@cairnkeep/cli 2.9.0 → 2.12.0

package/docs/quickstart.md

@@ -0,0 +1,86 @@
+# Cairnkeep quickstart
+
+This is the shortest supported route from an empty directory or existing Git
+repository to durable, local agent memory. The default transport is stdio and
+the default store stays on this computer.
+
+## Codex CLI
+
+Install Cairnkeep, then let guided setup initialize an empty project and write
+Codex's project-scoped MCP entry:
+
+```bash
+npm install --global @cairnkeep/cli
+cairn setup /path/to/project --git init --harness codex --memory local --yes
+cd /path/to/project
+cairn doctor
+./.ai/start-codex.sh
+```
+
+Use `--git existing` instead when the target is already a Git work tree. On
+native Windows, launch with `.\.ai\start-codex.cmd`.
+
+Before the first session, review `.codex/config.toml` and accept Codex's project
+trust prompt. The generated entry runs `cairn memory-server` locally. Setup
+does not edit the user-wide Codex configuration and does not enable networking,
+telemetry, embeddings, session capture, or context packs.
+
+If `.codex/config.toml` already exists and differs, setup reports it as
+`skipped` and preserves it byte-for-byte. Merge this table into the existing
+file, then run `cairn doctor`:
+
+```toml
+[mcp_servers.cairn-memory]
+command = "cairn"
+args = ["memory-server"]
+```
+
+## Claude Code
+
+Claude Code has the full Cairnkeep operating layer, so it needs one explicit
+machine-level sync in addition to project setup:
+
+```bash
+npm install --global @cairnkeep/cli
+claude mcp add cairn-memory -s user -- cairn memory-server
+cairn sync --apply
+cairn setup /path/to/project --git init --harness claude --memory local --yes
+cd /path/to/project
+cairn doctor
+./.ai/start-claude.sh
+```
+
+Setup reports machine-level commands but never executes them. This keeps
+project scaffolding separate from harness-wide changes.
+
+## First memory cycle
+
+In a harness with Cairnkeep commands, remember one durable fact and recall it:
+
+```text
+> /remember Use transactional migrations for schema changes
+> /recall transactional migrations
+```
+
+In Codex or another MCP client, ask the client to call `memory_write`, then
+`memory_search`. Close the session, start a new one, and repeat the search. The
+result should survive the restart.
+
+## What setup owns
+
+`cairn setup` creates only the selected harness assets plus the common `.ai`,
+`.planning`, and `.agentfs` scaffold. It initializes Git only with explicit
+`--git init`, preserves unrelated files, does not overwrite modified files it
+does not own, and records managed digests in private `.ai/cairnkeep.json`.
+
+Useful follow-ups:
+
+```bash
+cairn setup . --git existing --harness codex --memory local --yes  # reconcile
+cairn doctor                                                       # diagnose
+cairn uninstall --dry-run .                                       # preview removal
+```
+
+For all harnesses, remote HTTP, storage, profiles, context packs, overlays, and
+recovery details, continue with [Operating Cairnkeep](operating.md) or the
+[learning path](learning/README.md).

package/docs/storage.md

@@ -31,6 +31,17 @@ For the local launchers, the server working directory is normally the project
 root. Bootstrap installs `.agentfs/.gitignore` so private project memory is not
 accidentally committed. SQLite may also create `-wal` and `-shm` sidecar files.
 
+Private-file protection is platform-equivalent rather than mode-identical.
+Linux and macOS use `0600` files and `0700` directories. Native Windows removes
+inherited ACLs and grants access only to the current SID, Local System, and the
+built-in Administrators group. `cairn doctor` fails closed when a managed MCP
+profile or context-pack pointer has broader access. Context-pack objects also
+receive a read-only attribute after their content digest is verified.
+
+Where this document names a generated `revert.sh`, native Windows produces the
+equivalent backup manifest and `revert.ps1`; it restores exact bytes and the
+Windows ACL contract rather than emulating POSIX mode bits.
+
 `CAIRN_LLM_API_URL` and `CAIRN_MEMORY_EMBEDDING_URL` select optional model
 services used to process/search memory. They do not change where the SQLite
 databases are stored. Git-provider and routing configuration do not change
@@ -502,8 +513,9 @@ bearer_token_env_var = "CAIRN_MEMORY_HTTP_TOKEN"
 Context-pack objects are content-addressed, immutable directories. Installation
 copies verified content through a temporary directory and atomically publishes
 the digest; a failed or concurrent install never changes project enablement.
-Project pointers are separate atomic mode-`0600` files keyed by canonical local
-project identity or a validated remote project ID. Updates retain old objects
+Project pointers are separate atomic private files (`0600` on POSIX, restricted
+ACLs on Windows) keyed by canonical local project identity or a validated
+remote project ID. Updates retain old objects
 and switch only the named project after exact-digest confirmation.
 
