@bo-agent/sandbox-windows-acl 0.0.1

package/lib/index.js

@@ -0,0 +1,349 @@
+/**
+ * Windows ACL write-restriction sandbox backend for the DeepSeek Harness
+ * sandbox seam. Mirrors the mechanism of github.com/huoyaoyuan/
+ * windows-acl-restrict-poc @ 10e4dfb (the fixed revision): a WRITE_RESTRICTED
+ * token whose restricting SIDs include distinct workspace and temp write
+ * SIDs that this sandbox adds to their owning directories' DACLs — the
+ * intersection check then allows writes exactly where either capability has
+ * a Write ACE, and nowhere else those SIDs are concerned (the check ALSO
+ * inherits the ambient write ACEs of the other restricting SIDs — the
+ * keep-alive group logon SID + Everyone; Authenticated Users, INTERACTIVE,
+ * and LOCAL are absent from both lists — see the seam's dual-list contract
+ * in `packages/sandbox/sandbox-local` and the package README's Modes section
+ * for the complete boundary). The write SID is the per-WORKSPACE identity
+ * ({@link workspaceWriteSid}): deterministic from the canonical workspace
+ * path, so the workspace-root ACE materializes once per workspace per
+ * machine and every later provision hits the exact-ACE skip — the
+ * grant-reuse story the per-session random SID paid a full tree propagation
+ * per session for. Each private temp directory instead receives its own SID,
+ * so sibling sessions sharing a workspace cannot enter one another's temp
+ * trees. Unlike the POC, every API failure throws with the API
+ * name and exact Win32 code; a child is NEVER spawned unrestricted.
+ *
+ * Known boundaries (inherent to restricted tokens, not this port):
+ *  - writes are restricted; reads, network, and process visibility are NOT
+ *    (WRITE_RESTRICTED intersects only write accesses);
+ *  - console isolation is unavailable — children share the host console
+ *    (CREATE_NO_WINDOW / CREATE_NEW_CONSOLE children die with
+ *    STATUS_DLL_INIT_FAILED under the restriction);
+ *  - the private temp directory and every writable directory must be owned by the
+ *    caller (owner-implicit WRITE_DAC);
+ *  - grants are standing ACE mutations on real directories. WORKSPACE grants
+ *    are deliberately never revoked — the ACE is the cross-session reuse
+ *    cache (revoking would force the next session to re-propagate the whole
+ *    tree). TEMP grants are revocable: dispose() removes them so a standing
+ *    inheritable ACE never outlives its session's temp directory. The
+ *    ambient temp root is never granted implicitly. With `manageDacls: false`
+ *    the CALLER owns the DACLs (the sandbox seam's grant reuse):
+ *    init()/dispose() skip grant/revoke entirely and the caller must not
+ *    revoke under live children.
+ * @module @bo-agent/sandbox-windows-acl
+ */
+import { existsSync, statSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { grantWrite, revokeWrite } from "./acl.js";
+import { Win32Error } from "./errors.js";
+import { allocPtrSlot, decodePtr, isNullPtr, throwLastError, win32 } from "./ffi.js";
+import { assertPrivateTempDisjoint } from "./path-boundary.js";
+import { drainPipe, spawnSandboxed, spawnSandboxedInherited, waitForExit } from "./spawn.js";
+import { createRestrictedToken, findLogonSid, makeWellKnownSid, openCurrentProcessToken, setTokenDefaultDaclGrant } from "./token.js";
+import * as abi from "./win32-abi.js";
+export { quoteArg } from "./spawn.js";
+export { AclWriteGrant } from "./grant.js";
+export { assertTempRootOutsideWorkspace } from "./path-boundary.js";
+export { tempWriteSid, workspaceWriteSid } from "./workspace-sid.js";
+export { Win32Error } from "./errors.js";
+/** Free one optional SID while retaining a failure for best-effort sibling cleanup. */
+function freeSidBestEffort(api, sidPtr, label, failures) {
+    if (sidPtr === undefined)
+        return;
+    try {
+        const freed = api.localFree(sidPtr);
+        if (!isNullPtr(freed))
+            throwLastError(api, 'LocalFree', label);
+    }
+    catch (error) {
+        failures.push(error);
+    }
+}
+/**
+ * One write-restricted sandbox instance: token + write-SID grants + spawn.
