@sysid/sandbox-runtime-improved 0.0.56-sysid.1 → 0.0.64-sysid.1

package/dist/sandbox/sandbox-manager.js

@@ -1,36 +1,73 @@
 import { createHttpProxyServer } from './http-proxy.js';
 import { createSocksProxyServer } from './socks-proxy.js';
-import { createMitmCA, disposeMitmCA } from './mitm-ca.js';
+import { createMuxProxyServer } from './mux-proxy.js';
+import { listenInRange } from './listen-in-range.js';
+import { SentinelRegistry } from './credential-sentinel.js';
+import { MaskedFileStore, buildMaskedFileBinds, } from './credential-mask-files.js';
+import { createMitmCA, CRL_PATH, disposeMitmCA, } from './mitm-ca.js';
 import { logForDebugging } from '../utils/debug.js';
 import { whichSync } from '../utils/which.js';
 import { getPlatform, getWslVersion } from '../utils/platform.js';
 import * as fs from 'fs';
-import { randomBytes } from 'node:crypto';
+import { randomBytes, X509Certificate } from 'node:crypto';
 import { wrapCommandWithSandboxLinux, initializeLinuxNetworkBridge, checkLinuxDependencies, cleanupBwrapMountPoints, } from './linux-sandbox-utils.js';
 import { wrapCommandWithSandboxMacOS, startMacOSSandboxLogMonitor, } from './macos-sandbox-utils.js';
-import { checkWindowsDependencies, wrapCommandWithSandboxWindows, DEFAULT_WINDOWS_GROUP_NAME, DEFAULT_WINDOWS_PROXY_PORT_RANGE, } from './windows-sandbox-utils.js';
+import { startLinuxSandboxViolationMonitor, } from './linux-violation-monitor.js';
+import { checkWindowsDependencies, wrapCommandWithSandboxWindows, parseWindowsBinShell, expandWindowsFsPaths, stampWindowsAcl, restoreWindowsAcl, grantWindowsAcl, revokeWindowsAcl, getWindowsSandboxUserStatus, getWindowsSandboxCaCert, verifyWindowsWfpEgress, resolveSrtWin, DEFAULT_WINDOWS_PROXY_PORT_RANGE, } from './windows-sandbox-utils.js';
 import { getDefaultWritePaths, containsGlobChars, removeTrailingGlobSuffix, expandGlobPattern, ensureSandboxTmpdir, } from './sandbox-utils.js';
 import { SandboxViolationStore } from './sandbox-violation-store.js';
-import { canonicalizeHost, isValidHost, redactUrl, resolveParentProxy, stripBrackets, } from './parent-proxy.js';
-import { isIP } from 'node:net';
+import { canonicalizeHost, isValidHost, redactUrl, resolveParentProxy, } from './parent-proxy.js';
+import { matchesDomainPattern } from './domain-pattern.js';
 import { EOL } from 'node:os';
+import { dirname } from 'node:path';
 // ============================================================================
 // Private Module State
 // ============================================================================
 let config;
 let httpProxyServer;
 let socksProxyServer;
+let muxProxyServer;
 let managerContext;
 let initializationPromise;
 let cleanupRegistered = false;
 let logMonitorShutdown;
+let linuxMonitor;
 let parentProxy;
 let mitmCA;
 // Per-session proxy auth token. Generated at proxy start, exported only into
 // the sandbox child env, checked on every CONNECT/request — so a host process
 // dialing 127.0.0.1:<proxyPort> can't reach the filter callback.
 let proxyAuthToken;
+// Windows: the resolved access set that was actually applied at
+// initialize(). `undefined` means no stamp/grant was applied
+// (gates running `acl restore`/`acl revoke` at reset()).
+let windowsFsStampedSet;
+// The sandbox user SID captured at initialize(). reset() uses this
+// so a config change between init and reset can't strand ACEs
+// under a different SID.
+let windowsFsSbUserSid;
+// The RAW config inputs that produced `windowsFsStampedSet`.
+// updateConfig() compares these (not the resolved set) so it never
+// re-expands globs — see `sameWindowsStampSet`.
+let windowsFsRawInputs;
+// `verifyWindowsWfpEgress()` is once per PROCESS (it spawns a
+// CreateProcessWithLogonW runner; first call may create the sandbox
+// user's profile). The WFP fence is install-scoped, not config- or
+// session-scoped — reset() does NOT clear this, so updateConfig()'s
+// reset+reinit and the test suite's per-test reset() don't re-verify.
+let windowsWfpVerified = false;
+// Resolved once at initialize() (`resolveSrtWin` stats the disk).
+// Captured so wrapWithSandboxArgv/reset() don't re-resolve per call
+// and so reset()'s revoke/restore addresses the SAME binary the
+// grants/stamps were applied with even if `config` mutated between.
+let srtWinSpawn;
 const sandboxViolationStore = new SandboxViolationStore();
+// Per-session sentinel↔real-value map for masked credentials. Lives only in
+// process memory; never written to disk or logged. Cleared on reset().
+const sentinelRegistry = new SentinelRegistry();
+// Temp dir holding the sentinel-content fake files for masked credential
+// files. Created lazily on first masked file; removed on reset().
+const maskedFileStore = new MaskedFileStore();
 // ============================================================================
 // Private Helper Functions (not exported)
 // ============================================================================
@@ -48,26 +85,6 @@ function registerCleanup() {
     process.once('SIGTERM', cleanupHandler);
     cleanupRegistered = true;
 }
-function matchesDomainPattern(hostname, pattern) {
-    const h = hostname.toLowerCase();
-    // Bare '*' is deny-all when it appears in deniedDomains. The schema only
-    // accepts it there (allowedDomains still rejects it as too broad).
-    if (pattern === '*')
-        return true;
-    // Support wildcard patterns like *.example.com. Never apply wildcard
-    // suffix matching to IP literals — an IPv6 zone-ID payload like
-    // `::ffff:1.2.3.4%x.allowed.com` would otherwise pass .endsWith() while
-    // the OS connects to the bare IP. isValidHost already rejects `%`, but
-    // we refuse here too for defence in depth.
