@sysid/sandbox-runtime-improved 0.0.56-sysid.1 → 0.0.61-sysid.1

package/dist/sandbox/windows-sandbox-utils.js

@@ -3,7 +3,10 @@ import * as path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { logForDebugging } from '../utils/debug.js';
-import { generateProxyEnvVars } from './sandbox-utils.js';
+import { containsGlobCharsWin, expandGlobPattern, generateProxyEnvVars, normalizePathForSandbox, } from './sandbox-utils.js';
+// Re-export so existing tests (glob-expand.test.ts) and any
+// out-of-tree caller keep their import path.
+export { containsGlobCharsWin, stripExtendedPathPrefix, } from './sandbox-utils.js';
 /**
  * Windows sandbox backend.
  *
@@ -19,7 +22,12 @@ import { generateProxyEnvVars } from './sandbox-utils.js';
  * token-membership check; WFP via providerData-tag enumeration under
  * the configured sublayer). There is no marker file.
  *
- * Filesystem restrictions are NOT enforced on Windows yet.
+ * Filesystem deny (`denyRead`/`denyWrite`) is enforced via
+ * `srt-win acl stamp` at session start: a broker-only DACL is
+ * applied to each listed file plus a `Modify`-minus-`FILE_DELETE_CHILD`
+ * allow-list on its immediate parent directory, with restore state
+ * sealed by an inert hash-ACE marker so the on-disk SD is
+ * self-authenticating. See {@link stampWindowsAcl}.
  */
 // ────────────────────────────────────────────────────────────────────
 // Types
@@ -28,6 +36,50 @@ export const DEFAULT_WINDOWS_GROUP_NAME = 'sandbox-runtime-net';
 export const DEFAULT_WINDOWS_PROXY_PORT_RANGE = [
     60080, 60089,
 ];
+/**
+ * Adapter from the cross-platform `binShell?: string` surface
+ * ({@link SandboxManager.wrapWithSandboxArgv}) to the Windows
+ * discriminated union. Throws on any value outside the recognised
+ * set — there is no silent fallback to cmd.exe.
+ *
+ * Uses `path.win32` explicitly so the function (and its unit test)
+ * is platform-independent.
+ */
+export function parseWindowsBinShell(raw) {
+    if (raw === undefined)
+        return { kind: 'cmd' };
+    // bash/sh: path semantics — match on basename, keep the caller's
+    // absolute path verbatim.
+    const base = path.win32.basename(raw).toLowerCase();
+    if (base === 'bash' ||
+        base === 'bash.exe' ||
+        base === 'sh' ||
+        base === 'sh.exe') {
+        if (!path.win32.isAbsolute(raw)) {
+            throw new Error(`binShell bash path must be absolute (got ${JSON.stringify(raw)}); ` +
+                `pass the resolved Git Bash install path`);
+        }
+        return { kind: 'bash', path: raw };
+    }
+    // cmd/powershell/pwsh: token semantics — match on the FULL string,
+    // not basename, so an absolute path to pwsh.exe (whose path we'd
+    // otherwise discard) falls through to the explicit throw rather
+    // than silently degrading to a PATH lookup.
+    switch (raw.toLowerCase()) {
+        case 'pwsh':
+        case 'pwsh.exe':
+            return { kind: 'pwsh' };
+        case 'powershell':
+        case 'powershell.exe':
+            return { kind: 'powershell' };
+        case 'cmd':
+        case 'cmd.exe':
+            return { kind: 'cmd' };
+        default:
+            throw new Error(`unrecognised binShell ${JSON.stringify(raw)}: expected ` +
+                `'cmd' | 'powershell' | 'pwsh' or an absolute path to bash.exe/sh.exe`);
+    }
+}
 // ────────────────────────────────────────────────────────────────────
 // Binary resolution
 // ────────────────────────────────────────────────────────────────────
@@ -36,12 +88,20 @@ function repoRoot() {
     const here = path.dirname(fileURLToPath(import.meta.url));
     return path.resolve(here, '..', '..');
 }
+const nodeArchToDir = { x64: 'x64', arm64: 'arm64' };
 /**
  * Locate `srt-win.exe`. Resolution order:
  *   1. `SRT_WIN_PATH` env var (CI sets this to the freshly-built binary).
