@deepseek-ai/dsh-sandbox-windows-acl 0.1.6-alpha.2 → 0.1.7-alpha.2

package/README.i18n.yaml

@@ -1,6 +1,6 @@
 # Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write packages/sandbox/sandbox-windows-acl/README.md
-README.md: 30eaea27b9f8a0ebd1691348c9e6f87706891866
-README.zh.md: eeb65e5db1044eb75e0c13c5f3c76667432dc485
+#   pnpm run verify-translation-pairing --write packages//sandbox//sandbox-windows-acl//README.md
+README.md: 42b2290028c9138e38594ae23ce94fb3f0ebaa85
+README.zh.md: 6a99eec14adf65027f199079f7ae08d94b0636ad

package/README.md

@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-On Windows, this package confines child-process writes to the workspace and a private temporary directory. `workspace-write` grants both locations, while `read-only` grants neither. Mounting `dsh-sandbox-local` selects this behavior automatically for confined bash and PowerShell commands, or callers can use the public `AclSandbox` API directly with captured standard streams. Any failed Win32 operation prevents the child from starting unrestricted. The guarantee is intentionally partial because process startup retains Everyone access and NTFS hard links can expose the same file through another path; callers can detect this limitation through the reported `partial` enforcement level.
+On Windows, this package confines child-process writes and deletes to the workspace and a private temporary directory: `workspace-write` grants both, `read-only` grants neither. Mounting `dsh-sandbox-local` selects this for confined bash and PowerShell commands, or callers use the public `AclSandbox` API directly; any failed Win32 operation prevents an unrestricted spawn. Each grant combines a capability-SID allow ACE, a deny of the ambient parent-directory delete right, and a Low integrity label the lowered token must match, so one granted root cannot reach another. The guarantee stays partial: hard links alias file objects and files ACL'd by another AppContainer tool stay unreadable.
 
 ## Table of Contents
 
@@ -59,15 +59,15 @@ await sandbox.init() // throws on ANY Win32 failure — never spawns unrestricte
 const child = sandbox.spawn({ command: 'pwsh', args: ['-NoProfile', '-Command', '...'], cwd: workspaceRoot })
 const { stdout, stderr, exitCode } = await child.wait()
 
-sandbox.dispose() // revokes the revocable (temp) grant, keeps the standing workspace ACE; reports every cleanup failure
+sandbox.dispose() // revokes the revocable (temp) grant and label, keeps the standing workspace pair
 rmSync(tempDir, { recursive: true, force: true })
 ```
 
-The workspace ACEs are granted standing — `dispose()` leaves them, because they are the cross-instance reuse cache — while the distinct temp SID is granted revocably. The server-side counterpart is the `AclWriteGrant` class: `add(path, standing)` per directory, and `dispose()` revokes the revocable paths and frees the SID.
+The workspace security descriptor edits are granted standing — `dispose()` leaves them, because they are the cross-instance reuse cache — while the distinct temp SID is granted revocably. Each grant is one call carrying the capability-SID allow ACE, the ambient-delete deny, and the Low no-write-up label. The server-side counterpart is the `AclWriteGrant` class: `add(path, standing)` per directory, and `dispose()` revokes the revocable paths and frees the SIDs.
 
 ### What confinement gives you
 
-Under `workspace-write`, the child may write into the workspace and its private temp directory; other ACL-addressable writes are denied except the documented Everyone and hard-link boundaries. Under `read-only`, no explicit write grants exist, so writes are denied with the same documented ambient boundaries.
+Under `workspace-write`, the child may write into the workspace and its private temp directory; other ACL-addressable writes and deletes are denied except the documented hard-link and AppContainer-ACL boundaries. Under `read-only`, no explicit write grants exist, so writes and deletes are denied with the same documented boundaries.
 
 Temp isolation is per live session/workspace pair: sessions sharing a workspace share its write authority but cannot write one another's temp directories. A fresh provider always chooses a new temp path and SID, so crash residue cannot block or authorize a resumed session.
 
@@ -87,11 +87,11 @@ This section explains the restricted-token mechanism, the token lists, the runne
 
 ### Mechanism
 
-The caller's token is duplicated into a `WRITE_RESTRICTED` token whose restricting SIDs carry separate workspace and private-temp capabilities. Windows performs the access check twice — once against the normal SIDs, once against the restricting SIDs — and grants write-class access only where both checks pass. The workspace SID is derived deterministically from the canonical workspace path (`workspaceWriteSid`), so the workspace-root ACE materializes once per workspace per machine and every later session, call, or restart hits the exact-ACE skip. Each live session/workspace pair instead receives a random private temp directory and a SID derived from that path (`tempWriteSid`), so sessions share the intended workspace authority without inheriting one another's temp authority. Every policy-specific Win32 call and every process primitive from [`dsh-win32-process`](../../subprocess/win32-process/README.md) is checked; failures throw `Win32Error` carrying the API name, exact code, system text, and failing context — fail-closed by construction.
+The caller's token is duplicated into a `WRITE_RESTRICTED` token whose restricting SIDs carry separate workspace and private-temp capabilities, and that token is lowered to Low integrity. Windows performs the access check twice — once against the normal SIDs, once against the restricting SIDs — and grants write-class access only where both checks pass; separately, the kernel's mandatory-integrity check denies write-class access to every object that is not labeled Low. The write-SID intersection covers only the object's OWN access check: Windows can also authorize a write or a delete from the parent directory's `FILE_DELETE_CHILD` right, which no restricting SID has to co-sign, so a token holding only the intersection could still delete anything its ambient user SIDs control — including files inside ANOTHER granted root, whose Low label clears the integrity check. Each grant therefore also denies `FILE_DELETE_CHILD` to the world SID, leaving the capability ACE's DELETE bit as the only delete authority inside the granted roots, and labels the same directory Low in the one `SetNamedSecurityInfoW` call that applies all three edits. The workspace SID is derived deterministically from the canonical workspace path (`workspaceWriteSid`), so the workspace-root security descriptor edit materializes once per workspace per machine and every later session, call, or restart hits the exact-ACE/exact-deny/exact-label skip. Each live session/workspace pair instead receives a random private temp directory and a SID derived from that path (`tempWriteSid`), so sessions share the intended workspace authority without inheriting one another's temp authority. Every policy-specific Win32 call and every process primitive from [`dsh-win32-process`](../../subprocess/win32-process/README.md) is checked; failures throw `Win32Error` carrying the API name, exact code, system text, and failing context — fail-closed by construction.
 
 ### Modes and token lists
 
-`workspace-write` (logon SID, Everyone, workspace SID, temp SID) grants the workspace and the session's private temp subdirectory separate Write grants; `read-only` (logon SID, Everyone — no write SID) grants none. The keep-alive group (logon SID + Everyone) is present in both modes: without it, early DLL initialization dies with `0xC0000142` and CNG crashes pwsh with `0xE0434352`. The write SID stays out of the read-only list on purpose: the standing workspace grant from an earlier workspace-write period remains inert because the write-restricted pass-2 check grants only what the restricting list carries, while the standing ACE keeps a re-upgrade free of re-propagation.
+`workspace-write` (logon SID, Everyone, workspace SID, temp SID) grants the workspace and the session's private temp subdirectory separate Write grants; `read-only` (logon SID, Everyone — no write SID) grants none. Both modes spawn a Low-integrity token, and only labeled directories stay writable for it. The keep-alive group (logon SID + Everyone) is present in both modes: without it, early DLL initialization dies with `0xC0000142` and CNG crashes pwsh with `0xE0434352`. The write SID stays out of the read-only list on purpose: the standing workspace grant from an earlier workspace-write period remains inert because the write-restricted pass-2 check grants only what the restricting list carries, while the standing security descriptor edit keeps a re-upgrade free of re-propagation.
 
 NUL writes are ambient, not granted: the device DACL grants Everyone read+write+execute (`0x1201BF`), so openers whose mask fits it (cmd `> NUL`, node `\\.\NUL`) can write it in both modes. `Set-Content NUL` fails in both modes (a PowerShell/.NET-layer effect, not the device DACL), while PowerShell's `> $null` redirection keeps working.
 
@@ -111,15 +111,18 @@ When launched with the subprocess control marker, the runner forwards fd 7 throu
 
 ### Verified boundaries
 
-- **Everyone grants remain ambient write authority** — Everyone must stay in both restricting lists (removing it breaks early DLL initialization and CNG); an external NTFS object whose DACL grants Everyone a requested write right clears both checks and stays writable under both modes.
-- **Hard links are file-object aliases, not path aliases** — an inheritable workspace ACE propagated onto an existing hard link changes the one underlying file security descriptor, so the same object is writable through an external alias; rejecting multiply-linked files is not viable for ordinary pnpm installations.
-- **Writes are restricted; reads, network, and process visibility are not** — `WRITE_RESTRICTED` intersects write accesses only, so a confined child can read any caller-readable file and open sockets; `read-only` therefore needs a read-side policy to be expressed.
+- **Everyone stays in both restricting lists, but no longer confers write authority** — the keep-alive group is required for early DLL initialization and CNG; the Low label now denies an Everyone-granted write outside the labeled roots, so that former gap is closed.
+- **Inside a granted root, the capability ACE's DELETE bit is the only delete authority** — the grant denies `FILE_DELETE_CHILD` to the world SID, which also removes the ambient default: a file whose own DACL grants no DELETE is no longer deletable through its parent's rights, by the confined child or by the user's own processes. The user's ordinary deletes keep working because the workspace DACL grants them DELETE directly.
+- **The deny inherits to subdirectories only, and a FullControl open of one is denied** — `FILE_DELETE_CHILD` is evaluated on directories, so the deny carries `CONTAINER_INHERIT_ACE` and never reaches files (its bit, `0x40`, is part of `FILE_ALL_ACCESS`, so a file-level copy would refuse every `GENERIC_ALL`/`FullControl` open by the user, Administrators, SYSTEM, or the DSH host). Directories inside a granted root keep the deny and therefore refuse those opens; `DELETE`-based deletes, `MAXIMUM_ALLOWED`, and ordinary read/write opens are unaffected, and both outcomes are pinned by the runner suite.
+- **Writes and deletes are restricted; reads, network, and process visibility are not** — neither layer intersects reads, so a confined child can read any caller-readable file (including files in another workspace) and open sockets; `read-only` therefore needs a read-side policy to be expressed.
+- **Hard links are file-object aliases, not path aliases** — an inheritable workspace grant propagated onto an existing hard link labels and grants the one underlying file security descriptor, so the same object is writable through an external alias; rejecting multiply-linked files is not viable for ordinary pnpm installations.
 - **Console isolation is unavailable** — children created with `CREATE_NO_WINDOW` / `CREATE_NEW_CONSOLE` die during DLL initialization with `STATUS_DLL_INIT_FAILED` (`0xC0000142`); children share the host console, and pipe-based stdio redirection is unaffected.
-- **ACL grants are standing directory mutations** — workspace ACEs stand by design (the reuse cache, never revoked); temp ACEs are revoked by `dispose()`; manual `icacls` cleanup cannot revoke them on this platform (`ERROR_NONE_MAPPED`, 1332), so revoke through this module.
-- **Granted directories must be caller-owned** — the owner's implicit `WRITE_DAC` is what lets the sandbox edit the DACL without elevation.
+- **Security descriptor edits are standing directory mutations** — workspace ACEs, denies, and labels stand by design (the reuse cache, never revoked); temp edits are revoked by `dispose()`, except that a revoke keeps the shared label while another capability grant remains on the directory, and the deny it leaves behind disappears with the temp directory itself; manual `icacls` cleanup cannot revoke them on this platform (`ERROR_NONE_MAPPED`, 1332), so revoke through this module.
+- **A standing Low label outlives DSH and widens the tree for other Low-integrity processes** — the workspace's inheritable label survives the session (and same-volume moves), so any other process running at Low integrity as the same user — another product's Low-IL sandbox, a Protected Mode reader — can write and delete inside the workspace, where a Medium label would have denied it. The label is the price of the write boundary: without it the confined child cannot write at all, and revoking it per session would re-propagate the whole tree on every provision.
+- **Granted directories must be caller-owned and grant `WRITE_OWNER`** — the owner's implicit rights cover only `READ_CONTROL` and `WRITE_DAC`; the label lives in the SACL, so the combined apply additionally needs `WRITE_OWNER` (a Full-control directory, the normal workspace case, has it). A directory whose DACL grants only Modify now fails the grant loudly instead of silently skipping the confinement.
 - **The ambient temp root is never granted implicitly** — direct callers must supply an existing private `tempDir` plus its distinct `tempWriteSid`, or disable temp writes with `tempDir: null`; the actual temp directory must be disjoint from every writable root.
 - **The confined child's temp capability is private per live session/workspace pair** — the runner rewrites TMP/TEMP to that private directory before the spawn; two tokens sharing the same workspace SID cannot write one another's temp directories.
-- **`whoami` and token-inspection cmdlets fail under the restricted token** — `GetTokenInformation` on the duplicate is partially unavailable to the child, which is diagnostic noise rather than an operational failure.
+- **`whoami` and token-inspection cmdlets may fail under the restricted token** — `GetTokenInformation` on the duplicate is partially unavailable to the child, so whether a reporting cmdlet works is host-dependent; it is diagnostic noise rather than an operational failure.
 
 ### Header verification and source map
 
@@ -127,10 +130,10 @@ The sandbox-owned SID, ACL, token, file, and lock declarations are checked again
 
 | File | Role |
 |---|---|
-| [`src/index.ts`](src/index.ts) | `AclSandbox`: restricted-token policy, DACL grants, fail-closed spawn and dispose |
+| [`src/index.ts`](src/index.ts) | `AclSandbox`: restricted-token policy, DACL and label grants, fail-closed spawn and dispose |
 | [`src/runner.ts`](src/runner.ts) | The runner entry over shared Win32 process primitives |
 | [`src/grant.ts`](src/grant.ts) | `AclWriteGrant`: server-side grant materialization and revocation |
-| [`src/token.ts`](src/token.ts) + [`src/acl.ts`](src/acl.ts) | Win32 token and DACL primitives behind the sandbox |
+| [`src/token.ts`](src/token.ts) + [`src/acl.ts`](src/acl.ts) | Win32 token, DACL, and mandatory-label primitives behind the sandbox |
 
 </details>
 
@@ -173,7 +176,8 @@ These limits define when the backend is a poor fit or needs special operational
 - **Piped stdio capture is impossible for confined grandchildren** — libuv's pipe stdio uses named pipes, whose client-end open requests write access no restricting SID is granted (the Win32 layer's default SD template, not the token default DACL), so `spawn(..., { stdio: 'pipe' })` inside a confined process fails with EPERM; inherited and ignored stdio spawns work, and anonymous pipes (PowerShell pipelines) work because the restricted token's default DACL carries a full-access restricting-SID ACE.
 - **Grant materialization is an eager full-tree propagation** — `SetNamedSecurityInfoW` on a directory with inheritable ACEs walks every descendant immediately (tens of seconds on large workspace trees); the per-workspace identity pays it once per workspace per machine, and the exact-ACE skip makes every later provision cheap.
 - **Read-side confinement and network policy are out of scope** — `WRITE_RESTRICTED` intersects write accesses only; pair this backend with a read-side policy for stronger confinement.
-- **Wide-directory and FAT-volume warnings are deferred; FAT-class targets stay writable** — the UI-side warnings are not implemented, a FAT volume as a grant root fails loudly, and a FAT-class target outside the granted roots has no security descriptors so it stays writable under both confined modes; FAT is treated as legacy residue.
+- **Reads stop at objects another AppContainer-based tool has ACL'd with a package SID** — a file whose DACL carries an ACE for a package SID (`S-1-15-2-…`) is inaccessible to a Low-integrity token on this host, even when the same DACL grants the user full control and Everyone read (observed: adding that single ACE to a fresh file reproduces the denial, granting Everyone read does not lift it, and the same bytes copied elsewhere stay readable). The kernel rule behind it is unconfirmed and not this package's to change; tools that sandbox themselves with AppContainers stamp such ACEs, so a tree they touched becomes unreadable to this backend's child. Removing the foreign ACE (or re-installing the affected tree) restores access.
+- **Wide-directory and FAT-volume warnings are deferred; the FAT-class residue is unverified** — the UI-side warnings are not implemented, a FAT volume as a grant root fails loudly, and a FAT-class target outside the granted roots stores no security descriptor; its effective integrity label is assigned by the system rather than recorded on the object, so the label layer's behavior there is untested. FAT stays legacy residue.
 - **PowerShell language mode differs by confined mode** — under `read-only`, PowerShell cannot create its AppLocker probe files in temp and conservatively starts in ConstrainedLanguage (`Add-Type`, non-core .NET static calls, COM, and reflection fail); the shipped `workspace-write` path lets the probe complete, so pwsh stays in FullLanguage unless host-wide WDAC/AppLocker policy says otherwise, while a direct `AclSandbox` with `tempDir: null` has no such guarantee. This split is PowerShell startup behavior, not part of the ACL write boundary.
 
 <a id="dev-note"></a>

package/README.zh.md

@@ -9,7 +9,7 @@ kind: "package-library"
 
 ## 概述
 
-在 Windows 上，本包将子进程的写入限制在工作区和私有临时目录内。`workspace-write` 授予对这两个位置的写入权限，`read-only` 则均不授予。挂载 `dsh-sandbox-local` 后，受限的 bash 和 PowerShell 命令会自动获得此行为；调用方也可以直接使用公开 `AclSandbox` API，并捕获标准流。任何 Win32 操作失败都会阻止子进程在不受限制的情况下启动。该保证特意标记为部分强制，因为进程启动会保留 Everyone 访问权限，NTFS 硬链接也可以通过其他路径暴露同一文件；调用方可通过报告的 `partial` 强制级别检测此限制。
+在 Windows 上，本包将子进程的写入与删除限制在工作区和私有临时目录内：`workspace-write` 授予这两处，`read-only` 均不授予。挂载 `dsh-sandbox-local` 后，受限的 bash 与 PowerShell 命令即获得此行为；调用方也可以直接使用公开 `AclSandbox` API；任何 Win32 操作失败都会阻止不受限制的 spawn。每次授权同时写入能力 SID 允许 ACE、对父目录删除权限的环境性拒绝，以及被降级令牌必须匹配的 Low 完整性标签，因此一个授权根目录无法触及另一个。该保证仍为部分强制：硬链接是文件对象别名，而被其他 AppContainer 工具 ACL 过的文件不可读。
 
 ## 目录
 
@@ -59,15 +59,15 @@ await sandbox.init() // throws on ANY Win32 failure — never spawns unrestricte
 const child = sandbox.spawn({ command: 'pwsh', args: ['-NoProfile', '-Command', '...'], cwd: workspaceRoot })
 const { stdout, stderr, exitCode } = await child.wait()
 
-sandbox.dispose() // revokes the revocable (temp) grant, keeps the standing workspace ACE; reports every cleanup failure
+sandbox.dispose() // revokes the revocable (temp) grant and label, keeps the standing workspace pair
 rmSync(tempDir, { recursive: true, force: true })
 ```
 
