@mnemonik/cli 7.109.3 → 7.111.0

package/dist/runtime/signers.js

@@ -21,7 +21,6 @@ import { basename, dirname, join, resolve, sep, win32 } from "node:path";
 import { createHash, createPublicKey, randomUUID, timingSafeEqual, verify as verifySignature } from "node:crypto";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
-import { hostname } from "node:os";
 function decodeBase64(text, length) {
   const bytes = Buffer.from(text, "base64");
   if (bytes.length !== length || bytes.toString("base64") !== text)
@@ -101,13 +100,30 @@ function readIdentity(stdout2) {
     throw new Error("acl_identity_unavailable");
   return { name: match[1], sid: match[2] };
 }
+function* readWindowsIdentity() {
+  const user = readIdentity(yield [windowsCommand("whoami.exe"), identityArgs]);
+  if (!ADMINISTRATOR_RID.test(user.sid))
+    return user;
+  const groups = yield [windowsCommand("whoami.exe"), groupArgs];
+  const local = /^"[^"\r\n]*","[^"\r\n]*","S-1-5-113",/m.test(groups);
+  return {
+    ...user,
+    localAdministratorSid: local ? `${user.sid.slice(0, user.sid.lastIndexOf("-"))}-500` : null
+  };
+}
 function windowsCurrentAccountSync() {
-  return currentIdentity ??= readIdentity(hookExecuteSync(windowsCommand("whoami.exe"), identityArgs));
+  if (currentIdentity)
+    return currentIdentity;
+  const commands = readWindowsIdentity();
+  let step = commands.next();
+  while (!step.done)
+    step = commands.next(hookExecuteSync(...step.value));
+  return currentIdentity = step.value;
 }
 async function windowsIdentity(run) {
   if (currentIdentity)
     return currentIdentity;
-  identityPending ??= run(windowsCommand("whoami.exe"), identityArgs).then((result) => currentIdentity = readIdentity(stdout(result))).finally(() => {
+  identityPending ??= drive(readWindowsIdentity(), run).then((identity) => currentIdentity = identity).finally(() => {
     identityPending = void 0;
   });
   return identityPending;
@@ -164,8 +180,8 @@ function privateEntries(entries, user, directory) {
     const ace = /^\(([AD]);((?:OI|CI|NP|IO|ID|SA|FA)*);[A-Za-z0-9]+;;;((?:S-1-(?:\d+-)+\d+)|[A-Z]{2})\)$/.exec(line);
     if (!ace)
       throw new Error("acl_unavailable");
-    const ownAlias = ace[3] === "LA" && user.sid.endsWith("-500") && user.name.toLowerCase().startsWith(hostname().toLowerCase() + "\\");
-    return (!directory || !ace[2]?.includes("ID")) && (ace[1] === "D" || ace[3] === user.sid || ownAlias);
+    const sid = ace[3] === "LA" ? user.localAdministratorSid : ace[3];
+    return (!directory || !ace[2]?.includes("ID")) && (ace[1] === "D" || sid === user.sid);
   });
 }
 function* prepareAclDirectory(state) {
@@ -188,7 +204,7 @@ function* prepareAclDirectory(state) {
   if (!stat.isDirectory() || stat.isSymbolicLink())
     throw new Error("acl_permissions");