- *   2. `<repo>/vendor/srt-win/target/release/srt-win.exe` (local cargo build).
- *   3. `<repo>/dist/vendor/srt-win/target/release/srt-win.exe`
- *      (post-`npm run build` shape, when running from compiled output).
+ *   2. `<root>/vendor/srt-win/{arch}/srt-win.exe` (prebuilt — published npm
+ *      package, or after `npm run build:srt-win` locally).
+ *   3. `<root>/vendor/srt-win-src/target/release/srt-win.exe` (local
+ *      `cargo build --release` fallback for development).
+ *   4. `<root>/vendor/srt-win/target/release/srt-win.exe` (transitional:
+ *      stale local build from before the srt-win-src rename).
+ *
+ * `<root>` is {@link repoRoot} — `__dirname/../..`, which resolves to the
+ * repo root from `src/sandbox/` and `dist/sandbox/` alike, and to the
+ * package root when installed under `node_modules`.
  *
  * Resolution via the optional `@anthropic-ai/sandbox-runtime-win32-*`
  * platform packages is added separately.
@@ -54,16 +114,20 @@ export function getSrtWinPath() {
         return envPath;
     }
     const root = repoRoot();
-    const candidates = [
-        path.join(root, 'vendor', 'srt-win', 'target', 'release', 'srt-win.exe'),
-        path.join(root, 'dist', 'vendor', 'srt-win', 'target', 'release', 'srt-win.exe'),
-    ];
+    const arch = nodeArchToDir[process.arch];
+    const candidates = [];
+    if (arch) {
+        candidates.push(path.join(root, 'vendor', 'srt-win', arch, 'srt-win.exe'));
+    }
+    candidates.push(path.join(root, 'vendor', 'srt-win-src', 'target', 'release', 'srt-win.exe'), 
+    // transitional: stale local build from before the srt-win-src rename
+    path.join(root, 'vendor', 'srt-win', 'target', 'release', 'srt-win.exe'));
     for (const c of candidates) {
         if (fs.existsSync(c))
             return c;
     }
     throw new Error(`srt-win.exe not found. Set SRT_WIN_PATH or build with ` +
-        `\`cargo build --release --manifest-path vendor/srt-win/Cargo.toml\`. ` +
+        `\`cargo build --release --manifest-path vendor/srt-win-src/Cargo.toml\`. ` +
         `Looked in: ${[envPath, ...candidates].filter(Boolean).join(', ')}`);
 }
 // ────────────────────────────────────────────────────────────────────
@@ -74,9 +138,13 @@ function groupRefArgs(ref) {
         return ['--group-sid', ref.groupSid];
     return ['--name', ref.groupName ?? DEFAULT_WINDOWS_GROUP_NAME];
 }
-function runSrtWin(args) {
+function runSrtWin(args, stdin, timeoutMs = 15000) {
     const exe = getSrtWinPath();
-    const r = spawnSync(exe, args, { encoding: 'utf8', timeout: 15000 });
+    const r = spawnSync(exe, args, {
+        encoding: 'utf8',
+        timeout: timeoutMs,
+        ...(stdin !== undefined && { input: stdin }),
+    });
     if (r.error) {
         throw new Error(`srt-win ${args[0]}: spawn failed: ${r.error.message}`);
     }
@@ -86,20 +154,29 @@ function runSrtWin(args) {
         stderr: (r.stderr ?? '').trim(),
     };
 }
-function runSrtWinJson(args) {
-    const r = runSrtWin(args);
-    if (r.status !== 0) {
-        throw new Error(`srt-win ${args.join(' ')} exited ${r.status}: ${r.stderr || r.stdout}`);
-    }
-    // Status subcommands print exactly one line of JSON to stdout. stderr
-    // may carry `srt-win:` diagnostics — ignore it for parsing.
