@cairnkeep/cli 2.9.0 → 2.11.0

package/mcp-memory-server/dist/artifact-store.js

@@ -1,9 +1,12 @@
 import { randomUUID } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { AgentFS } from "agentfs-sdk";
 import { ARTIFACT_SCHEMA_VERSION, artifactEnvelopeSchema, artifactWriteInputSchema, canonicalBytes, canonicalJson, getArtifactLimits, sha256Hex, truncateUtf8, } from "./artifact-schema.js";
 import { redactLocalValue } from "./trajectory-redaction.js";
+import { atomicReplace } from "./platform-security.js";
 const META_KEY = "artifact/meta/schema-version";
 const FULL_PREFIX = "artifact/full/";
 const INDEX_PREFIX = "artifact/index/";
@@ -14,6 +17,40 @@ const SEQUENCE_PREFIX = "compaction/sequence/";
 const DIAGNOSTIC_PREFIX = "artifact/meta/unsupported-adapter/";
 const MAX_DIAGNOSTICS = 32;
 const mutationQueues = new Map();
+const artifactWorkerPath = fileURLToPath(new URL("./artifact-store-windows-worker.js", import.meta.url));
+function useWindowsArtifactWorker() {
+    return (process.platform === "win32" || process.env.CAIRN_TEST_WINDOWS_ARTIFACT_WORKER === "1")
+        && resolve(process.argv[1] ?? "") !== resolve(artifactWorkerPath);
+}
+async function runArtifactWorker(request) {
+    return new Promise((resolvePromise, rejectPromise) => {
+        const child = spawn(process.execPath, [artifactWorkerPath], {
+            env: process.env,
+            stdio: ["pipe", "pipe", "pipe"],
+            windowsHide: true,
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (chunk) => { stdout += chunk.toString("utf8"); });
+        child.stderr.on("data", (chunk) => {
+            stderr = `${stderr}${chunk.toString("utf8")}`.slice(-1024 * 1024);
+        });
+        child.once("error", rejectPromise);
+        child.once("close", (code) => {
+            if (code !== 0) {
+                rejectPromise(new Error(stderr.trim() || "Windows artifact worker failed."));
+                return;
+            }
+            try {
+                resolvePromise(JSON.parse(stdout));
+            }
+            catch (error) {
+                rejectPromise(error);
+            }
+        });
+        child.stdin.end(JSON.stringify(request));
+    });
+}
 export function getArtifactDbPath(projectRoot = process.cwd()) {
     return resolve(projectRoot, ".agentfs", "artifacts.db");
 }
@@ -273,7 +310,7 @@ async function rebuildPointers(agent) {
     if (latest)
         await agent.kv.set(PROJECT_LATEST_KEY, latest.artifact_id);
 }
-async function rewriteArtifactDatabase(projectRoot, rows) {
+async function rewriteArtifactDatabase(projectRoot, rows, deferReplacement = false) {
     const dbPath = getArtifactDbPath(projectRoot);
     const rewritePath = `${dbPath}.rewrite-${randomUUID()}`;
     const rewrite = await AgentFS.open({ id: "artifacts", path: rewritePath });
@@ -288,11 +325,33 @@ async function rewriteArtifactDatabase(projectRoot, rows) {
         await rewrite.close();
     }
     chmodSync(rewritePath, 0o600);
+    if (deferReplacement)
+        return rewritePath;
     for (const suffix of ["-wal", "-shm"]) {
         rmSync(`${rewritePath}${suffix}`, { force: true });
         rmSync(`${dbPath}${suffix}`, { force: true });
     }
-    renameSync(rewritePath, dbPath);
+    await atomicReplace(rewritePath, dbPath);
+    return undefined;
+}
+async function installArtifactWorkerRewrite(projectRoot, rewritePath) {
+    if (!rewritePath)
+        throw new Error("Windows artifact worker did not produce a replacement database.");
+    const dbPath = getArtifactDbPath(projectRoot);
+    if (!rewritePath.startsWith(`${dbPath}.rewrite-`) || dirname(rewritePath) !== dirname(dbPath)) {
+        throw new Error("Windows artifact worker returned an invalid replacement path.");
+    }
+    try {
+        for (const suffix of ["-wal", "-shm"]) {
+            rmSync(`${rewritePath}${suffix}`, { force: true });
+            rmSync(`${dbPath}${suffix}`, { force: true });
