youmd 0.10.2 → 0.12.0

package/native/safe-open/youmd_safe_open.c

@@ -0,0 +1,224 @@
+#define NAPI_VERSION 8
+#include <node_api.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#ifndef O_CLOEXEC
+#define O_CLOEXEC 0
+#endif
+
+static napi_value fail(napi_env env, const char *reason) {
+  napi_throw_error(env, reason, reason);
+  return NULL;
+}
+
+static const char *errno_reason(int value) {
+  if (value == ELOOP) return "symlink_rejected";
+  if (value == ENOTDIR || value == EINVAL || value == ENAMETOOLONG) return "unsafe_path";
+  if (value == ENOENT || value == ESTALE) return "stale_claim";
+  return "unreadable";
+}
+
+static char *get_string(napi_env env, napi_value value, size_t maximum) {
+  size_t length = 0;
+  if (napi_get_value_string_utf8(env, value, NULL, 0, &length) != napi_ok || length > maximum) {
+    fail(env, "unsafe_path");
+    return NULL;
+  }
+  char *result = malloc(length + 1);
+  if (result == NULL) {
+    fail(env, "unreadable");
+    return NULL;
+  }
+  if (napi_get_value_string_utf8(env, value, result, length + 1, &length) != napi_ok) {
+    free(result);
+    fail(env, "unsafe_path");
+    return NULL;
+  }
+  if (memchr(result, '\0', length) != NULL) {
+    free(result);
+    fail(env, "unsafe_path");
+    return NULL;
+  }
+  result[length] = '\0';
+  return result;
+}
+
+static int get_u64(napi_env env, napi_value value, uint64_t *result) {
+  char *text = get_string(env, value, 32);
+  if (text == NULL) return 0;
+  char *end = NULL;
+  errno = 0;
+  unsigned long long parsed = strtoull(text, &end, 10);
+  int valid = errno == 0 && end != text && *end == '\0';
+  free(text);
+  if (!valid) {
+    fail(env, "unsafe_path");
+    return 0;
+  }
+  *result = (uint64_t)parsed;
+  return 1;
+}
+
+static int invoke_hook(napi_env env, napi_value hook, const char *stage, uint32_t index, const char *segment) {
+  napi_valuetype type;
+  if (hook == NULL || napi_typeof(env, hook, &type) != napi_ok || type != napi_function) return 1;
+  napi_value global, args[3], ignored;
+  if (napi_get_global(env, &global) != napi_ok ||
+      napi_create_string_utf8(env, stage, NAPI_AUTO_LENGTH, &args[0]) != napi_ok ||
+      napi_create_uint32(env, index, &args[1]) != napi_ok ||
+      napi_create_string_utf8(env, segment == NULL ? "" : segment, NAPI_AUTO_LENGTH, &args[2]) != napi_ok) {
+    fail(env, "unreadable");
+    return 0;
+  }
+  return napi_call_function(env, global, hook, 3, args, &ignored) == napi_ok;
+}
+
+static int unchanged(const struct stat *before, const struct stat *after) {
+  return before->st_dev == after->st_dev && before->st_ino == after->st_ino && before->st_size == after->st_size &&
+#if defined(__APPLE__)
+    before->st_mtimespec.tv_sec == after->st_mtimespec.tv_sec && before->st_mtimespec.tv_nsec == after->st_mtimespec.tv_nsec &&
+    before->st_ctimespec.tv_sec == after->st_ctimespec.tv_sec && before->st_ctimespec.tv_nsec == after->st_ctimespec.tv_nsec;
+#else
+    before->st_mtim.tv_sec == after->st_mtim.tv_sec && before->st_mtim.tv_nsec == after->st_mtim.tv_nsec &&
+    before->st_ctim.tv_sec == after->st_ctim.tv_sec && before->st_ctim.tv_nsec == after->st_ctim.tv_nsec;
+#endif
+}
+
+static napi_value safe_read(napi_env env, napi_callback_info info) {
+  size_t argc = 6;
+  napi_value argv[6];
+  if (napi_get_cb_info(env, info, &argc, argv, NULL, NULL) != napi_ok || argc < 5) return fail(env, "unsafe_path");
+
+  char *root = get_string(env, argv[0], PATH_MAX - 1);
+  if (root == NULL) return NULL;
+  char *relative = get_string(env, argv[1], PATH_MAX - 1);
+  if (relative == NULL) { free(root); return NULL; }
+  uint32_t maximum = 0;
+  uint64_t expected_dev = 0, expected_ino = 0;
+  if (napi_get_value_uint32(env, argv[2], &maximum) != napi_ok || maximum == 0 ||
