@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/lib/work-context/windows-acl.d.ts

@@ -0,0 +1,123 @@
+/**
+ * Windows DACL check for the work-context config (US-018).
+ *
+ * NTFS has no POSIX mode bits: Node reports `mode` 0666 for every regular
+ * file on win32, so the POSIX `mode & 0o022` test in config.ts can never pass
+ * there. Instead of skipping the check on Windows, this module reads the real
+ * DACL and refuses the config when any principal other than the current user,
+ * SYSTEM, Administrators, or the owner is granted write/modify/full access.
+ *
+ * How the DACL is read (no native dependency):
+ *   `icacls <path> /save <tmpfile>` writes the DACL as an SDDL string
+ *   (`D:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-...)`). SDDL carries
+ *   SIDs or well-known SID abbreviations, never display names, so the check is
+ *   independent of the OS language (VORDEFINIERT\Administratoren is still BA /
+ *   S-1-5-32-544). The current user's SID comes from `whoami /user`. Display
+ *   names are only resolved (via PowerShell) for the error message.
+ *
+ * Trust is decided by SID: S-1-5-18 (SYSTEM), S-1-5-32-544 (Administrators),
+ * S-1-3-0 (CREATOR OWNER), S-1-3-4 (OWNER RIGHTS), the current user's SID and
+ * the owner's SID when known.
+ *
+ * Reduced-guarantee path (explicit, documented): the check does NOT throw and
+ * instead emits one stderr diagnostic that the config is unprotected on this
+ * platform when, and only when, the DACL cannot be evaluated:
+ *   - icacls is missing, fails, or its output has no SDDL line (unreadable);
+ *   - an ACE grants write to a principal whose SID we cannot resolve (an SDDL
+ *     abbreviation this module does not know), or carries a rights token we
+ *     cannot decode, or the current user's SID is unknown and the grant is to
+ *     a non-well-known SID (unresolvable).
+ * A DACL that parses and grants write to a resolved SID outside the trusted
+ * set always throws UnsafeConfigPathError. Nothing else falls back.
+ */
+export interface SddlAce {
+    /** ACE type token, e.g. `A` (allow) or `D` (deny). */
+    type: string;
+    /** ACE flag string, e.g. `OICIID`. */
+    flags: string;
+    /** Rights field as written, e.g. `FA`, `0x1200a9`, `CCDCLCSWRPWPRC`. */
+    rights: string;
+    /** Account field as written: full SID or two-letter abbreviation. */
+    account: string;
+}
+export type AclReadResult = {
+    readable: true;
+    sddl: string;
+} | {
+    readable: false;
+    reason: string;
+};
+export interface WindowsAclCheckOptions {
+    /** Current user SID (defaults to `whoami /user`). `null` = unknown. */
+    currentUserSid?: string | null;
+    /** Owner SID when known (icacls /save does not include the owner). */
+    ownerSid?: string | null;
+    /** DACL reader; injectable for tests. Defaults to `icacls <path> /save`. */
+    readAcl?: (targetPath: string) => AclReadResult;
+    /** SID → display name for error messages; injectable for tests. */
+    resolveSidName?: (sid: string) => string | null;
+    /** Diagnostic sink for the reduced-guarantee path (defaults to stderr). */
+    diagnostic?: (line: string) => void;
+}
+export type AclVerdict = {
+    kind: "safe";
+} | {
+    kind: "unsafe";
+    sid: string;
+    rights: string;
+} | {
+    kind: "unresolvable";
+    reason: string;
+};
+export declare const SID_SYSTEM = "S-1-5-18";
+export declare const SID_ADMINISTRATORS = "S-1-5-32-544";
+export declare const SID_CREATOR_OWNER = "S-1-3-0";
+export declare const SID_OWNER_RIGHTS = "S-1-3-4";
+/** Resolve an SDDL account field to a SID, or null when unknown. */
+export declare function sddlAccountToSid(account: string): string | null;
+/** Any of these bits lets the holder change the file or replace it. */
+export declare const WRITE_MASK: number;
+/** Decode an SDDL rights field to an access mask, or null when undecodable. */
+export declare function sddlRightsToMask(rights: string): number | null;
+/**
+ * Parse the DACL portion of an SDDL string into ACEs. Accepts a full security
+ * descriptor string (`O:...G:...D:...S:...`) or just the `D:` section.
