@cairnkeep/cli 2.9.0 → 2.11.0

package/mcp-memory-server/dist/eval-cli.js

@@ -7,6 +7,7 @@ import { isEvalEnabled, loadEvalPlan } from "./eval-plan.js";
 import { diagnoseEvalReport, readEvalReport, renderEvalReport, } from "./eval-report.js";
 import { buildAblationArms, runCapabilityAblation, runTwoPassExperiment, } from "./eval-runner.js";
 import { canonicalJson, EVAL_SCHEMA_VERSION } from "./eval-schema.js";
+import { privatePathIsSafe } from "./platform-security.js";
 process.stdout.on("error", (error) => {
     if (error.code === "EPIPE")
         process.exit(0);
@@ -126,7 +127,7 @@ async function evalRoot() {
             return null;
         throw error;
     }
-    if (info.isSymbolicLink() || !info.isDirectory() || (info.mode & 0o077) !== 0) {
+    if (info.isSymbolicLink() || !info.isDirectory() || !privatePathIsSafe(root)) {
         throw new Error("unsafe_eval_root");
     }
     const resolvedRoot = await realpath(root);
@@ -185,7 +186,7 @@ async function diagnoseProjectReports(projectRoot) {
         }
         if (info.isSymbolicLink() || !info.isDirectory() || await realpath(directory) !== directory)
             return "unsafe";
-        if (directory === root && (info.mode & 0o077) !== 0)
+        if (directory === root && !privatePathIsSafe(directory))
             return "unsafe";
     }
     const entries = await readdir(root, { withFileTypes: true });
@@ -201,7 +202,7 @@ async function diagnoseProjectReports(projectRoot) {
         if (!isContained(root, experimentPath) || experimentPath === root)
             return "unsafe";
         const experimentInfo = await lstat(experimentPath);
-        if (experimentInfo.isSymbolicLink() || !experimentInfo.isDirectory() || (experimentInfo.mode & 0o077) !== 0
+        if (experimentInfo.isSymbolicLink() || !experimentInfo.isDirectory() || !privatePathIsSafe(experimentPath)
             || await realpath(experimentPath) !== experimentPath) {
             return "unsafe";
         }
@@ -247,7 +248,7 @@ async function safeReportStore(experimentId) {
             throw new Error("eval_report_not_found");
         throw error;
     }
-    if (directory.isSymbolicLink() || !directory.isDirectory() || (directory.mode & 0o077) !== 0
+    if (directory.isSymbolicLink() || !directory.isDirectory() || !privatePathIsSafe(experimentPath)
         || await realpath(experimentPath) !== experimentPath) {
         throw new Error("unsafe_experiment_path");
     }
@@ -261,7 +262,7 @@ async function safeReportStore(experimentId) {
             throw new Error("eval_report_not_found");
         throw error;
     }
-    if (reportInfo.isSymbolicLink() || !reportInfo.isFile() || (reportInfo.mode & 0o077) !== 0
+    if (reportInfo.isSymbolicLink() || !reportInfo.isFile() || !privatePathIsSafe(reportPath)
         || reportInfo.size > DEFAULT_REPORT_BYTES) {
         throw new Error("unsafe_eval_report");
     }

