@gmickel/gno 2.7.0 → 2.7.1

package/README.md

@@ -139,7 +139,7 @@ See the [guide](docs/COMPILED-CONTEXT.md).
 
 <!-- public-truth:current-version -->
 
-> Current source version: **v2.7.0**. See [CHANGELOG.md](./CHANGELOG.md).
+> Current source version: **v2.7.1**. See [CHANGELOG.md](./CHANGELOG.md).
 
 <!-- /public-truth -->
 
@@ -184,9 +184,8 @@ See the [guide](docs/COMPILED-CONTEXT.md).
   explicit read-only retrieval smoke from Connectors.
 - **One resident gateway**: `gno serve` and `gno daemon` now host stateful
   Streamable HTTP MCP at `/mcp` from the same long-lived runtime as their
-  watcher, jobs, stores, and models. The packed npm smoke proves two-client
-  parity, warm reuse, redacted lifecycle status, fail-closed security, restart,
-  and shutdown.
+  watcher, jobs, stores, and models. Several MCP clients can share one
+  resident process and get the same results as stdio MCP.
 - **Knowledge Delta**: `gno changes`, `gno diff`, and `gno impact` expose
   bounded metadata-only history, structural change summaries, and explainable
   dependency paths across CLI, REST, MCP, and SDK.
@@ -215,17 +214,13 @@ See the [guide](docs/COMPILED-CONTEXT.md).
   `local_only`, `lan`, or `remote` boundary that follows mixed and derived
   evidence through resident serving, inference, publishing, exports, Capsules,
   and traces. Authentication never overrides policy.
-- **Source availability (`any` | `local`)**: opt-in `local` refuses
-  cloud-placeholder materialization on the macOS File Provider layouts covered
-  by physical evidence (Google Drive, iCloud Drive, and OneDrive for both
-  validated immediate SharePoint library roots). Hierarchical directory
-  classification + guarded content recheck; skips are not conversion errors;
-  unproven prefixes preserve indexed descendants. Distinct from egress.
-  Unsupported platforms fail closed; no claim of zero provider activity or
-  universal provider support. On the controlled 5,000-file all-local corpus,
-  production `any` regressed -1.1280% and hierarchical `local` added 1.1841%
-  median traversal overhead (2 warmups, 9 samples per lane; same corpus and
-  interleaved pre-implementation/current production walkers).
+- **Source availability (`any` | `local`)**: opt-in `local` indexes only files
+  already on disk and never makes a cloud provider download one. Supported on
+  macOS with Google Drive, iCloud Drive, and OneDrive SharePoint library roots.
+  Cloud-only files are skipped and reported, not treated as conversion errors,
+  and documents under a cloud-only folder stay indexed. Other platforms fail
+  with an error. On a 5,000-file all-local collection, `local` scans about 1%
+  slower than `any`.
 - **Read-only integrity audits**: `gno audit` and MCP `gno_audit` inspect local
   links, declared provenance, and source/index freshness offline. Stable,
   bounded findings distinguish complete, partial, unavailable, and changing
@@ -240,7 +235,7 @@ See the [guide](docs/COMPILED-CONTEXT.md).
 <!-- public-truth:default-embed-model -->
 - **Default Embed Model**: all four built-in presets use `Qwen3-Embedding-0.6B-GGUF`; see the dated, fixture-scoped evidence below
 <!-- /public-truth -->
-- **Regression Fixes**: tightened phrase/negation/hyphen/underscore BM25 behavior, cleaned non-TTY hyperlink output, improved `gno doctor` chunking and embedding fingerprint visibility, and fixed the embedding autoresearch harness
+- **Regression Fixes**: tightened phrase/negation/hyphen/underscore BM25 behavior, cleaned non-TTY hyperlink output, and improved `gno doctor` chunking and embedding fingerprint visibility
 
 ### Upgrading Existing Collections
 
@@ -1318,10 +1313,10 @@ Current product stance:
 
 Why Qwen is the current default:
 
