@indigoai-us/hq-cli 5.124.0 → 5.126.0

package/dist/lib/work-context/windows-acl.js

@@ -0,0 +1,425 @@
+/**
+ * Windows DACL check for the work-context config (US-018).
+ *
+ * NTFS has no POSIX mode bits: Node reports `mode` 0666 for every regular
+ * file on win32, so the POSIX `mode & 0o022` test in config.ts can never pass
+ * there. Instead of skipping the check on Windows, this module reads the real
+ * DACL and refuses the config when any principal other than the current user,
+ * SYSTEM, Administrators, or the owner is granted write/modify/full access.
+ *
+ * How the DACL is read (no native dependency):
+ *   `icacls <path> /save <tmpfile>` writes the DACL as an SDDL string
+ *   (`D:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-...)`). SDDL carries
+ *   SIDs or well-known SID abbreviations, never display names, so the check is
+ *   independent of the OS language (VORDEFINIERT\Administratoren is still BA /
+ *   S-1-5-32-544). The current user's SID comes from `whoami /user`. Display
+ *   names are only resolved (via PowerShell) for the error message.
+ *
+ * Trust is decided by SID: S-1-5-18 (SYSTEM), S-1-5-32-544 (Administrators),
+ * S-1-3-0 (CREATOR OWNER), S-1-3-4 (OWNER RIGHTS), the current user's SID and
+ * the owner's SID when known.
+ *
+ * Reduced-guarantee path (explicit, documented): the check does NOT throw and
+ * instead emits one stderr diagnostic that the config is unprotected on this
+ * platform when, and only when, the DACL cannot be evaluated:
+ *   - icacls is missing, fails, or its output has no SDDL line (unreadable);
+ *   - an ACE grants write to a principal whose SID we cannot resolve (an SDDL
+ *     abbreviation this module does not know), or carries a rights token we
+ *     cannot decode, or the current user's SID is unknown and the grant is to
+ *     a non-well-known SID (unresolvable).
+ * A DACL that parses and grants write to a resolved SID outside the trusted
+ * set always throws UnsafeConfigPathError. Nothing else falls back.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import { UnsafeConfigPathError } from "./errors.js";
+// --- SIDs ---------------------------------------------------------------
+export const SID_SYSTEM = "S-1-5-18";
+export const SID_ADMINISTRATORS = "S-1-5-32-544";
+export const SID_CREATOR_OWNER = "S-1-3-0";
+export const SID_OWNER_RIGHTS = "S-1-3-4";
+/** SDDL well-known account abbreviations (subset relevant to file DACLs). */
+const SDDL_SID_ABBREVIATIONS = {
+    SY: SID_SYSTEM,
+    BA: SID_ADMINISTRATORS,
+    BU: "S-1-5-32-545", // Users
+    BG: "S-1-5-32-546", // Guests
+    PU: "S-1-5-32-547", // Power Users
+    WD: "S-1-1-0", // Everyone
+    AU: "S-1-5-11", // Authenticated Users
+    IU: "S-1-5-4", // Interactive
+    NU: "S-1-5-2", // Network
+    SU: "S-1-5-6", // Service
+    AN: "S-1-5-7", // Anonymous
+    LS: "S-1-5-19", // Local Service
+    NS: "S-1-5-20", // Network Service
+    CO: SID_CREATOR_OWNER,
+    CG: "S-1-3-1", // Creator Group
+    OW: SID_OWNER_RIGHTS,
+    RC: "S-1-5-12", // Restricted Code
+    AC: "S-1-15-2-1", // All application packages
+    DA: "S-1-5-21-<domain>-512", // Domain Admins (domain-relative; never trusted)
