@bitkyc08/opencodex 2.7.42 → 2.7.43

package/src/lib/provider-outbound.ts

@@ -0,0 +1,164 @@
+import type { OcxProviderConfig } from "../types";
+import {
+  assessUrlDestination,
+  DestinationDnsResolutionError,
+  providerDestinationConfigError,
+  resolvePublicAddresses,
+} from "./destination-policy";
+import { pinnedHttpGet } from "./pinned-http";
+import { outboundProxyConfigured } from "./proxy-env";
+import { publicProviderBaseUrl } from "./provider-url";
+
+type ProviderGetInit = Omit<RequestInit, "body" | "method" | "redirect">;
+type ProviderOutboundConfig = Pick<OcxProviderConfig, "baseUrl" | "allowPrivateNetwork"> & {
+  fetch?: typeof globalThis.fetch;
+};
+export interface ProviderOutboundDependencies {
+  resolveAddresses?: typeof resolvePublicAddresses;
+  pinnedGet?: typeof pinnedHttpGet;
+}
+
+export class ProviderOutboundPolicyError extends Error {
+  override readonly name = "ProviderOutboundPolicyError";
+}
+
+function pickPinnedAddress(addresses: Array<{ address: string; family: number }>): { address: string; family: number } {
+  return addresses.find(address => address.family === 4) ?? addresses[0]!;
+}
+
+function configuredProxyFor(): boolean {
+  return outboundProxyConfigured();
+}
+
+function normalizeProxyHostname(hostname: string): string {
+  const normalized = hostname.trim().toLowerCase().replace(/\.+$/, "");
+  return normalized.startsWith("[") && normalized.endsWith("]")
+    ? normalized.slice(1, -1)
+    : normalized;
+}
+
+function noProxyMatches(url: URL): boolean {
+  const raw = process.env.NO_PROXY ?? process.env.no_proxy ?? "";
+  const hostname = normalizeProxyHostname(url.hostname);
+  const port = url.port || (url.protocol === "https:" ? "443" : "80");
+  for (const rawEntry of raw.split(",")) {
+    let entry = rawEntry.trim().toLowerCase();
+    if (!entry) continue;
+    if (entry === "*") return true;
+    entry = entry.replace(/^https?:\/\//, "").split("/", 1)[0]!;
+
+    let entryHost = entry;
+    let entryPort = "";
+    const bracketed = /^\[([^\]]+)](?::(\d+))?$/.exec(entry);
+    if (bracketed) {
+      entryHost = bracketed[1]!;
+      entryPort = bracketed[2] ?? "";
+    } else if ((entry.match(/:/g)?.length ?? 0) === 1) {
+      const separator = entry.lastIndexOf(":");
+      const possiblePort = entry.slice(separator + 1);
+      if (/^\d+$/.test(possiblePort)) {
+        entryHost = entry.slice(0, separator);
+        entryPort = possiblePort;
+      }
+    }
+    if (entryPort && entryPort !== port) continue;
+    entryHost = normalizeProxyHostname(entryHost.replace(/^\*?\./, ""));
+    if (!entryHost) continue;
+    if (hostname === entryHost || hostname.endsWith(`.${entryHost}`)) return true;
+  }
+  return false;
+}
+
+let proxyBoundaryWarned = false;
+let proxyDnsDegradationWarned = false;
+
+function warnProxyBoundaryOnce(): void {
+  if (proxyBoundaryWarned) return;
+  proxyBoundaryWarned = true;
+  console.warn(
+    "[opencodex] Provider outbound proxy mode preserves Bun proxy/NO_PROXY routing and validates "
+    + "the URL plus available local DNS results; the final route and peer cannot be pinned locally.",
+  );
+}
+
+function warnProxyDnsDegradationOnce(): void {
+  if (proxyDnsDegradationWarned) return;
+  proxyDnsDegradationWarned = true;
+  console.warn(
+    "[opencodex] Local DNS could not resolve a proxied provider hostname; continuing after URL/literal checks. "
+    + "The proxy-selected peer cannot be verified or pinned locally.",