+ * Returns null when no DACL section is present or an ACE is malformed.
+ */
+export declare function parseSddlDacl(sddl: string): SddlAce[] | null;
+/**
+ * Parse the file `icacls <path> /save <file>` writes: UTF-16LE (optional BOM),
+ * CRLF, alternating `<name>` / `<sddl>` lines. Returns the SDDL of the first
+ * entry (the target itself), or an unreadable result.
+ */
+export declare function parseIcaclsSaveOutput(raw: string | Buffer): AclReadResult;
+/**
+ * Absolute path of a System32 tool. PATH lookup is not safe here: Git Bash and
+ * MSYS environments put a coreutils `whoami` ahead of Windows' `whoami.exe`,
+ * which does not understand `/user` and would make the current user SID look
+ * unknown on every run.
+ */
+export declare function system32Tool(exe: string): string;
+export declare function readAclWithIcaclsSave(targetPath: string): AclReadResult;
+/** Current user's SID via `whoami /user /fo csv /nh`; null when unavailable. */
+export declare function readCurrentUserSid(): string | null;
+/** Best-effort SID → account name (only used to build error messages). */
+export declare function resolveSidNameWithPowerShell(sid: string): string | null;
+/**
+ * Evaluate parsed ACEs against the trusted SID set.
+ * - `unsafe`: an allow ACE grants a write bit to a resolved, untrusted SID.
+ * - `unresolvable`: a write-granting ACE whose SID or rights cannot be decoded,
+ *   or whose SID is a per-machine/domain SID while the current user is unknown.
+ * - `safe`: everything else (deny ACEs and read-only grants are ignored).
+ */
+export declare function evaluateDacl(aces: SddlAce[], opts: Pick<WindowsAclCheckOptions, "currentUserSid" | "ownerSid">): AclVerdict;
+/**
+ * Assert the Windows DACL of `targetPath` grants write only to trusted
+ * principals. Throws UnsafeConfigPathError naming the offending principal.
+ * Unreadable or unresolvable DACL → reduced-guarantee diagnostic (once per
+ * path), no throw. See the module header for the exact conditions.
+ */
+export declare function assertWindowsOwnerOnlyAcl(targetPath: string, kind: "file" | "directory", opts?: WindowsAclCheckOptions): void;
+/** Test hook: forget which paths already emitted the reduced-guarantee line. */
+export declare function resetWindowsAclDiagnostics(): void;
+//# sourceMappingURL=windows-acl.d.ts.map

package/dist/lib/work-context/windows-acl.js

@@ -0,0 +1,425 @@
+/**
+ * Windows DACL check for the work-context config (US-018).
+ *
+ * NTFS has no POSIX mode bits: Node reports `mode` 0666 for every regular
+ * file on win32, so the POSIX `mode & 0o022` test in config.ts can never pass
+ * there. Instead of skipping the check on Windows, this module reads the real
+ * DACL and refuses the config when any principal other than the current user,
+ * SYSTEM, Administrators, or the owner is granted write/modify/full access.
+ *
+ * How the DACL is read (no native dependency):
+ *   `icacls <path> /save <tmpfile>` writes the DACL as an SDDL string
+ *   (`D:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-...)`). SDDL carries
+ *   SIDs or well-known SID abbreviations, never display names, so the check is
+ *   independent of the OS language (VORDEFINIERT\Administratoren is still BA /
+ *   S-1-5-32-544). The current user's SID comes from `whoami /user`. Display
+ *   names are only resolved (via PowerShell) for the error message.