+        }
+        await atomicReplace(rewritePath, dbPath);
+    }
+    finally {
+        for (const suffix of ["", "-wal", "-shm"])
+            rmSync(`${rewritePath}${suffix}`, { force: true });
+    }
 }
 function planPrune(artifacts, limits, options) {
     const sorted = sortedOldest(artifacts);
@@ -369,6 +428,15 @@ async function pruneInTransaction(agent, limits, options) {
 export async function putArtifact(projectRoot, candidate, limits = getArtifactLimits(), options = {}) {
     const prepared = prepareInput(projectRoot, candidate, limits);
     return withMutationLock(projectRoot, async () => {
+        if (useWindowsArtifactWorker()) {
+            return (await runArtifactWorker({
+                operation: "put",
+                projectRoot: resolve(projectRoot),
+                candidate,
+                limits,
+                options,
+            })).result;
+        }
         const agent = await openArtifactStore(projectRoot, true);
         if (!agent)
             throw new Error("Unable to open the local artifact store.");
@@ -443,6 +511,13 @@ export async function putCompactionArtifact(projectRoot, candidate, limits = get
     return putArtifact(projectRoot, parsed, limits, options);
 }
 export async function readArtifact(identifier, projectRoot = process.cwd()) {
+    if (useWindowsArtifactWorker()) {
+        return (await runArtifactWorker({
+            operation: "read",
+            identifier,
+            projectRoot: resolve(projectRoot),
+        })).result;
+    }
     const agent = await openArtifactStore(projectRoot, false);
     if (!agent)
         throw new Error("Artifact not found.");
@@ -455,6 +530,13 @@ export async function readArtifact(identifier, projectRoot = process.cwd()) {
     }
 }
 export async function listArtifacts(projectRoot = process.cwd(), filters = {}) {
+    if (useWindowsArtifactWorker()) {
+        return (await runArtifactWorker({
+            operation: "list",
+            projectRoot: resolve(projectRoot),
+            filters,
+        })).result;
+    }
     const agent = await openArtifactStore(projectRoot, false);
     if (!agent)
         return { schema_version: ARTIFACT_SCHEMA_VERSION, artifacts: [], logical_bytes: 0 };
@@ -486,6 +568,13 @@ export async function listArtifacts(projectRoot = process.cwd(), filters = {}) {
     }
 }
 export async function readLatestCompaction(projectRoot = process.cwd(), sessionRef) {
+    if (useWindowsArtifactWorker()) {
+        return (await runArtifactWorker({
+            operation: "latest",
+            projectRoot: resolve(projectRoot),
+            sessionRef,
+        })).result;
+    }
     const agent = await openArtifactStore(projectRoot, false);
     if (!agent)
         return null;
@@ -505,70 +594,114 @@ export async function readLatestCompaction(projectRoot = process.cwd(), sessionR
     }
 }
 export const selectRecoveryArtifact = readLatestCompaction;
+async function deleteArtifactLocally(identifier, projectRoot, options, deferReplacement) {
+    const agent = await openArtifactStore(projectRoot, false);
+    if (!agent)
+        throw new Error("Artifact not found.");
+    let retainedRows;
+    let result;
+    try {
+        await assertCompatibleSchema(agent, false);
+        const artifact = await findByIdentifier(agent, identifier);
+        if (!options.dryRun) {
+            await inImmediateTransaction(agent, async () => {
+                await deleteArtifactRows(agent, artifact);
+                await rebuildPointers(agent);
+            });
+            await agent.getDatabase().exec("PRAGMA wal_checkpoint(TRUNCATE)");
+            retainedRows = await agent.kv.list("");
+        }
+        result = {
+            schema_version: ARTIFACT_SCHEMA_VERSION,
+            artifact_id: artifact.artifact_id,
+            deleted: !options.dryRun,
+            dry_run: Boolean(options.dryRun),
+        };