   if (!auditDirectories.has(directory)) {
-    currentIdentity ??= readIdentity(yield [windowsCommand("whoami.exe"), identityArgs]);
+    currentIdentity ??= yield* readWindowsIdentity();
     yield [windowsCommand("icacls.exe"), aclArgs(directory, currentIdentity.sid, created)];
     if (!created) {
       const temp = join(directory, `.acl-${randomUUID()}.tmp`);
@@ -285,7 +301,8 @@ function* hookPermission(path, created, session, directory = true) {
       if (lstatSync(session).isSymbolicLink() || !lstatSync(marker).isFile() || lstatSync(marker).isSymbolicLink())
         throw new Error("cache unavailable");
       receipt = JSON.parse(readFileSync(marker, "utf8"));
-      if (!receipt || !receipt.paths || !receipt.identity || !/^S-1-(?:\d+-)+\d+$/.test(receipt.identity.sid) || typeof receipt.identity.name !== "string")
+      if (!receipt || !receipt.paths || !receipt.identity || !/^S-1-(?:\d+-)+\d+$/.test(receipt.identity.sid) || typeof receipt.identity.name !== "string" || // Written before LA was resolved by SID: re-read the token instead.
+      ADMINISTRATOR_RID.test(receipt.identity.sid) && receipt.identity.localAdministratorSid === void 0)
         receipt = void 0;
     } catch {
     }
@@ -297,7 +314,7 @@ function* hookPermission(path, created, session, directory = true) {
     receipts.set(session, receipt);
     return;
   }
-  currentIdentity ??= readIdentity(yield [windowsCommand("whoami.exe"), identityArgs]);
+  currentIdentity ??= yield* readWindowsIdentity();
   const user = currentIdentity;
   if (receipt && receipt.identity.sid !== user.sid)
     receipt = void 0;
@@ -444,7 +461,7 @@ async function auditWindowsPermissions(state, paths, run = hookExecute, recursiv
   }
   return verdicts;
 }
-var execute, quote, RELEASE_MINISIGN_PUBLIC_KEY, identityArgs, currentIdentity, receipts, ttl, fresh, identityPending, aclArgs, hookOptions, hookExecute, stdout, auditDirectories, directoryPending, ownerWidth, unknownOwner;
+var execute, quote, RELEASE_MINISIGN_PUBLIC_KEY, identityArgs, groupArgs, ADMINISTRATOR_RID, currentIdentity, receipts, ttl, fresh, identityPending, aclArgs, hookOptions, hookExecute, stdout, auditDirectories, directoryPending, ownerWidth, unknownOwner;
 var init_runtimeSigners = __esm({
   "packages/shared/dist/runtimeSigners.js"() {
     "use strict";
@@ -461,6 +478,8 @@ var init_runtimeSigners = __esm({
     quote = (text) => `'${text.replaceAll("'", "''")}'`;
     RELEASE_MINISIGN_PUBLIC_KEY = "RWSBYwgbjz0qKB4/ToA3dywBiAlQeBjoQpib4OHdjP2nDbpQnOVqpPm0";
     identityArgs = ["/user", "/fo", "csv", "/nh"];
+    groupArgs = ["/groups", "/fo", "csv", "/nh"];
+    ADMINISTRATOR_RID = /^S-1-5-21-\d+-\d+-\d+-500$/;
     receipts = /* @__PURE__ */ new Map();
     ttl = 10 * 6e4;
     fresh = (time) => time !== void 0 && Date.now() >= time && Date.now() - time < ttl;