package/mcp-memory-server/dist/eval-plan.js

@@ -1,7 +1,7 @@
 import { spawnSync } from "node:child_process";
 import { constants } from "node:fs";
 import { accessSync, closeSync, existsSync, fstatSync, lstatSync, openSync, readFileSync, realpathSync, } from "node:fs";
-import { delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CAPABILITY_IDS } from "./capability-schema.js";
 import { EVAL_SCHEMA_VERSION, canonicalDigest, canonicalJson, evalAdapterConfigSchema, evalTaskSetSchema, } from "./eval-schema.js";
@@ -16,6 +16,19 @@ function isContained(root, candidate) {
     const rel = relative(root, candidate);
     return rel === "" || (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel));
 }
+function isExistingPathContained(root, candidate) {
+    const rootInfo = lstatSync(root);
+    let current = realpathSync(candidate);
+    for (;;) {
+        const currentInfo = lstatSync(current);
+        if (currentInfo.dev === rootInfo.dev && currentInfo.ino === rootInfo.ino)
+            return true;
+        const parent = dirname(current);
+        if (parent === current)
+            return false;
+        current = parent;
+    }
+}
 function assertRealDirectory(path, label) {
     const info = lstatSync(path);
     if (info.isSymbolicLink() || !info.isDirectory())
@@ -68,12 +81,16 @@ function resolveExactCommit(repository, revision) {
     return resolved;
 }
 function parseCommittedTaskSet(taskSetPath) {
-    const manifestRepository = assertRealDirectory(git(dirname(taskSetPath), ["rev-parse", "--show-toplevel"], "Resolve task-set repository"), "Task-set repository");
-    if (!isContained(manifestRepository, taskSetPath))
+    const manifestDirectory = dirname(taskSetPath);
+    const manifestRepository = assertRealDirectory(git(manifestDirectory, ["rev-parse", "--show-toplevel"], "Resolve task-set repository"), "Task-set repository");
+    if (!isExistingPathContained(manifestRepository, taskSetPath)) {
         throw new Error("The task-set manifest must be contained by its Git repository.");
-    const manifestPath = relative(manifestRepository, taskSetPath).split(sep).join("/");
-    if (!manifestPath || manifestPath.startsWith("../"))
+    }
+    const manifestPrefix = git(manifestDirectory, ["rev-parse", "--show-prefix"], "Resolve task-set repository prefix");
+    const manifestPath = `${manifestPrefix}${basename(taskSetPath)}`.split("\\").join("/");
+    if (!manifestPath || manifestPath.startsWith("../") || isAbsolute(manifestPath)) {
         throw new Error("The task-set manifest path is invalid.");
+    }
     git(manifestRepository, ["ls-files", "--error-unmatch", "--", manifestPath], "Require a tracked evaluation task set");
     const dirty = git(manifestRepository, ["status", "--porcelain", "--untracked-files=all", "--", manifestPath], "Check evaluation task set status");
     if (dirty !== "")
@@ -111,15 +128,20 @@ function resolvePathProgram(program, base) {
 function resolveProgram(program, base) {
     if (isAbsolute(program) || program.includes("/") || program.includes("\\"))
         return resolvePathProgram(program, base);
+    const names = process.platform === "win32" && extname(program) === ""
+        ? [program, ...[".EXE", ".COM"].map((extension) => `${program}${extension}`)]
+        : [program];
     for (const directory of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) {
-        const candidate = join(directory, program);
-        try {
-            accessSync(candidate, constants.X_OK);
-            if (lstatSync(candidate).isFile() || lstatSync(candidate).isSymbolicLink())
-                return realpathSync(candidate);
-        }
-        catch {
-            // Continue through PATH without executing the candidate.
+        for (const name of names) {
+            const candidate = join(directory, name);
+            try {
+                accessSync(candidate, constants.X_OK);
+                if (lstatSync(candidate).isFile() || lstatSync(candidate).isSymbolicLink())
+                    return realpathSync(candidate);
+            }
+            catch {
+                // Continue through PATH without executing the candidate.
+            }
         }
     }
     throw new Error(`Evaluation program was not found on PATH: ${program}`);

