@remnic/core 10.0.84 → 10.0.86

package/src/access-proto-injection.test.ts

@@ -0,0 +1,340 @@
+/**
+ * Request-local prototype injection and post-parse namespace authorization
+ * (issue #3225 B1).
+ *
+ * A JSON body can carry an own `__proto__` member (JSON.parse defines it as a
+ * real own property). The null-strip preprocessors used to copy that member
+ * into a plain `{}` accumulator, whose setter switched the accumulator's
+ * prototype, so an inherited `namespace` became an ordinary parsed field
+ * AFTER the transports had authorized the raw arguments. These tests drive
+ * the real registered boundary operations with JSON-decoded input and assert
+ * that reserved keys are rejected and that a parsed explicit namespace still
+ * passes the token namespace allow-list before the handler runs.
+ */
+
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { getOperation, type BoundOperation } from "./access-boundary.js";
+import {
+  EngramAccessInputError,
+  type EngramAccessMemoryResponse,
+  type EngramAccessRecallRequest,
+  type EngramAccessRecallResponse,
+  type EngramAccessService,
+} from "./access-service.js";
+import { validateRequest, type RecallRequest } from "./access-schema.js";
+import type { RecallNavigationResult } from "./recall-navigation.js";
+import { EngramAccessForbiddenError } from "./access-errors.js";
+import { tokenCapabilityStore } from "./access-token-capabilities.js";
+import "./access-operations.js";
+import "./access-operations-batch.js";
+import "./recall-navigation-operations.js";
+
+function makeService(handlers: Partial<EngramAccessService>): EngramAccessService {
+  // SAFETY: the operations under test dispatch only through the handlers supplied here.
+  return handlers as EngramAccessService;
+}
+
+function mustBeRegistered(name: Parameters<typeof getOperation>[0]): BoundOperation {
+  const op = getOperation(name);
+  assert.ok(op, `${name} must be registered`);
+  return op;
+}
+
+test("own __proto__ member cannot smuggle a namespace into memory_profile", async () => {
+  let handlerCalls = 0;
+  const service = makeService({
+    memoryProfile: async () => {
+      handlerCalls += 1;
+      throw new Error("handler must not run for a prototype-injection attempt");
+    },
+  });
+  const exploit = JSON.parse('{"__proto__":{"namespace":"other"}}');
+  const op = mustBeRegistered("memory_profile");
+  await assert.rejects(
+    () =>
+      tokenCapabilityStore.run(
+        { version: 1, namespaces: ["default"], ops: ["memory_profile"] },
+        () => op.run(exploit, { service }),
+      ),
+    EngramAccessInputError,
+  );
+  assert.equal(handlerCalls, 0, "handler must not run for a prototype-injection attempt");
+});
+
+test("own __proto__ member cannot smuggle a namespace into recall", async () => {
+  let handlerCalls = 0;
+  const service = makeService({
+    recall: async () => {
+      handlerCalls += 1;
+      throw new Error("handler must not run for a prototype-injection attempt");
+    },
+  });
+  const exploit = JSON.parse('{"__proto__":{"namespace":"other"},"query":"hello"}');
+  const op = mustBeRegistered("recall");
+  await assert.rejects(
+    () =>
+      tokenCapabilityStore.run(
+        { version: 1, namespaces: ["default"], ops: ["recall"] },
+        () => op.run(exploit, { service }),
+      ),
+    EngramAccessInputError,
+  );
+  assert.equal(handlerCalls, 0, "handler must not run for a prototype-injection attempt");
+});
+
+test("reserved constructor and prototype keys are rejected on both null-strip paths", async () => {