+    }
+    finally {
+        await agent.close();
+    }
+    const rewritePath = retainedRows
+        ? await rewriteArtifactDatabase(projectRoot, retainedRows, deferReplacement)
+        : undefined;
+    return { result, rewritePath };
+}
+export async function deleteArtifactForWindowsWorker(identifier, projectRoot, options = {}) {
+    return deleteArtifactLocally(identifier, projectRoot, options, !options.dryRun);
+}
 export async function deleteArtifact(identifier, projectRoot = process.cwd(), options = {}) {
     return withMutationLock(projectRoot, async () => {
-        const agent = await openArtifactStore(projectRoot, false);
-        if (!agent)
-            throw new Error("Artifact not found.");
-        let retainedRows;
-        let result;
-        try {
-            await assertCompatibleSchema(agent, false);
-            const artifact = await findByIdentifier(agent, identifier);
-            if (!options.dryRun) {
-                await inImmediateTransaction(agent, async () => {
-                    await deleteArtifactRows(agent, artifact);
-                    await rebuildPointers(agent);
-                });
-                await agent.getDatabase().exec("PRAGMA wal_checkpoint(TRUNCATE)");
-                retainedRows = await agent.kv.list("");
-            }
-            result = {
-                schema_version: ARTIFACT_SCHEMA_VERSION,
-                artifact_id: artifact.artifact_id,
-                deleted: !options.dryRun,
-                dry_run: Boolean(options.dryRun),
-            };
-        }
-        finally {
-            await agent.close();
+        if (useWindowsArtifactWorker()) {
+            const response = await runArtifactWorker({
+                operation: "delete",
+                identifier,
+                projectRoot: resolve(projectRoot),
+                options,
+            });
+            if (!options.dryRun)
+                await installArtifactWorkerRewrite(projectRoot, response.rewritePath);
+            return response.result;
         }
-        if (retainedRows)
-            await rewriteArtifactDatabase(projectRoot, retainedRows);
-        return result;
+        return (await deleteArtifactLocally(identifier, projectRoot, options, false)).result;
     });
 }
+async function pruneArtifactsLocally(projectRoot, limits, options, deferReplacement) {
+    const agent = await openArtifactStore(projectRoot, false);
+    if (!agent) {
+        return { result: { schema_version: 1, dry_run: Boolean(options.dryRun), removed: [], remaining_artifacts: 0, logical_bytes: 0 } };
+    }
+    let retainedRows;
+    let result;
+    try {
+        await assertCompatibleSchema(agent, false);
+        const resolved = {
+            dryRun: options.dryRun ?? false,
+            includeProtected: options.includeProtected ?? false,
+            now: options.now ?? new Date(),
+        };
+        result = await inImmediateTransaction(agent, () => pruneInTransaction(agent, limits, resolved));
+        if (!resolved.dryRun && result.removed.length > 0) {
+            await agent.getDatabase().exec("PRAGMA wal_checkpoint(TRUNCATE)");
+            retainedRows = await agent.kv.list("");
+        }
+    }
+    finally {
+        await agent.close();
+    }
+    const rewritePath = retainedRows
+        ? await rewriteArtifactDatabase(projectRoot, retainedRows, deferReplacement)
+        : undefined;
+    return { result, ...(rewritePath ? { rewritePath } : {}) };
+}
+export async function pruneArtifactsForWindowsWorker(projectRoot, limits = getArtifactLimits(), options = {}) {
+    return pruneArtifactsLocally(projectRoot, limits, options, !options.dryRun);
+}
 export async function pruneArtifacts(projectRoot, limits = getArtifactLimits(), options = {}) {
     return withMutationLock(projectRoot, async () => {
-        const agent = await openArtifactStore(projectRoot, false);
-        if (!agent) {