+ *
+ * Trust is decided by SID: S-1-5-18 (SYSTEM), S-1-5-32-544 (Administrators),
+ * S-1-3-0 (CREATOR OWNER), S-1-3-4 (OWNER RIGHTS), the current user's SID and
+ * the owner's SID when known.
+ *
+ * Reduced-guarantee path (explicit, documented): the check does NOT throw and
+ * instead emits one stderr diagnostic that the config is unprotected on this
+ * platform when, and only when, the DACL cannot be evaluated:
+ *   - icacls is missing, fails, or its output has no SDDL line (unreadable);
+ *   - an ACE grants write to a principal whose SID we cannot resolve (an SDDL
+ *     abbreviation this module does not know), or carries a rights token we
+ *     cannot decode, or the current user's SID is unknown and the grant is to
+ *     a non-well-known SID (unresolvable).
+ * A DACL that parses and grants write to a resolved SID outside the trusted
+ * set always throws UnsafeConfigPathError. Nothing else falls back.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import { UnsafeConfigPathError } from "./errors.js";
+// --- SIDs ---------------------------------------------------------------
+export const SID_SYSTEM = "S-1-5-18";
+export const SID_ADMINISTRATORS = "S-1-5-32-544";
+export const SID_CREATOR_OWNER = "S-1-3-0";
+export const SID_OWNER_RIGHTS = "S-1-3-4";
+/** SDDL well-known account abbreviations (subset relevant to file DACLs). */
+const SDDL_SID_ABBREVIATIONS = {
+    SY: SID_SYSTEM,
+    BA: SID_ADMINISTRATORS,
+    BU: "S-1-5-32-545", // Users
+    BG: "S-1-5-32-546", // Guests
+    PU: "S-1-5-32-547", // Power Users
+    WD: "S-1-1-0", // Everyone
+    AU: "S-1-5-11", // Authenticated Users
+    IU: "S-1-5-4", // Interactive
+    NU: "S-1-5-2", // Network
+    SU: "S-1-5-6", // Service
+    AN: "S-1-5-7", // Anonymous
+    LS: "S-1-5-19", // Local Service
+    NS: "S-1-5-20", // Network Service
+    CO: SID_CREATOR_OWNER,
+    CG: "S-1-3-1", // Creator Group
+    OW: SID_OWNER_RIGHTS,
+    RC: "S-1-5-12", // Restricted Code
+    AC: "S-1-15-2-1", // All application packages
+    DA: "S-1-5-21-<domain>-512", // Domain Admins (domain-relative; never trusted)
+    DU: "S-1-5-21-<domain>-513", // Domain Users
+    LA: "S-1-5-21-<domain>-500", // Local Administrator account
+    LG: "S-1-5-21-<domain>-501", // Local Guest account
+};
+/** Resolve an SDDL account field to a SID, or null when unknown. */
+export function sddlAccountToSid(account) {
+    const a = account.trim();
+    if (/^S-1-\d+(-\d+)+$/i.test(a))
+        return a.toUpperCase();
+    const abbr = SDDL_SID_ABBREVIATIONS[a.toUpperCase()];
+    if (!abbr || abbr.includes("<domain>"))
+        return null;
+    return abbr;
+}
+// --- rights -------------------------------------------------------------
+const FILE_WRITE_DATA = 0x2;
+const FILE_APPEND_DATA = 0x4;
+const FILE_WRITE_EA = 0x10;
+const FILE_DELETE_CHILD = 0x40;
+const FILE_WRITE_ATTRIBUTES = 0x100;
+const DELETE = 0x10000;
+const WRITE_DAC = 0x40000;
+const WRITE_OWNER = 0x80000;
+const GENERIC_ALL = 0x10000000;
+const GENERIC_WRITE = 0x40000000;
+/** Any of these bits lets the holder change the file or replace it. */
+export const WRITE_MASK = FILE_WRITE_DATA |
+    FILE_APPEND_DATA |
+    FILE_WRITE_EA |
+    FILE_DELETE_CHILD |
+    FILE_WRITE_ATTRIBUTES |
+    DELETE |
+    WRITE_DAC |