-- matches or exceeds `bge-m3` on the tiny canonical benchmark
-- significantly beats `bge-m3` on the real GNO `src/serve` code slice
-- also beats `bge-m3` on a pinned public-OSS code slice
-- also beats `bge-m3` on the multilingual prose/docs benchmark lane
+- ties `bge-m3` on the small [canonical code benchmark](./evals/fixtures/code-embedding-benchmark/canonical.md) (vector nDCG@10 `0.95` each)
+- beats `bge-m3` on [GNO's own web server code](./evals/fixtures/code-embedding-benchmark/repo-serve.md) (`0.8102` vs `0.1003`)
+- beats `bge-m3` on [pinned open-source code slices](./evals/fixtures/code-embedding-benchmark/oss-slices.md) (`1.0` vs `0.6116`)
+- beats `bge-m3` on the multilingual prose/docs benchmark below
 
 Current trade-off:
 
@@ -1340,7 +1335,7 @@ bun run bench:general-embeddings --candidate qwen3-embedding-0.6b --write
 
 <!-- public-truth:general-embedding-benchmark -->
 
-The immutable April 2026 FastAPI-docs run used 15 documents in five corpus
+The April 2026 FastAPI-docs run used 15 documents in five corpus
 languages (`en`, `de`, `fr`, `es`, `zh`) and 13 queries:
 
 - [bge-m3 incumbent](./evals/fixtures/general-embedding-benchmark/2026-04-06-bge-m3-incumbent.md): vector nDCG@10 `0.3503`, hybrid nDCG@10 `0.642`
@@ -1362,23 +1357,23 @@ languages.
 
 <!-- public-truth:cjk-lexical-benchmark -->
 
-Lexical fallback has separate evidence. The immutable
+Lexical fallback has separate evidence. The
 [July 22, 2026 CJK result](./evals/fixtures/cjk-lexical-benchmark/2026-07-22.md)
 uses 21 synthetic documents and 25 same-language queries across Chinese,
-Japanese, and Korean. Production BM25 lexical results and frozen floors:
+Japanese, and Korean. Production BM25 lexical results and the promotion floors:
 
 - Chinese: baseline Recall@10 `0.2222`, nDCG@10 `0.1481`, zero-result `0.7778`; promotion Recall@10 `0.4722`, nDCG@10 `0.3981`, maximum zero-result `0.5278`
 - Japanese: baseline Recall@10 `0.125`, nDCG@10 `0.125`, zero-result `0.875`; promotion Recall@10 `0.375`, nDCG@10 `0.375`, maximum zero-result `0.625`
 - Korean: baseline Recall@10 `0.5`, nDCG@10 `0.5`, zero-result `0.5`; promotion Recall@10 `0.75`, nDCG@10 `0.75`, maximum zero-result `0.25`
 
-The
+The "promotion" values are the floors a CJK-aware lexical analyzer must reach
+before GNO ships one.
 [promotion-gates.md](./evals/fixtures/cjk-lexical-benchmark/promotion-gates.md)
-also bind MRR, non-regression, and cost requirements. This lexical result does
-not reduce or replace the semantic evidence above. All positive qrels use
-relevance `3`, so
-nDCG measures placement but not distinctions among positive gain grades.
-Production tokenization is unchanged; improvements remain gated work for
-`fn-109`.
+lists them along with MRR, non-regression, and cost requirements. No analyzer
+has met them, so production BM25 tokenization is unchanged. These lexical
+numbers do not measure semantic retrieval. All positive qrels use relevance
+`3`, so nDCG measures placement but not distinctions among positive gain
+grades.
 
 <!-- /public-truth -->
 

package/browser-extension/artifacts/gno-browser-clipper-v2.7.1.zip.sha256

@@ -0,0 +1 @@
+0566f9eb5eb5db6a1632063e63f37dab01a9d2a0aa3dde5658356926a53c395e  gno-browser-clipper-v2.7.1.zip