+  );
+}
+
+export async function providerRedirectError(response: Response, requestUrl: string): Promise<string | null> {
+  if (response.status < 300 || response.status >= 400) return null;
+  try { await response.body?.cancel(); } catch { /* ignore cancellation failures */ }
+  const location = response.headers.get("location");
+  let target = "the final upstream URL";
+  if (location) {
+    try { target = publicProviderBaseUrl(new URL(location, requestUrl).toString()); } catch { /* keep fallback */ }
+  }
+  return `provider returned ${response.status} redirect to ${target}; configure the final provider URL directly`;
+}
+
+export async function providerOutboundGet(
+  name: string,
+  provider: ProviderOutboundConfig,
+  url: string,
+  init: ProviderGetInit = {},
+  dependencies: ProviderOutboundDependencies = {},
+): Promise<Response> {
+  if (provider.fetch) {
+    // A caller-owned executor cannot be peer-pinned here. This branch keeps literal/config
+    // checks and redirect blocking, but does not provide the resolved-address guarantees of
+    // the built-in transport. Main-request migration must define that executor contract first.
+    const assessment = assessUrlDestination(url);
+    if (assessment?.kind === "metadata" || assessment?.kind === "link-local" || assessment?.kind === "unspecified") {
+      throw new ProviderOutboundPolicyError(`provider URL targets ${assessment.detail}`);
+    }
+    if (!provider.allowPrivateNetwork) {
+      const destinationError = providerDestinationConfigError(name, {
+        baseUrl: url,
+        allowPrivateNetwork: false,
+      });
+      if (destinationError) throw new ProviderOutboundPolicyError(destinationError);
+    }
+    return provider.fetch(url, { ...init, method: "GET", redirect: "manual" });
+  }
+  const parsed = new URL(url);
+  const proxyConfigured = configuredProxyFor();
+  const resolveAddresses = dependencies.resolveAddresses ?? resolvePublicAddresses;
+  const pinnedGet = dependencies.pinnedGet ?? pinnedHttpGet;
+  let resolved: Awaited<ReturnType<typeof resolvePublicAddresses>>;
+  try {
+    resolved = await resolveAddresses(url, {
+      context: "provider URL",
+      allowPrivateNetwork: provider.allowPrivateNetwork,
+    });
+  } catch (error) {
+    const dnsResolutionFailed = error instanceof DestinationDnsResolutionError
+      || (error instanceof Error && error.name === "DestinationDnsResolutionError");
+    if (!dnsResolutionFailed) {
+      throw new ProviderOutboundPolicyError(error instanceof Error ? error.message : "provider destination was blocked");
+    }
+    if (!proxyConfigured) throw error;
+    warnProxyBoundaryOnce();
+    warnProxyDnsDegradationOnce();
+    return globalThis.fetch(url, { ...init, method: "GET", redirect: "manual" });
+  }
+  if (proxyConfigured && !resolved.privateNetwork) {
+    warnProxyBoundaryOnce();
+    return globalThis.fetch(url, { ...init, method: "GET", redirect: "manual" });
+  }
+  if (proxyConfigured && resolved.privateNetwork && !noProxyMatches(parsed)) {
+    const hostname = normalizeProxyHostname(parsed.hostname);
+    throw new Error(
+      `provider URL resolves to a private-network destination; add ${hostname} to NO_PROXY before using allowPrivateNetwork with an outbound proxy`,
+    );
+  }
+  return pinnedGet(url, pickPinnedAddress(resolved.addresses), init.signal ?? undefined, {
+    headers: init.headers,
+    rejectUnauthorized: true,
+    context: "provider response",
+  });
+}