-    if (pattern.startsWith('*.')) {
-        if (isIP(stripBrackets(h)))
-            return false;
-        const baseDomain = pattern.substring(2).toLowerCase();
-        return h.endsWith('.' + baseDomain);
-    }
-    // Exact match for non-wildcard patterns
-    return h === pattern.toLowerCase();
-}
 async function filterNetworkRequest(port, host, sandboxAskCallback) {
     if (!config) {
         logForDebugging('No config available, denying network request');
@@ -133,6 +150,24 @@ async function filterNetworkRequest(port, host, sandboxAskCallback) {
  * Returns the socket path if the host matches any MITM domain pattern,
  * otherwise returns undefined.
  */
+/**
+ * Build the header-mutation callback that substitutes sentinel→real for
+ * masked credentials. Returns undefined when no `credentials` block is
+ * configured — wiring the seam at all is unnecessary then.
+ *
+ * Per-host gating happens inside the registry: each sentinel carries its
+ * own injectHosts list and substitutes independently, so credential A's
+ * sentinel cannot be laundered through credential B's allowed host. The
+ * returned closure does not log header values; the registry holds the only
+ * copy of the real value.
+ */
+function buildCredentialInjector() {
+    if (!config?.credentials)
+        return undefined;
+    return (headers, destHost) => {
+        sentinelRegistry.substituteInHeaders(headers, destHost, matchesDomainPattern);
+    };
+}
 function getMitmSocketPath(host) {
     if (!config?.network.mitmProxy) {
         return undefined;
@@ -147,101 +182,82 @@ function getMitmSocketPath(host) {
     return undefined;
 }
 /**
- * Bind `server.listen()` to the first free port in `[lo, hi]`,
- * skipping `EADDRINUSE`. With `range` undefined, binds to ephemeral
- * port 0 (the previous behaviour).
+ * Per-host TLS-termination opt-out from network.tlsTerminate.excludeDomains.
+ * Only consulted by the HTTP proxy when tlsTerminate is enabled; exempted
+ * hosts fall back to the opaque CONNECT tunnel (still allowlist-filtered),
+ * so mTLS / cert-pinning clients can complete their own handshake.
  *
- * Used on Windows: the WFP loopback permit only covers a fixed port
- * range (default 60080–60089), so the JS proxies must bind inside it
- * for the sandboxed child to reach them. On other platforms the
- * sandbox layer (seatbelt rule, namespace+socat) targets whatever
- * port we landed on, so ephemeral is fine.
+ * Matches the canonicalized hostname, like the allow/deny filter
+ * (filterNetworkRequest) — otherwise a spelling the allowlist accepts after
+ * canonicalization (`127.1`, a trailing-dot FQDN) would dodge the exclusion
+ * and get terminated anyway.
  */
-function listenInRange(server, doListen, range, exclude) {
-    return new Promise((resolve, reject) => {
-        const [lo, hi] = range ?? [0, 0];
-        let port = lo;
-        const tryNext = () => {
-            while (exclude.has(port) && port <= hi)
-                port++;
-            if (port > hi) {
-                reject(new Error(`No free port in range ${lo}-${hi} (excluding ${[...exclude].join(',')})`));
-                return;
-            }
-            const onListening = () => {
-                server.removeListener('error', onError);
-                resolve();
-            };
-            const onError = (err) => {
-                // The paired 'listening' once-listener never fired; drop it
-                // so retries don't accumulate stale listeners.
-                server.removeListener('listening', onListening);
-                if (range &&
-                    err?.code === 'EADDRINUSE' &&
-                    port < hi) {
-                    port++;
-                    tryNext();
-                    return;
-                }
-                reject(err ?? new Error('listen error'));
-            };
-            server.once('error', onError);
-            server.once('listening', onListening);
-            doListen(range ? port : 0);
-        };
-        tryNext();
-    });
+function shouldTerminateTLSForHost(host) {
+    const excludeDomains = config?.network.tlsTerminate?.excludeDomains;
+    if (!excludeDomains?.length)
+        return true;
+    const canonicalHost = canonicalizeHost(host) ?? host;
+    for (const pattern of excludeDomains) {
+        if (!matchesDomainPattern(canonicalHost, pattern))
+            continue;
+        logForDebugging(`Host ${host} matches tlsTerminate.excludeDomains pattern ${pattern}; skipping TLS termination`);
+        // Masked-credential substitution only happens on the terminated path,
+        // so a credential whose injectHosts cover this host can never be
+        // injected here — the upstream gets the placeholder. Config validation
+        // rejects the fully-contradictory spellings; this flags the partial
+        // ones (e.g. default injectHosts = allowedDomains) at the moment they
+        // actually bite.
+        const masked = sentinelRegistry.namesInjectableAt(canonicalHost, matchesDomainPattern);
+        if (masked.length > 0) {
+            logForDebugging(`tlsTerminate.excludeDomains: masked credential(s) ${masked.join(', ')} ` +
+                `are configured for injection at ${host}, but its connections are ` +
+                `not terminated, so the upstream will receive the placeholder`, { level: 'error' });
+        }
+        return false;
+    }
+    return true;
 }
-async function startHttpProxyServer(sandboxAskCallback, portRange, excludePorts) {
+async function startMuxProxyServer(sandboxAskCallback, portRange) {
+    const injectCredentials = buildCredentialInjector();
     httpProxyServer = createHttpProxyServer({
         filter: (port, host) => filterNetworkRequest(port, host, sandboxAskCallback),
         getMitmSocketPath,
         mitmCA,
+        shouldTerminateTLS: shouldTerminateTLSForHost,
         filterRequest: config?.network.filterRequest,
+        // TLS-terminated path always gets the injector; the plain-HTTP path
+        // only when explicitly opted in. Without the opt-in, a sentinel sent
+        // over plain HTTP reaches the upstream unchanged (fails closed).