+    WRITE_OWNER |
+    GENERIC_ALL |
+    GENERIC_WRITE;
+/** SDDL rights tokens → access mask (generic + file-specific + DS bits). */
+const SDDL_RIGHTS_TOKENS = {
+    GA: GENERIC_ALL,
+    GR: 0x80000000,
+    GW: GENERIC_WRITE,
+    GX: 0x20000000,
+    FA: 0x1f01ff,
+    FR: 0x120089,
+    FW: 0x120116,
+    FX: 0x1200a0,
+    KA: 0xf003f,
+    KR: 0x20019,
+    KW: 0x20006,
+    KX: 0x20019,
+    RC: 0x20000,
+    SD: DELETE,
+    WD: WRITE_DAC,
+    WO: WRITE_OWNER,
+    RP: 0x10,
+    WP: 0x20,
+    CC: 0x1,
+    DC: 0x2,
+    LC: 0x4,
+    SW: 0x8,
+    LO: 0x80,
+    DT: 0x40,
+    CR: 0x100,
+};
+/** Decode an SDDL rights field to an access mask, or null when undecodable. */
+export function sddlRightsToMask(rights) {
+    const r = rights.trim();
+    if (!r)
+        return 0;
+    if (/^0x[0-9a-f]+$/i.test(r))
+        return Number.parseInt(r, 16) >>> 0;
+    if (/^\d+$/.test(r))
+        return Number.parseInt(r, 10) >>> 0;
+    if (r.length % 2 !== 0)
+        return null;
+    let mask = 0;
+    for (let i = 0; i < r.length; i += 2) {
+        const bits = SDDL_RIGHTS_TOKENS[r.slice(i, i + 2).toUpperCase()];
+        if (bits === undefined)
+            return null;
+        mask = (mask | bits) >>> 0;
+    }
+    return mask;
+}
+// --- parsing ------------------------------------------------------------
+/**
+ * Parse the DACL portion of an SDDL string into ACEs. Accepts a full security
+ * descriptor string (`O:...G:...D:...S:...`) or just the `D:` section.
+ * Returns null when no DACL section is present or an ACE is malformed.
+ */
+export function parseSddlDacl(sddl) {
+    const text = sddl.trim();
+    // Colons never occur inside an ACE or a SID, so section markers are unambiguous.
+    const dIdx = text.indexOf("D:");
+    if (dIdx < 0)
+        return null;
+    let body = text.slice(dIdx + 2);
+    const sIdx = body.indexOf("S:");
+    if (sIdx >= 0)
+        body = body.slice(0, sIdx);
+    // Strip DACL control flags (P, AI, AR, NO_ACCESS_CONTROL) before the first ACE.
+    const firstAce = body.indexOf("(");
+    const flags = firstAce < 0 ? body : body.slice(0, firstAce);
+    if (!/^[A-Z_]*$/i.test(flags.trim()))
+        return null;
+    if (firstAce < 0)
+        return [];
+    const aceText = body.slice(firstAce);
+    const aces = [];
+    const aceRe = /\(([^()]*)\)/g;
+    let consumed = 0;
+    let m;
+    while ((m = aceRe.exec(aceText)) !== null) {
+        if (m.index !== consumed)
+            return null; // junk between ACEs
+        consumed = m.index + m[0].length;
+        const fields = m[1].split(";");
+        if (fields.length < 6)
+            return null;
+        const [type, aceFlags, rights, , , account] = fields;
+        if (!type || !account)
+            return null;
+        aces.push({
+            type: type.trim().toUpperCase(),
+            flags: aceFlags.trim().toUpperCase(),
+            rights: rights.trim(),
+            account: account.trim(),
+        });
+    }
+    if (consumed !== aceText.trim().length)
+        return null;
+    return aces;
+}
+/**
+ * Parse the file `icacls <path> /save <file>` writes: UTF-16LE (optional BOM),
+ * CRLF, alternating `<name>` / `<sddl>` lines. Returns the SDDL of the first
+ * entry (the target itself), or an unreadable result.