+  const profileService = makeService({
+    memoryProfile: async () => {
+      throw new Error("handler must not run for a reserved-key argument");
+    },
+  });
+  const profileOp = mustBeRegistered("memory_profile");
+  await assert.rejects(
+    () =>
+      tokenCapabilityStore.run(
+        { version: 1, namespaces: ["default"], ops: ["memory_profile"] },
+        () => profileOp.run(JSON.parse('{"constructor":{"namespace":"other"}}'), { service: profileService }),
+      ),
+    EngramAccessInputError,
+  );
+  await assert.rejects(
+    () =>
+      tokenCapabilityStore.run(
+        { version: 1, namespaces: ["default"], ops: ["memory_profile"] },
+        () => profileOp.run(JSON.parse('{"prototype":{"namespace":"other"}}'), { service: profileService }),
+      ),
+    EngramAccessInputError,
+  );
+  const recallService = makeService({
+    recall: async () => {
+      throw new Error("handler must not run for a reserved-key argument");
+    },
+  });
+  const recallOp = mustBeRegistered("recall");
+  await assert.rejects(
+    () =>
+      tokenCapabilityStore.run(
+        { version: 1, namespaces: ["default"], ops: ["recall"] },
+        () => recallOp.run(JSON.parse('{"query":"q","constructor":{"namespace":"other"}}'), { service: recallService }),
+      ),
+    EngramAccessInputError,
+  );
+});
+
+test("navigation null-strip rejects an own __proto__ member (memory_expand)", async () => {
+  let handlerCalls = 0;
+  const service = makeService({
+    recallNavigate: async () => {
+      handlerCalls += 1;
+      throw new Error("handler must not run for a prototype-injection attempt");
+    },
+  });
+  const exploit = JSON.parse(
+    '{"__proto__":{"namespace":"other"},"memoryId":"m1","sessionKey":"s1"}',
+  );
+  const op = mustBeRegistered("memory_expand");
+  await assert.rejects(
+    () =>
+      tokenCapabilityStore.run(
+        { version: 1, namespaces: ["default"], ops: ["memory_expand"] },
+        () => op.run(exploit, { service }),
+      ),
+    EngramAccessInputError,
+  );
+  assert.equal(handlerCalls, 0, "handler must not run for a prototype-injection attempt");
+});
+
+test("a parsed explicit namespace outside the token allow-list is rejected before the handler", async () => {
+  let handlerCalls = 0;
+  let capturedNamespace: string | undefined;
+  const service = makeService({
+    memoryProfile: async (namespace) => {
+      handlerCalls += 1;
+      capturedNamespace = namespace;
+      throw new Error("handler must not run for a denied namespace");
+    },
+  });
+  const op = mustBeRegistered("memory_profile");
+  await assert.rejects(
+    () =>
+      tokenCapabilityStore.run(
+        { version: 1, namespaces: ["default"], ops: ["memory_profile"] },
+        () => op.run({ namespace: "other" }, { service }),
+      ),
+    EngramAccessForbiddenError,
+  );
+  assert.equal(handlerCalls, 0, "handler must not run for a denied namespace");
+  assert.equal(capturedNamespace, undefined);
+});
+
+test("an allowed explicit namespace still reaches the handler", async () => {
+  let profileCalls = 0;
+  let profileNamespace: string | undefined;
+  const profileService = makeService({
+    memoryProfile: async (namespace) => {
+      profileCalls += 1;
+      profileNamespace = namespace;
+      return {};
+    },
+  });
+  const profileOp = mustBeRegistered("memory_profile");
+  await tokenCapabilityStore.run(
+    { version: 1, namespaces: ["default", "other"], ops: ["memory_profile"] },
+    () => profileOp.run({ namespace: "other" }, { service: profileService }),