package/mcp-memory-server/dist/eval-process.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { evalAdapterRequestSchema, evalAdapterResultSchema, } from "./eval-schema.js";
 export const EVAL_PROCESS_ERROR_CODES = [
     "spawn_error",
@@ -33,7 +33,7 @@ export class EvalProcessError extends Error {
 const DEFAULT_KILL_GRACE_MS = 1_000;
 const MAX_TIMER_MS = 2_147_483_647;
 function terminationScope() {
-    return process.platform === "win32" ? "child" : "process-group";
+    return process.platform === "win32" ? "process-tree" : "process-group";
 }
 function assertOptions(options) {
     if (!Number.isSafeInteger(options.timeout_ms) || options.timeout_ms <= 0 || options.timeout_ms > MAX_TIMER_MS) {
@@ -59,7 +59,9 @@ function signalChild(child, signal) {
             process.kill(-child.pid, signal);
             return true;
         }
-        return child.kill(signal);
+        const args = ["/PID", String(child.pid), "/T", ...(signal === "SIGKILL" ? ["/F"] : [])];
+        const result = spawnSync("taskkill.exe", args, { stdio: "ignore", windowsHide: true });
+        return result.status === 0 || child.kill(signal);
     }
     catch {
         try {
@@ -90,7 +92,12 @@ async function runCommandInternal(options) {
         let exitSignal = null;
         let graceTimer;
         let closeTimer;
-        const child = spawn(options.command.program, options.command.args, {
+        // A shebang does not make a JavaScript file directly executable on
+        // Windows. Adapter contracts may point at JS programs, so launch
+        // those through the current runtime while preserving the declared
+        // command for hashing and provenance.
+        const javascriptProgram = /\.(?:cjs|mjs|js)$/i.test(options.command.program);
+        const child = spawn(javascriptProgram ? process.execPath : options.command.program, [...(javascriptProgram ? [options.command.program] : []), ...options.command.args], {
             cwd: options.cwd,
             env: options.env,
             shell: false,

package/mcp-memory-server/dist/eval-report.js

@@ -1,9 +1,10 @@
 import { randomBytes } from "node:crypto";
 import { constants } from "node:fs";
-import { chmod, lstat, mkdir, open, readdir, realpath, rename, rm, } from "node:fs/promises";
+import { lstat, mkdir, open, readdir, realpath, rename, rm, } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { canonicalDigest, canonicalJson, evalAggregateSchema, evalReportSchema, } from "./eval-schema.js";
 import { computeDifferenceInDifferences, computePairedEstimate, } from "./eval-statistics.js";
+import { hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
 const DEFAULT_MAX_REPORT_BYTES = 16 * 1024 * 1024;
 const MAX_ALLOWED_REPORT_BYTES = 64 * 1024 * 1024;
 const DEFAULT_MAX_EXPERIMENTS = 10_000;
@@ -36,7 +37,7 @@ async function ensureSafeDirectory(path, privateMode = false) {
         if (info.isSymbolicLink() || !info.isDirectory())
             throw new Error("unsafe_report_directory");
         if (privateMode)
-            await chmod(path, 0o700);
+            hardenPrivatePath(path);
         return;
     }
     catch (error) {
@@ -48,7 +49,7 @@ async function ensureSafeDirectory(path, privateMode = false) {
         throw new Error("unsafe_report_directory");
     await ensureSafeDirectory(parent, false);
     await mkdir(path, { mode: 0o700 });
-    await chmod(path, 0o700);
+    hardenPrivatePath(path);
 }
 function assertLimits(maxReportBytes, maxExperiments) {
     if (!Number.isSafeInteger(maxReportBytes) || maxReportBytes < 1 || maxReportBytes > MAX_ALLOWED_REPORT_BYTES) {
@@ -206,8 +207,9 @@ export async function checkpointEvalReport(store, report, options = {}) {
             await handle.close();
             handle = undefined;
             injectFault(options, "after_close");
+            hardenPrivatePath(temporary);
             await rename(temporary, store.report_path);
-            await chmod(store.report_path, 0o600);
+            hardenPrivatePath(store.report_path);
             injectFault(options, "after_rename");
         }
         finally {
@@ -239,7 +241,7 @@ export async function diagnoseEvalReport(store) {
         });
         if (!info)
             return { state: "absent", code: "report_absent" };
-        if (info.isSymbolicLink() || !info.isFile() || (info.mode & 0o077) !== 0) {
+        if (info.isSymbolicLink() || !info.isFile() || !privatePathIsSafe(store.report_path)) {
             return { state: "unsafe", code: "report_unsafe" };
         }
         const report = await readEvalReport(store);