-            return { schema_version: 1, dry_run: Boolean(options.dryRun), removed: [], remaining_artifacts: 0, logical_bytes: 0 };
-        }
-        let retainedRows;
-        let result;
-        try {
-            await assertCompatibleSchema(agent, false);
-            const resolved = {
-                dryRun: options.dryRun ?? false,
-                includeProtected: options.includeProtected ?? false,
-                now: options.now ?? new Date(),
-            };
-            result = await inImmediateTransaction(agent, () => pruneInTransaction(agent, limits, resolved));
-            if (!resolved.dryRun && result.removed.length > 0) {
-                await agent.getDatabase().exec("PRAGMA wal_checkpoint(TRUNCATE)");
-                retainedRows = await agent.kv.list("");
-            }
-        }
-        finally {
-            await agent.close();
+        if (useWindowsArtifactWorker()) {
+            const response = await runArtifactWorker({
+                operation: "prune",
+                projectRoot: resolve(projectRoot),
+                limits,
+                options,
+            });
+            if (!options.dryRun && response.rewritePath)
+                await installArtifactWorkerRewrite(projectRoot, response.rewritePath);
+            return response.result;
         }
-        if (retainedRows)
-            await rewriteArtifactDatabase(projectRoot, retainedRows);
-        return result;
+        return (await pruneArtifactsLocally(projectRoot, limits, options, false)).result;
     });
 }
 export async function recordUnsupportedCompactionAdapter(projectRoot, diagnostic = {}) {
     await withMutationLock(projectRoot, async () => {
+        if (useWindowsArtifactWorker()) {
+            await runArtifactWorker({
+                operation: "record-unsupported",
+                projectRoot: resolve(projectRoot),
+                diagnostic,
+            });
+            return;
+        }
         const agent = await openArtifactStore(projectRoot, true);
         if (!agent)
             return;
@@ -727,6 +860,14 @@ function inspectRetentionState(artifacts, limits) {
     return issues;
 }
 export async function doctorArtifactStore(projectRoot = process.cwd(), repair = false, limits = getArtifactLimits()) {
+    if (useWindowsArtifactWorker()) {
+        return (await runArtifactWorker({
+            operation: "doctor",
+            projectRoot: resolve(projectRoot),
+            repair,
+            limits,
+        })).result;
+    }
     const dbPath = getArtifactDbPath(projectRoot);
     if (!existsSync(dbPath)) {
         return { schema_version: 1, exists: false, ok: true, repaired: false, integrity: "not_present", valid_artifacts: 0, indexed_artifacts: 0, issues: [] };

package/mcp-memory-server/dist/capability-cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { lstat } from "node:fs/promises";
 import { join } from "node:path";
+import { privatePathIsSafe } from "./platform-security.js";
 import { capabilityAdapterClassificationSchema, finishOperatingCapability, operatingCapabilityBypassResultSchema, operatingCapabilityHandleSchema, startOperatingCapability, } from "./capability-adapter.js";
 import { readCapabilityConfig, resetCapabilityLogging, resetCapabilityOverride, resolveCapabilityStatus, setCapabilityLogging, setCapabilityOverride, } from "./capability-config.js";
 import { CAPABILITY_CALLBACK_SCHEMA_VERSION, doctorCapabilityRecords, } from "./capability-store.js";
@@ -226,7 +227,7 @@ async function configDoctor() {
     try {
         const info = await lstat(path);
         exists = true;
-        unsafePermissions = info.isSymbolicLink() || !info.isFile() || (info.mode & 0o077) !== 0;
+        unsafePermissions = info.isSymbolicLink() || !info.isFile() || !privatePathIsSafe(path);
     }
     catch (error) {
         if (error.code !== "ENOENT")

package/mcp-memory-server/dist/capability-config.js