+    DU: "S-1-5-21-<domain>-513", // Domain Users
+    LA: "S-1-5-21-<domain>-500", // Local Administrator account
+    LG: "S-1-5-21-<domain>-501", // Local Guest account
+};
+/** Resolve an SDDL account field to a SID, or null when unknown. */
+export function sddlAccountToSid(account) {
+    const a = account.trim();
+    if (/^S-1-\d+(-\d+)+$/i.test(a))
+        return a.toUpperCase();
+    const abbr = SDDL_SID_ABBREVIATIONS[a.toUpperCase()];
+    if (!abbr || abbr.includes("<domain>"))
+        return null;
+    return abbr;
+}
+// --- rights -------------------------------------------------------------
+const FILE_WRITE_DATA = 0x2;
+const FILE_APPEND_DATA = 0x4;
+const FILE_WRITE_EA = 0x10;
+const FILE_DELETE_CHILD = 0x40;
+const FILE_WRITE_ATTRIBUTES = 0x100;
+const DELETE = 0x10000;
+const WRITE_DAC = 0x40000;
+const WRITE_OWNER = 0x80000;
+const GENERIC_ALL = 0x10000000;
+const GENERIC_WRITE = 0x40000000;
+/** Any of these bits lets the holder change the file or replace it. */
+export const WRITE_MASK = FILE_WRITE_DATA |
+    FILE_APPEND_DATA |
+    FILE_WRITE_EA |
+    FILE_DELETE_CHILD |
+    FILE_WRITE_ATTRIBUTES |
+    DELETE |
+    WRITE_DAC |
+    WRITE_OWNER |
+    GENERIC_ALL |
+    GENERIC_WRITE;
+/** SDDL rights tokens → access mask (generic + file-specific + DS bits). */
+const SDDL_RIGHTS_TOKENS = {
+    GA: GENERIC_ALL,
+    GR: 0x80000000,
+    GW: GENERIC_WRITE,
+    GX: 0x20000000,
+    FA: 0x1f01ff,
+    FR: 0x120089,
+    FW: 0x120116,
+    FX: 0x1200a0,
+    KA: 0xf003f,
+    KR: 0x20019,
+    KW: 0x20006,
+    KX: 0x20019,
+    RC: 0x20000,
+    SD: DELETE,
+    WD: WRITE_DAC,
+    WO: WRITE_OWNER,
+    RP: 0x10,
+    WP: 0x20,
+    CC: 0x1,
+    DC: 0x2,
+    LC: 0x4,
+    SW: 0x8,
+    LO: 0x80,
+    DT: 0x40,
+    CR: 0x100,
+};
+/** Decode an SDDL rights field to an access mask, or null when undecodable. */
+export function sddlRightsToMask(rights) {
+    const r = rights.trim();
+    if (!r)
+        return 0;
+    if (/^0x[0-9a-f]+$/i.test(r))
+        return Number.parseInt(r, 16) >>> 0;
+    if (/^\d+$/.test(r))
+        return Number.parseInt(r, 10) >>> 0;
+    if (r.length % 2 !== 0)
+        return null;
+    let mask = 0;
+    for (let i = 0; i < r.length; i += 2) {
+        const bits = SDDL_RIGHTS_TOKENS[r.slice(i, i + 2).toUpperCase()];
+        if (bits === undefined)
+            return null;
+        mask = (mask | bits) >>> 0;
+    }
+    return mask;
+}
+// --- parsing ------------------------------------------------------------
+/**
+ * Parse the DACL portion of an SDDL string into ACEs. Accepts a full security
+ * descriptor string (`O:...G:...D:...S:...`) or just the `D:` section.
+ * Returns null when no DACL section is present or an ACE is malformed.
+ */
+export function parseSddlDacl(sddl) {
+    const text = sddl.trim();
+    // Colons never occur inside an ACE or a SID, so section markers are unambiguous.
+    const dIdx = text.indexOf("D:");
+    if (dIdx < 0)
+        return null;
+    let body = text.slice(dIdx + 2);
+    const sIdx = body.indexOf("S:");
+    if (sIdx >= 0)
+        body = body.slice(0, sIdx);
+    // Strip DACL control flags (P, AI, AR, NO_ACCESS_CONTROL) before the first ACE.
