)
+        if (!info.isDirectory() || info.isSymbolicLink() || !privatePathIsSafe(directory))
             return [];
         entries = (await readdir(directory, { withFileTypes: true }))
             .sort((left, right) => left.name.localeCompare(right.name))

package/mcp-memory-server/dist/context-pack-cli.js

@@ -0,0 +1,185 @@
+import { existsSync } from "node:fs";
+import { rm } from "node:fs/promises";
+import { resolve } from "node:path";
+import { applyContextPackUpdate, approvePackSkill, contextPackBaseDirectory, disableContextPack, doctorContextPacks, enableContextPack, initializeContextPack, inspectContextPackUpdate, installContextPack, listInstalledContextPacks, listPackSkills, lockContextPack, readProjectPointer, removeContextPack, resolveInstalledPack, revokePackSkill, validateContextPack, } from "./context-pack.js";
+function usage() {
+    process.stderr.write(`Usage:
+  cairn pack init [DIRECTORY] [--id ID] [--version VERSION] [--title TITLE] [--description TEXT] [--license LICENSE]
+  cairn pack lock|validate [DIRECTORY]
+  cairn pack install SOURCE [--ref REF]
+  cairn pack list [--json]
+  cairn pack show SELECTOR [--json]
+  cairn pack remove SELECTOR
+  cairn pack enable|disable SELECTOR [--project PATH | --project-id ID]
+  cairn pack update SELECTOR --check [--project PATH | --project-id ID]
+  cairn pack update SELECTOR --apply --confirm DIGEST [--project PATH | --project-id ID]
+  cairn pack skills [--project PATH | --project-id ID] [--json]
+  cairn pack approve-skill SELECTOR PATH --confirm FILE_DIGEST [--project PATH | --project-id ID]
+  cairn pack revoke-skill SELECTOR PATH [--project PATH | --project-id ID]
+`);
+    process.exit(2);
+}
+function take(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0)
+        return undefined;
+    const value = args[index + 1];
+    if (!value || value.startsWith("--"))
+        usage();
+    args.splice(index, 2);
+    return value;
+}
+function flag(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0)
+        return false;
+    args.splice(index, 1);
+    return true;
+}
+function projectOptions(args) {
+    const projectRoot = take(args, "--project");
+    const projectId = take(args, "--project-id");
+    if (projectRoot && projectId)
+        usage();
+    return projectId ? { projectId } : { projectRoot: projectRoot ?? process.cwd() };
+}
+function output(value, json, human) {
+    process.stdout.write(`${json ? JSON.stringify(value) : human ?? JSON.stringify(value, null, 2)}\n`);
+}
+async function main() {
+    const args = process.argv.slice(2);
+    const command = args.shift();
+    const json = flag(args, "--json");
+    if (command === "init") {
+        const directory = args[0] && !args[0].startsWith("--") ? args.shift() : process.cwd();
+        const manifest = await initializeContextPack(directory, {
+            id: take(args, "--id"), version: take(args, "--version"), title: take(args, "--title"),
+            description: take(args, "--description"), license: take(args, "--license"),
+        });
+        if (args.length)
+            usage();
+        output(manifest, json, `Initialized ${resolve(directory)}/context-pack.json`);
+        return;
+    }
+    if (command === "lock" || command === "validate") {
+        const directory = args.shift() ?? process.cwd();
+        if (args.length)
+            usage();
+        const result = command === "lock" ? await lockContextPack(directory) : await validateContextPack(directory);
+        output(result, json, command === "lock" ? `Locked ${resolve(directory)}/context-pack.json` : `Valid context pack: ${result.digest}`);
+        return;
+    }
+    if (command === "install") {
+        const source = args.shift();
+        if (!source)
+            usage();
+        const ref = take(args, "--ref");
+        if (args.length)
+            usage();
+        const result = await installContextPack(source, { ref });
+        output({ id: result.pack.manifest.id, version: result.pack.manifest.version, digest: result.pack.digest, source: result.source, existing: result.existing }, json, `${result.existing ? "Already installed" : "Installed"} ${result.pack.manifest.id}@${result.pack.manifest.version} ${result.pack.digest}`);
+        return;
+    }
+    if (command === "list") {
+        if (args.length)
+            usage();
+        const packs = await listInstalledContextPacks();
