@dsh-electron/dsh-plugin-multi-root-workspace 0.1.6 → 0.1.7

package/lib/windows-runner.js

@@ -1,34 +1,1277 @@
-import { r as workspaceScopeSid, t as parseWindowsProfile } from "./windows-profile-CiFsFYIV.js";
-import { join } from "node:path";
-import { canonicalPath } from "@deepseek-ai/dsh-sandbox";
-import { closeSync, mkdtempSync, rmSync, statSync } from "node:fs";
+import { a as parseWindowsProfile, i as isWindowsNetworkOrDevicePath, n as assertWindowsDenyCapacity, o as rootDenySid, r as canonicalPath, s as workspaceScopeSid } from "./windows-runner-contract-CEfmZzu0.js";
+import { createRequire } from "node:module";
+import { closeSync, existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, statSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, win32 } from "node:path";
+import { createHash } from "node:crypto";
+import { pathToFileURL } from "node:url";
+import { createConnection } from "node:net";
+//#region src/compat/windows-native.ts
+/** Public Win32 process primitives, resolved from the upstream ACL installation.
+* The standalone runner has no host module resolver. No upstream private file
+* or load-time optional dependency is used here; unfamiliar exports fail closed.
+*/
+/** Decode the UTF-16 pointee, not a second string pointer stored at its first
+* code units. `decode(ptr, 'str16')` would dereference those units as an address.
+*/
+function readWindowsWideString(koffi, pointer) {
+	return String(koffi.decode(pointer, "char16_t", -1));
+}
+async function loadWindowsNative(upstreamRunner) {
+	const aclEntry = createRequire(upstreamRunner).resolve("@deepseek-ai/dsh-sandbox-windows-acl");
+	const fromAcl = createRequire(aclEntry);
+	const processApi = await import(pathToFileURL(fromAcl.resolve("@deepseek-ai/dsh-win32-process")).href);
+	const koffi = (await import(pathToFileURL(fromAcl.resolve("koffi")).href)).default;
+	for (const name of [
+		"extendWin32ProcessBindings",
+		"spawnInheritedJobProcess",
+		"waitForProcessExit"
+	]) if (typeof processApi[name] !== "function") throw new Error(`Windows ambient restriction requires public Win32 export ${name}`);
+	for (const name of [
+		"decode",
+		"address",
+		"load",
+		"alloc",
+		"free",
+		"encode"
+	]) if (typeof koffi?.[name] !== "function") throw new Error(`Windows ambient restriction requires Koffi ${name}`);
+	return {
+		...processApi,
+		koffi
+	};
+}
+/** Older public process helpers predate fd-7 CRT forwarding. Adapt the Win32
+* STARTUPINFO structure at the public binding seam, preserving argv and Job
+* ownership. New helpers already populate cbReserved2 and pass through.
+*/
+function spawnWindowsDeniedChild(native, api, options, activation) {
+	if (options.controlFileDescriptor !== void 0 && typeof api.getFileType !== "function") api = {
+		...api,
+		...native.extendWin32ProcessBindings(({ kernel32, bind }) => ({ getFileType: bind(kernel32, "GetFileType", "uint32", ["void*"]) }))
+	};
+	let launchApi = api;
+	if (activation !== void 0) launchApi = {
+		...api,
+		createProcessAsUserW: (...args) => {
+			if ((Number(args[6]) & 4) === 0) throw new Error("Windows deny activation requires a suspended child");
+			const result = api.createProcessAsUserW(activation.sourceToken, ...args.slice(1));
+			if (result === 0) return result;
+			const processInfo = Buffer.from(native.koffi.decode(args[10], "uint8", 24));
+			const process = native.koffi.decode(processInfo, "void*");
+			const thread = native.koffi.decode(processInfo.subarray(8), "void*");
+			try {
+				activation.assign(process, thread);
+			} catch (error) {
+				api.terminateProcess(process, 127);
+				api.closeHandle(thread);
+				api.closeHandle(process);
+				throw error;
+			}
+			return result;
+		}
+	};
+	if (options.controlFileDescriptor === void 0) return native.spawnInheritedJobProcess(launchApi, options);
+	const handle = api.uvGetOsfhandle(7);
+	if (api.getFileType(handle) !== 3) throw new Error("subprocess control descriptor is not a Windows pipe");
+	if (api.setHandleInformation(handle, 1, 1) === 0) throw new Error(`SetHandleInformation(control) failed (Win32 ${api.getLastError()})`);
+	const adapted = {
+		...launchApi,
+		createProcessAsUserW: (...args) => {
+			const original = Buffer.from(native.koffi.decode(args[9], "uint8", 104));
+			if (original.readUInt32LE(0) !== 104) throw new Error("unrecognized Windows STARTUPINFO layout");
+			if (original.readUInt16LE(66) !== 0) return launchApi.createProcessAsUserW(...args);
+			const count = 8;
+			const data = Buffer.alloc(76);
+			data.writeUInt32LE(count);
+			for (let fd = 0; fd < count; fd++) data.writeBigUInt64LE(18446744073709551615n, 12 + fd * 8);
+			for (const [fd, value] of [
+				[0, original.readBigUInt64LE(80)],
+				[1, original.readBigUInt64LE(88)],
+				[2, original.readBigUInt64LE(96)],
+				[7, handle]
+			]) {
+				const kind = api.getFileType(value);
+				data[4 + fd] = 1 | (kind === 3 ? 8 : kind === 2 ? 64 : 0);
+				data.writeBigUInt64LE(BigInt(value), 12 + fd * 8);
+			}
+			const reserved = native.koffi.alloc("uint8", data.length);
+			try {
+				native.koffi.encode(reserved, "uint8", data, data.length);
+				original.writeUInt16LE(data.length, 66);
+				original.writeBigUInt64LE(native.koffi.address(reserved), 72);
+				return launchApi.createProcessAsUserW(...args.slice(0, 9), original, ...args.slice(10));
+			} finally {
+				native.koffi.free(reserved);
+			}
+		}
+	};
+	try {
+		return native.spawnInheritedJobProcess(adapted, options);
+	} finally {
+		api.setHandleInformation(handle, 1, 0);
+	}
+}
+/**
+* Terminate a kill-on-close Job and wait until the kernel reports it drained.
+*
+* The public `waitForProcessExit` covers the direct child only: a descendant
+* the child spawned before exiting stays in the Job and could otherwise keep
+* running — with its restricted token — after the runner has released its
+* ancestor pins. `TerminateJobObject(job, 127)` kills every member; the
+* subsequent `QueryInformationJobObject` polling loop (class 1,
+* JOBOBJECT_BASIC_ACCOUNTING_INFORMATION, `ActiveProcesses` at byte 40) only
+* returns once the kernel reports none left. There is deliberately no
+* timeout: releasing pins while a live descendant remains is exactly the gap
+* this wait exists to close. The caller still owns and closes the Job handle
+* afterwards.
+*
+* Abnormal-error boundary: a TerminateJobObject or QueryInformationJobObject
+* API failure throws into the caller's teardown — the Job handle is still
+* closed there and its kill-on-close flag is the residual bound, same as the
+* forced-termination case: if the runner process itself is killed, no
+* in-process guarantee can survive, the Job flag takes the descendants down
+* with it, and the pin handles die with the process. Protection is promised
+* only through this orderly path.