package/mcp-memory-server/dist/graph-cli.js

@@ -90,7 +90,13 @@ function graphifyEnvironment() {
     return environment;
 }
 function executeGraphify(projectRoot, args, timeout) {
-    const result = spawnSync("graphify", args, {
+    const configuredProgram = process.env.CAIRN_GRAPHIFY_BINARY?.trim();
+    const graphifyProgram = configuredProgram || "graphify";
+    const javascriptProgram = /\.(?:cjs|mjs|js)$/i.test(graphifyProgram);
+    const result = spawnSync(javascriptProgram ? process.execPath : graphifyProgram, [
+        ...(javascriptProgram ? [graphifyProgram] : []),
+        ...args,
+    ], {
         cwd: projectRoot,
         encoding: "utf8",
         shell: false,

package/mcp-memory-server/dist/index.js

@@ -761,7 +761,18 @@ async function runContextExplore(args) {
     }
     // --- Execution tier: return { ok: false, ... } (runtime problems, D-04) ---
     if (!evidence) {
-        const result = await runCommand(binaryPath, ["explore", "--query", query, "--repo-root", repoRoot], (timeoutSeconds ?? 120) * 1000, { ...process.env, NO_COLOR: "1" });
+        // Native Windows cannot execute a JavaScript file directly from a
+        // shebang. Treat JS helpers as Node programs while keeping compiled
+        // token_miser binaries byte-for-byte compatible on every platform.
+        const javascriptHelper = /\.(?:cjs|mjs|js)$/i.test(binaryPath);
+        const result = await runCommand(javascriptHelper ? process.execPath : binaryPath, [
+            ...(javascriptHelper ? [binaryPath] : []),
+            "explore",
+            "--query",
+            query,
+            "--repo-root",
+            repoRoot,
+        ], (timeoutSeconds ?? 120) * 1000, { ...process.env, NO_COLOR: "1" });
         if (result.timedOut || result.exitCode !== 0) {
             const payload = {
                 ok: false,
@@ -1718,30 +1729,18 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability, toolProf
             }
             // Resolve containment before any database is opened or directory is created.
             const scopePath = resolveScopePath(envelope.scope, scopeOptions);
-            const existing = await openScope(envelope.scope, false, scopeOptions);
-            let plan;
-            try {
-                plan = await planMemoryImport(existing, envelope);
-            }
-            finally {
-                await existing?.close();
-            }
-            if (envelope.dry_run) {
-                const payload = await commitMemoryImport(null, plan);
-                return {
-                    content: [{ type: "text", text: asToolText(payload) }],
-                    structuredContent: payload,
-                };
-            }
             const payload = await serializeScopeMutation(scopePath, async () => {
-                const agent = await openScope(envelope.scope, true, scopeOptions);
-                if (!agent)
-                    throw new Error(`Unable to open scope ${envelope.scope}.`);
+                const agent = await openScope(envelope.scope, !envelope.dry_run, scopeOptions);
                 try {
+                    const plan = await planMemoryImport(agent, envelope);
+                    if (envelope.dry_run)
+                        return commitMemoryImport(null, plan);
+                    if (!agent)
+                        throw new Error(`Unable to open scope ${envelope.scope}.`);
                     return await commitMemoryImport(agent, plan);
                 }
                 finally {
-                    await agent.close();
+                    await agent?.close();
                 }
             });
             return {

