@indigoai-us/hq-cli 5.125.0 → 5.126.0

package/dist/lib/work-context/config.js

@@ -7,6 +7,7 @@ import * as path from "node:path";
 import { atomicWriteJson, ensureOwnerDir, resolveRealTarget } from "./atomic.js";
 import { DefaultCompanyUnavailableError, UnsafeConfigPathError, WorkContextError, } from "./errors.js";
 import { workContextConfigPath, workContextRoot } from "./paths.js";
+import { assertWindowsOwnerOnlyAcl } from "./windows-acl.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
 export const DEVICE_CONFIG_SCHEMA_VERSION = 1;
 const CONFIG_LOCK_TIMEOUT_MS = 5_000;
@@ -147,20 +148,40 @@ function sanitizeRepoCompanyMap(raw) {
     }
     return Object.keys(out).length > 0 ? out : null;
 }
-function assertSafeConfigPath(configPath) {
+/**
+ * Refuse a config path that is a symlink (every platform) or writable by
+ * anyone other than the owner.
+ *
+ * - POSIX (darwin/linux/...): `mode & 0o022` must be clear. Unchanged.
+ * - win32: NTFS has no POSIX mode bits; Node reports 0666 for every regular
+ *   file, so the mode test would reject every config (US-018). We read the
+ *   real DACL instead (see windows-acl.ts). Unreadable DACL → documented
+ *   reduced-guarantee path: one diagnostic line, no throw.
+ */
+export function assertSafeConfigPath(configPath, io = {}) {
+    const platform = io.platform ?? process.platform;
+    const existsSync = io.existsSync ?? fs.existsSync;
+    const lstatSync = io.lstatSync ?? fs.lstatSync;
     const dir = path.dirname(configPath);
     try {
-        if (fs.existsSync(dir)) {
-            const lst = fs.lstatSync(dir);
+        if (existsSync(dir)) {
+            const lst = lstatSync(dir);
             if (lst.isSymbolicLink()) {
                 throw new UnsafeConfigPathError(`Config directory is a symlink: ${dir}`);
             }
+            if (platform === "win32") {
+                assertWindowsOwnerOnlyAcl(dir, "directory", io.windowsAcl);
+            }
         }
-        if (fs.existsSync(configPath)) {
-            const lst = fs.lstatSync(configPath);
+        if (existsSync(configPath)) {
+            const lst = lstatSync(configPath);
             if (lst.isSymbolicLink()) {
                 throw new UnsafeConfigPathError(`Config file is a symlink: ${configPath}`);
             }
+            if (platform === "win32") {
+                assertWindowsOwnerOnlyAcl(configPath, "file", io.windowsAcl);
+                return;
+            }
             const mode = lst.mode & 0o777;
             // Warn-level only for world-writable; refuse group/other write bits on read for safety.
             if (mode & 0o022) {

package/dist/lib/work-context/reconcile.js

@@ -701,17 +701,37 @@ export async function reconcileObservation(obs, deps) {
     if (delivered.ok) {
         markOutboxAcked(outboxOp.operationId, deps.root, delivered.receiptId, nowFn);
         writeAckedRegisterState(outboxOp, deps.root, delivered.receiptId, nowFn);
-        // Persist binding episode on success for bound registrations.
-        if (registerClassification === "bound") {
+        // Company attribution write for EVERY acked register that resolved a
+        // company — not only bound sessions. A company-only ack (needs_project /
+        // needs_task / unresolved) must still project companyUid/companySlug and
+        // the true computed classification into durable session state; otherwise
+        // the emitter and mesh presence lose the tenant the server already
+        // acknowledged. projectId / taskId are written only when genuinely
+        // resolved, and a fresh bindingEpisodeId only when the session is bound —
+        // never fabricated on a partial path. (writeAckedRegisterState above may
+        // have already recorded a receipt-derived episode for a resolved partial
+        // binding; the default merge preserves that when the binding still matches.)