 `cairn doctor` verifies objects, pointers, and interrupted-install remnants.

package/examples/eval/bundled-fake.json

@@ -1 +1 @@
-{"identifier":"cairn-offline-fake-v1","package_version":"2.9.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}
+{"identifier":"cairn-offline-fake-v1","package_version":"2.12.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}

package/mcp-memory-server/dist/artifact-store-windows-worker.js

@@ -0,0 +1,74 @@
+import { AgentFS } from "agentfs-sdk";
+import { deleteArtifactForWindowsWorker, doctorArtifactStore, getArtifactDbPath, listArtifacts, pruneArtifactsForWindowsWorker, putArtifact, readArtifact, readLatestCompaction, recordUnsupportedCompactionAdapter, } from "./artifact-store.js";
+async function readRequest() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(Buffer.from(chunk));
+    const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    if (!parsed || typeof parsed.operation !== "string" || typeof parsed.projectRoot !== "string") {
+        throw new Error("Invalid Windows artifact worker request.");
+    }
+    return parsed;
+}
+function resolvedOptions(options = {}) {
+    const { now, ...rest } = options;
+    return { ...rest, ...(now ? { now: new Date(now) } : {}) };
+}
+async function rawOperation(request) {
+    const agent = await AgentFS.open({ id: "artifacts", path: getArtifactDbPath(request.projectRoot) });
+    try {
+        if (request.action === "list")
+            return await agent.kv.list(request.prefix ?? "");
+        if (request.action === "get")
+            return await agent.kv.get(request.key ?? "");
+        if (request.action === "set") {
+            await agent.kv.set(request.key ?? "", request.value);
+            return null;
+        }
+        if (request.action === "delete") {
+            await agent.kv.delete(request.key ?? "");
+            return null;
+        }
+        throw new Error("Unsupported raw Windows artifact operation.");
+    }
+    finally {
+        await agent.close();
+    }
+}
+async function dispatch(request) {
+    const limits = request.limits;
+    if (request.operation === "put" && limits) {
+        return { result: await putArtifact(request.projectRoot, request.candidate, limits, resolvedOptions(request.options)) };
+    }
+    if (request.operation === "read" && request.identifier) {
+        return { result: await readArtifact(request.identifier, request.projectRoot) };
+    }
+    if (request.operation === "list") {
+        return { result: await listArtifacts(request.projectRoot, request.filters) };
+    }
+    if (request.operation === "latest") {
+        return { result: await readLatestCompaction(request.projectRoot, request.sessionRef) };
+    }
+    if (request.operation === "delete" && request.identifier) {
+        return deleteArtifactForWindowsWorker(request.identifier, request.projectRoot, request.options);
+    }
+    if (request.operation === "prune" && limits) {
+        return pruneArtifactsForWindowsWorker(request.projectRoot, limits, resolvedOptions(request.options));
+    }
+    if (request.operation === "record-unsupported") {
+        await recordUnsupportedCompactionAdapter(request.projectRoot, request.diagnostic);
+        return { result: null };
+    }
+    if (request.operation === "doctor" && limits) {
+        return { result: await doctorArtifactStore(request.projectRoot, request.repair, limits) };
+    }
+    if (request.operation === "raw")
+        return { result: await rawOperation(request) };
+    throw new Error("Unsupported Windows artifact worker operation.");
+}
+dispatch(await readRequest())
+    .then((response) => process.stdout.write(JSON.stringify(response)))
+    .catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});

