@cairnkeep/cli 2.9.0 → 2.12.0

package/mcp-memory-server/dist/context-pack.js

@@ -1,12 +1,13 @@
 import { execFile } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
-import { chmod, cp, mkdir, mkdtemp, open, readdir, readFile, realpath, rename, rm, stat, } from "node:fs/promises";
+import { chmod, cp, mkdir, mkdtemp, open, readdir, readFile, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { z } from "zod";
 import { EmbeddingCache, cosineSimilarity, embedTexts, getEmbeddingConfig, hashText } from "./embeddings.js";
+import { atomicReplace, hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
 const execFileAsync = promisify(execFile);
 export const CONTEXT_PACK_MANIFEST = "context-pack.json";
 export const CONTEXT_PACK_MAX_FILE_BYTES = 1024 * 1024;
@@ -73,7 +74,7 @@ function readPackSource(digest) {
     const directoryInfo = lstatSync(directory);
     const info = lstatSync(path);
     if (!directoryInfo.isDirectory() || directoryInfo.isSymbolicLink() || !info.isFile() || info.isSymbolicLink()
-        || info.size > 64 * 1024 || (process.platform !== "win32" && (info.mode & 0o077) !== 0)) {
+        || info.size > 64 * 1024 || !privatePathIsSafe(path)) {
         throw new Error(`Context pack source record is unsafe: ${digest}`);
     }
     const value = JSON.parse(readFileSync(path, "utf8"));
@@ -193,8 +194,9 @@ async function atomicJson(path, value) {
         await handle.close();
         handle = undefined;
         await chmod(temporary, 0o600);
-        await rename(temporary, path);
-        await chmod(path, 0o600);
+        hardenPrivatePath(temporary);
+        await atomicReplace(temporary, path);
+        hardenPrivatePath(path);
     }
     finally {
         if (handle)
@@ -210,13 +212,35 @@ async function makeImmutable(root) {
             const path = join(directory, entry.name);
             if (entry.isDirectory())
                 await walk(path);
+            else if (process.platform === "win32") {
+                hardenPrivatePath(path);
+                await execFileAsync("attrib.exe", ["+R", path]);
+            }
             else
                 await chmod(path, 0o400);
         }
     };
     await walk(root);
-    for (const directory of directories.reverse())
-        await chmod(directory, 0o500);
+    for (const directory of directories.reverse()) {
+        if (process.platform === "win32")
+            hardenPrivatePath(directory);
+        else
+            await chmod(directory, 0o500);
+    }
+}
+async function makeWritable(root) {
+    if (!existsSync(root))
+        return;
+    await chmod(root, 0o700);
+    for (const entry of await readdir(root, { withFileTypes: true })) {
+        const path = join(root, entry.name);
+        if (entry.isDirectory())
+            await makeWritable(path);
+        else if (process.platform === "win32")
+            await execFileAsync("attrib.exe", ["-R", path]);
+        else
+            await chmod(path, 0o600);
+    }
 }
 function rejectCredentialUrl(source) {
     try {
@@ -232,6 +256,45 @@ function rejectCredentialUrl(source) {
         throw new Error("Git source URLs may not contain credentials.");
     }
 }
+function execFileBuffer(program, args, options) {
+    return new Promise((resolvePromise, rejectPromise) => {
+        execFile(program, args, { ...options, encoding: null, windowsHide: true }, (error, stdout) => {
+            if (error)
+                rejectPromise(error);
+            else
+                resolvePromise(Buffer.from(stdout));
+        });
+    });
+}
+async function materializeGitTree(repository, destination, commit) {
+    const listing = await execFileBuffer("git", ["-C", repository, "ls-tree", "-r", "-z", commit], { timeout: 30_000, maxBuffer: 4 * 1024 * 1024 });
+    const records = new TextDecoder("utf-8", { fatal: true }).decode(listing).split("\0").filter(Boolean);
+    if (records.length > CONTEXT_PACK_MAX_ENTRIES + 1)
+        throw new Error("Git context pack exceeds the entry limit.");
+    let totalBytes = 0;
+    for (const record of records) {
+        const match = /^(100644|100755|120000) blob ([a-f0-9]{40}|[a-f0-9]{64})\t([\s\S]+)$/.exec(record);
+        if (!match || match[1] === "120000")
+            throw new Error("Git context packs may contain only regular files.");
+        const path = normalizePackPath(match[3]);
+        const { stdout: rawSize } = await execFileAsync("git", ["-C", repository, "cat-file", "-s", match[2]], { encoding: "utf8", timeout: 30_000, maxBuffer: 1024 });
+        const size = Number(rawSize.trim());
+        if (!Number.isSafeInteger(size) || size < 0 || size > CONTEXT_PACK_MAX_FILE_BYTES) {
+            throw new Error(`Git context pack file is unsafe or too large: ${path}`);
+        }
+        totalBytes += size;
+        if (totalBytes > CONTEXT_PACK_MAX_TOTAL_BYTES)
+            throw new Error("Git context pack exceeds the total size limit.");
+        const target = resolve(destination, ...path.split("/"));
+        if (!contained(destination, target))
+            throw new Error(`Unsafe Git context pack path: ${path}`);
+        await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+        const bytes = await execFileBuffer("git", ["-C", repository, "cat-file", "blob", match[2]], { timeout: 30_000, maxBuffer: CONTEXT_PACK_MAX_FILE_BYTES + 1 });