+ */
+export function parseIcaclsSaveOutput(raw) {
+    let text;
+    if (Buffer.isBuffer(raw)) {
+        const hasLeBom = raw.length >= 2 && raw[0] === 0xff && raw[1] === 0xfe;
+        text = raw.toString("utf16le", hasLeBom ? 2 : 0);
+    }
+    else {
+        text = raw;
+    }
+    text = text.replace(/^\uFEFF/, "");
+    const lines = text.split(/\r?\n/).map((l) => l.trim());
+    const sddl = lines.find((l) => /^(O:|G:|D:|S:)/.test(l));
+    if (!sddl) {
+        return { readable: false, reason: "no SDDL line in icacls /save output" };
+    }
+    return { readable: true, sddl };
+}
+// --- platform readers ---------------------------------------------------
+/**
+ * Absolute path of a System32 tool. PATH lookup is not safe here: Git Bash and
+ * MSYS environments put a coreutils `whoami` ahead of Windows' `whoami.exe`,
+ * which does not understand `/user` and would make the current user SID look
+ * unknown on every run.
+ */
+export function system32Tool(exe) {
+    const winDir = process.env.SystemRoot ?? process.env.windir ?? "C:\\Windows";
+    return path.join(winDir, "System32", exe);
+}
+export function readAclWithIcaclsSave(targetPath) {
+    const stamp = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+    const saveFile = path.join(os.tmpdir(), `hq-acl-${stamp}.txt`);
+    try {
+        const res = spawnSync(system32Tool("icacls.exe"), [targetPath, "/save", saveFile], {
+            encoding: "utf8",
+            windowsHide: true,
+            timeout: 10_000,
+        });
+        if (res.error) {
+            return { readable: false, reason: `icacls unavailable: ${res.error.message}` };
+        }
+        if (res.status !== 0) {
+            const stderr = String(res.stderr ?? "").trim();
+            return {
+                readable: false,
+                reason: `icacls exited ${String(res.status)}${stderr ? `: ${stderr}` : ""}`,
+            };
+        }
+        let raw;
+        try {
+            raw = fs.readFileSync(saveFile);
+        }
+        catch (err) {
+            return { readable: false, reason: `icacls /save wrote nothing: ${err.message}` };
+        }
+        return parseIcaclsSaveOutput(raw);
+    }
+    catch (err) {
+        return { readable: false, reason: `icacls failed: ${err.message}` };
+    }
+    finally {
+        try {
+            fs.rmSync(saveFile, { force: true });
+        }
+        catch {
+            // best effort
+        }
+    }
+}
+let cachedCurrentUserSid;
+/** Current user's SID via `whoami /user /fo csv /nh`; null when unavailable. */
+export function readCurrentUserSid() {
+    if (cachedCurrentUserSid !== undefined)
+        return cachedCurrentUserSid;
+    try {
+        const res = spawnSync(system32Tool("whoami.exe"), ["/user", "/fo", "csv", "/nh"], {
+            encoding: "utf8",
+            windowsHide: true,
+            timeout: 10_000,
+        });
+        const m = /"(S-1-\d+(?:-\d+)+)"/i.exec(String(res.stdout ?? ""));
+        cachedCurrentUserSid = res.status === 0 && m ? m[1].toUpperCase() : null;
+    }
+    catch {
+        cachedCurrentUserSid = null;
+    }
+    return cachedCurrentUserSid;
+}
+/** Best-effort SID → account name (only used to build error messages). */
+export function resolveSidNameWithPowerShell(sid) {
+    if (!/^S-1-\d+(-\d+)+$/i.test(sid))
+        return null;
+    try {
+        const script = `(New-Object System.Security.Principal.SecurityIdentifier('${sid}'))` +
+            `.Translate([System.Security.Principal.NTAccount]).Value`;
+        const res = spawnSync(system32Tool("WindowsPowerShell/v1.0/powershell.exe"), ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", script], { encoding: "utf8", windowsHide: true, timeout: 15_000 });
+        const out = String(res.stdout ?? "").trim();
+        return res.status === 0 && out ? out : null;
+    }
+    catch {
+        return null;
+    }
+}
+// --- evaluation ---------------------------------------------------------
+/**
+ * Evaluate parsed ACEs against the trusted SID set.
