relembra 1.0.0-beta.1 → 1.0.0-beta.2

package/README.md

@@ -25,7 +25,7 @@ and storage (an adapter). relembra enforces the rules:
 - **Measured.** An evaluation harness with leak, scope, retrieval and wake-coverage gates, plus
   controls that must fail. Results: [docs/eval/](docs/eval/).
 
-Version: 1.0.0-beta.1, a beta ([changelog](CHANGELOG.md),
+Version: 1.0.0-beta.2, a beta ([changelog](CHANGELOG.md),
 [releases](https://github.com/mneves75/relembra/releases)). Release procedure:
 [docs/RELEASE.md](docs/RELEASE.md).
 Design: [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).
@@ -203,23 +203,36 @@ scope. Outside a repository it is the scope itself. The wake gives each of the t
 its budget and passes the room one leaves unused to the other, so neither can crowd the other
 out. Set `RELEMBRA_SCOPE` to the global scope to change what it holds.
 
-Each [GitHub release](https://github.com/mneves75/relembra/releases) carries the macOS arm64
-binary `relembra-darwin-arm64`, `SHA256SUMS` and the library archive npm serves. Download the
-binary and checksum file, then install them with `install.sh` from a checkout of the same tag:
+Each [GitHub release](https://github.com/mneves75/relembra/releases) carries a native binary
+per platform, `SHA256SUMS` and the library archive npm serves:
+
+| Platform | Binary |
+|---|---|
+| macOS arm64 | `relembra-darwin-arm64` |
+| Linux x64 (glibc) | `relembra-linux-x64` |
+| Linux arm64 (glibc) | `relembra-linux-arm64` |
+| Windows x64 | `relembra-windows-x64.exe` |
+| Windows arm64 | `relembra-windows-arm64.exe` |
+
+On macOS and Linux, download the binary and checksum file, then install them with `install.sh`
+from a checkout of the same tag:
 
 ```sh
-sh install.sh relembra-darwin-arm64 SHA256SUMS  # verifies the checksum, installs to ~/.local/bin
+sh install.sh relembra-linux-x64 SHA256SUMS  # verifies the checksum, installs to ~/.local/bin
 ```
 
+On Windows, check the hash with `Get-FileHash` and copy the binary onto `PATH` as
+`relembra.exe`; the session hook needs Git Bash ([docs/CLI.md](docs/CLI.md#windows)).
+
 Before replacing an installed executable, retain a backup and its hash. Verify installed bytes
 against the release checksum and export metadata from a disposable store
-(`relembra: "1.0.0-beta.1"`); there is no `--version` flag. The [release procedure](docs/RELEASE.md) covers isolated checks and
+(`relembra: "1.0.0-beta.2"`); there is no `--version` flag. The [release procedure](docs/RELEASE.md) covers isolated checks and
 rollback without opening a live memory store. After verification, `relembra init` prints the
 session hook for your agent.
 
-On other platforms, build it from a clone with an AOT-capable Bun using `bun run build:cli`
-(writes `bin/relembra` and `bin/relembra.sha256`) and install that pair the same way. A local Mac
-check does not attest another platform's binary.
+To build it yourself, run `bun run build:cli` from a clone with the pinned Bun
+(`build/bun-toolchain.txt`); it writes `bin/relembra` (`relembra.exe` on Windows) and
+`bin/relembra.sha256`.
 
 Commands, flags, exit codes and the JSON envelope: [docs/CLI.md](docs/CLI.md).
 
@@ -304,9 +317,10 @@ The landing page is `site/`: static files, no build step besides `bun run build:
 the library into `site/assets/relembra.js` so the page's demos run the real code in the browser
 (`test/site.test.ts` fails while that file is stale). Preview it with
 `python3 -m http.server --directory site`, or open `site/index.html` directly.
-`scripts/site/publish.sh` publishes a committed `site/` to the `gh-pages` branch for GitHub Pages
-(`--dry-run` shows the tree without pushing); the explainer video in `site/assets/video/` is
-git-ignored on `main` and ships only there.
+The `pages` workflow (`gh workflow run pages.yml --ref main`) publishes it to GitHub Pages with
+OIDC, no stored token: `scripts/site/assemble.sh <new directory>` builds what ships from the
+commit's `site/` plus the explainer video, which is git-ignored on `main` and kept on the
+`gh-pages` branch, checked against `scripts/site/video.sha256`.
 