package/mcp-memory-server/dist/artifact-store.js

@@ -1,9 +1,12 @@
 import { randomUUID } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { AgentFS } from "agentfs-sdk";
 import { ARTIFACT_SCHEMA_VERSION, artifactEnvelopeSchema, artifactWriteInputSchema, canonicalBytes, canonicalJson, getArtifactLimits, sha256Hex, truncateUtf8, } from "./artifact-schema.js";
 import { redactLocalValue } from "./trajectory-redaction.js";
+import { atomicReplace } from "./platform-security.js";
 const META_KEY = "artifact/meta/schema-version";
 const FULL_PREFIX = "artifact/full/";
 const INDEX_PREFIX = "artifact/index/";
@@ -14,6 +17,40 @@ const SEQUENCE_PREFIX = "compaction/sequence/";
 const DIAGNOSTIC_PREFIX = "artifact/meta/unsupported-adapter/";
 const MAX_DIAGNOSTICS = 32;
 const mutationQueues = new Map();
+const artifactWorkerPath = fileURLToPath(new URL("./artifact-store-windows-worker.js", import.meta.url));
+function useWindowsArtifactWorker() {
+    return (process.platform === "win32" || process.env.CAIRN_TEST_WINDOWS_ARTIFACT_WORKER === "1")
+        && resolve(process.argv[1] ?? "") !== resolve(artifactWorkerPath);
+}
+async function runArtifactWorker(request) {
+    return new Promise((resolvePromise, rejectPromise) => {
+        const child = spawn(process.execPath, [artifactWorkerPath], {
+            env: process.env,
+            stdio: ["pipe", "pipe", "pipe"],
+            windowsHide: true,
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (chunk) => { stdout += chunk.toString("utf8"); });
+        child.stderr.on("data", (chunk) => {
+            stderr = `${stderr}${chunk.toString("utf8")}`.slice(-1024 * 1024);
+        });
+        child.once("error", rejectPromise);
+        child.once("close", (code) => {
+            if (code !== 0) {
+                rejectPromise(new Error(stderr.trim() || "Windows artifact worker failed."));
+                return;
+            }
+            try {
+                resolvePromise(JSON.parse(stdout));
+            }
+            catch (error) {
+                rejectPromise(error);
+            }
+        });
+        child.stdin.end(JSON.stringify(request));
+    });
+}
 export function getArtifactDbPath(projectRoot = process.cwd()) {
     return resolve(projectRoot, ".agentfs", "artifacts.db");
 }
@@ -273,7 +310,7 @@ async function rebuildPointers(agent) {
     if (latest)
         await agent.kv.set(PROJECT_LATEST_KEY, latest.artifact_id);
 }
-async function rewriteArtifactDatabase(projectRoot, rows) {
+async function rewriteArtifactDatabase(projectRoot, rows, deferReplacement = false) {
     const dbPath = getArtifactDbPath(projectRoot);
     const rewritePath = `${dbPath}.rewrite-${randomUUID()}`;
     const rewrite = await AgentFS.open({ id: "artifacts", path: rewritePath });
@@ -288,11 +325,33 @@ async function rewriteArtifactDatabase(projectRoot, rows) {
         await rewrite.close();
     }
     chmodSync(rewritePath, 0o600);
+    if (deferReplacement)
+        return rewritePath;
     for (const suffix of ["-wal", "-shm"]) {
         rmSync(`${rewritePath}${suffix}`, { force: true });
         rmSync(`${dbPath}${suffix}`, { force: true });
     }
-    renameSync(rewritePath, dbPath);
+    await atomicReplace(rewritePath, dbPath);
+    return undefined;
+}
+async function installArtifactWorkerRewrite(projectRoot, rewritePath) {
+    if (!rewritePath)
+        throw new Error("Windows artifact worker did not produce a replacement database.");
+    const dbPath = getArtifactDbPath(projectRoot);
+    if (!rewritePath.startsWith(`${dbPath}.rewrite-`) || dirname(rewritePath) !== dirname(dbPath)) {
+        throw new Error("Windows artifact worker returned an invalid replacement path.");
+    }
+    try {
+        for (const suffix of ["-wal", "-shm"]) {
+            rmSync(`${rewritePath}${suffix}`, { force: true });
+            rmSync(`${dbPath}${suffix}`, { force: true });
+        }
+        await atomicReplace(rewritePath, dbPath);
+    }
+    finally {
+        for (const suffix of ["", "-wal", "-shm"])
+            rmSync(`${rewritePath}${suffix}`, { force: true });
+    }
 }
 function planPrune(artifacts, limits, options) {
     const sorted = sortedOldest(artifacts);
@@ -369,6 +428,15 @@ async function pruneInTransaction(agent, limits, options) {
 export async function putArtifact(projectRoot, candidate, limits = getArtifactLimits(), options = {}) {
     const prepared = prepareInput(projectRoot, candidate, limits);
     return withMutationLock(projectRoot, async () => {
+        if (useWindowsArtifactWorker()) {
+            return (await runArtifactWorker({
+                operation: "put",
+                projectRoot: resolve(projectRoot),
+                candidate,
+                limits,
+                options,
+            })).result;
+        }