+ * `init()` is fail-closed — any Win32 failure revokes the revocable (temp)
+ * grants and throws; `dispose()` revokes the temp grants, leaves the
+ * standing workspace ACEs in place (the cross-instance reuse cache), frees
+ * every allocation, and reports every cleanup failure. With
+ * `manageDacls: false` the caller owns the grants (the sandbox seam's grant
+ * reuse): init() applies none and dispose() revokes none.
+ */
+export class AclSandbox {
+    /** Absolute writable directories (constructor-validated). */
+    writableDirs;
+    /** The workspace SID string whose ACEs form the workspace allowlist. */
+    writeSid;
+    /** The private temp directory's write SID (workspace-write with temp only). */
+    tempWriteSid;
+    /** The file-effect mode — the restricted token's restricting-SID list selection. */
+    mode;
+    tempDirOption;
+    manageDacls;
+    tempDirResolved;
+    api;
+    token;
+    writeSidPtr;
+    tempWriteSidPtr;
+    /** The well-known/logon SID allocations init() makes; freed by dispose() alongside the write SIDs. */
+    sidAllocations = [];
+    grantedPaths = [];
+    constructor(options) {
+        this.mode = options.mode;
+        this.manageDacls = options.manageDacls ?? true;
+        this.writableDirs = options.writableDirs.map((directory) => {
+            const absolute = resolve(directory);
+            if (!existsSync(absolute) || !statSync(absolute).isDirectory()) {
+                throw new Error(`AclSandbox writable dir does not exist or is not a directory: ${absolute}`);
+            }
+            return absolute;
+        });
+        this.tempDirOption = options.tempDir;
+        this.writeSid = options.writeSid;
+        this.tempWriteSid = options.tempWriteSid;
+        if (this.mode === 'workspace-write' && this.writeSid === undefined) {
+            throw new Error('AclSandbox workspace-write requires a write SID — derive it from the workspace via workspaceWriteSid()');
+        }
+        if (this.mode === 'workspace-write' && this.tempDirOption === undefined) {
+            throw new Error('AclSandbox workspace-write requires an explicit private temp directory or null');
+        }
+        if (this.mode === 'read-only' && this.tempDirOption !== undefined && this.tempDirOption !== null) {
+            throw new Error('AclSandbox read-only does not accept a temp directory');
+        }
+        if (this.mode === 'read-only' && (this.writeSid !== undefined || this.tempWriteSid !== undefined)) {
+            throw new Error('AclSandbox read-only does not accept write SIDs');
+        }
+        if (this.mode === 'workspace-write' && this.tempDirOption !== null && this.tempWriteSid === undefined) {
+            throw new Error('AclSandbox workspace-write with temp requires a temp write SID — derive it via tempWriteSid()');
+        }
+        if (this.tempDirOption === null && this.tempWriteSid !== undefined) {
+            throw new Error('AclSandbox temp write SID requires a temp directory');
+        }
+        if (this.writeSid !== undefined && this.tempWriteSid === this.writeSid) {
+            throw new Error('AclSandbox workspace and temp write SIDs must be distinct');
+        }
+    }
+    /** Resolved temp directory (available after init; null when temp grants are disabled). */
+    get tempDir() {
+        return this.tempDirResolved;
+    }
+    /** Create the restricted token and apply the capability-SID grants. Idempotent-unsafe: once per instance. */
+    async init() {
+        if (this.api !== undefined)
+            throw new Error('AclSandbox is already initialized');
+        const api = await win32();
+        const currentToken = openCurrentProcessToken(api);
+        let currentTokenOpen = true;
+        let restrictedToken;
+        try {
+            const parseSid = (sid) => {
+                const sidSlot = allocPtrSlot();
+                if (api.convertStringSidToSidW(sid, sidSlot) === 0) {
+                    throwLastError(api, 'ConvertStringSidToSidW', sid);
+                }
+                const parsedSid = decodePtr(sidSlot);
+                if (parsedSid === null)
+                    throw new Win32Error('ConvertStringSidToSidW', api.getLastError(), sid);
+                return parsedSid;
+            };
+            this.writeSidPtr = this.writeSid === undefined ? undefined : parseSid(this.writeSid);
+            this.tempWriteSidPtr = this.tempWriteSid === undefined ? undefined : parseSid(this.tempWriteSid);
+            const tempDir = this.mode === 'read-only' || this.tempDirOption === null ? null : this.tempDirOption;
+            /* v8 ignore next -- constructor validation requires workspace-write to supply
+               an explicit temp directory or null; the other branches normalize to null. */
+            if (tempDir === undefined)
+                throw new Error('AclSandbox workspace-write temp directory was not resolved');
+            if (tempDir !== null) {
+                if (!existsSync(tempDir) || !statSync(tempDir).isDirectory()) {
+                    throw new Error(`AclSandbox temp dir does not exist or is not a directory: ${tempDir}`);
+                }
+                assertPrivateTempDisjoint(this.writableDirs, tempDir);
+            }
+            this.tempDirResolved = tempDir;
+            // manageDacls: false — the caller (the sandbox seam's grant) already
+            // materialized the ACEs; this instance must neither add nor remove any.