+*/
+function terminateWindowsJobAndWait(native, api, job) {
+	const jobApi = {
+		...api,
+		...native.extendWin32ProcessBindings(({ kernel32, bind }) => ({
+			terminateJobObject: bind(kernel32, "TerminateJobObject", "int", ["void*", "uint32"]),
+			queryInformationJobObject: bind(kernel32, "QueryInformationJobObject", "int", [
+				"void*",
+				"int",
+				"void*",
+				"uint32",
+				"void*"
+			]),
+			sleep: bind(kernel32, "Sleep", "void", ["uint32"]),
+			getLastError: bind(kernel32, "GetLastError", "uint32", [])
+		}))
+	};
+	if (jobApi.terminateJobObject(job, 127) === 0) throw new Error(`TerminateJobObject failed (Win32 ${jobApi.getLastError()})`);
+	const info = Buffer.alloc(48);
+	for (;;) {
+		if (jobApi.queryInformationJobObject(job, 1, info, info.length, null) === 0) throw new Error(`QueryInformationJobObject failed (Win32 ${jobApi.getLastError()})`);
+		if (info.readUInt32LE(40) === 0) return;
+		jobApi.sleep(10);
+	}
+}
+//#endregion
+//#region src/compat/windows-path-guard.ts
+/** Windows deny-path pinning (branch-review Phase B).
+*
+* The ACL writer's deny ACEs follow the file OBJECT, not the registered
+* spelling: a restricted process that renames a deny root's ancestor moves
+* the protected tree to a NEW path the recorded deny set does not name — the
+* kernel still refuses that token's writes through the moved ACEs, but the
+* host fs fence, which matches the recorded spellings, no longer covers the
+* moved objects (the shell → host new-path gap, R1). This guard pins every
+* ancestor directory of every deny root with an open handle that shares read
+* and write but NOT delete — so a rename or delete of the registered tree
+* fails for the lifetime of the restricted child, without writing a single
+* persistent ACL on `C:\`, user directories, or anywhere else.
+*
+* `windows-deny.ts` owns the lifetime contract: handles are held until the
+* confined child AND its drained Job descendants have exited.
+*
+* Primitives are bound through the public `extendWin32ProcessBindings` seam —
+* no upstream private file, no new native dependency. Every verification uses
+* the same handle that pins the directory, so the checked object and the
+* pinned object are always the same one.
+*/
+/** The access an ancestor pin needs to PARTICIPATE in the delete-sharing
+* gate. Verified on Windows 11: a metadata-only open (FILE_READ_ATTRIBUTES
+* alone, even with share mode 0) is transparent to the gate — it neither
+* blocks a rename of the directory nor is blocked by a conflicting handle —
+* while verified data-read access (GENERIC_READ here) does block it: the pin
+* then holds renames while still sharing read and write.
+* A consequence, not a bug: an ancestor the caller cannot READ cannot be
+* pinned, and the pin fails closed instead of pretending. */
+const PIN_ACCESS = 2147483648;
+/** READ|WRITE sharing, deliberately WITHOUT FILE_SHARE_DELETE: that is the
+* whole mechanism — a rename or delete of a pinned directory needs delete
+* sharing on it, which nothing gets while a pin is held. */
+const SHARE_READ_WRITE = 3;
+const OPEN_EXISTING$1 = 3;
+/** Directory handles need BACKUP_SEMANTICS; OPEN_REPARSE_POINT makes the pin
+* land on the reparse point itself so the attribute check can refuse it. */
+const PIN_FLAGS = 35651584;
+const FILE_ATTRIBUTE_DIRECTORY$1 = 16;
+const FILE_ATTRIBUTE_REPARSE_POINT = 1024;
+const HANDLE_FLAG_INHERIT = 1;
+/** `\\?\` extended-length prefix on a normalized DOS volume name; a `UNC`
+* continuation means the handle resolved onto a network share. */
+const DOS_PREFIX = "\\\\?\\";
+/** Bind the file/handle primitives the guard needs through the public seam. */
+function pathGuardBindings(native) {
+	return native.extendWin32ProcessBindings(({ kernel32, bind }) => ({
+		createFileW: bind(kernel32, "CreateFileW", "void*", [
+			"str16",
+			"uint32",
+			"uint32",
+			"void*",
+			"uint32",
+			"uint32",
+			"void*"
+		]),
+		getFileInformationByHandle: bind(kernel32, "GetFileInformationByHandle", "int", ["void*", "void*"]),
+		getFinalPathNameByHandleW: bind(kernel32, "GetFinalPathNameByHandleW", "uint32", [
+			"void*",
+			"void*",
+			"uint32",
+			"uint32"
+		]),
+		getHandleInformation: bind(kernel32, "GetHandleInformation", "int", ["void*", "void*"]),
+		closeHandle: bind(kernel32, "CloseHandle", "int", ["void*"]),
+		getLastError: bind(kernel32, "GetLastError", "uint32", [])
+	}));
+}
+const isInvalidHandle = (handle) => handle === null || handle === void 0 || BigInt(handle) === -1n || BigInt(handle) === 0n || BigInt(handle) === 18446744073709551615n;
+/** BY_HANDLE_FILE_INFORMATION is 52 bytes (FILETIME members are DWORD-pairs):
+* attributes @0, volume serial @28, link count @40, file index high @44 /
+* low @48. Read back on the same handle that pins the path, so the identity
+* cannot drift between check and pin.
+*/
+function readWindowsPathIdentity(api, handle) {
+	const info = Buffer.alloc(52);
+	if (api.getFileInformationByHandle(handle, info) === 0) throw new Error(`GetFileInformationByHandle failed (Win32 ${api.getLastError()})`);
+	return {
+		attributes: info.readUInt32LE(0),
+		volumeSerial: info.readUInt32LE(28),
+		links: info.readUInt32LE(40),
+		fileIndex: BigInt(info.readUInt32LE(44)) << 32n | BigInt(info.readUInt32LE(48))
+	};
+}
+/**
+* The kernel's normalized DOS name for an open handle, compared against the
+* spelling the caller expected. Anything else — a junction-resolved target, a
+* UNC share, a device path — is a refusal, never an assumption.
+*/
+function readFinalPathName(api, handle, expected) {
+	let capacity = 260;
+	for (;;) {
+		const buffer = Buffer.alloc(capacity * 2);
+		const written = api.getFinalPathNameByHandleW(handle, buffer, capacity, 0);
+		if (written === 0) throw new Error(`GetFinalPathNameByHandleW(${expected}) failed (Win32 ${api.getLastError()})`);
+		if (written >= capacity) {
+			capacity = written + 1;
+			continue;
+		}
+		const name = buffer.subarray(0, written * 2).toString("utf16le");
+		const finalPath = name.startsWith(DOS_PREFIX) ? name.slice(4) : name;
+		if (finalPath.startsWith("UNC\\") || finalPath.startsWith("\\\\")) throw new Error(`deny path ancestor resolves to a non-local device: ${expected}`);
+		if (finalPath.toLowerCase() !== expected.toLowerCase()) throw new Error(`deny path ancestor resolves to "${finalPath}" instead of "${expected}"`);
+		return;
+	}
+}
+/**
+* Every directory that must not move for `roots` to keep their registered
+* meaning: the full chain from the drive root down to each deny root,
+* deduplicated and ordered shallow-first so a shared prefix is pinned once
+* and parents are held before their children.
+*
+* Roots must be canonical absolute local-drive spellings: relative input,
+* UNC, and device paths are rejected lexically before any filesystem touch.