-工作区 ACE 以常驻方式授予——`dispose()` 保留它们，因为它们是跨实例的复用缓存——而不同的临时 SID 以可回收方式授予。服务端对应实现是 `AclWriteGrant` 类：每个目录一次 `add(path, standing)`，`dispose()` 撤销可回收路径并释放 SID。
+工作区的安全描述符改动以常驻方式授予——`dispose()` 保留它们，因为它们是跨实例的复用缓存——而不同的临时 SID 以可回收方式授予。每次授权就是一次调用，同时携带能力 SID 允许 ACE、环境性删除拒绝与 Low 禁止上调标签。服务端对应实现是 `AclWriteGrant` 类：每个目录一次 `add(path, standing)`，`dispose()` 撤销可回收路径并释放各 SID。
 
 ### 隔离给你带来什么
 
-在 `workspace-write` 下，子进程可以写入工作区及其私有临时目录；受 ACL 管辖的其他写入都会被拒绝，已记录的 Everyone 与硬链接边界除外。在 `read-only` 下不存在显式写入授权，因此写入会被拒绝，同样带有已记录的边界。
+在 `workspace-write` 下，子进程可以写入工作区及其私有临时目录；受 ACL 管辖的其他写入与删除都会被拒绝，已记录的硬链接与 AppContainer ACL 边界除外。在 `read-only` 下不存在显式写入授权，因此写入与删除都会被拒绝，同样带有已记录的边界。
 
 临时隔离按每个活跃的会话/工作区对进行：共享工作区的会话共享其写权限，但无法写入彼此的临时目录。新的提供方总会选择新的临时路径和 SID，因此崩溃残留既无法阻止恢复的会话，也无法向其授权。
 
@@ -87,11 +87,11 @@ rmSync(tempDir, { recursive: true, force: true })
 
