@mnemonik/cli 7.104.1 → 7.104.4

package/dist/vendor/shared/runtimeSigners.js

@@ -4,6 +4,7 @@ import { basename, dirname, join, resolve, sep, win32 } from 'node:path';
 import { createHash, createPublicKey, randomUUID, timingSafeEqual, verify as verifySignature, } from 'node:crypto';
 import { execFile, execFileSync } from 'node:child_process';
 import { promisify } from 'node:util';
+import { hostname } from 'node:os';
 export const execute = (file, args, input) => {
     const result = promisify(execFile)(file, args);
     if (input === undefined)
@@ -140,11 +141,12 @@ export async function verifyWindowsAcl(path, run = hookExecute, state) {
     if (!privateEntries((await drive(saveAcl(path, false, [path], state), run)).get(path), user, false))
         throw new Error('acl_permissions');
 }
-const aclArgs = (path, sid) => [
+const aclArgs = (path, sid, created = false) => [
     path,
     '/inheritance:r',
     '/grant:r',
     `*${sid}:(OI)(CI)F`,
+    ...(created ? ['/remove:g', '*S-1-5-32-544', '*S-1-5-18'] : []),
 ];
 // Keep injected runners at the logical-command boundary; native execution owns encoding.
 function hookInvocation(file, args) {
@@ -223,7 +225,10 @@ function privateEntries(entries, user, directory) {
         const ace = /^\(([AD]);((?:OI|CI|NP|IO|ID|SA|FA)*);[A-Za-z0-9]+;;;((?:S-1-(?:\d+-)+\d+)|[A-Z]{2})\)$/.exec(line);
         if (!ace)
             throw new Error('acl_unavailable');
-        return (!directory || !ace[2]?.includes('ID')) && (ace[1] === 'D' || ace[3] === user.sid);
+        const ownAlias = ace[3] === 'LA' &&
+            user.sid.endsWith('-500') &&
+            user.name.toLowerCase().startsWith(hostname().toLowerCase() + '\\');
+        return ((!directory || !ace[2]?.includes('ID')) && (ace[1] === 'D' || ace[3] === user.sid || ownAlias));
     });
 }
 const auditDirectories = new Set();
@@ -249,7 +254,7 @@ function* prepareAclDirectory(state) {
         throw new Error('acl_permissions');
     if (!auditDirectories.has(directory)) {
         currentIdentity ??= readIdentity(yield [windowsCommand('whoami.exe'), identityArgs]);
-        yield [windowsCommand('icacls.exe'), aclArgs(directory, currentIdentity.sid)];
+        yield [windowsCommand('icacls.exe'), aclArgs(directory, currentIdentity.sid, created)];
         if (!created) {
             const temp = join(directory, `.acl-${randomUUID()}.tmp`);
             writeFileSync(temp, '', { flag: 'wx', mode: 0o600 });
@@ -319,14 +324,21 @@ function dirEntry(line) {
     return owner && name ? { owner, name } : undefined;
 }
 const unknownOwner = (owner, user) => user.name.length >= ownerWidth || owner.length >= ownerWidth || owner.includes('...');
-function ownerLookup(paths) {
+function ownerLookup(paths, restoreOwner) {
     if (paths.some((path) => /[\t\r\n]/.test(path)))
         throw new Error('acl_path_unavailable');
     const script = `$ErrorActionPreference = 'Stop'
 [Console]::InputEncoding = [System.Text.UTF8Encoding]::new($false)
 [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)
 while ($null -ne ($path = [Console]::ReadLine())) {
-  $owner = (Get-Acl -LiteralPath $path).GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+  ${restoreOwner
+        ? `$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+  if ($identity.User.Value -eq ${quote(restoreOwner)} -and $identity.Owner.Value -eq 'S-1-5-32-544') {
+    & ${quote(windowsCommand('icacls.exe'))} $path /setowner ${quote('*' + restoreOwner)} /l | Out-Null