+  );
+  assert.equal(profileCalls, 1);
+  assert.equal(profileNamespace, "other");
+
+  let recallCalls = 0;
+  let recallNamespace: string | undefined;
+  const recallResponse: EngramAccessRecallResponse = {
+    query: "hello",
+    namespace: "other",
+    context: "",
+    count: 0,
+    memoryIds: [],
+    results: [],
+    fallbackUsed: false,
+    sourcesUsed: [],
+    disclosure: "chunk",
+  };
+  const recallService = makeService({
+    recall: async (input) => {
+      recallCalls += 1;
+      recallNamespace = input.namespace;
+      return recallResponse;
+    },
+  });
+  const recallOp = mustBeRegistered("recall");
+  await tokenCapabilityStore.run(
+    { version: 1, namespaces: ["default", "other"], ops: ["recall"] },
+    () => recallOp.run({ query: "hello", namespace: "other" }, { service: recallService }),
+  );
+  assert.equal(recallCalls, 1);
+  assert.equal(recallNamespace, "other");
+});
+
+test("an absent namespace is not defaulted at the boundary", async () => {
+  let profileNamespace: string | undefined;
+  const service = makeService({
+    memoryProfile: async (namespace) => {
+      profileNamespace = namespace;
+      return {};
+    },
+  });
+  const op = mustBeRegistered("memory_profile");
+  await tokenCapabilityStore.run(
+    { version: 1, namespaces: ["default"], ops: ["memory_profile"] },
+    () => op.run({}, { service }),
+  );
+  assert.equal(profileNamespace, undefined, "the boundary must not invent a namespace");
+});
+
+test("codingContext null clearing still works through recall", async () => {
+  let capturedInput: EngramAccessRecallRequest | undefined;
+  const recallResponse: EngramAccessRecallResponse = {
+    query: "q",
+    namespace: "default",
+    context: "",
+    count: 0,
+    memoryIds: [],
+    results: [],
+    fallbackUsed: false,
+    sourcesUsed: [],
+    disclosure: "chunk",
+  };
+  const service = makeService({
+    recall: async (input) => {
+      capturedInput = input;
+      return recallResponse;
+    },
+  });
+  const op = mustBeRegistered("recall");
+  await tokenCapabilityStore.run(
+    { version: 1, namespaces: ["default"], ops: ["recall"] },
+    () => op.run(JSON.parse('{"query":"q","codingContext":null}'), { service }),
+  );
+  assert.ok(capturedInput, "recall handler must run");
+  assert.ok(Object.hasOwn(capturedInput, "codingContext"), "codingContext must survive the null strip");
+  assert.equal(capturedInput.codingContext, null);
+});
+
+test("an allowed explicit namespace reaches the memory_expand handler", async () => {
+  let capturedNamespace: string | undefined;
+  const navigationResult: RecallNavigationResult = {
+    ok: false,
+    action: "expand",
+    error: "disabled",
+    message: "",
+    rendered: "",
+  };
+  const service = makeService({
+    recallNavigate: async (input) => {
+      capturedNamespace = input.namespace;
+      return navigationResult;
+    },
+  });
+  const op = mustBeRegistered("memory_expand");
+  await tokenCapabilityStore.run(
+    { version: 1, namespaces: ["ns2"], ops: ["memory_expand"] },
+    () =>
+      op.run({ memoryId: "m1", sessionKey: "s1", namespace: "ns2" }, { service }),
+  );
+  assert.equal(capturedNamespace, "ns2");
+});
+
+test("own __proto__ member cannot smuggle a namespace through the wire request parse", () => {
+  // validateRequest is the shared entry the HTTP REST body reader
+  // (readValidatedBody) and the MCP wire-schema parse (parseMcpRequest) run.
+  // A reserved key returns the documented validation failure, not a throw.