+function runSrtWinJson(args, opts) {
+    const r = runSrtWin(args, undefined, opts?.timeoutMs);
+    // Parse stdout BEFORE the exit-code check so `allowNonZero`
+    // can hand back the JSON on exit≠0. JSON.parse never returns
+    // `undefined`, so `json !== undefined` ⇔ parse succeeded.
+    let json;
+    let parseErr;
     try {
-        return JSON.parse(r.stdout);
+        json = JSON.parse(r.stdout);
     }
     catch (e) {
-        throw new Error(`srt-win ${args.join(' ')}: unparseable JSON output ` +
-            `${JSON.stringify(r.stdout)}: ${e.message}`);
+        parseErr = e.message;
+    }
+    if (opts?.allowNonZero && json !== undefined) {
+        return { ok: r.status === 0, json, stderr: r.stderr };
     }
+    if (r.status !== 0) {
+        throw new Error(`srt-win ${args.join(' ')} exited ${r.status}: ${r.stderr || r.stdout}`);
+    }
+    if (json !== undefined)
+        return json;
+    throw new Error(`srt-win ${args.join(' ')}: unparseable JSON output ` +
+        `${JSON.stringify(r.stdout)}: ${parseErr}`);
 }
 // ────────────────────────────────────────────────────────────────────
 // Status / install API
@@ -129,8 +206,83 @@ export function getWindowsWfpStatus(opts = {}) {
         state: raw.state,
         filters: raw.filters,
         ...(raw.port_range && { portRange: raw.port_range }),
+        userFilters: raw.user_filters ?? 0,
+        ...(raw.user_sid && { userSid: raw.user_sid }),
     };
 }
+/**
+ * Query the sandbox user account's provisioning state. Each field
+ * is independently observed so a half-provisioned install (e.g.
+ * user exists but credential file missing) is distinguishable.
+ * Does not require elevation.
+ */
+export function getWindowsSandboxUserStatus() {
+    const raw = runSrtWinJson(['user', 'status']);
+    return {
+        provisioned: raw.user.exists,
+        ...(raw.user.sid && { sid: raw.user.sid }),
+        groupExists: raw.user.group_exists,
+        ...(raw.user.group_sid && { groupSid: raw.user.group_sid }),
+        inBuiltinUsers: raw.user.in_builtin_users,
+        inSandboxGroup: raw.user.in_sandbox_group,
+        hiddenFromLogon: raw.user.hidden_from_logon,
+        credPresent: raw.cred_present,
+        ...(typeof raw.marker_version === 'number' && {
+            markerVersion: raw.marker_version,
+        }),
+        ...(raw.ca_cert_thumb && { caCertThumb: raw.ca_cert_thumb }),
+        ...(raw.ca_cert_pem && { caCertPem: raw.ca_cert_pem }),
+    };
+}
+/**
+ * Read back the persistent MITM CA the sandbox was installed with
+ * (via `srt-win user trust-ca` / {@link windowsTrustCa}).
+ * Returns `null` when no CA was installed. The PEM is what `srt-win
+ * user status` reconstructs from the DER stored in `state.db`.
+ *
+ * On Windows with `windows.asSandboxUser`, `tlsTerminate` requires
+ * this CA to be present in the sandbox user's `CurrentUser\Root`
+ * (schannel-level trust is an install-time concern, not
+ * per-session); the host calls this from `initialize()` to fail
+ * early with an actionable message when it isn't.
+ *
+ * @param status pass an already-fetched
+ *   {@link getWindowsSandboxUserStatus} result to avoid a second
+ *   `srt-win user status` spawn.