+*/
+function denyPathChain(roots) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const root of roots) {
+		const normalized = win32.normalize(root);
+		if (!/^[a-zA-Z]:[\\/]/.test(normalized) || isWindowsNetworkOrDevicePath(normalized)) throw new Error(`deny root is not a canonical local-drive path: ${root}`);
+		let cursor = normalized.length > 3 ? normalized.replace(/[\\/]+$/, "") : normalized;
+		for (;;) {
+			if (!seen.has(cursor.toLowerCase())) seen.set(cursor.toLowerCase(), cursor);
+			const parent = win32.dirname(cursor);
+			if (parent === cursor) break;
+			cursor = parent;
+		}
+	}
+	const depth = (path) => path.split("\\").length - 1;
+	return [...seen.values()].sort((a, b) => depth(a) - depth(b) || a.localeCompare(b));
+}
+/** Close every handle, deepest first; collect rather than lose failures. */
+function closeAll(api, handles) {
+	const errors = [];
+	for (let index = handles.length - 1; index >= 0; index -= 1) try {
+		if (api.closeHandle(handles[index]) === 0) errors.push(/* @__PURE__ */ new Error(`CloseHandle failed (Win32 ${api.getLastError()})`));
+	} catch (error) {
+		errors.push(error instanceof Error ? error : new Error(String(error)));
+	}
+	return errors;
+}
+/**
+* Open a pin handle on every ancestor of every deny root — including the deny
+* root itself — and hold them all until {@link WindowsPathGuard.close}. Each
+* handle is opened with GENERIC_READ, read+write sharing, and a null security
+* descriptor so it is non-inheritable; the missing DELETE sharing is what
+* blocks renames, while ordinary reads and writes (and creating sibling files
+* inside a pinned directory) keep working.
+*
+* Every pin is verified on the same handle: the object must be a directory,
+* must not be a reparse point, must not carry the inherit flag (so a confined
+* child cannot simply `CloseHandle` the pin away), and its kernel-reported
+* final DOS path must equal the expected canonical spelling.
+* Any failure — open, verification, or a sharing conflict with a handle some
+* other component already holds — closes every earlier pin in reverse order
+* and refuses, keeping the launch fail-closed before spawn.
+*/
+function pinWindowsDenyPaths(native, roots) {
+	const api = pathGuardBindings(native);
+	const chain = denyPathChain(roots);
+	const handles = [];
+	try {
+		for (const path of chain) {
+			const handle = api.createFileW(path, PIN_ACCESS, SHARE_READ_WRITE, null, OPEN_EXISTING$1, PIN_FLAGS, null);
+			if (isInvalidHandle(handle)) throw new Error(`CreateFileW(${path}) failed (Win32 ${api.getLastError()})`);
+			handles.push(handle);
+			const identity = readWindowsPathIdentity(api, handle);
+			if ((identity.attributes & FILE_ATTRIBUTE_REPARSE_POINT) !== 0) throw new Error(`deny path ancestor is a reparse point: ${path}`);
+			if ((identity.attributes & FILE_ATTRIBUTE_DIRECTORY$1) === 0) throw new Error(`deny path ancestor is not a directory: ${path}`);
+			const flags = Buffer.alloc(4);
+			if (api.getHandleInformation(handle, flags) === 0) throw new Error(`GetHandleInformation(${path}) failed (Win32 ${api.getLastError()})`);
+			if ((flags.readUInt32LE() & HANDLE_FLAG_INHERIT) !== 0) throw new Error(`deny path handle is inheritable: ${path}`);
+			readFinalPathName(api, handle, path);
+		}
+	} catch (primary) {
+		const cleanup = closeAll(api, handles);
+		if (cleanup.length > 0) throw new AggregateError([primary instanceof Error ? primary : new Error(String(primary)), ...cleanup], primary instanceof Error ? primary.message : String(primary));
+		throw primary;
+	}
+	let closed = false;
+	return { close() {
+		if (closed) return;
+		closed = true;
+		const errors = closeAll(api, handles);
+		if (errors.length > 0) throw new AggregateError(errors, "WindowsPathGuard close failed");
+	} };
+}
+//#endregion
+//#region src/compat/windows-deny-preflight.ts
+/** Windows deny-tree preflight (branch-review Phase C1, R4).
+*
+* A deny ACE written through `SetSecurityInfo` lands on the file OBJECT — for
+* a hardlinked file every other link carries the same object, so a partial
+* ACL walk would have already mutated paths outside the denied tree by the
+* time a later hardlink is discovered. This module therefore scans EVERY deny
+* root and descendant — read-only, no ACL edits anywhere — before the runner
+* is allowed to request a token or touch a security descriptor. Any
+* uninspectable node or any plain file with more than one link refuses the
+* whole startup (exit 127 before side effects).
+*
+* The policy is conservative: `links > 1` fails even when every link appears
+* to live inside the same scanned tree, because the snapshot cannot prove
+* that topology (a link may be added or moved between scan and mutation).
+* Reparse points are recorded but never descended — a junction's target is a
+* different tree with its own policy and must not be scanned or mutated.
+*
+* `verifyHandle` re-checks identity on the same live handle about to be
+* ACL-mutated: a path replaced between scan and mutation fails closed rather
+* than writing a deny onto an object the preflight never inspected. This is
+* not transactional — a malicious concurrent mutation can still race between
+* the recheck and the write — but it closes the far cheaper
+* replace-between-scan-and-write window.
+*
+* Primitives are bound through the public `extendWin32ProcessBindings` seam;
+* only Node built-ins and local contract/native modules are imported.
+*/
+const FILE_READ_ATTRIBUTES = 128;
+const INSPECTION_SHARE = 7;
+const OPEN_EXISTING = 3;
+const OPEN_FLAGS = 35651584;
+const FILE_ATTRIBUTE_DIRECTORY = 16;
+const KIND_BITS = 1040;
+const FILE_TYPE_DISK = 1;
+const INVALID_HANDLE = BigInt("0xFFFFFFFFFFFFFFFF");
+const invalid = (handle) => handle === null || handle === void 0 || BigInt(handle) === INVALID_HANDLE || BigInt(handle) === -1n;
+const kindOf = (root, protectedHome) => protectedHome !== void 0 && root.toLowerCase() === protectedHome.toLowerCase() ? "protected DSH home" : "registered root";
+const hardlinkError = (root, path, links, protectedHome) => {
+	const kind = kindOf(root, protectedHome);
+	return /* @__PURE__ */ new Error(`hardlinked file inside the ${kind} ${root}: ${path} has links=${links}; a deny ACL written on one link mutates every link's shared object — ${kind === "protected DSH home" ? "replace the file with an independent copy — run `/workspace-folders isolate-profiles` to isolate the protected home, then reinstall the profile dependencies (do not skip this file)" : "replace the file with an independent copy (write its contents to a new file and rename that over it, or reinstall the dependency tree as copies)"}`);
+};
+/**
+* Scan every root recursively. The returned snapshot keys every node by its
+* lowercased walked spelling; a later same-key path (shared subtree) keeps
+* the first entry and is not re-scanned.
+*/
+function preflightWindowsDenyRoots(native, roots, protectedHome) {
+	const api = native.extendWin32ProcessBindings(({ kernel32, bind }) => ({
+		createFileW: bind(kernel32, "CreateFileW", "void*", [
+			"str16",
+			"uint32",
+			"uint32",
+			"void*",
+			"uint32",
+			"uint32",
+			"void*"
+		]),
+		getFileInformationByHandle: bind(kernel32, "GetFileInformationByHandle", "int", ["void*", "void*"]),
+		getFileType: bind(kernel32, "GetFileType", "uint32", ["void*"]),
+		closeHandle: bind(kernel32, "CloseHandle", "int", ["void*"]),
+		getLastError: bind(kernel32, "GetLastError", "uint32", [])
+	}));
+	const entries = /* @__PURE__ */ new Map();
+	/**
+	* Open, identify, record, then close — the handle never outlives the node.
+	* Every failure names the root and the path; a close failure is reported on
+	* its own when it is the only error and aggregated (never masking) when the
+	* inspection itself already failed.