 Contributing: [CONTRIBUTING.md](CONTRIBUTING.md). Security reports: [SECURITY.md](SECURITY.md).
 

package/dist/cli/commands.d.ts

@@ -36,5 +36,5 @@ export declare const COMMANDS: readonly CommandSpec[];
 /** Flags every command takes. */
 export declare const GLOBAL_FLAGS: readonly ["--json", "--help"];
 /** The environment the CLI reads, in the order docs/CLI.md lists it. */
-export declare const ENV_VARS: readonly ["RELEMBRA_HOME", "RELEMBRA_SCOPE", "RELEMBRA_GLOBAL_SCOPE", "RELEMBRA_AGENT", "RELEMBRA_HARNESS", "RELEMBRA_MODEL", "BUN_OPTIONS", "BUN_BYTECODE_ORDER_OUT", "PATH", "HOME", "XDG_CONFIG_HOME"];
+export declare const ENV_VARS: readonly ["RELEMBRA_HOME", "RELEMBRA_SCOPE", "RELEMBRA_GLOBAL_SCOPE", "RELEMBRA_AGENT", "RELEMBRA_HARNESS", "RELEMBRA_MODEL", "BUN_OPTIONS", "BUN_BYTECODE_ORDER_OUT", "PATH", "HOME", "XDG_CONFIG_HOME", "SystemRoot"];
 export declare function usageText(): string;

package/dist/cli/commands.js

@@ -99,6 +99,7 @@ export const ENV_VARS = [
     "PATH",
     "HOME",
     "XDG_CONFIG_HOME",
+    "SystemRoot",
 ];
 export function usageText() {
     return [