@@ -1,7 +1,8 @@
 import { createHash, randomBytes } from "node:crypto";
 import { constants } from "node:fs";
-import { chmod, lstat, mkdir, open, rename, rm, } from "node:fs/promises";
+import { lstat, mkdir, open, rename, rm, } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
+import { hardenPrivatePath } from "./platform-security.js";
 import { CAPABILITY_REGISTRY } from "./capability-registry.js";
 import { CAPABILITY_IDS, CAPABILITY_SCHEMA_VERSION, capabilityIdSchema, capabilityManagedConfigSchema, capabilityStatusSchema, } from "./capability-schema.js";
 const MAX_CONFIG_BYTES = 64 * 1024;
@@ -247,9 +248,9 @@ async function atomicWriteConfig(path, config) {
         await handle.sync();
         await handle.close();
         handle = undefined;
-        await chmod(temporary, 0o600);
+        hardenPrivatePath(temporary);
         await rename(temporary, path);
-        await chmod(path, 0o600);
+        hardenPrivatePath(path);
     }
     finally {
         if (handle)

package/mcp-memory-server/dist/capability-harness.js

@@ -1,13 +1,14 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { constants } from "node:fs";
 import { homedir } from "node:os";
-import { chmod, lstat, mkdir, open, readdir, realpath, rename, rm, stat, } from "node:fs/promises";
+import { lstat, mkdir, open, readdir, realpath, rename, rm, stat, } from "node:fs/promises";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { z } from "zod";
 import { isCapabilityContractEnabled, resolveCapabilityStatus, } from "./capability-config.js";
 import { operatingCapabilityHandleSchema, } from "./capability-adapter.js";
 import { CAPABILITY_CALLBACK_SCHEMA_VERSION, isOperatingCapabilitySettled, issueOperatingCapability, settleOperatingCapability, } from "./capability-store.js";
 import { isTrajectoryCaptureEnabled } from "./trajectory-schema.js";
+import { hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
 const LEASE_DIRECTORY_NAME = "capability-leases-v1";
 const LEASE_SCHEMA_VERSION = 1;
 const MAX_LEASE_BYTES = 4_096;
@@ -124,12 +125,13 @@ async function ensureLeaseDirectory(options = {}) {
     const rootInfo = await lstat(root);
     if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink())
         throw new Error("Harness state root is unsafe.");
+    hardenPrivatePath(root);
     const directory = getHarnessCapabilityLeaseDirectory(options);
     await mkdir(directory, { recursive: true, mode: 0o700 });
     const info = await lstat(directory);
     if (!info.isDirectory() || info.isSymbolicLink())
         throw new Error("Harness lease directory is unsafe.");
-    await chmod(directory, 0o700);
+    hardenPrivatePath(directory);
     return directory;
 }
 async function canonicalProjectBinding(rawRoot) {
@@ -185,9 +187,9 @@ async function writeLease(lease, options = {}) {
         await handle.sync();
         await handle.close();
         handle = undefined;
-        await chmod(temporary, 0o600);
+        hardenPrivatePath(temporary);
         await rename(temporary, path);
-        await chmod(path, 0o600);
+        hardenPrivatePath(path);
     }
     finally {
         if (handle)
@@ -200,7 +202,7 @@ async function readLease(path) {
     try {
         handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
         const info = await handle.stat();
-        if (!info.isFile() || info.size > MAX_LEASE_BYTES || (info.mode & 0o077) !== 0)
+        if (!info.isFile() || info.size > MAX_LEASE_BYTES || !privatePathIsSafe(path))
             return undefined;
         const bytes = await handle.readFile();
         if (bytes.byteLength > MAX_LEASE_BYTES)
@@ -216,7 +218,32 @@ async function readLease(path) {
     }
 }
 async function removeLease(path) {
-    await rm(path, { force: true });
+    let lastError;
+    for (let attempt = 0; attempt < 12; attempt += 1) {
+        try {
+            await rm(path, { force: true });