+    const firstAce = body.indexOf("(");
+    const flags = firstAce < 0 ? body : body.slice(0, firstAce);
+    if (!/^[A-Z_]*$/i.test(flags.trim()))
+        return null;
+    if (firstAce < 0)
+        return [];
+    const aceText = body.slice(firstAce);
+    const aces = [];
+    const aceRe = /\(([^()]*)\)/g;
+    let consumed = 0;
+    let m;
+    while ((m = aceRe.exec(aceText)) !== null) {
+        if (m.index !== consumed)
+            return null; // junk between ACEs
+        consumed = m.index + m[0].length;
+        const fields = m[1].split(";");
+        if (fields.length < 6)
+            return null;
+        const [type, aceFlags, rights, , , account] = fields;
+        if (!type || !account)
+            return null;
+        aces.push({
+            type: type.trim().toUpperCase(),
+            flags: aceFlags.trim().toUpperCase(),
+            rights: rights.trim(),
+            account: account.trim(),
+        });
+    }
+    if (consumed !== aceText.trim().length)
+        return null;
+    return aces;
+}
+/**
+ * Parse the file `icacls <path> /save <file>` writes: UTF-16LE (optional BOM),
+ * CRLF, alternating `<name>` / `<sddl>` lines. Returns the SDDL of the first
+ * entry (the target itself), or an unreadable result.
+ */
+export function parseIcaclsSaveOutput(raw) {
+    let text;
+    if (Buffer.isBuffer(raw)) {
+        const hasLeBom = raw.length >= 2 && raw[0] === 0xff && raw[1] === 0xfe;
+        text = raw.toString("utf16le", hasLeBom ? 2 : 0);
+    }
+    else {
+        text = raw;
+    }
+    text = text.replace(/^\uFEFF/, "");
+    const lines = text.split(/\r?\n/).map((l) => l.trim());
+    const sddl = lines.find((l) => /^(O:|G:|D:|S:)/.test(l));
+    if (!sddl) {
+        return { readable: false, reason: "no SDDL line in icacls /save output" };
+    }
+    return { readable: true, sddl };
+}
+// --- platform readers ---------------------------------------------------
+/**
+ * Absolute path of a System32 tool. PATH lookup is not safe here: Git Bash and
+ * MSYS environments put a coreutils `whoami` ahead of Windows' `whoami.exe`,
+ * which does not understand `/user` and would make the current user SID look
+ * unknown on every run.
+ */
+export function system32Tool(exe) {
+    const winDir = process.env.SystemRoot ?? process.env.windir ?? "C:\\Windows";
+    return path.join(winDir, "System32", exe);
+}
+export function readAclWithIcaclsSave(targetPath) {
+    const stamp = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+    const saveFile = path.join(os.tmpdir(), `hq-acl-${stamp}.txt`);
+    try {
+        const res = spawnSync(system32Tool("icacls.exe"), [targetPath, "/save", saveFile], {
+            encoding: "utf8",
+            windowsHide: true,
+            timeout: 10_000,
+        });
+        if (res.error) {
+            return { readable: false, reason: `icacls unavailable: ${res.error.message}` };
+        }
+        if (res.status !== 0) {
+            const stderr = String(res.stderr ?? "").trim();
+            return {
+                readable: false,
+                reason: `icacls exited ${String(res.status)}${stderr ? `: ${stderr}` : ""}`,
+            };
+        }
+        let raw;
+        try {
+            raw = fs.readFileSync(saveFile);
+        }
+        catch (err) {
+            return { readable: false, reason: `icacls /save wrote nothing: ${err.message}` };
+        }
+        return parseIcaclsSaveOutput(raw);
+    }
+    catch (err) {
+        return { readable: false, reason: `icacls failed: ${err.message}` };
+    }
+    finally {
+        try {
+            fs.rmSync(saveFile, { force: true });
+        }
+        catch {
+            // best effort
+        }
+    }
+}
+let cachedCurrentUserSid;
+/** Current user's SID via `whoami /user /fo csv /nh`; null when unavailable. */
+export function readCurrentUserSid() {
+    if (cachedCurrentUserSid !== undefined)