         const agent = await openArtifactStore(projectRoot, true);
         if (!agent)
             throw new Error("Unable to open the local artifact store.");
@@ -443,6 +511,13 @@ export async function putCompactionArtifact(projectRoot, candidate, limits = get
     return putArtifact(projectRoot, parsed, limits, options);
 }
 export async function readArtifact(identifier, projectRoot = process.cwd()) {
+    if (useWindowsArtifactWorker()) {
+        return (await runArtifactWorker({
+            operation: "read",
+            identifier,
+            projectRoot: resolve(projectRoot),
+        })).result;
+    }
     const agent = await openArtifactStore(projectRoot, false);
     if (!agent)
         throw new Error("Artifact not found.");
@@ -455,6 +530,13 @@ export async function readArtifact(identifier, projectRoot = process.cwd()) {
     }
 }
 export async function listArtifacts(projectRoot = process.cwd(), filters = {}) {
+    if (useWindowsArtifactWorker()) {
+        return (await runArtifactWorker({
+            operation: "list",
+            projectRoot: resolve(projectRoot),
+            filters,
+        })).result;
+    }
     const agent = await openArtifactStore(projectRoot, false);
     if (!agent)
         return { schema_version: ARTIFACT_SCHEMA_VERSION, artifacts: [], logical_bytes: 0 };
@@ -486,6 +568,13 @@ export async function listArtifacts(projectRoot = process.cwd(), filters = {}) {
     }
 }
 export async function readLatestCompaction(projectRoot = process.cwd(), sessionRef) {
+    if (useWindowsArtifactWorker()) {
+        return (await runArtifactWorker({
+            operation: "latest",
+            projectRoot: resolve(projectRoot),
+            sessionRef,
+        })).result;
+    }
     const agent = await openArtifactStore(projectRoot, false);
     if (!agent)
         return null;
@@ -505,70 +594,114 @@ export async function readLatestCompaction(projectRoot = process.cwd(), sessionR
     }
 }
 export const selectRecoveryArtifact = readLatestCompaction;
+async function deleteArtifactLocally(identifier, projectRoot, options, deferReplacement) {
+    const agent = await openArtifactStore(projectRoot, false);
+    if (!agent)
+        throw new Error("Artifact not found.");
+    let retainedRows;
+    let result;
+    try {
+        await assertCompatibleSchema(agent, false);
+        const artifact = await findByIdentifier(agent, identifier);
+        if (!options.dryRun) {
+            await inImmediateTransaction(agent, async () => {
+                await deleteArtifactRows(agent, artifact);
+                await rebuildPointers(agent);
+            });
+            await agent.getDatabase().exec("PRAGMA wal_checkpoint(TRUNCATE)");
+            retainedRows = await agent.kv.list("");
+        }
+        result = {
+            schema_version: ARTIFACT_SCHEMA_VERSION,
+            artifact_id: artifact.artifact_id,
+            deleted: !options.dryRun,
+            dry_run: Boolean(options.dryRun),
+        };
+    }
+    finally {
+        await agent.close();
+    }
+    const rewritePath = retainedRows
+        ? await rewriteArtifactDatabase(projectRoot, retainedRows, deferReplacement)
+        : undefined;
+    return { result, rewritePath };
+}
+export async function deleteArtifactForWindowsWorker(identifier, projectRoot, options = {}) {
+    return deleteArtifactLocally(identifier, projectRoot, options, !options.dryRun);
+}
 export async function deleteArtifact(identifier, projectRoot = process.cwd(), options = {}) {
     return withMutationLock(projectRoot, async () => {
-        const agent = await openArtifactStore(projectRoot, false);
-        if (!agent)
-            throw new Error("Artifact not found.");
-        let retainedRows;
-        let result;
-        try {
-            await assertCompatibleSchema(agent, false);
-            const artifact = await findByIdentifier(agent, identifier);
-            if (!options.dryRun) {
-                await inImmediateTransaction(agent, async () => {
-                    await deleteArtifactRows(agent, artifact);
-                    await rebuildPointers(agent);
-                });
-                await agent.getDatabase().exec("PRAGMA wal_checkpoint(TRUNCATE)");
-                retainedRows = await agent.kv.list("");
-            }
-            result = {
-                schema_version: ARTIFACT_SCHEMA_VERSION,
-                artifact_id: artifact.artifact_id,
-                deleted: !options.dryRun,
-                dry_run: Boolean(options.dryRun),
-            };
-        }
-        finally {
-            await agent.close();
+        if (useWindowsArtifactWorker()) {
+            const response = await runArtifactWorker({
+                operation: "delete",
+                identifier,
+                projectRoot: resolve(projectRoot),
+                options,