+  const recallExploit = JSON.parse('{"__proto__":{"namespace":"other"},"query":"hello"}');
+  const recallResult = validateRequest<RecallRequest>("recall", recallExploit);
+  assert.equal(recallResult.success, false);
+  if (!recallResult.success) {
+    assert.equal(recallResult.error.error, "request validation failed");
+    assert.equal(recallResult.error.code, "validation_error");
+    assert.ok(
+      recallResult.error.details.some(
+        (detail) => detail.field === "(root)" && /__proto__/.test(detail.message),
+      ),
+      "the details must name the reserved key",
+    );
+  }
+  const observeResult = validateRequest("observe", JSON.parse('{"__proto__":{"namespace":"other"}}'));
+  assert.equal(observeResult.success, false);
+  if (!observeResult.success) {
+    assert.equal(observeResult.error.code, "validation_error");
+    assert.ok(
+      observeResult.error.details.some((detail) => /__proto__/.test(detail.message)),
+      "the details must name the reserved key",
+    );
+  }
+});
+
+test("wire request parse still preserves codingContext null clearing", () => {
+  const result = validateRequest<RecallRequest>("recall", JSON.parse('{"query":"q","codingContext":null}'));
+  assert.ok(result.success, "a codingContext null clear must parse");
+  if (result.success) {
+    assert.ok(Object.hasOwn(result.data, "codingContext"), "codingContext must survive the wire null strip");
+    assert.equal(result.data.codingContext, null);
+  }
+});
+
+test("an explicit null namespace still reaches the handler (transport null-for-absent idiom)", async () => {
+  let capturedNamespace: string | undefined;
+  const memoryResponse: EngramAccessMemoryResponse = { found: true, namespace: "global" };
+  const service = makeService({
+    memoryGet: async (_memoryId, namespace) => {
+      capturedNamespace = namespace;
+      return memoryResponse;
+    },
+  });
+  const op = mustBeRegistered("memory_get");
+  await tokenCapabilityStore.run(
+    { version: 1, namespaces: ["global"], ops: ["memory_get"] },
+    () => op.run({ memoryId: "fact-1", namespace: null, sessionKey: null }, { service }),
+  );
+  assert.equal(capturedNamespace, undefined, "an explicit null namespace means absent");
+});

package/src/access-schema.ts

@@ -4,6 +4,7 @@
 
 import { z } from "zod";
 
+import { EngramAccessInputError, rejectReservedArgumentKey } from "./access-errors.js";
 import type { MemoryCategory } from "./types.js";
 import {
   ACTION_CONFIDENCE_CONTEXT_READINESS,
@@ -855,17 +856,42 @@ export function validateRequest<T = unknown>(
       },
     };
   }
-  const result = schema.safeParse(stripNullsExceptCodingContext(body));
-  if (result.success) {
-    return { success: true, data: result.data as T };
+  let parseResult: z.ZodSafeParseResult<unknown>;
+  try {
+    parseResult = schema.safeParse(stripNullsExceptCodingContext(body));
+  } catch (error) {
+    // A reserved argument key (__proto__/constructor/prototype, issue #3225
+    // B1) is an ordinary client input fault: return the same documented
+    // failure shape a failed parse returns instead of throwing past the
+    // callers. Anything else keeps propagating.
+    if (error instanceof EngramAccessInputError) {
+      return {
+        success: false,
+        error: {
+          error: "request validation failed",
+          code: "validation_error",
+          details: [{ field: "(root)", message: error.message }],
+        },
+      };
+    }
+    throw error;
+  }
+  if (parseResult.success) {
+    // SAFETY: T is the type each caller associates with schemaName, and the
+    // schema registered under schemaName is that type's canonical parser.
+    return { success: true, data: parseResult.data as T };
   }
-  return { success: false, error: formatZodError(result.error) };
+  return { success: false, error: formatZodError(parseResult.error) };
 }
 
 function stripNullsExceptCodingContext(data: unknown): unknown {
   if (!data || typeof data !== "object" || Array.isArray(data)) return data;
-  const cleaned: Record<string, unknown> = {};
+  // Object.create(null): a plain {} lets a copied own `__proto__` member
+  // invoke the prototype setter, so an inherited field could reach the wire
+  // schema parse (issue #3225 B1).