+ * - `unsafe`: an allow ACE grants a write bit to a resolved, untrusted SID.
+ * - `unresolvable`: a write-granting ACE whose SID or rights cannot be decoded,
+ *   or whose SID is a per-machine/domain SID while the current user is unknown.
+ * - `safe`: everything else (deny ACEs and read-only grants are ignored).
+ */
+export function evaluateDacl(aces, opts) {
+    const trusted = new Set([SID_SYSTEM, SID_ADMINISTRATORS, SID_CREATOR_OWNER, SID_OWNER_RIGHTS]);
+    if (opts.currentUserSid)
+        trusted.add(opts.currentUserSid.toUpperCase());
+    if (opts.ownerSid)
+        trusted.add(opts.ownerSid.toUpperCase());
+    for (const ace of aces) {
+        if (ace.type !== "A")
+            continue; // deny / audit / object ACEs never grant
+        if (ace.flags.includes("IO"))
+            continue; // inherit-only: no effect on this object
+        const mask = sddlRightsToMask(ace.rights);
+        if (mask === null) {
+            return {
+                kind: "unresolvable",
+                reason: `cannot decode rights "${ace.rights}" for ${ace.account}`,
+            };
+        }
+        if ((mask & WRITE_MASK) === 0)
+            continue;
+        const sid = sddlAccountToSid(ace.account);
+        if (!sid) {
+            return { kind: "unresolvable", reason: `cannot resolve principal "${ace.account}" to a SID` };
+        }
+        if (trusted.has(sid))
+            continue;
+        if (!opts.currentUserSid && /^S-1-5-21-/.test(sid)) {
+            return {
+                kind: "unresolvable",
+                reason: `current user SID unknown; cannot tell whether ${sid} is the current user`,
+            };
+        }
+        return { kind: "unsafe", sid, rights: ace.rights };
+    }
+    return { kind: "safe" };
+}
+const reducedGuaranteeReported = new Set();
+/**
+ * Per-process memo of non-throwing verdicts, keyed by the object's identity
+ * and NTFS ChangeTime (Node `ctimeMs`), which advances whenever the DACL is
+ * modified. Spawning icacls costs ~100-200ms; hooks may read the config many
+ * times per process. Unsafe verdicts are never cached.
+ */
+const verdictCache = new Map();
+function cacheKey(targetPath) {
+    try {
+        const st = fs.lstatSync(targetPath);
+        return { ino: st.ino, ctimeMs: st.ctimeMs };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Assert the Windows DACL of `targetPath` grants write only to trusted
+ * principals. Throws UnsafeConfigPathError naming the offending principal.
+ * Unreadable or unresolvable DACL → reduced-guarantee diagnostic (once per
+ * path), no throw. See the module header for the exact conditions.
+ */
+export function assertWindowsOwnerOnlyAcl(targetPath, kind, opts = {}) {
+    const readAcl = opts.readAcl ?? readAclWithIcaclsSave;
+    const resolveSidName = opts.resolveSidName ?? resolveSidNameWithPowerShell;
+    const diagnostic = opts.diagnostic ?? ((line) => process.stderr.write(`${line}\n`));
+    const currentUserSid = opts.currentUserSid === undefined ? readCurrentUserSid() : opts.currentUserSid;
+    const reducedGuarantee = (reason) => {
+        // Reduced-guarantee path: see module header. Deliberately not a throw.