package/dist/cli/main.js

@@ -21,6 +21,7 @@ import { LATEST_EVENT_FORMAT, } from "../model.js";
 import { importOptmem } from "../optmem.js";
 import { createRelembra } from "../relembra.js";
 import { identityEgress, renderMemory } from "../render.js";
+import { OWNER_MODES } from "../sqlite/database.js";
 import { openSqliteStore } from "../sqlite/index.js";
 import { exportJsonl, importJsonl, MAX_IMPORT_BYTES } from "../transfer.js";
 import { flagValue, hasFlag, intFlag, parseArgs, wantsJson } from "./args.js";
@@ -38,10 +39,10 @@ const MAX_BUDGET = 1_000_000;
 const MAX_AGE_DAYS = 36_500;
 const MAX_SOURCES = 100;
 /** Reads the session's scope and the global one; writes, pins and owns the session's only. */
-function principalFor(scopes, trustCeiling) {
+function principalFor(env, scopes, trustCeiling) {
     const scope = scopes.session;
     return {
-        id: osUser(),
+        id: osUser(env),
         readable: scopes.global === undefined ? [scope] : [scope, scopes.global],
         writable: [scope],
         promotable: [],
@@ -57,8 +58,8 @@ function principalFor(scopes, trustCeiling) {
  * (`denied:above-ceiling`), as it would be without the owner's confirmation. Export needs
  * ownership only, not trust.
  */
-function transferPrincipal(scope) {
-    return principalFor({ session: scope }, "agent");
+function transferPrincipal(env, scope) {
+    return principalFor(env, { session: scope }, "agent");
 }
 function provenanceFrom(context) {
     const { parsed, env } = context;
@@ -189,7 +190,7 @@ function hookCommand() {
  * with harness `mcp` by default. Log lines go to stderr; stdout carries protocol messages only.
  */
 async function serveStdio(env, scopes, store) {
-    const principal = principalFor(scopes, "agent");
+    const principal = principalFor(env, scopes, "agent");
     const egress = identityEgress;
     const relembra = createRelembra({ store, policy: () => principal, egress });
     const pick = (variable, fallback) => variable === undefined || variable === "" ? fallback : variable;
@@ -249,7 +250,7 @@ async function runStoreCommand(context, scopes, store, path) {
     });
     const relembra = createRelembra({
         store,
-        policy: () => principalFor(scopes, ceiling),
+        policy: () => principalFor(context.env, scopes, ceiling),
         ...(maxAgeDays === undefined ? {} : { retention: [{ scope, maxAgeDays }] }),
     });
     switch (name) {
@@ -399,7 +400,7 @@ async function runStoreCommand(context, scopes, store, path) {
         case "check":
             return check(scope, store, path);
         case "export": {
-            const jsonl = await exportJsonl(store, transferPrincipal(scope), { scope });
+            const jsonl = await exportJsonl(store, transferPrincipal(context.env, scope), { scope });
             const [header, ...events] = jsonl
                 .split("\n")
                 .slice(0, -1)
@@ -412,7 +413,7 @@ async function runStoreCommand(context, scopes, store, path) {
                 throw usage("missing-argument", "import takes a file, or --optmem <dir>, not both");
             }
             const report = optmem === undefined
-                ? await importJsonl(store, transferPrincipal(scope), readImportFile(context, first))
+                ? await importJsonl(store, transferPrincipal(context.env, scope), readImportFile(context, first))
                 : await importFromOptmem(context, scope, store, optmem);
             return { data: report, text: reportText(report) };
         }
@@ -453,7 +454,7 @@ async function importFromOptmem(context, scope, store, dir) {
     }
     const log = readRegularFile(join(real, "LOG.txt"), "the OptMem log");
     const { agent, harness, model, host } = provenanceFrom(context);
-    return importOptmem(store, transferPrincipal(scope), {
+    return importOptmem(store, transferPrincipal(context.env, scope), {
         scope,
         store: createHash("sha256").update(real).digest("hex").slice(0, 16),
         log,
@@ -540,7 +541,7 @@ function parseSource(value) {
  */
 async function check(scope, store, path) {
     const homeMode = Number(lstatSync(dirname(path)).mode) & 0o777;
-    if ((homeMode & 0o077) !== 0) {
+    if (OWNER_MODES && (homeMode & 0o077) !== 0) {
         throw new CliError("store-file", "the store's directory grants group or others access", "mode");
     }
     const db = new DatabaseSync(path, { readOnly: true });
@@ -747,7 +748,7 @@ function fail(error, json, write) {
 }
 if (import.meta.main) {
     // Only the variables docs/CLI.md lists are read.
-    const { RELEMBRA_HOME, RELEMBRA_SCOPE, RELEMBRA_GLOBAL_SCOPE, RELEMBRA_AGENT, RELEMBRA_HARNESS, RELEMBRA_MODEL, BUN_OPTIONS, BUN_BYTECODE_ORDER_OUT, PATH, HOME, XDG_CONFIG_HOME, } = process.env;
+    const { RELEMBRA_HOME, RELEMBRA_SCOPE, RELEMBRA_GLOBAL_SCOPE, RELEMBRA_AGENT, RELEMBRA_HARNESS, RELEMBRA_MODEL, BUN_OPTIONS, BUN_BYTECODE_ORDER_OUT, PATH, HOME, XDG_CONFIG_HOME, SystemRoot, } = process.env;
     const env = {
         RELEMBRA_HOME,
         RELEMBRA_SCOPE,
@@ -760,6 +761,7 @@ if (import.meta.main) {
         PATH,
         HOME,
         XDG_CONFIG_HOME,
+        SystemRoot,
     };
     const code = await main(process.argv.slice(2), env, process.cwd(), process.execArgv);
     process.exitCode = code;