+    if ($LASTEXITCODE -ne 0) { throw 'acl_owner' }
+  }`
+        : ''}
+  $owner = [System.IO.File]::GetAccessControl($path).GetOwner([System.Security.Principal.SecurityIdentifier]).Value
   [Console]::WriteLine($path + "\`t" + $owner)
 }`;
     return [
@@ -395,16 +407,28 @@ function* hookPermission(path, created, session, directory = true) {
         return entry?.name.toLowerCase() === basename(path).toLowerCase() ? [entry.owner] : [];
     });
     let owner = owners[0];
-    if (owners.length === 1 && owner && unknownOwner(owner, user))
+    const currentOwner = () => [user.name.toLowerCase(), user.sid.toLowerCase()].includes(owner ?? '');
+    if (owners.length === 1 &&
+        owner &&
+        (unknownOwner(owner, user) || (!currentOwner() && !/^s-1-(?:\d+-)+\d+$/.test(owner))))
         owner = ownerSids(yield ownerLookup([path])).get(path);
-    if (owners.length !== 1 ||
-        ![user.name.toLowerCase(), user.sid.toLowerCase()].includes(owner ?? ''))
+    const elevatedOwner = owner === 's-1-5-32-544';
+    if (owners.length !== 1 || (!currentOwner() && !elevatedOwner))
         throw new Error('acl_owner');
     const icacls = windowsCommand('icacls.exe');
     if (created)
-        yield [icacls, aclArgs(path, user.sid)];
+        yield [icacls, aclArgs(path, user.sid, true)];
     let valid = privateEntries((yield* saveAcl(path, false)).get(path), user, directory);
-    if (!valid && !created && directory) {
+    if (elevatedOwner) {
+        // Existing group-owned paths must already be private. Only a freshly created
+        // directory may have its inherited ACL constrained before restoring its owner.
+        if (!valid)
+            throw new Error('acl_permissions');
+        owner = ownerSids(yield ownerLookup([path], user.sid)).get(path);
+        if (!currentOwner())
+            throw new Error('acl_owner');
+    }
+    else if (!valid && !created && directory) {
         yield [icacls, aclArgs(path, user.sid)];
         valid = privateEntries((yield* saveAcl(path, false)).get(path), user, directory);
     }
@@ -424,10 +448,6 @@ function* hookPermission(path, created, session, directory = true) {
         /* A missing receipt costs another audit next process. */
     }
 }
-export async function windowsCurrentUserDirectoryAcl(path, run = hookExecute) {
-    currentIdentity ??= readIdentity(stdout(await run(windowsCommand('whoami.exe'), identityArgs)));
-    await run(windowsCommand('icacls.exe'), aclArgs(path, currentIdentity.sid));
-}
 export async function protectWindowsDirectory(path, created, run = hookExecute, session = path) {
     await drive(hookPermission(path, created, session), run);
 }
@@ -493,14 +513,40 @@ export async function auditWindowsPermissions(state, paths, run = hookExecute, r
     }
     const verdicts = new Map();
     const ownerPaths = [...owners.keys()].filter((path) => path === root || path.startsWith(root + sep));
-    const truncated = new Set(ownerPaths.filter((path) => owners.get(path)?.includes('...')));
-    if (truncated.size) {
-        const result = await run(...ownerLookup([...truncated])).catch(() => ({ stdout: '' }));
+    const records = await drive(saveAcl(root, recursive, ownerPaths, tempState), run);
+    // Elevated Windows tokens create Administrators-owned files even with a private
+    // user DACL. Restore the exact-user invariant, including a failed install's
+    // directories, only after proving both the owner SID and the existing DACL.