+        mutateHeaders: injectCredentials,
+        mutateHeadersPlaintext: config?.credentials?.allowPlaintextInject
+            ? injectCredentials
+            : undefined,
         parentProxy,
         proxyAuthToken,
     });
-    const server = httpProxyServer;
-    await listenInRange(server, p => server.listen(p, '127.0.0.1'), portRange, excludePorts);
-    const address = server.address();
-    if (!address || typeof address !== 'object') {
-        throw new Error('Failed to get HTTP proxy server address');
-    }
-    server.unref();
-    logForDebugging(`HTTP proxy listening on localhost:${address.port}`);
-    return address.port;
-}
-async function startSocksProxyServer(sandboxAskCallback, portRange, excludePorts) {
     socksProxyServer = createSocksProxyServer({
         filter: (port, host) => filterNetworkRequest(port, host, sandboxAskCallback),
         parentProxy,
         proxyAuthToken,
     });
-    const wrapper = socksProxyServer;
-    // SocksProxyWrapper.listen() resolves with the bound port; we
-    // adapt it to the listenInRange shape by retrying on EADDRINUSE
-    // here directly rather than via the once('error') path.
-    if (!portRange) {
-        const port = await wrapper.listen(0, '127.0.0.1');
-        wrapper.unref();
-        return port;
-    }
-    let lastErr;
-    for (let p = portRange[0]; p <= portRange[1]; p++) {
-        if (excludePorts.has(p))
-            continue;
-        try {
-            const port = await wrapper.listen(p, '127.0.0.1');
-            wrapper.unref();
-            return port;
-        }
-        catch (err) {
-            lastErr = err;
-            if (err?.code !== 'EADDRINUSE')
-                throw err;
-        }
+    muxProxyServer = createMuxProxyServer({
+        httpServer: httpProxyServer,
+        handleSocksConnection: s => socksProxyServer.handleConnection(s),
+        httpBackendPortRange: portRange,
+    });
+    const mux = muxProxyServer;
+    // Backend first so the front-end never accepts a connection that would
+    // dispatch to an unbound backend. On Windows the backend's port is
+    // excluded when binding the front-end in the same WFP range.
+    const backendPort = await mux.listenHttpBackend();
+    await listenInRange(mux.server, p => mux.server.listen(p, '127.0.0.1'), portRange, backendPort !== undefined ? new Set([backendPort]) : new Set());
+    const muxPort = mux.getPort();
+    if (muxPort === undefined) {
+        throw new Error('Failed to get mux proxy server port');
     }
-    throw new Error(`No free SOCKS port in range ${portRange[0]}-${portRange[1]}: ${lastErr?.message ?? 'all in use'}`);
+    mux.unref();
+    logForDebugging(`Mux proxy (HTTP+SOCKS) listening on localhost:${muxPort}`);
+    return muxPort;
 }
 // ============================================================================
 // Public Module Functions (will be exported via namespace)
@@ -283,8 +299,169 @@ async function initialize(runtimeConfig, sandboxAskCallback, enableLogMonitor =
         logMonitorShutdown = startMacOSSandboxLogMonitor(sandboxViolationStore.addViolation.bind(sandboxViolationStore), config.ignoreViolations);
         logForDebugging('Started macOS sandbox log monitor');
     }
+    if (enableLogMonitor && getPlatform() === 'linux') {
+        linuxMonitor = startLinuxSandboxViolationMonitor(sandboxViolationStore.addViolation.bind(sandboxViolationStore), {
+            // apply-seccomp's observer reports every write-intent syscall
+            // (allowed or not). Only paths bwrap would actually refuse — outside
+            // allowWrite or inside a denyWrite carve-out — go to the store.
+            allowWritePaths: [
+                ...getDefaultWritePaths(),
+                ...config.filesystem.allowWrite,
+            ],
+            denyWritePaths: config.filesystem.denyWrite,
+            ignoreViolations: config.ignoreViolations,
+        });
+        // Don't block initialization on listen() — wrap-time checks
+        // fs.existsSync(observeSocketPath) and degrades gracefully.
+        void linuxMonitor.ready;
+        logForDebugging('Started Linux seccomp violation monitor');
+    }
     // Register cleanup handlers first time
     registerCleanup();
+    // Windows: validate provisioning + filesystem config BEFORE any
+    // sandboxed child can be spawned. Doing this at initialize() (not
+    // wrap-time) means the host gets a single actionable error before
+    // any per-exec work happens, instead of exit-15 on every command.
+    if (getPlatform() === 'windows') {
+        // Resolve once (stats disk); captured module-level for wrap/reset.
+        srtWinSpawn = resolveSrtWin(runtimeConfig.windows?.srtWin);
+        const srtWin = srtWinSpawn;
+        const u = getWindowsSandboxUserStatus({ srtWin });
+        if (!u.provisioned || !u.credPresent) {
+            config = undefined;
+            throw new Error(`Windows sandbox user is not provisioned (user=` +
+                `${u.provisioned}, cred=${u.credPresent}). Run \`npx ` +
+                `sandbox-runtime windows-install\` (one UAC prompt) to ` +
+                `provision it.`);
+        }
+        // Behavioral proof the WFP egress fence is active for the
+        // sandbox user — BFE enumeration (`wfp status`) is admin-gated,
+        // so this is the non-elevated readiness check. Fails closed: a
+        // stale install (user provisioned but filters since removed)
+        // throws here instead of running every exec with full egress.
+        // After the user-status check so the not-provisioned message is
+        // the actionable one. Once per process — the fence is install-
+        // scoped, not session-scoped.
+        if (!windowsWfpVerified) {
+            try {
+                await verifyWindowsWfpEgress({
+                    proxyPortRange: runtimeConfig.windows?.proxyPortRange,
+                    srtWin,
+                });
+            }
+            catch (e) {
+                config = undefined;
+                throw e;
+            }
+            windowsWfpVerified = true;
+        }
+        // schannel-level trust under the sandbox user is install-time
+        // (cert lifecycle = sandbox-user lifecycle), not per-session.