 ### 机制
 
-调用者令牌被复制为 `WRITE_RESTRICTED` 受限令牌，其 restricting SIDs 携带彼此独立的工作区与私有临时目录能力。Windows 执行两次访问检查——先对正常 SID，再对 restricting SID——并且只在两次检查都通过时才授予写类访问。工作区 SID 由规范工作区路径确定性派生（`workspaceWriteSid`），因此工作区根目录 ACE 每台机器每个工作区只物化一次，之后每次会话、调用或重启都命中精确 ACE 跳过。每个活跃的会话/工作区对则获得一个随机私有临时目录，以及一个从该路径派生的 SID（`tempWriteSid`），因此各会话共享预期的工作区权限，却不会继承彼此的临时目录权限。每个策略专用 Win32 调用和 [`dsh-win32-process`](../../subprocess/win32-process/README.zh.md) 提供的进程原语都有检查；失败抛出携带 API 名、精确错误码、系统文本与失败上下文的 `Win32Error`——从构造上 fail-closed。
+调用者令牌被复制为 `WRITE_RESTRICTED` 受限令牌，其 restricting SIDs 携带彼此独立的工作区与私有临时目录能力，该令牌还会被降级为 Low 完整性。Windows 执行两次访问检查——先对正常 SID，再对 restricting SID——并且只在两次检查都通过时才授予写类访问；与此同时，内核的强制完整性检查会拒绝对任何未标记为 Low 的对象进行写类访问。写 SID 交叉检查只覆盖对象自身的那次访问检查：Windows 也可以依据父目录的 `FILE_DELETE_CHILD` 权限批准写入或删除，而这项权限不需要任何 restricting SID 副署，因此只带交叉检查的令牌不仅能删除其环境用户 SID 所控制的任何文件，还能删除**另一个授权根目录**内的文件——那里的 Low 标签恰好能通过完整性检查。所以每次授权还会向 world SID 拒绝 `FILE_DELETE_CHILD`，使能力 ACE 的 DELETE 位成为授权根目录内唯一的删除授权来源，并在同一次 `SetNamedSecurityInfoW` 调用中把该目录标记为 Low。工作区 SID 由规范工作区路径确定性派生（`workspaceWriteSid`），因此工作区根目录的安全描述符改动每台机器每个工作区只物化一次，之后每次会话、调用或重启都命中精确 ACE／精确拒绝／精确标签跳过。每个活跃的会话/工作区对则获得一个随机私有临时目录，以及一个从该路径派生的 SID（`tempWriteSid`），因此各会话共享预期的工作区权限，却不会继承彼此的临时目录权限。每个策略专用 Win32 调用和 [`dsh-win32-process`](../../subprocess/win32-process/README.zh.md) 提供的进程原语都有检查；失败抛出携带 API 名、精确错误码、系统文本与失败上下文的 `Win32Error`——从构造上 fail-closed。
 
 ### 模式与令牌列表
 
-`workspace-write`（登录 SID、Everyone、工作区 SID、临时 SID）为工作区与会话的私有临时子目录分别授予 Write；`read-only`（登录 SID、Everyone——不含写入 SID）不授予任何内容。保活组（登录 SID + Everyone）在两种模式下都存在：没有它，早期 DLL 初始化会以 `0xC0000142` 死亡、CNG 会让 pwsh 以 `0xE0434352` 崩溃。写入 SID 有意留在 read-only 列表之外：先前 workspace-write 时期留下的常驻授权 ACE 仍然失效，因为 write-restricted 的 pass-2 检查只授予 restricting 列表所携带的内容，而常驻 ACE 让重新升级免于重新传播。
+`workspace-write`（登录 SID、Everyone、工作区 SID、临时 SID）为工作区与会话的私有临时子目录分别授予 Write；`read-only`（登录 SID、Everyone——不含写入 SID）不授予任何内容。两种模式都 spawn 降级为 Low 完整性的令牌，对它而言只有被标记 Low 的目录保持可写。保活组（登录 SID + Everyone）在两种模式下都存在：没有它，早期 DLL 初始化会以 `0xC0000142` 死亡、CNG 会让 pwsh 以 `0xE0434352` 崩溃。写入 SID 有意留在 read-only 列表之外：先前 workspace-write 时期留下的常驻授权 ACE 仍然失效，因为 write-restricted 的 pass-2 检查只授予 restricting 列表所携带的内容，而常驻安全描述符改动让重新升级免于重新传播。
 
 NUL 写入是环境性的、不是被授权的：设备 DACL 授予 Everyone 读+写+执行（`0x1201BF`），因此访问掩码落在其内的打开者（cmd 的 `> NUL`、node 的 `\\.\NUL`）在两种模式下都能写。`Set-Content NUL` 在两种模式下都失败（PowerShell/.NET 层效应，非设备 DACL 所致），而 PowerShell 的 `> $null` 重定向不受影响。
 
@@ -111,15 +111,18 @@ seam 先把确定性工作区 SID 的 ACE 常驻物化（每个工作区每服
 
 ### 已验证边界
 
-- **Everyone 授权仍是环境中的写权限来源。** Everyone 必须保留在两种 restricting 列表中（移除它会破坏早期 DLL 初始化与 CNG）；外部 NTFS 对象若其 DACL 向 Everyone 授予所请求的写权限，就会同时通过两次检查，并在两种模式下保持可写。
-- **硬链接是文件对象别名，而非路径别名。** 传播到已有硬链接上的可继承工作区 ACE 会修改底层同一文件的安全描述符，因此同一对象也可通过外部别名写入；拒绝工作区中的所有多链接文件不具可行性，因为普通 pnpm 安装会使用硬链接。
-- **写入受限；读取、网络与进程可见性不受限。** `WRITE_RESTRICTED` 只交叉检查写访问，因此受限子进程可以读取调用者可读的任何文件并打开套接字；`read-only` 因而需要读侧策略才能表达。
+- **Everyone 仍留在两种 restricting 列表中，但不再带来写权限。** 保活组是早期 DLL 初始化与 CNG 所必需的；如今 Low 标签会拒绝对被标记根目录之外、由 Everyone 授权的写入，因此这一旧缺口已关闭。
+- **在授权根目录内，能力 ACE 的 DELETE 位是唯一的删除授权来源。** 授权会向 world SID 拒绝 `FILE_DELETE_CHILD`，这同时移除了环境性默认行为：自身 DACL 未授予 DELETE 的文件不再能凭父目录权限删除——受限子进程与用户自身进程皆然。用户日常删除仍然可用，因为工作区 DACL 直接向其授予 DELETE。
+- **拒绝项只继承到子目录，且子目录的 FullControl 打开会被拒。** `FILE_DELETE_CHILD` 只在目录上被评估，因此该 ACE 带 `CONTAINER_INHERIT_ACE`、绝不落到文件上（它的位 `0x40` 属于 `FILE_ALL_ACCESS`，若落到文件上会让用户、Administrators、SYSTEM 或 DSH host 的每次 `GENERIC_ALL`／`FullControl` 打开都被拒绝）。授权根内的目录保留该拒绝项，因而会拒绝这类打开；基于 `DELETE` 的删除、`MAXIMUM_ALLOWED` 与常规读写打开不受影响——两种结果都已被 runner 套件钉住。
+- **写入与删除受限；读取、网络与进程可见性不受限。** 两层都不交叉检查读取，因此受限子进程可以读取调用者可读的任何文件（包括其他工作区中的文件）并打开套接字；`read-only` 因而需要读侧策略才能表达。
+- **硬链接是文件对象别名，而非路径别名。** 传播到已有硬链接上的可继承工作区授权会标记并授权底层同一文件的安全描述符，因此同一对象也可通过外部别名写入；拒绝工作区中的所有多链接文件不具可行性，因为普通 pnpm 安装会使用硬链接。
 - **控制台隔离不可用。** 以 `CREATE_NO_WINDOW` / `CREATE_NEW_CONSOLE` 创建的子进程在 DLL 初始化期间以 `STATUS_DLL_INIT_FAILED`（`0xC0000142`）死亡；子进程共享宿主控制台，基于管道的 stdio 重定向不受影响。
-- **ACL 授权是对真实目录的驻留改动。** 工作区 ACE 按设计常驻（复用缓存，绝不撤销）；临时 ACE 由 `dispose()` 撤销；手工 `icacls` 清理无法在本平台回收它们（`ERROR_NONE_MAPPED` 1332），请通过本模块回收。
-- **被授权目录必须由调用者拥有。** 所有者的隐式 `WRITE_DAC` 是沙箱无需提权即可编辑 DACL 的原因。
+- **安全描述符改动是对真实目录的驻留改动。** 工作区 ACE、拒绝项与标签按设计常驻（复用缓存，绝不撤销）；临时改动由 `dispose()` 撤销——但若该目录上仍留有其他能力授权，撤销会保留共享的 Low 标签——撤销后残留的那条拒绝项会随临时目录本身一并消失；手工 `icacls` 清理无法在本平台回收它们（`ERROR_NONE_MAPPED` 1332），请通过本模块回收。
+- **常驻 Low 标签的生命期长于 DSH，并会向其他 Low 完整性的进程放宽该目录树。** 工作区的可继承标签在会话结束后（以及同卷移动后）依然存在，因此任何以同一用户身份运行在 Low 完整性的其他进程——别家产品的 Low-IL 沙箱、受保护模式阅读器——都能写入与删除工作区内的内容，而在 Medium 标签下这会被拒绝。这个标签是写边界的代价：没有它受限子进程根本无法写入，而按会话回收会导致每次供给都要重新传播整棵树。
+- **被授权目录必须由调用者拥有并授予 `WRITE_OWNER`。** 所有者隐式获得的只有 `READ_CONTROL` 与 `WRITE_DAC`；标签位于 SACL，因此合并应用还需要 `WRITE_OWNER`（完全控制目录——即正常工作区情形——本就具备）。DACL 只授予 Modify 的目录现在会大声失败，而不是静默跳过隔离。
 - **环境临时根目录绝不会被隐式授权。** 直接调用方必须提供已存在的私有 `tempDir` 及其不同的 `tempWriteSid`，或用 `tempDir: null` 禁用临时写入；实际临时目录不得与任何可写根目录重叠。
 - **受限子进程的临时能力按每个活跃的会话/工作区对私有。** runner 在 spawn 之前把 TMP/TEMP 改写为该私有目录；共享同一工作区 SID 的两个令牌无法写入彼此的临时目录。
-- **受限令牌下 `whoami` 与令牌检查 cmdlet 会失败。** 子进程对复制令牌的 `GetTokenInformation` 部分不可用，这是诊断噪音而非运行故障。
+- **受限令牌下 `whoami` 与令牌检查 cmdlet 可能失败。** 子进程对复制令牌的 `GetTokenInformation` 部分不可用，因此这类报告型 cmdlet 是否可用取决于宿主环境；这是诊断噪音而非运行故障。
 