package/dist/cli/scope.d.ts

@@ -14,13 +14,15 @@ export interface CliEnv {
     readonly PATH?: string | undefined;
     readonly HOME?: string | undefined;
     readonly XDG_CONFIG_HOME?: string | undefined;
+    /** Windows only: the Windows folder, whose System32 holds whoami.exe; default `C:\Windows`. */
+    readonly SystemRoot?: string | undefined;
 }
 /**
  * The OS user, as `uid-<uid>`. Not the user name: Bun's os.userInfo().username reads $USER and
  * answers "unknown" when it is unset (measured on Bun 1.4.4; Node asks getpwuid), so a hook run
  * without USER would land in a second scope. The uid is the same in every environment.
  */
-export declare function osUser(): string;
+export declare function osUser(env: CliEnv): string;
 /** The store file: RELEMBRA_HOME/relembra.db, RELEMBRA_HOME defaulting to ~/.relembra. */
 export declare function storePath(env: CliEnv, cwd: string): string;
 /** The global scope RELEMBRA_GLOBAL_SCOPE names, checked like RELEMBRA_SCOPE; undefined unset. */

package/dist/cli/scope.js

@@ -2,21 +2,41 @@ import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { accessSync, constants, existsSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { findGuardViolation } from "../guard.js";
 import { MAX_SCOPE_BYTES, utf8Bytes } from "../render.js";
+import { windowsUserSid } from "../sqlite/database.js";
 import { CliError } from "./errors.js";
 /**
  * The OS user, as `uid-<uid>`. Not the user name: Bun's os.userInfo().username reads $USER and
  * answers "unknown" when it is unset (measured on Bun 1.4.4; Node asks getpwuid), so a hook run
  * without USER would land in a second scope. The uid is the same in every environment.
  */
-export function osUser() {
+export function osUser(env) {
+    if (process.platform === "win32")
+        return windowsUser(env.SystemRoot);
     const uid = process.getuid?.();
     if (uid === undefined)
         throw new CliError("no-scope", "this platform has no OS user id");
     return `uid-${uid}`;
 }
+/**
+ * Windows has no uid: the user is `sid-<SID>`, the logon account's security identifier, which,
+ * like a uid, is one per account (`PC\alex` and `CORP\alex` differ) and survives a rename. It
+ * comes from the process token through whoami, never from os.userInfo(): Bun reads that from
+ * %USERNAME% on Windows (seen on the hosted runners), which the hook's `env -i` clears and any
+ * caller can set. An account whoami cannot name is refused, never mapped to a shared scope.
+ * windowsUserSid runs whoami once per process, though the policy builds a principal for every
+ * operation.
+ */
+function windowsUser(systemRoot) {
+    try {
+        return `sid-${windowsUserSid(systemRoot)}`;
+    }
+    catch {
+        throw new CliError("no-scope", "no scope: the OS did not name the user; set RELEMBRA_SCOPE");
+    }
+}
 /** The store file: RELEMBRA_HOME/relembra.db, RELEMBRA_HOME defaulting to ~/.relembra. */
 export function storePath(env, cwd) {
     const home = env.RELEMBRA_HOME;
@@ -46,7 +66,7 @@ export function resolveScope(env, cwd) {
     if (found === undefined)
         return global;
     const hash = createHash("sha256").update(found.key).digest("hex").slice(0, 16);
-    return checkScope(`${osUser()}/${found.name}-${hash}`);
+    return checkScope(`${osUser(env)}/${found.name}-${hash}`);
 }
 /**
  * The scopes the session reads (src/cli/wake.ts): its own (resolveScope) and the global scope
@@ -59,6 +79,9 @@ export function resolveScopes(env, cwd) {
     const global = resolveGlobalScope(env);
     return global === undefined || global === session ? { session } : { session, global };
 }
+const WINDOWS = process.platform === "win32";
+/** Git's file name: Windows runs only files named .exe. */
+const GIT = WINDOWS ? "git.exe" : "git";
 /** Git gets this long to answer each question before the scope is refused. */
 const GIT_TIMEOUT_MS = 2_000;
 /** Characters a path or URL from git may not hold: control characters, a newline among them. */
@@ -82,18 +105,20 @@ function hostGit(env, cwd) {
         if (dirname(dir) === dir)
             break;
     }
-    const inside = (dir) => fences.some((f) => dir === f || dir.startsWith(`${f}/`));
+    // Windows paths ignore case, so a fence compared by bytes would let C:\REPO\bin past C:\repo.
+    const fold = (path) => (WINDOWS ? path.toLowerCase() : path);
+    const inside = (dir) => fences.some((f) => fold(dir) === fold(f) || fold(dir).startsWith(fold(`${f}${sep}`)));
     const entries = (env.PATH ?? "")
-        .split(":")
+        .split(delimiter)
         .filter((entry) => isAbsolute(entry) && !inside(safeRealpath(entry)));
     for (const entry of entries) {
         try {
-            const candidate = realpathSync(join(entry, "git"));
+            const candidate = realpath(join(entry, GIT));
             if (inside(candidate))
                 continue;
             if (statSync(candidate).isFile()) {
                 accessSync(candidate, constants.X_OK);
-                return { git: candidate, path: entries.join(":") };
+                return { git: candidate, path: entries.join(delimiter) };
             }
         }
         catch {
@@ -217,6 +242,10 @@ export function normalizeRemote(url, base) {
         if (port === DEFAULT_PORTS[name])
             port = "";
     }
+    else if (WINDOWS && /^[A-Za-z]:[\\/]/.test(rest)) {
+        // A drive path, which git on Windows reads as local, never as an scp-like host "C".
+        return localKey(rest, base);
+    }
     else {
         // scp-like `[user@]host:path`, as git reads it: a colon before any slash.
         const scp = /^(?:[^@/]+@)?(\[[^\]]*\]|[^/:]+):(.*)$/.exec(rest);
@@ -259,15 +288,28 @@ function filePath(afterScheme) {
     if (UNSUPPORTED.test(path)) {
         throw new CliError("no-scope", "no scope: the origin's file URL decodes to a control character; set RELEMBRA_SCOPE", "unsupported-path");
     }
-    return path;
+    // On Windows a drive path is written /C:/x in the URL; the path is C:/x.
+    return WINDOWS && /^\/[A-Za-z]:\//.test(path) ? path.slice(1) : path;
 }
+/**
+ * The key of a local origin: `file:` and its real path, with forward slashes on Windows too, so
+ * the project name beside the hash is the last folder, never the whole path.
+ */
 function localKey(path, base) {
     const absolute = isAbsolute(path) ? path : resolve(base(), path);
-    return `file:${safeRealpath(absolute).replace(/(?<=.)\/+$/, "")}`;
+    const real = safeRealpath(absolute);
+    return `file:${(WINDOWS ? real.replaceAll("\\", "/") : real).replace(/(?<=.)\/+$/, "")}`;
+}
+/**
+ * The real path. On Windows the native call, which also gives the canonical case and long names,
+ * so one folder reached as C:\Repo and c:\repo is one project and one fence.
+ */
+function realpath(path) {
+    return WINDOWS ? realpathSync.native(path) : realpathSync(path);
 }
 function safeRealpath(path) {
     try {
-        return realpathSync(path);
+        return realpath(path);
     }
     catch {
         return resolve(path);