+            });
+            if (!options.dryRun)
+                await installArtifactWorkerRewrite(projectRoot, response.rewritePath);
+            return response.result;
         }
-        if (retainedRows)
-            await rewriteArtifactDatabase(projectRoot, retainedRows);
-        return result;
+        return (await deleteArtifactLocally(identifier, projectRoot, options, false)).result;
     });
 }
+async function pruneArtifactsLocally(projectRoot, limits, options, deferReplacement) {
+    const agent = await openArtifactStore(projectRoot, false);
+    if (!agent) {
+        return { result: { schema_version: 1, dry_run: Boolean(options.dryRun), removed: [], remaining_artifacts: 0, logical_bytes: 0 } };
+    }
+    let retainedRows;
+    let result;
+    try {
+        await assertCompatibleSchema(agent, false);
+        const resolved = {
+            dryRun: options.dryRun ?? false,
+            includeProtected: options.includeProtected ?? false,
+            now: options.now ?? new Date(),
+        };
+        result = await inImmediateTransaction(agent, () => pruneInTransaction(agent, limits, resolved));
+        if (!resolved.dryRun && result.removed.length > 0) {
+            await agent.getDatabase().exec("PRAGMA wal_checkpoint(TRUNCATE)");
+            retainedRows = await agent.kv.list("");
+        }
+    }
+    finally {
+        await agent.close();
+    }
+    const rewritePath = retainedRows
+        ? await rewriteArtifactDatabase(projectRoot, retainedRows, deferReplacement)
+        : undefined;
+    return { result, ...(rewritePath ? { rewritePath } : {}) };
+}
+export async function pruneArtifactsForWindowsWorker(projectRoot, limits = getArtifactLimits(), options = {}) {
+    return pruneArtifactsLocally(projectRoot, limits, options, !options.dryRun);
+}
 export async function pruneArtifacts(projectRoot, limits = getArtifactLimits(), options = {}) {
     return withMutationLock(projectRoot, async () => {
-        const agent = await openArtifactStore(projectRoot, false);
-        if (!agent) {
-            return { schema_version: 1, dry_run: Boolean(options.dryRun), removed: [], remaining_artifacts: 0, logical_bytes: 0 };
-        }
-        let retainedRows;
-        let result;
-        try {
-            await assertCompatibleSchema(agent, false);
-            const resolved = {
-                dryRun: options.dryRun ?? false,
-                includeProtected: options.includeProtected ?? false,
-                now: options.now ?? new Date(),
-            };
-            result = await inImmediateTransaction(agent, () => pruneInTransaction(agent, limits, resolved));
-            if (!resolved.dryRun && result.removed.length > 0) {
-                await agent.getDatabase().exec("PRAGMA wal_checkpoint(TRUNCATE)");
-                retainedRows = await agent.kv.list("");
-            }
-        }
-        finally {
-            await agent.close();
+        if (useWindowsArtifactWorker()) {
+            const response = await runArtifactWorker({
+                operation: "prune",
+                projectRoot: resolve(projectRoot),
+                limits,
+                options,
+            });
+            if (!options.dryRun && response.rewritePath)
+                await installArtifactWorkerRewrite(projectRoot, response.rewritePath);
+            return response.result;
         }
-        if (retainedRows)
-            await rewriteArtifactDatabase(projectRoot, retainedRows);
-        return result;
+        return (await pruneArtifactsLocally(projectRoot, limits, options, false)).result;
     });
 }
 export async function recordUnsupportedCompactionAdapter(projectRoot, diagnostic = {}) {
     await withMutationLock(projectRoot, async () => {
+        if (useWindowsArtifactWorker()) {
+            await runArtifactWorker({
+                operation: "record-unsupported",
+                projectRoot: resolve(projectRoot),
+                diagnostic,
+            });
+            return;
+        }
         const agent = await openArtifactStore(projectRoot, true);
         if (!agent)
             return;
@@ -727,6 +860,14 @@ function inspectRetentionState(artifacts, limits) {
     return issues;
 }
 export async function doctorArtifactStore(projectRoot = process.cwd(), repair = false, limits = getArtifactLimits()) {
+    if (useWindowsArtifactWorker()) {
+        return (await runArtifactWorker({
+            operation: "doctor",
+            projectRoot: resolve(projectRoot),
+            repair,
+            limits,
+        })).result;
+    }
     const dbPath = getArtifactDbPath(projectRoot);
     if (!existsSync(dbPath)) {
         return { schema_version: 1, exists: false, ok: true, repaired: false, integrity: "not_present", valid_artifacts: 0, indexed_artifacts: 0, issues: [] };