+        if (bytes.byteLength !== size)
+            throw new Error(`Git context pack blob changed while reading: ${path}`);
+        await writeFile(target, bytes, { mode: match[1] === "100755" ? 0o700 : 0o600 });
+    }
+}
 async function materializeSource(source, ref) {
     if (!ref) {
         const requested = resolve(source);
@@ -250,9 +313,10 @@ async function materializeSource(source, ref) {
         const commit = stdout.trim();
         if (!GIT_COMMIT.test(commit))
             throw new Error("Git did not resolve the requested ref to a full commit.");
-        await execFileAsync("git", ["-C", checkout, "checkout", "--quiet", "--detach", commit], { timeout: 60_000, maxBuffer: 1024 * 1024 });
-        await rm(join(checkout, ".git"), { recursive: true, force: true });
-        return { root: checkout, cleanup: checkout, source: { kind: "git", url: gitSource, ref, commit } };
+        const root = join(checkout, "pack");
+        await mkdir(root, { mode: 0o700 });
+        await materializeGitTree(checkout, root, commit);
+        return { root, cleanup: checkout, source: { kind: "git", url: gitSource, ref, commit } };
     }
     catch (error) {
         await rm(checkout, { recursive: true, force: true });
@@ -275,6 +339,7 @@ export async function installContextPack(sourcePath, options = {}) {
         const objects = dirname(destination);
         await mkdir(objects, { recursive: true, mode: 0o700 });
         const temporary = join(objects, `.${pack.digest}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
+        let published = true;
         try {
             await cp(pack.root, temporary, { recursive: true, errorOnExist: true, force: false });
             const copied = await validateContextPack(temporary);
@@ -285,19 +350,23 @@ export async function installContextPack(sourcePath, options = {}) {
                 await rename(temporary, destination);
             }
             catch (error) {
-                if (!["EEXIST", "ENOTEMPTY"].includes(error.code ?? "") || !existsSync(destination))
+                const code = error.code ?? "";
+                const converged = existsSync(destination)
+                    && (["EEXIST", "ENOTEMPTY"].includes(code) || (process.platform === "win32" && code === "EPERM"));
+                if (!converged)
                     throw error;
                 const concurrent = await validateContextPack(destination);
                 if (concurrent.digest !== pack.digest)
                     throw new Error("Concurrent context pack installation produced a conflicting object.");
+                published = false;
             }
         }
         finally {
-            await chmod(temporary, 0o700).catch(() => undefined);
+            await makeWritable(temporary).catch(() => undefined);
             await rm(temporary, { recursive: true, force: true }).catch(() => undefined);
         }
         await atomicJson(join(packBaseDir(), "sources", `${pack.digest}.json`), { schema_version: 1, source: materialized.source });
-        return { pack: await validateContextPack(destination), source: materialized.source, existing: false };
+        return { pack: await validateContextPack(destination), source: materialized.source, existing: !published };
     }
     finally {
         if (materialized.cleanup)
@@ -396,7 +465,7 @@ export function readProjectPointer(options) {
         return emptyPointer(identity.id);
     const info = lstatSync(identity.path);
     if (!info.isFile() || info.isSymbolicLink() || info.size > 1024 * 1024
-        || (process.platform !== "win32" && (info.mode & 0o077) !== 0))
+        || !privatePathIsSafe(identity.path))
         throw new Error("Context pack project pointer is unsafe.");
     return parseProjectPointer(JSON.parse(readFileSync(identity.path, "utf8")), identity.id);
 }
@@ -470,7 +539,7 @@ async function allPointers() {
         const path = join(directory, entry.name);
         const info = lstatSync(path);
         if (!info.isFile() || info.isSymbolicLink() || info.size > 1024 * 1024
-            || (process.platform !== "win32" && (info.mode & 0o077) !== 0)) {
+            || !privatePathIsSafe(path)) {
             throw new Error(`Context pack project pointer is unsafe: ${path}`);
         }
         const raw = JSON.parse(await readFile(path, "utf8"));
@@ -489,17 +558,7 @@ export async function removeContextPack(selector) {
             throw new Error("Context pack is enabled by a project and cannot be removed.");
     }
     const root = objectRoot(pack.digest);
-    const unlock = async (directory) => {
-        await chmod(directory, 0o700);
-        for (const entry of await readdir(directory, { withFileTypes: true })) {
-            const path = join(directory, entry.name);
-            if (entry.isDirectory())
-                await unlock(path);
-            else
-                await chmod(path, 0o600);
-        }
-    };
-    await unlock(root);
+    await makeWritable(root);
     await rm(root, { recursive: true, force: true });
     await rm(join(packBaseDir(), "sources", `${pack.digest}.json`), { force: true });
     return pack.digest;