+      !get_u64(env, argv[3], &expected_dev) || !get_u64(env, argv[4], &expected_ino)) {
+    free(root); free(relative); return NULL;
+  }
+  napi_value hook = argc >= 6 ? argv[5] : NULL;
+  size_t root_length = strlen(root);
+  if (root[0] != '/' || (root_length > 1 && root[root_length - 1] == '/') ||
+      relative[0] == '\0' || relative[0] == '/' || relative[strlen(relative) - 1] == '/') {
+    free(root); free(relative); return fail(env, "unsafe_path");
+  }
+
+  /* Anchor at /, then traverse every root component with openat. Opening the
+     absolute root pathname directly would still follow symlinks in parents. */
+  int directory_fd = open("/", O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+  if (directory_fd < 0) {
+    const char *reason = errno_reason(errno); free(root); free(relative); return fail(env, reason);
+  }
+  char *root_cursor = root + 1;
+  uint32_t root_index = 0;
+  while (*root_cursor != '\0') {
+    char *slash = strchr(root_cursor, '/');
+    size_t length = slash == NULL ? strlen(root_cursor) : (size_t)(slash - root_cursor);
+    if (length == 0 || length > NAME_MAX || (length == 1 && root_cursor[0] == '.') ||
+        (length == 2 && root_cursor[0] == '.' && root_cursor[1] == '.')) {
+      close(directory_fd); free(root); free(relative); return fail(env, "unsafe_path");
+    }
+    char segment[NAME_MAX + 1];
+    memcpy(segment, root_cursor, length); segment[length] = '\0';
+    if (!invoke_hook(env, hook, "before_root_directory_open", root_index, segment)) {
+      close(directory_fd); free(root); free(relative); return NULL;
+    }
+    int next_fd = openat(directory_fd, segment, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+    if (next_fd < 0) {
+      const char *reason = errno_reason(errno); close(directory_fd); free(root); free(relative); return fail(env, reason);
+    }
+    close(directory_fd); directory_fd = next_fd;
+    if (!invoke_hook(env, hook, "after_root_directory_open", root_index, segment)) {
+      close(directory_fd); free(root); free(relative); return NULL;
+    }
+    if (slash == NULL) break;
+    root_cursor = slash + 1;
+    root_index += 1;
+  }
+  free(root);
+  struct stat root_stat;
+  if (fstat(directory_fd, &root_stat) != 0 || !S_ISDIR(root_stat.st_mode)) {
+    close(directory_fd); free(relative); return fail(env, "unsafe_path");
+  }
+  if ((uint64_t)root_stat.st_dev != expected_dev || (uint64_t)root_stat.st_ino != expected_ino) {
+    close(directory_fd); free(relative); return fail(env, "stale_claim");
+  }
+  if (!invoke_hook(env, hook, "after_root_open", 0, "")) { close(directory_fd); free(relative); return NULL; }
+
+  char *cursor = relative;
+  uint32_t index = 0;
+  int file_fd = -1;
+  while (*cursor != '\0') {
+    char *slash = strchr(cursor, '/');
+    size_t length = slash == NULL ? strlen(cursor) : (size_t)(slash - cursor);
+    if (length == 0 || length > NAME_MAX || (length == 1 && cursor[0] == '.') ||
+        (length == 2 && cursor[0] == '.' && cursor[1] == '.')) {
+      close(directory_fd); free(relative); return fail(env, "unsafe_path");
+    }
+    char segment[NAME_MAX + 1];
+    memcpy(segment, cursor, length); segment[length] = '\0';
+    int final = slash == NULL;
+    if (!invoke_hook(env, hook, final ? "before_file_open" : "before_directory_open", index, segment)) {
+      close(directory_fd); free(relative); return NULL;
+    }
+    int next_fd = openat(directory_fd, segment, O_RDONLY | O_NOFOLLOW | O_CLOEXEC |
+      (final ? O_NONBLOCK : O_DIRECTORY));
+    if (next_fd < 0) {
+      const char *reason = errno_reason(errno); close(directory_fd); free(relative); return fail(env, reason);
+    }
+    if (final) { file_fd = next_fd; break; }