+            // When this instance owns the DACLs, writableDir ACEs are STANDING (the
+            // per-workspace reuse cache — dispose() never revokes them, or the next
+            // provision would re-propagate the whole tree) and the temp ACE is
+            // REVOCABLE (dispose() removes it before the private directory is
+            // deleted; the ambient temp root is never granted).
+            if (this.manageDacls) {
+                if (this.writeSidPtr !== undefined) {
+                    for (const path of this.writableDirs) {
+                        grantWrite(api, path, this.writeSidPtr);
+                    }
+                    if (tempDir !== null && this.tempWriteSidPtr !== undefined) {
+                        // Record BEFORE granting: grantWrite can throw after a successful
+                        // apply (a LocalFree failure), and the fail-closed catch must still
+                        // revoke that path (revoking an ungranted path is a no-op merge).
+                        this.grantedPaths.push({ path: tempDir, sidPtr: this.tempWriteSidPtr });
+                        grantWrite(api, tempDir, this.tempWriteSidPtr);
+                    }
+                }
+            }
+            const logonSid = findLogonSid(api, currentToken);
+            this.sidAllocations.push(logonSid);
+            const worldSid = makeWellKnownSid(api, abi.WinWorldSid);
+            this.sidAllocations.push(worldSid);
+            const writeSids = [this.writeSidPtr, this.tempWriteSidPtr].filter((sid) => sid !== undefined);
+            restrictedToken = createRestrictedToken(api, currentToken, logonSid, writeSids, { world: worldSid }, this.mode);
+            this.token = restrictedToken;
+            // The restricted token's default DACL still names only the user's
+            // ambient SIDs — none of the restricting SIDs. Every NEW object the
+            // confined process creates (anonymous stdio pipes, sync objects) takes
+            // its DACL from that default, so the write pass-2 check would deny
+            // pipe creation (ERROR_ACCESS_DENIED; Node EPERM) and break every
+            // piped-stdio grandchild spawn. Merge a full-access ACE for a
+            // restricting SID (the PRIVATE temp SID when present, otherwise the
+            // workspace SID, or Everyone under read-only): new-object creation
+            // stays gated by the parent object's DACL, while the new object's own
+            // DACL passes pass-2. Choosing the temp SID prevents default-DACL
+            // objects in one session's temp tree from acquiring the shared
+            // workspace capability.
+            setTokenDefaultDaclGrant(api, restrictedToken, this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid);
+            if (api.closeHandle(currentToken) === 0)
+                throwLastError(api, 'CloseHandle', 'current process token');
+            currentTokenOpen = false;
+            this.api = api;
+        }
+        catch (error) {
+            // Fail-closed cleanup: never leave a revocable (temp) grant or SID
+            // allocation behind a failed init. Standing workspace ACEs are NOT
+            // revoked — they are the intended end state (the reuse cache), not an
+            // error artifact.