+	*/
+	const inspect = (root, path) => {
+		const handle = api.createFileW(path, FILE_READ_ATTRIBUTES, INSPECTION_SHARE, 0, OPEN_EXISTING, OPEN_FLAGS, 0);
+		if (invalid(handle)) throw new Error(`deny preflight cannot inspect ${path} under root ${root}: CreateFileW Win32 ${api.getLastError()}`);
+		let primary;
+		let identity;
+		try {
+			identity = readWindowsPathIdentity(api, handle);
+			if ((identity.attributes & KIND_BITS) === 0) {
+				if (api.getFileType(handle) !== FILE_TYPE_DISK) throw new Error(`deny preflight refuses non-disk file ${path} under root ${root}`);
+				if (identity.links > 1) throw hardlinkError(root, path, identity.links, protectedHome);
+			}
+		} catch (error) {
+			primary = error instanceof Error ? error : new Error(String(error));
+		}
+		const closed = api.closeHandle(handle) !== 0;
+		if (primary !== void 0) {
+			if (!closed) throw new AggregateError([primary, /* @__PURE__ */ new Error(`CloseHandle failed on the inspection handle: Win32 ${api.getLastError()}`)], `deny preflight failed for ${path} under root ${root} and its cleanup also failed`);
+			throw primary;
+		}
+		if (!closed) throw new Error(`deny preflight cannot close the inspection handle for ${path} under root ${root}: Win32 ${api.getLastError()}`);
+		return identity;
+	};
+	const scanNode = (root, path) => {
+		const key = path.toLowerCase();
+		if (entries.has(key)) return;
+		const identity = inspect(root, path);
+		entries.set(key, {
+			root,
+			path,
+			identity
+		});
+		if ((identity.attributes & KIND_BITS) !== FILE_ATTRIBUTE_DIRECTORY) return;
+		const canonical = canonicalPath(path);
+		if (win32.normalize(canonical).toLowerCase() !== key) throw new Error(`deny preflight refuses aliased directory ${path} under root ${root}: resolves to ${canonical}`);
+		let names;
+		try {
+			names = readdirSync(path).sort();
+		} catch (error) {
+			throw new Error(`deny preflight cannot list ${path} under root ${root}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		for (const name of names) scanNode(root, win32.join(path, name));
+	};
+	for (const root of roots) {
+		const canonicalRoot = win32.normalize(canonicalPath(root));
+		const identity = inspect(canonicalRoot, canonicalRoot);
+		if ((identity.attributes & KIND_BITS) !== FILE_ATTRIBUTE_DIRECTORY) throw new Error(`deny preflight refuses root ${canonicalRoot}: it must be a plain directory`);
+		entries.set(canonicalRoot.toLowerCase(), {
+			root: canonicalRoot,
+			path: canonicalRoot,
+			identity
+		});
+		let names;
+		try {
+			names = readdirSync(canonicalRoot).sort();
+		} catch (error) {
+			throw new Error(`deny preflight cannot list root ${canonicalRoot}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		for (const name of names) scanNode(canonicalRoot, win32.join(canonicalRoot, name));
+	}
+	return {
+		entries,
+		verifyHandle(liveApi, path, handle) {
+			const entry = entries.get(path.toLowerCase());
+			if (entry === void 0) throw new Error(`deny preflight has no snapshot for ${path} — refusing to mutate an uninspected path`);
+			let fresh;
+			try {
+				fresh = readWindowsPathIdentity(liveApi, handle);
+			} catch (error) {
+				throw new Error(`deny preflight cannot re-verify ${path}: ${error instanceof Error ? error.message : String(error)}`);
+			}
+			if ((fresh.attributes & KIND_BITS) !== (entry.identity.attributes & KIND_BITS)) throw new Error(`deny preflight refuses ${entry.path}: attributes changed since the scan (was 0x${entry.identity.attributes.toString(16)}, now 0x${fresh.attributes.toString(16)})`);
+			if (fresh.volumeSerial !== entry.identity.volumeSerial || fresh.fileIndex !== entry.identity.fileIndex) throw new Error(`deny preflight refuses ${entry.path}: the path was replaced by a different file object since the scan`);
+			if ((entry.identity.attributes & KIND_BITS) === 0 && fresh.links !== 1) throw hardlinkError(entry.root, entry.path, fresh.links, protectedHome);
+		}
+	};
+}
+//#endregion
+//#region src/windows-broker.ts
+/** Client of the administrator-installed deny-token broker. Requests carry
+* only the caller process token handle and bounded deny identities.
+*/
+function brokerPipeName(userSid) {
+	if (!/^S-1-[0-9]+(?:-[0-9]+)+$/.test(userSid)) throw new Error("invalid broker user SID");
+	return `DshMultiRootBroker-${createHash("sha256").update(userSid).digest("hex").slice(0, 16)}`;
+}
+/** The broker must acknowledge before any ACL edits or process creation. The
+* caller independently reads the deny-only groups from the token;
+* even an impersonated pipe server cannot fabricate that kernel state.
+*/
+async function requestDenyToken(userSid, tokenHandle, deniedIds) {
+	if (tokenHandle <= 0n || tokenHandle > 18446744073709551615n || deniedIds.length === 0 || deniedIds.length > 256 || deniedIds.some((id) => !/^S-1-4-(?:[0-9]{1,10}-){4}3$/.test(id))) throw new Error("invalid deny-token broker request");
+	const pipe = `\\\\.\\pipe\\${brokerPipeName(userSid)}`;
+	return await new Promise((resolve, reject) => {
+		const socket = createConnection(pipe);
+		let response = "";
+		const timer = setTimeout(() => finish(/* @__PURE__ */ new Error("deny-token broker timed out")), 1e4);
+		const finish = (error, handle) => {
+			clearTimeout(timer);
+			socket.destroy();
+			if (error === void 0 && handle !== void 0) resolve(handle);
+			else reject(error ?? /* @__PURE__ */ new Error("missing broker token handle"));
+		};
+		socket.once("connect", () => {
+			socket.write(`2|${tokenHandle}|${deniedIds.join(",")}\n`);
+		});
+		socket.once("error", (error) => finish(/* @__PURE__ */ new Error(`Windows read-only roots require the installed privileged broker (${brokerPipeName(userSid)}): ${error.message}`)));
+		socket.once("end", () => {
+			if (!response.includes("\n")) finish(/* @__PURE__ */ new Error("deny-token broker disconnected"));
+		});
+		socket.on("data", (bytes) => {
+			response += bytes.toString("utf8");
+			if (response.length > 1024) return finish(/* @__PURE__ */ new Error("invalid deny-token broker response"));
+			const end = response.indexOf("\n");
+			if (end < 0) return;
+			const line = response.slice(0, end);
+			if (/^OK\|[1-9][0-9]{0,19}$/.test(line)) {
+				const handle = BigInt(line.slice(3));
+				if (handle <= 18446744073709551615n) return finish(void 0, handle);
+			}
+			finish(/* @__PURE__ */ new Error(`deny-token broker refused: ${line}`));
+		});
+	});
+}
+/** Synchronous, bounded RPC inside the public suspended-create binding. The
+* caller verifies the child's kernel token before the helper can resume it.