package/mcp-memory-server/dist/capability-cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { lstat } from "node:fs/promises";
 import { join } from "node:path";
+import { privatePathIsSafe } from "./platform-security.js";
 import { capabilityAdapterClassificationSchema, finishOperatingCapability, operatingCapabilityBypassResultSchema, operatingCapabilityHandleSchema, startOperatingCapability, } from "./capability-adapter.js";
 import { readCapabilityConfig, resetCapabilityLogging, resetCapabilityOverride, resolveCapabilityStatus, setCapabilityLogging, setCapabilityOverride, } from "./capability-config.js";
 import { CAPABILITY_CALLBACK_SCHEMA_VERSION, doctorCapabilityRecords, } from "./capability-store.js";
@@ -226,7 +227,7 @@ async function configDoctor() {
     try {
         const info = await lstat(path);
         exists = true;
-        unsafePermissions = info.isSymbolicLink() || !info.isFile() || (info.mode & 0o077) !== 0;
+        unsafePermissions = info.isSymbolicLink() || !info.isFile() || !privatePathIsSafe(path);
     }
     catch (error) {
         if (error.code !== "ENOENT")

package/mcp-memory-server/dist/capability-config.js

@@ -1,7 +1,8 @@
 import { createHash, randomBytes } from "node:crypto";
 import { constants } from "node:fs";
-import { chmod, lstat, mkdir, open, rename, rm, } from "node:fs/promises";
+import { lstat, mkdir, open, rename, rm, } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
+import { hardenPrivatePath } from "./platform-security.js";
 import { CAPABILITY_REGISTRY } from "./capability-registry.js";
 import { CAPABILITY_IDS, CAPABILITY_SCHEMA_VERSION, capabilityIdSchema, capabilityManagedConfigSchema, capabilityStatusSchema, } from "./capability-schema.js";
 const MAX_CONFIG_BYTES = 64 * 1024;
@@ -247,9 +248,9 @@ async function atomicWriteConfig(path, config) {
         await handle.sync();
         await handle.close();
         handle = undefined;
-        await chmod(temporary, 0o600);
+        hardenPrivatePath(temporary);
         await rename(temporary, path);
-        await chmod(path, 0o600);
+        hardenPrivatePath(path);
     }
     finally {
         if (handle)