+    close(directory_fd); directory_fd = next_fd;
+    if (!invoke_hook(env, hook, "after_directory_open", index, segment)) { close(directory_fd); free(relative); return NULL; }
+    cursor = slash + 1; index += 1;
+  }
+  free(relative); close(directory_fd);
+  if (file_fd < 0) return fail(env, "unsafe_path");
+
+  struct stat before;
+  if (fstat(file_fd, &before) != 0 || !S_ISREG(before.st_mode)) { close(file_fd); return fail(env, "unsafe_path"); }
+  if (before.st_size < 0 || (uint64_t)before.st_size > maximum) { close(file_fd); return fail(env, "budget_exceeded"); }
+  size_t size = (size_t)before.st_size;
+  unsigned char *bytes = malloc(size == 0 ? 1 : size);
+  if (bytes == NULL) { close(file_fd); return fail(env, "unreadable"); }
+  size_t offset = 0;
+  while (offset < size) {
+    ssize_t count = pread(file_fd, bytes + offset, size - offset, (off_t)offset);
+    if (count < 0 && errno == EINTR) continue;
+    if (count <= 0) { free(bytes); close(file_fd); return fail(env, "unreadable"); }
+    offset += (size_t)count;
+  }
+  unsigned char extra;
+  ssize_t extra_count;
+  do { extra_count = pread(file_fd, &extra, 1, (off_t)size); } while (extra_count < 0 && errno == EINTR);
+  struct stat after;
+  int stable = fstat(file_fd, &after) == 0 && extra_count == 0 && unchanged(&before, &after);
+  close(file_fd);
+  if (!stable) { free(bytes); return fail(env, "stale_claim"); }
+
+  napi_value result;
+  napi_status status = napi_create_buffer_copy(env, size, bytes, NULL, &result);
+  free(bytes);
+  return status == napi_ok ? result : fail(env, "unreadable");
+}
+
+static napi_value init(napi_env env, napi_value exports) {
+  napi_value function, version;
+  if (napi_create_function(env, "safeRead", NAPI_AUTO_LENGTH, safe_read, NULL, &function) != napi_ok ||
+      napi_set_named_property(env, exports, "safeRead", function) != napi_ok ||
+      napi_create_uint32(env, NAPI_VERSION, &version) != napi_ok ||
+      napi_set_named_property(env, exports, "napiVersion", version) != napi_ok) return NULL;
+  return exports;
+}
+
+NAPI_MODULE(youmd_safe_open, init)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "youmd",
-  "version": "0.10.2",
+  "version": "0.12.0",
   "description": "Identity context protocol for the agent internet — an MCP where the context is you. CLI for the You.md platform.",
   "bin": {
     "you": "dist/you.js",
@@ -10,17 +10,25 @@
   "main": "dist/index.js",
   "files": [
     "dist/**/*",
+    "native/**/*",
     "skills/**/*",
     "examples/**/*",
     "scripts/**/*"
   ],
   "scripts": {
     "build": "tsc",
+    "build:native": "node scripts/build-safe-open.mjs",
     "dev": "ts-node src/index.ts",
     "start": "node dist/index.js",
+    "pretest": "npm run build:native",
     "test": "vitest run",
+    "pretest:brain-content": "npm run build:native",
+    "test:brain-content": "vitest run src/__tests__/brain-content.test.ts src/__tests__/brain-safe-open-native.test.ts",
+    "pretest:brain-content:abi": "npm run build:native",
+    "test:brain-content:abi": "node scripts/smoke-safe-open-node.cjs",
     "test:watch": "vitest",
-    "prepublishOnly": "node scripts/check-version-exists.mjs && npm run build",
+    "prepack": "npm run build:native && npm run build",
+    "prepublishOnly": "node scripts/check-version-exists.mjs && npm run build:native && npm run build",
     "postinstall": "node -e \"try{require('./dist/postinstall.js')}catch(e){if(e&&e.code!=='MODULE_NOT_FOUND')throw e}\""
   },
   "keywords": [
@@ -45,7 +53,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "chalk": "^4.1.2",
     "commander": "^12.1.0",
-    "convex": "1.33.1",
+    "convex": "1.43.0",
     "gray-matter": "^4.0.3",
     "jimp": "^0.22.12",
     "js-yaml": "^4.1.1",