+        if (resolvedCompany.uid) {
+            const bound = registerClassification === "bound";
+            // A server ack of the company makes it authoritative: the durable status
+            // is at least needs_project (company known, no project), needs_task
+            // (project, no task), or bound (project + task) — mirroring
+            // acknowledgedStatus() in state.ts. Never downgrade an acked company to a
+            // pre-threshold "unresolved" projection; that is what dropped the tenant.
+            const ackedClassification = projectId && taskId
+                ? "bound"
+                : projectId
+                    ? "needs_task"
+                    : "needs_project";
             writeSessionState(mergeLocalSessionFields({
                 contractVersion: WORK_CONTEXT_CONTRACT_VERSION,
                 sessionId,
                 companyUid: resolvedCompany.uid,
                 companySlug: resolvedCompany.slug,
-                contextStatus: "bound",
-                projectId,
-                taskId,
-                bindingEpisodeId: delivered.receiptId,
+                contextStatus: bound ? "bound" : ackedClassification,
+                ...(projectId ? { projectId } : {}),
+                ...(taskId ? { taskId } : {}),
+                ...(bound ? { bindingEpisodeId: delivered.receiptId } : {}),
                 updatedAt: nowFn().toISOString(),
                 startedAt,
                 ...(typeof toolWrites === "number" ? { toolWrites } : {}),
@@ -719,7 +739,8 @@ export async function reconcileObservation(obs, deps) {
                 ...transcriptFields,
             }, 
             // Merge against the just-written projection rather than the stale
-            // snapshot from before reconciliation (retains device confidence).
+            // pre-reconcile snapshot, so device confidence and any receipt
+            // attribution survive.
             readSessionState(sessionId, deps.root) ?? stateWrite), deps.root);
         }
         const kind = registerClassification === "bound"

package/dist/lib/work-context/windows-acl.d.ts

@@ -0,0 +1,123 @@
+/**
+ * Windows DACL check for the work-context config (US-018).
+ *
+ * NTFS has no POSIX mode bits: Node reports `mode` 0666 for every regular
+ * file on win32, so the POSIX `mode & 0o022` test in config.ts can never pass
+ * there. Instead of skipping the check on Windows, this module reads the real
+ * DACL and refuses the config when any principal other than the current user,
+ * SYSTEM, Administrators, or the owner is granted write/modify/full access.
+ *
+ * How the DACL is read (no native dependency):
+ *   `icacls <path> /save <tmpfile>` writes the DACL as an SDDL string
+ *   (`D:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-...)`). SDDL carries
+ *   SIDs or well-known SID abbreviations, never display names, so the check is
+ *   independent of the OS language (VORDEFINIERT\Administratoren is still BA /
+ *   S-1-5-32-544). The current user's SID comes from `whoami /user`. Display
+ *   names are only resolved (via PowerShell) for the error message.
+ *
+ * Trust is decided by SID: S-1-5-18 (SYSTEM), S-1-5-32-544 (Administrators),
+ * S-1-3-0 (CREATOR OWNER), S-1-3-4 (OWNER RIGHTS), the current user's SID and
+ * the owner's SID when known.
+ *
+ * Reduced-guarantee path (explicit, documented): the check does NOT throw and
+ * instead emits one stderr diagnostic that the config is unprotected on this
+ * platform when, and only when, the DACL cannot be evaluated:
+ *   - icacls is missing, fails, or its output has no SDDL line (unreadable);
+ *   - an ACE grants write to a principal whose SID we cannot resolve (an SDDL
+ *     abbreviation this module does not know), or carries a rights token we
+ *     cannot decode, or the current user's SID is unknown and the grant is to
+ *     a non-well-known SID (unresolvable).
+ * A DACL that parses and grants write to a resolved SID outside the trusted
+ * set always throws UnsafeConfigPathError. Nothing else falls back.