package/browser-extension/dist/manifest.json

@@ -21,5 +21,5 @@
   "content_security_policy": {
     "extension_pages": "script-src 'self'; object-src 'none'; connect-src http://127.0.0.1:*"
   },
-  "version": "2.7.0"
+  "version": "2.7.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gmickel/gno",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "Local semantic search for your documents. Index Markdown, PDF, and Office files with hybrid BM25 + vector search.",
   "keywords": [
     "embeddings",
@@ -89,6 +89,7 @@
     "smoke:serve-shutdown": "bun scripts/serve-shutdown-smoke.ts",
     "test:watcher:filesystem": "bun test test/serve/watch-service-filesystem.test.ts test/serve/resident-runtime.test.ts",
     "bench:watcher-reconciliation": "bun scripts/watcher-reconciliation-benchmark.ts",
+    "bench:session-import": "bun scripts/session-import-benchmark.ts",
     "smoke:watcher-reconciliation": "bun scripts/watcher-reconciliation-smoke.ts",
     "bench:code-embeddings": "bun scripts/code-embedding-benchmark.ts",
     "bench:code-embeddings:write": "bun scripts/code-embedding-benchmark.ts --write",

package/spec/output-schemas/collection-list.schema.json

@@ -6,7 +6,7 @@
   "type": "array",
   "items": {
     "type": "object",
-    "required": ["name", "path", "pattern", "include", "exclude"],
+    "required": ["name", "pattern", "include", "exclude"],
     "properties": {
       "name": {
         "type": "string",
@@ -15,7 +15,7 @@
       },
       "path": {
         "type": "string",
-        "description": "Absolute path to collection root directory"
+        "description": "Absolute path to collection root directory. Same-host callers only: omitted for a remote REST caller."
       },
       "pattern": {
         "type": "string",

package/spec/output-schemas/status.schema.json

@@ -90,24 +90,18 @@
     },
     "configPath": {
       "type": "string",
-      "description": "Path to config file"
+      "description": "Path to config file. Same-host callers only: omitted for a remote REST or HTTP MCP caller."
     },
     "dbPath": {
       "type": "string",
-      "description": "Path to SQLite database"
+      "description": "Path to SQLite database. Same-host callers only: omitted for a remote REST or HTTP MCP caller."
     },
     "collections": {
       "type": "array",
       "description": "Collection statistics",
       "items": {
         "type": "object",
-        "required": [
-          "name",
-          "path",
-          "documentCount",
-          "chunkCount",
-          "embeddedCount"
-        ],
+        "required": ["name", "documentCount", "chunkCount", "embeddedCount"],
         "properties": {
           "name": {
             "type": "string",
@@ -115,7 +109,7 @@
           },
           "path": {
             "type": "string",
-            "description": "Collection root path"
+            "description": "Collection root path. Same-host callers only: omitted for a remote REST or HTTP MCP caller."
           },
           "documentCount": {
             "type": "integer",
@@ -595,13 +589,14 @@
           "type": "array",
           "items": {
             "type": "object",
-            "required": ["label", "path", "reason"],
+            "required": ["label", "reason"],
             "properties": {
               "label": {
                 "type": "string"
               },
               "path": {
-                "type": "string"
+                "type": "string",
+                "description": "Suggested folder path. Same-host callers only: omitted for a remote REST or HTTP MCP caller."
               },
               "reason": {
                 "type": "string"
@@ -883,10 +878,11 @@
         },
         "cache": {
           "type": "object",
-          "required": ["path", "totalSizeBytes", "totalSizeLabel"],
+          "required": ["totalSizeBytes", "totalSizeLabel"],
           "properties": {
             "path": {
-              "type": "string"
+              "type": "string",
+              "description": "Model cache directory. Same-host callers only: omitted for a remote REST or HTTP MCP caller."
             },
             "totalSizeBytes": {
               "type": "integer",
@@ -941,7 +937,6 @@
                   "role",
                   "uri",
                   "cached",
-                  "path",
                   "sizeBytes",
                   "statusLabel"
                 ],
@@ -957,7 +952,8 @@
                     "type": "boolean"
                   },
                   "path": {
-                    "type": ["string", "null"]
+                    "type": ["string", "null"],
+                    "description": "Cached model file, or null when not cached. Same-host callers only: omitted for a remote REST or HTTP MCP caller."
                   },
                   "sizeBytes": {
                     "type": ["integer", "null"],

package/src/cli/commands/ask.ts

@@ -81,6 +81,36 @@ export type AskCommandResult =
     }
   | { success: false; error: string };
 