package/mcp-memory-server/dist/capability-harness.js

@@ -1,13 +1,14 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { constants } from "node:fs";
 import { homedir } from "node:os";
-import { chmod, lstat, mkdir, open, readdir, realpath, rename, rm, stat, } from "node:fs/promises";
+import { lstat, mkdir, open, readdir, realpath, rename, rm, stat, } from "node:fs/promises";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { z } from "zod";
 import { isCapabilityContractEnabled, resolveCapabilityStatus, } from "./capability-config.js";
 import { operatingCapabilityHandleSchema, } from "./capability-adapter.js";
 import { CAPABILITY_CALLBACK_SCHEMA_VERSION, isOperatingCapabilitySettled, issueOperatingCapability, settleOperatingCapability, } from "./capability-store.js";
 import { isTrajectoryCaptureEnabled } from "./trajectory-schema.js";
+import { hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
 const LEASE_DIRECTORY_NAME = "capability-leases-v1";
 const LEASE_SCHEMA_VERSION = 1;
 const MAX_LEASE_BYTES = 4_096;
@@ -124,12 +125,13 @@ async function ensureLeaseDirectory(options = {}) {
     const rootInfo = await lstat(root);
     if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink())
         throw new Error("Harness state root is unsafe.");
+    hardenPrivatePath(root);
     const directory = getHarnessCapabilityLeaseDirectory(options);
     await mkdir(directory, { recursive: true, mode: 0o700 });
     const info = await lstat(directory);
     if (!info.isDirectory() || info.isSymbolicLink())
         throw new Error("Harness lease directory is unsafe.");
-    await chmod(directory, 0o700);
+    hardenPrivatePath(directory);
     return directory;
 }
 async function canonicalProjectBinding(rawRoot) {
@@ -185,9 +187,9 @@ async function writeLease(lease, options = {}) {
         await handle.sync();
         await handle.close();
         handle = undefined;
-        await chmod(temporary, 0o600);
+        hardenPrivatePath(temporary);
         await rename(temporary, path);
-        await chmod(path, 0o600);
+        hardenPrivatePath(path);
     }
     finally {
         if (handle)
@@ -200,7 +202,7 @@ async function readLease(path) {
     try {
         handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
         const info = await handle.stat();
-        if (!info.isFile() || info.size > MAX_LEASE_BYTES || (info.mode & 0o077) !== 0)
+        if (!info.isFile() || info.size > MAX_LEASE_BYTES || !privatePathIsSafe(path))
             return undefined;
         const bytes = await handle.readFile();
         if (bytes.byteLength > MAX_LEASE_BYTES)
@@ -216,7 +218,32 @@ async function readLease(path) {
     }
 }
 async function removeLease(path) {
-    await rm(path, { force: true });
+    let lastError;
+    for (let attempt = 0; attempt < 12; attempt += 1) {
+        try {
+            await rm(path, { force: true });
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== "EPERM" && code !== "EBUSY")
+                throw error;
+            lastError = error;
+            if (process.platform === "win32" && attempt === 0) {
+                try {
+                    const info = await lstat(path);
+                    if (info.isFile() && !info.isSymbolicLink())
+                        hardenPrivatePath(path);
+                }
+                catch (aclError) {
+                    if (aclError.code === "ENOENT")
+                        return;
+                }
+            }
+            await new Promise((resolveDelay) => setTimeout(resolveDelay, 25 * (attempt + 1)));
+        }
+    }
+    throw lastError;
 }
 function capabilityState(snapshot, id) {
     const state = snapshot.capabilities.find((row) => row.id === id);
@@ -280,7 +307,7 @@ async function matchingLeases(input, options = {}) {
     let entries;
     try {
         const info = await lstat(directory);
-        if (!info.isDirectory() || info.isSymbolicLink() || (info.mode & 0o077) !== 0)
+        if (!info.isDirectory() || info.isSymbolicLink() || !privatePathIsSafe(directory))
             return [];
         entries = (await readdir(directory, { withFileTypes: true }))
             .sort((left, right) => left.name.localeCompare(right.name))