+ */
+export interface SddlAce {
+    /** ACE type token, e.g. `A` (allow) or `D` (deny). */
+    type: string;
+    /** ACE flag string, e.g. `OICIID`. */
+    flags: string;
+    /** Rights field as written, e.g. `FA`, `0x1200a9`, `CCDCLCSWRPWPRC`. */
+    rights: string;
+    /** Account field as written: full SID or two-letter abbreviation. */
+    account: string;
+}
+export type AclReadResult = {
+    readable: true;
+    sddl: string;
+} | {
+    readable: false;
+    reason: string;
+};
+export interface WindowsAclCheckOptions {
+    /** Current user SID (defaults to `whoami /user`). `null` = unknown. */
+    currentUserSid?: string | null;
+    /** Owner SID when known (icacls /save does not include the owner). */
+    ownerSid?: string | null;
+    /** DACL reader; injectable for tests. Defaults to `icacls <path> /save`. */
+    readAcl?: (targetPath: string) => AclReadResult;
+    /** SID → display name for error messages; injectable for tests. */
+    resolveSidName?: (sid: string) => string | null;
+    /** Diagnostic sink for the reduced-guarantee path (defaults to stderr). */
+    diagnostic?: (line: string) => void;
+}
+export type AclVerdict = {
+    kind: "safe";
+} | {
+    kind: "unsafe";
+    sid: string;
+    rights: string;
+} | {
+    kind: "unresolvable";
+    reason: string;
+};
+export declare const SID_SYSTEM = "S-1-5-18";
+export declare const SID_ADMINISTRATORS = "S-1-5-32-544";
+export declare const SID_CREATOR_OWNER = "S-1-3-0";
+export declare const SID_OWNER_RIGHTS = "S-1-3-4";
+/** Resolve an SDDL account field to a SID, or null when unknown. */
+export declare function sddlAccountToSid(account: string): string | null;
+/** Any of these bits lets the holder change the file or replace it. */
+export declare const WRITE_MASK: number;
+/** Decode an SDDL rights field to an access mask, or null when undecodable. */
+export declare function sddlRightsToMask(rights: string): number | null;
+/**
+ * Parse the DACL portion of an SDDL string into ACEs. Accepts a full security
+ * descriptor string (`O:...G:...D:...S:...`) or just the `D:` section.
+ * Returns null when no DACL section is present or an ACE is malformed.
+ */
+export declare function parseSddlDacl(sddl: string): SddlAce[] | null;
+/**
+ * Parse the file `icacls <path> /save <file>` writes: UTF-16LE (optional BOM),
+ * CRLF, alternating `<name>` / `<sddl>` lines. Returns the SDDL of the first
+ * entry (the target itself), or an unreadable result.
+ */
+export declare function parseIcaclsSaveOutput(raw: string | Buffer): AclReadResult;
+/**
+ * Absolute path of a System32 tool. PATH lookup is not safe here: Git Bash and
+ * MSYS environments put a coreutils `whoami` ahead of Windows' `whoami.exe`,
+ * which does not understand `/user` and would make the current user SID look
+ * unknown on every run.
+ */
+export declare function system32Tool(exe: string): string;
+export declare function readAclWithIcaclsSave(targetPath: string): AclReadResult;
+/** Current user's SID via `whoami /user /fo csv /nh`; null when unavailable. */
+export declare function readCurrentUserSid(): string | null;
+/** Best-effort SID → account name (only used to build error messages). */
+export declare function resolveSidNameWithPowerShell(sid: string): string | null;
+/**
+ * Evaluate parsed ACEs against the trusted SID set.
+ * - `unsafe`: an allow ACE grants a write bit to a resolved, untrusted SID.
+ * - `unresolvable`: a write-granting ACE whose SID or rights cannot be decoded,
+ *   or whose SID is a per-machine/domain SID while the current user is unknown.
+ * - `safe`: everything else (deny ACEs and read-only grants are ignored).
+ */
+export declare function evaluateDacl(aces: SddlAce[], opts: Pick<WindowsAclCheckOptions, "currentUserSid" | "ownerSid">): AclVerdict;
+/**
+ * Assert the Windows DACL of `targetPath` grants write only to trusted
+ * principals. Throws UnsafeConfigPathError naming the offending principal.
+ * Unreadable or unresolvable DACL → reduced-guarantee diagnostic (once per
+ * path), no throw. See the module header for the exact conditions.