package/mcp-memory-server/dist/mcp-tool-profile.js

@@ -1,8 +1,9 @@
 import { createHash, randomBytes } from "node:crypto";
 import { closeSync, constants, existsSync, lstatSync, openSync, readFileSync, realpathSync, rmSync } from "node:fs";
-import { chmod, mkdir, open, rename, rm } from "node:fs/promises";
+import { chmod, mkdir, open, rm } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { MCP_TOOL_CATALOG, MCP_TOOL_NAMES, isCairnToolName } from "./mcp-tool-catalog.js";
+import { atomicReplace, hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
 const MAX_CONFIG_BYTES = 64 * 1024;
 function paths(projectRoot) {
     const root = resolve(projectRoot);
@@ -63,7 +64,7 @@ function readProjectConfig(projectRoot) {
     const dirInfo = lstatSync(directory);
     const info = lstatSync(config);
     if (!dirInfo.isDirectory() || dirInfo.isSymbolicLink() || !info.isFile() || info.isSymbolicLink()
-        || info.size > MAX_CONFIG_BYTES || (process.platform !== "win32" && (info.mode & 0o077) !== 0)) {
+        || info.size > MAX_CONFIG_BYTES || !privatePathIsSafe(config)) {
         throw new Error("MCP tool profile configuration is unsafe.");
     }
     const fd = requireNoFollow(config);
@@ -129,8 +130,9 @@ async function atomicWrite(path, value) {
         await handle.close();
         handle = undefined;
         await chmod(temporary, 0o600);
-        await rename(temporary, path);
-        await chmod(path, 0o600);
+        hardenPrivatePath(temporary);
+        await atomicReplace(temporary, path);
+        hardenPrivatePath(path);
     }
     finally {
         if (handle)

package/mcp-memory-server/dist/note-store.js

@@ -5,6 +5,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve } from "node:pat
 import { buildFailureSignature } from "./failure-signature.js";
 import { NOTE_SCHEMA_VERSION, noteNodeSchema, } from "./note-schema.js";
 import { memoryImportEnvelopeSchema, nodePathSchema, } from "./node-schema.js";
+import { atomicReplace } from "./platform-security.js";
 const MANAGED_START = "<!-- cairnkeep:managed:v1:start -->";
 const MANAGED_END = "<!-- cairnkeep:managed:v1:end -->";
 const MAX_PROCESSED_SESSIONS_PER_PROJECT = 4096;
@@ -685,7 +686,8 @@ export function planCreateAddressedNote(options) {
     return { schema_version: 1, operation: "create", notes_root: target.layout.notes_root, project_id: target.layout.project_id, changes: manifestChanges(target.layout.notes_root, manifest, [{ path: target.absolute_path, bytes: renderNote(record) }]), result: { ok: true, scope: "project", key: options.key, created: true, snapshot_key: null, node } };
 }
 function historyPath(notesRoot, addressSpace, key) {
-    return join(notesRoot, ".cairnkeep", "history", addressSpace, ...key.split("/"), `${new Date().toISOString()}-${randomBytes(6).toString("hex")}.json`);
+    const portableTimestamp = new Date().toISOString().replaceAll(":", "-");
+    return join(notesRoot, ".cairnkeep", "history", addressSpace, ...key.split("/"), `${portableTimestamp}-${randomBytes(6).toString("hex")}.json`);
 }
 export function planSupersedeAddressedNote(options) {
     const target = resolveNoteTarget(options);
@@ -725,7 +727,9 @@ function pendingTransactionDirectories(notesRoot) {
     return readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join(root, entry.name)).sort();
 }
 function syncFile(path) {
-    const descriptor = openSync(path, "r");
+    // FlushFileBuffers requires a write-capable Windows handle. POSIX accepts
+    // the narrower read handle used by the historical implementation.
+    const descriptor = openSync(path, process.platform === "win32" ? "r+" : "r");
     try {
         fsyncSync(descriptor);
     }
@@ -734,6 +738,11 @@ function syncFile(path) {
     }
 }
 function syncDirectory(path) {
+    // Windows does not permit opening a directory as a file descriptor, so
+    // Node cannot fsync it. File contents are still fsynced before the atomic
+    // rename; POSIX additionally persists the containing directory entry.
+    if (process.platform === "win32")
+        return;
     const descriptor = openSync(path, "r");
     try {
         fsyncSync(descriptor);
@@ -839,7 +848,7 @@ export async function commitJournaledNoteMutation(plan) {
         for (const change of journal.changes) {
             mkdirSync(dirname(change.path), { recursive: true });
             if (change.staged)
-                renameSync(change.staged, change.path);
+                await atomicReplace(change.staged, change.path);
             else
                 rmSync(change.path, { force: true });
             if (existsSync(change.path))