+        // System32 curl / IWR / .NET / default-backend git only trust
+        // what's in the sandbox user's `CurrentUser\Root` — which
+        // `srt-win exec` does not (and must not) write. Compare
+        // thumbprints so a stale install-time CA doesn't pass the gate
+        // while schannel rejects the session's proxy-minted leaves.
+        if (runtimeConfig.network.tlsTerminate && mitmCA) {
+            const installed = getWindowsSandboxCaCert(u);
+            const sessionThumb = new X509Certificate(mitmCA.certPem).fingerprint
+                .replace(/:/g, '')
+                .toUpperCase();
+            if (!installed) {
+                config = undefined;
+                throw new Error(`tlsTerminate on Windows requires the sandbox to be ` +
+                    `installed with this CA (thumb=${sessionThumb}): run ` +
+                    `\`srt-win user trust-ca ${mitmCA.certPath}\`. Per-exec ` +
+                    `installs into the sandbox user's Root store are not ` +
+                    `supported.`);
+            }
+            if (installed.thumb !== sessionThumb) {
+                config = undefined;
+                throw new Error(`tlsTerminate on Windows: the sandbox's installed CA ` +
+                    `(thumb=${installed.thumb}) doesn't match this ` +
+                    `session's CA (thumb=${sessionThumb}). Run \`srt-win ` +
+                    `user trust-ca ${mitmCA.certPath}\` to update it.`);
+            }
+        }
+        // Filesystem grants/denies — additive sandbox-user ACEs.
+        try {
+            const acc = computeWindowsFsAccessSet(runtimeConfig);
+            // The trust bundle the CA-trust env vars point at
+            // (NODE_EXTRA_CA_CERTS etc.) must be readable by the
+            // srt-sandbox child. It's written into the broker's %TEMP%,
+            // which the sandbox user has no inherent rights on, so it
+            // rides the same session-level `acl grant` read-set as the
+            // working tree. Granted on the mkdtemp DIR (not the file)
+            // so the (OI)(CI) ACE covers both the file open AND the
+            // parent-directory list that cmd's `type`/`FindFirstFile`
+            // does before opening. Mirrors the mac/linux
+            // `expandedAllowRead` push in wrapWithSandbox.
+            if (mitmCA) {
+                acc.grantRead.push(dirname(mitmCA.trustBundlePath));
+            }
+            // `u` was fetched once above for the provisioning gate; the
+            // same status carries the SID — don't re-spawn `srt-win user
+            // status` here.
+            if (!u.sid) {
+                throw new Error('sandbox user SID missing from `srt-win user status` ' +
+                    '(provisioned but in an inconsistent state)');
+            }
+            const sb = u.sid;
+            // Record module-level state BEFORE the first acl call so the
+            // catch's best-effort revoke/restore can address whatever
+            // partially landed.
+            windowsFsSbUserSid = sb;
+            // Grant FIRST so the sandbox user has working-tree access by
+            // the time the deny stamp runs. The two are independent
+            // refcounted state-DB sets keyed on the same holder PID.
+            if (acc.grantRead.length > 0 || acc.grantWrite.length > 0) {
+                grantWindowsAcl({
+                    sandboxUserSid: sb,
+                    read: acc.grantRead,
+                    write: acc.grantWrite,
+                    srtWin,
+                });
+            }
+            if (acc.denyRead.length > 0 || acc.denyWrite.length > 0) {
+                stampWindowsAcl({
+                    sandboxUserSid: sb,
+                    denyRead: acc.denyRead,
+                    denyWrite: acc.denyWrite,
+                    srtWin,
+                });
+            }
+            // Only record when something was actually applied — gates
+            // running revoke/restore at reset(). Recorded AFTER success —
+            // the catch below clears `config`, and a non-undefined
+            // stampedSet would leave reset()/updateConfig() seeing state
+            // that never landed.
+            const anyApplied = acc.grantRead.length > 0 ||
+                acc.grantWrite.length > 0 ||
+                acc.denyRead.length > 0 ||
+                acc.denyWrite.length > 0;
+            if (anyApplied) {
+                windowsFsStampedSet = acc;
+                logForDebugging(`[Sandbox Windows] fs applied: ` +
+                    `${acc.grantWrite.length} grantWrite, ` +
+                    `${acc.grantRead.length} grantRead, ` +
+                    `${acc.denyRead.length} denyRead, ` +
+                    `${acc.denyWrite.length} denyWrite`);
+            }
+            windowsFsRawInputs = rawWindowsFsInputs(runtimeConfig);
+        }
+        catch (e) {
+            // Best-effort release of whatever WAS applied before the
+            // failure (exit-2 partial stamps/grants the resolvable
+            // inputs; harmless if nothing was — no holds for this PID).
+            if (windowsFsSbUserSid) {
+                revokeWindowsAcl({ sandboxUserSid: windowsFsSbUserSid, srtWin });
+                restoreWindowsAcl({ sandboxUserSid: windowsFsSbUserSid, srtWin });
+            }
+            windowsFsSbUserSid = undefined;
+            config = undefined;
+            throw e;
+        }
+    }
     // Initialize network infrastructure
     initializationPromise = (async () => {
         try {
@@ -302,27 +479,35 @@ async function initialize(runtimeConfig, sandboxAskCallback, enableLogMonitor =
                 config.network.httpProxyPort !== undefined
                     ? undefined
                     : randomBytes(16).toString('hex');
-            let httpProxyPort;
+            // The mux front-end serves both protocols on one port. Each side's
+            // reported port is the external override if configured, else the mux
+            // port — so the public config.network.{http,socks}ProxyPort contract
+            // is unchanged. The mux is skipped only when BOTH are external.
+            const needLocalProxy = config.network.httpProxyPort === undefined ||
+                config.network.socksProxyPort === undefined;
+            const muxPort = needLocalProxy
+                ? await startMuxProxyServer(sandboxAskCallback, portRange)
+                : undefined;
+            const httpProxyPort = config.network.httpProxyPort ?? muxPort;
+            const socksProxyPort = config.network.socksProxyPort ?? muxPort;
+            // Leaves are minted lazily per-CONNECT (after this point), so setting
+            // the CDP URL now means every leaf carries it. See MitmCA.crlUrl.