+ */
+export declare function assertWindowsOwnerOnlyAcl(targetPath: string, kind: "file" | "directory", opts?: WindowsAclCheckOptions): void;
+/** Test hook: forget which paths already emitted the reduced-guarantee line. */
+export declare function resetWindowsAclDiagnostics(): void;
+//# sourceMappingURL=windows-acl.d.ts.map

package/dist/lib/work-context/windows-acl.js

@@ -0,0 +1,425 @@
+/**
+ * Windows DACL check for the work-context config (US-018).
+ *
+ * NTFS has no POSIX mode bits: Node reports `mode` 0666 for every regular
+ * file on win32, so the POSIX `mode & 0o022` test in config.ts can never pass
+ * there. Instead of skipping the check on Windows, this module reads the real
+ * DACL and refuses the config when any principal other than the current user,
+ * SYSTEM, Administrators, or the owner is granted write/modify/full access.
+ *
+ * How the DACL is read (no native dependency):
+ *   `icacls <path> /save <tmpfile>` writes the DACL as an SDDL string
+ *   (`D:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-...)`). SDDL carries
+ *   SIDs or well-known SID abbreviations, never display names, so the check is
+ *   independent of the OS language (VORDEFINIERT\Administratoren is still BA /
+ *   S-1-5-32-544). The current user's SID comes from `whoami /user`. Display
+ *   names are only resolved (via PowerShell) for the error message.
+ *
+ * Trust is decided by SID: S-1-5-18 (SYSTEM), S-1-5-32-544 (Administrators),
+ * S-1-3-0 (CREATOR OWNER), S-1-3-4 (OWNER RIGHTS), the current user's SID and
+ * the owner's SID when known.
+ *
+ * Reduced-guarantee path (explicit, documented): the check does NOT throw and
+ * instead emits one stderr diagnostic that the config is unprotected on this
+ * platform when, and only when, the DACL cannot be evaluated:
+ *   - icacls is missing, fails, or its output has no SDDL line (unreadable);
+ *   - an ACE grants write to a principal whose SID we cannot resolve (an SDDL
+ *     abbreviation this module does not know), or carries a rights token we
+ *     cannot decode, or the current user's SID is unknown and the grant is to
+ *     a non-well-known SID (unresolvable).
+ * A DACL that parses and grants write to a resolved SID outside the trusted
+ * set always throws UnsafeConfigPathError. Nothing else falls back.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import { UnsafeConfigPathError } from "./errors.js";
+// --- SIDs ---------------------------------------------------------------
+export const SID_SYSTEM = "S-1-5-18";
+export const SID_ADMINISTRATORS = "S-1-5-32-544";
+export const SID_CREATOR_OWNER = "S-1-3-0";
+export const SID_OWNER_RIGHTS = "S-1-3-4";
+/** SDDL well-known account abbreviations (subset relevant to file DACLs). */
+const SDDL_SID_ABBREVIATIONS = {
+    SY: SID_SYSTEM,
+    BA: SID_ADMINISTRATORS,
+    BU: "S-1-5-32-545", // Users
+    BG: "S-1-5-32-546", // Guests
+    PU: "S-1-5-32-547", // Power Users
+    WD: "S-1-1-0", // Everyone
+    AU: "S-1-5-11", // Authenticated Users
+    IU: "S-1-5-4", // Interactive
+    NU: "S-1-5-2", // Network
+    SU: "S-1-5-6", // Service
+    AN: "S-1-5-7", // Anonymous
+    LS: "S-1-5-19", // Local Service
+    NS: "S-1-5-20", // Network Service
+    CO: SID_CREATOR_OWNER,
+    CG: "S-1-3-1", // Creator Group
+    OW: SID_OWNER_RIGHTS,
+    RC: "S-1-5-12", // Restricted Code