+        output({ schema_version: 1, packs }, json, packs.length ? packs.map((pack) => `${pack.id}@${pack.version}\t${pack.digest}`).join("\n") : "No context packs installed.");
+        return;
+    }
+    if (command === "show") {
+        const selector = args.shift();
+        if (!selector || args.length)
+            usage();
+        const pack = await resolveInstalledPack(selector);
+        output({ ...pack.manifest, digest: pack.digest, total_bytes: pack.total_bytes }, json);
+        return;
+    }
+    if (command === "remove") {
+        const selector = args.shift();
+        if (!selector || args.length)
+            usage();
+        const digest = await removeContextPack(selector);
+        output({ removed: true, digest }, json, `Removed context pack ${digest}.`);
+        return;
+    }
+    if (command === "enable" || command === "disable") {
+        const selector = args.shift();
+        if (!selector)
+            usage();
+        const project = projectOptions(args);
+        if (args.length)
+            usage();
+        const pointer = command === "enable" ? await enableContextPack(selector, project) : await disableContextPack(selector, project);
+        output(pointer, json, `${command === "enable" ? "Enabled" : "Disabled"} context pack ${selector}.`);
+        return;
+    }
+    if (command === "update") {
+        const selector = args.shift();
+        if (!selector)
+            usage();
+        const check = flag(args, "--check");
+        const apply = flag(args, "--apply");
+        const confirm = take(args, "--confirm");
+        const project = projectOptions(args);
+        if (args.length || check === apply || (apply && !confirm) || (check && confirm))
+            usage();
+        const result = check ? await inspectContextPackUpdate(selector, project) : await applyContextPackUpdate(selector, confirm, project);
+        output(result, json, check ? `${result.changed ? "Update available" : "Up to date"}: ${result.candidate_digest}` : `Applied context pack update ${result.candidate_digest}.`);
+        return;
+    }
+    if (command === "skills") {
+        const project = projectOptions(args);
+        if (args.length)
+            usage();
+        const skills = await listPackSkills(project);
+        output({ schema_version: 1, skills }, json, skills.length ? skills.map((row) => `${row.approved ? "approved" : "unapproved"}\t${row.pack_id}\t${row.path}\t${row.file_digest}`).join("\n") : "No context pack skills.");
+        return;
+    }
+    if (command === "approve-skill" || command === "revoke-skill") {
+        const selector = args.shift();
+        const path = args.shift();
+        if (!selector || !path)
+            usage();
+        const confirm = take(args, "--confirm");
+        const project = projectOptions(args);
+        if (args.length || (command === "approve-skill" && !confirm) || (command === "revoke-skill" && confirm))
+            usage();
+        const pointer = command === "approve-skill"
+            ? await approvePackSkill(selector, path, confirm, project)
+            : await revokePackSkill(selector, path, project);
+        output(pointer, json, `${command === "approve-skill" ? "Approved" : "Revoked"} ${path}.`);
+        return;
+    }
+    if (command === "doctor") {
+        if (args.length)
+            usage();
+        const result = await doctorContextPacks();
+        output(result, json, result.ok ? `Context packs healthy (${result.objects} objects, ${result.projects} projects).` : `Context pack problems: ${[...result.issues, ...result.temporary_remnants].join("; ")}`);
+        if (!result.ok)
+            process.exitCode = 1;
+        return;
+    }
+    if (command === "purge") {
+        if (!flag(args, "--yes") || args.length)
+            usage();
+        const base = contextPackBaseDirectory();
+        if (existsSync(base))
+            await rm(base, { recursive: true, force: true });
+        output({ purged: true, path: base }, json, `Purged context pack data at ${base}.`);
+        return;
+    }
+    if (command === "status") {
+        const project = projectOptions(args);
+        if (args.length)
+            usage();
+        const pointer = readProjectPointer(project);
+        output(pointer, json);
+        return;
+    }
+    usage();
+}
+main().catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});