@qqbrowser/qbot-dsh 0.0.7 → 0.0.9

package/node_modules/@deepseek-ai/dsh-sandbox-windows-acl/lib/types-CNjZgO4h.js

@@ -1 +0,0 @@
-var fe=Object.defineProperty;var c=(e,t)=>fe(e,"name",{value:t,configurable:!0});import{existsSync as J,mkdirSync as he,realpathSync as z,statSync as q}from"node:fs";import{dirname as we,isAbsolute as Se,join as me,relative as ge,resolve as Pe,sep as Ie}from"node:path";import{createHash as $}from"node:crypto";import f from"koffi";var b=class extends Error{static{c(this,"Win32Error")}api;win32Code;constructor(e,t,r){super(`${e} failed (Win32 ${t})${r===void 0?"":`: ${r}`}`),this.name="Win32Error",this.api=e,this.win32Code=t}};const M=3221225472,pe=1114454,ke=2032127,Ee=1024,We=8192;function m(e){return e==null||e===0n}c(m,"isNullPtr");function be(e){return m(e)?!0:e===18446744073709551615n||e===-1n}c(be,"isInvalidHandle");const s=f.pointer("void"),P=f.pointer(s),A=f.struct("STARTUPINFOW",{cb:"uint32",lpReserved:"str16",lpDesktop:"str16",lpTitle:"str16",dwX:"uint32",dwY:"uint32",dwXSize:"uint32",dwYSize:"uint32",dwXCountChars:"uint32",dwYCountChars:"uint32",dwFillAttribute:"uint32",dwFlags:"uint32",wShowWindow:"uint16",cbReserved2:"uint16",lpReserved2:f.pointer("uint8"),hStdInput:s,hStdOutput:s,hStdError:s}),L=f.struct("PROCESS_INFORMATION",{hProcess:s,hThread:s,dwProcessId:"uint32",dwThreadId:"uint32"});if(A.size!==104)throw new Error(`STARTUPINFOW layout mismatch: koffi computed ${A.size}, header probe says 104`);if(L.size!==24)throw new Error(`PROCESS_INFORMATION layout mismatch: koffi computed ${L.size}, header probe says 24`);function g(){return f.alloc(s,1)}c(g,"allocPtrSlot");function E(){return f.alloc("uint32",1)}c(E,"allocUint32");function ve(e,t){f.encode(e,"uint32",t)}c(ve,"encodeUint32");function p(e){const t=f.decode(e,s);return m(t)?null:t}c(p,"decodePtr");function D(e){return f.decode(e,"uint32")}c(D,"decodeUint32");function K(e){return f.address(e)}c(K,"ptrAddress");function F(e){return f.alloc("uint8",e)}c(F,"allocBytes");function Te(){return F(32)}c(Te,"allocOverlapped");function V(e,t){const r=f.decode(e,t,s);return m(r)?null:r}c(V,"decodePtrAt");function W(e,t){return f.decode(e,t,"uint8")}c(W,"decodeUint8At");function x(e,t){return f.decode(e,t,"uint16")}c(x,"decodeUint16At");function R(e,t){return f.decode(e,t,"uint32")}c(R,"decodeUint32At");function Ce(e,t,r,n){if(W(e,t)!==W(r,n))return!1;const o=W(e,t+1);if(o!==W(r,n+1)||o>15)return!1;for(let i=0;i<6;i++)if(W(e,t+2+i)!==W(r,n+2+i))return!1;for(let i=0;i<o;i++)if(R(e,t+8+i*4)!==R(r,n+8+i*4))return!1;return!0}c(Ce,"sameSidAt");function Y(){return f.alloc(A,1)}c(Y,"allocStartupInfo");function X(e,t){f.encode(e,A,t)}c(X,"encodeStartupInfo");function Q(){return f.alloc(L,1)}c(Q,"allocProcessInfo");function Z(e){return f.decode(e,L)}c(Z,"decodeProcessInfo");let H;function ee(){if(H!==void 0)return H;const e=f.load("kernel32.dll"),t=f.load("advapi32.dll"),r=c((n,o,i,l)=>n.func("__stdcall",o,i,l),"bind");return H={openProcess:r(e,"OpenProcess",s,["uint32","int","uint32"]),openProcessToken:r(t,"OpenProcessToken","int",[s,"uint32",P]),closeHandle:r(e,"CloseHandle","int",[s]),getLastError:r(e,"GetLastError","uint32",[]),formatMessageW:r(e,"FormatMessageW","uint32",["uint32",s,"uint32","uint32",s,"uint32",s]),localAlloc:r(e,"LocalAlloc",s,["uint32","size_t"]),localFree:r(e,"LocalFree",s,[s]),convertStringSidToSidW:r(t,"ConvertStringSidToSidW","int",["str16",P]),createWellKnownSid:r(t,"CreateWellKnownSid","int",["int",s,s,f.pointer("uint32")]),isValidSid:r(t,"IsValidSid","int",[s]),getLengthSid:r(t,"GetLengthSid","uint32",[s]),copySid:r(t,"CopySid","int",["uint32",s,s]),getTokenInformation:r(t,"GetTokenInformation","int",[s,"int",s,"uint32",f.pointer("uint32")]),setTokenInformation:r(t,"SetTokenInformation","int",[s,"int",s,"uint32"]),createRestrictedToken:r(t,"CreateRestrictedToken","int",[s,"uint32","uint32",s,"uint32",s,"uint32",s,P]),setEntriesInAclW:r(t,"SetEntriesInAclW","uint32",["uint32",s,s,P]),setNamedSecurityInfoW:r(t,"SetNamedSecurityInfoW","uint32",["str16","int","uint32",s,s,s,s]),getNamedSecurityInfoW:r(t,"GetNamedSecurityInfoW","uint32",["str16","int","uint32",P,P,P,P,P]),getTempPathW:r(e,"GetTempPathW","uint32",["uint32",s]),createFileW:r(e,"CreateFileW",s,["str16","uint32","uint32",s,"uint32","uint32",s]),lockFileEx:r(e,"LockFileEx","int",[s,"uint32","uint32","uint32","uint32",s]),unlockFileEx:r(e,"UnlockFileEx","int",[s,"uint32","uint32","uint32",s]),createPipe:r(e,"CreatePipe","int",[P,P,s,"uint32"]),setHandleInformation:r(e,"SetHandleInformation","int",[s,"uint32","uint32"]),createProcessAsUserW:r(t,"CreateProcessAsUserW","int",[s,"str16","str16",s,s,"int","uint32",s,"str16",f.pointer(A),f.pointer(L)]),setEnvironmentVariableW:r(e,"SetEnvironmentVariableW","int",["str16","str16"]),readFile:r(e,"ReadFile","int",[s,s,"uint32",f.pointer("uint32"),s]),peekNamedPipe:r(e,"PeekNamedPipe","int",[s,s,"uint32",f.pointer("uint32"),f.pointer("uint32"),f.pointer("uint32")]),waitForSingleObject:r(e,"WaitForSingleObject","uint32",[s,"uint32"]),getExitCodeProcess:r(e,"GetExitCodeProcess","int",[s,f.pointer("uint32")]),resumeThread:r(e,"ResumeThread","uint32",[s]),createJobObjectW:r(e,"CreateJobObjectW",s,[s,"str16"]),setInformationJobObject:r(e,"SetInformationJobObject","int",[s,"int",s,"uint32"]),assignProcessToJobObject:r(e,"AssignProcessToJobObject","int",[s,s]),terminateProcess:r(e,"TerminateProcess","int",[s,"uint32"]),setConsoleCtrlHandler:r(e,"SetConsoleCtrlHandler","int",[s,"int"]),getStdHandle:r(e,"GetStdHandle",s,["int"])},H}c(ee,"bindings");function te(){return Promise.resolve(ee())}c(te,"win32");function Ae(){return