package/src/lib/provider-url.ts

@@ -0,0 +1,14 @@
+/** Strip credentials and non-routing URL components before displaying a provider URL. */
+export function publicProviderBaseUrl(baseUrl: string): string {
+  try {
+    const parsed = new URL(baseUrl.trim());
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return "(invalid URL)";
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString().replace(/\/$/, baseUrl.endsWith("/") ? "/" : "");
+  } catch {
+    return "(invalid URL)";
+  }
+}

package/src/lib/proxy-env.ts

@@ -0,0 +1,18 @@
+export const OUTBOUND_PROXY_ENV_KEYS = ["HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY"] as const;
+export const PROXY_ENV_KEYS = [...OUTBOUND_PROXY_ENV_KEYS, "NO_PROXY"] as const;
+
+export type ProxyEnvKey = typeof PROXY_ENV_KEYS[number];
+export type ProxyEnvMap = Record<string, string | undefined>;
+
+export function proxyEnvPresent(
+  key: ProxyEnvKey,
+  env: ProxyEnvMap = process.env,
+): boolean {
+  return Boolean(env[key]?.trim() || env[key.toLowerCase()]?.trim());
+}
+
+export function outboundProxyConfigured(
+  env: ProxyEnvMap = process.env,
+): boolean {
+  return OUTBOUND_PROXY_ENV_KEYS.some(key => proxyEnvPresent(key, env));
+}

package/src/lib/windows-elevation.ts

@@ -18,9 +18,13 @@ export function setWindowsElevationSpawnForTests(next: ElevationSpawn | null): v
 
 type GetSystemDirectoryW = (buffer: Pointer, size: number) => number;
 type TrustedSystemDirectoryResolver = () => string;
+type IsUserAnAdmin = () => number;
+type WindowsElevationProbe = () => boolean | null;
 
 let getSystemDirectoryWFn: GetSystemDirectoryW | null | undefined;
 let trustedSystemDirectoryResolverForTests: TrustedSystemDirectoryResolver | null = null;
+let isUserAnAdminFn: (() => boolean) | null | undefined;
+let windowsElevationProbeForTests: WindowsElevationProbe | null = null;
 
 /** Test-only seam to replace GetSystemDirectoryW-backed resolution. */
 export function setTrustedWindowsSystemDirectoryResolverForTests(
@@ -29,6 +33,49 @@ export function setTrustedWindowsSystemDirectoryResolverForTests(
   trustedSystemDirectoryResolverForTests = next;
 }
 
+/** Test-only seam for the locale-independent current-token elevation probe. */
+export function setWindowsElevationProbeForTests(next: WindowsElevationProbe | null): void {
+  windowsElevationProbeForTests = next;
+}
+
+function loadIsUserAnAdmin(): (() => boolean) | null {
+  if (isUserAnAdminFn !== undefined) return isUserAnAdminFn;
+  if (process.platform !== "win32") {
+    isUserAnAdminFn = null;
+    return null;
+  }
+  try {
+    const lib = dlopen("shell32.dll", {
+      IsUserAnAdmin: {
+        args: [],
+        // Win32 BOOL is a signed 32-bit integer, not C/C++ bool.
+        returns: "i32",
+      },
+    });
+    const isUserAnAdmin = lib.symbols.IsUserAnAdmin as IsUserAnAdmin;
+    isUserAnAdminFn = () => isUserAnAdmin() !== 0;
+  } catch {
+    isUserAnAdminFn = null;
+  }
+  return isUserAnAdminFn;
+}
+
+/**
+ * Probe the effective Windows token without parsing localized command output.
+ * `null` fails closed: callers must retain the original scheduler error rather
+ * than infer that an unknown token state needs elevation.
+ */
+export function isCurrentWindowsProcessElevated(): boolean | null {
+  if (windowsElevationProbeForTests) return windowsElevationProbeForTests();
+  const isUserAnAdmin = loadIsUserAnAdmin();
+  if (!isUserAnAdmin) return null;
+  try {
+    return isUserAnAdmin();
+  } catch {
+    return null;
+  }
+}
+
 function loadGetSystemDirectoryW(): GetSystemDirectoryW | null {
   if (getSystemDirectoryWFn !== undefined) return getSystemDirectoryWFn;
   if (process.platform !== "win32") {
@@ -252,6 +299,34 @@ export function schtasksOperationFromArgs(args: string[]): WindowsSchtasksOperat
   return "other";
 }
 