package/dist/sqlite/database.d.ts

@@ -30,12 +30,46 @@ export declare class StoreUnverifiedError extends Error {
 export declare function isBusy(error: unknown): boolean;
 /** Refuses a busy timeout that would make waits unbounded or meaningless. */
 export declare function checkBusyTimeout(busyTimeoutMs: number): number;
+/** Whether file modes say who may read a file: every platform but Windows. */
+export declare const OWNER_MODES: boolean;
 /**
  * Creates missing directories as 0700 and a missing file as 0600, then checks the files with
  * checkOwnerOnly. A symbolic link at the path is refused before anything is created, so no file
  * appears behind it.
  */
 export declare function createOwnerOnly(path: string): void;
+/**
+ * Windows' System32 folder under `systemRoot` (%SystemRoot%). An empty or relative value falls
+ * back to `C:\Windows`: a relative executable path would be resolved against the working
+ * directory, which may be a repository's.
+ */
+export declare function windowsSystem32(systemRoot: string | undefined): string;
+/**
+ * The logon account's SID, from the process token as whoami prints it. Thrown when none. The
+ * account cannot change while the process runs, so whoami runs once: the CLI's scope and a new
+ * store's ACL both ask.
+ */
+export declare function windowsUserSid(systemRoot: string | undefined): string;
+/**
+ * Windows: makes the current user the folder's owner, then replaces its ACL with full control for
+ * the user, SYSTEM and the Administrators group only, inherited by everything in it. An owner may
+ * always rewrite an ACL, so a folder another account made would otherwise give that account its
+ * access back; `/setowner` fails, and no store is created, unless the user may take ownership.
+ * `/inheritance:r` with the three `/grant:r` then drops what the folder inherited, in one change
+ * that never widens access: another process may already have made the store here (two first
+ * opens at once), and a step that restored the parent's grants, as `/reset` does, would let the
+ * store inherit them for a moment. An explicit grant to anyone else is refused, not dropped: the
+ * ACL is read back and must hold one entry per account in storeFolderAccounts, and no other.
+ * Accounts are named by SID, so no account name or system language is involved. Any failure is
+ * thrown: a store is never created in a folder others may read.
+ */
+export declare function restrictFolderToOwner(dir: string): void;
+/**
+ * The accounts a store folder grants full control: the user, SYSTEM and Administrators, each once.
+ * A process running as LocalSystem is SYSTEM itself, so its folder holds two entries; counting
+ * three would let a foreign grant pass as the third.
+ */
+export declare function storeFolderAccounts(userSid: string): string[];
 /**
  * The store file must exist. It and any -wal or -shm file must be regular files (lstat never
  * follows a symbolic link) that grant group and others nothing. A loose file is refused, never

