The `import_into` function in the `agent-memory` system, specifically its vulnerability to directory traversal attacks via crafted export files.

# import_into writes to attacker-controlled paths outside the store root

**Severity:** Critical
**File:** `packages/core/src/agent_memory/core/portability.py:48`

`import_into` builds the target path as `store.root / str(entry[KEY_PATH])` and writes
to it without validating that the result stays within the store root. A crafted export
file with `"path": "../../etc/cron.d/malicious"` escapes the store directory via
`pathlib.Path`'s `..` traversal. `pathlib.Path("store") / "../../etc/x"` resolves to
`/etc/x` on the filesystem.

```python
def import_into(store: Store, payload: dict[str, object]) -> int:
...
for entry in files if isinstance(files, list) else []:
target = store.root / str(entry[KEY_PATH]) # no traversal check
target.parent.mkdir(parents=True, exist_ok=True)
target.write_text(str(entry[KEY_TEXT]), encoding="utf-8")
```

### Why it matters
`mem import` is the documented migration path between stores. An operator who imports
an untrusted export file can have arbitrary files written anywhere the process has
write permission. The fix is to resolve the target and verify `target.resolve().is_relative_to(store.root.resolve())`
before writing.