@sysid/sandbox-runtime-improved 0.0.55-sysid.1 → 0.0.61-sysid.1

package/dist/sandbox/sandbox-manager.js

@@ -1,18 +1,22 @@
 import { createHttpProxyServer } from './http-proxy.js';
 import { createSocksProxyServer } from './socks-proxy.js';
+import { createMuxProxyServer } from './mux-proxy.js';
+import { listenInRange } from './listen-in-range.js';
+import { SentinelRegistry } from './credential-sentinel.js';
+import { MaskedFileStore, buildMaskedFileBinds, } from './credential-mask-files.js';
 import { createMitmCA, disposeMitmCA } from './mitm-ca.js';
 import { logForDebugging } from '../utils/debug.js';
 import { whichSync } from '../utils/which.js';
 import { getPlatform, getWslVersion } from '../utils/platform.js';
 import * as fs from 'fs';
-import { randomBytes } from 'node:crypto';
+import { randomBytes, X509Certificate } from 'node:crypto';
 import { wrapCommandWithSandboxLinux, initializeLinuxNetworkBridge, checkLinuxDependencies, cleanupBwrapMountPoints, } from './linux-sandbox-utils.js';
 import { wrapCommandWithSandboxMacOS, startMacOSSandboxLogMonitor, } from './macos-sandbox-utils.js';
-import { checkWindowsDependencies, wrapCommandWithSandboxWindows, DEFAULT_WINDOWS_GROUP_NAME, DEFAULT_WINDOWS_PROXY_PORT_RANGE, } from './windows-sandbox-utils.js';
-import { getDefaultWritePaths, containsGlobChars, removeTrailingGlobSuffix, expandGlobPattern, ensureSandboxTmpdir, } from './sandbox-utils.js';
+import { checkWindowsDependencies, wrapCommandWithSandboxWindows, parseWindowsBinShell, expandWindowsFsDenyPaths, stampWindowsAcl, restoreWindowsAcl, getWindowsSandboxUserStatus, getWindowsSandboxCaCert, WINDOWS_ACL_PATH_OK, WINDOWS_ACL_PARENT_OK, DEFAULT_WINDOWS_GROUP_NAME, DEFAULT_WINDOWS_PROXY_PORT_RANGE, } from './windows-sandbox-utils.js';
+import { getDefaultWritePaths, containsGlobChars, removeTrailingGlobSuffix, expandGlobPattern, normalizePathForSandbox, ensureSandboxTmpdir, } from './sandbox-utils.js';
 import { SandboxViolationStore } from './sandbox-violation-store.js';
-import { canonicalizeHost, isValidHost, redactUrl, resolveParentProxy, stripBrackets, } from './parent-proxy.js';
-import { isIP } from 'node:net';
+import { canonicalizeHost, isValidHost, redactUrl, resolveParentProxy, } from './parent-proxy.js';
+import { matchesDomainPattern } from './domain-pattern.js';
 import { EOL } from 'node:os';
 // ============================================================================
 // Private Module State
@@ -20,6 +24,7 @@ import { EOL } from 'node:os';
 let config;
 let httpProxyServer;
 let socksProxyServer;
+let muxProxyServer;
 let managerContext;
 let initializationPromise;
 let cleanupRegistered = false;
@@ -30,7 +35,28 @@ let mitmCA;
 // the sandbox child env, checked on every CONNECT/request — so a host process
 // dialing 127.0.0.1:<proxyPort> can't reach the filter callback.
 let proxyAuthToken;
+// Windows: the resolved {denyRead, denyWrite} that was actually
+// passed to `srt-win acl stamp` at initialize(). `undefined` means
+// no stamp was applied (gates passing `--holder-pid` to exec —
+// which engages the per-exec dir/file fence — and running `acl
+// restore` at reset()).
+let windowsFsStampedSet;
+// The group reference that was passed to `srt-win acl stamp`.
+// reset() restores against THIS, not the current config — a
+// group change between stamp and restore would otherwise
+// target the wrong group's broker DACL.
+let windowsFsStampedGroup;
+// The RAW config inputs that produced `windowsFsStampedSet`.
+// updateConfig() compares these (not the resolved set) so it never
+// re-expands globs — see `sameWindowsStampSet`.
+let windowsFsRawInputs;
 const sandboxViolationStore = new SandboxViolationStore();
+// Per-session sentinel↔real-value map for masked credentials. Lives only in
+// process memory; never written to disk or logged. Cleared on reset().
+const sentinelRegistry = new SentinelRegistry();
+// Temp dir holding the sentinel-content fake files for masked credential
+// files. Created lazily on first masked file; removed on reset().
+const maskedFileStore = new MaskedFileStore();
 // ============================================================================
 // Private Helper Functions (not exported)
 // ============================================================================
@@ -48,26 +74,6 @@ function registerCleanup() {
     process.once('SIGTERM', cleanupHandler);
     cleanupRegistered = true;
 }
-function matchesDomainPattern(hostname, pattern) {
-    const h = hostname.toLowerCase();
-    // Bare '*' is deny-all when it appears in deniedDomains. The schema only
-    // accepts it there (allowedDomains still rejects it as too broad).
-    if (pattern === '*')
-        return true;
-    // Support wildcard patterns like *.example.com. Never apply wildcard
-    // suffix matching to IP literals — an IPv6 zone-ID payload like
-    // `::ffff:1.2.3.4%x.allowed.com` would otherwise pass .endsWith() while
-    // the OS connects to the bare IP. isValidHost already rejects `%`, but
-    // we refuse here too for defence in depth.
-    if (pattern.startsWith('*.')) {
-        if (isIP(stripBrackets(h)))
-            return false;
-        const baseDomain = pattern.substring(2).toLowerCase();
-        return h.endsWith('.' + baseDomain);
-    }
-    // Exact match for non-wildcard patterns
-    return h === pattern.toLowerCase();
-}
 async function filterNetworkRequest(port, host, sandboxAskCallback) {
     if (!config) {
         logForDebugging('No config available, denying network request');
@@ -133,6 +139,24 @@ async function filterNetworkRequest(port, host, sandboxAskCallback) {
  * Returns the socket path if the host matches any MITM domain pattern,
  * otherwise returns undefined.