+            const cleanupFailures = [];
+            if (currentTokenOpen && api.closeHandle(currentToken) === 0) {
+                cleanupFailures.push(new Win32Error('CloseHandle', api.getLastError(), 'current process token after init failure'));
+            }
+            if (restrictedToken !== undefined && api.closeHandle(restrictedToken) === 0) {
+                cleanupFailures.push(new Win32Error('CloseHandle', api.getLastError(), 'restricted token after init failure'));
+            }
+            for (const grant of this.grantedPaths) {
+                try {
+                    revokeWrite(api, grant.path, grant.sidPtr);
+                }
+                catch (cleanupError) {
+                    cleanupFailures.push(cleanupError);
+                }
+            }
+            for (const [label, sidPtr] of [['workspace write SID', this.writeSidPtr], ['temp write SID', this.tempWriteSidPtr]]) {
+                freeSidBestEffort(api, sidPtr, label, cleanupFailures);
+            }
+            for (const sidPtr of this.sidAllocations.splice(0)) {
+                freeSidBestEffort(api, sidPtr, 'init SID allocation', cleanupFailures);
+            }
+            this.token = undefined;
+            this.writeSidPtr = undefined;
+            this.tempWriteSidPtr = undefined;
+            this.tempDirResolved = undefined;
+            this.grantedPaths = [];
+            if (cleanupFailures.length > 0) {
+                throw new AggregateError([error, ...cleanupFailures], `AclSandbox init failed and ${cleanupFailures.length} cleanup operation(s) also failed`);
+            }
+            throw error;
+        }
+    }
+    /**
+     * Spawn a process under the restricted token. Fails closed: throws on every
+     * Win32 failure; the child is never created unrestricted. With
+     * `stdio: 'inherit'` the child shares the caller's stdio directly and is
+     * placed in a kill-on-close job (dies with the caller). Call dispose() only
+     * after all children have exited — revoking grants under a live child
+     * removes its remaining write allowance.
+     * @param options - the program, argv/cwd, and stdio shape.
+     * @returns the running child.
+     */
+    spawn(options) {
+        const api = this.api;
+        const token = this.token;
+        if (api === undefined || token === undefined)
+            throw new Error('AclSandbox is not initialized: call init() first');
+        const args = options.args ?? [];
+        const cwd = options.cwd ?? process.cwd();
+        if (options.stdio === 'inherit') {
+            const native = spawnSandboxedInherited(api, token, { command: options.command, args, cwd });
+            let exitCodePromise;
+            return {
+                pid: native.pid,
+                wait: async () => {
+                    exitCodePromise ??= Promise.resolve(waitForExit(api, native.process));
+                    const exitCode = await exitCodePromise;
+                    if (api.closeHandle(native.job) === 0)
+                        throwLastError(api, 'CloseHandle', 'kill-on-close job');
+                    return { stdout: Buffer.alloc(0), stderr: Buffer.alloc(0), exitCode };
+                },
+            };
+        }
+        const native = spawnSandboxed(api, token, { command: options.command, args, cwd });
+        const stdout = drainPipe(api, native.stdoutRead);
+        const stderr = drainPipe(api, native.stderrRead);
+        // waitForExit is deliberately NOT started here: WaitForSingleObject blocks
+        // the thread and would starve the drains while the child is still running
+        // (pipe-buffer deadlock). The drains resolve only after the child closed
+        // its pipe ends — by then the wait returns immediately.
+        let exitCodePromise;
+        return {
+            pid: native.pid,
+            wait: async () => {
+                const stdoutBuffer = await stdout;
+                const stderrBuffer = await stderr;
+                exitCodePromise ??= Promise.resolve(waitForExit(api, native.process));
+                return { stdout: stdoutBuffer, stderr: stderrBuffer, exitCode: await exitCodePromise };
+            },
+        };
+    }
+    /**
+     * Revoke the revocable (temp) grants, free the SID, close the token; the
+     * standing workspace ACEs stay (the reuse cache). Reports every cleanup
+     * failure.