+        return cachedCurrentUserSid;
+    try {
+        const res = spawnSync(system32Tool("whoami.exe"), ["/user", "/fo", "csv", "/nh"], {
+            encoding: "utf8",
+            windowsHide: true,
+            timeout: 10_000,
+        });
+        const m = /"(S-1-\d+(?:-\d+)+)"/i.exec(String(res.stdout ?? ""));
+        cachedCurrentUserSid = res.status === 0 && m ? m[1].toUpperCase() : null;
+    }
+    catch {
+        cachedCurrentUserSid = null;
+    }
+    return cachedCurrentUserSid;
+}
+/** Best-effort SID → account name (only used to build error messages). */
+export function resolveSidNameWithPowerShell(sid) {
+    if (!/^S-1-\d+(-\d+)+$/i.test(sid))
+        return null;
+    try {
+        const script = `(New-Object System.Security.Principal.SecurityIdentifier('${sid}'))` +
+            `.Translate([System.Security.Principal.NTAccount]).Value`;
+        const res = spawnSync(system32Tool("WindowsPowerShell/v1.0/powershell.exe"), ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", script], { encoding: "utf8", windowsHide: true, timeout: 15_000 });
+        const out = String(res.stdout ?? "").trim();
+        return res.status === 0 && out ? out : null;
+    }
+    catch {
+        return null;
+    }
+}
+// --- evaluation ---------------------------------------------------------
+/**
+ * Evaluate parsed ACEs against the trusted SID set.
+ * - `unsafe`: an allow ACE grants a write bit to a resolved, untrusted SID.
+ * - `unresolvable`: a write-granting ACE whose SID or rights cannot be decoded,
+ *   or whose SID is a per-machine/domain SID while the current user is unknown.
+ * - `safe`: everything else (deny ACEs and read-only grants are ignored).
+ */
+export function evaluateDacl(aces, opts) {
+    const trusted = new Set([SID_SYSTEM, SID_ADMINISTRATORS, SID_CREATOR_OWNER, SID_OWNER_RIGHTS]);
+    if (opts.currentUserSid)
+        trusted.add(opts.currentUserSid.toUpperCase());
+    if (opts.ownerSid)
+        trusted.add(opts.ownerSid.toUpperCase());
+    for (const ace of aces) {
+        if (ace.type !== "A")
+            continue; // deny / audit / object ACEs never grant
+        if (ace.flags.includes("IO"))
+            continue; // inherit-only: no effect on this object
+        const mask = sddlRightsToMask(ace.rights);
+        if (mask === null) {
+            return {
+                kind: "unresolvable",
+                reason: `cannot decode rights "${ace.rights}" for ${ace.account}`,
+            };
+        }
+        if ((mask & WRITE_MASK) === 0)
+            continue;
+        const sid = sddlAccountToSid(ace.account);
+        if (!sid) {
+            return { kind: "unresolvable", reason: `cannot resolve principal "${ace.account}" to a SID` };
+        }
+        if (trusted.has(sid))
+            continue;
+        if (!opts.currentUserSid && /^S-1-5-21-/.test(sid)) {
+            return {
+                kind: "unresolvable",
+                reason: `current user SID unknown; cannot tell whether ${sid} is the current user`,
+            };
+        }
+        return { kind: "unsafe", sid, rights: ace.rights };
+    }
+    return { kind: "safe" };
+}
+const reducedGuaranteeReported = new Set();
+/**
+ * Per-process memo of non-throwing verdicts, keyed by the object's identity
+ * and NTFS ChangeTime (Node `ctimeMs`), which advances whenever the DACL is
+ * modified. Spawning icacls costs ~100-200ms; hooks may read the config many
+ * times per process. Unsafe verdicts are never cached.
+ */
+const verdictCache = new Map();
+function cacheKey(targetPath) {
+    try {
+        const st = fs.lstatSync(targetPath);
+        return { ino: st.ino, ctimeMs: st.ctimeMs };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Assert the Windows DACL of `targetPath` grants write only to trusted
+ * principals. Throws UnsafeConfigPathError naming the offending principal.