+    AC: "S-1-15-2-1", // All application packages
+    DA: "S-1-5-21-<domain>-512", // Domain Admins (domain-relative; never trusted)
+    DU: "S-1-5-21-<domain>-513", // Domain Users
+    LA: "S-1-5-21-<domain>-500", // Local Administrator account
+    LG: "S-1-5-21-<domain>-501", // Local Guest account
+};
+/** Resolve an SDDL account field to a SID, or null when unknown. */
+export function sddlAccountToSid(account) {
+    const a = account.trim();
+    if (/^S-1-\d+(-\d+)+$/i.test(a))
+        return a.toUpperCase();
+    const abbr = SDDL_SID_ABBREVIATIONS[a.toUpperCase()];
+    if (!abbr || abbr.includes("<domain>"))
+        return null;
+    return abbr;
+}
+// --- rights -------------------------------------------------------------
+const FILE_WRITE_DATA = 0x2;
+const FILE_APPEND_DATA = 0x4;
+const FILE_WRITE_EA = 0x10;
+const FILE_DELETE_CHILD = 0x40;
+const FILE_WRITE_ATTRIBUTES = 0x100;
+const DELETE = 0x10000;
+const WRITE_DAC = 0x40000;
+const WRITE_OWNER = 0x80000;
+const GENERIC_ALL = 0x10000000;
+const GENERIC_WRITE = 0x40000000;
+/** Any of these bits lets the holder change the file or replace it. */
+export const WRITE_MASK = FILE_WRITE_DATA |
+    FILE_APPEND_DATA |
+    FILE_WRITE_EA |
+    FILE_DELETE_CHILD |
+    FILE_WRITE_ATTRIBUTES |
+    DELETE |
+    WRITE_DAC |
+    WRITE_OWNER |
+    GENERIC_ALL |
+    GENERIC_WRITE;
+/** SDDL rights tokens → access mask (generic + file-specific + DS bits). */
+const SDDL_RIGHTS_TOKENS = {
+    GA: GENERIC_ALL,
+    GR: 0x80000000,
+    GW: GENERIC_WRITE,
+    GX: 0x20000000,
+    FA: 0x1f01ff,
+    FR: 0x120089,
+    FW: 0x120116,
+    FX: 0x1200a0,
+    KA: 0xf003f,
+    KR: 0x20019,
+    KW: 0x20006,
+    KX: 0x20019,
+    RC: 0x20000,
+    SD: DELETE,
+    WD: WRITE_DAC,
+    WO: WRITE_OWNER,
+    RP: 0x10,
+    WP: 0x20,
+    CC: 0x1,
+    DC: 0x2,
+    LC: 0x4,
+    SW: 0x8,
+    LO: 0x80,
+    DT: 0x40,
+    CR: 0x100,
+};
+/** Decode an SDDL rights field to an access mask, or null when undecodable. */
+export function sddlRightsToMask(rights) {
+    const r = rights.trim();
+    if (!r)
+        return 0;
+    if (/^0x[0-9a-f]+$/i.test(r))
+        return Number.parseInt(r, 16) >>> 0;
+    if (/^\d+$/.test(r))
+        return Number.parseInt(r, 10) >>> 0;
+    if (r.length % 2 !== 0)
+        return null;
+    let mask = 0;
+    for (let i = 0; i < r.length; i += 2) {
+        const bits = SDDL_RIGHTS_TOKENS[r.slice(i, i + 2).toUpperCase()];
+        if (bits === undefined)
+            return null;
+        mask = (mask | bits) >>> 0;
+    }
+    return mask;
+}
+// --- parsing ------------------------------------------------------------
+/**
+ * Parse the DACL portion of an SDDL string into ACEs. Accepts a full security
+ * descriptor string (`O:...G:...D:...S:...`) or just the `D:` section.
+ * Returns null when no DACL section is present or an ACE is malformed.
+ */
+export function parseSddlDacl(sddl) {
+    const text = sddl.trim();
+    // Colons never occur inside an ACE or a SID, so section markers are unambiguous.
+    const dIdx = text.indexOf("D:");
+    if (dIdx < 0)
+        return null;
+    let body = text.slice(dIdx + 2);
+    const sIdx = body.indexOf("S:");
+    if (sIdx >= 0)
+        body = body.slice(0, sIdx);
+    // Strip DACL control flags (P, AI, AR, NO_ACCESS_CONTROL) before the first ACE.