+function schedulerExitStatus(error: unknown): number | null {
+  if (!error || typeof error !== "object") return null;
+  const status = (error as { status?: unknown }).status;
+  return typeof status === "number" && Number.isInteger(status) ? status : null;
+}
+
+/**
+ * The owned scheduler install has a fixed shape. Restrict the locale-independent
+ * fallback to that shape so unrelated schtasks failures cannot request elevation.
+ */
+function isOwnedSchedulerCreate(args: string[]): boolean {
+  const normalized = args.map(arg => arg.toLowerCase());
+  const taskIndex = normalized.indexOf("/tn");
+  const xmlIndex = normalized.indexOf("/xml");
+  return normalized[0] === "/create"
+    && normalized[taskIndex + 1] === "opencodex-proxy"
+    && taskIndex > 0
+    && xmlIndex > 0
+    && Boolean(args[xmlIndex + 1])
+    && normalized.includes("/f");
+}
+
+function isWindowsSchtasksAccessDeniedError(error: unknown, args: string[]): boolean {
+  if (!isOwnedSchedulerCreate(args)) return false;
+  return isWindowsAccessDeniedError(error)
+    || (schedulerExitStatus(error) === 1 && isCurrentWindowsProcessElevated() === false);
+}
+
 /** Structured Task Scheduler failure that survives formatting and process boundaries. */
 export class WindowsSchtasksError extends Error {
   readonly code = "WINDOWS_SCHTASKS_ERROR" as const;
@@ -287,7 +362,8 @@ export class WindowsElevationError extends Error {
 /** Replace raw schtasks access-denied output with dashboard-friendly guidance. */
 export function formatWindowsSchtasksError(error: unknown, args: string[]): string {
   const operation = schtasksOperationFromArgs(args);
-  const accessDenied = isWindowsAccessDeniedError(error);
+  const ownedCreateAccessDenied = isWindowsSchtasksAccessDeniedError(error, args);
+  const accessDenied = ownedCreateAccessDenied || isWindowsAccessDeniedError(error);
   if (!accessDenied) {
     return error instanceof Error ? error.message : String(error);
   }
@@ -297,7 +373,7 @@ export function formatWindowsSchtasksError(error: unknown, args: string[]): stri
     `Command: schtasks ${argsText}`,
     "Approve the Windows UAC prompt to install the background service, or run `ocx service install` from an elevated PowerShell window.",
   ].join(" ");
-  if (operation === "create") {
+  if (operation === "create" && ownedCreateAccessDenied) {
     return `${guidance}\n${WINDOWS_SCHTASKS_CREATE_ACCESS_DENIED_MARKER}`;
   }
   return guidance;
@@ -306,7 +382,9 @@ export function formatWindowsSchtasksError(error: unknown, args: string[]): stri
 export function toWindowsSchtasksError(error: unknown, args: string[]): WindowsSchtasksError {
   if (error instanceof WindowsSchtasksError) return error;
   const operation = schtasksOperationFromArgs(args);
-  const reason: WindowsSchtasksFailureReason = isWindowsAccessDeniedError(error) ? "access-denied" : "other";
+  const reason: WindowsSchtasksFailureReason = isWindowsSchtasksAccessDeniedError(error, args)
+    ? "access-denied"
+    : "other";
   return new WindowsSchtasksError(operation, reason, formatWindowsSchtasksError(error, args));
 }
 