+            // Windows-only: on Linux the child runs under bwrap --unshare-net and
+            // reaches the proxy via a socat bridge on a fixed netns port, so a
+            // host-namespace mux port would be unreachable — worse than no CDP,
+            // since a Schannel-analog client (Java, OpenSSL with CRL_CHECK) then
+            // hard-fails "CRL fetch error" instead of soft-passing "no CDP". macOS
+            // has no in-tree Schannel-analog client. Also gated on `muxPort`: an
+            // external `network.httpProxyPort` doesn't answer /srt.crl.
+            if (mitmCA && muxPort !== undefined && getPlatform() === 'windows') {
+                mitmCA.crlUrl = `http://127.0.0.1:${muxPort}${CRL_PATH}`;
+            }
             if (config.network.httpProxyPort !== undefined) {
-                // Use external HTTP proxy (don't start a server)
-                httpProxyPort = config.network.httpProxyPort;
                 logForDebugging(`Using external HTTP proxy on port ${httpProxyPort}`);
             }
-            else {
-                // Start local HTTP proxy
-                httpProxyPort = await startHttpProxyServer(sandboxAskCallback, portRange, new Set());
-            }
-            let socksProxyPort;
             if (config.network.socksProxyPort !== undefined) {
-                // Use external SOCKS proxy (don't start a server)
-                socksProxyPort = config.network.socksProxyPort;
                 logForDebugging(`Using external SOCKS proxy on port ${socksProxyPort}`);
             }
-            else {
-                // Start local SOCKS proxy. Skip the port the HTTP proxy
-                // already took.
-                socksProxyPort = await startSocksProxyServer(sandboxAskCallback, portRange, new Set([httpProxyPort]));
-            }
             // Initialize platform-specific infrastructure
             let linuxBridge;
             if (getPlatform() === 'linux') {
@@ -359,16 +544,6 @@ function isSupportedPlatform() {
     }
     return platform === 'macos' || platform === 'windows';
 }
-/**
- * Resolve the Windows group reference from config. Used by both the
- * dependency check and `wrapWithSandbox` so they agree.
- */
-function getWindowsGroupRef() {
-    return {
-        groupName: config?.windows?.groupName ?? DEFAULT_WINDOWS_GROUP_NAME,
-        groupSid: config?.windows?.groupSid,
-    };
-}
 function isSandboxingEnabled() {
     // Sandboxing is enabled if config has been set (via initialize())
     return config !== undefined;
@@ -402,46 +577,110 @@ function checkDependencies(ripgrepConfig) {
         warnings.push(...linuxDeps.warnings);
     }
     else if (platform === 'windows') {
-        const winDeps = checkWindowsDependencies(getWindowsGroupRef(), config?.windows?.wfpSublayerGuid);
+        let srtWin;
+        try {
+            srtWin = resolveSrtWin(config?.windows?.srtWin);
+        }
+        catch (e) {
+            errors.push(e.message);
+            return { errors, warnings };
+        }
+        const winDeps = checkWindowsDependencies({
+            sublayerGuid: config?.windows?.sublayerGuid ?? config?.windows?.wfpSublayerGuid,
+            srtWin,
+        });
         errors.push(...winDeps.errors);
         warnings.push(...winDeps.warnings);
     }
     return { errors, warnings };
 }
 /**
- * Build the read-deny / env-unset sets implied by the `credentials` config.
+ * Build the read-deny / env-unset / env-set maps implied by the
+ * `credentials` config.
  *
  * Only explicitly declared sources are restricted: `mode: 'deny'` file
- * entries join the read-deny set and `mode: 'deny'` env vars are unset.
- * The mode filter keeps the structure ready for future non-deny modes
- * (e.g. masking).
+ * entries join the read-deny set, `mode: 'deny'` env vars are unset, and
+ * `mode: 'mask'` env vars are set to a per-session sentinel registered in
+ * {@link sentinelRegistry}. A masked var with no value in the host
+ * environment is skipped — there is nothing to protect, and emitting an
+ * unset var would change tool behaviour (presence checks would pass where
+ * they didn't before).
  */
-function getCredentialRestrictions(credentials) {
+function getCredentialRestrictions(credentials, allowedDomains) {
     if (!credentials) {
-        return { denyReadPaths: [], unsetEnvVars: [] };
+        return {
+            denyReadPaths: [],
+            unsetEnvVars: [],
+            setEnvVars: {},
+            maskedFileBinds: [],
+            maskedFileStoreDir: undefined,
+        };
     }
+    const denyReadPaths = getCredentialDenyReadPaths(credentials);
+    const unsetEnvVars = [];
+    const setEnvVars = {};
+    for (const v of credentials.envVars ?? []) {
+        if (v.mode === 'deny') {
+            unsetEnvVars.push(v.name);
+        }
+        else if (v.mode === 'mask') {
+            const real = process.env[v.name];
+            if (real === undefined)
+                continue;
+            // Effective injectHosts: per-entry narrows; if unset, default to
+            // every reachable host (network.allowedDomains). injectHosts is an
+            // *optional narrowing*, not a required allowlist. Trade-off: a
+            // masked credential with no injectHosts is injectable at every host
+            // the sandbox can reach — narrow it explicitly when the credential
+            // should only go to a subset.
+            const injectHosts = v.injectHosts ?? allowedDomains ?? [];
+            setEnvVars[v.name] = sentinelRegistry.register(v.name, real, injectHosts);
+        }
+    }
+    // Masked files: read the real bytes on the host, register a sentinel,
+    // write it to a fake file in the manager-owned temp dir. Missing/unreadable
+    // entries are skipped (same posture as an unset masked env var).
+    // degradeToDenyPaths carries paths whose extract pattern matched
+    // nothing with onExtractNoMatch: "deny" — merged into denyReadPaths
+    // below so both the read-deny config and the platform builders see them.
     const files = credentials.files ?? [];
-    const denyReadPaths = files.filter(f => f.mode === 'deny').map(f => f.path);
-    const unsetEnvVars = (credentials.envVars ?? [])
-        .filter(v => v.mode === 'deny')
-        .map(v => v.name);
+    const { binds: maskedFileBinds, degradeToDenyPaths } = buildMaskedFileBinds(files, allowedDomains ?? [], sentinelRegistry, maskedFileStore);
     return {
-        denyReadPaths: [...new Set(denyReadPaths)],
+        denyReadPaths: [...new Set([...denyReadPaths, ...degradeToDenyPaths])],
         unsetEnvVars: [...new Set(unsetEnvVars)],
+        setEnvVars,
+        maskedFileBinds,
+        maskedFileStoreDir: maskedFileStore.dirPath,
     };
 }
+/**
+ * Pure (side-effect-free) chokepoint for credential file-deny
+ * paths — `credentials.files` entries with `mode: 'deny'`. Any
+ * code that needs the credential→denyRead contribution routes
+ * through here so a comparison predicate can read it without
+ * touching {@link sentinelRegistry}.
+ */
+function getCredentialDenyReadPaths(credentials) {
+    const files = credentials?.files ?? [];
+    return [...new Set(files.filter(f => f.mode === 'deny').map(f => f.path))];
+}
+/**
+ * Union the explicit `filesystem.denyRead` with credential-derived
+ * deny paths. The single source of "what files does this config
+ * want read-denied" — all platforms route through here so a new
+ * credential kind that contributes deny paths reaches every
+ * backend.
+ */
+function unionDenyReadPaths(denyRead, credentialRestrictions) {
+    return [...new Set([...denyRead, ...credentialRestrictions.denyReadPaths])];
+}
 function getFsReadConfig() {
-    if (!config) {
+    if (!config || config.filesystem.disabled) {
         return { denyOnly: [], allowWithinDeny: [] };
     }
     // Credential deny paths are unioned with the caller's denyRead — never
     // replacing it — so explicit filesystem restrictions always survive.
-    const rawDenyRead = [
-        ...new Set([
-            ...config.filesystem.denyRead,
-            ...getCredentialRestrictions(config.credentials).denyReadPaths,
-        ]),
-    ];
+    const rawDenyRead = unionDenyReadPaths(config.filesystem.denyRead, getCredentialRestrictions(config.credentials, config.network.allowedDomains));
     const denyPaths = [];
     for (const p of rawDenyRead) {
         const stripped = removeTrailingGlobSuffix(p);
@@ -477,6 +716,9 @@ function getFsWriteConfig() {
     if (!config) {
         return { allowOnly: getDefaultWritePaths(), denyWithinAllow: [] };
     }
+    if (config.filesystem.disabled) {
+        return { allowOnly: ['/'], denyWithinAllow: [] };
+    }
     // Filter out glob patterns on Linux/WSL for allowWrite (bubblewrap doesn't support globs)
     const allowPaths = config.filesystem.allowWrite
         .map(path => removeTrailingGlobSuffix(path))
@@ -504,6 +746,94 @@ function getFsWriteConfig() {
         denyWithinAllow: denyPaths,
     };
 }
+/**
+ * Build the Windows file-access set (deny stamps + sandbox-user
+ * grants) from `runtimeConfig`. Globs are expanded to concrete
+ * paths (point-in-time — a path appearing after this returns is NOT
+ * covered). Directory targets are accepted (the `(OI)(CI)` ACEs
+ * cover the subtree).
+ *
+ * The sandbox user has no inherent rights on real-user-owned files,
+ * so `allowWrite` (the working-tree roots) becomes a per-session
+ * `MODIFY_NO_FDC` ALLOW ACE for `<sb-SID>`, `allowRead` a
+ * `READ|EXECUTE` ALLOW ACE, and `denyRead`/`denyWrite` become an
+ * explicit DENY ACE for `<sb-SID>` on the target plus a
+ * `(OI)(CI) FILE_DELETE_CHILD` DENY on its parent.
+ */
+function computeWindowsFsAccessSet(c) {
+    const fs = c.filesystem;
+    // filesystem.disabled bypasses ALL filesystem rule generation —
+    // same as the macOS/Linux wrapWithSandbox path (readConfig /
+    // writeConfig left undefined). On Windows this means no ACL
+    // stamp/grant; credential FILE denies are dropped along with the
+    // rest (credential ENV: mode:'deny' is structural under the
+    // fresh srt-sandbox env; mode:'mask' sentinels are passed via
+    // the --env overlay).
+    if (fs?.disabled) {
+        return { grantRead: [], grantWrite: [], denyRead: [], denyWrite: [] };
+    }
+    const expand = expandWindowsFsPaths;
+    const denyRead = expand([
+        ...new Set([
+            ...(fs?.denyRead ?? []),
+            ...getCredentialDenyReadPaths(c.credentials),
+        ]),
+    ]);
+    const denyWrite = expand(fs?.denyWrite ?? []);
+    return {
+        // `allowRead` also serves as `allowWithinDeny`: a file under a
+        // denied dir gets an explicit ALLOW ACE for the sandbox user,
+        // and explicit DENY on the parent doesn't override it because
+        // the recompose chokepoint orders deny-before-allow per-path.
+        grantRead: expand(fs?.allowRead ?? []),
+        grantWrite: expand(fs?.allowWrite ?? []),
+        denyRead,
+        denyWrite,
+    };
+}
+/**
+ * Snapshot the raw config fields that feed
+ * {@link computeWindowsFsAccessSet}. Used by updateConfig() to
+ * short-circuit the resolved-set diff (which re-runs glob
+ * expansion) when nothing relevant changed.
+ */
+function rawWindowsFsInputs(c) {
+    // Keyed exactly on what {@link computeWindowsFsAccessSet} reads.
+    // `network.allowedDomains` does NOT feed file-deny (only mask
+    // injectHosts), so a network-only updateConfig hits the cache.
+    return {
+        disabled: c.filesystem.disabled ?? false,
+        denyRead: [...c.filesystem.denyRead],
+        denyWrite: [...c.filesystem.denyWrite],
+        allowRead: [...(c.filesystem.allowRead ?? [])],
+        allowWrite: [...c.filesystem.allowWrite],
+        credFiles: getCredentialDenyReadPaths(c.credentials),
+    };
+}
+function setEq(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const s = new Set(a);
+    return b.every(x => s.has(x));
+}
+function sameRawWindowsFsInputs(a, b) {
+    return (a.disabled === b.disabled &&
+        setEq(a.denyRead, b.denyRead) &&
+        setEq(a.denyWrite, b.denyWrite) &&
+        setEq(a.allowRead, b.allowRead) &&
+        setEq(a.allowWrite, b.allowWrite) &&
+        setEq(a.credFiles, b.credFiles));
+}
+/**
+ * True when `newConfig`'s file-deny inputs match what was
+ * stamped at initialize(). Compares raw inputs only (cheap,
+ * order-insensitive); never re-expands globs — updateConfig is
+ * warn-only on Windows and the resolved set wouldn't be used.
+ */
+function sameWindowsStampSet(newConfig) {
+    return (windowsFsRawInputs !== undefined &&
+        sameRawWindowsFsInputs(windowsFsRawInputs, rawWindowsFsInputs(newConfig)));
+}
 function getNetworkRestrictionConfig() {
     if (!config) {
         return {};
@@ -593,6 +923,22 @@ async function waitForNetworkInitialization() {
 }
 async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
     const platform = getPlatform();
+    // filesystem.disabled bypasses ALL filesystem rule generation. Both
+    // platform wrappers treat readConfig/writeConfig === undefined as "no
+    // filesystem restrictions" (seatbelt emits `(allow file-write*)`; bwrap
+    // skips the `--ro-bind / /` root and all path binds).
+    //
+    // Precedence: when a caller passes a per-call filesystem override at all,
+    // its `disabled` (defaulting to false) wins outright. A global
+    // disabled=true must not silently discard a per-call tightening that
+    // omits the new key.
+    const fsDisabled = customConfig?.filesystem !== undefined
+        ? (customConfig.filesystem.disabled ?? false)
+        : (config?.filesystem.disabled ?? false);
+    // Credential env handling is independent of filesystem policy: unsetEnvVars /
+    // setEnvVars must be applied even when fsDisabled (the credential file
+    // deny-reads are dropped, but env scrubbing still happens).
+    const credentialRestrictions = getCredentialRestrictions(customConfig?.credentials ?? config?.credentials, customConfig?.network?.allowedDomains ?? config?.network?.allowedDomains);
     // Get configs - use custom if provided, otherwise fall back to main config
     // If neither exists, defaults to empty arrays (most restrictive)
     // Always include default system write paths (like /dev/null, /tmp/claude)
@@ -600,63 +946,62 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
     // Strip trailing /** and filter remaining globs on Linux (bwrap needs
     // real paths, not globs; macOS subpath matching is also recursive so
     // stripping is harmless there).
-    const stripWriteGlobs = (paths) => paths
-        .map(p => removeTrailingGlobSuffix(p))
-        .filter(p => {
-        if (getPlatform() === 'linux' && containsGlobChars(p)) {
-            logForDebugging(`[Sandbox] Skipping glob write pattern on Linux: ${p}`);
-            return false;
-        }
-        return true;
-    });
-    const userAllowWrite = stripWriteGlobs(customConfig?.filesystem?.allowWrite ?? config?.filesystem.allowWrite ?? []);
-    const writeConfig = {
-        allowOnly: [...getDefaultWritePaths(), ...userAllowWrite],
-        denyWithinAllow: stripWriteGlobs(customConfig?.filesystem?.denyWrite ?? config?.filesystem.denyWrite ?? []),
-    };
-    // Credential file denies and env unsets derived from the credentials
-    // section. The deny paths are unioned with the caller's denyRead — never
-    // replacing it — so explicit filesystem restrictions always survive.
-    const credentialRestrictions = getCredentialRestrictions(customConfig?.credentials ?? config?.credentials);
-    const rawDenyRead = [
-        ...new Set([
-            ...(customConfig?.filesystem?.denyRead ??
-                config?.filesystem.denyRead ??
+    let writeConfig;
+    let readConfig;
+    if (!fsDisabled) {
+        const stripWriteGlobs = (paths) => paths
+            .map(p => removeTrailingGlobSuffix(p))
+            .filter(p => {
+            if (getPlatform() === 'linux' && containsGlobChars(p)) {
+                logForDebugging(`[Sandbox] Skipping glob write pattern on Linux: ${p}`);
+                return false;
+            }
+            return true;
+        });
+        const userAllowWrite = stripWriteGlobs(customConfig?.filesystem?.allowWrite ??
+            config?.filesystem.allowWrite ??
+            []);
+        writeConfig = {
+            allowOnly: [...getDefaultWritePaths(), ...userAllowWrite],
+            denyWithinAllow: stripWriteGlobs(customConfig?.filesystem?.denyWrite ??
+                config?.filesystem.denyWrite ??
                 []),
-            ...credentialRestrictions.denyReadPaths,
-        ]),
-    ];
-    const expandedDenyRead = [];
-    for (const p of rawDenyRead) {
-        const stripped = removeTrailingGlobSuffix(p);
-        if (getPlatform() === 'linux' && containsGlobChars(stripped)) {
-            expandedDenyRead.push(...expandGlobPattern(p));
-        }
-        else {
-            expandedDenyRead.push(stripped);
+        };
+        // Credential deny paths are unioned with the caller's denyRead — never
+        // replacing it — so explicit filesystem restrictions always survive.