+    const firstAce = body.indexOf("(");
+    const flags = firstAce < 0 ? body : body.slice(0, firstAce);
+    if (!/^[A-Z_]*$/i.test(flags.trim()))
+        return null;
+    if (firstAce < 0)
+        return [];
+    const aceText = body.slice(firstAce);
+    const aces = [];
+    const aceRe = /\(([^()]*)\)/g;
+    let consumed = 0;
+    let m;
+    while ((m = aceRe.exec(aceText)) !== null) {
+        if (m.index !== consumed)
+            return null; // junk between ACEs
+        consumed = m.index + m[0].length;
+        const fields = m[1].split(";");
+        if (fields.length < 6)
+            return null;
+        const [type, aceFlags, rights, , , account] = fields;
+        if (!type || !account)
+            return null;
+        aces.push({
+            type: type.trim().toUpperCase(),
+            flags: aceFlags.trim().toUpperCase(),
+            rights: rights.trim(),
+            account: account.trim(),
+        });
+    }
+    if (consumed !== aceText.trim().length)
+        return null;
+    return aces;
+}
+/**
+ * Parse the file `icacls <path> /save <file>` writes: UTF-16LE (optional BOM),
+ * CRLF, alternating `<name>` / `<sddl>` lines. Returns the SDDL of the first
+ * entry (the target itself), or an unreadable result.
+ */
+export function parseIcaclsSaveOutput(raw) {
+    let text;
+    if (Buffer.isBuffer(raw)) {
+        const hasLeBom = raw.length >= 2 && raw[0] === 0xff && raw[1] === 0xfe;
+        text = raw.toString("utf16le", hasLeBom ? 2 : 0);
+    }
+    else {
+        text = raw;
+    }
+    text = text.replace(/^\uFEFF/, "");
+    const lines = text.split(/\r?\n/).map((l) => l.trim());
+    const sddl = lines.find((l) => /^(O:|G:|D:|S:)/.test(l));
+    if (!sddl) {
+        return { readable: false, reason: "no SDDL line in icacls /save output" };
+    }
+    return { readable: true, sddl };
+}
+// --- platform readers ---------------------------------------------------
+/**
+ * Absolute path of a System32 tool. PATH lookup is not safe here: Git Bash and
+ * MSYS environments put a coreutils `whoami` ahead of Windows' `whoami.exe`,
+ * which does not understand `/user` and would make the current user SID look
+ * unknown on every run.
+ */
+export function system32Tool(exe) {
+    const winDir = process.env.SystemRoot ?? process.env.windir ?? "C:\\Windows";
+    return path.join(winDir, "System32", exe);
+}
+export function readAclWithIcaclsSave(targetPath) {
+    const stamp = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+    const saveFile = path.join(os.tmpdir(), `hq-acl-${stamp}.txt`);
+    try {
+        const res = spawnSync(system32Tool("icacls.exe"), [targetPath, "/save", saveFile], {
+            encoding: "utf8",
+            windowsHide: true,
+            timeout: 10_000,
+        });
+        if (res.error) {
+            return { readable: false, reason: `icacls unavailable: ${res.error.message}` };
+        }
+        if (res.status !== 0) {
+            const stderr = String(res.stderr ?? "").trim();
+            return {
+                readable: false,
+                reason: `icacls exited ${String(res.status)}${stderr ? `: ${stderr}` : ""}`,
+            };
+        }
+        let raw;
+        try {
+            raw = fs.readFileSync(saveFile);
+        }
+        catch (err) {
+            return { readable: false, reason: `icacls /save wrote nothing: ${err.message}` };
+        }
+        return parseIcaclsSaveOutput(raw);
+    }
+    catch (err) {
+        return { readable: false, reason: `icacls failed: ${err.message}` };
+    }
+    finally {
+        try {
+            fs.rmSync(saveFile, { force: true });
+        }
+        catch {
+            // best effort
+        }