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== "EPERM" && code !== "EBUSY")
+                throw error;
+            lastError = error;
+            if (process.platform === "win32" && attempt === 0) {
+                try {
+                    const info = await lstat(path);
+                    if (info.isFile() && !info.isSymbolicLink())
+                        hardenPrivatePath(path);
+                }
+                catch (aclError) {
+                    if (aclError.code === "ENOENT")
+                        return;
+                }
+            }
+            await new Promise((resolveDelay) => setTimeout(resolveDelay, 25 * (attempt + 1)));
+        }
+    }
+    throw lastError;
 }
 function capabilityState(snapshot, id) {
     const state = snapshot.capabilities.find((row) => row.id === id);
@@ -280,7 +307,7 @@ async function matchingLeases(input, options = {}) {
     let entries;
     try {
         const info = await lstat(directory);
-        if (!info.isDirectory() || info.isSymbolicLink() || (info.mode & 0o077) !== 0)
+        if (!info.isDirectory() || info.isSymbolicLink() || !privatePathIsSafe(directory))
             return [];
         entries = (await readdir(directory, { withFileTypes: true }))
             .sort((left, right) => left.name.localeCompare(right.name))

package/mcp-memory-server/dist/context-pack.js

@@ -1,12 +1,13 @@
 import { execFile } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
-import { chmod, cp, mkdir, mkdtemp, open, readdir, readFile, realpath, rename, rm, stat, } from "node:fs/promises";
+import { chmod, cp, mkdir, mkdtemp, open, readdir, readFile, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { z } from "zod";
 import { EmbeddingCache, cosineSimilarity, embedTexts, getEmbeddingConfig, hashText } from "./embeddings.js";
+import { atomicReplace, hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
 const execFileAsync = promisify(execFile);
 export const CONTEXT_PACK_MANIFEST = "context-pack.json";
 export const CONTEXT_PACK_MAX_FILE_BYTES = 1024 * 1024;
@@ -73,7 +74,7 @@ function readPackSource(digest) {
     const directoryInfo = lstatSync(directory);
     const info = lstatSync(path);
     if (!directoryInfo.isDirectory() || directoryInfo.isSymbolicLink() || !info.isFile() || info.isSymbolicLink()
-        || info.size > 64 * 1024 || (process.platform !== "win32" && (info.mode & 0o077) !== 0)) {
+        || info.size > 64 * 1024 || !privatePathIsSafe(path)) {
         throw new Error(`Context pack source record is unsafe: ${digest}`);
     }
     const value = JSON.parse(readFileSync(path, "utf8"));
@@ -193,8 +194,9 @@ async function atomicJson(path, value) {
         await handle.close();
         handle = undefined;
         await chmod(temporary, 0o600);
-        await rename(temporary, path);
-        await chmod(path, 0o600);
+        hardenPrivatePath(temporary);
+        await atomicReplace(temporary, path);
+        hardenPrivatePath(path);
     }
     finally {
         if (handle)
@@ -210,13 +212,35 @@ async function makeImmutable(root) {
             const path = join(directory, entry.name);
             if (entry.isDirectory())
                 await walk(path);
+            else if (process.platform === "win32") {
+                hardenPrivatePath(path);
+                await execFileAsync("attrib.exe", ["+R", path]);
+            }
             else
                 await chmod(path, 0o400);
         }
     };
     await walk(root);
-    for (const directory of directories.reverse())
-        await chmod(directory, 0o500);
+    for (const directory of directories.reverse()) {
+        if (process.platform === "win32")
+            hardenPrivatePath(directory);
+        else
+            await chmod(directory, 0o500);
+    }
+}
+async function makeWritable(root) {
+    if (!existsSync(root))
+        return;
+    await chmod(root, 0o700);
+    for (const entry of await readdir(root, { withFileTypes: true })) {