package/scripts/build-safe-open.mjs

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const cliRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const outputDirectory = path.join(cliRoot, "native", "prebuilds", "darwin-universal");
+const output = path.join(outputDirectory, "youmd_safe_open.node");
+const source = path.join(cliRoot, "native", "safe-open", "youmd_safe_open.c");
+
+if (process.platform !== "darwin") {
+  console.error("safe-open: non-darwin build skipped (Linux uses procfd; other runtimes degrade to metadata-only)");
+  process.exit(0);
+}
+
+const includeCandidates = [
+  process.env.NODE_INCLUDE_DIR,
+  process.env.npm_config_nodedir && path.join(process.env.npm_config_nodedir, "include", "node"),
+  path.resolve(path.dirname(process.execPath), "..", "include", "node"),
+  "/opt/homebrew/include/node",
+  "/usr/local/include/node",
+].filter(Boolean);
+const includeDirectory = includeCandidates.find((candidate) => fs.existsSync(path.join(candidate, "node_api.h")));
+if (!includeDirectory) throw new Error("safe-open: node_api.h not found; set NODE_INCLUDE_DIR");
+
+const xcrun = (args) => execFileSync("xcrun", args, { encoding: "utf8" }).trim();
+const clang = xcrun(["--find", "clang"]);
+const sdk = xcrun(["--show-sdk-path"]);
+fs.mkdirSync(outputDirectory, { recursive: true });
+const temporary = `${output}.${process.pid}.tmp`;
+try {
+  execFileSync(clang, [
+    "-std=c11",
+    "-O2",
+    "-Wall",
+    "-Wextra",
+    "-Werror",
+    "-fvisibility=hidden",
+    "-bundle",
+    "-undefined", "dynamic_lookup",
+    "-mmacosx-version-min=10.15",
+    "-isysroot", sdk,
+    "-I", includeDirectory,
+    "-arch", "arm64",
+    "-arch", "x86_64",
+    source,
+    "-o", temporary,
+  ], { stdio: "inherit" });
+  execFileSync("codesign", ["--force", "--sign", "-", temporary], { stdio: "inherit" });
+  fs.renameSync(temporary, output);
+} finally {
+  if (fs.existsSync(temporary)) fs.unlinkSync(temporary);
+}
+
+const lipo = execFileSync("lipo", ["-info", output], { encoding: "utf8" }).trim();
+if (!lipo.includes("x86_64") || !lipo.includes("arm64")) throw new Error(`safe-open: expected universal binary; ${lipo}`);
+const addon = createRequire(import.meta.url)(output);
+if (addon.napiVersion !== 8 || typeof addon.safeRead !== "function") throw new Error("safe-open: invalid Node-API v8 exports");
+// npm pack --json reserves stdout for its JSON document.
+console.error(`safe-open: built ${path.relative(cliRoot, output)} (${lipo})`);

package/scripts/skillstack-sync/com.you.context-sync.plist

@@ -32,7 +32,7 @@
         <key>HOME</key>
         <string>__HOME__</string>
         <key>PATH</key>
-        <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+        <string>__HOME__/.you/bin:__HOME__/.youmd/bin:__HOME__/.youmd/npm-global/bin:__HOME__/.npm-global/bin:/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
     </dict>
 </dict>
 </plist>