ee()}c(Ae,"win32Sync");function re(e,t){const r=Buffer.alloc(1024),n=e.formatMessageW(4608,null,t,0,r,r.length/2,null);return n===0?"":r.subarray(0,n*2).toString("utf16le").trim()}c(re,"errorText");function Le(e){const t=Buffer.alloc(522),r=e.getTempPathW(t.length/2,t);if(r===0&&a(e,"GetTempPathW"),r>t.length/2)throw new b("GetTempPathW",122,`required ${r} chars exceed the ${t.length/2}-char buffer; nothing was written`);return t.subarray(0,r*2).toString("utf16le")}c(Le,"getTempPath");function a(e,t,r){const n=e.getLastError();throw new b(t,n,r??re(e,n))}c(a,"throwLastError");function S(e,t,r,n){throw new b(t,r,n??re(e,r))}c(S,"throwWin32");function U(e,t,r){const n=Buffer.alloc(48);return n.writeUInt32LE(r,0),n.writeUInt32LE(t,4),n.writeUInt32LE(3,8),n.writeUInt32LE(0,24),n.writeUInt32LE(0,28),n.writeUInt32LE(0,32),n.writeBigUInt64LE(K(e),40),n}c(U,"buildExplicitAccess");function De(e,t){const r=$("sha256").update(t.toLowerCase()).digest("hex").slice(0,16);return me(Le(e),"dsh-acl-locks",`${r}.lock`)}c(De,"lockFilePath");function ne(e,t,r){const n=De(e,t);he(we(n),{recursive:!0});const o=e.createFileW(n,-1073741824,3,null,4,0,null);be(o)&&a(e,"CreateFileW",n);const i=Te();if(e.lockFileEx(o,2,0,1,0,i)===0){const d=e.getLastError();e.closeHandle(o),S(e,"LockFileEx",d,n)}let l;try{l=r()}catch(d){throw e.unlockFileEx(o,0,1,0,i),e.closeHandle(o),d}if(e.unlockFileEx(o,0,1,0,i)===0){const d=e.getLastError();e.closeHandle(o),S(e,"UnlockFileEx",d,n)}return e.closeHandle(o)===0&&a(e,"CloseHandle",`lock file ${n}`),l}c(ne,"withPathLock");function oe(e,t){const r=g(),n=g(),o=g(),i=g(),l=g(),d=e.getNamedSecurityInfoW(t,1,4,r,n,o,i,l);return d!==0&&S(e,"GetNamedSecurityInfoW",d,t),{oldAcl:p(o),descriptor:p(l)}}c(oe,"readCurrentDacl");function ie(e,t,r,n,o,i){const l=g(),d=e.setEntriesInAclW(1,r,n,l);d!==0&&(o!==null&&e.localFree(o),S(e,"SetEntriesInAclW",d,`${i}(${t})`));const u=p(l);u===null&&(o!==null&&e.localFree(o),S(e,"SetEntriesInAclW",e.getLastError(),`${i}(${t}): null new ACL`));const h=o!==null?e.localFree(o):null,w=e.setNamedSecurityInfoW(t,1,4,null,null,u,null),I=e.localFree(u);w!==0&&S(e,"SetNamedSecurityInfoW",w,`${i}(${t})`),h!==null&&!m(h)&&a(e,"LocalFree",`${i}(${t}) descriptor`),m(I)||a(e,"LocalFree",`${i}(${t}) new ACL`)}c(ie,"mergeAndApply");function He(e,t){const r=x(e,2),n=x(e,4);if(r<8||r>1048576)return!1;let o=8;for(let i=0;i<n;i++){const l=x(e,o+2);if(l<8||o+l>r)return!1;if(W(e,o)===0&&W(e,o+1)===3&&R(e,o+4)===1114454&&Ce(e,o+8,t,0))return!0;o+=l}return!1}c(He,"hasExactGrant");function G(e,t,r){ne(e,t,()=>{const{oldAcl:n,descriptor:o}=oe(e,t);if(n!==null&&He(n,r)){o!==null&&(m(e.localFree(o))||a(e,"LocalFree",`grantWrite(${t}) descriptor`));return}ie(e,t,U(r,1,pe),n,o,"grantWrite")})}c(G,"grantWrite");function N(e,t,r){return ne(e,t,()=>{const{oldAcl:n,descriptor:o}=oe(e,t);return n===null?(o!==null&&(m(e.localFree(o))||a(e,"LocalFree",`revokeWrite(${t}) descriptor`)),!1):(ie(e,t,U(r,4,0),n,o,"revokeWrite"),!0)})}c(N,"revokeWrite");function j(e,t){const r=ge(z.native(e),z.native(t));return r===""||!Se(r)&&r!==".."&&!r.startsWith(`..${Ie}`)}c(j,"containsDirectory");function ye(e,t){if(j(e,t))throw new Error(`Windows ACL temp root must be outside the workspace: workspace=${e}; temp=${t}`)}c(ye,"assertTempRootOutsideWorkspace");function Oe(e,t){for(const r of e)if(j(r,t)||j(t,r))throw new Error(`AclSandbox private temp directory must be disjoint from writable directories: writable=${r}; temp=${t}`)}c(Oe,"assertPrivateTempDisjoint");function se(e){if(e==="")return'""';if(!/[\s"]/u.test(e))return e;let t='"';for(let r=0;r<e.length;r++){let n=0;for(;r<e.length&&e.charAt(r)==="\\";)n++,r++;r===e.length?t+="\\".repeat(n*2):e.charAt(r)==='"'?t+="\\".repeat(n*2+1)+'"':t+="\\".repeat(n)+e.charAt(r)}return t+'"'}c(se,"quoteArg");function ce(e,t){return[e,...t].map(se).join(" ")}c(ce,"buildCommandLine");function B(e){const t=g(),r=g();e.createPipe(t,r,null,0)===0&&a(e,"CreatePipe");const n=p(t),o=p(r);return(n===null||o===null)&&a(e,"CreatePipe","null pipe handle"),{read:n,write:o}}c(B,"createPipe");function _(e,t,r){e.setHandleInformation(t,1,1)===0&&a(e,"SetHandleInformation",r)}c(_,"setInheritable");function $e(e,t,r){const n=B(e),o=B(e),i=B(e);_(e,n.read,"stdin read end"),_(e,o.write,"stdout write end"),_(e,i.write,"stderr write end");const l=Y();X(l,{cb:104,dwFlags:256,hStdInput:n.read,hStdOutput:o.write,hStdError:i.write});const d=Q(),u=ce(r.command,r.args);if(e.createProcessAsUserW(t,null,u,null,null,1,0,null,r.cwd,l,d)===0){const O=e.getLastError();e.closeHandle(n.read),e.closeHandle(n.write),e.closeHandle(o.read),e.closeHandle(o.write),e.closeHandle(i.read),e.closeHandle(i.write),S(e,"CreateProcessAsUserW",O,`command: ${r.command}, cwd: ${r.cwd}`)}const h=Z(d),w=h.hProcess,I=h.hThread;if(w===null||I===null)throw new Error(`CreateProcessAsUserW succeeded but returned null process/thread handles (pid ${h.dwProcessId})`);return e.closeHandle(n.read),e.closeHandle(o.write),e.closeHandle(i.write),e.closeHandle(n.write),e.closeHandle(I),{pid:h.dwProcessId,process:w,stdoutRead:o.read,stderrRead:i.read}}c($e,"spawnSandboxed");async function le(e,t){const r=[];for(;;){const n=E(),o=E(),i=E();if(e.peekNamedPipe(t,null,0,n,o,i)===0){const d=e.getLastError();if(d===109||d===232)break;a(e,"PeekNamedPipe",`drain failure after ${r.length} chunk(s)`)}const l=D(o);if(l>0){const d=Buffer.alloc(l),u=E();e.readFile(t,d,d.length,u,null)===0&&a(e,"ReadFile",`drain failure after ${r.length} chunk(s)`),r.push(d.subarray(0,D(u)))}await new Promise(d=>setTimeout(d,1))}return e.closeHandle(t),Buffer.concat(r)}c(le,"drainPipe");function