+        const path = join(root, entry.name);
+        if (entry.isDirectory())
+            await makeWritable(path);
+        else if (process.platform === "win32")
+            await execFileAsync("attrib.exe", ["-R", path]);
+        else
+            await chmod(path, 0o600);
+    }
 }
 function rejectCredentialUrl(source) {
     try {
@@ -232,6 +256,45 @@ function rejectCredentialUrl(source) {
         throw new Error("Git source URLs may not contain credentials.");
     }
 }
+function execFileBuffer(program, args, options) {
+    return new Promise((resolvePromise, rejectPromise) => {
+        execFile(program, args, { ...options, encoding: null, windowsHide: true }, (error, stdout) => {
+            if (error)
+                rejectPromise(error);
+            else
+                resolvePromise(Buffer.from(stdout));
+        });
+    });
+}
+async function materializeGitTree(repository, destination, commit) {
+    const listing = await execFileBuffer("git", ["-C", repository, "ls-tree", "-r", "-z", commit], { timeout: 30_000, maxBuffer: 4 * 1024 * 1024 });
+    const records = new TextDecoder("utf-8", { fatal: true }).decode(listing).split("\0").filter(Boolean);
+    if (records.length > CONTEXT_PACK_MAX_ENTRIES + 1)
+        throw new Error("Git context pack exceeds the entry limit.");
+    let totalBytes = 0;
+    for (const record of records) {
+        const match = /^(100644|100755|120000) blob ([a-f0-9]{40}|[a-f0-9]{64})\t([\s\S]+)$/.exec(record);
+        if (!match || match[1] === "120000")
+            throw new Error("Git context packs may contain only regular files.");
+        const path = normalizePackPath(match[3]);
+        const { stdout: rawSize } = await execFileAsync("git", ["-C", repository, "cat-file", "-s", match[2]], { encoding: "utf8", timeout: 30_000, maxBuffer: 1024 });
+        const size = Number(rawSize.trim());
+        if (!Number.isSafeInteger(size) || size < 0 || size > CONTEXT_PACK_MAX_FILE_BYTES) {
+            throw new Error(`Git context pack file is unsafe or too large: ${path}`);
+        }
+        totalBytes += size;
+        if (totalBytes > CONTEXT_PACK_MAX_TOTAL_BYTES)
+            throw new Error("Git context pack exceeds the total size limit.");
+        const target = resolve(destination, ...path.split("/"));
+        if (!contained(destination, target))
+            throw new Error(`Unsafe Git context pack path: ${path}`);
+        await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+        const bytes = await execFileBuffer("git", ["-C", repository, "cat-file", "blob", match[2]], { timeout: 30_000, maxBuffer: CONTEXT_PACK_MAX_FILE_BYTES + 1 });
+        if (bytes.byteLength !== size)
+            throw new Error(`Git context pack blob changed while reading: ${path}`);
+        await writeFile(target, bytes, { mode: match[1] === "100755" ? 0o700 : 0o600 });
+    }
+}
 async function materializeSource(source, ref) {
     if (!ref) {
         const requested = resolve(source);
@@ -250,9 +313,10 @@ async function materializeSource(source, ref) {
         const commit = stdout.trim();
         if (!GIT_COMMIT.test(commit))
             throw new Error("Git did not resolve the requested ref to a full commit.");
-        await execFileAsync("git", ["-C", checkout, "checkout", "--quiet", "--detach", commit], { timeout: 60_000, maxBuffer: 1024 * 1024 });
-        await rm(join(checkout, ".git"), { recursive: true, force: true });
-        return { root: checkout, cleanup: checkout, source: { kind: "git", url: gitSource, ref, commit } };
+        const root = join(checkout, "pack");
+        await mkdir(root, { mode: 0o700 });
+        await materializeGitTree(checkout, root, commit);
+        return { root, cleanup: checkout, source: { kind: "git", url: gitSource, ref, commit } };
     }
     catch (error) {
         await rm(checkout, { recursive: true, force: true });