package/scripts/skillstack-sync/com.you.identity-sync.plist

@@ -32,7 +32,7 @@
         <key>HOME</key>
         <string>__HOME__</string>
         <key>PATH</key>
-        <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+        <string>__HOME__/.you/bin:__HOME__/.youmd/bin:__HOME__/.youmd/npm-global/bin:__HOME__/.npm-global/bin:/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
     </dict>
 </dict>
 </plist>

package/scripts/skillstack-sync/com.you.orchestrator-watch.plist

@@ -32,7 +32,7 @@
         <key>HOME</key>
         <string>__HOME__</string>
         <key>PATH</key>
-        <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+        <string>__HOME__/.you/bin:__HOME__/.youmd/bin:__HOME__/.youmd/npm-global/bin:__HOME__/.npm-global/bin:/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
     </dict>
 </dict>
 </plist>

package/scripts/skillstack-sync/com.you.realtime-sync.plist

@@ -29,7 +29,13 @@
         <key>HOME</key>
         <string>__HOME__</string>
         <key>PATH</key>
-        <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+        <string>__HOME__/.you/bin:__HOME__/.youmd/bin:__HOME__/.youmd/npm-global/bin:__HOME__/.npm-global/bin:/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+        <!-- Dedicated launchd jobs own these cadences; the realtime worker
+             must not spawn duplicate project/stack sync processes. -->
+        <key>YOUMD_LIVE_SYNC_STACK</key>
+        <string>0</string>
+        <key>YOUMD_LIVE_SYNC_CONTEXT</key>
+        <string>0</string>
     </dict>
 </dict>
 </plist>

package/scripts/skillstack-sync/com.you.skillstack-sync.plist

@@ -32,7 +32,7 @@
         <key>HOME</key>
         <string>__HOME__</string>
         <key>PATH</key>
-        <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+        <string>__HOME__/.you/bin:__HOME__/.youmd/bin:__HOME__/.youmd/npm-global/bin:__HOME__/.npm-global/bin:/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
     </dict>
 </dict>
 </plist>

package/scripts/skillstack-sync/context-sync.sh

@@ -33,8 +33,10 @@
 #   ./context-sync.sh --dry-run    # log intended actions only, write nothing
 #
 # Env overrides:
-#   CONTEXT_REPOS   space-separated list of repo DIRECTORY NAMES under
-#                   ~/Desktop/CODE_2025/ (not full paths)
+#   CONTEXT_ROOTS   space-separated absolute roots to scan. Defaults to the
+#                   standard CODE_YOU, CODE_2025, and CODE_2026 machine roots.
+#   CONTEXT_REPOS   space-separated list of repo DIRECTORY NAMES under each
+#                   context root (not full paths)
 #   GIT_USER_NAME   commit author name  (default: Houston Golden)
 #   GIT_USER_EMAIL  commit author email (default: houston@bamf.ai)
 
@@ -50,7 +52,9 @@ LOG_FILE="${LOG_DIR}/context-sync.log"
 GIT_USER_NAME="${GIT_USER_NAME:-Houston Golden}"
 GIT_USER_EMAIL="${GIT_USER_EMAIL:-houston@bamf.ai}"
 
-CODE_ROOT="${HOME}/Desktop/CODE_2025"
+DEFAULT_CONTEXT_ROOTS="${HOME}/Desktop/CODE_YOU ${HOME}/Desktop/CODE_2025 ${HOME}/Desktop/CODE_2026"
+CONTEXT_ROOTS="${CONTEXT_ROOTS:-${DEFAULT_CONTEXT_ROOTS}}"
+CODE_ROOT=""
 
 # Curated list of Houston's OWN repos with rich agent context.
 # These all have houstongolden/* or hubify-projects/* remotes — confirmed safe
@@ -60,7 +64,7 @@ CODE_ROOT="${HOME}/Desktop/CODE_2025"
 #   - disler/*, coffeefuelbump/*, etc.  → not Houston's remote
 #   - repos with no origin              → detected and skipped at runtime
 #   - gstack, agent-shared, scistack    → handled by sync.sh
-DEFAULT_CONTEXT_REPOS="bamfaiapp bigbounce hubify-aios myo hubifycode badapp claws"
+DEFAULT_CONTEXT_REPOS="youmd bamfaiapp bigbounce hubify-aios myo hubifycode badapp claws"
 CONTEXT_REPOS="${CONTEXT_REPOS:-${DEFAULT_CONTEXT_REPOS}}"
 