de(e,t){e.waitForSingleObject(t,4294967295)===4294967295&&a(e,"WaitForSingleObject");const r=E();return e.getExitCodeProcess(t,r)===0&&a(e,"GetExitCodeProcess"),e.closeHandle(t),D(r)}c(de,"waitForExit");function Fe(e){const t=e.createJobObjectW(null,null);m(t)&&a(e,"CreateJobObjectW");const r=Buffer.alloc(144);if(r.writeUInt32LE(We,16),e.setInformationJobObject(t,9,r,r.length)===0){const n=e.getLastError();e.closeHandle(t),S(e,"SetInformationJobObject",n)}return t}c(Fe,"createKillOnCloseJob");function xe(e,t,r){const n=Fe(e),o=e.getStdHandle(-10),i=e.getStdHandle(-11),l=e.getStdHandle(-12);(m(o)||m(i)||m(l))&&(e.closeHandle(n),a(e,"GetStdHandle","null standard handle"));const d=c((k,ue)=>{e.setHandleInformation(k,1,1)===0&&a(e,"SetHandleInformation",`${ue} (enable inherit)`)},"makeInheritable"),u=c(k=>{e.setHandleInformation(k,1,0)},"restoreInherit");d(o,"stdin"),d(i,"stdout"),d(l,"stderr");const h=Y();X(h,{cb:104,dwFlags:256,hStdInput:o,hStdOutput:i,hStdError:l});const w=Q(),I=ce(r.command,r.args),O=e.createProcessAsUserW(t,null,I,null,null,1,4,null,r.cwd,h,w);if(u(o),u(i),u(l),O===0){const k=e.getLastError();e.closeHandle(n),S(e,"CreateProcessAsUserW",k,`command: ${r.command}, cwd: ${r.cwd}`)}const v=Z(w),T=v.hProcess,C=v.hThread;if(T===null||C===null)throw e.closeHandle(n),new Error(`CreateProcessAsUserW succeeded but returned null process/thread handles (pid ${v.dwProcessId})`);if(e.assignProcessToJobObject(n,T)===0){const k=e.getLastError();e.terminateProcess(T,1),e.closeHandle(C),e.closeHandle(T),e.closeHandle(n),S(e,"AssignProcessToJobObject",k,`pid ${v.dwProcessId}`)}if(e.resumeThread(C)===4294967295){const k=e.getLastError();e.closeHandle(C),e.closeHandle(T),e.closeHandle(n),S(e,"ResumeThread",k,`pid ${v.dwProcessId}`)}return e.closeHandle(C),{pid:v.dwProcessId,process:T,job:n}}c(xe,"spawnSandboxedInherited");function Re(e){const t=e.openProcess(Ee,0,process.pid);m(t)&&a(e,"OpenProcess",`pid ${process.pid}`);const r=g();if(e.openProcessToken(t,139,r)===0){const o=e.getLastError();e.closeHandle(t),S(e,"OpenProcessToken",o,`pid ${process.pid}`)}e.closeHandle(t)===0&&a(e,"CloseHandle","OpenProcess process handle");const n=p(r);return n===null&&S(e,"OpenProcessToken",e.getLastError(),"null token handle"),n}c(Re,"openCurrentProcessToken");function Ue(e,t){const r=E();e.getTokenInformation(t,2,null,0,r);const n=D(r);n===0&&a(e,"GetTokenInformation","TokenGroups size query"),n<8&&S(e,"GetTokenInformation",e.getLastError(),`implausible TokenGroups size ${n}`);const o=Buffer.alloc(n);e.getTokenInformation(t,2,o,o.length,r)===0&&a(e,"GetTokenInformation","TokenGroups");const i=o.readUInt32LE(0);for(let l=0;l<i;l++){const d=V(o,8+l*16),u=(o.readUInt32LE(8+l*16+8)&M)>>>0===M>>>0;if(d===null||!u)continue;const h=e.getLengthSid(d);h===0&&a(e,"GetLengthSid",`logon SID group ${l}`);const w=F(h);return e.copySid(h,w,d)===0&&a(e,"CopySid",`logon SID group ${l}`),w}throw new Error(`CreateRestrictedToken prerequisite failed: no logon SID found among ${i} token groups`)}c(Ue,"findLogonSid");function Ge(e,t){const r=F(68),n=E();return ve(n,68),e.createWellKnownSid(t,null,r,n)===0&&a(e,"CreateWellKnownSid",`type ${t}`),e.isValidSid(r)===0&&a(e,"IsValidSid",`CreateWellKnownSid type ${t}`),r}c(Ge,"makeWellKnownSid");function Ne(e,t,r){const n=E();e.getTokenInformation(t,6,null,0,n);const o=D(n);o===0&&a(e,"GetTokenInformation","TokenDefaultDacl size query");const i=Buffer.alloc(o);e.getTokenInformation(t,6,i,i.length,n)===0&&a(e,"GetTokenInformation","TokenDefaultDacl");const l=V(i,0);if(l===null)throw new Error("setTokenDefaultDaclGrant: the token carries no default DACL to extend");const d=g(),u=e.setEntriesInAclW(1,U(r,1,ke),l,d);u!==0&&S(e,"SetEntriesInAclW",u,"default DACL merge");const h=p(d);h===null&&S(e,"SetEntriesInAclW",u,"null merged default DACL");const w=Buffer.alloc(8);if(w.writeBigUInt64LE(h,0),e.setTokenInformation(t,6,w,w.length)===0){const I=e.getLastError();e.localFree(h),S(e,"SetTokenInformation",I,"TokenDefaultDacl")}e.localFree(h)}c(Ne,"setTokenDefaultDaclGrant");function je(e){const t=Buffer.alloc(16*e.length);return e.forEach((r,n)=>{t.writeBigUInt64LE(K(r),16*n)}),t}c(je,"buildRestrictingSids");function Be(e,t,r,n,o,i){const l=je(i==="read-only"?[r,o.world]:n.length===0?(()=>{throw new Error("createRestrictedToken: workspace-write restricting list requires at least one write SID")})():[r,o.world,...n]),d=g();e.createRestrictedToken(t,13,0,null,0,null,l.length/16,l,d)===0&&a(e,"CreateRestrictedToken",`restricting SIDs: ${l.length/16}`);const u=p(d);return u===null&&S(e,"CreateRestrictedToken",e.getLastError(),"null token handle"),u}c(Be,"createRestrictedToken");var _e=class ae{static{c(this,"AclWriteGrant")}writeSid;api;sidPtr;revocablePaths=[];standingPaths=[];constructor(t,r,n){this.api=t,this.sidPtr=r,this.writeSid=n}static create(t,r){const n=r??Ae(),o=g();n.convertStringSidToSidW(t,o)===0&&a(n,"ConvertStringSidToSidW",t);const i=p(o);return i===null&&a(n,"ConvertStringSidToSidW",`null SID for ${t}`),new ae(n,i,t)}add(t,r=!1){(r?this.standingPaths:this.revocablePaths).push(t),G(this.api,t,this.sidPtr)}get paths(){return[...this.standingPaths,...this.revocablePaths]}dispose(){const t=[];for(const r of this.revocablePaths)try{N(this.api,r,this.sidPtr)}catch(n){t.push(n)}try{m(this.api.localFree(this.sidPtr))||a(this.api,"LocalFree","write SID")}catch(r){t.push(r)}if(t.length>0)throw new AggregateError(t,`AclWriteGrant dispose completed with ${t.length} cleanup failure(s)`)}};function Je(e){const t=$("sha256").update(e,"utf8").digest();return`S-1-4-${t.readUInt32LE(0)%(2**30-1)+1}-${t.readUInt32LE(4)%(2**30-1)+1}`}c(Je,"workspaceWriteSid");function ze(e){const t=$("sha256").update("temp\0","utf8").update(e,"utf8").digest();return`S-1-4-${t.readUInt32LE(0)%(2**30-1)+1}-${t.readUInt32LE(4)%(2**30-1)+1}-1`}c(ze,"tempWriteSid");function y(e,t,r,n){if(t!