+        if (reducedGuaranteeReported.has(targetPath))
+            return;
+        reducedGuaranteeReported.add(targetPath);
+        diagnostic(`work-context: could not evaluate Windows ACL for ${kind} ${targetPath} (${reason}); ` +
+            "config is unprotected on this platform (reduced guarantee)");
+    };
+    const key = cacheKey(targetPath);
+    const cached = key ? verdictCache.get(targetPath) : undefined;
+    if (key && cached && cached.ino === key.ino && cached.ctimeMs === key.ctimeMs)
+        return;
+    const acl = readAcl(targetPath);
+    if (!acl.readable) {
+        reducedGuarantee(acl.reason);
+        if (key)
+            verdictCache.set(targetPath, key);
+        return;
+    }
+    const aces = parseSddlDacl(acl.sddl);
+    if (aces === null) {
+        reducedGuarantee(`unparseable SDDL "${acl.sddl}"`);
+        if (key)
+            verdictCache.set(targetPath, key);
+        return;
+    }
+    const verdict = evaluateDacl(aces, { currentUserSid, ownerSid: opts.ownerSid ?? null });
+    if (verdict.kind === "safe") {
+        if (key)
+            verdictCache.set(targetPath, key);
+        return;
+    }
+    if (verdict.kind === "unresolvable") {
+        reducedGuarantee(verdict.reason);
+        if (key)
+            verdictCache.set(targetPath, key);
+        return;
+    }
+    const name = resolveSidName(verdict.sid);
+    const who = name ? `${name} (${verdict.sid})` : verdict.sid;
+    throw new UnsafeConfigPathError(`Config ${kind} ${targetPath} is writable by ${who} [rights ${verdict.rights}] ` +
+        "(expected owner-only: current user, SYSTEM, Administrators)");
+}
+/** Test hook: forget which paths already emitted the reduced-guarantee line. */
+export function resetWindowsAclDiagnostics() {
+    reducedGuaranteeReported.clear();
+    verdictCache.clear();
+    cachedCurrentUserSid = undefined;
+}
+//# sourceMappingURL=windows-acl.js.map

package/dist/lib/workers-registry/index.js

@@ -18,10 +18,26 @@ function isFile(target) {
         return false;
     }
 }
-/** A sorted `find -L … -name worker.yaml -type f` equivalent, including symlinked pack workers. */
+/**
+ * A sorted `find -L … -name worker.yaml -type f` equivalent, including
+ * symlinked pack workers.
+ *
+ * Excluded subtrees are pruned at the descent, not filtered from the result.
+ * That distinction is the whole cost of this scan: a tenant's `repos/` holds
+ * source checkouts, so filtering afterwards means reading every `node_modules`
+ * and `.git` directory inside them — tens of thousands of directories on a real
+ * root — to produce matches that are discarded a moment later.
+ *
+ * Directory entries carry their own type, so the common case costs one
+ * `readdir` per directory instead of an extra `stat` per entry. Symlinks are
+ * the exception: their dirent type describes the link, so resolving one still
+ * needs a `stat`, which is what keeps this faithful to `find -L`.
+ */
 function workerYamlFiles(root, relativeRoot) {
     const output = [];
     const walk = (relative, ancestors) => {
+        if (isExcludedWorkerDirectory(relative))
+            return;
         const absolute = path.join(root, relative);
         if (!isDirectory(absolute))
             return;
@@ -35,20 +51,23 @@ function workerYamlFiles(root, relativeRoot) {
         if (ancestors.has(physical))
             return; // `find -L` reports loops; a bounded walk is safer here.