  */
+/**
+ * Build the header-mutation callback that substitutes sentinel→real for
+ * masked credentials. Returns undefined when no `credentials` block is
+ * configured — wiring the seam at all is unnecessary then.
+ *
+ * Per-host gating happens inside the registry: each sentinel carries its
+ * own injectHosts list and substitutes independently, so credential A's
+ * sentinel cannot be laundered through credential B's allowed host. The
+ * returned closure does not log header values; the registry holds the only
+ * copy of the real value.
+ */
+function buildCredentialInjector() {
+    if (!config?.credentials)
+        return undefined;
+    return (headers, destHost) => {
+        sentinelRegistry.substituteInHeaders(headers, destHost, matchesDomainPattern);
+    };
+}
 function getMitmSocketPath(host) {
     if (!config?.network.mitmProxy) {
         return undefined;
@@ -147,101 +171,82 @@ function getMitmSocketPath(host) {
     return undefined;
 }
 /**
- * Bind `server.listen()` to the first free port in `[lo, hi]`,
- * skipping `EADDRINUSE`. With `range` undefined, binds to ephemeral
- * port 0 (the previous behaviour).
+ * Per-host TLS-termination opt-out from network.tlsTerminate.excludeDomains.
+ * Only consulted by the HTTP proxy when tlsTerminate is enabled; exempted
+ * hosts fall back to the opaque CONNECT tunnel (still allowlist-filtered),
+ * so mTLS / cert-pinning clients can complete their own handshake.
  *
- * Used on Windows: the WFP loopback permit only covers a fixed port
- * range (default 60080–60089), so the JS proxies must bind inside it
- * for the sandboxed child to reach them. On other platforms the
- * sandbox layer (seatbelt rule, namespace+socat) targets whatever
- * port we landed on, so ephemeral is fine.
+ * Matches the canonicalized hostname, like the allow/deny filter
+ * (filterNetworkRequest) — otherwise a spelling the allowlist accepts after
+ * canonicalization (`127.1`, a trailing-dot FQDN) would dodge the exclusion
+ * and get terminated anyway.
  */
-function listenInRange(server, doListen, range, exclude) {
-    return new Promise((resolve, reject) => {
-        const [lo, hi] = range ?? [0, 0];
-        let port = lo;
-        const tryNext = () => {
-            while (exclude.has(port) && port <= hi)
-                port++;
-            if (port > hi) {
-                reject(new Error(`No free port in range ${lo}-${hi} (excluding ${[...exclude].join(',')})`));
-                return;
-            }
-            const onListening = () => {
-                server.removeListener('error', onError);
-                resolve();
-            };
-            const onError = (err) => {
-                // The paired 'listening' once-listener never fired; drop it
-                // so retries don't accumulate stale listeners.
-                server.removeListener('listening', onListening);
-                if (range &&
-                    err?.code === 'EADDRINUSE' &&
-                    port < hi) {
-                    port++;
-                    tryNext();
-                    return;
-                }
-                reject(err ?? new Error('listen error'));
-            };
-            server.once('error', onError);
-            server.once('listening', onListening);
-            doListen(range ? port : 0);
-        };
-        tryNext();
-    });
+function shouldTerminateTLSForHost(host) {
+    const excludeDomains = config?.network.tlsTerminate?.excludeDomains;
+    if (!excludeDomains?.length)
+        return true;
+    const canonicalHost = canonicalizeHost(host) ?? host;
+    for (const pattern of excludeDomains) {
+        if (!matchesDomainPattern(canonicalHost, pattern))
+            continue;
+        logForDebugging(`Host ${host} matches tlsTerminate.excludeDomains pattern ${pattern}; skipping TLS termination`);
+        // Masked-credential substitution only happens on the terminated path,
+        // so a credential whose injectHosts cover this host can never be
+        // injected here — the upstream gets the placeholder. Config validation
+        // rejects the fully-contradictory spellings; this flags the partial
+        // ones (e.g. default injectHosts = allowedDomains) at the moment they
+        // actually bite.
+        const masked = sentinelRegistry.namesInjectableAt(canonicalHost, matchesDomainPattern);
+        if (masked.length > 0) {
+            logForDebugging(`tlsTerminate.excludeDomains: masked credential(s) ${masked.join(', ')} ` +
+                `are configured for injection at ${host}, but its connections are ` +
+                `not terminated, so the upstream will receive the placeholder`, { level: 'error' });
+        }
+        return false;
+    }
+    return true;
 }
-async function startHttpProxyServer(sandboxAskCallback, portRange, excludePorts) {
+async function startMuxProxyServer(sandboxAskCallback, portRange) {
+    const injectCredentials = buildCredentialInjector();
     httpProxyServer = createHttpProxyServer({
         filter: (port, host) => filterNetworkRequest(port, host, sandboxAskCallback),
         getMitmSocketPath,
         mitmCA,
+        shouldTerminateTLS: shouldTerminateTLSForHost,
         filterRequest: config?.network.filterRequest,
+        // TLS-terminated path always gets the injector; the plain-HTTP path
+        // only when explicitly opted in. Without the opt-in, a sentinel sent
+        // over plain HTTP reaches the upstream unchanged (fails closed).
+        mutateHeaders: injectCredentials,
+        mutateHeadersPlaintext: config?.credentials?.allowPlaintextInject
+            ? injectCredentials
+            : undefined,
         parentProxy,
         proxyAuthToken,
     });
-    const server = httpProxyServer;
-    await listenInRange(server, p => server.listen(p, '127.0.0.1'), portRange, excludePorts);
-    const address = server.address();
-    if (!address || typeof address !== 'object') {
-        throw new Error('Failed to get HTTP proxy server address');
-    }
-    server.unref();
-    logForDebugging(`HTTP proxy listening on localhost:${address.port}`);
-    return address.port;
-}
-async function startSocksProxyServer(sandboxAskCallback, portRange, excludePorts) {
     socksProxyServer = createSocksProxyServer({
         filter: (port, host) => filterNetworkRequest(port, host, sandboxAskCallback),
         parentProxy,
         proxyAuthToken,
     });
-    const wrapper = socksProxyServer;
-    // SocksProxyWrapper.listen() resolves with the bound port; we
-    // adapt it to the listenInRange shape by retrying on EADDRINUSE
-    // here directly rather than via the once('error') path.