==void 0)try{m(e.localFree(t))||a(e,"LocalFree",r)}catch(o){n.push(o)}}c(y,"freeSidBestEffort");var qe=class{static{c(this,"AclSandbox")}writableDirs;writeSid;tempWriteSid;mode;tempDirOption;manageDacls;tempDirResolved;api;token;writeSidPtr;tempWriteSidPtr;sidAllocations=[];grantedPaths=[];constructor(e){if(this.mode=e.mode,this.manageDacls=e.manageDacls??!0,this.writableDirs=e.writableDirs.map(t=>{const r=Pe(t);if(!J(r)||!q(r).isDirectory())throw new Error(`AclSandbox writable dir does not exist or is not a directory: ${r}`);return r}),this.tempDirOption=e.tempDir,this.writeSid=e.writeSid,this.tempWriteSid=e.tempWriteSid,this.mode==="workspace-write"&&this.writeSid===void 0)throw new Error("AclSandbox workspace-write requires a write SID — derive it from the workspace via workspaceWriteSid()");if(this.mode==="workspace-write"&&this.tempDirOption===void 0)throw new Error("AclSandbox workspace-write requires an explicit private temp directory or null");if(this.mode==="read-only"&&this.tempDirOption!==void 0&&this.tempDirOption!==null)throw new Error("AclSandbox read-only does not accept a temp directory");if(this.mode==="read-only"&&(this.writeSid!==void 0||this.tempWriteSid!==void 0))throw new Error("AclSandbox read-only does not accept write SIDs");if(this.mode==="workspace-write"&&this.tempDirOption!==null&&this.tempWriteSid===void 0)throw new Error("AclSandbox workspace-write with temp requires a temp write SID — derive it via tempWriteSid()");if(this.tempDirOption===null&&this.tempWriteSid!==void 0)throw new Error("AclSandbox temp write SID requires a temp directory");if(this.writeSid!==void 0&&this.tempWriteSid===this.writeSid)throw new Error("AclSandbox workspace and temp write SIDs must be distinct")}get tempDir(){return this.tempDirResolved}async init(){if(this.api!==void 0)throw new Error("AclSandbox is already initialized");const e=await te(),t=Re(e);let r=!0,n;try{const o=c(u=>{const h=g();e.convertStringSidToSidW(u,h)===0&&a(e,"ConvertStringSidToSidW",u);const w=p(h);if(w===null)throw new b("ConvertStringSidToSidW",e.getLastError(),u);return w},"parseSid");this.writeSidPtr=this.writeSid===void 0?void 0:o(this.writeSid),this.tempWriteSidPtr=this.tempWriteSid===void 0?void 0:o(this.tempWriteSid);const i=this.mode==="read-only"||this.tempDirOption===null?null:this.tempDirOption;if(i===void 0)throw new Error("AclSandbox workspace-write temp directory was not resolved");if(i!==null){if(!J(i)||!q(i).isDirectory())throw new Error(`AclSandbox temp dir does not exist or is not a directory: ${i}`);Oe(this.writableDirs,i)}if(this.tempDirResolved=i,this.manageDacls&&this.writeSidPtr!==void 0){for(const u of this.writableDirs)G(e,u,this.writeSidPtr);i!==null&&this.tempWriteSidPtr!==void 0&&(this.grantedPaths.push({path:i,sidPtr:this.tempWriteSidPtr}),G(e,i,this.tempWriteSidPtr))}const l=Ue(e,t);this.sidAllocations.push(l);const d=Ge(e,1);this.sidAllocations.push(d),n=Be(e,t,l,[this.writeSidPtr,this.tempWriteSidPtr].filter(u=>u!==void 0),{world:d},this.mode),this.token=n,Ne(e,n,this.tempWriteSidPtr??this.writeSidPtr??d),e.closeHandle(t)===0&&a(e,"CloseHandle","current process token"),r=!1,this.api=e}catch(o){const i=[];r&&e.closeHandle(t)===0&&i.push(new b("CloseHandle",e.getLastError(),"current process token after init failure")),n!==void 0&&e.closeHandle(n)===0&&i.push(new b("CloseHandle",e.getLastError(),"restricted token after init failure"));for(const l of this.grantedPaths)try{N(e,l.path,l.sidPtr)}catch(d){i.push(d)}for(const[l,d]of[["workspace write SID",this.writeSidPtr],["temp write SID",this.tempWriteSidPtr]])y(e,d,l,i);for(const l of this.sidAllocations.splice(0))y(e,l,"init SID allocation",i);throw this.token=void 0,this.writeSidPtr=void 0,this.tempWriteSidPtr=void 0,this.tempDirResolved=void 0,this.grantedPaths=[],i.length>0?new AggregateError([o,...i],`AclSandbox init failed and ${i.length} cleanup operation(s) also failed`):o}}spawn(e){const t=this.api,r=this.token;if(t===void 0||r===void 0)throw new Error("AclSandbox is not initialized: call init() first");const n=e.args??[],o=e.cwd??process.cwd();if(e.stdio==="inherit"){const h=xe(t,r,{command:e.command,args:n,cwd:o});let w;return{pid:h.pid,wait:c(async()=>{w??=Promise.resolve(de(t,h.process));const I=await w;return t.closeHandle(h.job)===0&&a(t,"CloseHandle","kill-on-close job"),{stdout:Buffer.alloc(0),stderr:Buffer.alloc(0),exitCode:I}},"wait")}}const i=$e(t,r,{command:e.command,args:n,cwd:o}),l=le(t,i.stdoutRead),d=le(t,i.stderrRead);let u;return{pid:i.pid,wait:c(async()=>{const h=await l,w=await d;return u??=Promise.resolve(de(t,i.process)),{stdout:h,stderr:w,exitCode:await u}},"wait")}}dispose(){const e=this.api;if(e===void 0)return;const t=[];if(this.manageDacls)for(const n of this.grantedPaths)try{N(e,n.path,n.sidPtr)}catch(o){t.push(o)}for(const[n,o]of[["workspace write SID",this.writeSidPtr],["temp write SID",this.tempWriteSidPtr]])y(e,o,n,t);const r=this.token;if(r!==void 0)try{e.closeHandle(r)===0&&a(e,"CloseHandle","restricted token")}catch(n){t.push(n)}for(const n of this.sidAllocations.splice(0))y(e,n,"init SID allocation",t);if(this.api=void 0,this.token=void 0,this.writeSidPtr=void 0,this.tempWriteSidPtr=void 0,this.grantedPaths=[],t.length>0)throw new AggregateError(t,`AclSandbox dispose completed with ${t.length} cleanup failure(s)`)}};export{se as a,b as c,_e as i,ze as n,ye as o,Je as r,te as s,qe as t};