+  const cleaned = Object.create(null);
   for (const [key, value] of Object.entries(data as Record<string, unknown>)) {
+    rejectReservedArgumentKey(key);
     if (value === null && key !== "codingContext") continue;
     cleaned[key] = value;
   }

package/src/access-service-capsule-import.test.ts

@@ -0,0 +1,235 @@
+import assert from "node:assert/strict";
+import { mkdir, mkdtemp, readFile, rm, symlink, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test, { type TestContext } from "node:test";
+import { EngramAccessInputError } from "./access-errors.js";
+import { EngramAccessService } from "./access-service.js";
+import { defaultCapsulesDir } from "./capsule-cli.js";
+import { parseConfig } from "./config.js";
+import { NamespaceStorageRouter } from "./namespaces/storage.js";
+import type { Orchestrator } from "./orchestrator.js";
+import { generateSalt } from "./secure-store/cipher.js";
+import { buildHeaderFromPassphrase, writeHeader, secureStoreDir } from "./secure-store/header.js";
+import * as keyring from "./secure-store/keyring.js";
+import type { ScryptParams } from "./secure-store/kdf.js";
+
+/**
+ * Capsule import source confinement (issue #3225 C1): a remote import may
+ * only read an archive that lives inside the destination namespace's capsule
+ * store, the same store `capsule export` writes and `capsule_list` lists.
+ */
+
+const FAST_SCRYPT: ScryptParams = {
+  N: 1 << 10,
+  r: 8,
+  p: 1,
+  keyLength: 32,
+  maxmem: 64 * 1024 * 1024,
+};
+
+const TEST_PASSPHRASE = "capsule-confinement-passphrase";
+
+/** Initialize a secure-store header in `memoryDir` and unlock its keyring. */
+async function initAndUnlockStore(memoryDir: string): Promise<void> {
+  const salt = generateSalt();
+  const { header, derivedKey } = buildHeaderFromPassphrase({
+    passphrase: TEST_PASSPHRASE,
+    salt,
+    algorithm: "scrypt",
+    params: FAST_SCRYPT,
+  });
+  await writeHeader(memoryDir, header);
+  const keyCopy = Buffer.from(derivedKey);
+  keyring.unlock(secureStoreDir(memoryDir), keyCopy);
+}
+
+interface Fixture {
+  memoryDir: string;
+  service: EngramAccessService;
+  storageRouter: NamespaceStorageRouter;
+}
+
+/** Real service over real namespace storage; the capsule paths touch only config and getStorage. */
+async function createFixture(t: TestContext): Promise<Fixture> {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-capsule-import-"));
+  t.after(() => rm(memoryDir, { recursive: true, force: true }));
+  const config = parseConfig({
+    memoryDir,
+    namespacesEnabled: true,
+    defaultNamespace: "default",
+    sharedNamespace: "shared",
+    namespacePolicies: [
+      { name: "default", readPrincipals: ["owner"], writePrincipals: ["owner"] },
+      { name: "foreign", readPrincipals: ["owner"], writePrincipals: ["owner"] },
+    ],
+  });
+  const storageRouter = new NamespaceStorageRouter(config);
+  const storage = await storageRouter.storageFor("default");
+  await mkdir(path.join(storage.dir, "facts"), { recursive: true });
+  await writeFile(path.join(storage.dir, "facts", "seeded.md"), "---\nid: fact-seeded\n---\nSeeded fact body.");
+  const dependencies: Pick<Orchestrator, "config" | "getStorage"> = {
+    config,
+    getStorage: (namespace) => storageRouter.storageFor(namespace ?? config.defaultNamespace),
+  };
+  // SAFETY: the capsule paths touch only `config` and `getStorage` (the Pick above); the rest of the Orchestrator is unused here.