+    }
+}
+let cachedCurrentUserSid;
+/** Current user's SID via `whoami /user /fo csv /nh`; null when unavailable. */
+export function readCurrentUserSid() {
+    if (cachedCurrentUserSid !== undefined)
+        return cachedCurrentUserSid;
+    try {
+        const res = spawnSync(system32Tool("whoami.exe"), ["/user", "/fo", "csv", "/nh"], {
+            encoding: "utf8",
+            windowsHide: true,
+            timeout: 10_000,
+        });
+        const m = /"(S-1-\d+(?:-\d+)+)"/i.exec(String(res.stdout ?? ""));
+        cachedCurrentUserSid = res.status === 0 && m ? m[1].toUpperCase() : null;
+    }
+    catch {
+        cachedCurrentUserSid = null;
+    }
+    return cachedCurrentUserSid;
+}
+/** Best-effort SID → account name (only used to build error messages). */
+export function resolveSidNameWithPowerShell(sid) {
+    if (!/^S-1-\d+(-\d+)+$/i.test(sid))
+        return null;
+    try {
+        const script = `(New-Object System.Security.Principal.SecurityIdentifier('${sid}'))` +
+            `.Translate([System.Security.Principal.NTAccount]).Value`;
+        const res = spawnSync(system32Tool("WindowsPowerShell/v1.0/powershell.exe"), ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", script], { encoding: "utf8", windowsHide: true, timeout: 15_000 });
+        const out = String(res.stdout ?? "").trim();
+        return res.status === 0 && out ? out : null;
+    }
+    catch {
+        return null;
+    }
+}
+// --- evaluation ---------------------------------------------------------
+/**
+ * Evaluate parsed ACEs against the trusted SID set.
+ * - `unsafe`: an allow ACE grants a write bit to a resolved, untrusted SID.
+ * - `unresolvable`: a write-granting ACE whose SID or rights cannot be decoded,
+ *   or whose SID is a per-machine/domain SID while the current user is unknown.
+ * - `safe`: everything else (deny ACEs and read-only grants are ignored).
+ */
+export function evaluateDacl(aces, opts) {
+    const trusted = new Set([SID_SYSTEM, SID_ADMINISTRATORS, SID_CREATOR_OWNER, SID_OWNER_RIGHTS]);
+    if (opts.currentUserSid)
+        trusted.add(opts.currentUserSid.toUpperCase());
+    if (opts.ownerSid)
+        trusted.add(opts.ownerSid.toUpperCase());
+    for (const ace of aces) {
+        if (ace.type !== "A")
+            continue; // deny / audit / object ACEs never grant
+        if (ace.flags.includes("IO"))
+            continue; // inherit-only: no effect on this object
+        const mask = sddlRightsToMask(ace.rights);
+        if (mask === null) {
+            return {
+                kind: "unresolvable",
+                reason: `cannot decode rights "${ace.rights}" for ${ace.account}`,
+            };
+        }
+        if ((mask & WRITE_MASK) === 0)
+            continue;
+        const sid = sddlAccountToSid(ace.account);
+        if (!sid) {
+            return { kind: "unresolvable", reason: `cannot resolve principal "${ace.account}" to a SID` };
+        }
+        if (trusted.has(sid))
+            continue;
+        if (!opts.currentUserSid && /^S-1-5-21-/.test(sid)) {
+            return {
+                kind: "unresolvable",
+                reason: `current user SID unknown; cannot tell whether ${sid} is the current user`,
+            };
+        }
+        return { kind: "unsafe", sid, rights: ace.rights };
+    }
+    return { kind: "safe" };
+}
+const reducedGuaranteeReported = new Set();
+/**
+ * Per-process memo of non-throwing verdicts, keyed by the object's identity
+ * and NTFS ChangeTime (Node `ctimeMs`), which advances whenever the DACL is
+ * modified. Spawning icacls costs ~100-200ms; hooks may read the config many
+ * times per process. Unsafe verdicts are never cached.