+/**
+ * Give every document URI `?index=` on a named index, like search and
+ * Capsule results: results, citations and the answer-context selection.
+ */
+export function decorateAskUris(
+  result: AskResult,
+  indexName: string | undefined
+): AskResult {
+  const decorate = <T extends { uri: string }>(item: T): T => ({
+    ...item,
+    uri: decorateUriForIndex(item.uri, indexName),
+  });
+  const answerContext = result.meta.answerContext;
+  return {
+    ...result,
+    results: result.results.map(decorate),
+    citations: result.citations?.map(decorate),
+    meta: answerContext
+      ? {
+          ...result.meta,
+          answerContext: {
+            ...answerContext,
+            selected: answerContext.selected.map(decorate),
+            dropped: answerContext.dropped.map(decorate),
+          },
+        }
+      : result.meta,
+  };
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Command Implementation
 // ─────────────────────────────────────────────────────────────────────────────
@@ -435,20 +465,9 @@ export async function ask(
         return { success: false, error: finalized.error.message };
       }
     }
-    // URIs carry `?index=` like search and Capsule results on a named index.
     return {
       success: true,
-      data: {
-        ...askResult,
-        results: askResult.results.map((result) => ({
-          ...result,
-          uri: decorateUriForIndex(result.uri, globals.index),
-        })),
-        citations: askResult.citations?.map((citation) => ({
-          ...citation,
-          uri: decorateUriForIndex(citation.uri, globals.index),
-        })),
-      },
+      data: decorateAskUris(askResult, globals.index),
       metadata: traceSession?.metadata(),
     };
   } catch (cause) {

package/src/cli/commands/ls.ts

@@ -7,6 +7,7 @@
 
 import type { DocumentRow, StorePort, StoreResult } from "../../store/types";
 
+import { decorateUriForIndex } from "../../app/constants";
 import { initStore } from "./shared";
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -145,7 +146,11 @@ export async function ls(
     // Apply offset and limit
     const offset = options.offset ?? 0;
     const limit = options.limit ?? 20;
-    const paged = allActive.slice(offset, offset + limit);
+    // Sorted on canonical URIs; the output URIs carry `?index=` like search.
+    const paged = allActive.slice(offset, offset + limit).map((doc) => ({
+      ...doc,
+      uri: decorateUriForIndex(doc.uri, options.indexName),
+    }));
 
     return {
       success: true,

package/src/core/host-paths.ts

@@ -6,26 +6,44 @@
  * peek receipts). A remote caller identifies documents by `uri` and
  * collection-relative `relPath` instead, so every `absPath` key is removed
  * before a payload leaves a remote-reachable surface.
+ *
+ * Status, collection, and connector payloads also name owner configuration
+ * locations: `configPath`, `dbPath`, and `path` (collection roots, suggested
+ * folders, model cache and model files, connector targets). A remote caller
+ * identifies a collection by `name`, so those keys are removed from those
+ * payloads too.
  */
 
-const HOST_PATH_FIELD = "absPath";
+/** Document host path key of result payloads. */
+export const HOST_PATH_FIELDS: ReadonlySet<string> = new Set(["absPath"]);
+
+/** Owner configuration path keys of status, collection, and connector payloads. */
+export const OWNER_CONFIG_PATH_FIELDS: ReadonlySet<string> = new Set([
+  "configPath",
+  "dbPath",
+  "path",
+]);
 
 const isPlainObject = (value: object): boolean => {
   const proto = Object.getPrototypeOf(value) as object | null;
   return proto === Object.prototype || proto === null;
 };
 