-    if (!portRange) {
-        const port = await wrapper.listen(0, '127.0.0.1');
-        wrapper.unref();
-        return port;
-    }
-    let lastErr;
-    for (let p = portRange[0]; p <= portRange[1]; p++) {
-        if (excludePorts.has(p))
-            continue;
-        try {
-            const port = await wrapper.listen(p, '127.0.0.1');
-            wrapper.unref();
-            return port;
-        }
-        catch (err) {
-            lastErr = err;
-            if (err?.code !== 'EADDRINUSE')
-                throw err;
-        }
+    muxProxyServer = createMuxProxyServer({
+        httpServer: httpProxyServer,
+        handleSocksConnection: s => socksProxyServer.handleConnection(s),
+        httpBackendPortRange: portRange,
+    });
+    const mux = muxProxyServer;
+    // Backend first so the front-end never accepts a connection that would
+    // dispatch to an unbound backend. On Windows the backend's port is
+    // excluded when binding the front-end in the same WFP range.
+    const backendPort = await mux.listenHttpBackend();
+    await listenInRange(mux.server, p => mux.server.listen(p, '127.0.0.1'), portRange, backendPort !== undefined ? new Set([backendPort]) : new Set());
+    const muxPort = mux.getPort();
+    if (muxPort === undefined) {
+        throw new Error('Failed to get mux proxy server port');
     }
-    throw new Error(`No free SOCKS port in range ${portRange[0]}-${portRange[1]}: ${lastErr?.message ?? 'all in use'}`);
+    mux.unref();
+    logForDebugging(`Mux proxy (HTTP+SOCKS) listening on localhost:${muxPort}`);
+    return muxPort;
 }
 // ============================================================================
 // Public Module Functions (will be exported via namespace)
@@ -285,6 +290,90 @@ async function initialize(runtimeConfig, sandboxAskCallback, enableLogMonitor =
     }
     // Register cleanup handlers first time
     registerCleanup();
+    // Windows: apply the file-deny stamp set BEFORE any sandboxed
+    // child can be spawned. Synchronous (spawnSync) and independent
+    // of the network proxies, so do it here rather than inside the
+    // initializationPromise. Throws on any failure (including a
+    // partial — exit 2 means at least one input was skipped):
+    // fail-closed at session start.
+    if (getPlatform() === 'windows') {
+        // Separate-user opt-in: refuse early when the config asks for
+        // it but the account isn't provisioned. Doing this at
+        // initialize() (not wrap-time) means the host gets a single
+        // actionable error before any per-exec work happens, instead of
+        // exit-15 on every command.
+        if (runtimeConfig.windows?.asSandboxUser) {
+            const u = getWindowsSandboxUserStatus();
+            if (!u.provisioned || !u.credPresent) {
+                config = undefined;
+                throw new Error(`windows.asSandboxUser is set but the sandbox user is not ` +
+                    `provisioned (user=${u.provisioned}, cred=${u.credPresent}). ` +
+                    `Run \`npx sandbox-runtime windows-install\` (one UAC ` +
+                    `prompt) to provision it.`);
+            }
+            // schannel-level trust under the sandbox user is install-time
+            // (cert lifecycle = sandbox-user lifecycle), not per-session.
+            // The env-var trust layer covers OpenSSL clients regardless,
+            // but System32 curl / IWR / .NET / default-backend git only
+            // trust what's in the sandbox user's `CurrentUser\Root` —
+            // which `srt-win exec` does not (and must not) write. Gate
+            // only on `asSandboxUser`: the same-user path lands on the
+            // REAL user's Root, which is out of scope (env-var trust
+            // only). Compare thumbprints so a stale install-time CA
+            // doesn't pass the gate while schannel rejects the session's
+            // proxy-minted leaves.
+            if (runtimeConfig.network.tlsTerminate && mitmCA) {
+                const installed = getWindowsSandboxCaCert(u);
+                const sessionThumb = new X509Certificate(mitmCA.certPem).fingerprint
+                    .replace(/:/g, '')
+                    .toUpperCase();
+                if (!installed) {
+                    config = undefined;
+                    throw new Error(`tlsTerminate with windows.asSandboxUser requires the ` +
+                        `sandbox to be installed with this CA (thumb=` +
+                        `${sessionThumb}): run \`srt-win user trust-ca ` +
+                        `${mitmCA.certPath}\`. Per-exec installs into the ` +
+                        `sandbox user's Root store are not supported.`);
+                }
+                if (installed.thumb !== sessionThumb) {
+                    config = undefined;
+                    throw new Error(`tlsTerminate with windows.asSandboxUser: the sandbox's ` +
+                        `installed CA (thumb=${installed.thumb}) doesn't match ` +
+                        `this session's CA (thumb=${sessionThumb}). Run ` +
+                        `\`srt-win user trust-ca ${mitmCA.certPath}\` to ` +
+                        `update it.`);
+                }
+            }
+        }
+        try {
+            const deny = computeWindowsFsDenySet(runtimeConfig);
+            if (deny.denyRead.length > 0 || deny.denyWrite.length > 0) {
+                const group = getWindowsGroupRef();
+                stampWindowsAcl({
+                    group,
+                    denyRead: deny.denyRead,
+                    denyWrite: deny.denyWrite,
+                });
+                // Only record the set AFTER a successful stamp — the
+                // catch below clears `config`, and a non-undefined
+                // stampedSet would leave reset()/updateConfig() seeing a
+                // stamp that never landed.
+                windowsFsStampedSet = deny;
+                windowsFsStampedGroup = group;
+                logForDebugging(`[Sandbox Windows] file deny stamped: ` +
+                    `${deny.denyRead.length} denyRead, ${deny.denyWrite.length} denyWrite`);
+            }
+            windowsFsRawInputs = rawWindowsFsInputs(runtimeConfig);
+        }
+        catch (e) {
+            // Best-effort release of whatever WAS stamped before the
+            // failure (exit-2 partial stamps the resolvable inputs;
+            // harmless if nothing was stamped — no holds for this PID).
+            restoreWindowsAcl({ group: getWindowsGroupRef() });
+            config = undefined;
+            throw e;
+        }
+    }
     // Initialize network infrastructure
     initializationPromise = (async () => {
         try {
@@ -302,27 +391,23 @@ async function initialize(runtimeConfig, sandboxAskCallback, enableLogMonitor =
                 config.network.httpProxyPort !== undefined
                     ? undefined
                     : randomBytes(16).toString('hex');
-            let httpProxyPort;
+            // The mux front-end serves both protocols on one port. Each side's
+            // reported port is the external override if configured, else the mux
+            // port — so the public config.network.{http,socks}ProxyPort contract
+            // is unchanged. The mux is skipped only when BOTH are external.
+            const needLocalProxy = config.network.httpProxyPort === undefined ||
+                config.network.socksProxyPort === undefined;
+            const muxPort = needLocalProxy
+                ? await startMuxProxyServer(sandboxAskCallback, portRange)
+                : undefined;
+            const httpProxyPort = config.network.httpProxyPort ?? muxPort;
+            const socksProxyPort = config.network.socksProxyPort ?? muxPort;
             if (config.network.httpProxyPort !== undefined) {
-                // Use external HTTP proxy (don't start a server)
-                httpProxyPort = config.network.httpProxyPort;
                 logForDebugging(`Using external HTTP proxy on port ${httpProxyPort}`);
             }
-            else {
-                // Start local HTTP proxy
-                httpProxyPort = await startHttpProxyServer(sandboxAskCallback, portRange, new Set());
-            }
-            let socksProxyPort;
             if (config.network.socksProxyPort !== undefined) {
-                // Use external SOCKS proxy (don't start a server)
-                socksProxyPort = config.network.socksProxyPort;
                 logForDebugging(`Using external SOCKS proxy on port ${socksProxyPort}`);
             }
-            else {
-                // Start local SOCKS proxy. Skip the port the HTTP proxy
-                // already took.
-                socksProxyPort = await startSocksProxyServer(sandboxAskCallback, portRange, new Set([httpProxyPort]));
-            }
             // Initialize platform-specific infrastructure
             let linuxBridge;
             if (getPlatform() === 'linux') {
@@ -408,12 +493,99 @@ function checkDependencies(ripgrepConfig) {
     }
     return { errors, warnings };
 }
+/**
+ * Build the read-deny / env-unset / env-set maps implied by the
+ * `credentials` config.
+ *
+ * Only explicitly declared sources are restricted: `mode: 'deny'` file
+ * entries join the read-deny set, `mode: 'deny'` env vars are unset, and
+ * `mode: 'mask'` env vars are set to a per-session sentinel registered in
+ * {@link sentinelRegistry}. A masked var with no value in the host
+ * environment is skipped — there is nothing to protect, and emitting an
+ * unset var would change tool behaviour (presence checks would pass where
+ * they didn't before).
+ */
+function getCredentialRestrictions(credentials, allowedDomains) {
+    if (!credentials) {
+        return {
+            denyReadPaths: [],
+            unsetEnvVars: [],
+            setEnvVars: {},
+            maskedFileBinds: [],
+            maskedFileStoreDir: undefined,
+        };
+    }
+    const denyReadPaths = getCredentialDenyReadPaths(credentials);
+    const unsetEnvVars = [];
+    const setEnvVars = {};
+    for (const v of credentials.envVars ?? []) {
+        if (v.mode === 'deny') {
+            unsetEnvVars.push(v.name);
+        }
+        else if (v.mode === 'mask') {
+            const real = process.env[v.name];
+            if (real === undefined)
+                continue;
+            // Effective injectHosts: per-entry narrows; if unset, default to
+            // every reachable host (network.allowedDomains). injectHosts is an
+            // *optional narrowing*, not a required allowlist. Trade-off: a
+            // masked credential with no injectHosts is injectable at every host
+            // the sandbox can reach — narrow it explicitly when the credential
+            // should only go to a subset.
+            const injectHosts = v.injectHosts ?? allowedDomains ?? [];
+            setEnvVars[v.name] = sentinelRegistry.register(v.name, real, injectHosts);
+        }
+    }
+    // Masked files: read the real bytes on the host, register a sentinel,
+    // write it to a fake file in the manager-owned temp dir. Missing/unreadable
+    // entries are skipped (same posture as an unset masked env var).
+    const files = credentials.files ?? [];
+    const maskedFileBinds = buildMaskedFileBinds(files, allowedDomains ?? [], sentinelRegistry, maskedFileStore);
+    return {
+        denyReadPaths,
+        unsetEnvVars: [...new Set(unsetEnvVars)],
+        setEnvVars,
+        maskedFileBinds,
+        maskedFileStoreDir: maskedFileStore.dirPath,
+    };
+}
+/**
+ * Pure (side-effect-free) chokepoint for credential file-deny
+ * paths — `credentials.files` entries with `mode: 'deny'`. Any
+ * code that needs the credential→denyRead contribution routes
+ * through here so a comparison predicate can read it without
+ * touching {@link sentinelRegistry}.
+ */
+function getCredentialDenyReadPaths(credentials) {
+    const files = credentials?.files ?? [];
+    return [...new Set(files.filter(f => f.mode === 'deny').map(f => f.path))];
+}
+/** Order-insensitive string-set equality. */
+function setEq(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const bs = new Set(b);
+    return a.every(v => bs.has(v));
+}
+/**
+ * Union the explicit `filesystem.denyRead` with credential-derived
+ * deny paths. The single source of "what files does this config
+ * want read-denied" — all platforms route through here so a new
+ * credential kind that contributes deny paths reaches every
+ * backend.
+ */
+function unionDenyReadPaths(denyRead, credentialRestrictions) {
+    return [...new Set([...denyRead, ...credentialRestrictions.denyReadPaths])];
+}
 function getFsReadConfig() {
-    if (!config) {
+    if (!config || config.filesystem.disabled) {
         return { denyOnly: [], allowWithinDeny: [] };
     }
+    // Credential deny paths are unioned with the caller's denyRead — never
+    // replacing it — so explicit filesystem restrictions always survive.
+    const rawDenyRead = unionDenyReadPaths(config.filesystem.denyRead, getCredentialRestrictions(config.credentials, config.network.allowedDomains));
     const denyPaths = [];
-    for (const p of config.filesystem.denyRead) {
+    for (const p of rawDenyRead) {
         const stripped = removeTrailingGlobSuffix(p);
         if (getPlatform() === 'linux' && containsGlobChars(stripped)) {
             // Expand glob to concrete paths on Linux (bubblewrap doesn't support globs)
@@ -447,6 +619,9 @@ function getFsWriteConfig() {
     if (!config) {
         return { allowOnly: getDefaultWritePaths(), denyWithinAllow: [] };
     }
+    if (config.filesystem.disabled) {
+        return { allowOnly: ['/'], denyWithinAllow: [] };
+    }
     // Filter out glob patterns on Linux/WSL for allowWrite (bubblewrap doesn't support globs)
     const allowPaths = config.filesystem.allowWrite
         .map(path => removeTrailingGlobSuffix(path))
@@ -474,6 +649,91 @@ function getFsWriteConfig() {
         denyWithinAllow: denyPaths,
     };
 }
+/**
+ * Build the Windows file-deny set from `runtimeConfig`. Globs are
+ * expanded to concrete file paths (point-in-time — a file
+ * appearing after this returns is NOT covered). Throws on any
+ * directory match (file-only for now) and on any unsupported
+ * config field that would otherwise be silently dropped.
+ *
+ * `denyRead` ← `filesystem.denyRead` ∪ `credentials`-derived deny
+ *              paths (via {@link getCredentialDenyReadPaths}).
+ * `denyWrite` ← `filesystem.denyWrite`.
+ *
+ * Not supported on Windows (throws if non-empty so the caller
+ * never silently runs with a weaker-than-configured policy):
+ *   - `filesystem.allowRead` (re-allow within a denied region)
+ *   - `filesystem.allowWrite` as a write allow-list — the Windows
+ *     backend is deny-listed only; the sandboxed child writes
+ *     wherever the host user can, minus `denyWrite`.
+ */
+function computeWindowsFsDenySet(c) {
+    const fs = c.filesystem;
+    // filesystem.disabled bypasses ALL filesystem rule generation —
+    // same as the macOS/Linux wrapWithSandbox path (readConfig /
+    // writeConfig left undefined). On Windows this means no ACL
+    // stamp; credential FILE denies are dropped along with the rest
+    // (credential ENV scrubbing is independent and still applied at
+    // wrap time). Returning empty here means initialize() applies no
+    // stamp.
+    if (fs?.disabled) {
+        return { denyRead: [], denyWrite: [] };
+    }
+    if (fs?.allowRead?.length) {
+        throw new Error(`filesystem.allowRead (re-allow within denyRead) is not supported ` +
+            `on Windows. Remove the entries or narrow filesystem.denyRead to ` +
+            `exclude them.`);
+    }
+    if (fs?.allowWrite?.length) {
+        throw new Error(`filesystem.allowWrite is not supported on Windows — the Windows ` +
+            `sandbox is deny-listed only (the child writes wherever the host ` +
+            `user can, minus filesystem.denyWrite). Remove the allowWrite ` +
+            `entries.`);
+    }
+    const denyRead = expandWindowsFsDenyPaths([
+        ...new Set([
+            ...(fs?.denyRead ?? []),
+            ...getCredentialDenyReadPaths(c.credentials),
+        ]),
+    ]);
+    const denyWrite = expandWindowsFsDenyPaths(fs?.denyWrite ?? []);
+    return { denyRead, denyWrite };
+}
+/**
+ * Snapshot the raw config fields that feed
+ * {@link computeWindowsFsDenySet}. Used by updateConfig() to
+ * short-circuit the resolved-set diff (which re-runs glob
+ * expansion) when nothing relevant changed.
+ */
+function rawWindowsFsInputs(c) {
+    // Keyed exactly on what {@link computeWindowsFsDenySet} reads:
+    // disabled, denyRead, denyWrite, and the credential file-deny
+    // paths. `network.allowedDomains` does NOT feed file-deny
+    // (only mask injectHosts), so a network-only updateConfig
+    // hits the cache.
+    return {
+        disabled: c.filesystem.disabled ?? false,
+        denyRead: [...c.filesystem.denyRead],
+        denyWrite: [...c.filesystem.denyWrite],
+        credFiles: getCredentialDenyReadPaths(c.credentials),
+    };
+}
+function sameRawWindowsFsInputs(a, b) {
+    return (a.disabled === b.disabled &&
+        setEq(a.denyRead, b.denyRead) &&
+        setEq(a.denyWrite, b.denyWrite) &&
+        setEq(a.credFiles, b.credFiles));
+}
+/**
+ * True when `newConfig`'s file-deny inputs match what was
+ * stamped at initialize(). Compares raw inputs only (cheap,
+ * order-insensitive); never re-expands globs — updateConfig is
+ * warn-only on Windows and the resolved set wouldn't be used.
+ */
+function sameWindowsStampSet(newConfig) {
+    return (windowsFsRawInputs !== undefined &&
+        sameRawWindowsFsInputs(windowsFsRawInputs, rawWindowsFsInputs(newConfig)));
+}
 function getNetworkRestrictionConfig() {
     if (!config) {
         return {};
@@ -563,6 +823,22 @@ async function waitForNetworkInitialization() {
 }
 async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
     const platform = getPlatform();
+    // filesystem.disabled bypasses ALL filesystem rule generation. Both
+    // platform wrappers treat readConfig/writeConfig === undefined as "no
+    // filesystem restrictions" (seatbelt emits `(allow file-write*)`; bwrap
+    // skips the `--ro-bind / /` root and all path binds).
+    //
+    // Precedence: when a caller passes a per-call filesystem override at all,
+    // its `disabled` (defaulting to false) wins outright. A global
+    // disabled=true must not silently discard a per-call tightening that
+    // omits the new key.
+    const fsDisabled = customConfig?.filesystem !== undefined
+        ? (customConfig.filesystem.disabled ?? false)
+        : (config?.filesystem.disabled ?? false);
+    // Credential env handling is independent of filesystem policy: unsetEnvVars /
+    // setEnvVars must be applied even when fsDisabled (the credential file
+    // deny-reads are dropped, but env scrubbing still happens).
+    const credentialRestrictions = getCredentialRestrictions(customConfig?.credentials ?? config?.credentials, customConfig?.network?.allowedDomains ?? config?.network?.allowedDomains);
     // Get configs - use custom if provided, otherwise fall back to main config
     // If neither exists, defaults to empty arrays (most restrictive)
     // Always include default system write paths (like /dev/null, /tmp/claude)
@@ -570,52 +846,62 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
     // Strip trailing /** and filter remaining globs on Linux (bwrap needs
     // real paths, not globs; macOS subpath matching is also recursive so
     // stripping is harmless there).
-    const stripWriteGlobs = (paths) => paths
-        .map(p => removeTrailingGlobSuffix(p))
-        .filter(p => {
-        if (getPlatform() === 'linux' && containsGlobChars(p)) {
-            logForDebugging(`[Sandbox] Skipping glob write pattern on Linux: ${p}`);
-            return false;
-        }
-        return true;
-    });
-    const userAllowWrite = stripWriteGlobs(customConfig?.filesystem?.allowWrite ?? config?.filesystem.allowWrite ?? []);
-    const writeConfig = {
-        allowOnly: [...getDefaultWritePaths(), ...userAllowWrite],
-        denyWithinAllow: stripWriteGlobs(customConfig?.filesystem?.denyWrite ?? config?.filesystem.denyWrite ?? []),
-    };
-    const rawDenyRead = customConfig?.filesystem?.denyRead ?? config?.filesystem.denyRead ?? [];
-    const expandedDenyRead = [];
-    for (const p of rawDenyRead) {
-        const stripped = removeTrailingGlobSuffix(p);
-        if (getPlatform() === 'linux' && containsGlobChars(stripped)) {
-            expandedDenyRead.push(...expandGlobPattern(p));
-        }
-        else {
-            expandedDenyRead.push(stripped);
+    let writeConfig;
+    let readConfig;
+    if (!fsDisabled) {
+        const stripWriteGlobs = (paths) => paths
+            .map(p => removeTrailingGlobSuffix(p))
+            .filter(p => {
+            if (getPlatform() === 'linux' && containsGlobChars(p)) {
+                logForDebugging(`[Sandbox] Skipping glob write pattern on Linux: ${p}`);
+                return false;
+            }
+            return true;
+        });
+        const userAllowWrite = stripWriteGlobs(customConfig?.filesystem?.allowWrite ??
+            config?.filesystem.allowWrite ??
+            []);
+        writeConfig = {
+            allowOnly: [...getDefaultWritePaths(), ...userAllowWrite],
+            denyWithinAllow: stripWriteGlobs(customConfig?.filesystem?.denyWrite ??
+                config?.filesystem.denyWrite ??
+                []),
+        };
+        // Credential deny paths are unioned with the caller's denyRead — never
+        // replacing it — so explicit filesystem restrictions always survive.
+        const rawDenyRead = unionDenyReadPaths(customConfig?.filesystem?.denyRead ?? config?.filesystem.denyRead ?? [], credentialRestrictions);
+        const expandedDenyRead = [];
+        for (const p of rawDenyRead) {
+            const stripped = removeTrailingGlobSuffix(p);
+            if (getPlatform() === 'linux' && containsGlobChars(stripped)) {
+                expandedDenyRead.push(...expandGlobPattern(p));
+            }
+            else {
+                expandedDenyRead.push(stripped);
+            }
         }
-    }
-    const rawAllowRead = customConfig?.filesystem?.allowRead ?? config?.filesystem.allowRead ?? [];
-    const expandedAllowRead = [];
-    for (const p of rawAllowRead) {
-        const stripped = removeTrailingGlobSuffix(p);
-        if (getPlatform() === 'linux' && containsGlobChars(stripped)) {
-            expandedAllowRead.push(...expandGlobPattern(p));
+        const rawAllowRead = customConfig?.filesystem?.allowRead ?? config?.filesystem.allowRead ?? [];
+        const expandedAllowRead = [];
+        for (const p of rawAllowRead) {
+            const stripped = removeTrailingGlobSuffix(p);
+            if (getPlatform() === 'linux' && containsGlobChars(stripped)) {
+                expandedAllowRead.push(...expandGlobPattern(p));
+            }
+            else {
+                expandedAllowRead.push(stripped);
+            }
         }
-        else {
-            expandedAllowRead.push(stripped);
+        // The TLS-termination CA cert and the trust bundle the env vars point at
+        // (NODE_EXTRA_CA_CERTS etc.) must be readable by the child, even if their
+        // paths fall under a user-configured denyRead.
+        if (mitmCA) {
+            expandedAllowRead.push(mitmCA.certPath, mitmCA.trustBundlePath);
         }
+        readConfig = {
+            denyOnly: expandedDenyRead,
+            allowWithinDeny: expandedAllowRead,
+        };
     }
-    // The TLS-termination CA cert must be readable by the child so the trust
-    // env vars (NODE_EXTRA_CA_CERTS etc.) resolve, even if its path falls
-    // under a user-configured denyRead.
-    if (mitmCA) {
-        expandedAllowRead.push(mitmCA.certPath);
-    }
-    const readConfig = {
-        denyOnly: expandedDenyRead,
-        allowWithinDeny: expandedAllowRead,
-    };
     // Check if network config is specified - this determines if we need network restrictions
     // Network restriction is needed when:
     // 1. customConfig has network.allowedDomains defined (even if empty array = block all)
@@ -649,9 +935,12 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
                 httpProxyPort: needsNetworkProxy ? getProxyPort() : undefined,
                 socksProxyPort: needsNetworkProxy ? getSocksProxyPort() : undefined,
                 proxyAuthToken: needsNetworkProxy ? proxyAuthToken : undefined,
-                caCertPath: mitmCA?.certPath,
+                caCertPath: mitmCA?.trustBundlePath,
                 readConfig,
                 writeConfig,
+                unsetEnvVars: credentialRestrictions.unsetEnvVars,
+                setEnvVars: credentialRestrictions.setEnvVars,
+                maskedFileBinds: credentialRestrictions.maskedFileBinds,
                 allowUnixSockets: getAllowUnixSockets(),
                 allowAllUnixSockets: getAllowAllUnixSockets(),
                 allowLocalBinding: getAllowLocalBinding(),
@@ -682,9 +971,13 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
                     ? managerContext?.socksProxyPort
                     : undefined,
                 proxyAuthToken: needsNetworkProxy ? proxyAuthToken : undefined,
-                caCertPath: mitmCA?.certPath,
+                caCertPath: mitmCA?.trustBundlePath,
                 readConfig,
                 writeConfig,
+                unsetEnvVars: credentialRestrictions.unsetEnvVars,
+                setEnvVars: credentialRestrictions.setEnvVars,
+                maskedFileBinds: credentialRestrictions.maskedFileBinds,
+                maskedFileStoreDir: credentialRestrictions.maskedFileStoreDir,
                 enableWeakerNestedSandbox: getEnableWeakerNestedSandbox(),
                 allowAllUnixSockets: getAllowAllUnixSockets(),
                 binShell,
@@ -730,13 +1023,104 @@ async function wrapWithSandboxArgv(command, binShell, customConfig, abortSignal)
         if (hasNetworkConfig) {
             await waitForNetworkInitialization();
         }
+        const credentialRestrictions = getCredentialRestrictions(customConfig?.credentials ?? config?.credentials, customConfig?.network?.allowedDomains ?? config?.network?.allowedDomains);
+        // Per-exec FILE denies (customConfig only — the session-level
+        // config's denies were already stamped at initialize()).
+        // Unlike the session-level set, paths are passed through
+        // VERBATIM (normalized only): no glob expansion, no
+        // existsSync filter. `srt-win exec`'s
+        // `canonicalize_deny_targets` is the authority — it
+        // hard-fails on glob/dir/nonexistent so a missing path is a
+        // visible caller error, not a silent skip (the session-level
+        // expand-and-drop-missing was for tolerant point-in-time
+        // globs at init; per-exec is "deny THIS one command" and a
+        // path that doesn't resolve is a bug the caller must see).
+        //
+        // The dedup against `windowsFsStampedSet` is an OPTIMIZATION,
+        // not a correctness gate: re-stamping a session-held path
+        // under the exec's distinct holder is refcount-safe but
+        // wastes a SetSecurityInfo round-trip. The mask-escalation /
+        // hardlink-alias guard lives in srt-win's `ensure_stamped`
+        // (`refuse_escalation = true`), NOT here — canonical-path
+        // identity and concurrent holders are only visible to Rust.
+        //
+        // filesystem.disabled bypasses ALL filesystem rule generation
+        // — including credential-derived file denies — same ordering
+        // as session-level `computeWindowsFsDenySet` (credential ENV
+        // scrubbing is independent and still applied at wrap time).
+        // allowRead/allowWrite throw, also matching session-level:
+        // the Windows file-deny sandbox is deny-only.
+        const fsCfg = customConfig?.filesystem;
+        let perExecDenyRead = [];
+        let perExecDenyWrite = [];
+        if (!fsCfg?.disabled) {
+            if (fsCfg?.allowRead?.length) {
+                throw new Error(`Per-exec filesystem.allowRead (re-allow within denyRead) is ` +
+                    `not supported on Windows. Remove the entries or narrow ` +
+                    `filesystem.denyRead to exclude them.`);
+            }
+            if (fsCfg?.allowWrite?.length) {
+                throw new Error(`Per-exec filesystem.allowWrite is not supported on Windows — ` +
+                    `the Windows sandbox is deny-listed only (the child writes ` +
+                    `wherever the host user can, minus filesystem.denyWrite). ` +
+                    `Remove the allowWrite entries.`);
+            }
+            const rawRead = [
+                ...(fsCfg?.denyRead ?? []),
+                ...getCredentialDenyReadPaths(customConfig?.credentials),
+            ];
+            const rawWrite = fsCfg?.denyWrite ?? [];
+            // Skip on the dominant path (no per-exec fs or
+            // credential-file deny) — this used to call
+            // `computeWindowsFsDenySet` (glob walk + statSync per
+            // match) on every exec, including with
+            // `customConfig === undefined`.
+            if (rawRead.length > 0 || rawWrite.length > 0) {
+                const sessRead = new Set(windowsFsStampedSet?.denyRead ?? []);
+                const sessWrite = new Set(windowsFsStampedSet?.denyWrite ?? []);
+                const norm = (raw) => [
+                    ...new Set(raw.map(normalizePathForSandbox)),
+                ];
+                perExecDenyRead = norm(rawRead).filter(p => !sessRead.has(p));
+                perExecDenyWrite = norm(rawWrite).filter(p => !sessRead.has(p) && !sessWrite.has(p));
+            }
+        }
+        // Per-exec deny rides on argv (`acl stamp` reads stdin, but
+        // exec's stdin belongs to the child). The CreateProcessW
+        // length check lives in `wrapCommandWithSandboxWindows`
+        // where the full argv (incl. shell + user command) is known.
+        //
+        // Credential env restrictions are passed INTO the wrapper so it
+        // can apply them BEFORE merging the proxy env (same precedence
+        // as the macOS/Linux `env -u … VAR=… sandbox-exec` order — the
+        // sandbox's own proxy plumbing must survive a caller listing
+        // e.g. HTTPS_PROXY as a denied credential). The `denyReadPaths`
+        // half of the SESSION-level credentials is already unioned into
+        // the stamp set at initialize() time via
+        // `computeWindowsFsDenySet`.
         return wrapCommandWithSandboxWindows({
             command,
             group: getWindowsGroupRef(),
+            sublayerGuid: config?.windows?.wfpSublayerGuid,
             httpProxyPort: hasNetworkConfig ? getProxyPort() : undefined,
             socksProxyPort: hasNetworkConfig ? getSocksProxyPort() : undefined,
             proxyAuthToken: hasNetworkConfig ? proxyAuthToken : undefined,
-            binShell,
+            unsetEnvVars: credentialRestrictions.unsetEnvVars,
+            setEnvVars: credentialRestrictions.setEnvVars,
+            // Engage the session-level fence only when this session
+            // actually stamped — keeps `srt-win exec` standalone (no
+            // state-DB dependency) when no file-deny is configured. The
+            // per-exec deny below opens its own fence under the exec's
+            // own PID regardless.