+ */
+const verdictCache = new Map();
+function cacheKey(targetPath) {
+    try {
+        const st = fs.lstatSync(targetPath);
+        return { ino: st.ino, ctimeMs: st.ctimeMs };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Assert the Windows DACL of `targetPath` grants write only to trusted
+ * principals. Throws UnsafeConfigPathError naming the offending principal.
+ * Unreadable or unresolvable DACL → reduced-guarantee diagnostic (once per
+ * path), no throw. See the module header for the exact conditions.
+ */
+export function assertWindowsOwnerOnlyAcl(targetPath, kind, opts = {}) {
+    const readAcl = opts.readAcl ?? readAclWithIcaclsSave;
+    const resolveSidName = opts.resolveSidName ?? resolveSidNameWithPowerShell;
+    const diagnostic = opts.diagnostic ?? ((line) => process.stderr.write(`${line}\n`));
+    const currentUserSid = opts.currentUserSid === undefined ? readCurrentUserSid() : opts.currentUserSid;
+    const reducedGuarantee = (reason) => {
+        // Reduced-guarantee path: see module header. Deliberately not a throw.
+        if (reducedGuaranteeReported.has(targetPath))
+            return;
+        reducedGuaranteeReported.add(targetPath);
+        diagnostic(`work-context: could not evaluate Windows ACL for ${kind} ${targetPath} (${reason}); ` +
+            "config is unprotected on this platform (reduced guarantee)");
+    };
+    const key = cacheKey(targetPath);
+    const cached = key ? verdictCache.get(targetPath) : undefined;
+    if (key && cached && cached.ino === key.ino && cached.ctimeMs === key.ctimeMs)
+        return;
+    const acl = readAcl(targetPath);
+    if (!acl.readable) {
+        reducedGuarantee(acl.reason);
+        if (key)
+            verdictCache.set(targetPath, key);
+        return;
+    }
+    const aces = parseSddlDacl(acl.sddl);
+    if (aces === null) {
+        reducedGuarantee(`unparseable SDDL "${acl.sddl}"`);
+        if (key)
+            verdictCache.set(targetPath, key);
+        return;
+    }
+    const verdict = evaluateDacl(aces, { currentUserSid, ownerSid: opts.ownerSid ?? null });
+    if (verdict.kind === "safe") {
+        if (key)
+            verdictCache.set(targetPath, key);
+        return;
+    }
+    if (verdict.kind === "unresolvable") {
+        reducedGuarantee(verdict.reason);
+        if (key)
+            verdictCache.set(targetPath, key);
+        return;
+    }
+    const name = resolveSidName(verdict.sid);
+    const who = name ? `${name} (${verdict.sid})` : verdict.sid;
+    throw new UnsafeConfigPathError(`Config ${kind} ${targetPath} is writable by ${who} [rights ${verdict.rights}] ` +
+        "(expected owner-only: current user, SYSTEM, Administrators)");
+}
+/** Test hook: forget which paths already emitted the reduced-guarantee line. */
+export function resetWindowsAclDiagnostics() {
+    reducedGuaranteeReported.clear();
+    verdictCache.clear();
+    cachedCurrentUserSid = undefined;
+}
+//# sourceMappingURL=windows-acl.js.map

package/dist/utils/pack-contributions.js

@@ -199,10 +199,11 @@ export function linkStatus(link, packDir) {
     catch {
         return 'foreign';
     }
-    // scan-packages.sh writes the symlink target as the absolute `src` path.
-    // Canonicalize both sides so `/var` vs `/private/var` (macOS) and symlink
-    // aliases classify as ours; optionally accept stale targets that still resolve
-    // inside this pack's directory.
+    // scan-packages writes the symlink target as a path relative to the host
+    // directory (`path.relative(dirname(dst), src)`). Older trees still carry
+    // absolute `src` strings; canonicalize both so those, `/var` vs `/private/var`
+    // (macOS), and symlink aliases classify as ours; optionally accept stale
+    // targets that still resolve inside this pack's directory.
     const resolvedTarget = path.resolve(path.dirname(link.dst), target);
     if (pointsAtDeclaredPayload(link, resolvedTarget)) {
         return fs.existsSync(link.src) ? 'live' : 'broken';