-/** Deep copy of a JSON-shaped value with every `absPath` key removed. */
-export function withoutHostPaths<T>(value: T): T {
+/** Deep copy of a JSON-shaped value with every key in `fields` removed. */
+export function withoutFields<T>(value: T, fields: ReadonlySet<string>): T {
   if (Array.isArray(value)) {
-    return value.map((item: unknown) => withoutHostPaths(item)) as T;
+    return value.map((item: unknown) => withoutFields(item, fields)) as T;
   }
   if (value === null || typeof value !== "object" || !isPlainObject(value)) {
     return value;
   }
   const copy: Record<string, unknown> = {};
   for (const [key, entry] of Object.entries(value)) {
-    if (key !== HOST_PATH_FIELD) copy[key] = withoutHostPaths(entry);
+    if (!fields.has(key)) copy[key] = withoutFields(entry, fields);
   }
   return copy as T;
 }
+
+/** Deep copy of a JSON-shaped value with every `absPath` key removed. */
+export const withoutHostPaths = <T>(value: T): T =>
+  withoutFields(value, HOST_PATH_FIELDS);

package/src/core/request-receipts.ts

@@ -11,14 +11,18 @@
  */
 
 import { Database } from "bun:sqlite";
-// node:fs/promises chmod/mkdir: filesystem structure ops, no Bun equivalent
-import { chmod, mkdir } from "node:fs/promises";
+// node:fs/promises chmod/mkdir/lstat/readdir: filesystem structure ops, no Bun equivalent
+import { chmod, lstat, mkdir, readdir } from "node:fs/promises";
 // node:path has no Bun path utilities
 import { basename, dirname, join } from "node:path";
 
 import { MCP_ERRORS } from "./errors";
 import { withWriteLock } from "./file-lock";
-import { windowsPrivatePath } from "./windows-private-path";
+import {
+  isOwnerOnlyDescriptor,
+  windowsDirectoryDescriptor,
+  windowsPrivatePath,
+} from "./windows-private-path";
 import { writeLeasePath } from "./write-lease";
 
 /** Committed receipts keep their full outcome this long, then become tombstones. */
@@ -221,25 +225,75 @@ CREATE TABLE IF NOT EXISTS request_receipts (
 /** Ledger directories whose owner-only Windows DACL this process verified. */
 const privateLedgerDirs = new Set<string>();
 
+/** Inside the ledger directory: what the last authoritative check verified. */
+const LEDGER_DIR_MARKER = ".owner-only-verified";
+
+export interface PrivateDirAcl {
+  /** Authoritative check (spawns PowerShell); `create` sets the owner-only DACL first. */
+  verify: (dir: string, create: boolean) => Promise<void>;
+  /** In-process owner and DACL bytes, or null when they cannot be read. */
+  descriptor: (dir: string) => Uint8Array | null;
+}
+
+const WINDOWS_ACL: PrivateDirAcl = {
+  verify: windowsPrivatePath,
+  descriptor: windowsDirectoryDescriptor,
+};
+
+/** Directory identity plus descriptor digest; null unless owner-only. */
+async function ledgerDirStamp(
+  dir: string,
+  acl: PrivateDirAcl
+): Promise<string | null> {
+  const { dev, ino } = await lstat(dir, { bigint: true });
+  const descriptor = acl.descriptor(dir);
+  if (!descriptor || !isOwnerOnlyDescriptor(descriptor)) return null;
+  const digest = new Bun.CryptoHasher("sha256")
+    .update(descriptor)
+    .digest("hex");
+  return `${dev}:${ino}:${digest}`;
+}
+
 /**
  * Windows ignores POSIX modes: give a new ledger directory the current-user
  * DACL before SQLite creates the database or its WAL/SHM (they inherit it),
  * and refuse an existing one that grants another principal access.
+ *
+ * The PowerShell check costs a process start, so its success is recorded in a
+ * marker inside the directory. A later open skips it only when the directory
+ * is the same object and its owner and DACL are byte-identical to the verified
+ * ones and still owner-only; reading the marker at all requires access that
+ * owner-only DACL grants. Anything else re-runs the authoritative check.
+ *
+ * An existing but empty directory is secured like a new one: a first open
+ * interrupted before its DACL was set leaves exactly that, and nothing inside
+ * it could have been exposed.
  */
-async function secureLedgerDir(
+export async function securePrivateLedgerDir(
   dir: string,
-  created: string | undefined
+  created: boolean,
+  acl: PrivateDirAcl = WINDOWS_ACL
 ): Promise<void> {
-  if (process.platform !== "win32" || privateLedgerDirs.has(dir)) return;
-  await windowsPrivatePath(dir, created !== undefined);
-  privateLedgerDirs.add(dir);
+  const marker = Bun.file(join(dir, LEDGER_DIR_MARKER));
+  if (!created) {
+    const stamp = await ledgerDirStamp(dir, acl);
+    if (stamp !== null && stamp === (await marker.text().catch(() => null)))
+      return;
+  }
+  const secure = created || (await readdir(dir)).length === 0;
+  await acl.verify(dir, secure);
+  const stamp = await ledgerDirStamp(dir, acl);
+  if (stamp !== null) await Bun.write(marker, stamp);
 }
 