 ### 头文件验证与源码索引
 
@@ -173,7 +176,8 @@ seam 先把确定性工作区 SID 的 ACE 常驻物化（每个工作区每服
 - **受限孙进程的管道 stdio 捕获不可用。** libuv 的管道 stdio 用的是 NAMED pipe，其 client 端打开所请求的写访问没有任何 restricting SID 被授予（是 Win32 层的默认 SD 模板，而非令牌默认 DACL），因此受限进程内 `spawn(..., { stdio: 'pipe' })` 以 EPERM 失败；继承与忽略 stdio 的 spawn 可用，匿名管道（PowerShell 的管道）因受限令牌默认 DACL 携带 restricting SID 全权 ACE 而可用。
 - **授权物化是急切的全树传播。** 在带可继承 ACE 的目录上调用 `SetNamedSecurityInfoW` 会立即遍历每个后代（大型工作区树上以数十秒计）；按工作区身份每台机器每个工作区只付一次，精确 ACE 跳过让后续每次供给都很便宜。
 - **读侧隔离与网络策略不在范围内**——`WRITE_RESTRICTED` 只交叉检查写访问；将此后端与读侧策略配对以获得更强隔离。
-- **宽目录与 FAT 卷警告已推迟；FAT 类目标保持可写。** UI 侧警告尚未实现，FAT 卷作为授权根会大声失败，而授权根之外的 FAT 类目标没有安全描述符，因此在两种受限模式下都可写；FAT 被视为遗留残留。
+- **读取会被其他基于 AppContainer 的工具以包 SID 授权过的对象挡住。** 在本机上，当文件的 DACL 携带针对包 SID（`S-1-15-2-…`）的 ACE 时，Low 完整性的令牌无法访问它——即使同一份 DACL 同时向用户授予完全控制、向 Everyone 授予读取（已观测：只给新文件加这一条 ACE 即可复现拒绝，补授 Everyone 读取无法解除，而同样内容复制到别处仍可读）。其背后的内核规则尚未确证，也不由本包掌控；以 AppContainer 自我隔离的工具正是会写入这类 ACE，因此被它们标记过的目录树对本后端的子进程将不可读。移除外来 ACE（或重新安装受影响的目录树）即可恢复访问。
+- **宽目录与 FAT 卷警告已推迟；FAT 类残留未经验证。** UI 侧警告尚未实现，FAT 卷作为授权根会大声失败，而授权根之外的 FAT 类目标不存储安全描述符；其有效完整性标签由系统分配而非记录在对象上，因此标签层在该处的行为未经测试。FAT 仍被视为遗留残留。
 - **PowerShell 语言模式因受限模式而异。** 在 `read-only` 下，PowerShell 无法在临时目录中创建 AppLocker 探针文件，因此会保守地以 ConstrainedLanguage 启动（`Add-Type`、非核心 .NET 静态调用、COM 与反射失败）；交付的 `workspace-write` 路径可让探针完成，因此除非主机范围的 WDAC/AppLocker 策略另有规定，否则 pwsh 保持 FullLanguage，而直接使用 `AclSandbox` 并配置 `tempDir: null` 时则没有这一保证。这一区别属于 PowerShell 启动行为，不是 ACL 写入边界的一部分。
 
 <a id="dev-note"></a>

package/lib/index.js

@@ -1,2 +1,2 @@
-import { a as assertTempRootOutsideWorkspace, i as AclWriteGrant, n as tempWriteSid, r as workspaceWriteSid, t as AclSandbox } from "./types-CutH1Lgc.js";
+import { a as assertTempRootOutsideWorkspace, i as AclWriteGrant, n as tempWriteSid, r as workspaceWriteSid, t as AclSandbox } from "./types-DxezulnA.js";
 export { AclSandbox, AclWriteGrant, assertTempRootOutsideWorkspace, tempWriteSid, workspaceWriteSid };

package/lib/runner.js

@@ -1,4 +1,4 @@
-import { a as assertTempRootOutsideWorkspace, n as tempWriteSid, o as win32, r as workspaceWriteSid, t as AclSandbox } from "./types-CutH1Lgc.js";
+import { a as assertTempRootOutsideWorkspace, n as tempWriteSid, o as win32, r as workspaceWriteSid, t as AclSandbox } from "./types-DxezulnA.js";
 import { closeSync, existsSync, mkdtempSync, rmSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { SUBPROCESS_CONTROL_ENV, SUBPROCESS_CONTROL_FD } from "@deepseek-ai/dsh-subprocess/control";

package/lib/types/acl.d.ts

@@ -5,6 +5,15 @@
  * failure is reported with the API name, the exact Win32 code, the formatted
  * system text, and the affected path.
  *
+ * Each grant applies three edits in ONE SetNamedSecurityInfoW call: the
+ * capability-SID allow ACE, a Deny ACE that removes the ambient
+ * `FILE_DELETE_CHILD` right from the world SID, and a Low no-write-up
+ * mandatory label ({@link buildLowLabelAcl}). The deny is what keeps one
+ * granted root out of another's reach: Windows also authorizes a delete from
+ * the parent directory's `FILE_DELETE_CHILD` right, which the token's
+ * write-restricted intersection does not reach, and every granted root carries
+ * the Low label that clears the integrity check.
+ *
  * Concurrency: grants are read-merge-write against the directory's CURRENT
  * DACL, and the whole get-merge-set sequence runs under a per-path exclusive
  * LockFileEx lock (see {@link withPathLock}) so concurrent sandbox instances
@@ -17,13 +26,17 @@ import type { NativePtr, Win32Bindings } from './ffi.ts';
  * perms@0, mode@4, inheritance@8, Trustee@16 { pMultipleTrustee@16,
  * MultipleTrusteeOperation@24, TrusteeForm@28, TrusteeType@32, ptstrName@40 }.
  * `permissions` is the access mask; the POC passes 0 for REVOKE_ACCESS, which
- * removes every ACE for the trustee.
+ * removes every ACE for the trustee. `inheritance` defaults to children of
+ * both kinds; the ambient-delete deny narrows it to containers because
+ * FILE_DELETE_CHILD is meaningless on a file and its bit would otherwise
+ * spread through the file's inherited mask.
  * @param sidPtr - the trustee SID the entry names.
- * @param mode - the access mode (GRANT_ACCESS or REVOKE_ACCESS).
- * @param permissions - the access mask to grant (0 for REVOKE_ACCESS).
+ * @param mode - the access mode (GRANT_ACCESS, DENY_ACCESS, or REVOKE_ACCESS).
+ * @param permissions - the access mask to grant or deny (0 for REVOKE_ACCESS).
+ * @param inheritance - the ACE inheritance flags.
  * @returns the packed entry buffer.
  */
-export declare function buildExplicitAccess(sidPtr: NativePtr, mode: number, permissions: number): Buffer;
+export declare function buildExplicitAccess(sidPtr: NativePtr, mode: number, permissions: number, inheritance?: number): Buffer;
 /**
  * One lock file per protected path: `<GetTempPathW()>\dsh-acl-locks\<first 16
  * hex of sha256(lowercased path)>.lock`. The lock root derives from
@@ -50,30 +63,53 @@ export declare function lockFilePath(api: Win32Bindings, path: string): string;
  * @returns the action's result.
  */
 export declare function withPathLock<T>(api: Win32Bindings, path: string, action: () => T): T;
+/**
+ * Build the Low mandatory label applied with every write grant: one
+ * SYSTEM_MANDATORY_LABEL_ACE naming `lowLabelSidPtr` with the no-write-up
+ * policy, inheriting to subcontainers and objects so later children carry the
+ * same label. The caller frees the returned ACL with LocalFree
+ * (SetNamedSecurityInfoW copies it); every Win32 call is checked and a
+ * half-built ACL is released before the error is thrown.
+ * @param api - the binding table.
+ * @param lowLabelSidPtr - the Low integrity SID (S-1-16-4096) the label names.
+ * @returns the ACL carrying the single inheritable label ACE.
+ */
+export declare function buildLowLabelAcl(api: Win32Bindings, lowLabelSidPtr: NativePtr): NativePtr;
 /**
  * Grant `GRANT_MASK` (Write+Delete, displays as "Modify") to the capability SID
- * on `path`, inheriting to subcontainers and objects. Idempotent: when the
- * directory's current explicit DACL already carries the exact ACE (the
- * per-session grant surviving from a previous server lifetime), the
- * SetNamedSecurityInfoW apply is SKIPPED — it would otherwise re-propagate
- * the identical ACE across the whole tree (eager inheritance; minutes on
- * large workspaces). Otherwise read-merge-write: the new ACE merges into the
- * directory's CURRENT explicit DACL (same shape as {@link revokeWrite}), so
- * pre-existing explicit ACEs survive. Runs under the per-path lock. The
- * directory must be owned by the caller (owner implicit WRITE_DAC) — same
- * precondition as the POC.
+ * on `path`, deny the world SID the ambient `FILE_DELETE_CHILD` right, and
+ * apply the Low mandatory label — one merge. The deny inherits to containers
+ * only: the right is evaluated on directories, and inheriting its bit onto
+ * files would deny every `FILE_ALL_ACCESS`/`GENERIC_ALL` open inside the root
+ * (0x40 is a member of that mask). The capability ACE's DELETE bit is then the
+ * only delete authority inside the root, so a file whose own DACL grants no
+ * DELETE is no longer deletable through its parent's rights.
+ *
+ * Idempotent: the exact ACE, deny, and label together SKIP the
+ * SetNamedSecurityInfoW apply, which would otherwise re-propagate the
+ * identical descriptor across the whole tree (eager inheritance; minutes on
+ * large workspaces). Otherwise read-merge-write, so pre-existing explicit ACEs
+ * survive (same shape as {@link revokeWrite}). Runs under the per-path lock.
+ * The directory must be owned by the caller AND grant WRITE_OWNER (the label
+ * lives in the SACL; owner-implicit rights cover only READ_CONTROL and
+ * WRITE_DAC) — a Full-control workspace satisfies both.
  * @param api - the binding table.
- * @param path - the directory whose DACL gains the grant (the workspace or temp root).
+ * @param path - the directory whose DACL and label gain the grant (the workspace or temp root).
  * @param sidPtr - the capability SID the ACE names.
+ * @param lowLabelSidPtr - the Low integrity SID the mandatory label names.
+ * @param worldSidPtr - the Everyone SID the ambient-delete deny names.
  */
-export declare function grantWrite(api: Win32Bindings, path: string, sidPtr: NativePtr): void;
+export declare function grantWrite(api: Win32Bindings, path: string, sidPtr: NativePtr, lowLabelSidPtr: NativePtr, worldSidPtr: NativePtr): void;
 /**
  * Remove every ACE for the capability SID from the directory DACL (REVOKE_ACCESS
- * merge — other entries are preserved). Returns whether an ACE removal was
- * attempted (false when the directory carries no DACL at all).
+ * merge — other entries are preserved). The shared Low label is cleared only
+ * when no other capability grant remains on the directory: two grants may
+ * target one directory, and the surviving one still needs the label for its
+ * child's writes. Returns whether an ACE removal was attempted (false when the
+ * directory carries no DACL at all).
  *
  * Runs under the per-path lock (the whole get-merge-set sequence); the
- * descriptor/ACL allocation contract lives on {@link readCurrentDacl}.
+ * descriptor/ACL allocation contract lives on {@link readCurrentSecurity}.
  * @param api - the binding table.
  * @param path - the directory whose DACL loses the capability-SID ACEs.
  * @param sidPtr - the capability SID whose ACEs are removed.