package/node_modules/@deepseek-ai/dsh-sandbox-windows-acl/lib/types-CPImuxZD.js

@@ -1 +0,0 @@
-var fe=Object.defineProperty;var c=(e,t)=>fe(e,"name",{value:t,configurable:!0});import{existsSync as J,mkdirSync as he,realpathSync as z,statSync as q}from"node:fs";import{dirname as we,isAbsolute as Se,join as me,relative as ge,resolve as Pe,sep as Ie}from"node:path";import{createHash as $}from"node:crypto";import f from"koffi";var b=class extends Error{static{c(this,"Win32Error")}api;win32Code;constructor(e,t,r){super(`${e} failed (Win32 ${t})${r===void 0?"":`: ${r}`}`),this.name="Win32Error",this.api=e,this.win32Code=t}};const M=3221225472,pe=1114454,ke=2032127,Ee=1024,We=8192;function m(e){return e==null||e===0n}c(m,"isNullPtr");function be(e){return m(e)?!0:e===18446744073709551615n||e===-1n}c(be,"isInvalidHandle");const s=f.pointer("void"),P=f.pointer(s),A=f.struct("STARTUPINFOW",{cb:"uint32",lpReserved:"str16",lpDesktop:"str16",lpTitle:"str16",dwX:"uint32",dwY:"uint32",dwXSize:"uint32",dwYSize:"uint32",dwXCountChars:"uint32",dwYCountChars:"uint32",dwFillAttribute:"uint32",dwFlags:"uint32",wShowWindow:"uint16",cbReserved2:"uint16",lpReserved2:f.pointer("uint8"),hStdInput:s,hStdOutput:s,hStdError:s}),L=f.struct("PROCESS_INFORMATION",{hProcess:s,hThread:s,dwProcessId:"uint32",dwThreadId:"uint32"});if(A.size!==104)throw new Error(`STARTUPINFOW layout mismatch: koffi computed ${A.size}, header probe says 104`);if(L.size!==24)throw new Error(`PROCESS_INFORMATION layout mismatch: koffi computed ${L.size}, header probe says 24`);function g(){return f.alloc(s,1)}c(g,"allocPtrSlot");function E(){return f.alloc("uint32",1)}c(E,"allocUint32");function ve(e,t){f.encode(e,"uint32",t)}c(ve,"encodeUint32");function p(e){const t=f.decode(e,s);return m(t)?null:t}c(p,"decodePtr");function D(e){return f.decode(e,"uint32")}c(D,"decodeUint32");function K(e){return f.address(e)}c(K,"ptrAddress");function F(e){return f.alloc("uint8",e)}c(F,"allocBytes");function Te(){return F(32)}c(Te,"allocOverlapped");function V(e,t){const r=f.decode(e,t,s);return m(r)?null:r}c(V,"decodePtrAt");function W(e,t){return f.decode(e,t,"uint8")}c(W,"decodeUint8At");function x(e,t){return f.decode(e,t,"uint16")}c(x,"decodeUint16At");function R(e,t){return f.decode(e,t,"uint32")}c(R,"decodeUint32At");function Ce(e,t,r,n){if(W(e,t)!==W(r,n))return!1;const o=W(e,t+1);if(o!==W(r,n+1)||o>15)return!1;for(let i=0;i<6;i++)if(W(e,t+2+i)!==W(r,n+2+i))return!1;for(let i=0;i<o;i++)if(R(e,t+8+i*4)!==R(r,n+8+i*4))return!1;return!0}c(Ce,"sameSidAt");function Y(){return f.alloc(A,1)}c(Y,"allocStartupInfo");function X(e,t){f.encode(e,A,t)}c(X,"encodeStartupInfo");function Q(){return f.alloc(L,1)}c(Q,"allocProcessInfo");function Z(e){return f.decode(e,L)}c(Z,"decodeProcessInfo");let H;function ee(){if(H!==void 0)return H;const e=f.load("kernel32.dll"),t=f.load("advapi32.dll"),r=c((n,o,i,l)=>n.func("__stdcall",o,i,l),"bind");return H={openProcess:r(e,"OpenProcess",s,["uint32","int","uint32"]),openProcessToken:r(t,"OpenProcessToken","int",[s,"uint32",P]),closeHandle:r(e,"CloseHandle","int",[s]),getLastError:r(e,"GetLastError","uint32",[]),formatMessageW:r(e,"FormatMessageW","uint32",["uint32",s,"uint32","uint32",s,"uint32",s]),localAlloc:r(e,"LocalAlloc",s,["uint32","size_t"]),localFree:r(e,"LocalFree",s,[s]),convertStringSidToSidW:r(t,"ConvertStringSidToSidW","int",["str16",P]),createWellKnownSid:r(t,"CreateWellKnownSid","int",["int",s,s,f.pointer("uint32")]),isValidSid:r(t,"IsValidSid","int",[s]),getLengthSid:r(t,"GetLengthSid","uint32",[s]),copySid:r(t,"CopySid","int",["uint32",s,s]),getTokenInformation:r(t,"GetTokenInformation","int",[s,"int",s,"uint32",f.pointer("uint32")]),setTokenInformation:r(t,"SetTokenInformation","int",[s,"int",s,"uint32"]),createRestrictedToken:r(t,"CreateRestrictedToken","int",[s,"uint32","uint32",s,"uint32",s,"uint32",s,P]),setEntriesInAclW:r(t,"SetEntriesInAclW","uint32",["uint32",s,s,P]),setNamedSecurityInfoW:r(t,"SetNamedSecurityInfoW","uint32",["str16","int","uint32",s,s,s,s]),getNamedSecurityInfoW:r(t,"GetNamedSecurityInfoW","uint32",["str16","int","uint32",P,P,P,P,P]),getTempPathW:r(e,"GetTempPathW","uint32",["uint32",s]),createFileW:r(e,"CreateFileW",s,["str16","uint32","uint32",s,"uint32","uint32",s]),lockFileEx:r(e,"LockFileEx","int",[s,"uint32","uint32","uint32","uint32",s]),unlockFileEx:r(e,"UnlockFileEx","int",[s,"uint32","uint32","uint32",s]),createPipe:r(e,"CreatePipe","int",[P,P,s,"uint32"]),setHandleInformation:r(e,"SetHandleInformation","int",[s,"uint32","uint32"]),createProcessAsUserW:r(t,"CreateProcessAsUserW","int",[s,"str16","str16",s,s,"int","uint32",s,"str16",f.pointer(A),f.pointer(L)]),setEnvironmentVariableW:r(e,"SetEnvironmentVariableW","int",["str16","str16"]),readFile:r(e,"ReadFile","int",[s,s,"uint32",f.pointer("uint32"),s]),peekNamedPipe:r(e,"PeekNamedPipe","int",[s,s,"uint32",f.pointer("uint32"),f.pointer("uint32"),f.pointer("uint32")]),waitForSingleObject:r(e,"WaitForSingleObject","uint32",[s,"uint32"]),getExitCodeProcess:r(e,"GetExitCodeProcess","int",[s,f.pointer("uint32")]),resumeThread:r(e,"ResumeThread","uint32",[s]),createJobObjectW:r(e,"CreateJobObjectW",s,[s,"str16"]),setInformationJobObject:r(e,"SetInformationJobObject","int",[s,"int",s,"uint32"]),assignProcessToJobObject:r(e,"AssignProcessToJobObject","int",[s,s]),terminateProcess:r(e,"TerminateProcess","int",[s,"uint32"]),setConsoleCtrlHandler:r(e,"SetConsoleCtrlHandler","int",[s,"int"]),getStdHandle:r(e,"GetStdHandle",s,["int"])},H}c(ee,"bindings");function te(){return Promise.resolve(ee())}c(te,"win32");function Ae(){return