@@ -275,6 +339,7 @@ export async function installContextPack(sourcePath, options = {}) {
         const objects = dirname(destination);
         await mkdir(objects, { recursive: true, mode: 0o700 });
         const temporary = join(objects, `.${pack.digest}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
+        let published = true;
         try {
             await cp(pack.root, temporary, { recursive: true, errorOnExist: true, force: false });
             const copied = await validateContextPack(temporary);
@@ -285,19 +350,23 @@ export async function installContextPack(sourcePath, options = {}) {
                 await rename(temporary, destination);
             }
             catch (error) {
-                if (!["EEXIST", "ENOTEMPTY"].includes(error.code ?? "") || !existsSync(destination))
+                const code = error.code ?? "";
+                const converged = existsSync(destination)
+                    && (["EEXIST", "ENOTEMPTY"].includes(code) || (process.platform === "win32" && code === "EPERM"));
+                if (!converged)
                     throw error;
                 const concurrent = await validateContextPack(destination);
                 if (concurrent.digest !== pack.digest)
                     throw new Error("Concurrent context pack installation produced a conflicting object.");
+                published = false;
             }
         }
         finally {
-            await chmod(temporary, 0o700).catch(() => undefined);
+            await makeWritable(temporary).catch(() => undefined);
             await rm(temporary, { recursive: true, force: true }).catch(() => undefined);
         }
         await atomicJson(join(packBaseDir(), "sources", `${pack.digest}.json`), { schema_version: 1, source: materialized.source });
-        return { pack: await validateContextPack(destination), source: materialized.source, existing: false };
+        return { pack: await validateContextPack(destination), source: materialized.source, existing: !published };
     }
     finally {
         if (materialized.cleanup)
@@ -396,7 +465,7 @@ export function readProjectPointer(options) {
         return emptyPointer(identity.id);
     const info = lstatSync(identity.path);
     if (!info.isFile() || info.isSymbolicLink() || info.size > 1024 * 1024
-        || (process.platform !== "win32" && (info.mode & 0o077) !== 0))
+        || !privatePathIsSafe(identity.path))
         throw new Error("Context pack project pointer is unsafe.");
     return parseProjectPointer(JSON.parse(readFileSync(identity.path, "utf8")), identity.id);
 }
@@ -470,7 +539,7 @@ async function allPointers() {
         const path = join(directory, entry.name);
         const info = lstatSync(path);
         if (!info.isFile() || info.isSymbolicLink() || info.size > 1024 * 1024
-            || (process.platform !== "win32" && (info.mode & 0o077) !== 0)) {
+            || !privatePathIsSafe(path)) {
             throw new Error(`Context pack project pointer is unsafe: ${path}`);
         }
         const raw = JSON.parse(await readFile(path, "utf8"));
@@ -489,17 +558,7 @@ export async function removeContextPack(selector) {
             throw new Error("Context pack is enabled by a project and cannot be removed.");
     }
     const root = objectRoot(pack.digest);
-    const unlock = async (directory) => {
-        await chmod(directory, 0o700);
-        for (const entry of await readdir(directory, { withFileTypes: true })) {
-            const path = join(directory, entry.name);
-            if (entry.isDirectory())
-                await unlock(path);
-            else
-                await chmod(path, 0o600);
-        }
-    };
-    await unlock(root);
+    await makeWritable(root);
     await rm(root, { recursive: true, force: true });
     await rm(join(packBaseDir(), "sources", `${pack.digest}.json`), { force: true });
     return pack.digest;