package/dist/runtime/store.js

@@ -16,7 +16,6 @@ import { basename, dirname, join, resolve, sep, win32 } from "node:path";
 import { createHash, createPublicKey, randomUUID, timingSafeEqual, verify as verifySignature } from "node:crypto";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
-import { hostname } from "node:os";
 function decodeBase64(text, length) {
   const bytes = Buffer.from(text, "base64");
   if (bytes.length !== length || bytes.toString("base64") !== text)
@@ -96,10 +95,21 @@ function readIdentity(stdout2) {
     throw new Error("acl_identity_unavailable");
   return { name: match[1], sid: match[2] };
 }
+function* readWindowsIdentity() {
+  const user = readIdentity(yield [windowsCommand("whoami.exe"), identityArgs]);
+  if (!ADMINISTRATOR_RID.test(user.sid))
+    return user;
+  const groups = yield [windowsCommand("whoami.exe"), groupArgs];
+  const local = /^"[^"\r\n]*","[^"\r\n]*","S-1-5-113",/m.test(groups);
+  return {
+    ...user,
+    localAdministratorSid: local ? `${user.sid.slice(0, user.sid.lastIndexOf("-"))}-500` : null
+  };
+}
 async function windowsIdentity(run) {
   if (currentIdentity)
     return currentIdentity;
-  identityPending ??= run(windowsCommand("whoami.exe"), identityArgs).then((result) => currentIdentity = readIdentity(stdout(result))).finally(() => {
+  identityPending ??= drive(readWindowsIdentity(), run).then((identity) => currentIdentity = identity).finally(() => {
     identityPending = void 0;
   });
   return identityPending;
@@ -152,8 +162,8 @@ function privateEntries(entries, user, directory) {
     const ace = /^\(([AD]);((?:OI|CI|NP|IO|ID|SA|FA)*);[A-Za-z0-9]+;;;((?:S-1-(?:\d+-)+\d+)|[A-Z]{2})\)$/.exec(line);
     if (!ace)
       throw new Error("acl_unavailable");
-    const ownAlias = ace[3] === "LA" && user.sid.endsWith("-500") && user.name.toLowerCase().startsWith(hostname().toLowerCase() + "\\");
-    return (!directory || !ace[2]?.includes("ID")) && (ace[1] === "D" || ace[3] === user.sid || ownAlias);
+    const sid = ace[3] === "LA" ? user.localAdministratorSid : ace[3];
+    return (!directory || !ace[2]?.includes("ID")) && (ace[1] === "D" || sid === user.sid);
   });
 }
 function* prepareAclDirectory(state) {
@@ -176,7 +186,7 @@ function* prepareAclDirectory(state) {
   if (!stat.isDirectory() || stat.isSymbolicLink())
     throw new Error("acl_permissions");
   if (!auditDirectories.has(directory)) {
-    currentIdentity ??= readIdentity(yield [windowsCommand("whoami.exe"), identityArgs]);
+    currentIdentity ??= yield* readWindowsIdentity();
     yield [windowsCommand("icacls.exe"), aclArgs(directory, currentIdentity.sid, created)];
     if (!created) {
       const temp = join(directory, `.acl-${randomUUID()}.tmp`);
@@ -339,7 +349,7 @@ async function auditWindowsPermissions(state, paths, run = hookExecute, recursiv
   }
   return verdicts;
 }
-var execute, quote, RELEASE_MINISIGN_PUBLIC_KEY, identityArgs, currentIdentity, ttl, identityPending, aclArgs, hookOptions, hookExecute, stdout, auditDirectories, directoryPending, ownerWidth, unknownOwner;
+var execute, quote, RELEASE_MINISIGN_PUBLIC_KEY, identityArgs, groupArgs, ADMINISTRATOR_RID, currentIdentity, ttl, identityPending, aclArgs, hookOptions, hookExecute, stdout, auditDirectories, directoryPending, ownerWidth, unknownOwner;
 var init_runtimeSigners = __esm({
   "packages/shared/dist/runtimeSigners.js"() {
     "use strict";
@@ -356,6 +366,8 @@ var init_runtimeSigners = __esm({
     quote = (text) => `'${text.replaceAll("'", "''")}'`;
     RELEASE_MINISIGN_PUBLIC_KEY = "RWSBYwgbjz0qKB4/ToA3dywBiAlQeBjoQpib4OHdjP2nDbpQnOVqpPm0";
     identityArgs = ["/user", "/fo", "csv", "/nh"];
+    groupArgs = ["/groups", "/fo", "csv", "/nh"];
+    ADMINISTRATOR_RID = /^S-1-5-21-\d+-\d+-\d+-500$/;
     ttl = 10 * 6e4;
     aclArgs = (path, sid, created = false) => [
       path,

package/dist/runtime/updateCheck.d.ts

@@ -0,0 +1,4 @@
+import type { ReadinessUpdateCheck } from '@mnemonik/shared';
+export declare function recordUpdateCheck(stateDir: string, result: ReadinessUpdateCheck['result'], now?: () => number): Promise<void>;
+export declare function readUpdateCheck(stateDir: string): Promise<ReadinessUpdateCheck | undefined>;
+//# sourceMappingURL=updateCheck.d.ts.map

package/dist/runtime/updateCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"updateCheck.d.ts","sourceRoot":"","sources":["../../src/runtime/updateCheck.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAS7D,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EACtC,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAcjG"}