+     */
+    dispose() {
+        const api = this.api;
+        if (api === undefined)
+            return;
+        const failures = [];
+        if (this.manageDacls) {
+            for (const grant of this.grantedPaths) {
+                try {
+                    revokeWrite(api, grant.path, grant.sidPtr);
+                }
+                catch (error) {
+                    failures.push(error);
+                }
+            }
+        }
+        for (const [label, sidPtr] of [['workspace write SID', this.writeSidPtr], ['temp write SID', this.tempWriteSidPtr]]) {
+            freeSidBestEffort(api, sidPtr, label, failures);
+        }
+        const token = this.token;
+        /* v8 ignore next -- init assigns this.api only after this.token, so an initialized instance always
+           has its token; the guard mirrors the write-SID guard. */
+        if (token !== undefined) {
+            try {
+                if (api.closeHandle(token) === 0)
+                    throwLastError(api, 'CloseHandle', 'restricted token');
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+        for (const sidPtr of this.sidAllocations.splice(0)) {
+            freeSidBestEffort(api, sidPtr, 'init SID allocation', failures);
+        }
+        this.api = undefined;
+        this.token = undefined;
+        this.writeSidPtr = undefined;
+        this.tempWriteSidPtr = undefined;
+        this.grantedPaths = [];
+        if (failures.length > 0) {
+            throw new AggregateError(failures, `AclSandbox dispose completed with ${failures.length} cleanup failure(s)`);
+        }
+    }
+}
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAEpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC5F,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AACrI,OAAO,KAAK,GAAG,MAAM,gBAAgB,CAAA;AAErC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AA4ExC,uFAAuF;AACvF,SAAS,iBAAiB,CACxB,GAAkB,EAClB,MAA6B,EAC7B,KAAa,EACb,QAAmB;IAEnB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAM;IAChC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACnC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,UAAU;IACrB,6DAA6D;IACpD,YAAY,CAAU;IAC/B,wEAAwE;IAC/D,QAAQ,CAAoB;IACrC,+EAA+E;IACtE,YAAY,CAAoB;IACzC,oFAAoF;IAC3E,IAAI,CAAiC;IAC7B,aAAa,CAA2B;IACxC,WAAW,CAAS;IAC7B,eAAe,CAA2B;IAC1C,GAAG,CAA2B;IAC9B,KAAK,CAAuB;IAC5B,WAAW,CAAuB;IAClC,eAAe,CAAuB;IAC9C,sGAAsG;IAC9F,cAAc,GAAgB,EAAE,CAAA;IAChC,YAAY,GAA+C,EAAE,CAAA;IAErE,YAAY,OAA0B;QACpC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAA;QAC9C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;YACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;YACnC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,iEAAiE,QAAQ,EAAE,CAAC,CAAA;YAC9F,CAAC;YACD,OAAO,QAAQ,CAAA;QACjB,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,OAAO,CAAA;QACpC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QAChC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAA;QACxC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAA;QAC3H,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;QACnG,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACjG,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC1E,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtG,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAA;QAClH,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED,6GAA6G;IAC7G,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QAChF,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAA;QACzB,MAAM,YAAY,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,gBAAgB,GAAG,IAAI,CAAA;QAC3B,IAAI,eAAsC,CAAA;QAC1C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAa,EAAE;gBAC1C,MAAM,OAAO,GAAG,YAAY,EAAE,CAAA;gBAC9B,IAAI,GAAG,CAAC,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnD,cAAc,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAA;gBACpD,CAAC;gBACD,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;gBACpC,IAAI,SAAS,KAAK,IAAI;oBAAE,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC/F,OAAO,SAAS,CAAA;YAClB,CAAC,CAAA;YACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpF,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAEhG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAA;YACpG;2FAC+E;YAC/E,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;YACxG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC7D,MAAM,IAAI,KAAK,CAAC,6DAA6D,OAAO,EAAE,CAAC,CAAA;gBACzF,CAAC;gBACD,yBAAyB,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;YACvD,CAAC;YACD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAA;YAE9B,qEAAqE;YACrE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,mEAAmE;YACnE,kEAAkE;YAClE,oDAAoD;YACpD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;oBACnC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;wBACrC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;oBACzC,CAAC;oBACD,IAAI,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;wBAC3D,kEAAkE;wBAClE,oEAAoE;wBACpE,kEAAkE;wBAClE