package/dist/sqlite/database.js

@@ -1,5 +1,6 @@
+import { spawnSync } from "node:child_process";
 import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync } from "node:fs";
-import { dirname } from "node:path";
+import { dirname, win32 } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { pathToFileURL } from "node:url";
 import { StoreBusyError } from "../errors.js";
@@ -52,6 +53,8 @@ export function checkBusyTimeout(busyTimeoutMs) {
     }
     return busyTimeoutMs;
 }
+/** Whether file modes say who may read a file: every platform but Windows. */
+export const OWNER_MODES = process.platform !== "win32";
 /**
  * Creates missing directories as 0700 and a missing file as 0600, then checks the files with
  * checkOwnerOnly. A symbolic link at the path is refused before anything is created, so no file
@@ -61,6 +64,21 @@ export function createOwnerOnly(path) {
     mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
     if (isSymbolicLink(path))
         throw new StoreFileTypeError(path);
+    // Windows ignores the modes: before a new store's first byte, its folder gets an ACL of its own,
+    // so the store and the -wal and -shm files SQLite makes beside it inherit owner-only access.
+    if (!OWNER_MODES && !existsSync(path)) {
+        restrictFolderToOwner(dirname(path));
+        // A sidecar without its store was put there by someone: it keeps its own ACL, and Windows
+        // opens a file by its full path whatever the folder grants, so SQLite would write into a file
+        // another account can read. Checked after the ACL, when no other account can add one. A
+        // sidecar beside a store that exists by now belongs to another process that created the
+        // store first (its folder got the same three grants), so it is no plant.
+        for (const sidecar of [`${path}-wal`, `${path}-shm`, `${path}-journal`]) {
+            if (hasEntry(sidecar) && !hasEntry(path)) {
+                throw new Error(`${sidecar} exists without its store; no store is created beside it`);
+            }
+        }
+    }
     try {
         // O_EXCL never follows a link, so a link made since the check fails here with EEXIST.
         closeSync(openSync(path, "wx", 0o600));
@@ -71,6 +89,89 @@ export function createOwnerOnly(path) {
     }
     checkOwnerOnly(path);
 }
+/**
+ * Windows' System32 folder under `systemRoot` (%SystemRoot%). An empty or relative value falls
+ * back to `C:\Windows`: a relative executable path would be resolved against the working
+ * directory, which may be a repository's.
+ */
+export function windowsSystem32(systemRoot) {
+    const root = systemRoot !== undefined && win32.isAbsolute(systemRoot) && /^[A-Za-z]:/.test(systemRoot)
+        ? systemRoot
+        : "C:\\Windows";
+    return win32.join(root, "System32");
+}
+/** Runs a System32 tool; any failure is thrown with its output. */
+function runSystemTool(systemRoot, exe, args) {
+    const result = spawnSync(win32.join(windowsSystem32(systemRoot), exe), args, {
+        encoding: "utf8",
+        shell: false,
+        windowsHide: true,
+        timeout: 10_000,
+    });
+    if (result.status !== 0) {
+        throw new Error(`${exe} failed (exit ${result.status}): ${result.stderr || result.stdout}`);
+    }
+    return result.stdout;
+}
+let userSid;
+/**
+ * The logon account's SID, from the process token as whoami prints it. Thrown when none. The
+ * account cannot change while the process runs, so whoami runs once: the CLI's scope and a new
+ * store's ACL both ask.
+ */
+export function windowsUserSid(systemRoot) {
+    if (userSid !== undefined)
+        return userSid;
+    // `"HOST\user","S-1-5-21-..."`: the SID is the last quoted field.
+    const printed = runSystemTool(systemRoot, "whoami.exe", ["/user", "/fo", "csv", "/nh"]);
+    const sid = /"(S-1-[0-9-]+)"\s*$/.exec(printed)?.[1];
+    if (sid === undefined)
+        throw new Error("whoami did not print the user's SID");
+    userSid = sid;
+    return sid;
+}
+/**
+ * Windows: makes the current user the folder's owner, then replaces its ACL with full control for
+ * the user, SYSTEM and the Administrators group only, inherited by everything in it. An owner may
+ * always rewrite an ACL, so a folder another account made would otherwise give that account its
+ * access back; `/setowner` fails, and no store is created, unless the user may take ownership.