 async function openLedger(path: string): Promise<Database> {
   try {
     const dir = dirname(path);
     const created = await mkdir(dir, { recursive: true, mode: 0o700 });
-    await secureLedgerDir(dir, created);
+    if (process.platform === "win32" && !privateLedgerDirs.has(dir)) {
+      await securePrivateLedgerDir(dir, created !== undefined);
+      privateLedgerDirs.add(dir);
+    }
     const db = new Database(path, { create: true, strict: true });
     try {
       // POSIX: private before any journal file exists (they inherit this mode).

package/src/core/windows-private-path.ts

@@ -1,6 +1,9 @@
 /** Windows owner-only evidence storage. Paths are data, never interpolated script.
  * Fresh Windows objects may use the token default Owner instead of its User.
  * Only those exact owner SIDs are accepted; allowed DACL entries remain User-only. */
+// bun:ffi — reading a security descriptor in-process needs advapi32; Bun has no ACL API
+import { dlopen, FFIType } from "bun:ffi";
+
 // Use framework APIs directly: module auto-discovery depends on profile paths
 // deliberately absent from isolated native workers.
 const ACL = `
@@ -65,7 +68,8 @@ export async function windowsPrivatePath(
       // ACL checks return no data; do not allocate an unused stdout pipe.
       stdout: "ignore",
       stderr: "pipe",
-      timeout: 10000,
+      // A cold PowerShell start on a loaded host can take over 10s.
+      timeout: 30000,
     }
   );
   const reader = child.stderr.getReader();
@@ -94,3 +98,134 @@ export async function windowsPrivatePath(
     await child.exited;
   }
 }
+
+const OWNER_AND_DACL = 0x1 | 0x4; // OWNER_ | DACL_SECURITY_INFORMATION
+const FILE_ATTRIBUTE_DIRECTORY = 0x10;
+const FILE_ATTRIBUTE_REPARSE_POINT = 0x4_00;
+const INVALID_FILE_ATTRIBUTES = 0xff_ff_ff_ff;
+const SECURITY_DESCRIPTOR_MAX_BYTES = 65_536;
+
+interface Win32Security {
+  getFileAttributes: (path: Uint8Array) => number;
+  getFileSecurity: (
+    path: Uint8Array,
+    info: number,
+    descriptor: Uint8Array,
+    length: number,
+    needed: Uint32Array
+  ) => number;
+}
+
+let win32Security: Win32Security | null | undefined;
+
+function loadWin32Security(): Win32Security | null {
+  if (win32Security !== undefined) return win32Security;
+  try {
+    const kernel32 = dlopen("kernel32.dll", {
+      GetFileAttributesW: { args: [FFIType.ptr], returns: FFIType.u32 },
+    });
+    const advapi32 = dlopen("advapi32.dll", {
+      GetFileSecurityW: {
+        args: [FFIType.ptr, FFIType.u32, FFIType.ptr, FFIType.u32, FFIType.ptr],
+        returns: FFIType.i32,
+      },
+    });
+    win32Security = {
+      getFileAttributes: kernel32.symbols.GetFileAttributesW,
+      getFileSecurity: advapi32.symbols.GetFileSecurityW,
+    };
+  } catch {
+    win32Security = null;
+  }
+  return win32Security;
+}
+
+/**
+ * Owner and DACL of a directory that is not a reparse point, read in-process
+ * (no PowerShell). Null when unavailable: callers treat that as unverified.
+ */
+export function windowsDirectoryDescriptor(path: string): Uint8Array | null {
+  if (process.platform !== "win32") return null;