+  return { memoryDir, service: new EngramAccessService(dependencies as Orchestrator), storageRouter };
+}
+
+const REFUSAL = /capsule import failed: archivePath must be an existing file inside the namespace capsule store/;
+
+test("capsule import refuses an archive outside the namespace capsule store", async (t) => {
+  const { memoryDir, service } = await createFixture(t);
+  const exported = await service.capsuleExport({ name: "relocation", namespace: "default", principal: "owner" });
+  const outsideArchive = path.join(path.dirname(defaultCapsulesDir(memoryDir)), "outside.capsule.json.gz");
+  await mkdir(path.dirname(outsideArchive), { recursive: true });
+  await writeFile(outsideArchive, await readFile(exported.archivePath));
+  try {
+    await assert.rejects(
+      () => service.capsuleImport({ archivePath: outsideArchive, namespace: "default", principal: "owner" }),
+      REFUSAL,
+    );
+    // A `..` segment that walks out of the store resolves to the same outside file.
+    await assert.rejects(
+      () =>
+        service.capsuleImport({
+          archivePath: path.join(defaultCapsulesDir(memoryDir), "..", "outside.capsule.json.gz"),
+          namespace: "default",
+          principal: "owner",
+        }),
+      REFUSAL,
+    );
+  } finally {
+    await rm(outsideArchive, { force: true });
+  }
+});
+
+test("capsule import refuses an archive in another namespace's capsule store", async (t) => {
+  const { service, storageRouter } = await createFixture(t);
+  const exported = await service.capsuleExport({ name: "cross-principal", namespace: "default", principal: "owner" });
+  const foreignStorage = await storageRouter.storageFor("foreign");
+  const foreignStore = defaultCapsulesDir(foreignStorage.dir);
+  await mkdir(foreignStore, { recursive: true });
+  const foreignArchive = path.join(foreignStore, "cross-principal.capsule.json.gz");
+  await writeFile(foreignArchive, await readFile(exported.archivePath));
+  try {
+    await assert.rejects(
+      () => service.capsuleImport({ archivePath: foreignArchive, namespace: "default", principal: "owner" }),
+      REFUSAL,
+    );
+  } finally {
+    await rm(foreignArchive, { force: true });
+  }
+});
+
+test("capsule import refuses a store symlink that points outside", async (t) => {
+  const { memoryDir, service } = await createFixture(t);
+  const exported = await service.capsuleExport({ name: "symlinked", namespace: "default", principal: "owner" });
+  const outsideArchive = path.join(path.dirname(defaultCapsulesDir(memoryDir)), "outside.capsule.json.gz");
+  await mkdir(path.dirname(outsideArchive), { recursive: true });
+  await writeFile(outsideArchive, await readFile(exported.archivePath));
+  const linkedPath = path.join(defaultCapsulesDir(memoryDir), "linked.capsule.json.gz");
+  await symlink(outsideArchive, linkedPath);
+  try {
+    await assert.rejects(
+      () => service.capsuleImport({ archivePath: linkedPath, namespace: "default", principal: "owner" }),
+      REFUSAL,
+    );
+  } finally {
+    await rm(linkedPath, { force: true });
+    await rm(outsideArchive, { force: true });
+  }
+});
+
+test("capsule import refuses a missing namespace capsule store", async (t) => {
+  const { memoryDir, service } = await createFixture(t);
+  const exported = await service.capsuleExport({ name: "nosuchstore", namespace: "default", principal: "owner" });
+  const outsideArchive = path.join(path.dirname(defaultCapsulesDir(memoryDir)), "outside.capsule.json.gz");
+  await mkdir(path.dirname(outsideArchive), { recursive: true });
+  await writeFile(outsideArchive, await readFile(exported.archivePath));
+  await rm(defaultCapsulesDir(memoryDir), { recursive: true, force: true });
+  try {
+    await assert.rejects(
+      () => service.capsuleImport({ archivePath: outsideArchive, namespace: "default", principal: "owner" }),
+      REFUSAL,