+ * `/inheritance:r` with the three `/grant:r` then drops what the folder inherited, in one change
+ * that never widens access: another process may already have made the store here (two first
+ * opens at once), and a step that restored the parent's grants, as `/reset` does, would let the
+ * store inherit them for a moment. An explicit grant to anyone else is refused, not dropped: the
+ * ACL is read back and must hold one entry per account in storeFolderAccounts, and no other.
+ * Accounts are named by SID, so no account name or system language is involved. Any failure is
+ * thrown: a store is never created in a folder others may read.
+ */
+export function restrictFolderToOwner(dir) {
+    // icacls follows a junction or symbolic link: the owner and ACL of its target would change.
+    if (lstatSync(dir).isSymbolicLink())
+        throw new Error(`${dir} is a link; no store is created in it`);
+    const systemRoot = process.env["SystemRoot"];
+    const sid = windowsUserSid(systemRoot);
+    const accounts = storeFolderAccounts(sid);
+    runSystemTool(systemRoot, "icacls.exe", [dir, "/setowner", `*${sid}`]);
+    runSystemTool(systemRoot, "icacls.exe", [
+        dir,
+        "/inheritance:r",
+        ...accounts.flatMap((who) => ["/grant:r", `*${who}:(OI)(CI)F`]),
+    ]);
+    // icacls prints one `name:(flags)` entry per line; the path, on the first, holds no `:(`.
+    const entries = runSystemTool(systemRoot, "icacls.exe", [dir])
+        .split(/\r?\n/)
+        .filter((line) => line.includes(":("));
+    if (entries.length !== accounts.length) {
+        throw new Error(`${dir} grants another account access (${entries.length} entries, not ${accounts.length}); no store is created in it: remove those grants or use another folder`);
+    }
+}
+/**
+ * The accounts a store folder grants full control: the user, SYSTEM and Administrators, each once.
+ * A process running as LocalSystem is SYSTEM itself, so its folder holds two entries; counting
+ * three would let a foreign grant pass as the third.
+ */
+export function storeFolderAccounts(userSid) {
+    return [...new Set([userSid, "S-1-5-18", "S-1-5-32-544"])];
+}
 /**
  * The store file must exist. It and any -wal or -shm file must be regular files (lstat never
  * follows a symbolic link) that grant group and others nothing. A loose file is refused, never
@@ -90,9 +191,14 @@ export function checkOwnerOnly(path) {
         }
         if (!stats.isFile())
             throw new StoreFileTypeError(file);
-        const mode = Number(stats.mode) & 0o777;
-        if ((mode & 0o077) !== 0)
-            throw new StoreFileModeError(file, mode);
+        // Windows has no mode bits: Node and Bun report 0o666 for every writable file, whatever its
+        // access control list grants. There the store relies on its folder's ACL, which under the
+        // user profile grants only the user, SYSTEM and Administrators (docs/CLI.md, Windows).
+        if (OWNER_MODES) {
+            const mode = Number(stats.mode) & 0o777;
+            if ((mode & 0o077) !== 0)
+                throw new StoreFileModeError(file, mode);
+        }
     }
 }
 function isSymbolicLink(path) {
@@ -105,6 +211,18 @@ function isSymbolicLink(path) {
         throw error;
     }
 }
+/** Whether a directory entry exists at `path`: a link counts, even one whose target is missing. */
+function hasEntry(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
 /**
  * True for SQLITE_CANTOPEN (14) and SQLITE_READONLY (8), with their extended codes: what a
  * read-only connection answers when only a write-capable one could proceed, for example
@@ -150,6 +268,11 @@ function isTorn(error) {
 function readOnlySchemaVersion(path, busyTimeoutMs) {
     const deadline = Date.now() + busyTimeoutMs;
     for (let delay = 1;; delay = Math.min(delay * 2, 32)) {
+        // A -wal without its -shm: only a writer could rebuild the index, so the version comes from
+        // the image straight away. A read-only connection would refuse it on POSIX, but on Windows it
+        // creates the -shm or answers SQLITE_PROTOCOL.
+        if (existsSync(`${path}-wal`) && !existsSync(`${path}-shm`))
+            return imageSchemaVersion(path);
         const sidecars = existsSync(`${path}-wal`) || existsSync(`${path}-shm`);
         const parameters = sidecars ? "mode=ro&readonly_shm=1" : "mode=ro&immutable=1";
         let db;