package/lib/types/ffi.d.ts

@@ -17,7 +17,9 @@ export interface Win32Bindings extends Win32ProcessBindings {
     setTokenInformation(token: NativePtr, cls: number, info: Buffer, length: number): number;
     createRestrictedToken(existing: NativePtr, flags: number, disableCount: number, disableSids: null, deletePrivilegeCount: number, privilegesToDelete: null, restrictCount: number, restrictingSids: Buffer, newToken: NativePtr): number;
     setEntriesInAclW(count: number, entries: Buffer, oldAcl: NativePtr | null, newAcl: NativePtr): number;
-    setNamedSecurityInfoW(path: string, objectType: number, information: number, owner: null, group: null, dacl: NativePtr | null, sacl: null): number;
+    initializeAcl(acl: NativePtr, length: number, revision: number): number;
+    addMandatoryAce(acl: NativePtr, revision: number, aceFlags: number, policy: number, sid: NativePtr): number;
+    setNamedSecurityInfoW(path: string, objectType: number, information: number, owner: null, group: null, dacl: NativePtr | null, sacl: NativePtr | null): number;
     getNamedSecurityInfoW(path: string, objectType: number, information: number, owner: NativePtr, group: NativePtr, dacl: NativePtr, sacl: NativePtr, descriptor: NativePtr): number;
     getTempPathW(length: number, buffer: Buffer): number;
     setEnvironmentVariableW(name: string, value: string): number;

package/lib/types/grant.d.ts

@@ -7,54 +7,61 @@
  *
  * Fail-closed: `add` throws on any grant failure and the caller disposes the
  * instance (revoking every path granted so far); `dispose` revokes every
- * standing grant and reports every cleanup failure.
+ * revocable grant, leaves the standing workspace edits in place, and reports
+ * every cleanup failure.
  * @module @deepseek-ai/dsh-sandbox-windows-acl/grant
  */
 import type { Win32Bindings } from './ffi.ts';
 /**
  * One write SID's provider-lifetime grant materialization: the parsed SID
- * pointer plus every directory whose DACL currently carries its ACE.
- * Workspace paths are added STANDING (their ACEs are the cross-session reuse
- * cache and outlive the grant — dispose() skips revoking them, or the next
+ * pointer plus every directory whose DACL currently carries its ACE and whose
+ * label ACL carries the Low mandatory label. Workspace paths are added
+ * STANDING (their security descriptor edits are the cross-session reuse cache
+ * and outlive the grant — dispose() skips revoking them, or the next
  * provision would re-propagate the whole tree); temp paths are revocable
  * (dispose() revokes them — an inheritable ACE must not outlive its
  * session's temp directory). Create with {@link AclWriteGrant.create};
- * dispose revokes the revocable paths and frees the SID.
+ * dispose revokes the revocable paths and frees every SID.
  */
 export declare class AclWriteGrant {
     /** The write SID in SDDL string form. */
     readonly writeSid: string;
     private readonly api;
     private readonly sidPtr;
+    private readonly lowLabelSidPtr;
+    private readonly worldSidPtr;
     private readonly revocablePaths;
     private readonly standingPaths;
     private constructor();
     /**
-     * Parse the SID string and open the binding table (lazily, once per
-     * server). Fail-closed: any failure throws — nothing is granted yet.
+     * Parse the SID string, create the Low integrity SID the grants label with
+     * and the world SID their ambient-delete deny names, and open the binding
+     * table (lazily, once per server). Fail-closed: any failure throws — nothing
+     * is granted yet.
      * @param writeSid - the workspace (`S-1-4-x-y`) or temp (`S-1-4-x-y-1`) capability SID string.
      * @param api - optional already-resolved bindings (tests).
      * @returns the ready grant (no ACEs yet).
      */
     static create(writeSid: string, api?: Win32Bindings): AclWriteGrant;
     /**
-     * Grant the write ACE on one directory (idempotent: an already-standing
-     * exact ACE skips the eager full-tree re-propagation — see
-     * {@link grantWrite}) and record the path for {@link dispose} unless it is
-     * standing. The path is recorded BEFORE the grant: a post-apply throw (a
-     * LocalFree failure after SetNamedSecurityInfoW succeeded) must still
-     * revoke it, and revoking an ungranted path is a no-op merge. Callers
-     * treat a throw as a failed materialization and dispose the instance to
-     * revoke the paths granted so far.
-     * @param path - the directory whose DACL gains the grant.
-     * @param standing - the ACE outlives this grant (the workspace reuse
+     * Grant the write ACE, the ambient-delete deny, and the Low mandatory label
+     * on one directory (idempotent: an already-standing exact ACE, deny, and
+     * label skip the eager full-tree re-propagation — see {@link grantWrite})
+     * and record the path for {@link dispose} unless it is standing. The path is
+     * recorded BEFORE the grant: a post-apply throw (a LocalFree failure after
+     * SetNamedSecurityInfoW succeeded) must still revoke it, and revoking an
+     * ungranted path is a no-op merge. Callers treat a throw as a failed
+     * materialization and dispose the instance to revoke the paths granted so
+     * far.
+     * @param path - the directory whose DACL and label gain the grant.
+     * @param standing - the edits outlive this grant (the workspace reuse
      *   cache; dispose() skips revoking it). Default false (revoked on
      *   dispose — the temp-directory lifecycle).
      */
     add(path: string, standing?: boolean): void;
     /** Every directory currently carrying the grant, in grant order. */
     get paths(): readonly string[];
-    /** Revoke every revocable grant (standing ACEs stay) and free the SID; reports every cleanup failure. */
+    /** Revoke every revocable grant (standing security descriptor edits stay) and free the SIDs; reports every cleanup failure. */
     dispose(): void;
 }
 //# sourceMappingURL=grant.d.ts.map

package/lib/types/index.d.ts

@@ -10,7 +10,10 @@
  * keep-alive group logon SID + Everyone; Authenticated Users, INTERACTIVE,
  * and LOCAL are absent from both lists — see the seam's dual-list contract
  * in `packages/sandbox/sandbox-local` and the package README's Modes section
- * for the complete boundary). The write SID is the per-WORKSPACE identity
+ * for the complete boundary). The intersection covers only the object's own
+ * access check, so the token is also lowered to Low integrity and every
+ * granted directory carries a Low no-write-up label and the ambient-delete
+ * deny the `acl` module documents. The write SID is the per-WORKSPACE identity
  * ({@link workspaceWriteSid}): deterministic from the canonical workspace
  * path, so the workspace-root ACE materializes once per workspace per
  * machine and every later provision hits the exact-ACE skip — the

package/lib/types/token.d.ts

@@ -49,6 +49,16 @@ export declare function makeWellKnownSid(api: Win32Bindings, type: number): Nati
  * @param sidPtr - the restricting SID whose full-access ACE joins the default DACL.
  */
 export declare function setTokenDefaultDaclGrant(api: Win32Bindings, token: NativePtr, sidPtr: NativePtr): void;
+/**
+ * Lower the restricted token's integrity level to Low (S-1-16-4096), the level
+ * the mandatory labels `grantWrite` applies are matched against; a token left
+ * at Medium would ignore them. Requires TOKEN_ADJUST_DEFAULT on the token;
+ * fails closed before any child is spawned.
+ * @param api - the binding table.
+ * @param token - the restricted token to lower.
+ * @param lowLabelSidPtr - the Low integrity SID (S-1-16-4096).
+ */
+export declare function restrictTokenIntegrity(api: Win32Bindings, token: NativePtr, lowLabelSidPtr: NativePtr): void;
 /** The well-known SID packed into every restricted token's restricting list. */
 export interface RestrictingSidSet {
     world: NativePtr;

package/lib/types/win32-abi.d.ts

@@ -41,6 +41,33 @@ export declare const TokenGroups = 2;
 export declare const TokenDefaultDacl = 6;
 /** SECURITY_INFORMATION flag selecting the DACL. */
 export declare const DACL_SECURITY_INFORMATION = 4;
+/** SECURITY_INFORMATION flag selecting the mandatory integrity label. */
+export declare const LABEL_SECURITY_INFORMATION = 16;
+/** ACE type carrying a mandatory integrity label. */
+export declare const SYSTEM_MANDATORY_LABEL_ACE_TYPE = 17;
+/**
+ * Mandatory policy denying write-class access to higher-integrity objects.
+ * The kernel applies it inside the access check, so it also covers writes and
+ * deletes granted through a parent directory's FILE_DELETE_CHILD right —
+ * the path the write-restricted pass-2 intersection does not reach.
+ */
+export declare const SYSTEM_MANDATORY_LABEL_NO_WRITE_UP = 1;
+/** TOKEN_INFORMATION_CLASS value for the token's integrity level. */
+export declare const TokenIntegrityLevel = 25;
+/** Group attribute marking the integrity SID of a TOKEN_MANDATORY_LABEL. */
+export declare const SE_GROUP_INTEGRITY = 32;
+/** WELL_KNOWN_SID_TYPE value for the Low mandatory level (S-1-16-4096). */
+export declare const WinLowLabelSid = 66;
+/** x64 TOKEN_MANDATORY_LABEL byte size (the SID is referenced, not embedded). */
+export declare const TOKEN_MANDATORY_LABEL_SIZE = 16;
+/** x64 ACL header byte size (AclRevision, Sbz1, AclSize, AceCount, Sbz2). */
+export declare const ACL_HEADER_SIZE = 8;
+/** Bytes a SYSTEM_MANDATORY_LABEL_ACE occupies beyond the ACL header and its SID. */
+export declare const MANDATORY_ACE_OVERHEAD = 8;
+/** ACL revision accepted by InitializeAcl and AddMandatoryAce. */
+export declare const ACL_REVISION = 2;
+/** LocalAlloc flag selecting zero-initialized fixed memory (LMEM_FIXED | LMEM_ZEROINIT). */
+export declare const LPTR = 64;
 /** SE_OBJECT_TYPE value for filesystem objects. */
 export declare const SE_FILE_OBJECT = 1;
 /** TRUSTEE_TYPE value used when trustee classification is unknown. */
@@ -51,10 +78,14 @@ export declare const TRUSTEE_IS_SID = 0;
 export declare const NO_MULTIPLE_TRUSTEE = 0;
 /** EXPLICIT_ACCESS mode that grants access. */
 export declare const GRANT_ACCESS = 1;
+/** EXPLICIT_ACCESS mode that denies access. */
+export declare const DENY_ACCESS = 3;
 /** EXPLICIT_ACCESS mode that revokes access. */
 export declare const REVOKE_ACCESS = 4;
 /** ACE inheritance flags for child containers and objects. */
 export declare const SUB_CONTAINERS_AND_OBJECTS_INHERIT = 3;
+/** ACE inheritance flag for child containers only (directories; files do not inherit). */
+export declare const CONTAINER_INHERIT_ACE = 2;
 /** Legacy Win32 maximum path character count used by GetTempPathW. */
 export declare const MAX_PATH = 260;
 /** Successful Win32 status code. */
@@ -79,6 +110,8 @@ export declare const LOCKFILE_EXCLUSIVE_LOCK = 2;
 export declare const LOCKFILE_FAIL_IMMEDIATELY = 1;
 /** ACE type for an allowed-access entry. */
 export declare const ACCESS_ALLOWED_ACE_TYPE = 0;
+/** ACE type for a denied-access entry (shares the allowed ACE's Mask/SID layout). */
+export declare const ACCESS_DENIED_ACE_TYPE = 1;
 /** Maximum SID sub-authority count. */
 export declare const SID_MAX_SUB_AUTHORITIES = 15;
 /** ACE flag marking inherited entries. */