ee()}c(Ae,"win32Sync");function re(e,t){const r=Buffer.alloc(1024),n=e.formatMessageW(4608,null,t,0,r,r.length/2,null);return n===0?"":r.subarray(0,n*2).toString("utf16le").trim()}c(re,"errorText");function Le(e){const t=Buffer.alloc(522),r=e.getTempPathW(t.length/2,t);if(r===0&&a(e,"GetTempPathW"),r>t.length/2)throw new b("GetTempPathW",122,`required ${r} chars exceed the ${t.length/2}-char buffer; nothing was written`);return t.subarray(0,r*2).toString("utf16le")}c(Le,"getTempPath");function a(e,t,r){const n=e.getLastError();throw new b(t,n,r??re(e,n))}c(a,"throwLastError");function S(e,t,r,n){throw new b(t,r,n??re(e,r))}c(S,"throwWin32");function U(e,t,r){const n=Buffer.alloc(48);return n.writeUInt32LE(r,0),n.writeUInt32LE(t,4),n.writeUInt32LE(3,8),n.writeUInt32LE(0,24),n.writeUInt32LE(0,28),n.writeUInt32LE(0,32),n.writeBigUInt64LE(K(e),40),n}c(U,"buildExplicitAccess");function De(e,t){const r=$("sha256").update(t.toLowerCase()).digest("hex").slice(0,16);return me(Le(e),"dsh-acl-locks",`${r}.lock`)}c(De,"lockFilePath");function ne(e,t,r){const n=De(e,t);he(we(n),{recursive:!0});const o=e.createFileW(n,-1073741824,3,null,4,0,null);be(o)&&a(e,"CreateFileW",n);const i=Te();if(e.lockFileEx(o,2,0,1,0,i)===0){const d=e.getLastError();e.closeHandle(o),S(e,"LockFileEx",d,n)}let l;try{l=r()}catch(d){throw e.unlockFileEx(o,0,1,0,i),e.closeHandle(o),d}if(e.unlockFileEx(o,0,1,0,i)===0){const d=e.getLastError();e.closeHandle(o),S(e,"UnlockFileEx",d,n)}return e.closeHandle(o)===0&&a(e,"CloseHandle",`lock file ${n}`),l}c(ne,"withPathLock");function oe(e,t){const r=g(),n=g(),o=g(),i=g(),l=g(),d=e.getNamedSecurityInfoW(t,1,4,r,n,o,i,l);return d!==0&&S(e,"GetNamedSecurityInfoW",d,t),{oldAcl:p(o),descriptor:p(l)}}c(oe,"readCurrentDacl");function ie(e,t,r,n,o,i){const l=g(),d=e.setEntriesInAclW(1,r,n,l);d!==0&&(o!==null&&e.localFree(o),S(e,"SetEntriesInAclW",d,`${i}(${t})`));const u=p(l);u===null&&(o!==null&&e.localFree(o),S(e,"SetEntriesInAclW",e.getLastError(),`${i}(${t}): null new ACL`));const h=o!==null?e.localFree(o):null,w=e.setNamedSecurityInfoW(t,1,4,null,null,u,null),I=e.localFree(u);w!==0&&S(e,"SetNamedSecurityInfoW",w,`${i}(${t})`),h!==null&&!m(h)&&a(e,"LocalFree",`${i}(${t}) descriptor`),m(I)||a(e,"LocalFree",`${i}(${t}) new ACL`)}c(ie,"mergeAndApply");function He(e,t){const r=x(e,2),n=x(e,4);if(r<8||r>1048576)return!1;let o=8;for(let i=0;i<n;i++){const l=x(e,o+2);if(l<8||o+l>r)return!1;if(W(e,o)===0&&W(e,o+1)===3&&R(e,o+4)===1114454&&Ce(e,o+8,t,0))return!0;o+=l}return!1}c(He,"hasExactGrant");function G(e,t,r){ne(e,t,()=>{const{oldAcl:n,descriptor:o}=oe(e,t);if(n!==null&&He(n,r)){o!==null&&(m(e.localFree(o))||a(e,"LocalFree",`grantWrite(${t}) descriptor`));return}ie(e,t,U(r,1,pe),n,o,"grantWrite")})}c(G,"grantWrite");function N(e,t,r){return ne(e,t,()=>{const{oldAcl:n,descriptor:o}=oe(e,t);return n===null?(o!==null&&(m(e.localFree(o))||a(e,"LocalFree",`revokeWrite(${t}) descriptor`)),!1):(ie(e,t,U(r,4,0),n,o,"revokeWrite"),!0)})}c(N,"revokeWrite");function j(e,t){const r=ge(z.native(e),z.native(t));return r===""||!Se(r)&&r!==".."&&!r.startsWith(`..${Ie}`)}c(j,"containsDirectory");function ye(e,t){if(j(e,t))throw new Error(`Windows ACL temp root must be outside the workspace: workspace=${e}; temp=${t}`)}c(ye,"assertTempRootOutsideWorkspace");function Oe(e,t){for(const r of e)if(j(r,t)||j(t,r))throw new Error(`AclSandbox private temp directory must be disjoint from writable directories: writable=${r}; temp=${t}`)}c(Oe,"assertPrivateTempDisjoint");function se(e){if(e==="")return'""';if(!/[\s"]/u.test(e))return e;let t='"';for(let r=0;r<e.length;r++){let n=0;for(;r<e.length&&e.charAt(r)==="\\";)n++,r++;r===e.length?t+="\\".repeat(n*2):e.charAt(r)==='"'?t+="\\".repeat(n*2+1)+'"':t+="\\".repeat(n)+e.charAt(r)}return t+'"'}c(se,"quoteArg");function ce(e,t){return[e,...t].map(se).join(" ")}c(ce,"buildCommandLine");function B(e){const t=g(),r=g();e.createPipe(t,r,null,0)===0&&a(e,"CreatePipe");const n=p(t),o=p(r);return(n===null||o===null)&&a(e,"CreatePipe","null pipe handle"),{read:n,write:o}}c(B,"createPipe");function _(e,t,r){e.setHandleInformation(t,1,1)===0&&a(e,"SetHandleInformation",r)}c(_,"setInheritable");function $e(e,t,r){const n=B(e),o=B(e),i=B(e);_(e,n.read,"stdin read end"),_(e,o.write,"stdout write end"),_(e,i.write,"stderr write end");const l=Y();X(l,{cb:104,dwFlags:256,hStdInput:n.read,hStdOutput:o.write,hStdError:i.write});const d=Q(),u=ce(r.command,r.args);if(e.createProcessAsUserW(t,null,u,null,null,1,0,null,r.cwd,l,d)===0){const O=e.getLastError();e.closeHandle(n.read),e.closeHandle(n.write),e.closeHandle(o.read),e.closeHandle(o.write),e.closeHandle(i.read),e.closeHandle(i.write),S(e,"CreateProcessAsUserW",O,`command: ${r.command}, cwd: ${r.cwd}`)}const h=Z(d),w=h.hProcess,I=h.hThread;if(w===null||I===null)throw new Error(`CreateProcessAsUserW succeeded but returned null process/thread handles (pid ${h.dwProcessId})`);return e.closeHandle(n.read),e.closeHandle(o.write),e.closeHandle(i.write),e.closeHandle(n.write),e.closeHandle(I),{pid:h.dwProcessId,process:w,stdoutRead:o.read,stderrRead:i.read}}c($e,"spawnSandboxed");async function le(e,t){const r=[];for(;;){const n=E(),o=E(),i=E();if(e.peekNamedPipe(t,null,0,n,o,i)===0){const d=e.getLastError();if(d===109||d===232)break;a(e,"PeekNamedPipe",`drain failure after ${r.length} chunk(s)`)}const l=D(o);if(l>0){const d=Buffer.alloc(l),u=E();e.readFile(t,d,d.length,u,null)===0&&a(e,"ReadFile",`drain failure after ${r.length} chunk(s)`),r.push(d.subarray(0,D(u)))}await new Promise(d=>setTimeout(d,1))}return e.closeHandle(t),Buffer.concat(r)}c(le,"drainPipe");function