+            holderPid: windowsFsStampedSet ? process.pid : undefined,
+            denyRead: perExecDenyRead,
+            denyWrite: perExecDenyWrite,
+            // Opt-in two-hop separate-user launch. Additive — defaults
+            // false, the same-user deny-only-group path is unchanged.
+            // Provisioning was checked at initialize().
+            asSandboxUser: config?.windows?.asSandboxUser ?? false,
+            caCertPath: mitmCA?.trustBundlePath,
+            binShell: parseWindowsBinShell(binShell),
         });
     }
     // macOS/Linux: delegate to the existing string wrapper, then put
@@ -765,12 +1149,33 @@ function getConfig() {
  *
  * Filesystem changes (denyRead/denyWrite) are NOT applied live:
  * macOS bakes them into the seatbelt profile at wrap time, and
- * Windows will need an explicit re-stamp. To change FS
- * restrictions, reset() then initialize() with the new config.
+ * Windows applies the ACL stamp once at `initialize()` (a live
+ * swap would mean releasing all of this holder's claims and
+ * re-stamping, which opens an unprotected window). To change FS
+ * restrictions, `reset()` then `initialize()` with the new
+ * config; on Windows, calling this with a config whose file-deny
+ * inputs (`filesystem.denyRead`/`denyWrite`, `credentials.files`)
+ * differ from those passed at `initialize()` logs a warning and
+ * the stamped set stays as-is.
  *
  * @param newConfig - The new configuration to use
  */
 function updateConfig(newConfig) {
+    if (getPlatform() === 'windows' &&
+        config &&
+        (newConfig.windows?.groupSid !== config.windows?.groupSid ||
+            newConfig.windows?.groupName !== config.windows?.groupName)) {
+        throw new Error('Changing the Windows sandbox group requires reset() and ' +
+            're-initialize().');
+    }
+    if (getPlatform() === 'windows' &&
+        config &&
+        !sameWindowsStampSet(newConfig)) {
+        logForDebugging(`[Sandbox Windows] updateConfig: the resolved file-deny set ` +
+            `(filesystem.denyRead/denyWrite ∪ credentials.files) changed but ` +
+            `the ACL stamp is session-wide — call reset() then initialize() ` +
+            `to apply. The previously-stamped set stays in effect.`, { level: 'warn' });
+    }
     // Deep clone the config to avoid mutations. structuredClone cannot clone
     // functions, so pull filterRequest out, clone the rest, and put it back —
     // a function reference is immutable in the sense that matters here.
@@ -907,6 +1312,39 @@ function forceCloseHttpServer(server) {
     });
 }
 async function reset() {
+    // Windows: release this session's file-deny stamps. Best-effort
+    // — log anomalies (relocated/missing/tampered/…) rather than
+    // throw, so teardown always completes. The on-disk hash-ACE
+    // marker means a stamp left in place is recoverable later via
+    // `srt-win acl recover`.
+    if (windowsFsStampedSet) {
+        const r = restoreWindowsAcl({
+            group: windowsFsStampedGroup ?? getWindowsGroupRef(),
+        });
+        if (r) {
+            for (const e of r.paths ?? []) {
+                if (!WINDOWS_ACL_PATH_OK.has(e.status)) {
+                    const tail = e.status === 'missing'
+                        ? ' — file no longer exists; snapshot row kept for tracking'
+                        : (e.movedTo ? ` (now at '${e.movedTo}')` : '') +
+                            ' — stamp left in place; resolve and run ' +
+                            '`srt-win acl recover` to clear';
+                    logForDebugging(`[Sandbox Windows] file-deny restore: '${e.path}' ` +
+                        `${e.status}${tail}`, { level: 'warn' });
+                }
+            }
+            for (const e of r.parents ?? []) {
+                if (!WINDOWS_ACL_PARENT_OK.has(e.status)) {
+                    logForDebugging(`[Sandbox Windows] file-deny restore: parent ` +
+                        `'${e.path}' ${e.status}` +
+                        (e.error ? `: ${e.error}` : ''), { level: 'warn' });
+                }
+            }
+        }
+    }
+    windowsFsStampedSet = undefined;
+    windowsFsStampedGroup = undefined;
+    windowsFsRawInputs = undefined;
     // Clean up any leftover bwrap mount points. Force past the
     // active-sandbox counter — reset() means the session is over.
     cleanupBwrapMountPoints({ force: true });
@@ -951,6 +1389,13 @@ async function reset() {
     if (mitmCA) {
         closePromises.push(disposeMitmCA(mitmCA));
     }
+    if (muxProxyServer) {
+        closePromises.push(muxProxyServer.close().catch((error) => {
+            logForDebugging(`Error closing mux proxy server: ${error.message}`, {
+                level: 'error',
+            });
+        }));
+    }
     if (httpProxyServer) {
         closePromises.push(forceCloseHttpServer(httpProxyServer));
     }
@@ -965,6 +1410,7 @@ async function reset() {
     // Wait for all servers to close
     await Promise.all(closePromises);
     // Clear references
+    muxProxyServer = undefined;
     httpProxyServer = undefined;
     proxyAuthToken = undefined;
     socksProxyServer = undefined;
@@ -972,6 +1418,8 @@ async function reset() {
     initializationPromise = undefined;
     parentProxy = undefined;
     mitmCA = undefined;
+    sentinelRegistry.clear();
+    maskedFileStore.dispose();
 }
 function getSandboxViolationStore() {
     return sandboxViolationStore;
@@ -1002,7 +1450,7 @@ function annotateStderrWithSandboxFailures(command, stderr) {
 function getLinuxGlobPatternWarnings() {
     // Only warn on Linux/WSL (bubblewrap doesn't support globs)
     // macOS supports glob patterns via regex conversion
-    if (getPlatform() !== 'linux' || !config) {
+    if (getPlatform() !== 'linux' || !config || config.filesystem.disabled) {
         return [];
     }
     const globPatterns = [];
@@ -1053,6 +1501,8 @@ export const SandboxManager = {
     cleanupAfterCommand,
     reset,
     getMitmCA: () => mitmCA,
+    getSentinelRegistry: () => sentinelRegistry,
+    getMaskedFileStore: () => maskedFileStore,
     getSandboxViolationStore,
     annotateStderrWithSandboxFailures,
     getLinuxGlobPatternWarnings,