package/lib/{types-CutH1Lgc.js → types-DxezulnA.js}

@@ -188,6 +188,18 @@ function bindings() {
 			PVOID,
 			PPVOID
 		]),
+		initializeAcl: bind(advapi32, "InitializeAcl", "int", [
+			PVOID,
+			"uint32",
+			"uint32"
+		]),
+		addMandatoryAce: bind(advapi32, "AddMandatoryAce", "int", [
+			PVOID,
+			"uint32",
+			"uint32",
+			"uint32",
+			PVOID
+		]),
 		setNamedSecurityInfoW: bind(advapi32, "SetNamedSecurityInfoW", "uint32", [
 			"str16",
 			"int",
@@ -272,6 +284,15 @@ function getTempPath(api) {
 * failure is reported with the API name, the exact Win32 code, the formatted
 * system text, and the affected path.
 *
+* Each grant applies three edits in ONE SetNamedSecurityInfoW call: the
+* capability-SID allow ACE, a Deny ACE that removes the ambient
+* `FILE_DELETE_CHILD` right from the world SID, and a Low no-write-up
+* mandatory label ({@link buildLowLabelAcl}). The deny is what keeps one
+* granted root out of another's reach: Windows also authorizes a delete from
+* the parent directory's `FILE_DELETE_CHILD` right, which the token's
+* write-restricted intersection does not reach, and every granted root carries
+* the Low label that clears the integrity check.
+*
 * Concurrency: grants are read-merge-write against the directory's CURRENT
 * DACL, and the whole get-merge-set sequence runs under a per-path exclusive
 * LockFileEx lock (see {@link withPathLock}) so concurrent sandbox instances
@@ -283,17 +304,21 @@ function getTempPath(api) {
 * perms@0, mode@4, inheritance@8, Trustee@16 { pMultipleTrustee@16,
 * MultipleTrusteeOperation@24, TrusteeForm@28, TrusteeType@32, ptstrName@40 }.
 * `permissions` is the access mask; the POC passes 0 for REVOKE_ACCESS, which
-* removes every ACE for the trustee.
+* removes every ACE for the trustee. `inheritance` defaults to children of
+* both kinds; the ambient-delete deny narrows it to containers because
+* FILE_DELETE_CHILD is meaningless on a file and its bit would otherwise
+* spread through the file's inherited mask.
 * @param sidPtr - the trustee SID the entry names.
-* @param mode - the access mode (GRANT_ACCESS or REVOKE_ACCESS).
-* @param permissions - the access mask to grant (0 for REVOKE_ACCESS).
+* @param mode - the access mode (GRANT_ACCESS, DENY_ACCESS, or REVOKE_ACCESS).
+* @param permissions - the access mask to grant or deny (0 for REVOKE_ACCESS).
+* @param inheritance - the ACE inheritance flags.
 * @returns the packed entry buffer.
 */
-function buildExplicitAccess(sidPtr, mode, permissions) {
+function buildExplicitAccess(sidPtr, mode, permissions, inheritance = 3) {
 	const entry = Buffer.alloc(48);
 	entry.writeUInt32LE(permissions, 0);
 	entry.writeUInt32LE(mode, 4);
-	entry.writeUInt32LE(3, 8);
+	entry.writeUInt32LE(inheritance, 8);
 	entry.writeUInt32LE(0, 24);
 	entry.writeUInt32LE(0, 28);
 	entry.writeUInt32LE(0, 32);
@@ -356,76 +381,173 @@ function withPathLock(api, path, action) {
 	return result;
 }
 /**
-* Read the directory's current explicit DACL via GetNamedSecurityInfoW.
+* Read the directory's current explicit DACL and mandatory label via
+* GetNamedSecurityInfoW.
 * Allocation contract (the POC's RevokeAccess, minus its missing checks): the
 * returned ACL pointer sits INSIDE the security descriptor allocation — only
 * the descriptor may be LocalFree'd, and it must not be freed before
 * SetEntriesInAclW has consumed the ACL. Freeing the ACL pointer itself
 * corrupts the heap (verified the hard way).
 * @param api - the binding table.
-* @param path - the directory whose DACL is read.
-* @returns the current explicit DACL (null when the directory carries none) and its owning descriptor.
+* @param path - the directory whose DACL and label are read.
+* @returns the current explicit DACL and label ACL (null when the directory carries none) plus their owning descriptor.
 */
-function readCurrentDacl(api, path) {
+function readCurrentSecurity(api, path) {
 	const ownerSlot = allocPtrSlot();
 	const groupSlot = allocPtrSlot();
 	const daclSlot = allocPtrSlot();
 	const saclSlot = allocPtrSlot();
 	const descriptorSlot = allocPtrSlot();
-	const readResult = api.getNamedSecurityInfoW(path, 1, 4, ownerSlot, groupSlot, daclSlot, saclSlot, descriptorSlot);
+	const readResult = api.getNamedSecurityInfoW(path, 1, 20, ownerSlot, groupSlot, daclSlot, saclSlot, descriptorSlot);
 	if (readResult !== 0) throwWin32(api, "GetNamedSecurityInfoW", readResult, path);
 	return {
 		oldAcl: decodePtr(daclSlot),
+		labelAcl: decodePtr(saclSlot),
 		descriptor: decodePtr(descriptorSlot)
 	};
 }
 /**
-* Shared tail of grantWrite and revokeWrite: merge `entry` into `oldAcl`
+* Build the Low mandatory label applied with every write grant: one
+* SYSTEM_MANDATORY_LABEL_ACE naming `lowLabelSidPtr` with the no-write-up
+* policy, inheriting to subcontainers and objects so later children carry the
+* same label. The caller frees the returned ACL with LocalFree
+* (SetNamedSecurityInfoW copies it); every Win32 call is checked and a
+* half-built ACL is released before the error is thrown.
+* @param api - the binding table.
+* @param lowLabelSidPtr - the Low integrity SID (S-1-16-4096) the label names.
+* @returns the ACL carrying the single inheritable label ACE.
+*/
+function buildLowLabelAcl(api, lowLabelSidPtr) {
+	const sidLength = api.getLengthSid(lowLabelSidPtr);
+	if (sidLength === 0) throwLastError$1(api, "GetLengthSid", "Low mandatory label SID");
+	const aclLength = 16 + sidLength;
+	const acl = api.localAlloc(64, aclLength);
+	if (isNullPtr$1(acl)) throwLastError$1(api, "LocalAlloc", "Low mandatory label ACL");
+	if (api.initializeAcl(acl, aclLength, 2) === 0) {
+		const win32Code = api.getLastError();
+		api.localFree(acl);
+		throwWin32(api, "InitializeAcl", win32Code, "Low mandatory label ACL");
+	}
+	if (api.addMandatoryAce(acl, 2, 3, 1, lowLabelSidPtr) === 0) {
+		const win32Code = api.getLastError();
+		api.localFree(acl);
+		throwWin32(api, "AddMandatoryAce", win32Code, "Low mandatory label ACL");
+	}
+	return acl;
+}
+/**
+* True when the label ACL already carries the EXACT label this module would
+* add (mandatory-label ACE, OI|CI inheritance, no-write-up policy, the Low
+* SID), so a re-grant can skip the eager full-tree propagation.
+* @param labelAcl - the current label ACL pointer (from {@link readCurrentSecurity}).
+* @param lowLabelSidPtr - the Low integrity SID to match.
+* @returns whether the exact label ACE is already present.
+*/
+function hasExactLabel(labelAcl, lowLabelSidPtr) {
+	return hasExactEntry(labelAcl, 17, 3, 1, lowLabelSidPtr);
+}
+/**
+* Shared tail of grantWrite and revokeWrite: merge `entries` into `oldAcl`
 * (null = no explicit DACL yet; SetEntriesInAclW builds one from scratch),
-* free the descriptor before applying the merged ACL, apply it, then free the
-* merged ACL — checking every call and reporting with the caller's label.
+* free the descriptor before applying the merged ACL, apply the merged DACL
+* together with the label edit in one SetNamedSecurityInfoW call, then free
+* every ACL this call owns — checking each call and reporting with the
+* caller's label. The entry count derives from the buffer, so a grant can
+* carry its capability ACE and its ambient-delete deny in one merge.
 * @param api - the binding table.
-* @param path - the directory the DACL edit applies to.
-* @param entry - the EXPLICIT_ACCESS_W to merge (grant or revoke).
-* @param oldAcl - the current explicit DACL (from {@link readCurrentDacl}).
+* @param path - the directory the DACL and label edits apply to.
+* @param entries - packed EXPLICIT_ACCESS_W records to merge (grant, deny, or revoke).
+* @param oldAcl - the current explicit DACL (from {@link readCurrentSecurity}).
+* @param labelEdit - the label change to apply alongside the DACL.
 * @param descriptor - the descriptor allocation owning `oldAcl`.
 * @param label - the caller's name for error details.
 */
-function mergeAndApply(api, path, entry, oldAcl, descriptor, label) {
+function mergeAndApply(api, path, entries, oldAcl, labelEdit, descriptor, label) {
 	const newAclSlot = allocPtrSlot();
-	const mergeResult = api.setEntriesInAclW(1, entry, oldAcl, newAclSlot);
+	const mergeResult = api.setEntriesInAclW(entries.length / 48, entries, oldAcl, newAclSlot);
 	if (mergeResult !== 0) {
 		if (descriptor !== null) api.localFree(descriptor);
+		if (labelEdit.kind === "apply") api.localFree(labelEdit.acl);
 		throwWin32(api, "SetEntriesInAclW", mergeResult, `${label}(${path})`);
 	}
 	const newAcl = decodePtr(newAclSlot);
 	if (newAcl === null) {
 		if (descriptor !== null) api.localFree(descriptor);
+		if (labelEdit.kind === "apply") api.localFree(labelEdit.acl);
 		throwWin32(api, "SetEntriesInAclW", api.getLastError(), `${label}(${path}): null new ACL`);
 	}
 	const freedDescriptor = descriptor !== null ? api.localFree(descriptor) : null;
-	const applyResult = api.setNamedSecurityInfoW(path, 1, 4, null, null, newAcl, null);
+	const applyResult = api.setNamedSecurityInfoW(path, 1, labelEdit.kind === "keep" ? 4 : 20, null, null, newAcl, labelEdit.kind === "apply" ? labelEdit.acl : null);
 	const freedNew = api.localFree(newAcl);
+	const freedLabel = labelEdit.kind === "apply" ? api.localFree(labelEdit.acl) : null;
 	if (applyResult !== 0) throwWin32(api, "SetNamedSecurityInfoW", applyResult, `${label}(${path})`);
 	if (freedDescriptor !== null && !isNullPtr$1(freedDescriptor)) throwLastError$1(api, "LocalFree", `${label}(${path}) descriptor`);
 	if (!isNullPtr$1(freedNew)) throwLastError$1(api, "LocalFree", `${label}(${path}) new ACL`);
+	if (freedLabel !== null && !isNullPtr$1(freedLabel)) throwLastError$1(api, "LocalFree", `${label}(${path}) label ACL`);
+}
+/**
+* True when the explicit DACL already carries the EXACT entry
+* `(aceType, inheritance, mask, trustee SID)`. Every field is read through
+* koffi.decode at pointer offsets — no memcpy, no pointer arithmetic. The
+* ACE's SID is INLINE (embedded in the ACE after the 4-byte mask — there is
+* no pointer to read; reading one yields garbage addresses and crashed
+* EqualSid, verified by gdb), so it is compared field-by-field against the
+* trustee SID through bounded offset reads ({@link sameSidAt}). Allowed and
+* denied ACEs share the Mask@4/SID@8 layout. A malformed header reads as "no