package/mcp-memory-server/dist/eval-cli.js

@@ -7,6 +7,7 @@ import { isEvalEnabled, loadEvalPlan } from "./eval-plan.js";
 import { diagnoseEvalReport, readEvalReport, renderEvalReport, } from "./eval-report.js";
 import { buildAblationArms, runCapabilityAblation, runTwoPassExperiment, } from "./eval-runner.js";
 import { canonicalJson, EVAL_SCHEMA_VERSION } from "./eval-schema.js";
+import { privatePathIsSafe } from "./platform-security.js";
 process.stdout.on("error", (error) => {
     if (error.code === "EPIPE")
         process.exit(0);
@@ -126,7 +127,7 @@ async function evalRoot() {
             return null;
         throw error;
     }
-    if (info.isSymbolicLink() || !info.isDirectory() || (info.mode & 0o077) !== 0) {
+    if (info.isSymbolicLink() || !info.isDirectory() || !privatePathIsSafe(root)) {
         throw new Error("unsafe_eval_root");
     }
     const resolvedRoot = await realpath(root);
@@ -185,7 +186,7 @@ async function diagnoseProjectReports(projectRoot) {
         }
         if (info.isSymbolicLink() || !info.isDirectory() || await realpath(directory) !== directory)
             return "unsafe";
-        if (directory === root && (info.mode & 0o077) !== 0)
+        if (directory === root && !privatePathIsSafe(directory))
             return "unsafe";
     }
     const entries = await readdir(root, { withFileTypes: true });
@@ -201,7 +202,7 @@ async function diagnoseProjectReports(projectRoot) {
         if (!isContained(root, experimentPath) || experimentPath === root)
             return "unsafe";
         const experimentInfo = await lstat(experimentPath);
-        if (experimentInfo.isSymbolicLink() || !experimentInfo.isDirectory() || (experimentInfo.mode & 0o077) !== 0
+        if (experimentInfo.isSymbolicLink() || !experimentInfo.isDirectory() || !privatePathIsSafe(experimentPath)
             || await realpath(experimentPath) !== experimentPath) {
             return "unsafe";
         }
@@ -247,7 +248,7 @@ async function safeReportStore(experimentId) {
             throw new Error("eval_report_not_found");
         throw error;
     }
-    if (directory.isSymbolicLink() || !directory.isDirectory() || (directory.mode & 0o077) !== 0
+    if (directory.isSymbolicLink() || !directory.isDirectory() || !privatePathIsSafe(experimentPath)
         || await realpath(experimentPath) !== experimentPath) {
         throw new Error("unsafe_experiment_path");
     }
@@ -261,7 +262,7 @@ async function safeReportStore(experimentId) {
             throw new Error("eval_report_not_found");
         throw error;
     }
-    if (reportInfo.isSymbolicLink() || !reportInfo.isFile() || (reportInfo.mode & 0o077) !== 0
+    if (reportInfo.isSymbolicLink() || !reportInfo.isFile() || !privatePathIsSafe(reportPath)
         || reportInfo.size > DEFAULT_REPORT_BYTES) {
         throw new Error("unsafe_eval_report");
     }