+ */
+export function getWindowsSandboxCaCert(status) {
+    const u = status ?? getWindowsSandboxUserStatus();
+    if (!u.caCertThumb || !u.caCertPem)
+        return null;
+    return { pem: u.caCertPem, thumb: u.caCertThumb };
+}
+/**
+ * Install (or replace) the MITM CA in the **sandbox user's**
+ * `CurrentUser\Root` and record it in `state.db` (so
+ * {@link getWindowsSandboxCaCert} surfaces its thumbprint + PEM).
+ * Thin wrapper around `srt-win user trust-ca <path>`. Does NOT
+ * require elevation. Persistent until {@link uninstallWindowsSandbox}
+ * deletes the sandbox user's profile.
+ *
+ * The CA has a separate lifecycle from {@link installWindowsSandbox}
+ * — install provisions the account/filters and never touches the CA;
+ * call this AFTER install when `tlsTerminate` will be used with
+ * `windows.asSandboxUser`.
+ *
+ * @throws when the sandbox user is not provisioned, the file is not a
+ *   parseable X.509 certificate, or the registry write into the
+ *   sandbox user's hive fails.
+ */
+export function windowsTrustCa(caCertPath) {
+    // 60s: first call may create the sandbox user's profile
+    // (LOGON_WITH_PROFILE) via the one-shot CreateProcessWithLogonW.
+    const r = runSrtWin(['user', 'trust-ca', caCertPath], undefined, 60000);
+    logForDebugging(`[Sandbox Windows] user trust-ca exit=${r.status}: ${r.stderr || r.stdout}`);
+    if (r.status !== 0) {
+        throw new Error(`srt-win user trust-ca '${caCertPath}' failed (exit ` +
+            `${r.status}): ${r.stderr || r.stdout}`);
+    }
+}
 /**
  * One-shot install: creates the discriminator group, adds the
  * current user (or `userSid`), and installs the machine-wide WFP
@@ -164,7 +316,7 @@ export function installWindowsSandbox(opts = {}) {
     }
     if (opts.force)
         args.push('--force');
-    const r = runSrtWin(args);
+    const r = runSrtWin(args, undefined, 60000);
     logForDebugging(`[Sandbox Windows] install exit=${r.status}: ${r.stderr || r.stdout}`);
     // srt-win install exit-code contract:
     //   0  ok
@@ -172,6 +324,7 @@ export function installWindowsSandbox(opts = {}) {
     //   11 group create failed
     //   12 WFP install failed
     //   13 already installed with different config (use --force)
+    //   14 sandbox-user provisioning failed
     //   1  other error (stderr has detail)
     const out = r.stderr || r.stdout;
     switch (r.status) {
@@ -181,12 +334,15 @@ export function installWindowsSandbox(opts = {}) {
             return {
                 group: getWindowsGroupStatus(opts),
                 wfp: getWindowsWfpStatus({ sublayerGuid: opts.sublayerGuid }),
+                user: getWindowsSandboxUserStatus(),
                 cancelled: true,
             };
         case 11:
             throw new Error(`srt-win install: group create failed: ${out}`);
         case 12:
             throw new Error(`srt-win install: WFP filter install failed: ${out}`);
+        case 14:
+            throw new Error(`srt-win install: sandbox user provisioning failed: ${out}`);
         case 13:
             throw new Error(`srt-win install: filters already exist under this sublayer with ` +
                 `different configuration (group SID or port range). ` +
@@ -198,6 +354,7 @@ export function installWindowsSandbox(opts = {}) {
     return {
         group: getWindowsGroupStatus(opts),
         wfp: getWindowsWfpStatus({ sublayerGuid: opts.sublayerGuid }),
+        user: getWindowsSandboxUserStatus(),
     };
 }
 /**
@@ -209,12 +366,19 @@ export function installWindowsSandbox(opts = {}) {
  * re-do the logout dance on the next install. Call
  * {@link deleteWindowsGroup} explicitly if you want full teardown.
  *
+ * **Does** remove the `srt-sandbox` account, its credential file,
+ * and the setup marker, unless `keepUser` is set — the credential
+ * is useless without the account and vice versa, so they're
+ * treated as one unit.