         const nextAncestors = new Set(ancestors).add(physical);
-        let names;
+        let entries;
         try {
-            names = fs.readdirSync(absolute).sort();
+            entries = fs.readdirSync(absolute, { withFileTypes: true });
         }
         catch {
             return;
         }
-        for (const name of names) {
-            const childRelative = path.join(relative, name);
+        entries.sort((left, right) => (left.name < right.name ? -1 : left.name > right.name ? 1 : 0));
+        for (const entry of entries) {
+            const childRelative = path.join(relative, entry.name);
             const child = path.join(root, childRelative);
-            if (name === 'worker.yaml' && isFile(child))
+            if (entry.name === 'worker.yaml' && (entry.isFile() || isFile(child))) {
                 output.push(childRelative);
-            else if (isDirectory(child))
+            }
+            else if (entry.isDirectory() || (entry.isSymbolicLink() && isDirectory(child))) {
                 walk(childRelative, nextAncestors);
+            }
         }
     };
     walk(relativeRoot, new Set());
@@ -124,6 +143,41 @@ function registryText(now, entries) {
 function withoutTimestamp(content) {
     return content.split('\n').filter((line) => !line.startsWith('generated_at:')).join('\n');
 }
+/**
+ * Worker roots hold two kinds of `worker.yaml` that must never reach the
+ * registry.
+ *
+ * The `_template` company and any `_overrides` directory are scaffolding —
+ * copies kept so a new tenant or a pack override can be stamped out from them.
+ *
+ * A checkout nested under a tenant's `repos/` is a source repository that tenant
+ * happens to keep inside HQ, and when that repository is HQ itself, its own
+ * `core/workers` and template trees are full of worker.yaml files. Indexing them
+ * treats product source as deployed workers: they claim ids real workers already
+ * own, and because duplicates resolve by path order — a tenant path sorts before
+ * both `core` and `personal` — the checkout wins. The operator's actual worker
+ * then silently vanishes from the registry every skill reads.
+ */
+function isExcludedWorkerDirectory(relativeDirectory) {
+    const normalized = relativeDirectory.replaceAll('\\', '/');
+    const [root, tenant, nested] = normalized.split('/');
+    if (root !== 'companies')
+        return /(?:^|\/)_overrides(?:\/|$)/.test(normalized);
+    if (tenant === '_template')
+        return true;
+    if (nested === 'repos')
+        return true;
+    return /(?:^|\/)_overrides(?:\/|$)/.test(normalized);
+}
+/**
+ * Every exclusion is a property of the directory holding the `worker.yaml`, so
+ * the file rule is the directory rule applied to its parent. Deriving it keeps
+ * the pruned descent and this final filter from ever disagreeing — a drift that
+ * would either resurrect a shadowing copy or silently drop a real worker.
+ */
+function isExcludedWorkerPath(relativeFile) {
+    return isExcludedWorkerDirectory(path.dirname(relativeFile));
+}
 /**
  * Generate core/workers/registry.yaml from worker.yaml files. Invalid workers
  * are quarantined but do not prevent all valid workers from being registered.
@@ -138,7 +192,7 @@ export function generateWorkersRegistry(hqRoot, options = {}) {
         ...workerYamlFiles(hqRoot, 'personal/workers'),
     ].sort();
     for (const relativeFile of files) {
-        if (relativeFile.startsWith('companies/_template/') || /(?:^|[/\\])_overrides(?:[/\\]|$)/.test(relativeFile))
+        if (isExcludedWorkerPath(relativeFile))
             continue;
         const fields = readWorkerFields(path.join(hqRoot, relativeFile));
         const missing = ['id', 'type', 'description'].filter((key) => !fields[key]);

package/dist/lib/workers-registry/read.d.ts

@@ -0,0 +1,15 @@
+export interface RegistryWorker {
+    id: string;
+    path: string;
+    type: string;
+    visibility: string;
+    company?: string;
+    team?: string;
+    status?: string;
+    description?: string;
+    triggers?: string;
+    grants?: string;
+}
+/** Read + parse the worker registry. Empty array if it does not exist. */
+export declare function readWorkerRegistry(hqRoot: string): RegistryWorker[];
+//# sourceMappingURL=read.d.ts.map