package/mcp-memory-server/dist/pi-mcp-bridge.js

@@ -0,0 +1,185 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+const DEFAULT_STARTUP_TIMEOUT_MS = 10_000;
+const DEFAULT_CALL_TIMEOUT_MS = 30_000;
+const DEFAULT_STDERR_LIMIT_BYTES = 16 * 1024;
+const DEFAULT_RESULT_LIMIT_BYTES = 4 * 1024 * 1024;
+const MAX_CATALOG_PAGES = 1_000;
+function positiveInteger(value, fallback, name) {
+    const selected = value ?? fallback;
+    if (!Number.isSafeInteger(selected) || selected <= 0)
+        throw new Error(`${name} must be a positive integer.`);
+    return selected;
+}
+function childEnvironment(source) {
+    const env = {};
+    for (const [name, value] of Object.entries(source)) {
+        if (value !== undefined && name !== "MCP_HTTP_PORT")
+            env[name] = value;
+    }
+    return env;
+}
+function byteLength(value) {
+    try {
+        return Buffer.byteLength(JSON.stringify(value), "utf8");
+    }
+    catch {
+        throw new Error("MCP result could not be measured safely.");
+    }
+}
+function boundedMessage(error, stderr) {
+    const base = error instanceof Error ? error.message : String(error);
+    const tail = stderr.trim();
+    return tail ? `${base} (server stderr: ${tail})` : base;
+}
+function transportBufferSize(resultLimitBytes) {
+    return Math.min(Math.max(resultLimitBytes + 64 * 1024, resultLimitBytes * 4), 64 * 1024 * 1024);
+}
+function failureText(result) {
+    const text = result.content
+        .filter((item) => item.type === "text")
+        .map((item) => item.text.trim())
+        .filter(Boolean)
+        .join("; ");
+    return text || "The MCP server reported a tool failure.";
+}
+function piContent(result) {
+    return result.content.map((item) => {
+        if (item.type === "text")
+            return { ...item };
+        if (item.type === "image")
+            return { ...item };
+        throw new Error(`Unsupported MCP result content type: ${item.type}.`);
+    });
+}
+export async function connectCairnPiBridge(options = {}) {
+    const startupTimeoutMs = positiveInteger(options.startupTimeoutMs, DEFAULT_STARTUP_TIMEOUT_MS, "startupTimeoutMs");
+    const callTimeoutMs = positiveInteger(options.callTimeoutMs, DEFAULT_CALL_TIMEOUT_MS, "callTimeoutMs");
+    const stderrLimitBytes = positiveInteger(options.stderrLimitBytes, DEFAULT_STDERR_LIMIT_BYTES, "stderrLimitBytes");
+    const resultLimitBytes = positiveInteger(options.resultLimitBytes, DEFAULT_RESULT_LIMIT_BYTES, "resultLimitBytes");
+    const transport = new StdioClientTransport({
+        command: options.command ?? "cairn",
+        args: options.args ? [...options.args] : ["memory-server"],
+        cwd: options.cwd ?? process.cwd(),
+        env: childEnvironment(options.env ?? process.env),
+        stderr: "pipe",
+        maxBufferSize: transportBufferSize(resultLimitBytes),
+    });
+    const client = new Client({ name: "cairnkeep-pi-bridge", version: "1" }, { capabilities: {} });
+    let state = "idle";
+    let stderr = Buffer.alloc(0);
+    let transportFailure;
+    let catalog = [];
+    let closePromise;
+    transport.stderr?.on("data", (chunk) => {
+        const next = Buffer.concat([stderr, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)]);
+        stderr = next.byteLength <= stderrLimitBytes ? next : next.subarray(next.byteLength - stderrLimitBytes);
+    });
+    const stderrTail = () => stderr.toString("utf8");
+    const requireReady = () => {
+        if (state !== "ready")
+            throw new Error(`Pi MCP bridge is ${state}; calls require ready state.`);
+    };
+    const discover = async () => {
+        const tools = [];
+        const names = new Set();
+        const cursors = new Set();
+        let cursor;
+        for (let pageNumber = 0; pageNumber < MAX_CATALOG_PAGES; pageNumber += 1) {
+            const page = await client.listTools(cursor ? { cursor } : undefined, { timeout: startupTimeoutMs });
+            if (byteLength(page) > resultLimitBytes)