package/mcp-memory-server/dist/eval-plan.js

@@ -1,7 +1,7 @@
 import { spawnSync } from "node:child_process";
 import { constants } from "node:fs";
 import { accessSync, closeSync, existsSync, fstatSync, lstatSync, openSync, readFileSync, realpathSync, } from "node:fs";
-import { delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CAPABILITY_IDS } from "./capability-schema.js";
 import { EVAL_SCHEMA_VERSION, canonicalDigest, canonicalJson, evalAdapterConfigSchema, evalTaskSetSchema, } from "./eval-schema.js";
@@ -16,6 +16,19 @@ function isContained(root, candidate) {
     const rel = relative(root, candidate);
     return rel === "" || (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel));
 }
+function isExistingPathContained(root, candidate) {
+    const rootInfo = lstatSync(root);
+    let current = realpathSync(candidate);
+    for (;;) {
+        const currentInfo = lstatSync(current);
+        if (currentInfo.dev === rootInfo.dev && currentInfo.ino === rootInfo.ino)
+            return true;
+        const parent = dirname(current);
+        if (parent === current)
+            return false;
+        current = parent;
+    }
+}
 function assertRealDirectory(path, label) {
     const info = lstatSync(path);
     if (info.isSymbolicLink() || !info.isDirectory())
@@ -68,12 +81,16 @@ function resolveExactCommit(repository, revision) {
     return resolved;
 }
 function parseCommittedTaskSet(taskSetPath) {
-    const manifestRepository = assertRealDirectory(git(dirname(taskSetPath), ["rev-parse", "--show-toplevel"], "Resolve task-set repository"), "Task-set repository");
-    if (!isContained(manifestRepository, taskSetPath))
+    const manifestDirectory = dirname(taskSetPath);
+    const manifestRepository = assertRealDirectory(git(manifestDirectory, ["rev-parse", "--show-toplevel"], "Resolve task-set repository"), "Task-set repository");
+    if (!isExistingPathContained(manifestRepository, taskSetPath)) {
         throw new Error("The task-set manifest must be contained by its Git repository.");
-    const manifestPath = relative(manifestRepository, taskSetPath).split(sep).join("/");
-    if (!manifestPath || manifestPath.startsWith("../"))
+    }
+    const manifestPrefix = git(manifestDirectory, ["rev-parse", "--show-prefix"], "Resolve task-set repository prefix");
+    const manifestPath = `${manifestPrefix}${basename(taskSetPath)}`.split("\\").join("/");
+    if (!manifestPath || manifestPath.startsWith("../") || isAbsolute(manifestPath)) {
         throw new Error("The task-set manifest path is invalid.");
+    }
     git(manifestRepository, ["ls-files", "--error-unmatch", "--", manifestPath], "Require a tracked evaluation task set");
     const dirty = git(manifestRepository, ["status", "--porcelain", "--untracked-files=all", "--", manifestPath], "Check evaluation task set status");
     if (dirty !== "")
@@ -111,15 +128,20 @@ function resolvePathProgram(program, base) {
 function resolveProgram(program, base) {
     if (isAbsolute(program) || program.includes("/") || program.includes("\\"))
         return resolvePathProgram(program, base);
+    const names = process.platform === "win32" && extname(program) === ""
+        ? [program, ...[".EXE", ".COM"].map((extension) => `${program}${extension}`)]
+        : [program];
     for (const directory of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) {
-        const candidate = join(directory, program);
-        try {
-            accessSync(candidate, constants.X_OK);
-            if (lstatSync(candidate).isFile() || lstatSync(candidate).isSymbolicLink())
-                return realpathSync(candidate);
-        }
-        catch {
-            // Continue through PATH without executing the candidate.
+        for (const name of names) {
+            const candidate = join(directory, name);
+            try {
+                accessSync(candidate, constants.X_OK);
+                if (lstatSync(candidate).isFile() || lstatSync(candidate).isSymbolicLink())
+                    return realpathSync(candidate);
+            }
+            catch {
+                // Continue through PATH without executing the candidate.
+            }
         }
     }
     throw new Error(`Evaluation program was not found on PATH: ${program}`);

