@aipermission/mcp 0.2.44 → 0.2.47

package/dist/private-file.js

@@ -8,6 +8,7 @@ const execFileAsync = promisify(execFile);
 const staleTemporaryAgeMs = 24 * 60 * 60 * 1000;
 const lockRetryDelayMs = 50;
 const lockRetryLimit = 100;
+const windowsFullControlRights = 2032127;
 
 export async function atomicWritePrivateFile(filePath, contents, options = {}) {
   const destination = path.resolve(filePath);
@@ -73,9 +74,8 @@ export async function assertPrivateFilePermissions(filePath, options = {}) {
     if ((stat.mode & 0o077) !== 0) throw new Error(`permissions are not private; run chmod 600 ${filePath}`);
     return;
   }
-  const sid = await currentWindowsSID(options);
-  const { stdout } = await runWindowsSystemExecutable("icacls", [filePath], options, { encoding: "utf8" });
-  if (!stdout.includes(sid) || !stdout.includes("(F)") || stdout.includes("(I)")) {
+  const [identity, acl] = await Promise.all([currentWindowsIdentity(options), readWindowsACL(filePath, options)]);
+  if (!windowsACLIsPrivate(acl, identity)) {
     throw new Error(`Windows ACL is not restricted to the current user: ${filePath}`);
   }
 }
@@ -272,6 +272,7 @@ async function enforcePrivateFilePermissions(filePath, options) {
     return;
   }
   const sid = await currentWindowsSID(options);
+  await setWindowsOwner(filePath, sid, options);
   await runWindowsSystemExecutable("icacls", [filePath, "/inheritance:r", "/grant:r", `*${sid}:(F)`], options);
 }
 
@@ -285,16 +286,80 @@ async function enforcePrivateDirectoryPermissions(directory, options) {
     return;
   }
   const sid = await currentWindowsSID(options);
+  await setWindowsOwner(directory, sid, options);
   await runWindowsSystemExecutable("icacls", [directory, "/inheritance:r", "/grant:r", `*${sid}:(OI)(CI)(F)`], options);
 }
 
+async function setWindowsOwner(targetPath, sid, options) {
+  await runWindowsSystemExecutable("icacls", [targetPath, "/setowner", `*${sid}`], options);
+}
+
 async function currentWindowsSID(options) {
+  return (await currentWindowsIdentity(options)).sid;
+}
+
+async function currentWindowsIdentity(options) {
   const { stdout } = await runWindowsSystemExecutable("whoami", ["/user", "/fo", "csv", "/nh"], options, {
     encoding: "utf8",
   });
-  const sid = stdout.match(/S-\d-(?:\d+-)+\d+/)?.[0];
-  if (!sid) throw new Error("Could not determine current Windows SID for private config ACL");
-  return sid;
+  const match = stdout.match(/^\s*"((?:[^"]|"")*)"\s*,\s*"(S-\d-(?:\d+-)+\d+)"\s*$/im);
+  if (!match) throw new Error("Could not determine current Windows identity for private config ACL");
+  return { name: match[1].replaceAll('""', '"'), sid: match[2] };
+}
+
+async function readWindowsACL(filePath, options) {
+  const script = [
+    "$ErrorActionPreference = 'Stop'",
+    "$TargetPath = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($env:AIPERMISSION_PRIVATE_FILE_PATH_B64))",
+    "$Acl = [System.IO.File]::GetAccessControl($TargetPath)",
+    "$Rules = @($Acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]) | ForEach-Object {",
+    "[PSCustomObject]@{ identity_sid = $_.IdentityReference.Value; access_type = $_.AccessControlType.ToString(); inherited = [bool]$_.IsInherited; rights = [int64]$_.FileSystemRights }",
+    "})",
+    "[PSCustomObject]@{ owner_sid = $Acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value; protected = [bool]$Acl.AreAccessRulesProtected; rules = $Rules } | ConvertTo-Json -Depth 4 -Compress",
+  ].join("\n");
+  const execute = options.execFile || execFileAsync;
+  const { stdout } = await execute(windowsPowerShellExecutable(options), ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
+    windowsHide: true,
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      AIPERMISSION_PRIVATE_FILE_PATH_B64: Buffer.from(filePath, "utf8").toString("base64"),
+    },
+  });
+  let acl;
+  try {
+    acl = JSON.parse(String(stdout).trim());
+  } catch {
+    throw new Error(`Could not determine Windows owner for private config: ${filePath}`);
+  }
+  if (
+    !acl ||
+    !/^S-\d-(?:\d+-)+\d+$/i.test(acl.owner_sid) ||
+    typeof acl.protected !== "boolean" ||
+    !Array.isArray(acl.rules) ||
+    !acl.rules.every(
+      (rule) =>
+        rule &&
+        /^S-\d-(?:\d+-)+\d+$/i.test(rule.identity_sid) &&
+        ["Allow", "Deny"].includes(rule.access_type) &&
+        typeof rule.inherited === "boolean" &&
+        Number.isSafeInteger(rule.rights),
+    )
+  ) {
+    throw new Error(`Could not determine Windows ACL for private config: ${filePath}`);
+  }
+  return acl;
+}
+
+function windowsACLIsPrivate(acl, identity) {
+  if (!acl.protected || acl.owner_sid.toLowerCase() !== identity.sid.toLowerCase() || acl.rules.length !== 1) return false;
+  const rule = acl.rules[0];
+  return (
+    rule.identity_sid.toLowerCase() === identity.sid.toLowerCase() &&
+    rule.access_type === "Allow" &&
+    !rule.inherited &&
+    rule.rights === windowsFullControlRights
+  );
 }
 
 function runWindowsSystemExecutable(name, args, options, executionOptions = {}) {
@@ -313,6 +378,14 @@ function windowsSystemExecutable(name, options) {
   return path.win32.join(systemRoot, "System32", `${name}.exe`);
 }
 
+function windowsPowerShellExecutable(options) {
+  const systemRoot = options.windowsSystemRoot || process.env.SystemRoot || process.env.windir || "C:\\Windows";
+  if (!path.win32.isAbsolute(systemRoot)) {
+    throw new Error("Windows SystemRoot must be an absolute path for private config ACL setup");
+  }
+  return path.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+}
+
 function operatingSystem(options) {
   return options.platform || process.platform;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aipermission/mcp",
-  "version": "0.2.44",
+  "version": "0.2.47",
   "mcpName": "io.github.aipermission/aipermission-mcp",
   "description": "Local-first MCP bridge for the aipermission gateway.",
   "license": "AGPL-3.0-only",

package/server.json

@@ -3,12 +3,12 @@
   "name": "io.github.aipermission/aipermission-mcp",
   "title": "AIPermission",
   "description": "Local-first MCP bridge for the AIPermission gateway.",
-  "version": "0.2.44",
+  "version": "0.2.47",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@aipermission/mcp",
-      "version": "0.2.44",
+      "version": "0.2.47",
       "transport": {
         "type": "stdio"
       }