de(e,t){e.waitForSingleObject(t,4294967295)===4294967295&&a(e,"WaitForSingleObject");const r=E();return e.getExitCodeProcess(t,r)===0&&a(e,"GetExitCodeProcess"),e.closeHandle(t),D(r)}c(de,"waitForExit");function Fe(e){const t=e.createJobObjectW(null,null);m(t)&&a(e,"CreateJobObjectW");const r=Buffer.alloc(144);if(r.writeUInt32LE(We,16),e.setInformationJobObject(t,9,r,r.length)===0){const n=e.getLastError();e.closeHandle(t),S(e,"SetInformationJobObject",n)}return t}c(Fe,"createKillOnCloseJob");function xe(e,t,r){const n=Fe(e),o=e.getStdHandle(-10),i=e.getStdHandle(-11),l=e.getStdHandle(-12);(m(o)||m(i)||m(l))&&(e.closeHandle(n),a(e,"GetStdHandle","null standard handle"));const d=c((k,ue)=>{e.setHandleInformation(k,1,1)===0&&a(e,"SetHandleInformation",`${ue} (enable inherit)`)},"makeInheritable"),u=c(k=>{e.setHandleInformation(k,1,0)},"restoreInherit");d(o,"stdin"),d(i,"stdout"),d(l,"stderr");const h=Y();X(h,{cb:104,dwFlags:256,hStdInput:o,hStdOutput:i,hStdError:l});const w=Q(),I=ce(r.command,r.args),O=e.createProcessAsUserW(t,null,I,null,null,1,4,null,r.cwd,h,w);if(u(o),u(i),u(l),O===0){const k=e.getLastError();e.closeHandle(n),S(e,"CreateProcessAsUserW",k,`command: ${r.command}, cwd: ${r.cwd}`)}const v=Z(w),T=v.hProcess,C=v.hThread;if(T===null||C===null)throw e.closeHandle(n),new Error(`CreateProcessAsUserW succeeded but returned null process/thread handles (pid ${v.dwProcessId})`);if(e.assignProcessToJobObject(n,T)===0){const k=e.getLastError();e.terminateProcess(T,1),e.closeHandle(C),e.closeHandle(T),e.closeHandle(n),S(e,"AssignProcessToJobObject",k,`pid ${v.dwProcessId}`)}if(e.resumeThread(C)===4294967295){const k=e.getLastError();e.closeHandle(C),e.closeHandle(T),e.closeHandle(n),S(e,"ResumeThread",k,`pid ${v.dwProcessId}`)}return e.closeHandle(C),{pid:v.dwProcessId,process:T,job:n}}c(xe,"spawnSandboxedInherited");function Re(e){const t=e.openProcess(Ee,0,process.pid);m(t)&&a(e,"OpenProcess",`pid ${process.pid}`);const r=g();if(e.openProcessToken(t,139,r)===0){const o=e.getLastError();e.closeHandle(t),S(e,"OpenProcessToken",o,`pid ${process.pid}`)}e.closeHandle(t)===0&&a(e,"CloseHandle","OpenProcess process handle");const n=p(r);return n===null&&S(e,"OpenProcessToken",e.getLastError(),"null token handle"),n}c(Re,"openCurrentProcessToken");function Ue(e,t){const r=E();e.getTokenInformation(t,2,null,0,r);const n=D(r);n===0&&a(e,"GetTokenInformation","TokenGroups size query"),n<8&&S(e,"GetTokenInformation",e.getLastError(),`implausible TokenGroups size ${n}`);const o=Buffer.alloc(n);e.getTokenInformation(t,2,o,o.length,r)===0&&a(e,"GetTokenInformation","TokenGroups");const i=o.readUInt32LE(0);for(let l=0;l<i;l++){const d=V(o,8+l*16),u=(o.readUInt32LE(8+l*16+8)&M)>>>0===M>>>0;if(d===null||!u)continue;const h=e.getLengthSid(d);h===0&&a(e,"GetLengthSid",`logon SID group ${l}`);const w=F(h);return e.copySid(h,w,d)===0&&a(e,"CopySid",`logon SID group ${l}`),w}throw new Error(`CreateRestrictedToken prerequisite failed: no logon SID found among ${i} token groups`)}c(Ue,"findLogonSid");function Ge(e,t){const r=F(68),n=E();return ve(n,68),e.createWellKnownSid(t,null,r,n)===0&&a(e,"CreateWellKnownSid",`type ${t}`),e.isValidSid(r)===0&&a(e,"IsValidSid",`CreateWellKnownSid type ${t}`),r}c(Ge,"makeWellKnownSid");function Ne(e,t,r){const n=E();e.getTokenInformation(t,6,null,0,n);const o=D(n);o===0&&a(e,"GetTokenInformation","TokenDefaultDacl size query");const i=Buffer.alloc(o);e.getTokenInformation(t,6,i,i.length,n)===0&&a(e,"GetTokenInformation","TokenDefaultDacl");const l=V(i,0);if(l===null)throw new Error("setTokenDefaultDaclGrant: the token carries no default DACL to extend");const d=g(),u=e.setEntriesInAclW(1,U(r,1,ke),l,d);u!==0&&S(e,"SetEntriesInAclW",u,"default DACL merge");const h=p(d);h===null&&S(e,"SetEntriesInAclW",u,"null merged default DACL");const w=Buffer.alloc(8);if(w.writeBigUInt64LE(h,0),e.setTokenInformation(t,6,w,w.length)===0){const I=e.getLastError();e.localFree(h),S(e,"SetTokenInformation",I,"TokenDefaultDacl")}e.localFree(h)}c(Ne,"setTokenDefaultDaclGrant");function je(e){const t=Buffer.alloc(16*e.length);return e.forEach((r,n)=>{t.writeBigUInt64LE(K(r),16*n)}),t}c(je,"buildRestrictingSids");function Be(e,t,r,n,o,i){const l=je(i==="read-only"?[r,o.world]:n.length===0?(()=>{throw new Error("createRestrictedToken: workspace-write restricting list requires at least one write SID")})():[r,o.world,...n]),d=g();e.createRestrictedToken(t,13,0,null,0,null,l.length/16,l,d)===0&&a(e,"CreateRestrictedToken",`restricting SIDs: ${l.length/16}`);const u=p(d);return u===null&&S(e,"CreateRestrictedToken",e.getLastError(),"null token handle"),u}c(Be,"createRestrictedToken");var _e=class ae{static{c(this,"AclWriteGrant")}writeSid;api;sidPtr;revocablePaths=[];standingPaths=[];constructor(t,r,n){this.api=t,this.sidPtr=r,this.writeSid=n}static create(t,r){const n=r??Ae(),o=g();n.convertStringSidToSidW(t,o)===0&&a(n,"ConvertStringSidToSidW",t);const i=p(o);return i===null&&a(n,"ConvertStringSidToSidW",`null SID for ${t}`),new ae(n,i,t)}add(t,r=!1){(r?this.standingPaths:this.revocablePaths).push(t),G(this.api,t,this.sidPtr)}get paths(){return[...this.standingPaths,...this.revocablePaths]}dispose(){const t=[];for(const r of this.revocablePaths)try{N(this.api,r,this.sidPtr)}catch(n){t.push(n)}try{m(this.api.localFree(this.sidPtr))||a(this.api,"LocalFree","write SID")}catch(r){t.push(r)}if(t.length>0)throw new AggregateError(t,`AclWriteGrant dispose completed with ${t.length} cleanup failure(s)`)}};function Je(e){const t=$("sha256").update(e,"utf8").digest();return`S-1-4-${t.readUInt32LE(0)%(2**30-1)+1}-${t.readUInt32LE(4)%(2**30-1)+1}`}c(Je,"workspaceWriteSid");function ze(e){const t=$("sha256").update("temp\0","utf8").update(e,"utf8").digest();return`S-1-4-${t.readUInt32LE(0)%(2**30-1)+1}-${t.readUInt32LE(4)%(2**30-1)+1}-1`}c(ze,"tempWriteSid");function y(e,t,r,n){if(t!