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;wBACvE,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAA;oBAChD,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YAChD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAClC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;YACvD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAClC,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAoB,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAA;YAC/G,eAAe,GAAG,qBAAqB,CACrC,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EACtC,EAAE,KAAK,EAAE,QAAQ,EAAE,EACnB,IAAI,CAAC,IAAI,CACV,CAAA;YACD,IAAI,CAAC,KAAK,GAAG,eAAe,CAAA;YAC5B,kEAAkE;YAClE,oEAAoE;YACpE,uEAAuE;YACvE,mEAAmE;YACnE,kEAAkE;YAClE,8DAA8D;YAC9D,oEAAoE;YACpE,mEAAmE;YACnE,sEAAsE;YACtE,kEAAkE;YAClE,+DAA+D;YAC/D,wBAAwB;YACxB,wBAAwB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,CAAA;YACpG,IAAI,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC;gBAAE,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,uBAAuB,CAAC,CAAA;YACpG,gBAAgB,GAAG,KAAK,CAAA;YACxB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,kBAAkB;YAClB,MAAM,eAAe,GAAc,EAAE,CAAA;YACrC,IAAI,gBAAgB,IAAI,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5D,eAAe,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,0CAA0C,CAAC,CAAC,CAAA;YACrH,CAAC;YACD,IAAI,eAAe,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5E,eAAe,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,qCAAqC,CAAC,CAAC,CAAA;YAChH,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtC,IAAI,CAAC;oBACH,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;gBAC5C,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;gBACpC,CAAC;YACH,CAAC;YACD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAU,EAAE,CAAC;gBAC7H,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,CAAA;YACxD,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,qBAAqB,EAAE,eAAe,CAAC,CAAA;YACxE,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;YACtB,IAAI,CAAC,WAAW,GAAG,SAAS,CAAA;YAC5B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAA;YAChC,IAAI,CAAC,eAAe,GAAG,SAAS,CAAA;YAChC,IAAI,CAAC,YAAY,GAAG,EAAE,CAAA;YACtB,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,GAAG,eAAe,CAAC,EAC3B,8BAA8B,eAAe,CAAC,MAAM,mCAAmC,CACxF,CAAA;YACH,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAA+B;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QACjH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;QAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;QAExC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;YAC3F,IAAI,eAA4C,CAAA;YAChD,OAAO;gBACL,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,IAAI,EAAE,KAAK,IAAI,EAAE;oBACf,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;oBACrE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAA;oBACtC,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;wBAAE,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAA;oBAC9F,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAA;gBACvE,CAAC;aACF,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;QAClF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;QAChD,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,wDAAwD;QACxD,IAAI,eAA4C,CAAA;QAChD,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,MAAM,YAAY,GAAG,MAAM,MAAM,CAAA;gBACjC,MAAM,YAAY,GAAG,MAAM,MAAM,CAAA;gBACjC,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;gBACrE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,EAAE,CAAA;YACxF,CAAC;SACF,CAAA;IACH,CAAC;IAED;;;;OAIG;IACH,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;QACpB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAM;QAC7B,MAAM,QAAQ,GAAc,EAAE,CAAA;QAC9B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtC,IAAI,CAAC;oBACH,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;gBAC5C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAU,EAAE,CAAC;YAC7H,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;QACjD,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB;mEAC2D;QAC3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC;oBAAE,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAA;YAC1F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,SAAS,CAAA;QACpB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;QACtB,IAAI,CAAC,WAAW,GAAG,SAAS,CAAA;QAC5B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAA;QAChC,IAAI,CAAC,YAAY,GAAG,EAAE,CAAA;QACtB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,qCAAqC,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAA;QAC/G,CAAC;IACH,CAAC;CACF"}

package/lib/invariant.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Package-owned invariant companion stub.
+ *
+ * This product does not enforce runtime invariants; the public contract
+ * exposed here is a structural declaration (`name`, `inject`, `apply`)
+ * rather than runtime behavior. The companion slots into a Cordis context
+ * without doing anything, so consumers that wire it up see the same surface
+ * shape regardless of whether invariants are turned on.