+                throw new Error("MCP tool catalog exceeds the configured result size limit.");
+            for (const tool of page.tools) {
+                if (names.has(tool.name))
+                    throw new Error(`MCP tool catalog contains duplicate name: ${tool.name}.`);
+                names.add(tool.name);
+                tools.push(tool);
+            }
+            if (!page.nextCursor)
+                return tools;
+            if (cursors.has(page.nextCursor))
+                throw new Error("MCP tool catalog pagination repeated a cursor.");
+            cursors.add(page.nextCursor);
+            cursor = page.nextCursor;
+        }
+        throw new Error("MCP tool catalog exceeded the pagination limit.");
+    };
+    const close = () => {
+        if (closePromise)
+            return closePromise;
+        state = "closing";
+        closePromise = (async () => {
+            try {
+                await client.close();
+            }
+            finally {
+                state = "closed";
+                catalog = [];
+            }
+        })();
+        return closePromise;
+    };
+    state = "starting";
+    try {
+        await client.connect(transport, { timeout: startupTimeoutMs, maxTotalTimeout: startupTimeoutMs });
+        const protocolErrorHandler = transport.onerror;
+        transport.onerror = (error) => {
+            transportFailure = error;
+            protocolErrorHandler?.(error);
+        };
+        const protocolCloseHandler = transport.onclose;
+        transport.onclose = () => {
+            protocolCloseHandler?.();
+            if (state === "starting" || state === "ready") {
+                state = "closed";
+                catalog = [];
+            }
+        };
+        const pid = transport.pid;
+        if (pid !== null)
+            options.onSpawn?.({ pid });
+        catalog = await discover();
+        state = "ready";
+    }
+    catch (error) {
+        await close().catch(() => undefined);
+        throw new Error(`Unable to start local Pi MCP bridge: ${boundedMessage(error, stderrTail())}`, { cause: error });
+    }
+    return {
+        get state() { return state; },
+        async listAllTools() {
+            requireReady();
+            return catalog.map((tool) => structuredClone(tool));
+        },
+        async call(tool, args, callOptions = {}) {
+            requireReady();
+            const discovered = catalog.find(({ name }) => name === tool.name);
+            if (!discovered)
+                throw new Error(`MCP tool was not discovered for this session: ${tool.name}.`);
+            try {
+                const result = await client.callTool({ name: discovered.name, arguments: args }, undefined, { signal: callOptions.signal, timeout: callTimeoutMs, maxTotalTimeout: callTimeoutMs });
+                if (byteLength(result) > resultLimitBytes)
+                    throw new Error("MCP tool result exceeds the configured size limit.");
+                if (result.isError)
+                    throw new Error(failureText(result));
+                const details = {
+                    tool: discovered,
+                    annotations: discovered.annotations,
+                    outputSchema: discovered.outputSchema,
+                    content: result.content,
+                    structuredContent: result.structuredContent,
+                    isError: false,
+                    ...(result._meta ? { _meta: result._meta } : {}),
+                };
+                return { content: piContent(result), details };
+            }
+            catch (error) {
+                const failure = transportFailure && /closed/i.test(error instanceof Error ? error.message : String(error))
+                    ? transportFailure
+                    : error;
+                throw new Error(`Pi MCP call ${discovered.name} failed: ${boundedMessage(failure, stderrTail())}`, { cause: error });
+            }
+        },
+        close,
+    };
+}