+*/
+function assignDenyToken(userSid, processHandle, threadHandle, deniedIds, io) {
+	if (processHandle <= 0n || threadHandle <= 0n || processHandle > 18446744073709551615n || threadHandle > 18446744073709551615n || deniedIds.length < 1 || deniedIds.length > 256 || deniedIds.some((id) => !/^S-1-4-(?:[0-9]{1,10}-){4}3$/.test(id))) throw new Error("invalid deny-token assignment request");
+	const pipe = io.open(`\\\\.\\pipe\\${brokerPipeName(userSid)}`);
+	try {
+		const deadline = Date.now() + 1e4;
+		io.write(pipe, Buffer.from(`3|${processHandle}|${threadHandle}|${deniedIds.join(",")}\n`, "ascii"));
+		let response = "";
+		while (!response.includes("\n")) {
+			if (Date.now() > deadline) throw new Error("deny-token assignment timed out");
+			const count = io.available(pipe);
+			if (count > 1024 || response.length + count > 1024) throw new Error("invalid deny-token assignment response");
+			if (count > 0) response += io.read(pipe, count).toString("utf8");
+			else io.pause();
+		}
+		if (response.slice(0, response.indexOf("\n")) !== "OK") throw new Error(`deny-token assignment refused: ${response.trim()}`);
+	} finally {
+		io.close(pipe);
+	}
+}
+//#endregion
+//#region src/windows-deny.ts
+/** Ambient ACL writes minus registered read-only roots (Windows B9).
+*
+* The restricting list mirrors the caller's enabled identities. Inherited
+* deny-only NORMAL groups identify denied roots to ordinary deny ACEs in
+* the NORMAL access check, so narrowing the SID list cannot discard the deny.
+* Privileges that could bypass the DACL are removed; integrity is not lowered.
+* Standing ACEs retain the restriction for running children and concurrent
+* snapshots. They are never revoked during runner teardown.
+*
+* OWNER RIGHTS suppresses owner-implicit WRITE_DAC; the actual owner receives
+* that right explicitly so the unrestricted host keeps it. Parent guards stop
+* FILE_DELETE_CHILD and ACL rewrites from bypassing a child's DELETE deny.
+* Protected descendants get explicit ACEs (inherited denies can lose to an
+* explicit allow, or fail to reach a protected DACL). Reparse points are not
+* followed: targets have their own canonical policy and must not be mutated.
+*/
+const WRITE_DAC = 262144;
+const MUTATION = 852310;
+async function runWindowsDenied(upstreamRunner, roots, argv, protectedHome) {
+	assertWindowsDenyCapacity(roots.length);
+	if (process.arch !== "x64" && process.arch !== "arm64") throw new Error("Windows ambient restriction requires a 64-bit process");
+	const verifyRoots = () => {
+		for (const root of roots) {
+			if (!isAbsolute(root) || isWindowsNetworkOrDevicePath(root)) throw new Error(`unsupported deny root: ${root}`);
+			if (!statSync(root).isDirectory() || canonicalPath(root).toLowerCase() !== root.toLowerCase()) throw new Error(`deny root was removed or redirected: ${root}`);
+		}
+	};
+	verifyRoots();
+	const native = await loadWindowsNative(upstreamRunner);
+	const api = native.extendWin32ProcessBindings(({ kernel32, advapi32, bind }) => {
+		return Object.fromEntries(Object.entries({
+			openProcess: [
+				kernel32,
+				"void*",
+				[
+					"uint32",
+					"int",
+					"uint32"
+				]
+			],
+			openProcessToken: [
+				advapi32,
+				"int",
+				[
+					"void*",
+					"uint32",
+					"void*"
+				]
+			],
+			getTokenInformation: [
+				advapi32,
+				"int",
+				[
+					"void*",
+					"int",
+					"void*",
+					"uint32",
+					"void*"
+				]
+			],
+			setTokenInformation: [
+				advapi32,
+				"int",
+				[
+					"void*",
+					"int",
+					"void*",
+					"uint32"
+				]
+			],
+			createRestrictedToken: [
+				advapi32,
+				"int",
+				[
+					"void*",
+					"uint32",
+					"uint32",
+					"void*",
+					"uint32",
+					"void*",
+					"uint32",
+					"void*",
+					"void*"
+				]
+			],
+			createFileW: [
+				kernel32,
+				"void*",
+				[
+					"str16",
+					"uint32",
+					"uint32",
+					"void*",
+					"uint32",
+					"uint32",
+					"void*"
+				]
+			],
+			convertStringSidToSidW: [
+				advapi32,
+				"int",
+				["str16", "void*"]
+			],
+			localFree: [
+				kernel32,
+				"void*",
+				["void*"]
+			],
+			getLengthSid: [
+				advapi32,
+				"uint32",
+				["void*"]
+			],
+			equalSid: [
+				advapi32,
+				"int",
+				["void*", "void*"]
+			],
+			convertSidToStringSidW: [
+				advapi32,
+				"int",
+				["void*", "void*"]
+			],
+			getSecurityInfo: [
+				advapi32,
+				"uint32",
+				[
+					"void*",
+					"int",
+					"uint32",
+					"void*",
+					"void*",
+					"void*",
+					"void*",
+					"void*"
+				]
+			],
+			setSecurityInfo: [
+				advapi32,
+				"uint32",
+				[
+					"void*",
+					"int",
+					"uint32",
+					"void*",
+					"void*",
+					"void*",
+					"void*"
+				]
+			],
+			setEntriesInAclW: [
+				advapi32,
+				"uint32",
+				[
+					"uint32",
+					"void*",
+					"void*",
+					"void*"
+				]
+			],
+			getFileInformationByHandle: [
+				kernel32,
+				"int",
+				["void*", "void*"]
+			],
+			convertStringSecurityDescriptorToSecurityDescriptorW: [
+				advapi32,
+				"int",
+				[
+					"str16",
+					"uint32",
+					"void*",
+					"void*"
+				]
+			],
+			getSecurityDescriptorDacl: [
+				advapi32,
+				"int",
+				[
+					"void*",
+					"void*",
+					"void*",
+					"void*"
+				]
+			],
+			initializeAcl: [
+				advapi32,
+				"int",
+				[
+					"void*",
+					"uint32",
+					"uint32"
+				]
+			],
+			getAce: [
+				advapi32,
+				"int",
+				[
+					"void*",
+					"uint32",
+					"void*"
+				]
+			],
+			addAce: [
+				advapi32,
+				"int",
+				[
+					"void*",
+					"uint32",
+					"uint32",
+					"void*",
+					"uint32"
+				]
+			],
+			getTempPathW: [
+				kernel32,
+				"uint32",
+				["uint32", "void*"]
+			],
+			getPackageFullName: [
+				kernel32,
+				"int32",
+				[
+					"void*",
+					"void*",
+					"void*"
+				]
+			],
+			writeFile: [
+				kernel32,
+				"int",
+				[
+					"void*",
+					"void*",
+					"uint32",
+					"void*",
+					"void*"
+				]
+			],
+			readFile: [
+				kernel32,
+				"int",
+				[
+					"void*",
+					"void*",
+					"uint32",
+					"void*",
+					"void*"
+				]
+			],
+			peekNamedPipe: [
+				kernel32,
+				"int",
+				[
+					"void*",
+					"void*",
+					"uint32",
+					"void*",
+					"void*",
+					"void*"
+				]
+			],
+			sleep: [
+				kernel32,
+				"void",
+				["uint32"]
+			],
+			lockFileEx: [
+				kernel32,
+				"int",
+				[
+					"void*",
+					"uint32",
+					"uint32",
+					"uint32",
+					"uint32",
+					"void*"
+				]
+			],
+			unlockFileEx: [
+				kernel32,
+				"int",
+				[
+					"void*",
+					"uint32",
+					"uint32",
+					"uint32",
+					"void*"
+				]
+			]
+		}).map(([name, [library, result, args]]) => [name, bind(library, name[0].toUpperCase() + name.slice(1), result, args)]));
+	});
+	const pointer = (buffer, offset = 0) => native.koffi.decode(buffer.subarray(offset), "void*");