+ *
  * @returns `{cancelled: true}` if the user dismissed UAC.
  */
 export function uninstallWindowsSandbox(opts = {}) {
     const args = ['uninstall'];
     if (opts.sublayerGuid)
         args.push('--sublayer-guid', opts.sublayerGuid);
+    if (opts.keepUser)
+        args.push('--keep-user');
     const r = runSrtWin(args);
     logForDebugging(`[Sandbox Windows] uninstall exit=${r.status}: ${r.stderr || r.stdout}`);
     if (r.status === 10)
@@ -280,6 +444,136 @@ export function createWindowsWfp(ref) {
     }
     logForDebugging(`[Sandbox Windows] wfp install: ${r.stderr || r.stdout}`);
 }
+/**
+ * Expand the `denyRead`/`denyWrite` input set to a flat list of
+ * existing FILE paths for `srt-win acl stamp`.
+ *
+ * Every input goes through {@link normalizePathForSandbox} (the
+ * single Windows-aware chokepoint: `\\?\`/UNC-strip, drive-letter
+ * case-fold, ~-expand, realpath). Globs (`*`/`?` only — `[`/`]`
+ * are legal Win32 filename chars) expand via the shared walker
+ * with case-insensitive matching (point-in-time: a file appearing
+ * after this returns is NOT covered). Each candidate is checked
+ * with one `statSync({throwIfNoEntry:false})`: missing → drop
+ * (the protection model covers files present at session start);
+ * directory → reject (the file stamp applies a per-file DACL plus
+ * a per-parent-directory allow-list; stamping a directory itself
+ * would touch every child); file → keep.
+ */
+export function expandWindowsFsDenyPaths(patterns) {
+    const out = new Set();
+    for (const raw of patterns) {
+        const norm = normalizePathForSandbox(raw);
+        const candidates = containsGlobCharsWin(norm)
+            ? expandGlobPattern(norm, { caseInsensitive: true })
+            : [norm];
+        for (const c of candidates) {
+            const st = fs.statSync(c, { throwIfNoEntry: false });
+            if (!st)
+                continue;
+            if (st.isDirectory()) {
+                throw new Error(`Windows fs deny requires explicit file paths; ` +
+                    `${JSON.stringify(raw)} resolved to directory ` +
+                    `${JSON.stringify(c)}. Directory targets are not supported.`);
+            }
+            out.add(c);
+        }
+    }
+    return [...out];
+}
+/**
+ * Apply the file-deny stamp set for one host session. Idempotent
+ * via `srt-win`'s disk-first `ensure_stamped` chokepoint — calling
+ * this again with overlapping paths re-verifies the on-disk DACL
+ * against the hash-ACE marker rather than trusting state-DB rows.
+ *
+ * Inputs are passed verbatim to `srt-win` (which canonicalizes,
+ * rejects directories and globs, and stamps each file plus its
+ * immediate parent directory). Callers that accept globs should
+ * pre-expand via {@link expandWindowsFsDenyPaths}.
+ *
+ * @throws on exit ≠ 0 — including exit 2 (one or more inputs
+ *   skipped). srt-win stamps the resolvable inputs before exiting
+ *   2, so on throw the caller should call {@link restoreWindowsAcl}
+ *   to release whatever WAS stamped (fail-closed at session start
+ *   means tearing down a partial setup).
+ */
+export function stampWindowsAcl(opts) {
+    const holder = opts.holderPid ?? process.pid;
+    const stdin = JSON.stringify({
+        denyRead: opts.denyRead,
+        denyWrite: opts.denyWrite,
+    });
+    const r = runSrtWin(['acl', 'stamp', ...groupRefArgs(opts.group), '--holder-pid', `${holder}`], stdin, 60000);
+    logForDebugging(`[Sandbox Windows] acl stamp exit=${r.status}: ${r.stderr || r.stdout}`);
+    if (r.status !== 0) {
+        // exit 2 = partial (some inputs skipped); exit 1 = at least
+        // one path could not be stamped. Either is a setup failure.