+ * Unreadable or unresolvable DACL → reduced-guarantee diagnostic (once per
+ * path), no throw. See the module header for the exact conditions.
+ */
+export function assertWindowsOwnerOnlyAcl(targetPath, kind, opts = {}) {
+    const readAcl = opts.readAcl ?? readAclWithIcaclsSave;
+    const resolveSidName = opts.resolveSidName ?? resolveSidNameWithPowerShell;
+    const diagnostic = opts.diagnostic ?? ((line) => process.stderr.write(`${line}\n`));
+    const currentUserSid = opts.currentUserSid === undefined ? readCurrentUserSid() : opts.currentUserSid;
+    const reducedGuarantee = (reason) => {
+        // Reduced-guarantee path: see module header. Deliberately not a throw.
+        if (reducedGuaranteeReported.has(targetPath))
+            return;
+        reducedGuaranteeReported.add(targetPath);
+        diagnostic(`work-context: could not evaluate Windows ACL for ${kind} ${targetPath} (${reason}); ` +
+            "config is unprotected on this platform (reduced guarantee)");
+    };
+    const key = cacheKey(targetPath);
+    const cached = key ? verdictCache.get(targetPath) : undefined;
+    if (key && cached && cached.ino === key.ino && cached.ctimeMs === key.ctimeMs)
+        return;
+    const acl = readAcl(targetPath);
+    if (!acl.readable) {
+        reducedGuarantee(acl.reason);
+        if (key)
+            verdictCache.set(targetPath, key);
+        return;
+    }
+    const aces = parseSddlDacl(acl.sddl);
+    if (aces === null) {
+        reducedGuarantee(`unparseable SDDL "${acl.sddl}"`);
+        if (key)
+            verdictCache.set(targetPath, key);
+        return;
+    }
+    const verdict = evaluateDacl(aces, { currentUserSid, ownerSid: opts.ownerSid ?? null });
+    if (verdict.kind === "safe") {
+        if (key)
+            verdictCache.set(targetPath, key);
+        return;
+    }
+    if (verdict.kind === "unresolvable") {
+        reducedGuarantee(verdict.reason);
+        if (key)
+            verdictCache.set(targetPath, key);
+        return;
+    }
+    const name = resolveSidName(verdict.sid);
+    const who = name ? `${name} (${verdict.sid})` : verdict.sid;
+    throw new UnsafeConfigPathError(`Config ${kind} ${targetPath} is writable by ${who} [rights ${verdict.rights}] ` +
+        "(expected owner-only: current user, SYSTEM, Administrators)");
+}
+/** Test hook: forget which paths already emitted the reduced-guarantee line. */
+export function resetWindowsAclDiagnostics() {
+    reducedGuaranteeReported.clear();
+    verdictCache.clear();
+    cachedCurrentUserSid = undefined;
+}
+//# sourceMappingURL=windows-acl.js.map

package/dist/utils/pack-contributions.js

@@ -199,10 +199,11 @@ export function linkStatus(link, packDir) {
     catch {
         return 'foreign';
     }
-    // scan-packages.sh writes the symlink target as the absolute `src` path.
-    // Canonicalize both sides so `/var` vs `/private/var` (macOS) and symlink
-    // aliases classify as ours; optionally accept stale targets that still resolve
-    // inside this pack's directory.
+    // scan-packages writes the symlink target as a path relative to the host
+    // directory (`path.relative(dirname(dst), src)`). Older trees still carry
+    // absolute `src` strings; canonicalize both so those, `/var` vs `/private/var`
+    // (macOS), and symlink aliases classify as ours; optionally accept stale
+    // targets that still resolve inside this pack's directory.
     const resolvedTarget = path.resolve(path.dirname(link.dst), target);
     if (pointsAtDeclaredPayload(link, resolvedTarget)) {
         return fs.existsSync(link.src) ? 'live' : 'broken';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.124.0",
+  "version": "5.126.0",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {