@hellolynk-ai/codex-plugin 0.2.102-macos.1 → 0.2.103

package/plugins/hellolynk-codex/runtime/platform/windows/credential-store.ps1

@@ -85,8 +85,27 @@ public static class HelloLynkWindowsFileNative {
   [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
   public static extern bool MoveFileExW(string existingName, string newName, uint flags);
 
+  [StructLayout(LayoutKind.Sequential)]
+  private struct SECURITY_ATTRIBUTES {
+    public int Length;
+    public IntPtr SecurityDescriptor;
+    public int InheritHandle;
+  }
+
   [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-  public static extern bool CreateDirectoryW(string path, IntPtr securityAttributes);
+  private static extern bool CreateDirectoryW(string path, ref SECURITY_ATTRIBUTES attributes);
+
+  public static bool CreateProtectedDirectory(string path, byte[] descriptor) {
+    var pinned = GCHandle.Alloc(descriptor, GCHandleType.Pinned);
+    try {
+      var attributes = new SECURITY_ATTRIBUTES {
+        Length = Marshal.SizeOf<SECURITY_ATTRIBUTES>(),
+        SecurityDescriptor = pinned.AddrOfPinnedObject(),
+        InheritHandle = 0
+      };
+      return CreateDirectoryW(path, ref attributes);
+    } finally { pinned.Free(); }
+  }
 }
 '@
 
@@ -162,7 +181,7 @@ function Get-HelloLynkExistingAncestorDirectories([string]$RootPath) {
   return $ordered
 }
 
-function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath) {
+function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath, [bool]$Create = $false) {
   $rootParent = [IO.Path]::GetDirectoryName($RootPath.TrimEnd([char[]]@('\', '/')))
   $directories = @(Get-HelloLynkExistingAncestorDirectories $RootPath)
   $dangerousRights = (
@@ -175,6 +194,8 @@ function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath) {
     [Security.AccessControl.FileSystemRights]::ChangePermissions -bor
     [Security.AccessControl.FileSystemRights]::TakeOwnership
   )
+  $createRights = [Security.AccessControl.FileSystemRights]::CreateFiles -bor
+    [Security.AccessControl.FileSystemRights]::CreateDirectories
   foreach ($directory in $directories) {
     Assert-HelloLynkNoReparseAncestors $directory
     $identity = Open-HelloLynkIdentity $directory $true
@@ -204,6 +225,7 @@ function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath) {
     )
     $isRootParent = $directory.Equals($rootParent, [StringComparison]::OrdinalIgnoreCase)
     $directoryIndex = [Array]::IndexOf($directories, $directory)
+    $willCreateProtectedChild = $Create -and -not $isRootParent -and $directoryIndex -eq $directories.Count - 1
     $nextDirectoryProtected = $false
     if ($directoryIndex -ge 0 -and $directoryIndex + 1 -lt $directories.Count) {
       try {
@@ -220,15 +242,20 @@ function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath) {
       ) { continue }
       $rights = $rule.FileSystemRights
       $hasDangerousRights = (($rights -band $dangerousRights) -ne 0)
+      # A competing child created by a different user fails our owner check.
+      # A grant to alter the ancestor itself still prevents first creation.
+      $canCreateProtectedChild = $willCreateProtectedChild -and
+        (($rights -band $dangerousRights -band (-bnot $createRights)) -eq 0)
       $hasDeleteChild = (
         ($rights -band [Security.AccessControl.FileSystemRights]::DeleteSubdirectoriesAndFiles) -ne 0
       )
       if (
         $hasDeleteChild -or
-        ($hasDangerousRights -and ($isRootParent -or -not $nextDirectoryProtected))
+        ($hasDangerousRights -and ($isRootParent -or (-not $nextDirectoryProtected -and -not $canCreateProtectedChild)))
       ) { Fail "client_root_ancestor_dacl_untrusted" }
     }
   }
+  return $directories[-1]
 }
 
 function New-HelloLynkAcl([bool]$Directory) {
@@ -361,7 +388,7 @@ function Exit-HelloLynkRootMutex($Mutex) {
   try { $Mutex.ReleaseMutex() } finally { $Mutex.Dispose() }
 }
 