+        throw new Error(`srt-win acl stamp exited ${r.status} ` +
+            (r.status === 2 ? '(partial — some inputs skipped)' : '(failed)') +
+            `: ${r.stderr || r.stdout}`);
+    }
+}
+/**
+ * Release this holder's file-deny stamps and return per-path /
+ * per-parent outcomes. Best-effort: a non-`restored` entry means
+ * the file's stamp was LEFT in place (fail-closed) — see
+ * {@link WindowsAclPathOutcome} for the cases. Does not throw on
+ * anomalies; the caller decides whether to surface them.
+ *
+ * Returns `undefined` when `srt-win acl restore` itself failed
+ * (no JSON to parse) — the caller should log and move on rather
+ * than block teardown.
+ */
+export function restoreWindowsAcl(opts) {
+    const holder = opts.holderPid ?? process.pid;
+    const args = [
+        'acl',
+        'restore',
+        ...groupRefArgs(opts.group),
+        '--holder-pid',
+        `${holder}`,
+        '--json',
+    ];
+    // Don't let a teardown helper throw — the caller's reset() must
+    // complete. runSrtWinJson parses stdout before checking the
+    // exit code, so a non-zero exit with the per-path JSON intact
+    // (`acl restore` prints outcomes THEN errors when any path
+    // stayed stamped) still surfaces every entry to reset()'s loop
+    // instead of collapsing to `undefined`. Only spawn-fail /
+    // unparseable output throws → log and return undefined.
+    try {
+        const r = runSrtWinJson(args, {
+            timeoutMs: 60000,
+            allowNonZero: true,
+        });
+        if (!r.ok) {
+            logForDebugging(`[Sandbox Windows] acl restore exited non-zero (per-path ` +
+                `outcomes preserved): ${r.stderr}`, { level: 'error' });
+        }
+        return r.json;
+    }
+    catch (e) {
+        logForDebugging(`[Sandbox Windows] acl restore: ${e.message}`, {
+            level: 'error',
+        });
+        return undefined;
+    }
+}
+/**
+ * Per-path outcomes that mean the file's DACL was returned to its
+ * pre-stamp state (or was already there). Anything else left the
+ * stamp in place and should be surfaced to the user.
+ */
+export const WINDOWS_ACL_PATH_OK = new Set([
+    'restored',
+]);
+/**
+ * Per-parent-directory outcomes that are expected during normal
+ * teardown. `stillHeld` is normal when another active session
+ * still references a file under this directory.
+ */
+export const WINDOWS_ACL_PARENT_OK = new Set(['restored', 'alreadyOriginal', 'stillHeld']);
 // ────────────────────────────────────────────────────────────────────
 // Wrap
 // ────────────────────────────────────────────────────────────────────
@@ -290,7 +584,7 @@ export function createWindowsWfp(ref) {
  * Caller MUST spawn the result with `{shell: false}` — that is the
  * security boundary that keeps untrusted bytes off the host's shell
  * (the inner `cmd.exe /c` runs INSIDE the sandbox; see
- * `vendor/srt-win/src/launch.rs` `build_cmdline` for the passthrough
+ * `vendor/srt-win-src/src/launch.rs` `build_cmdline` for the passthrough
  * rationale) — AND with the returned `env`.
  *
  * Proxy configuration is single-sourced by {@link generateProxyEnvVars}
@@ -302,30 +596,128 @@ export function createWindowsWfp(ref) {
  */
 export function wrapCommandWithSandboxWindows(p) {
     const exe = getSrtWinPath();
-    const argv = [exe, 'exec', ...groupRefArgs(p.group)];
-    argv.push('--');
-    const systemRoot = process.env.SystemRoot ?? 'C:\\Windows';
-    const shell = (p.binShell ?? 'cmd').toLowerCase();
-    if (shell === 'pwsh' || shell.includes('powershell')) {
-        const psExe = shell === 'pwsh'
-            ? 'pwsh.exe'
-            : path.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
-        argv.push(psExe, '-NoProfile', '-Command', p.command);
-    }
-    else {
-        // cmd /d (no AutoRun) /s (strip first+last quote of post-/c by
-        // position) /c (run-then-exit). The `command` string lands as a
-        // single argv element; srt-win's build_cmdline wraps it in one
-        // outer "…" pair for /s to consume. See launch.rs.