+	const check = (ok, name) => {
+		if (ok === 0) throw new Error(`${name} failed (Win32 ${api.getLastError()})`);
+	};
+	const status = (code, name) => {
+		if (code !== 0) throw new Error(`${name} failed (Win32 ${code})`);
+	};
+	const parsedSids = [];
+	const sid = (text) => {
+		const out = Buffer.alloc(8);
+		check(api.convertStringSidToSidW(text, out), "ConvertStringSidToSidW");
+		const value = pointer(out);
+		parsedSids.push(value);
+		return value;
+	};
+	const writePointer = (buffer, offset, value) => {
+		buffer.writeBigUInt64LE(native.koffi.address(value), offset);
+	};
+	const info = (token, cls) => {
+		const size = Buffer.alloc(4);
+		api.getTokenInformation(token, cls, null, 0, size);
+		const length = size.readUInt32LE();
+		if (length < 8 || length > 1048576) throw new Error(`invalid TokenInformation size: ${length}`);
+		const data = Buffer.alloc(length);
+		check(api.getTokenInformation(token, cls, data, length, size), "GetTokenInformation");
+		return data;
+	};
+	const retained = [];
+	let currentToken;
+	let restrictedToken;
+	let pathGuard;
+	let primary;
+	let threw = false;
+	let exitCode = 0;
+	try {
+		pathGuard = pinWindowsDenyPaths(native, roots);
+		const preflight = preflightWindowsDenyRoots(native, roots, protectedHome);
+		const processHandle = api.openProcess(1024, 0, process.pid);
+		check(Number(processHandle !== null && processHandle !== 0), "OpenProcess");
+		const out = Buffer.alloc(8);
+		try {
+			check(api.openProcessToken(processHandle, 262283, out), "OpenProcessToken");
+		} finally {
+			check(api.closeHandle(processHandle), "CloseHandle(process)");
+		}
+		currentToken = pointer(out);
+		const user = info(currentToken, 1);
+		const groups = info(currentToken, 2);
+		retained.push(user, groups);
+		const userSid = pointer(user);
+		const identities = [userSid];
+		const owners = [userSid];
+		const count = groups.readUInt32LE();
+		if (count > (groups.length - 8) / 16) throw new Error("truncated TokenGroups");
+		for (let i = 0; i < count; i++) {
+			const offset = 8 + i * 16;
+			const attributes = groups.readUInt32LE(offset + 8);
+			if ((attributes & 4) === 0 || (attributes & 16) !== 0) continue;
+			const group = pointer(groups, offset);
+			identities.push(group);
+			if ((attributes & 8) !== 0) owners.push(group);
+		}
+		const ownerRights = sid("S-1-3-4");
+		const denies = roots.map(rootDenySid);
+		const list = Buffer.alloc(identities.length * 16);
+		identities.forEach((value, i) => writePointer(list, i * 16, value));
+		const sidOut = Buffer.alloc(8);
+		check(api.convertSidToStringSidW(userSid, sidOut), "ConvertSidToStringSidW");
+		const text = pointer(sidOut);
+		let minted;
+		let brokerUser;
+		try {
+			brokerUser = readWindowsWideString(native.koffi, text);
+			const handle = await requestDenyToken(brokerUser, native.koffi.address(currentToken), denies);
+			const bytes = Buffer.alloc(8);
+			bytes.writeBigUInt64LE(handle);
+			minted = pointer(bytes);
+		} finally {
+			api.localFree(text);
+		}
+		const restrictedOut = Buffer.alloc(8);
+		try {
+			check(api.createRestrictedToken(minted, 1, 0, null, 0, null, identities.length, list, restrictedOut), "CreateRestrictedToken");
+		} finally {
+			api.closeHandle(minted);
+		}
+		restrictedToken = pointer(restrictedOut);
+		const verifyDenyGroups = (token) => {
+			const denyGroups = info(token, 2);
+			const denyCount = denyGroups.readUInt32LE();
+			if (denyCount > (denyGroups.length - 8) / 16) throw new Error("truncated deny TokenGroups");
+			const verified = /* @__PURE__ */ new Set();
+			for (let i = 0; i < denyCount; i++) {
+				const offset = 8 + i * 16;
+				const flags = denyGroups.readUInt32LE(offset + 8);
+				if ((flags & 16) === 0 || (flags & 6) !== 0) continue;
+				const valueOut = Buffer.alloc(8);
+				check(api.convertSidToStringSidW(pointer(denyGroups, offset), valueOut), "ConvertSidToStringSidW(group)");
+				const value = pointer(valueOut);
+				try {
+					verified.add(readWindowsWideString(native.koffi, value));
+				} finally {
+					api.localFree(value);
+				}
+			}
+			if (denies.some((id) => !verified.has(id))) throw new Error("broker did not install the deny-only normal groups");
+		};
+		verifyDenyGroups(restrictedToken);
+		const entry = (trustee, mode, mask, inheritance) => {
+			const data = Buffer.alloc(48);
+			data.writeUInt32LE(mask, 0);
+			data.writeUInt32LE(mode, 4);
+			data.writeUInt32LE(inheritance, 8);
+			writePointer(data, 40, trustee);
+			return data;
+		};
+		const tokenAclOut = Buffer.alloc(8);
+		status(api.setEntriesInAclW(3, Buffer.concat([
+			entry(userSid, 3, 786656, 0),
+			entry(userSid, 1, 268435456, 0),
+			entry(ownerRights, 1, 131072, 0)
+		]), null, tokenAclOut), "SetEntriesInAclW(token)");
+		const tokenAcl = pointer(tokenAclOut);
+		try {
+			status(api.setSecurityInfo(restrictedToken, 6, 4, null, null, tokenAcl, null), "SetSecurityInfo(token)");
+			const defaultDacl = Buffer.alloc(8);
+			writePointer(defaultDacl, 0, tokenAcl);
+			check(api.setTokenInformation(restrictedToken, 6, defaultDacl, 8), "SetTokenInformation(TokenDefaultDacl)");
+		} finally {
+			api.localFree(tokenAcl);
+		}
+		const tempPath = Buffer.alloc(65536);
+		const tempLength = api.getTempPathW(32768, tempPath);
+		if (tempLength === 0 || tempLength >= 32768) throw new Error("GetTempPathW failed");
+		const lockDirectory = join(tempPath.subarray(0, tempLength * 2).toString("utf16le"), "dsh-acl-locks");
+		mkdirSync(lockDirectory, { recursive: true });
+		const protect = (path, denyId, mask, inheritance, verifyContent = true) => {
+			const lockPath = join(lockDirectory, `${createHash("sha256").update(path.toLowerCase()).digest("hex").slice(0, 16)}.lock`);
+			const lock = api.createFileW(lockPath, 3221225472, 3, null, 4, 0, null);
+			if (lock === null || BigInt(lock) === -1n || BigInt(lock) === 18446744073709551615n) throw new Error(`CreateFileW(lock) failed (Win32 ${api.getLastError()})`);
+			const overlapped = native.koffi.alloc("uint8", 32);
+			native.koffi.encode(overlapped, "uint8", Buffer.alloc(32), 32);
+			let held = false;
+			try {
+				check(api.lockFileEx(lock, 2, 0, 1, 0, overlapped), `LockFileEx(${path})`);
+				held = true;
+				const ownerOut = Buffer.alloc(8);
+				const aclOut = Buffer.alloc(8);
+				const sdOut = Buffer.alloc(8);
+				const handle = api.createFileW(path, 393216, 7, null, 3, 35651584, null);
+				if (handle === null || BigInt(handle) === -1n || BigInt(handle) === 18446744073709551615n) throw new Error(`CreateFileW(${path}) failed (Win32 ${api.getLastError()})`);
+				if (verifyContent) try {
+					preflight.verifyHandle(api, path, handle);
+				} catch (error) {
+					api.closeHandle(handle);
+					throw error;
+				}
+				try {
+					status(api.getSecurityInfo(handle, 1, 5, ownerOut, null, aclOut, null, sdOut), `GetSecurityInfo(${path})`);