-function Ensure-HelloLynkSecureDirectory([string]$PathValue) {
+function Ensure-HelloLynkSecureDirectory([string]$PathValue, [string]$ExistingAncestor = "") {
   if ([IO.Directory]::Exists($PathValue)) {
     Assert-HelloLynkNoReparseAncestors $PathValue
     Assert-HelloLynkSecureAcl $PathValue $true
@@ -370,12 +397,21 @@ function Ensure-HelloLynkSecureDirectory([string]$PathValue) {
     return
   }
   $parent = [IO.Path]::GetDirectoryName($PathValue)
-  if (-not [IO.Directory]::Exists($parent)) { Ensure-HelloLynkSecureDirectory $parent }
-  if (-not [HelloLynkWindowsFileNative]::CreateDirectoryW($PathValue, [IntPtr]::Zero)) {
+  if ($ExistingAncestor) {
+    if (-not $parent.Equals($ExistingAncestor, [StringComparison]::OrdinalIgnoreCase)) {
+      Ensure-HelloLynkSecureDirectory $parent $ExistingAncestor
+    }
+  } elseif (-not [IO.Directory]::Exists($parent)) {
+    Ensure-HelloLynkSecureDirectory $parent
+  }
+  Assert-HelloLynkNoReparseAncestors $PathValue
+  $descriptor = (New-HelloLynkAcl $true).GetSecurityDescriptorBinaryForm()
+  if (-not [HelloLynkWindowsFileNative]::CreateProtectedDirectory($PathValue, $descriptor)) {
     Fail "client_root_create_race"
   }
-  Set-HelloLynkSecureAcl $PathValue $true
   Assert-HelloLynkNoReparseAncestors $PathValue
+  # Keep the Windows auto-inheritance marker used by child file ACL checks.
+  Set-HelloLynkSecureAcl $PathValue $true
   Assert-HelloLynkSecureAcl $PathValue $true
   $identity = Open-HelloLynkIdentity $PathValue $true
   $identity.Handle.Dispose()
@@ -386,14 +422,14 @@ function Resolve-HelloLynkClientRoot([string]$RootValue, [bool]$Create) {
   Assert-HelloLynkNoReparseAncestors $root
   $mutex = Enter-HelloLynkRootMutex $root
   try {
-    Assert-HelloLynkTrustedAncestorAcl $root
-    if ($Create) { Ensure-HelloLynkSecureDirectory $root }
+    $existingAncestor = Assert-HelloLynkTrustedAncestorAcl $root $Create
+    if ($Create) { Ensure-HelloLynkSecureDirectory $root $existingAncestor }
     if (-not [IO.Directory]::Exists($root)) { Fail "client_root_missing" }
     Assert-HelloLynkNoReparseAncestors $root
     Assert-HelloLynkSecureAcl $root $true
     $identity = Open-HelloLynkIdentity $root $true
     try {
-      Assert-HelloLynkTrustedAncestorAcl $root
+      $null = Assert-HelloLynkTrustedAncestorAcl $root
       $canonical = $root
     } finally { $identity.Handle.Dispose() }
     return [pscustomobject]@{ Root = $canonical; Mutex = $mutex }

package/plugins/hellolynk-codex/server/codex-neutral-production.mjs

@@ -24,7 +24,7 @@ const TRUSTED_BOOTSTRAP_FILES = Object.freeze(new Map([
   ["runtime/neutral-host-release-loader.mjs", "283a20c6a9b90481bc03c143ab51d5289abf7b7a86fbe51fba7ea2ae1e6d2c60"],
   ["runtime/neutral-host-bootstrap.mjs", "53513deed7f0155a6603a1489d1609fae37776442358181ff7650d0cd9351f0a"],
   ["runtime/bootstrap/core/hellolynk-runtime-safety.cjs", "43d576d9f774409f4a735793c1503a6f397e787b10c59a4ac9cc9257299f5efe"],
-  ["runtime/bootstrap/core/hellolynk-darwin-host.mjs", "0772d7a23280b18d5bc59383a6a14fd2ecfd9de1ec53b351be0250770e3e2e70"],
+  ["runtime/bootstrap/core/hellolynk-darwin-host.mjs", "ded97c3bc3dd65ca75305f5199a1340dffb987a5f283454d60586df8b6b55c09"],
   ["runtime/bootstrap/core/hellolynk-darwin-vault.mjs", "b6094d856af016e674e4a0183a4e474397bbe92e66638743fa62fe085b554d30"],
   ["runtime/bootstrap/core/hellolynk-host-protected-store.mjs", "10f81f4f6a5dd2fe9a742e847b2eb47dbf20f802f4414f46a05ccbc3505148e2"],
   ["runtime/bootstrap/core/hellolynk-neutral-host-installation-store.mjs", "42ae1e7deb876a8308b7bfed6a7b891d1834117b62504fc5befe3f91a0b4c740"],
@@ -34,7 +34,7 @@ const TRUSTED_BOOTSTRAP_FILES = Object.freeze(new Map([
   ["runtime/bootstrap/core/hellolynk-client-core.mjs", "94bbad1d0ccee969bbffed176449e427188f1b892512a64167ab31f63d258e2b"],
   ["runtime/bootstrap/platform/windows/hellolynk-host-protected-store.ps1", "24357e8ce54090b4ec68e457f02c9e834a80f3273ef3c03a8c0fa7258797fb49"],
   ...(process.platform === "darwin" ? [
-    ["runtime/bootstrap/platform/darwin/hellolynk-keychain-helper.bin", "f1a782c08229ebc0e8d1704b6390e91c5695e084b4df0a1a6dc043f6b23700ab"],
+    ["runtime/bootstrap/platform/darwin/hellolynk-keychain-helper.bin", "0000000000000000000000000000000000000000000000000000000000000000"],
   ] : []),
 ]));