+* exact entry" so the caller falls back to the merge-apply path, which owns
+* the robust failure handling.
+* @param acl - the current explicit DACL pointer (from {@link readCurrentSecurity}).
+* @param aceType - the ACE type to match.
+* @param inheritance - the ACE inheritance flags to match.
+* @param mask - the access mask to match.
+* @param sidPtr - the trustee SID to match.
+* @returns whether the exact entry is already present.
+*/
+function hasExactEntry(acl, aceType, inheritance, mask, sidPtr) {
+	const aclSize = decodeUint16At(acl, 2);
+	const aceCount = decodeUint16At(acl, 4);
+	if (aclSize < 8 || aclSize > 1048576) return false;
+	let offset = 8;
+	for (let index = 0; index < aceCount; index++) {
+		const aceSize = decodeUint16At(acl, offset + 2);
+		if (aceSize < 8 || offset + aceSize > aclSize) return false;
+		if (decodeUint8At(acl, offset) === aceType && decodeUint8At(acl, offset + 1) === inheritance && decodeUint32At(acl, offset + 4) === mask && sameSidAt(acl, offset + 8, sidPtr, 0)) return true;
+		offset += aceSize;
+	}
+	return false;
 }
 /**
 * True when the explicit DACL already carries the EXACT write grant this
-* module would add (Allow ACE, OI|CI inheritance, {@link abi.GRANT_MASK}, the
-* capability SID). Every field is read through koffi.decode at pointer offsets —
-* no memcpy, no pointer arithmetic. The ACE's SID is INLINE (embedded in the
-* ACE after the 4-byte mask — there is no pointer to read; reading one
-* yields garbage addresses and crashed EqualSid, verified by gdb), so it is
-* compared field-by-field against the capability SID through bounded offset
-* reads ({@link sameSidAt}). A malformed header reads as "no exact grant"
-* so the caller falls back to the merge-apply path, which owns the robust
-* failure handling.
-* @param oldAcl - the current explicit DACL pointer (from {@link readCurrentDacl}).
+* module would add: the Allow ACE for {@link abi.GRANT_MASK} naming the
+* capability SID.
+* @param oldAcl - the current explicit DACL pointer (from {@link readCurrentSecurity}).
 * @param sidPtr - the capability SID to match.
 * @returns whether the exact grant ACE is already present.
 */
 function hasExactGrant(oldAcl, sidPtr) {
+	return hasExactEntry(oldAcl, 0, 3, GRANT_MASK, sidPtr);
+}
+/**
+* True when the explicit DACL already carries the EXACT ambient-delete deny:
+* the container-inherited Deny ACE for {@link abi.FILE_DELETE_CHILD} naming
+* the world SID. It is part of the idempotent skip, so a root granted by an
+* earlier build receives the deny on its next provision.
+* @param oldAcl - the current explicit DACL pointer (from {@link readCurrentSecurity}).
+* @param worldSidPtr - the Everyone SID the deny names.
+* @returns whether the exact deny ACE is already present.
+*/
+function hasExactDeny(oldAcl, worldSidPtr) {
+	return hasExactEntry(oldAcl, 1, 2, 64, worldSidPtr);
+}
+/**
+* True when a capability grant for a SID OTHER than `sidPtr` stands on this
+* DACL — the condition under which a revoke must leave the shared Low label in
+* place, or the remaining grant's child would lose its write authority.
+* @param oldAcl - the current explicit DACL pointer (from {@link readCurrentSecurity}).
+* @param sidPtr - the capability SID being revoked.
+* @returns whether another capability grant remains.
+*/
+function hasForeignGrant(oldAcl, sidPtr) {
 	const aclSize = decodeUint16At(oldAcl, 2);
 	const aceCount = decodeUint16At(oldAcl, 4);
 	if (aclSize < 8 || aclSize > 1048576) return false;
@@ -433,46 +555,67 @@ function hasExactGrant(oldAcl, sidPtr) {
 	for (let index = 0; index < aceCount; index++) {
 		const aceSize = decodeUint16At(oldAcl, offset + 2);
 		if (aceSize < 8 || offset + aceSize > aclSize) return false;
-		if (decodeUint8At(oldAcl, offset) === 0 && decodeUint8At(oldAcl, offset + 1) === 3 && decodeUint32At(oldAcl, offset + 4) === 1114454 && sameSidAt(oldAcl, offset + 8, sidPtr, 0)) return true;
+		if (decodeUint8At(oldAcl, offset) === 0 && decodeUint32At(oldAcl, offset + 4) === 1114454 && !sameSidAt(oldAcl, offset + 8, sidPtr, 0)) return true;
 		offset += aceSize;
 	}
 	return false;
 }
 /**
 * Grant `GRANT_MASK` (Write+Delete, displays as "Modify") to the capability SID
-* on `path`, inheriting to subcontainers and objects. Idempotent: when the
-* directory's current explicit DACL already carries the exact ACE (the
-* per-session grant surviving from a previous server lifetime), the
-* SetNamedSecurityInfoW apply is SKIPPED — it would otherwise re-propagate
-* the identical ACE across the whole tree (eager inheritance; minutes on
-* large workspaces). Otherwise read-merge-write: the new ACE merges into the
-* directory's CURRENT explicit DACL (same shape as {@link revokeWrite}), so
-* pre-existing explicit ACEs survive. Runs under the per-path lock. The
-* directory must be owned by the caller (owner implicit WRITE_DAC) — same
-* precondition as the POC.
+* on `path`, deny the world SID the ambient `FILE_DELETE_CHILD` right, and
+* apply the Low mandatory label — one merge. The deny inherits to containers
+* only: the right is evaluated on directories, and inheriting its bit onto
+* files would deny every `FILE_ALL_ACCESS`/`GENERIC_ALL` open inside the root
+* (0x40 is a member of that mask). The capability ACE's DELETE bit is then the
+* only delete authority inside the root, so a file whose own DACL grants no
+* DELETE is no longer deletable through its parent's rights.
+*
+* Idempotent: the exact ACE, deny, and label together SKIP the
+* SetNamedSecurityInfoW apply, which would otherwise re-propagate the
+* identical descriptor across the whole tree (eager inheritance; minutes on
+* large workspaces). Otherwise read-merge-write, so pre-existing explicit ACEs
+* survive (same shape as {@link revokeWrite}). Runs under the per-path lock.
+* The directory must be owned by the caller AND grant WRITE_OWNER (the label
+* lives in the SACL; owner-implicit rights cover only READ_CONTROL and
+* WRITE_DAC) — a Full-control workspace satisfies both.
 * @param api - the binding table.
-* @param path - the directory whose DACL gains the grant (the workspace or temp root).
+* @param path - the directory whose DACL and label gain the grant (the workspace or temp root).
 * @param sidPtr - the capability SID the ACE names.
+* @param lowLabelSidPtr - the Low integrity SID the mandatory label names.
+* @param worldSidPtr - the Everyone SID the ambient-delete deny names.
 */
-function grantWrite(api, path, sidPtr) {
+function grantWrite(api, path, sidPtr, lowLabelSidPtr, worldSidPtr) {
 	withPathLock(api, path, () => {
-		const { oldAcl, descriptor } = readCurrentDacl(api, path);
-		if (oldAcl !== null && hasExactGrant(oldAcl, sidPtr)) {
+		const { oldAcl, labelAcl, descriptor } = readCurrentSecurity(api, path);
+		if (oldAcl !== null && labelAcl !== null && hasExactGrant(oldAcl, sidPtr) && hasExactDeny(oldAcl, worldSidPtr) && hasExactLabel(labelAcl, lowLabelSidPtr)) {
 			if (descriptor !== null) {
 				if (!isNullPtr$1(api.localFree(descriptor))) throwLastError$1(api, "LocalFree", `grantWrite(${path}) descriptor`);
 			}
 			return;
 		}
-		mergeAndApply(api, path, buildExplicitAccess(sidPtr, 1, GRANT_MASK), oldAcl, descriptor, "grantWrite");
+		let label;
+		try {
+			label = buildLowLabelAcl(api, lowLabelSidPtr);
+		} catch (error) {
+			if (descriptor !== null) api.localFree(descriptor);
+			throw error;
+		}
+		mergeAndApply(api, path, Buffer.concat([buildExplicitAccess(worldSidPtr, 3, 64, 2), buildExplicitAccess(sidPtr, 1, GRANT_MASK)]), oldAcl, {
+			kind: "apply",
+			acl: label
+		}, descriptor, "grantWrite");
 	});
 }
 /**
 * Remove every ACE for the capability SID from the directory DACL (REVOKE_ACCESS
-* merge — other entries are preserved). Returns whether an ACE removal was
-* attempted (false when the directory carries no DACL at all).
+* merge — other entries are preserved). The shared Low label is cleared only
+* when no other capability grant remains on the directory: two grants may
+* target one directory, and the surviving one still needs the label for its
+* child's writes. Returns whether an ACE removal was attempted (false when the
+* directory carries no DACL at all).
 *
 * Runs under the per-path lock (the whole get-merge-set sequence); the
-* descriptor/ACL allocation contract lives on {@link readCurrentDacl}.
+* descriptor/ACL allocation contract lives on {@link readCurrentSecurity}.
 * @param api - the binding table.
 * @param path - the directory whose DACL loses the capability-SID ACEs.
 * @param sidPtr - the capability SID whose ACEs are removed.
@@ -480,14 +623,14 @@ function grantWrite(api, path, sidPtr) {
 */
 function revokeWrite(api, path, sidPtr) {
 	return withPathLock(api, path, () => {
-		const { oldAcl, descriptor } = readCurrentDacl(api, path);
+		const { oldAcl, descriptor } = readCurrentSecurity(api, path);
 		if (oldAcl === null) {
 			if (descriptor !== null) {
 				if (!isNullPtr$1(api.localFree(descriptor))) throwLastError$1(api, "LocalFree", `revokeWrite(${path}) descriptor`);
 			}
 			return false;
 		}
-		mergeAndApply(api, path, buildExplicitAccess(sidPtr, 4, 0), oldAcl, descriptor, "revokeWrite");
+		mergeAndApply(api, path, buildExplicitAccess(sidPtr, 4, 0), oldAcl, hasForeignGrant(oldAcl, sidPtr) ? { kind: "keep" } : { kind: "clear" }, descriptor, "revokeWrite");
 		return true;
 	});
 }
@@ -673,6 +816,23 @@ function setTokenDefaultDaclGrant(api, token, sidPtr) {
 	}
 	api.localFree(newDacl);
 }
+/**
+* Lower the restricted token's integrity level to Low (S-1-16-4096), the level
+* the mandatory labels `grantWrite` applies are matched against; a token left
+* at Medium would ignore them. Requires TOKEN_ADJUST_DEFAULT on the token;
+* fails closed before any child is spawned.
+* @param api - the binding table.
+* @param token - the restricted token to lower.
+* @param lowLabelSidPtr - the Low integrity SID (S-1-16-4096).
+*/
+function restrictTokenIntegrity(api, token, lowLabelSidPtr) {
+	const sidLength = api.getLengthSid(lowLabelSidPtr);
+	if (sidLength === 0) throwLastError$1(api, "GetLengthSid", "Low integrity label SID");
+	const info = Buffer.alloc(16 + sidLength);
+	info.writeBigUInt64LE(ptrAddress(lowLabelSidPtr), 0);