+ *
+ * @module @bo-agent/sandbox-windows-acl/invariant
+ */
+export declare const name = "sandbox-windows-acl-invariant";
+export declare const inject: string[];
+export declare const apply: () => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/lib/invariant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invariant.d.ts","sourceRoot":"","sources":["../src/invariant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,eAAO,MAAM,IAAI,kCAAkC,CAAA;AACnD,eAAO,MAAM,MAAM,EAAE,MAAM,EAAO,CAAA;AAClC,eAAO,MAAM,KAAK,QAAa,OAAO,CAAC,MAAM,IAAI,CAAa,CAAA"}

package/lib/invariant.js

@@ -0,0 +1,17 @@
+/**
+ * Package-owned invariant companion stub.
+ *
+ * This product does not enforce runtime invariants; the public contract
+ * exposed here is a structural declaration (`name`, `inject`, `apply`)
+ * rather than runtime behavior. The companion slots into a Cordis context
+ * without doing anything, so consumers that wire it up see the same surface
+ * shape regardless of whether invariants are turned on.
+ *
+ * @module @bo-agent/sandbox-windows-acl/invariant
+ */
+/* eslint-disable @typescript-eslint/no-unused-vars */
+export const name = 'sandbox-windows-acl-invariant';
+export const inject = [];
+export const apply = async () => () => { };
+/* eslint-enable @typescript-eslint/no-unused-vars */
+//# sourceMappingURL=invariant.js.map

package/lib/invariant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invariant.js","sourceRoot":"","sources":["../src/invariant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,sDAAsD;AACtD,MAAM,CAAC,MAAM,IAAI,GAAG,+BAA+B,CAAA;AACnD,MAAM,CAAC,MAAM,MAAM,GAAa,EAAE,CAAA;AAClC,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,IAAyB,EAAE,CAAC,GAAG,EAAE,GAAE,CAAC,CAAA;AAC9D,qDAAqD"}

package/lib/path-boundary.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Canonical directory-boundary checks for the Windows ACL workspace and
+ * private-temp capabilities.
+ * @module @bo-agent/sandbox-windows-acl/path-boundary
+ */
+/**
+ * Reject a temp parent that is inside the workspace: every child created
+ * below it would inherit the standing workspace capability.
+ * @param workspaceRoot - the canonical workspace root that receives the standing ACE.
+ * @param tempRoot - the existing parent beneath which a private temp child would be created.
+ */
+export declare function assertTempRootOutsideWorkspace(workspaceRoot: string, tempRoot: string): void;
+/**
+ * Reject overlap between an actual private temp directory and any writable
+ * directory: either inheritance direction would merge the two capabilities.
+ * @param writableDirs - directories carrying the standing workspace capability.
+ * @param tempDir - the existing directory carrying the revocable temp capability.
+ */
+export declare function assertPrivateTempDisjoint(writableDirs: readonly string[], tempDir: string): void;
+//# sourceMappingURL=path-boundary.d.ts.map

package/lib/path-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-boundary.d.ts","sourceRoot":"","sources":["../src/path-boundary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAI5F;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAMhG"}

package/lib/path-boundary.js

@@ -0,0 +1,37 @@
+/**
+ * Canonical directory-boundary checks for the Windows ACL workspace and
+ * private-temp capabilities.
+ * @module @bo-agent/sandbox-windows-acl/path-boundary
+ */
+import { realpathSync } from 'node:fs';
+import { isAbsolute, relative, sep } from 'node:path';
+/** Whether `root` is the same canonical directory as `candidate` or contains it. */
+function containsDirectory(root, candidate) {
+    const relation = relative(realpathSync.native(root), realpathSync.native(candidate));
+    return relation === '' || (!isAbsolute(relation) && relation !== '..' && !relation.startsWith(`..${sep}`));
+}
+/**
+ * Reject a temp parent that is inside the workspace: every child created
+ * below it would inherit the standing workspace capability.
+ * @param workspaceRoot - the canonical workspace root that receives the standing ACE.
+ * @param tempRoot - the existing parent beneath which a private temp child would be created.
+ */
+export function assertTempRootOutsideWorkspace(workspaceRoot, tempRoot) {
+    if (containsDirectory(workspaceRoot, tempRoot)) {
+        throw new Error(`Windows ACL temp root must be outside the workspace: workspace=${workspaceRoot}; temp=${tempRoot}`);
+    }
+}
+/**
+ * Reject overlap between an actual private temp directory and any writable
+ * directory: either inheritance direction would merge the two capabilities.