+    const candidates = [...records]
+        .filter(([path, entries]) => {
+        const owner = owners.get(path);
+        if (!owner || owner === user.name.toLowerCase() || owner === user.sid.toLowerCase())
+            return false;
+        try {
+            return privateEntries(entries, user, false);
+        }
+        catch {
+            return false;
+        }
+    })
+        .map(([path]) => path);
+    const lookup = new Set([
+        ...ownerPaths.filter((path) => owners.get(path)?.includes('...')),
+        ...candidates,
+    ]);
+    if (lookup.size) {
+        const result = await run(...ownerLookup([...lookup])).catch(() => ({ stdout: '' }));
         for (const [path, sid] of ownerSids(stdout(result)))
-            if (truncated.has(path))
+            if (lookup.has(path))
                 owners.set(path, sid);
+        const elevated = candidates.filter((path) => owners.get(path) === 's-1-5-32-544');
+        if (elevated.length) {
+            const restored = ownerSids(stdout(await run(...ownerLookup(elevated, user.sid))));
+            for (const path of elevated)
+                owners.set(path, restored.get(path) ?? '...');
+        }
     }
-    for (const [path, entries] of await drive(saveAcl(root, recursive, ownerPaths, tempState), run)) {
+    for (const [path, entries] of records) {
         const owner = owners.get(path) ?? '...';
         const owned = owner === user.name.toLowerCase() || owner === user.sid.toLowerCase();
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemonik/cli",
-  "version": "7.104.1",
+  "version": "7.104.4",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/JayDeeCo-Limited/mnemonik-cli.git"
@@ -34,27 +34,27 @@
     "hosts": {
       "claude-code": {
         "package": "@mnemonik/claude-code-hooks",
-        "version": "0.9.211",
+        "version": "0.9.214",
         "closure": [
           {
             "name": "@mnemonik/claude-code-hooks",
-            "version": "0.9.211",
-            "integrity": "sha512-BmuXrQdkn/SBToENe/ZUq0ppb9Sjs0txc+QLHyKN4GAdw1YUWQBPgPTFdn2hmmAtgsc6PUKAo7gnWzjecYKL+g=="
+            "version": "0.9.214",
+            "integrity": "sha512-85PiXD51d79WbF61NE+QgFB2kjgR1HYxZjAANUmAYRLTh2PVTmtje+OpVsDC47WJsjdcTZl+EO7SrKq8qDZUqw=="
           },
           {
             "name": "@mnemonik/credentials",
-            "version": "0.1.32",
-            "integrity": "sha512-h0mACABOgOvqfvH/Ix0pM0z3J5J43yLySgFV7irMqEwI6EpaqcKmTvZQImsS0EwzL5vizzTW/CsqJ+Ke/YIiTA=="
+            "version": "0.1.35",
+            "integrity": "sha512-XiwRlIABOKrEnOAO+MnBWZQjXPbsi0uC4Qm3Dlge7hsA1Uh69e+1S7KIwp38lv+3nIVUmPXo26ja8xp8oemmcw=="
           },
           {
             "name": "@mnemonik/local-setup",
-            "version": "0.1.32",
-            "integrity": "sha512-vkeXDt+wRQ41+lb1LyvZVRGOCd+22CU6rbQIRm58XKh3GSGKp6X/uDn7tJeeqzOQ171uuP2ONACzZ61GVWqqfw=="
+            "version": "0.1.35",
+            "integrity": "sha512-Tddt66qAvGF7xxTrXQwY7Jyc13rJcLbpYJtyy49PEvWBGPD5k7+nbs2/SDcvMvakPDfLIUdVCoRWfgK6pIYoBQ=="
           },
           {
             "name": "@mnemonik/shared",
-            "version": "7.104.1",
-            "integrity": "sha512-iSJQAEF9W+d2aw6M0DAWF9xixKS0Nt5c2oLjxsr6M2Mhr6kdySt4/xua327QbCo5oRHVJhtrBHFU94Fz0r8rvg=="
+            "version": "7.104.4",
+            "integrity": "sha512-PakAp+aTma4MX8hwCs+Jkg1QiEuSKQPiEG6Cc16mkqOW4kYbS07JCZ93E69doUGrR4xBpbDw1l6iMTMUCaY6TQ=="
           },
           {
             "name": "ignore",
@@ -87,31 +87,31 @@
             "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="
           }
         ],
-        "releaseVersion": "7.104.1"
+        "releaseVersion": "7.104.4"
       },
       "codex": {
         "package": "@mnemonik/codex-hooks",
-        "version": "0.8.180",