-        argv.push(path.join(systemRoot, 'System32', 'cmd.exe'), '/d', '/s', '/c', p.command);
-    }
-    // Generated proxy vars override any inherited ones so the child
-    // always routes through this sandbox's proxies.
-    const generated = envListToObject(generateProxyEnvVars(p.httpProxyPort, p.socksProxyPort, undefined, p.proxyAuthToken));
+    // Generated proxy + CA-trust env. Single-sourced here so the
+    // same object feeds (a) the spawn env merge below and (b) the
+    // explicit `--env` overlay for the two-hop launch.
+    //
+    // Under `asSandboxUser` the CA-bundle path is OMITTED: it points
+    // into the broker's `%TEMP%\srt-sandbox-…`, which the
+    // `srt-sandbox` user cannot read — OpenSSL-backed clients (msys2
+    // curl, `git -c http.sslBackend=openssl`, node, python) would
+    // fail to open it (curl exit 77 etc.). Schannel-level trust comes
+    // from the registry write `srt-win user trust-ca` did at install
+    // time; the env-var bundle layer for the two-hop path lands with
+    // the working-tree/profile-grant work. See WindowsSandboxParams.
+    if (p.asSandboxUser && p.caCertPath !== undefined) {
+        logForDebugging(`[Sandbox Windows] caCertPath '${p.caCertPath}' not forwarded ` +
+            `under asSandboxUser (broker %TEMP% is unreadable by ` +
+            `srt-sandbox); schannel trust via 'srt-win user trust-ca' ` +
+            `is the only CA-trust path for the two-hop launch`);
+    }
+    const generated = envListToObject(generateProxyEnvVars(p.httpProxyPort, p.socksProxyPort, p.asSandboxUser ? undefined : p.caCertPath, p.proxyAuthToken));
     // TMPDIR is a POSIX path meant for the macOS/Linux FS sandbox — it
     // serves no purpose on Windows and breaks msys2 tools (mktemp etc.).
     delete generated.TMPDIR;
-    const env = { ...process.env, ...generated };
+    const argv = [exe, 'exec', ...groupRefArgs(p.group)];
+    // Format-validated at the config boundary
+    // (`WindowsConfigSchema.wfpSublayerGuid: z.string().uuid()`),
+    // and again by clap's GUID parser at the binary boundary; the
+    // outer spawn is `shell:false`, so the value is an argv element,
+    // never shell-interpolated.
+    if (p.sublayerGuid)
+        argv.push('--sublayer-guid', p.sublayerGuid);
+    if (p.holderPid !== undefined) {
+        argv.push('--holder-pid', `${p.holderPid}`);
+    }
+    for (const f of p.denyRead ?? [])
+        argv.push('--deny-read', f);
+    for (const f of p.denyWrite ?? [])
+        argv.push('--deny-write', f);
+    if (p.asSandboxUser) {
+        argv.push('--as-sandbox-user');
+        // The two-hop runner starts with the SANDBOX user's profile env
+        // (USERPROFILE/TEMP isolated) and overlays exactly what we pass
+        // as `--env`. The broker does NOT enumerate its own env — the
+        // overlay is built here from the same single source as the
+        // same-user path's spawn env.