+				} catch (error) {
+					api.closeHandle(handle);
+					throw error;
+				}
+				const descriptor = pointer(sdOut);
+				let merged;
+				try {
+					const owner = pointer(ownerOut);
+					if (!owners.some((value) => api.equalSid(owner, value) !== 0)) throw new Error(`deny ACL requires caller-owned path: ${path}`);
+					const oldAcl = pointer(aclOut);
+					if (oldAcl === null || oldAcl === 0n) throw new Error(`deny ACL cannot preserve a null DACL: ${path}`);
+					const edits = Buffer.concat([entry(ownerRights, 1, 131072, inheritance), entry(owner, 1, WRITE_DAC, inheritance)]);
+					const mergedOut = Buffer.alloc(8);
+					status(api.setEntriesInAclW(2, edits, oldAcl, mergedOut), `SetEntriesInAclW(${path})`);
+					merged = pointer(mergedOut);
+					const descriptorOut = Buffer.alloc(8);
+					const flags = inheritance === 3 ? "OICI" : "";
+					check(api.convertStringSecurityDescriptorToSecurityDescriptorW(`D:(D;${flags};0x${mask.toString(16)};;;${denyId})`, 1, descriptorOut, null), "ConvertStringSecurityDescriptorToSecurityDescriptorW(normal-group deny)");
+					const conditionalDescriptor = pointer(descriptorOut);
+					try {
+						const present = Buffer.alloc(4), acl = Buffer.alloc(8), defaulted = Buffer.alloc(4);
+						check(api.getSecurityDescriptorDacl(conditionalDescriptor, present, acl, defaulted), "GetSecurityDescriptorDacl");
+						const first = Buffer.alloc(8);
+						check(api.getAce(pointer(acl), 0, first), "GetAce(normal-group deny)");
+						const header = Buffer.from(native.koffi.decode(pointer(first), "uint8", 4));
+						const denyBytes = Buffer.from(native.koffi.decode(pointer(first), "uint8", header.readUInt16LE(2)));
+						const count = Buffer.from(native.koffi.decode(merged, "uint8", 8)).readUInt16LE(4);
+						const others = [];
+						for (let index = 0; index < count; index++) {
+							const ace = Buffer.alloc(8);
+							check(api.getAce(merged, index, ace), "GetAce(existing)");
+							const h = Buffer.from(native.koffi.decode(pointer(ace), "uint8", 4));
+							const bytes = Buffer.from(native.koffi.decode(pointer(ace), "uint8", h.readUInt16LE(2)));
+							if (!bytes.equals(denyBytes)) others.push(bytes);
+						}
+						const size = 8 + denyBytes.length + others.reduce((total, bytes) => total + bytes.length, 0);
+						if (size > 65535) throw new Error(`deny ACL exceeds the Windows ACL size limit: ${path}`);
+						const combined = Buffer.alloc(size);
+						check(api.initializeAcl(combined, size, 4), "InitializeAcl");
+						for (const bytes of [denyBytes, ...others]) check(api.addAce(combined, 4, 4294967295, bytes, bytes.length), "AddAce");
+						if (verifyContent) preflight.verifyHandle(api, path, handle);
+						status(api.setSecurityInfo(handle, 1, 4, null, null, combined, null), `SetSecurityInfo(${path})`);
+					} finally {
+						api.localFree(conditionalDescriptor);
+					}
+				} finally {
+					if (merged !== void 0) api.localFree(merged);
+					api.localFree(descriptor);
+					check(api.closeHandle(handle), "CloseHandle(path)");
+				}
+			} finally {
+				try {
+					if (held) check(api.unlockFileEx(lock, 0, 1, 0, overlapped), "UnlockFileEx");
+				} finally {
+					native.koffi.free(overlapped);
+					check(api.closeHandle(lock), "CloseHandle(lock)");
+				}
+			}
+		};
+		const expectedChildren = /* @__PURE__ */ new Map();
+		for (const scanned of preflight.entries.values()) {
+			const parent = dirname(scanned.path).toLowerCase();
+			if (parent === scanned.path.toLowerCase()) continue;
+			const names = expectedChildren.get(parent) ?? /* @__PURE__ */ new Set();
+			names.add(basename(scanned.path));
+			expectedChildren.set(parent, names);
+		}
+		const denyIdFor = new Map(roots.map((root, i) => [root.toLowerCase(), denies[i]]));
+		for (const scanned of preflight.entries.values()) {
+			const isPlainDirectory = (scanned.identity.attributes & 1040) === 16;
+			if (isPlainDirectory) {
+				let names;
+				try {
+					names = readdirSync(scanned.path).sort();
+				} catch (error) {
+					throw new Error(`deny tree changed during ACL writes: cannot list ${scanned.path} (${error instanceof Error ? error.message : String(error)})`);
+				}
+				const expected = expectedChildren.get(scanned.path.toLowerCase()) ?? /* @__PURE__ */ new Set();
+				if (names.length !== expected.size || names.some((name) => !expected.has(name))) throw new Error(`deny tree changed since the preflight scan: ${scanned.path}`);
+			}
+			protect(scanned.path, denyIdFor.get(scanned.root.toLowerCase()), MUTATION, isPlainDirectory ? 3 : 0);
+		}
+		roots.forEach((root, i) => {
+			protect(dirname(root), denies[i], 786496, 0, false);
+		});
+		verifyRoots();
+		process.on("SIGINT", () => {});
+		const control = process.env.DSH_SUBPROCESS_CONTROL === "pipe";
+		const child = spawnWindowsDeniedChild(native, api, {
+			token: restrictedToken,
+			command: argv[0],
+			args: argv.slice(1),
+			cwd: process.cwd(),
+			...control ? { controlFileDescriptor: 7 } : {}
+		}, {
+			sourceToken: currentToken,
+			assign(child, thread) {
+				const packageNameLength = Buffer.alloc(4);
+				const packageProbe = api.getPackageFullName(child, packageNameLength, null);
+				if (packageProbe === 122) {
+					const nameBuffer = Buffer.alloc(packageNameLength.readUInt32LE() * 2);
+					const read = api.getPackageFullName(child, packageNameLength, nameBuffer);
+					const fullName = read === 0 ? nameBuffer.subarray(0, (packageNameLength.readUInt32LE() - 1) * 2).toString("utf16le") : `<unreadable, Win32 ${read}>`;
+					throw new Error(`deny launch refused: ${argv[0]} started as packaged (MSIX/Microsoft Store) application ${fullName}; a packaged process carries a package identity the deny token cannot preserve. Install the MSI or ZIP build of PowerShell (or use a non-packaged executable) and put it ahead of the WindowsApps alias on PATH`);
+				}
+				if (packageProbe !== 15700) throw new Error(`GetPackageFullName(child) failed (Win32 ${packageProbe})`);
+				assignDenyToken(brokerUser, native.koffi.address(child), native.koffi.address(thread), denies, {
+					open(pipe) {
+						const handle = api.createFileW(pipe, 3221225472, 0, null, 3, 0, null);
+						if (handle === null || BigInt(handle) === -1n || BigInt(handle) === 18446744073709551615n) throw new Error(`Open broker assignment pipe failed (Win32 ${api.getLastError()})`);
+						return handle;
+					},
+					write(pipe, bytes) {
+						const count = Buffer.alloc(4);
+						check(api.writeFile(pipe, bytes, bytes.length, count, null), "WriteFile(broker)");
+						if (count.readUInt32LE() !== bytes.length) throw new Error("incomplete broker assignment write");
+					},
+					available(pipe) {
+						const count = Buffer.alloc(4);
+						check(api.peekNamedPipe(pipe, null, 0, null, count, null), "PeekNamedPipe(broker)");
+						return count.readUInt32LE();
+					},