+ * @param writableDirs - directories carrying the standing workspace capability.
+ * @param tempDir - the existing directory carrying the revocable temp capability.
+ */
+export function assertPrivateTempDisjoint(writableDirs, tempDir) {
+    for (const writableDir of writableDirs) {
+        if (containsDirectory(writableDir, tempDir) || containsDirectory(tempDir, writableDir)) {
+            throw new Error(`AclSandbox private temp directory must be disjoint from writable directories: writable=${writableDir}; temp=${tempDir}`);
+        }
+    }
+}
+//# sourceMappingURL=path-boundary.js.map

package/lib/path-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-boundary.js","sourceRoot":"","sources":["../src/path-boundary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAErD,oFAAoF;AACpF,SAAS,iBAAiB,CAAC,IAAY,EAAE,SAAiB;IACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;IACpF,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAA;AAC5G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,aAAqB,EAAE,QAAgB;IACpF,IAAI,iBAAiB,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kEAAkE,aAAa,UAAU,QAAQ,EAAE,CAAC,CAAA;IACtH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,YAA+B,EAAE,OAAe;IACxF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,0FAA0F,WAAW,UAAU,OAAO,EAAE,CAAC,CAAA;QAC3I,CAAC;IACH,CAAC;AACH,CAAC"}

package/lib/runner.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The windows-acl confinement runner: the argv-prefix wrapper the sandbox
+ * seam spawns in place of the caller's command. It creates the
+ * WRITE_RESTRICTED token with the workspace write-SID allowlist, spawns the
+ * wrapped argv under it with the CALLER'S stdio inherited (bytes flow
+ * straight through), mirrors the child's exit code, and revokes its temp
+ * grant on exit (workspace ACEs stay standing as the reuse cache).
+ *
+ * Stable argv contract (the seam builds it; a native-exe replacement would
+ * keep the same contract):
+ *   [node, runner.js, '--workspace', <dir>, '--temp', <dir>,
+ *    '--mode', <read-only|workspace-write>,
+ *    ['--write-sid', <S-1-4-…>,
+ *     '--temp-write-sid', <S-1-4-…>], '--', <argv...>]
+ *
+ * Modes:
+ *  - workspace-write: the workspace and temp directories carry distinct
+ *    capability-SID Write grants; other ACL-addressable writes are denied
+ *    except for the documented Everyone and hard-link boundaries.
+ *  - read-only: no capability-SID grants; the restricting list carries no
+ *    capability SID, so a standing grant ACE from an earlier
+ *    workspace-write period stays inert. BOTH modes drop Authenticated Users
+ *    (CIM unavailable — documented in README) and INTERACTIVE/LOCAL (the
+ *    Public tree writes are denied); the two lists share the keep-alive group
+ *    (logon SID, EVERYONE) and differ only by the capabilities.
+ *
+ * `--write-sid` + `--temp-write-sid`: the seam's grant contract — the
+ * CALLER has already materialized distinct workspace and private-temp ACEs
+ * and owns their revocation, so the runner neither grants nor revokes
+ * (`manageDacls: false`). Both values are checked against their owning paths.
+ * Without the pair (standalone/agentless use), workspace-write treats
+ * `--temp` as a ROOT, creates a random private child directory, derives its
+ * own temp SID, and removes that directory after the child exits. In both
+ * flows the runner rewrites TMP/TEMP in its OWN environment to the private
+ * directory before spawning; the child inherits that block (`lpEnvironment`
+ * NULL; an explicit block through koffi trips ERROR_INVALID_PARAMETER in
+ * CreateProcessAsUserW, verified empirically). Read-only leaves the ambient
+ * temp entries untouched (writes there are denied anyway).
+ *
+ * Failure contract: every runner-side failure (bad args, missing
+ * directories, token/grant/spawn errors) prints `windows-acl-run: <detail>`
+ * to stderr and exits 127 — the seam's RUNNER_FAILURE_RULES matches that
+ * signature. The child is NEVER spawned unrestricted.
+ * @module @bo-agent/sandbox-windows-acl/runner
+ */
+export {};
+//# sourceMappingURL=runner.d.ts.map

package/lib/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG"}