 # The ONLY paths we will ever stage. Nothing else is touched.
@@ -395,13 +399,21 @@ main() {
 
   log "============================================================"
   log "context-sync START [${mode}] on $(hostname_short)"
+  log "Roots: ${CONTEXT_ROOTS}"
   log "Repos: ${CONTEXT_REPOS}"
   log "Context paths: ${CONTEXT_PATHSPECS}"
   log "============================================================"
 
-  local repo_name
-  for repo_name in ${CONTEXT_REPOS}; do
-    sync_context_repo "${repo_name}" || true
+  local code_root repo_name
+  for code_root in ${CONTEXT_ROOTS}; do
+    if [ ! -d "${code_root}" ]; then
+      log_warn "Skipping context root: directory not found at ${code_root}."
+      continue
+    fi
+    CODE_ROOT="${code_root}"
+    for repo_name in ${CONTEXT_REPOS}; do
+      sync_context_repo "${repo_name}" || true
+    done
   done
 
   log "============================================================"

package/scripts/skillstack-sync/install-daemons-linux.sh

@@ -79,6 +79,12 @@ write_service() {
     printf 'Environment=HOME=%s\n' "${HOME}"
     printf 'Environment=YOU_HOME=%s\n' "${YOU_HOME}"
     printf 'Environment=PATH=%s\n' "${UNIT_PATH}"
+    if [ "${unit}" = "you-realtime-sync.service" ]; then
+      # The interval units below own stack/context sync. Keep the realtime
+      # brain focused on live state, inventory, repair, and remote commands.
+      printf 'Environment=YOUMD_LIVE_SYNC_STACK=0\n'
+      printf 'Environment=YOUMD_LIVE_SYNC_CONTEXT=0\n'
+    fi
     # Run via a login shell so PATH is sourced from the user's profile — the CLI shells out to
     # node/git and the claude/codex/cursor harnesses by name, and those may live under nvm/fnm
     # prefixes not in the static Environment=PATH above (mirrors the macOS `/bin/zsh -lc` plists).

package/scripts/smoke-safe-open-node.cjs

@@ -0,0 +1,50 @@
+/* eslint-disable @typescript-eslint/no-require-imports */
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const addon = require(path.resolve(
+  __dirname,
+  "../native/prebuilds/darwin-universal/youmd_safe_open.node",
+));
+
+assert.equal(addon.napiVersion, 8, "expected the ABI-stable Node-API v8 addon");
+assert.equal(typeof addon.safeRead, "function", "safeRead export is missing");
+
+const root = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), "youmd-node-abi-")));
+const outside = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), "youmd-node-abi-outside-")));
+
+try {
+  fs.mkdirSync(path.join(root, "project-context"));
+  fs.writeFileSync(path.join(root, "project-context", "PRD.md"), "verified\n");
+  fs.writeFileSync(path.join(outside, "PRD.md"), "outside\n");
+
+  const stat = fs.lstatSync(root, { bigint: true });
+  const bytes = addon.safeRead(
+    root,
+    "project-context/PRD.md",
+    1024,
+    stat.dev.toString(),
+    stat.ino.toString(),
+  );
+  assert.equal(bytes.toString("utf8"), "verified\n");
+
+  fs.rmSync(path.join(root, "project-context"), { recursive: true });
+  fs.symlinkSync(outside, path.join(root, "project-context"), "dir");
+  assert.throws(
+    () => addon.safeRead(
+      root,
+      "project-context/PRD.md",
+      1024,
+      stat.dev.toString(),
+      stat.ino.toString(),
+    ),
+    /symlink_rejected|unsafe_path/,
+  );
+
+  console.log(`safe-open ABI smoke passed on Node ${process.version}`);
+} finally {
+  fs.rmSync(root, { recursive: true, force: true });
+  fs.rmSync(outside, { recursive: true, force: true });
+}