==void 0)try{m(e.localFree(t))||a(e,"LocalFree",r)}catch(o){n.push(o)}}c(y,"freeSidBestEffort");var qe=class{static{c(this,"AclSandbox")}writableDirs;writeSid;tempWriteSid;mode;tempDirOption;manageDacls;tempDirResolved;api;token;writeSidPtr;tempWriteSidPtr;sidAllocations=[];grantedPaths=[];constructor(e){if(this.mode=e.mode,this.manageDacls=e.manageDacls??!0,this.writableDirs=e.writableDirs.map(t=>{const r=Pe(t);if(!J(r)||!q(r).isDirectory())throw new Error(`AclSandbox writable dir does not exist or is not a directory: ${r}`);return r}),this.tempDirOption=e.tempDir,this.writeSid=e.writeSid,this.tempWriteSid=e.tempWriteSid,this.mode==="workspace-write"&&this.writeSid===void 0)throw new Error("AclSandbox workspace-write requires a write SID — derive it from the workspace via workspaceWriteSid()");if(this.mode==="workspace-write"&&this.tempDirOption===void 0)throw new Error("AclSandbox workspace-write requires an explicit private temp directory or null");if(this.mode==="read-only"&&this.tempDirOption!==void 0&&this.tempDirOption!==null)throw new Error("AclSandbox read-only does not accept a temp directory");if(this.mode==="read-only"&&(this.writeSid!==void 0||this.tempWriteSid!==void 0))throw new Error("AclSandbox read-only does not accept write SIDs");if(this.mode==="workspace-write"&&this.tempDirOption!==null&&this.tempWriteSid===void 0)throw new Error("AclSandbox workspace-write with temp requires a temp write SID — derive it via tempWriteSid()");if(this.tempDirOption===null&&this.tempWriteSid!==void 0)throw new Error("AclSandbox temp write SID requires a temp directory");if(this.writeSid!==void 0&&this.tempWriteSid===this.writeSid)throw new Error("AclSandbox workspace and temp write SIDs must be distinct")}get tempDir(){return this.tempDirResolved}async init(){if(this.api!==void 0)throw new Error("AclSandbox is already initialized");const e=await te(),t=Re(e);let r=!0,n;try{const o=c(u=>{const h=g();e.convertStringSidToSidW(u,h)===0&&a(e,"ConvertStringSidToSidW",u);const w=p(h);if(w===null)throw new b("ConvertStringSidToSidW",e.getLastError(),u);return w},"parseSid");this.writeSidPtr=this.writeSid===void 0?void 0:o(this.writeSid),this.tempWriteSidPtr=this.tempWriteSid===void 0?void 0:o(this.tempWriteSid);const i=this.mode==="read-only"||this.tempDirOption===null?null:this.tempDirOption;if(i===void 0)throw new Error("AclSandbox workspace-write temp directory was not resolved");if(i!==null){if(!J(i)||!q(i).isDirectory())throw new Error(`AclSandbox temp dir does not exist or is not a directory: ${i}`);Oe(this.writableDirs,i)}if(this.tempDirResolved=i,this.manageDacls&&this.writeSidPtr!==void 0){for(const u of this.writableDirs)G(e,u,this.writeSidPtr);i!==null&&this.tempWriteSidPtr!==void 0&&(this.grantedPaths.push({path:i,sidPtr:this.tempWriteSidPtr}),G(e,i,this.tempWriteSidPtr))}const l=Ue(e,t);this.sidAllocations.push(l);const d=Ge(e,1);this.sidAllocations.push(d),n=Be(e,t,l,[this.writeSidPtr,this.tempWriteSidPtr].filter(u=>u!==void 0),{world:d},this.mode),this.token=n,Ne(e,n,this.tempWriteSidPtr??this.writeSidPtr??d),e.closeHandle(t)===0&&a(e,"CloseHandle","current process token"),r=!1,this.api=e}catch(o){const i=[];r&&e.closeHandle(t)===0&&i.push(new b("CloseHandle",e.getLastError(),"current process token after init failure")),n!==void 0&&e.closeHandle(n)===0&&i.push(new b("CloseHandle",e.getLastError(),"restricted token after init failure"));for(const l of this.grantedPaths)try{N(e,l.path,l.sidPtr)}catch(d){i.push(d)}for(const[l,d]of[["workspace write SID",this.writeSidPtr],["temp write SID",this.tempWriteSidPtr]])y(e,d,l,i);for(const l of this.sidAllocations.splice(0))y(e,l,"init SID allocation",i);throw this.token=void 0,this.writeSidPtr=void 0,this.tempWriteSidPtr=void 0,this.tempDirResolved=void 0,this.grantedPaths=[],i.length>0?new AggregateError([o,...i],`AclSandbox init failed and ${i.length} cleanup operation(s) also failed`):o}}spawn(e){const t=this.api,r=this.token;if(t===void 0||r===void 0)throw new Error("AclSandbox is not initialized: call init() first");const n=e.args??[],o=e.cwd??process.cwd();if(e.stdio==="inherit"){const h=xe(t,r,{command:e.command,args:n,cwd:o});let w;return{pid:h.pid,wait:c(async()=>{w??=Promise.resolve(de(t,h.process));const I=await w;return t.closeHandle(h.job)===0&&a(t,"CloseHandle","kill-on-close job"),{stdout:Buffer.alloc(0),stderr:Buffer.alloc(0),exitCode:I}},"wait")}}const i=$e(t,r,{command:e.command,args:n,cwd:o}),l=le(t,i.stdoutRead),d=le(t,i.stderrRead);let u;return{pid:i.pid,wait:c(async()=>{const h=await l,w=await d;return u??=Promise.resolve(de(t,i.process)),{stdout:h,stderr:w,exitCode:await u}},"wait")}}dispose(){const e=this.api;if(e===void 0)return;const t=[];if(this.manageDacls)for(const n of this.grantedPaths)try{N(e,n.path,n.sidPtr)}catch(o){t.push(o)}for(const[n,o]of[["workspace write SID",this.writeSidPtr],["temp write SID",this.tempWriteSidPtr]])y(e,o,n,t);const r=this.token;if(r!==void 0)try{e.closeHandle(r)===0&&a(e,"CloseHandle","restricted token")}catch(n){t.push(n)}for(const n of this.sidAllocations.splice(0))y(e,n,"init SID allocation",t);if(this.api=void 0,this.token=void 0,this.writeSidPtr=void 0,this.tempWriteSidPtr=void 0,this.grantedPaths=[],t.length>0)throw new AggregateError(t,`AclSandbox dispose completed with ${t.length} cleanup failure(s)`)}};export{se as a,b as c,_e as i,ze as n,ye as o,Je as r,te as s,qe as t};