package/src/lib/windows-secret-acl.ts

@@ -3,9 +3,14 @@
  *
  * On Windows, `chmod` only controls POSIX-style bits in the ACE list and does NOT remove
  * inherited permissions from other users. Real per-user isolation requires icacls to:
- *   1. Disable inheritance   (icacls path /inheritance:r)
- *   2. Strip broad explicit grants by SID (Everyone, Users, Authenticated Users)
- *   3. Grant the current user full control (icacls path /grant:r "CURRENTUSER:(F)")
+ *   1. Grant the current user full control (icacls path /grant:r "CURRENTUSER:(F)")
+ *   2. Disable inheritance               (icacls path /inheritance:r)
+ *   3. Strip broad explicit grants by SID (Everyone, Users, Authenticated Users)
+ *
+ * Owner grant MUST precede `/inheritance:r`. That flag is destructive: it drops inherited
+ * ACEs immediately. If a later step times out after inheritance is removed but before an
+ * explicit owner ACE exists, the temp is left with a protected empty DACL — owned by the
+ * current user yet unreadable/ununlinkable until Full Control is restored (issue #596).
  *
  * On non-Windows platforms the helpers fall through to the caller's existing chmod-based
  * behaviour: they return ok:true without invoking any external process.
@@ -19,6 +24,10 @@
  *     icacls cannot block OAuth logins or token refresh (field report: Kimi auth
  *     stuck behind ETIMEDOUT). Real EPERM/EACCES/exit-code failures still throw:
  *     availability never silently overrides confidentiality for those.
+ *   hardenSecretPathAsync / hardenSecretDirAsync — same policy, async icacls
+ *     runner so the event loop is not held for the child lifetime (#612).
+ *   HardenOptions.timeoutMemoKey — optional destination-path key for the
+ *     timeout memo (atomic writers mint unique temps; never a parent directory).
  *   hardenSecretDir  — same contract for directories.
  */
 
@@ -37,6 +46,13 @@ export interface HardenResult {
 
 export interface HardenOptions {
   required: boolean;
+  /**
+   * Optional timeout-memo key distinct from `targetPath` (issue #612).
+   * Atomic writers mint a fresh `.tmp` path per write; keying the timeout cache by the
+   * final destination path prevents re-stalling the event loop on every subsequent temp.
+   * Must NOT be a parent directory — directory ACLs are not authoritative for new files.
+   */
+  timeoutMemoKey?: string;
 }
 
 /**
@@ -67,6 +83,7 @@ export interface IcaclsResult {
 }
 
 type IcaclsRunner = (args: string[], timeoutMs: number) => IcaclsResult;
+type AsyncIcaclsRunner = (args: string[], timeoutMs: number) => Promise<IcaclsResult>;
 
 function defaultIcaclsRunner(args: string[], timeoutMs: number): IcaclsResult {
   // Bun.spawnSync with windowsHide: Node execFileSync has hung under the GUI/proxy even
@@ -86,7 +103,43 @@ function defaultIcaclsRunner(args: string[], timeoutMs: number): IcaclsResult {
   };
 }
 
+/**
+ * Async icacls runner (#612): yields the event loop while waiting for the child.
+ * Timeout provenance is recorded by our timer (async Subprocess has no exitedDueToTimeout);
+ * we still await process exit before classifying so settlement is confirmed.
+ */
+async function defaultAsyncIcaclsRunner(args: string[], timeoutMs: number): Promise<IcaclsResult> {
+  const proc = Bun.spawn(["icacls.exe", ...args], {
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "ignore",
+    windowsHide: true,
+  });
+  let timedOutByUs = false;
+  const timer = setTimeout(() => {
+    timedOutByUs = true;
+    try { proc.kill(); } catch { /* already exited */ }
+  }, Math.max(1, timeoutMs));
+  let exitCode: number | null = null;
+  try {
+    exitCode = await proc.exited;
+  } finally {
+    clearTimeout(timer);
+  }
+  const stdout = proc.stdout
+    ? await new Response(proc.stdout).text().catch(() => "")
+    : "";
+  const timedOut = timedOutByUs;
+  return {
+    success: !timedOut && exitCode === 0,
+    exitCode: timedOut ? null : exitCode,
+    timedOut,
+    stdout,
+  };
+}
+
 let icaclsRunner: IcaclsRunner = defaultIcaclsRunner;
+let asyncIcaclsRunner: AsyncIcaclsRunner = defaultAsyncIcaclsRunner;
 let platformOverride: string | null = null;
 let nowFn: () => number = Date.now;
 