+					read(pipe, length) {
+						const data = Buffer.alloc(length), count = Buffer.alloc(4);
+						check(api.readFile(pipe, data, length, count, null), "ReadFile(broker)");
+						if (count.readUInt32LE() === 0) throw new Error("broker assignment disconnected");
+						return data.subarray(0, count.readUInt32LE());
+					},
+					pause() {
+						api.sleep(10);
+					},
+					close(pipe) {
+						api.closeHandle(pipe);
+					}
+				});
+				const out = Buffer.alloc(8);
+				check(api.openProcessToken(child, 8, out), "OpenProcessToken(assigned child)");
+				const token = pointer(out);
+				try {
+					verifyDenyGroups(token);
+				} finally {
+					api.closeHandle(token);
+				}
+			}
+		});
+		let waitError;
+		let waitThrew = false;
+		let waited = false;
+		try {
+			if (control) closeSync(7);
+			waited = true;
+			exitCode = native.waitForProcessExit(api, child.process);
+		} catch (error) {
+			waitError = error;
+			waitThrew = true;
+		}
+		const drainErrors = [];
+		try {
+			terminateWindowsJobAndWait(native, api, child.job);
+		} catch (error) {
+			drainErrors.push(error instanceof Error ? error : new Error(String(error)));
+		}
+		try {
+			check(api.closeHandle(child.job), "CloseHandle(job)");
+		} catch (error) {
+			drainErrors.push(error instanceof Error ? error : new Error(String(error)));
+		}
+		if (!waited) try {
+			check(api.closeHandle(child.process), "CloseHandle(child process)");
+		} catch (error) {
+			drainErrors.push(error instanceof Error ? error : new Error(String(error)));
+		}
+		if (waitThrew || drainErrors.length > 0) {
+			const all = [...waitThrew ? [waitError instanceof Error ? waitError : new Error(String(waitError))] : [], ...drainErrors];
+			if (all.length === 1) throw all[0];
+			throw new AggregateError(all, all[0].message);
+		}
+	} catch (error) {
+		primary = error;
+		threw = true;
+	}
+	const cleanupErrors = [];
+	const attempt = (operation) => {
+		try {
+			operation();
+		} catch (error) {
+			cleanupErrors.push(error instanceof Error ? error : new Error(String(error)));
+		}
+	};
+	attempt(() => {
+		if (restrictedToken !== void 0) check(api.closeHandle(restrictedToken), "CloseHandle(restricted token)");
+	});
+	attempt(() => {
+		if (currentToken !== void 0) check(api.closeHandle(currentToken), "CloseHandle(token)");
+	});
+	for (const value of parsedSids) attempt(() => api.localFree(value));
+	retained.length = 0;
+	attempt(() => pathGuard?.close());
+	if (threw) {
+		if (cleanupErrors.length === 0) throw primary;
+		throw new AggregateError([primary instanceof Error ? primary : new Error(String(primary)), ...cleanupErrors], primary instanceof Error ? primary.message : String(primary));
+	}
+	if (cleanupErrors.length === 1) throw cleanupErrors[0];
+	if (cleanupErrors.length > 1) throw new AggregateError(cleanupErrors, "Windows ambient deny cleanup failed");
+	return exitCode;
+}
+//#endregion
 //#region src/windows-runner.ts
-/** Standalone runner: public upstream AclSandbox with a capability for the whole root set. */
+/**
+* Standalone runner: public upstream AclSandbox with a capability for the
+* whole root set.
+*
+* This file is built into `lib/windows-runner.js` and executed as a SEPARATE
+* Node process. The host's in-process plugin package resolution does not
+* apply there, so this module (and everything it statically imports — only
+* `windows-runner-contract.ts`) may import `node:` builtins exclusively. The
+* upstream ACL package is reached dynamically through `--upstream-runner`:
+* `createRequire(<upstream runner>).resolve('@deepseek-ai/dsh-sandbox-windows-acl')
+* resolves the package by self-reference from its own install location — the
+* one anchor guaranteed to see it.
+*/
 async function main() {
 	if (process.platform !== "win32") throw new Error("Windows ACL runner requires Windows");
 	const raw = process.argv.slice(2);
 	const separator = raw.indexOf("--");
 	if (separator < 0 || raw[separator + 1] === void 0) throw new Error("missing command after --");
 	const profile = parseWindowsProfile(raw.slice(0, separator), true);
-	const roots = [.../* @__PURE__ */ new Set([profile.workspace, ...profile.additionalRoots])];
-	for (const root of roots) if (!statSync(root).isDirectory() || canonicalPath(root) !== root) throw new Error(`workspace root was removed or redirected: ${root}`);
-	const { AclSandbox, assertTempRootOutsideWorkspace, workspaceWriteSid, tempWriteSid } = await import("@deepseek-ai/dsh-sandbox-windows-acl");
+	if (profile.mode === "danger-full-access") return await runWindowsDenied(profile.upstreamRunner, profile.deniedRoots, raw.slice(separator + 1), profile.protectedHome);
+	const roots = profile.mode === "read-only" ? [...new Set(profile.additionalRoots)] : [.../* @__PURE__ */ new Set([profile.workspace, ...profile.additionalRoots])];
+	const verifyRoots = () => {
+		for (const root of roots) {
+			if (isWindowsNetworkOrDevicePath(root)) throw new Error(`Windows ACL confinement cannot cover network or device paths: ${root}`);
+			if (!statSync(root).isDirectory() || canonicalPath(root) !== root) throw new Error(`workspace root was removed or redirected: ${root}`);
+		}
+	};
+	verifyRoots();
+	if (!existsSync(profile.temp) || !statSync(profile.temp).isDirectory()) throw new Error(`--temp is not an existing directory: ${profile.temp}`);
+	const aclEntry = createRequire(profile.upstreamRunner).resolve("@deepseek-ai/dsh-sandbox-windows-acl");
+	const { AclSandbox, assertTempRootOutsideWorkspace, workspaceWriteSid, tempWriteSid } = await import(pathToFileURL(aclEntry).href);
 	if (profile.writeSid !== void 0 && (profile.writeSid !== workspaceWriteSid(profile.workspace) || profile.tempWriteSid !== tempWriteSid(profile.temp))) throw new Error("upstream capability SIDs do not match their paths");
 	for (const root of roots) assertTempRootOutsideWorkspace(root, profile.temp);
-	const temp = mkdtempSync(join(profile.temp, "dsh-multi-root-"));
+	const temp = profile.mode === "workspace-write" ? mkdtempSync(join(profile.temp, "dsh-multi-root-")) : null;
 	const sandbox = new AclSandbox({
 		writableDirs: roots,
 		tempDir: temp,
 		writeSid: workspaceScopeSid(roots),
-		tempWriteSid: tempWriteSid(temp),
+		...temp === null ? {} : { tempWriteSid: tempWriteSid(temp) },
 		mode: "workspace-write"
 	});
 	let initialized = false;
 	try {
 		await sandbox.init();
 		initialized = true;
-		process.env.TMP = temp;
-		process.env.TEMP = temp;
+		verifyRoots();
+		if (temp !== null) {
+			process.env.TMP = temp;
+			process.env.TEMP = temp;
+		}
 		process.on("SIGINT", () => {});
 		const control = process.env.DSH_SUBPROCESS_CONTROL === "pipe";
 		const child = sandbox.spawn({
@@ -46,7 +1289,7 @@ async function main() {
 			reportCleanup(error);
 		}
 		try {
-			rmSync(temp, {
+			if (temp !== null) rmSync(temp, {
 				recursive: true,
 				force: true
 			});