package/mcp-memory-server/dist/eval-process.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { evalAdapterRequestSchema, evalAdapterResultSchema, } from "./eval-schema.js";
 export const EVAL_PROCESS_ERROR_CODES = [
     "spawn_error",
@@ -33,7 +33,7 @@ export class EvalProcessError extends Error {
 const DEFAULT_KILL_GRACE_MS = 1_000;
 const MAX_TIMER_MS = 2_147_483_647;
 function terminationScope() {
-    return process.platform === "win32" ? "child" : "process-group";
+    return process.platform === "win32" ? "process-tree" : "process-group";
 }
 function assertOptions(options) {
     if (!Number.isSafeInteger(options.timeout_ms) || options.timeout_ms <= 0 || options.timeout_ms > MAX_TIMER_MS) {
@@ -59,7 +59,9 @@ function signalChild(child, signal) {
             process.kill(-child.pid, signal);
             return true;
         }
-        return child.kill(signal);
+        const args = ["/PID", String(child.pid), "/T", ...(signal === "SIGKILL" ? ["/F"] : [])];
+        const result = spawnSync("taskkill.exe", args, { stdio: "ignore", windowsHide: true });
+        return result.status === 0 || child.kill(signal);
     }
     catch {
         try {
@@ -90,7 +92,12 @@ async function runCommandInternal(options) {
         let exitSignal = null;
         let graceTimer;
         let closeTimer;
-        const child = spawn(options.command.program, options.command.args, {
+        // A shebang does not make a JavaScript file directly executable on
+        // Windows. Adapter contracts may point at JS programs, so launch
+        // those through the current runtime while preserving the declared
+        // command for hashing and provenance.
+        const javascriptProgram = /\.(?:cjs|mjs|js)$/i.test(options.command.program);
+        const child = spawn(javascriptProgram ? process.execPath : options.command.program, [...(javascriptProgram ? [options.command.program] : []), ...options.command.args], {
             cwd: options.cwd,
             env: options.env,
             shell: false,

package/mcp-memory-server/dist/eval-report.js

@@ -1,9 +1,10 @@
 import { randomBytes } from "node:crypto";
 import { constants } from "node:fs";
-import { chmod, lstat, mkdir, open, readdir, realpath, rename, rm, } from "node:fs/promises";
+import { lstat, mkdir, open, readdir, realpath, rename, rm, } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { canonicalDigest, canonicalJson, evalAggregateSchema, evalReportSchema, } from "./eval-schema.js";
 import { computeDifferenceInDifferences, computePairedEstimate, } from "./eval-statistics.js";
+import { hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
 const DEFAULT_MAX_REPORT_BYTES = 16 * 1024 * 1024;
 const MAX_ALLOWED_REPORT_BYTES = 64 * 1024 * 1024;
 const DEFAULT_MAX_EXPERIMENTS = 10_000;
@@ -36,7 +37,7 @@ async function ensureSafeDirectory(path, privateMode = false) {
         if (info.isSymbolicLink() || !info.isDirectory())
             throw new Error("unsafe_report_directory");
         if (privateMode)
-            await chmod(path, 0o700);
+            hardenPrivatePath(path);
         return;
     }
     catch (error) {
@@ -48,7 +49,7 @@ async function ensureSafeDirectory(path, privateMode = false) {
         throw new Error("unsafe_report_directory");
     await ensureSafeDirectory(parent, false);
     await mkdir(path, { mode: 0o700 });
-    await chmod(path, 0o700);
+    hardenPrivatePath(path);
 }
 function assertLimits(maxReportBytes, maxExperiments) {
     if (!Number.isSafeInteger(maxReportBytes) || maxReportBytes < 1 || maxReportBytes > MAX_ALLOWED_REPORT_BYTES) {
@@ -206,8 +207,9 @@ export async function checkpointEvalReport(store, report, options = {}) {
             await handle.close();
             handle = undefined;
             injectFault(options, "after_close");
+            hardenPrivatePath(temporary);
             await rename(temporary, store.report_path);
-            await chmod(store.report_path, 0o600);
+            hardenPrivatePath(store.report_path);
             injectFault(options, "after_rename");
         }
         finally {
@@ -239,7 +241,7 @@ export async function diagnoseEvalReport(store) {
         });
         if (!info)
             return { state: "absent", code: "report_absent" };
-        if (info.isSymbolicLink() || !info.isFile() || (info.mode & 0o077) !== 0) {
+        if (info.isSymbolicLink() || !info.isFile() || !privatePathIsSafe(store.report_path)) {
             return { state: "unsafe", code: "report_unsafe" };
         }
         const report = await readEvalReport(store);