+    );
+  } finally {
+    await rm(outsideArchive, { force: true });
+  }
+});
+
+test("capsule import gives the same refusal for every outside path, whatever the path holds", async (t) => {
+  const { memoryDir, service } = await createFixture(t);
+  const outsideDir = path.join(memoryDir, "outside-dir");
+  await mkdir(outsideDir, { recursive: true });
+  const presentFile = path.join(outsideDir, "present.capsule.json.gz");
+  await writeFile(presentFile, "not an archive");
+  const loop = path.join(outsideDir, "loop");
+  await symlink(loop, loop);
+  const candidates = [
+    presentFile,
+    path.join(outsideDir, "absent.capsule.json.gz"),
+    outsideDir,
+    loop,
+    path.join(presentFile, "below-a-file"),
+    `${presentFile}\0suffix`,
+    path.join(os.tmpdir(), "remnic-capsule-import-no-such-dir", "x.capsule.json.gz"),
+  ];
+  const messages = new Set<string>();
+  for (const archivePath of candidates) {
+    await assert.rejects(
+      () => service.capsuleImport({ archivePath, namespace: "default", principal: "owner" }),
+      (err) => {
+        assert.ok(err instanceof EngramAccessInputError);
+        messages.add(err.message);
+        return true;
+      },
+    );
+  }
+  assert.equal(messages.size, 1, `refusal messages differ: ${[...messages].join(" | ")}`);
+  assert.match([...messages][0] ?? "", REFUSAL);
+});
+
+test("export, list, and import of the listed archivePath round-trips a plain archive", async (t) => {
+  const { service, storageRouter } = await createFixture(t);
+  await service.capsuleExport({ name: "roundtrip", namespace: "default", principal: "owner" });
+  const list = await service.capsuleList({ namespace: "default", principal: "owner" });
+  const entry = list.capsules[0];
+  assert.ok(entry, "capsule_list must return the exported archive");
+  const storage = await storageRouter.storageFor("default");
+  // Restore after loss: drop the seeded file so the import must write it back.
+  await rm(path.join(storage.dir, "facts", "seeded.md"), { force: true });
+  const imported = await service.capsuleImport({ archivePath: entry.archivePath, namespace: "default", principal: "owner" });
+  assert.equal(imported.imported.length, 1);
+  assert.equal(imported.skipped.length, 0);
+  const landing = imported.imported[0];
+  assert.ok(landing, "the seeded fact must be reported as imported");
+  const body = await readFile(path.join(storage.dir, landing.targetPath), "utf-8");
+  assert.match(body, /Seeded fact body\./);
+});
+
+test("export, list, and import of the listed archivePath round-trips an encrypted archive", async (t) => {
+  const { memoryDir, service, storageRouter } = await createFixture(t);
+  await initAndUnlockStore(memoryDir);
+  const exported = await service.capsuleExport({
+    name: "encrypted-roundtrip",
+    namespace: "default",
+    principal: "owner",
+    encrypt: true,
+  });
+  assert.match(exported.archivePath, /\.enc$/);
+  const list = await service.capsuleList({ namespace: "default", principal: "owner" });
+  const entry = list.capsules[0];
+  assert.ok(entry, "capsule_list must return the exported encrypted archive");
+  assert.equal(entry.archivePath, exported.archivePath);
+  const storage = await storageRouter.storageFor("default");
+  // Restore after loss: drop the seeded file so the import must write it back.
+  await rm(path.join(storage.dir, "facts", "seeded.md"), { force: true });
+  const imported = await service.capsuleImport({ archivePath: entry.archivePath, namespace: "default", principal: "owner" });
+  assert.equal(imported.imported.length, 1);
+  assert.equal(imported.skipped.length, 0);
+  const landing = imported.imported[0];
+  assert.ok(landing, "the seeded fact must be reported as imported");
+  const body = await readFile(path.join(storage.dir, landing.targetPath), "utf-8");
+  assert.match(body, /Seeded fact body\./);
+});