@@ -95,6 +148,11 @@ export function setIcaclsRunnerForTests(runner: IcaclsRunner | null): void {
   icaclsRunner = runner ?? defaultIcaclsRunner;
 }
 
+/** Test seam: replace the async icacls runner. Pass null to restore the default. */
+export function setAsyncIcaclsRunnerForTests(runner: AsyncIcaclsRunner | null): void {
+  asyncIcaclsRunner = runner ?? defaultAsyncIcaclsRunner;
+}
+
 /** Test seam: force the platform gate (e.g. "win32") so CI on POSIX reaches the runner. */
 export function setPlatformForTests(value: string | null): void {
   platformOverride = value;
@@ -141,8 +199,8 @@ function currentWindowsUser(): string | undefined {
 
 /**
  * Run icacls to harden a single file system entry.
- * - Disables inheritance (keeps nothing: /inheritance:r)
- * - Grants the current user Full Control
+ * Order is intentional (issue #596): grant the owner ACE first so a later
+ * `/inheritance:r` or `/remove:g` timeout cannot strand a protected zero-ACE DACL.
  *
  * We do NOT use a shell string; all arguments are passed as an array so no
  * shell injection is possible even for paths with unusual characters.
@@ -151,6 +209,10 @@ function currentWindowsUser(): string | undefined {
  */
 const BROAD_SIDS = ["*S-1-1-0", "*S-1-5-11", "*S-1-5-32-545"] as const;
 
+function grantAce(user: string, directory: boolean): string {
+  return directory ? `${user}:(OI)(CI)(F)` : `${user}:(F)`;
+}
+
 function runIcacls(targetPath: string, directory: boolean, deadline: number): void {
   const user = currentWindowsUser();
   if (!user) {
@@ -170,13 +232,19 @@ function runIcacls(targetPath: string, directory: boolean, deadline: number): vo
     if (!result.success) throw icaclsError(step, result);
   };
 
-  // Step 1: disable inheritance and remove inherited ACEs
+  // Step 1: grant current user full control BEFORE any destructive ACL change.
+  // If this fails, inheritance is untouched and the writer keeps inherited access.
+  runOrThrow("/grant:r", [targetPath, "/grant:r", grantAce(user, directory)]);
+
+  // Step 2: disable inheritance and remove inherited ACEs. The explicit owner ACE
+  // from step 1 survives this transition, so a later failure still leaves cleanup access.
   runOrThrow("/inheritance:r", [targetPath, "/inheritance:r"]);
 
-  // Step 2: remove broad explicit grants using stable SIDs (not localized names).
+  // Step 3: remove broad explicit grants using stable SIDs (not localized names).
   // Missing ACEs can yield a non-zero exit; verify with locale-independent /findsid
   // before accepting the failure as harmless — a swallowed real failure would leave
   // Everyone/Users/Authenticated Users grants while reporting hardened.
+  // `/remove:g` cannot remove the explicit current-user ACE installed in step 1.
   const removal = run("/remove:g", [targetPath, "/remove:g", ...BROAD_SIDS]);
   if (!removal.success) {
     if (removal.timedOut) throw icaclsError("/remove:g", removal);
@@ -191,10 +259,41 @@ function runIcacls(targetPath: string, directory: boolean, deadline: number): vo
       }
     }
   }
+}
+
+/** Async counterpart of runIcacls — same step order and timeout/error classification (#612). */
+async function runIcaclsAsync(targetPath: string, directory: boolean, deadline: number): Promise<void> {
+  const user = currentWindowsUser();
+  if (!user) {
+    throw new Error("Cannot determine current Windows user for ACL hardening");
+  }
 