+  const win32 = loadWin32Security();
+  if (!win32) return null;
+  const widePath = Buffer.from(`${path}\0`, "utf16le");
+  const attributes = win32.getFileAttributes(widePath);
+  if (
+    attributes === INVALID_FILE_ATTRIBUTES ||
+    (attributes & FILE_ATTRIBUTE_DIRECTORY) === 0 ||
+    (attributes & FILE_ATTRIBUTE_REPARSE_POINT) !== 0
+  ) {
+    return null;
+  }
+  const descriptor = new Uint8Array(SECURITY_DESCRIPTOR_MAX_BYTES);
+  const needed = new Uint32Array(1);
+  const ok = win32.getFileSecurity(
+    widePath,
+    OWNER_AND_DACL,
+    descriptor,
+    descriptor.length,
+    needed
+  );
+  const length = needed[0] ?? 0;
+  if (ok === 0 || length === 0 || length > descriptor.length) return null;
+  return descriptor.slice(0, length);
+}
+
+const SE_DACL_PRESENT = 0x4;
+const SE_SELF_RELATIVE = 0x80_00;
+const ACCESS_ALLOWED_ACE_TYPE = 0;
+const ACCESS_DENIED_ACE_TYPE = 1;
+const FILE_ALL_ACCESS = 0x1f_01_ff;
+
+function sidAt(view: DataView, offset: number): Uint8Array | null {
+  if (offset === 0 || offset + 8 > view.byteLength) return null;
+  const end = offset + 8 + 4 * view.getUint8(offset + 1);
+  if (end > view.byteLength) return null;
+  return new Uint8Array(view.buffer, view.byteOffset + offset, end - offset);
+}
+
+function sameBytes(left: Uint8Array, right: Uint8Array): boolean {
+  return left.length === right.length && left.every((b, i) => b === right[i]);
+}
+
+/**
+ * Self-relative descriptor whose owner is the only principal any allow entry
+ * names, with full control among them. Stricter than the PowerShell policy
+ * (which also accepts a token default owner): a false here only means the
+ * authoritative check runs.
+ */
+export function isOwnerOnlyDescriptor(descriptor: Uint8Array): boolean {
+  const view = new DataView(
+    descriptor.buffer,
+    descriptor.byteOffset,
+    descriptor.byteLength
+  );
+  if (view.byteLength < 20 || view.getUint8(0) !== 1) return false;
+  const control = view.getUint16(2, true);
+  if ((control & SE_SELF_RELATIVE) === 0 || (control & SE_DACL_PRESENT) === 0)
+    return false;
+  const owner = sidAt(view, view.getUint32(4, true));
+  const dacl = view.getUint32(16, true);
+  if (!owner || dacl === 0 || dacl + 8 > view.byteLength) return false;
+  const aclEnd = dacl + view.getUint16(dacl + 2, true);
+  if (aclEnd > view.byteLength) return false;
+  let offset = dacl + 8;
+  let fullControl = false;
+  for (let ace = view.getUint16(dacl + 4, true); ace > 0; ace--) {
+    if (offset + 8 > aclEnd) return false;
+    const type = view.getUint8(offset);
+    const size = view.getUint16(offset + 2, true);
+    if (size < 8 || offset + size > aclEnd) return false;
+    if (type === ACCESS_ALLOWED_ACE_TYPE) {
+      const sid = sidAt(view, offset + 8);
+      if (!sid || offset + 8 + sid.length > offset + size) return false;
+      if (!sameBytes(sid, owner)) return false;
+      const mask = view.getUint32(offset + 4, true);
+      if ((mask & FILE_ALL_ACCESS) === FILE_ALL_ACCESS) fullControl = true;
+    } else if (type !== ACCESS_DENIED_ACE_TYPE) {
+      return false;
+    }
+    offset += size;
+  }
+  return fullControl;
+}