+        "version": "0.8.183",
         "closure": [
           {
             "name": "@mnemonik/codex-hooks",
-            "version": "0.8.180",
-            "integrity": "sha512-ZI9Ceil3RIPtOmtsWHYoJKJSO63cqtcS3ORdZhAo+ABPVLLvswhkv26uSlCMmKWDPV1Jf/f7MzjXCtPWumfHhQ=="
+            "version": "0.8.183",
+            "integrity": "sha512-QXpQC7gW0sQ0WVgyxMXv87kztFPN26iAcNgGPPF3bsIsV264BGEwvRqPZ8UvctnA41nU56tXFs5vZ/lrFb40lA=="
           },
           {
             "name": "@mnemonik/credentials",
-            "version": "0.1.32",
-            "integrity": "sha512-h0mACABOgOvqfvH/Ix0pM0z3J5J43yLySgFV7irMqEwI6EpaqcKmTvZQImsS0EwzL5vizzTW/CsqJ+Ke/YIiTA=="
+            "version": "0.1.35",
+            "integrity": "sha512-XiwRlIABOKrEnOAO+MnBWZQjXPbsi0uC4Qm3Dlge7hsA1Uh69e+1S7KIwp38lv+3nIVUmPXo26ja8xp8oemmcw=="
           },
           {
             "name": "@mnemonik/local-setup",
-            "version": "0.1.32",
-            "integrity": "sha512-vkeXDt+wRQ41+lb1LyvZVRGOCd+22CU6rbQIRm58XKh3GSGKp6X/uDn7tJeeqzOQ171uuP2ONACzZ61GVWqqfw=="
+            "version": "0.1.35",
+            "integrity": "sha512-Tddt66qAvGF7xxTrXQwY7Jyc13rJcLbpYJtyy49PEvWBGPD5k7+nbs2/SDcvMvakPDfLIUdVCoRWfgK6pIYoBQ=="
           },
           {
             "name": "@mnemonik/shared",
-            "version": "7.104.1",
-            "integrity": "sha512-iSJQAEF9W+d2aw6M0DAWF9xixKS0Nt5c2oLjxsr6M2Mhr6kdySt4/xua327QbCo5oRHVJhtrBHFU94Fz0r8rvg=="
+            "version": "7.104.4",
+            "integrity": "sha512-PakAp+aTma4MX8hwCs+Jkg1QiEuSKQPiEG6Cc16mkqOW4kYbS07JCZ93E69doUGrR4xBpbDw1l6iMTMUCaY6TQ=="
           },
           {
             "name": "ignore",
@@ -144,31 +144,31 @@
             "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="
           }
         ],
-        "releaseVersion": "7.104.1"
+        "releaseVersion": "7.104.4"
       },
       "cursor": {
         "package": "@mnemonik/cursor-hooks",
-        "version": "0.7.167",
+        "version": "0.7.170",
         "closure": [
           {
             "name": "@mnemonik/cursor-hooks",
-            "version": "0.7.167",
-            "integrity": "sha512-/emJXT6h5S0OLnnnXtCFvLRJbq5bI79BP/E5O9H1JgMsHGJcbLMgM8yz2Q6Are3b5XoH3yVXmq04icxR5xHlgg=="
+            "version": "0.7.170",
+            "integrity": "sha512-k6c2nfnkB8aStT/dQP56WaFgVU/r1OeKrMdz+SKB65NpnIhWvpu+iKngLWM9SaLo5OslG6Qcc4ttr8Z/yesTQg=="
           },
           {
             "name": "@mnemonik/credentials",
-            "version": "0.1.32",
-            "integrity": "sha512-h0mACABOgOvqfvH/Ix0pM0z3J5J43yLySgFV7irMqEwI6EpaqcKmTvZQImsS0EwzL5vizzTW/CsqJ+Ke/YIiTA=="
+            "version": "0.1.35",
+            "integrity": "sha512-XiwRlIABOKrEnOAO+MnBWZQjXPbsi0uC4Qm3Dlge7hsA1Uh69e+1S7KIwp38lv+3nIVUmPXo26ja8xp8oemmcw=="
           },
           {
             "name": "@mnemonik/local-setup",
-            "version": "0.1.32",
-            "integrity": "sha512-vkeXDt+wRQ41+lb1LyvZVRGOCd+22CU6rbQIRm58XKh3GSGKp6X/uDn7tJeeqzOQ171uuP2ONACzZ61GVWqqfw=="
+            "version": "0.1.35",
+            "integrity": "sha512-Tddt66qAvGF7xxTrXQwY7Jyc13rJcLbpYJtyy49PEvWBGPD5k7+nbs2/SDcvMvakPDfLIUdVCoRWfgK6pIYoBQ=="
           },
           {
             "name": "@mnemonik/shared",
-            "version": "7.104.1",
-            "integrity": "sha512-iSJQAEF9W+d2aw6M0DAWF9xixKS0Nt5c2oLjxsr6M2Mhr6kdySt4/xua327QbCo5oRHVJhtrBHFU94Fz0r8rvg=="
+            "version": "7.104.4",
+            "integrity": "sha512-PakAp+aTma4MX8hwCs+Jkg1QiEuSKQPiEG6Cc16mkqOW4kYbS07JCZ93E69doUGrR4xBpbDw1l6iMTMUCaY6TQ=="
           },
           {
             "name": "ignore",
@@ -201,7 +201,7 @@
             "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="
           }
         ],
-        "releaseVersion": "7.104.1"
+        "releaseVersion": "7.104.4"
       }
     }
   }