-  // Step 3: grant current user full control.
-  const grant = directory ? `${user}:(OI)(CI)(F)` : `${user}:(F)`;
-  runOrThrow("/grant:r", [targetPath, "/grant:r", grant]);
+  const run = async (step: string, args: string[]): Promise<IcaclsResult> => {
+    const remaining = deadline - nowFn();
+    if (remaining <= 0) {
+      throw icaclsError(step, { success: false, exitCode: null, timedOut: true, stdout: "" });
+    }
+    return asyncIcaclsRunner(args, remaining);
+  };
+  const runOrThrow = async (step: string, args: string[]): Promise<void> => {
+    const result = await run(step, args);
+    if (!result.success) throw icaclsError(step, result);
+  };
+
+  await runOrThrow("/grant:r", [targetPath, "/grant:r", grantAce(user, directory)]);
+  await runOrThrow("/inheritance:r", [targetPath, "/inheritance:r"]);
+
+  const removal = await run("/remove:g", [targetPath, "/remove:g", ...BROAD_SIDS]);
+  if (!removal.success) {
+    if (removal.timedOut) throw icaclsError("/remove:g", removal);
+    for (const sid of BROAD_SIDS) {
+      const found = await run("/findsid", [targetPath, "/findsid", sid]);
+      if (!found.success) throw icaclsError("/findsid", found);
+      if (found.stdout.includes(targetPath)) {
+        throw icaclsError("/remove:g", removal);
+      }
+    }
+  }
 }
 
 /**
@@ -246,6 +345,27 @@ function describeAclStateAfterTimeout(targetPath: string, deadline: number): str
   }
 }
 
+async function describeAclStateAfterTimeoutAsync(targetPath: string, deadline: number): Promise<string> {
+  try {
+    for (const sid of BROAD_SIDS) {
+      const remaining = deadline - nowFn();
+      if (remaining <= 0) return "ACL state unverified (budget exhausted)";
+      const found = await asyncIcaclsRunner([targetPath, "/findsid", sid], remaining);
+      if (!found.success) return "ACL state unverified (probe failed)";
+      if (found.stdout.includes(targetPath)) return "broad ACL grants still present";
+    }
+    return "no broad ACL grants detected (hardening still incomplete)";
+  } catch {
+    return "ACL state unverified (probe failed)";
+  }
+}
+
+function timeoutMemoKey(targetPath: string, opts: HardenOptions): string {
+  // Destination-path memo only (issue #612). Never a parent directory — directory ACLs
+  // are not authoritative for newly created temps.
+  return opts.timeoutMemoKey ?? targetPath;
+}
+
 /**
  * Shared harden flow for files and directories: one total budget (env-configurable)
  * covering the initial attempt, ONE timeout retry, and the diagnostic verification.
@@ -261,7 +381,8 @@ function hardenEntry(
   if (!existsSync(targetPath)) return { ok: true };
   if (effectivePlatform() !== "win32") return { ok: true };
   if (cache.has(targetPath)) return { ok: true };
-  if (timedOutPaths.has(targetPath)) {
+  const memoKey = timeoutMemoKey(targetPath, opts);
+  if (timedOutPaths.has(memoKey)) {
     return { ok: false, diagnostics: "ACL hardening skipped — previous attempt timed out" };
   }
 
@@ -281,7 +402,7 @@ function hardenEntry(
 
   const diagnostics = sanitizeDiagnostics(lastErr);
   if (isTimeoutError(lastErr)) {
-    timedOutPaths.add(targetPath);
+    timedOutPaths.add(memoKey);
     const state = describeAclStateAfterTimeout(targetPath, deadline);
     const annotated = `${diagnostics}; ${state}`;
     // Timeout-only soft-fail: a hung icacls must not block OAuth/token writes.
@@ -293,6 +414,47 @@ function hardenEntry(
   return { ok: false, diagnostics };
 }
 