package/mcp-memory-server/dist/platform-security.js

@@ -0,0 +1,102 @@
+import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
+import { rename } from "node:fs/promises";
+import { spawnSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+function currentWindowsSid() {
+    const result = spawnSync("whoami.exe", ["/user", "/fo", "csv", "/nh"], { encoding: "utf8", windowsHide: true });
+    if (result.status !== 0)
+        throw new Error("Unable to resolve the current Windows security identity.");
+    const match = result.stdout.match(/"(S-1-[0-9-]+)"/i);
+    if (!match)
+        throw new Error("Unable to resolve the current Windows security identity.");
+    return match[1];
+}
+export function hardenPrivatePath(path) {
+    if (process.platform !== "win32") {
+        chmodSync(path, lstatSync(path).isDirectory() ? 0o700 : 0o600);
+        return;
+    }
+    const sid = currentWindowsSid();
+    const args = [
+        path,
+        "/inheritance:r",
+        "/grant:r", `*${sid}:(F)`,
+        "/grant:r", "*S-1-5-18:(F)",
+        "/grant:r", "*S-1-5-32-544:(F)",
+    ];
+    const result = spawnSync("icacls.exe", args, { encoding: "utf8", windowsHide: true });
+    if (result.status !== 0)
+        throw new Error("Unable to restrict Windows ACLs for private Cairnkeep state.");
+}
+export function privatePathIsSafe(path) {
+    if (!existsSync(path))
+        return false;
+    const info = lstatSync(path);
+    if (info.isSymbolicLink())
+        return false;
+    if (process.platform !== "win32")
+        return (info.mode & 0o077) === 0;
+    const script = [
+        "$p=$env:CK_INTERNAL_PRIVATE_PATH",
+        "$me=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value",
+        "$ok=@($me,'S-1-5-18','S-1-5-32-544')",
+        "$acl=Get-Acl -LiteralPath $p",
+        "foreach($a in $acl.Access){",
+        "if($a.AccessControlType -eq 'Allow'){",
+        "try{$sid=$a.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value}catch{exit 1}",
+        "if($ok -notcontains $sid){exit 1}",
+        "}",
+        "}",
+        "exit 0",
+    ].join(";");
+    const result = spawnSync("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
+        encoding: "utf8",
+        windowsHide: true,
+        env: { ...process.env, CK_INTERNAL_PRIVATE_PATH: path },
+    });
+    return result.status === 0;
+}
+function delay(milliseconds) {
+    return new Promise((resolveDelay) => setTimeout(resolveDelay, milliseconds));
+}
+export async function atomicReplace(source, destination) {
+    if (process.platform === "win32") {
+        let lastError = "Windows atomic replacement failed.";
+        for (let attempt = 0; attempt < 12; attempt += 1) {
+            if (!existsSync(destination)) {
+                try {
+                    await rename(source, destination);
+                    return;
+                }
+                catch (error) {
+                    lastError = error instanceof Error ? error.message : String(error);
+                }
+            }
+            else {
+                const backup = `${destination}.replace-backup-${randomUUID()}`;
+                const result = spawnSync("powershell.exe", [
+                    "-NoLogo", "-NoProfile", "-NonInteractive", "-Command",
+                    "[IO.File]::Replace($env:CK_INTERNAL_ATOMIC_SOURCE,$env:CK_INTERNAL_ATOMIC_DESTINATION,$env:CK_INTERNAL_ATOMIC_BACKUP,$true)",
+                ], {
+                    encoding: "utf8",
+                    windowsHide: true,
+                    env: {
+                        ...process.env,
+                        CK_INTERNAL_ATOMIC_SOURCE: source,
+                        CK_INTERNAL_ATOMIC_DESTINATION: destination,
+                        CK_INTERNAL_ATOMIC_BACKUP: backup,
+                    },
+                });
+                if (result.status === 0) {
+                    rmSync(backup, { force: true });
+                    return;
+                }
+                rmSync(backup, { force: true });
+                lastError = result.stderr.trim() || result.stdout.trim() || lastError;
+            }
+            await delay(25 * (attempt + 1));
+        }
+        throw new Error(lastError);
+    }
+    await rename(source, destination);
+}