package/mcp-memory-server/dist/graph-cli.js

@@ -90,7 +90,13 @@ function graphifyEnvironment() {
     return environment;
 }
 function executeGraphify(projectRoot, args, timeout) {
-    const result = spawnSync("graphify", args, {
+    const configuredProgram = process.env.CAIRN_GRAPHIFY_BINARY?.trim();
+    const graphifyProgram = configuredProgram || "graphify";
+    const javascriptProgram = /\.(?:cjs|mjs|js)$/i.test(graphifyProgram);
+    const result = spawnSync(javascriptProgram ? process.execPath : graphifyProgram, [
+        ...(javascriptProgram ? [graphifyProgram] : []),
+        ...args,
+    ], {
         cwd: projectRoot,
         encoding: "utf8",
         shell: false,

package/mcp-memory-server/dist/index.js

@@ -761,7 +761,18 @@ async function runContextExplore(args) {
     }
     // --- Execution tier: return { ok: false, ... } (runtime problems, D-04) ---
     if (!evidence) {
-        const result = await runCommand(binaryPath, ["explore", "--query", query, "--repo-root", repoRoot], (timeoutSeconds ?? 120) * 1000, { ...process.env, NO_COLOR: "1" });
+        // Native Windows cannot execute a JavaScript file directly from a
+        // shebang. Treat JS helpers as Node programs while keeping compiled
+        // token_miser binaries byte-for-byte compatible on every platform.
+        const javascriptHelper = /\.(?:cjs|mjs|js)$/i.test(binaryPath);
+        const result = await runCommand(javascriptHelper ? process.execPath : binaryPath, [
+            ...(javascriptHelper ? [binaryPath] : []),
+            "explore",
+            "--query",
+            query,
+            "--repo-root",
+            repoRoot,
+        ], (timeoutSeconds ?? 120) * 1000, { ...process.env, NO_COLOR: "1" });
         if (result.timedOut || result.exitCode !== 0) {
             const payload = {
                 ok: false,
@@ -1718,30 +1729,18 @@ function buildMemoryServer(context, capabilitySnapshot, withCapability, toolProf
             }
             // Resolve containment before any database is opened or directory is created.
             const scopePath = resolveScopePath(envelope.scope, scopeOptions);
-            const existing = await openScope(envelope.scope, false, scopeOptions);
-            let plan;
-            try {
-                plan = await planMemoryImport(existing, envelope);
-            }
-            finally {
-                await existing?.close();
-            }
-            if (envelope.dry_run) {
-                const payload = await commitMemoryImport(null, plan);
-                return {
-                    content: [{ type: "text", text: asToolText(payload) }],
-                    structuredContent: payload,
-                };
-            }
             const payload = await serializeScopeMutation(scopePath, async () => {
-                const agent = await openScope(envelope.scope, true, scopeOptions);
-                if (!agent)
-                    throw new Error(`Unable to open scope ${envelope.scope}.`);
+                const agent = await openScope(envelope.scope, !envelope.dry_run, scopeOptions);
                 try {
+                    const plan = await planMemoryImport(agent, envelope);
+                    if (envelope.dry_run)
+                        return commitMemoryImport(null, plan);
+                    if (!agent)
+                        throw new Error(`Unable to open scope ${envelope.scope}.`);
                     return await commitMemoryImport(agent, plan);
                 }
                 finally {
-                    await agent.close();
+                    await agent?.close();
                 }
             });
             return {