+/** Async counterpart of hardenEntry — yields while waiting on icacls (#612). */
+async function hardenEntryAsync(
+  targetPath: string,
+  directory: boolean,
+  opts: HardenOptions,
+  cache: Set<string>,
+): Promise<HardenResult> {
+  if (!existsSync(targetPath)) return { ok: true };
+  if (effectivePlatform() !== "win32") return { ok: true };
+  if (cache.has(targetPath)) return { ok: true };
+  const memoKey = timeoutMemoKey(targetPath, opts);
+  if (timedOutPaths.has(memoKey)) {
+    return { ok: false, diagnostics: "ACL hardening skipped — previous attempt timed out" };
+  }
+
+  const deadline = nowFn() + resolveHardenDeadlineMs();
+  let lastErr: unknown;
+  for (let attempt = 0; attempt < 2; attempt++) {
+    if (attempt > 0 && deadline - nowFn() <= 0) break;
+    try {
+      await runIcaclsAsync(targetPath, directory, deadline);
+      cache.add(targetPath);
+      return { ok: true };
+    } catch (err) {
+      lastErr = err;
+      if (!isTimeoutError(err)) break;
+    }
+  }
+
+  const diagnostics = sanitizeDiagnostics(lastErr);
+  if (isTimeoutError(lastErr)) {
+    timedOutPaths.add(memoKey);
+    const state = await describeAclStateAfterTimeoutAsync(targetPath, deadline);
+    const annotated = `${diagnostics}; ${state}`;
+    console.warn(`[opencodex] ${annotated} — continuing without NTFS ACL harden`);
+    return { ok: false, diagnostics: annotated };
+  }
+  if (opts.required) throw new Error(diagnostics);
+  return { ok: false, diagnostics };
+}
+
 /**
  * Harden a single file path with per-user NTFS ACLs on Windows.
  * On non-Windows platforms, returns ok:true immediately (caller owns chmod).
@@ -304,6 +466,14 @@ export function hardenSecretPath(targetPath: string, opts: HardenOptions): Harde
   return hardenEntry(targetPath, false, opts, hardenedPaths);
 }
 
+/**
+ * Async harden for write paths that must not block the event loop (#612).
+ * Same success/timeout/error policy as hardenSecretPath.
+ */
+export function hardenSecretPathAsync(targetPath: string, opts: HardenOptions): Promise<HardenResult> {
+  return hardenEntryAsync(targetPath, false, opts, hardenedPaths);
+}
+
 /**
  * Harden a directory path with per-user NTFS ACLs on Windows.
  * On non-Windows platforms, returns ok:true immediately (caller owns chmod).
@@ -314,3 +484,10 @@ export function hardenSecretPath(targetPath: string, opts: HardenOptions): Harde
 export function hardenSecretDir(targetPath: string, opts: HardenOptions): HardenResult {
   return hardenEntry(targetPath, true, opts, hardenedDirectories);
 }
+
+/**
+ * Async directory harden (#612). Same policy as hardenSecretDir.
+ */
+export function hardenSecretDirAsync(targetPath: string, opts: HardenOptions): Promise<HardenResult> {
+  return hardenEntryAsync(targetPath, true, opts, hardenedDirectories);
+}

package/src/lib/winsw.ts

@@ -19,6 +19,7 @@ import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { expandUserPath, getConfigDir, loadConfig } from "../config";
+import { recordOwnedConfigPath } from "./config-ownership";
 import { durableBunPath } from "./bun-runtime";
 import { serviceApiTokenFilePath } from "./service-secrets";
 
@@ -133,6 +134,7 @@ export async function ensureWinswBinary(fetchImpl: typeof fetch = fetch): Promis
     unlinkSync(exe);
     console.warn("⚠️  Existing WinSW binary failed hash verification; re-downloading.");
   }
+  recordOwnedConfigPath(getConfigDir(), winswDir());
   if (!existsSync(winswDir())) mkdirSync(winswDir(), { recursive: true });
   let body: ArrayBuffer;
   try {