+        const overlay = {
+            PATH: process.env.PATH,
+            PATHEXT: process.env.PATHEXT,
+            ...generated,
+        };
+        for (const [k, v] of Object.entries(overlay)) {
+            if (v !== undefined)
+                argv.push('--env', `${k}=${v}`);
+        }
+    }
+    argv.push('--');
+    const systemRoot = process.env.SystemRoot ?? 'C:\\Windows';
+    const sh = p.binShell ?? { kind: 'cmd' };
+    switch (sh.kind) {
+        case 'bash':
+            // Git Bash: invoke the caller-supplied path directly with
+            // `-c <command>`. `command` is a fully-assembled bash command
+            // string with its own internal quoting; srt-win's `build_cmdline`
+            // takes the generic non-cmd branch and MSVCRT-quotes it as a
+            // SINGLE argv element, so bash receives it intact as argv[2].
+            // TODO: MSYS2 derives POSIX /tmp from Windows TEMP/TMP itself;
+            // revisit whether any extra TEMP/TMP normalisation is needed for
+            // the bash inner shell under the restricted token.
+            argv.push(sh.path, '-c', p.command);
+            break;
+        case 'pwsh':
+            argv.push('pwsh.exe', '-NoProfile', '-Command', p.command);
+            break;
+        case 'powershell':
+            argv.push(path.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe'), '-NoProfile', '-Command', p.command);
+            break;
+        case 'cmd':
+            // cmd /d (no AutoRun) /s (strip first+last quote of post-/c by
+            // position) /c (run-then-exit). The `command` string lands as a
+            // single argv element; srt-win's build_cmdline wraps it in one
+            // outer "…" pair for /s to consume. See launch.rs.
+            argv.push(path.join(systemRoot, 'System32', 'cmd.exe'), '/d', '/s', '/c', p.command);
+            break;
+    }
+    // CreateProcessW's lpCommandLine is capped at 32 767 WCHARs.
+    // Node's `shell:false` spawn builds it by MSVCRT-quoting each
+    // argv element and joining with spaces; the worst-case quote
+    // overhead per element is +2 (wrapping `"`) plus backslash
+    // doubling before embedded quotes (rare in file paths). A
+    // path-count proxy can't see this — 60 long paths overflow
+    // while 200 short ones fit — so estimate the actual command
+    // line and refuse with the same guidance the old count check
+    // gave. ~30 000 leaves headroom for the quote overhead the
+    // estimate doesn't model.
+    const cmdlineEstimate = argv.reduce((n, a) => n + a.length + 3, 0);
+    if (cmdlineEstimate > 30000) {
+        const nDeny = (p.denyRead?.length ?? 0) + (p.denyWrite?.length ?? 0);
+        throw new Error(`Windows sandbox argv is ~${cmdlineEstimate} chars ` +
+            `(CreateProcessW limit is 32 767). ${nDeny} per-exec ` +
+            `file-deny path(s) ride on this argv — move broad globs to ` +
+            `the session-level filesystem.denyRead/denyWrite (passed to ` +
+            `SandboxManager.initialize(), stdin-passed to \`acl stamp\`) ` +
+            `instead, or shorten the command.`);
+    }
+    // Drop/overwrite denied credential env vars from the inherited
+    // environment FIRST. The proxy assignments below must come LAST
+    // so SRT's own proxy plumbing vars survive even if a caller lists
+    // one of them as a denied credential — same precedence as the
+    // macOS/Linux `env -u … VAR=… sandbox-exec` order.
+    //
+    // Windows env is case-insensitive but Node preserves the OS
+    // casing on enumeration, so a `delete baseEnv['SECRET']` would
+    // miss a `Secret` key. Match by uppercased name instead.
+    const baseEnv = { ...process.env };
+    const unsetUpper = new Set((p.unsetEnvVars ?? []).map(k => k.toUpperCase()));
+    for (const k of Object.keys(baseEnv)) {
+        if (unsetUpper.has(k.toUpperCase()))
+            delete baseEnv[k];
+    }
+    Object.assign(baseEnv, p.setEnvVars ?? {});
+    // Generated proxy vars override any inherited (or just-masked)
+    // ones so the child always routes through this sandbox's proxies.
+    const env = { ...baseEnv, ...generated };
     return { argv, env };
 }
 /**