+	info.writeUInt32LE(32, 8);
+	if (api.setTokenInformation(token, 25, info, info.length) === 0) throwLastError$1(api, "SetTokenInformation", "TokenIntegrityLevel (Low)");
+}
 /** Pack `SID_AND_ATTRIBUTES[count]` (16-byte stride; Attributes stay 0). */
 function buildRestrictingSids(sids) {
 	const buffer = Buffer.alloc(16 * sids.length);
@@ -741,34 +901,42 @@ function createRestrictedToken(api, currentToken, logonSid, writeSids, known, mo
 *
 * Fail-closed: `add` throws on any grant failure and the caller disposes the
 * instance (revoking every path granted so far); `dispose` revokes every
-* standing grant and reports every cleanup failure.
+* revocable grant, leaves the standing workspace edits in place, and reports
+* every cleanup failure.
 * @module @deepseek-ai/dsh-sandbox-windows-acl/grant
 */
 /**
 * One write SID's provider-lifetime grant materialization: the parsed SID
-* pointer plus every directory whose DACL currently carries its ACE.
-* Workspace paths are added STANDING (their ACEs are the cross-session reuse
-* cache and outlive the grant — dispose() skips revoking them, or the next
+* pointer plus every directory whose DACL currently carries its ACE and whose
+* label ACL carries the Low mandatory label. Workspace paths are added
+* STANDING (their security descriptor edits are the cross-session reuse cache
+* and outlive the grant — dispose() skips revoking them, or the next
 * provision would re-propagate the whole tree); temp paths are revocable
 * (dispose() revokes them — an inheritable ACE must not outlive its
 * session's temp directory). Create with {@link AclWriteGrant.create};
-* dispose revokes the revocable paths and frees the SID.
+* dispose revokes the revocable paths and frees every SID.
 */
 var AclWriteGrant = class AclWriteGrant {
 	/** The write SID in SDDL string form. */
 	writeSid;
 	api;
 	sidPtr;
+	lowLabelSidPtr;
+	worldSidPtr;
 	revocablePaths = [];
 	standingPaths = [];
-	constructor(api, sidPtr, writeSid) {
+	constructor(api, sidPtr, lowLabelSidPtr, worldSidPtr, writeSid) {
 		this.api = api;
 		this.sidPtr = sidPtr;
+		this.lowLabelSidPtr = lowLabelSidPtr;
+		this.worldSidPtr = worldSidPtr;
 		this.writeSid = writeSid;
 	}
 	/**
-	* Parse the SID string and open the binding table (lazily, once per
-	* server). Fail-closed: any failure throws — nothing is granted yet.
+	* Parse the SID string, create the Low integrity SID the grants label with
+	* and the world SID their ambient-delete deny names, and open the binding
+	* table (lazily, once per server). Fail-closed: any failure throws — nothing
+	* is granted yet.
 	* @param writeSid - the workspace (`S-1-4-x-y`) or temp (`S-1-4-x-y-1`) capability SID string.
 	* @param api - optional already-resolved bindings (tests).
 	* @returns the ready grant (no ACEs yet).
@@ -779,31 +947,43 @@ var AclWriteGrant = class AclWriteGrant {
 		if (bindings.convertStringSidToSidW(writeSid, sidSlot) === 0) throwLastError$1(bindings, "ConvertStringSidToSidW", writeSid);
 		const sidPtr = decodePtr(sidSlot);
 		if (sidPtr === null) throwLastError$1(bindings, "ConvertStringSidToSidW", `null SID for ${writeSid}`);
-		return new AclWriteGrant(bindings, sidPtr, writeSid);
+		try {
+			const lowLabelSidPtr = makeWellKnownSid(bindings, 66);
+			try {
+				return new AclWriteGrant(bindings, sidPtr, lowLabelSidPtr, makeWellKnownSid(bindings, 1), writeSid);
+			} catch (error) {
+				bindings.localFree(lowLabelSidPtr);
+				throw error;
+			}
+		} catch (error) {
+			bindings.localFree(sidPtr);
+			throw error;
+		}
 	}
 	/**
-	* Grant the write ACE on one directory (idempotent: an already-standing
-	* exact ACE skips the eager full-tree re-propagation — see
-	* {@link grantWrite}) and record the path for {@link dispose} unless it is
-	* standing. The path is recorded BEFORE the grant: a post-apply throw (a
-	* LocalFree failure after SetNamedSecurityInfoW succeeded) must still
-	* revoke it, and revoking an ungranted path is a no-op merge. Callers
-	* treat a throw as a failed materialization and dispose the instance to
-	* revoke the paths granted so far.
-	* @param path - the directory whose DACL gains the grant.
-	* @param standing - the ACE outlives this grant (the workspace reuse
+	* Grant the write ACE, the ambient-delete deny, and the Low mandatory label
+	* on one directory (idempotent: an already-standing exact ACE, deny, and
+	* label skip the eager full-tree re-propagation — see {@link grantWrite})
+	* and record the path for {@link dispose} unless it is standing. The path is
+	* recorded BEFORE the grant: a post-apply throw (a LocalFree failure after
+	* SetNamedSecurityInfoW succeeded) must still revoke it, and revoking an
+	* ungranted path is a no-op merge. Callers treat a throw as a failed
+	* materialization and dispose the instance to revoke the paths granted so
+	* far.
+	* @param path - the directory whose DACL and label gain the grant.
+	* @param standing - the edits outlive this grant (the workspace reuse
 	*   cache; dispose() skips revoking it). Default false (revoked on
 	*   dispose — the temp-directory lifecycle).
 	*/
 	add(path, standing = false) {
 		(standing ? this.standingPaths : this.revocablePaths).push(path);
-		grantWrite(this.api, path, this.sidPtr);
+		grantWrite(this.api, path, this.sidPtr, this.lowLabelSidPtr, this.worldSidPtr);
 	}
 	/** Every directory currently carrying the grant, in grant order. */
 	get paths() {
 		return [...this.standingPaths, ...this.revocablePaths];
 	}
-	/** Revoke every revocable grant (standing ACEs stay) and free the SID; reports every cleanup failure. */
+	/** Revoke every revocable grant (standing security descriptor edits stay) and free the SIDs; reports every cleanup failure. */
 	dispose() {
 		const failures = [];
 		for (const path of this.revocablePaths) try {
@@ -811,8 +991,12 @@ var AclWriteGrant = class AclWriteGrant {
 		} catch (error) {
 			failures.push(error);
 		}
-		try {
-			if (!isNullPtr$1(this.api.localFree(this.sidPtr))) throwLastError$1(this.api, "LocalFree", "write SID");
+		for (const [label, sidPtr] of [
+			["write SID", this.sidPtr],
+			["Low label SID", this.lowLabelSidPtr],
+			["world SID", this.worldSidPtr]
+		]) try {
+			if (!isNullPtr$1(this.api.localFree(sidPtr))) throwLastError$1(this.api, "LocalFree", label);
 		} catch (error) {
 			failures.push(error);
 		}
@@ -881,7 +1065,10 @@ function tempWriteSid(tempDir) {
 * keep-alive group logon SID + Everyone; Authenticated Users, INTERACTIVE,
 * and LOCAL are absent from both lists — see the seam's dual-list contract
 * in `packages/sandbox/sandbox-local` and the package README's Modes section
-* for the complete boundary). The write SID is the per-WORKSPACE identity
+* for the complete boundary). The intersection covers only the object's own
+* access check, so the token is also lowered to Low integrity and every
+* granted directory carries a Low no-write-up label and the ambient-delete
+* deny the `acl` module documents. The write SID is the per-WORKSPACE identity
 * ({@link workspaceWriteSid}): deterministic from the canonical workspace
 * path, so the workspace-root ACE materializes once per workspace per
 * machine and every later provision hits the exact-ACE skip — the
@@ -996,23 +1183,25 @@ var AclSandbox = class {
 				assertPrivateTempDisjoint(this.writableDirs, tempDir);
 			}
 			this.tempDirResolved = tempDir;
+			const lowLabelSid = makeWellKnownSid(api, 66);
+			const worldSid = makeWellKnownSid(api, 1);
+			this.sidAllocations.push(lowLabelSid, worldSid);
 			if (this.manageDacls) {
 				if (this.writeSidPtr !== void 0) {
-					for (const path of this.writableDirs) grantWrite(api, path, this.writeSidPtr);
+					for (const path of this.writableDirs) grantWrite(api, path, this.writeSidPtr, lowLabelSid, worldSid);
 					if (tempDir !== null && this.tempWriteSidPtr !== void 0) {
 						this.grantedPaths.push({
 							path: tempDir,
 							sidPtr: this.tempWriteSidPtr
 						});
-						grantWrite(api, tempDir, this.tempWriteSidPtr);
+						grantWrite(api, tempDir, this.tempWriteSidPtr, lowLabelSid, worldSid);
 					}
 				}
 			}
 			const logonSid = findLogonSid(api, currentToken);
 			this.sidAllocations.push(logonSid);
-			const worldSid = makeWellKnownSid(api, 1);
-			this.sidAllocations.push(worldSid);
 			restrictedToken = createRestrictedToken(api, currentToken, logonSid, [this.writeSidPtr, this.tempWriteSidPtr].filter((sid) => sid !== void 0), { world: worldSid }, this.mode);
+			restrictTokenIntegrity(api, restrictedToken, lowLabelSid);
 			this.token = restrictedToken;
 			setTokenDefaultDaclGrant(api, restrictedToken, this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid);
 			if (api.closeHandle(currentToken) === 0) throwLastError$1(api, "CloseHandle", "current process token");

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-sandbox-windows-acl",
   "description": "Windows ACL write-restriction sandbox backend (restricted-token spawn with capability-SID write allowlist) for the DeepSeek Harness sandbox seam",
-  "version": "0.1.6-alpha.2",
+  "version": "0.1.7-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -33,19 +33,19 @@
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-subprocess": "^0.1.6-alpha.2"
+    "@deepseek-ai/cordis": "~4.0.4",
+    "@deepseek-ai/dsh-subprocess": "0.1.7-alpha.2"
   },
   "dependencies": {
     "koffi": "^3.1.0",
-    "@deepseek-ai/dsh-lazy-require": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-win32-process": "^0.1.6-alpha.2"
+    "@deepseek-ai/dsh-lazy-require": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-win32-process": "0.1.7-alpha.2"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-pwsh-local": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-sandbox-local": "^0.1.6-alpha.2",
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-subprocess": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-subprocess-local": "^0.1.6-alpha.2"
+    "@deepseek-ai/dsh-pwsh-local": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-sandbox-local": "0.1.7-alpha.2",
+    "@deepseek-ai/cordis": "~4.0.4",
+    "@deepseek-ai/dsh-subprocess": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-subprocess-local": "0.1.7-alpha.2"
   }
 }