package/mcp-memory-server/dist/mcp-tool-profile.js

@@ -1,8 +1,9 @@
 import { createHash, randomBytes } from "node:crypto";
 import { closeSync, constants, existsSync, lstatSync, openSync, readFileSync, realpathSync, rmSync } from "node:fs";
-import { chmod, mkdir, open, rename, rm } from "node:fs/promises";
+import { chmod, mkdir, open, rm } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { MCP_TOOL_CATALOG, MCP_TOOL_NAMES, isCairnToolName } from "./mcp-tool-catalog.js";
+import { atomicReplace, hardenPrivatePath, privatePathIsSafe } from "./platform-security.js";
 const MAX_CONFIG_BYTES = 64 * 1024;
 function paths(projectRoot) {
     const root = resolve(projectRoot);
@@ -63,7 +64,7 @@ function readProjectConfig(projectRoot) {
     const dirInfo = lstatSync(directory);
     const info = lstatSync(config);
     if (!dirInfo.isDirectory() || dirInfo.isSymbolicLink() || !info.isFile() || info.isSymbolicLink()
-        || info.size > MAX_CONFIG_BYTES || (process.platform !== "win32" && (info.mode & 0o077) !== 0)) {
+        || info.size > MAX_CONFIG_BYTES || !privatePathIsSafe(config)) {
         throw new Error("MCP tool profile configuration is unsafe.");
     }
     const fd = requireNoFollow(config);
@@ -129,8 +130,9 @@ async function atomicWrite(path, value) {
         await handle.close();
         handle = undefined;
         await chmod(temporary, 0o600);
-        await rename(temporary, path);
-        await chmod(path, 0o600);
+        hardenPrivatePath(temporary);
+        await atomicReplace(temporary, path);
+        hardenPrivatePath(path);
     }
     finally {
         if (handle)

package/mcp-memory-server/dist/note-store.js

@@ -5,6 +5,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve } from "node:pat
 import { buildFailureSignature } from "./failure-signature.js";
 import { NOTE_SCHEMA_VERSION, noteNodeSchema, } from "./note-schema.js";
 import { memoryImportEnvelopeSchema, nodePathSchema, } from "./node-schema.js";
+import { atomicReplace } from "./platform-security.js";
 const MANAGED_START = "<!-- cairnkeep:managed:v1:start -->";
 const MANAGED_END = "<!-- cairnkeep:managed:v1:end -->";
 const MAX_PROCESSED_SESSIONS_PER_PROJECT = 4096;
@@ -685,7 +686,8 @@ export function planCreateAddressedNote(options) {
     return { schema_version: 1, operation: "create", notes_root: target.layout.notes_root, project_id: target.layout.project_id, changes: manifestChanges(target.layout.notes_root, manifest, [{ path: target.absolute_path, bytes: renderNote(record) }]), result: { ok: true, scope: "project", key: options.key, created: true, snapshot_key: null, node } };
 }
 function historyPath(notesRoot, addressSpace, key) {
-    return join(notesRoot, ".cairnkeep", "history", addressSpace, ...key.split("/"), `${new Date().toISOString()}-${randomBytes(6).toString("hex")}.json`);
+    const portableTimestamp = new Date().toISOString().replaceAll(":", "-");
+    return join(notesRoot, ".cairnkeep", "history", addressSpace, ...key.split("/"), `${portableTimestamp}-${randomBytes(6).toString("hex")}.json`);
 }
 export function planSupersedeAddressedNote(options) {
     const target = resolveNoteTarget(options);
@@ -725,7 +727,9 @@ function pendingTransactionDirectories(notesRoot) {
     return readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join(root, entry.name)).sort();
 }
 function syncFile(path) {
-    const descriptor = openSync(path, "r");
+    // FlushFileBuffers requires a write-capable Windows handle. POSIX accepts
+    // the narrower read handle used by the historical implementation.
+    const descriptor = openSync(path, process.platform === "win32" ? "r+" : "r");
     try {
         fsyncSync(descriptor);
     }
@@ -734,6 +738,11 @@ function syncFile(path) {
     }
 }
 function syncDirectory(path) {
+    // Windows does not permit opening a directory as a file descriptor, so
+    // Node cannot fsync it. File contents are still fsynced before the atomic
+    // rename; POSIX additionally persists the containing directory entry.
+    if (process.platform === "win32")
+        return;
     const descriptor = openSync(path, "r");
     try {
         fsyncSync(descriptor);
@@ -839,7 +848,7 @@ export async function commitJournaledNoteMutation(plan) {
         for (const change of journal.changes) {
             mkdirSync(dirname(change.path), { recursive: true });
             if (change.staged)
-                renameSync(change.staged, change.path);
+                await atomicReplace(change.staged, change.path);
             else
                 rmSync(change.path, { force: true });
             if (existsSync(change.path))