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** This relembra's version, as package.json gives it. An export's header carries it. */
-export declare const RELEMBRA_VERSION = "1.0.0-beta.1";
+export declare const RELEMBRA_VERSION = "1.0.0-beta.2";

package/dist/version.js

@@ -1,2 +1,2 @@
 /** This relembra's version, as package.json gives it. An export's header carries it. */
-export const RELEMBRA_VERSION = "1.0.0-beta.1";
+export const RELEMBRA_VERSION = "1.0.0-beta.2";

package/docs/FORMAT.md

@@ -1,6 +1,6 @@
 # relembra storage format
 
-Status: event formats 1 and 2, SQLite schema version 6, Postgres schema version 3. Release 1.0.0-beta.1.
+Status: event formats 1 and 2, SQLite schema version 6, Postgres schema version 3. Release 1.0.0-beta.2.
 
 This document is the contract for what relembra stores. A reader that follows it needs no
 relembra code.
@@ -175,7 +175,7 @@ the events above, so a reader needs only this document.
 |---|---|---|
 | `export` | string | Always `relembra`. What makes the file an export. |
 | `format` | integer | The newest event format of the lines after it: `1` when none is a `promote` line, so a format 1 reader still reads the file, and `2` when one is. |
-| `relembra` | string | The relembra version that wrote the file, such as `1.0.0-beta.1`. Informational: a reader decides by `format` alone. |
+| `relembra` | string | The relembra version that wrote the file, such as `1.0.0-beta.2`. Informational: a reader decides by `format` alone. |
 | `scopes` | array of strings | The scopes exported. Every event's `scope` is one of them. |
 
 ### Events (lines 2 onward)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relembra",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.2",
   "description": "A curated, scoped, bounded, durable, erasable and measured memory for AI agents.",
   "license": "MIT",
   "author": "mneves75",