+        const rawDenyRead = unionDenyReadPaths(customConfig?.filesystem?.denyRead ?? config?.filesystem.denyRead ?? [], credentialRestrictions);
+        const expandedDenyRead = [];
+        for (const p of rawDenyRead) {
+            const stripped = removeTrailingGlobSuffix(p);
+            if (getPlatform() === 'linux' && containsGlobChars(stripped)) {
+                expandedDenyRead.push(...expandGlobPattern(p));
+            }
+            else {
+                expandedDenyRead.push(stripped);
+            }
         }
-    }
-    const rawAllowRead = customConfig?.filesystem?.allowRead ?? config?.filesystem.allowRead ?? [];
-    const expandedAllowRead = [];
-    for (const p of rawAllowRead) {
-        const stripped = removeTrailingGlobSuffix(p);
-        if (getPlatform() === 'linux' && containsGlobChars(stripped)) {
-            expandedAllowRead.push(...expandGlobPattern(p));
+        const rawAllowRead = customConfig?.filesystem?.allowRead ?? config?.filesystem.allowRead ?? [];
+        const expandedAllowRead = [];
+        for (const p of rawAllowRead) {
+            const stripped = removeTrailingGlobSuffix(p);
+            if (getPlatform() === 'linux' && containsGlobChars(stripped)) {
+                expandedAllowRead.push(...expandGlobPattern(p));
+            }
+            else {
+                expandedAllowRead.push(stripped);
+            }
         }
-        else {
-            expandedAllowRead.push(stripped);
+        // The TLS-termination CA cert and the trust bundle the env vars point at
+        // (NODE_EXTRA_CA_CERTS etc.) must be readable by the child, even if their
+        // paths fall under a user-configured denyRead.
+        if (mitmCA) {
+            expandedAllowRead.push(mitmCA.certPath, mitmCA.trustBundlePath);
         }
+        readConfig = {
+            denyOnly: expandedDenyRead,
+            allowWithinDeny: expandedAllowRead,
+        };
     }
-    // The TLS-termination CA cert must be readable by the child so the trust
-    // env vars (NODE_EXTRA_CA_CERTS etc.) resolve, even if its path falls
-    // under a user-configured denyRead.
-    if (mitmCA) {
-        expandedAllowRead.push(mitmCA.certPath);
-    }
-    const readConfig = {
-        denyOnly: expandedDenyRead,
-        allowWithinDeny: expandedAllowRead,
-    };
     // Check if network config is specified - this determines if we need network restrictions
     // Network restriction is needed when:
     // 1. customConfig has network.allowedDomains defined (even if empty array = block all)
@@ -690,10 +1035,12 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
                 httpProxyPort: needsNetworkProxy ? getProxyPort() : undefined,
                 socksProxyPort: needsNetworkProxy ? getSocksProxyPort() : undefined,
                 proxyAuthToken: needsNetworkProxy ? proxyAuthToken : undefined,
-                caCertPath: mitmCA?.certPath,
+                caCertPath: mitmCA?.trustBundlePath,
                 readConfig,
                 writeConfig,
                 unsetEnvVars: credentialRestrictions.unsetEnvVars,
+                setEnvVars: credentialRestrictions.setEnvVars,
+                maskedFileBinds: credentialRestrictions.maskedFileBinds,
                 allowUnixSockets: getAllowUnixSockets(),
                 allowAllUnixSockets: getAllowAllUnixSockets(),
                 allowLocalBinding: getAllowLocalBinding(),
@@ -724,10 +1071,13 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
                     ? managerContext?.socksProxyPort
                     : undefined,
                 proxyAuthToken: needsNetworkProxy ? proxyAuthToken : undefined,
-                caCertPath: mitmCA?.certPath,
+                caCertPath: mitmCA?.trustBundlePath,
                 readConfig,
                 writeConfig,
                 unsetEnvVars: credentialRestrictions.unsetEnvVars,
+                setEnvVars: credentialRestrictions.setEnvVars,
+                maskedFileBinds: credentialRestrictions.maskedFileBinds,
+                maskedFileStoreDir: credentialRestrictions.maskedFileStoreDir,
                 enableWeakerNestedSandbox: getEnableWeakerNestedSandbox(),
                 allowAllUnixSockets: getAllowAllUnixSockets(),
                 binShell,
@@ -737,6 +1087,7 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
                 seccompConfig: getSeccompConfig(),
                 bwrapPath: config?.bwrapPath,
                 socatPath: config?.socatPath,
+                observeSocketPath: linuxMonitor?.observeSocketPath,
                 abortSignal,
             });
         case 'windows':
@@ -758,14 +1109,22 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
  * `spawn(argv[0], argv.slice(1), {shell: false, env})`.
  *
  * On Windows this is the ONLY supported wrap method (see
- * {@link wrapWithSandbox}); `env` carries the full proxy set that the
- * sandboxed child inherits (`srt-win exec` forwards its environment
- * verbatim — see {@link wrapCommandWithSandboxWindows}). On
+ * {@link wrapWithSandbox}); `env` is the broker process's spawn env
+ * — the sandboxed child gets a fresh `srt-sandbox` profile env with
+ * only the `--env` overlay baked into `argv` (see
+ * {@link wrapCommandWithSandboxWindows}). On
  * macOS/Linux `argv` is `[binShell, '-c', <wrapWithSandbox result>]`
  * (proxy env is baked into that command) and `env` is the unchanged
  * `process.env`, so callers can spawn uniformly across platforms.
+ *
+ * @param cwd the working directory the caller will spawn the result
+ *   with. On Windows the child's cwd is whatever the caller passes
+ *   as the spawn `{cwd:}` option (there is no `--cwd` flag), and
+ *   the `safe.directory` git-config injection derives from this — so
+ *   pass the same value here as to `spawn({cwd})`. Defaults to
+ *   `process.cwd()`. Currently unused on macOS/Linux.
  */
-async function wrapWithSandboxArgv(command, binShell, customConfig, abortSignal) {
+async function wrapWithSandboxArgv(command, binShell, customConfig, abortSignal, cwd) {
     const platform = getPlatform();
     if (platform === 'windows') {
         const hasNetworkConfig = customConfig?.network?.allowedDomains !== undefined ||
@@ -773,13 +1132,83 @@ async function wrapWithSandboxArgv(command, binShell, customConfig, abortSignal)
         if (hasNetworkConfig) {
             await waitForNetworkInitialization();
         }
+        const credentialRestrictions = getCredentialRestrictions(customConfig?.credentials ?? config?.credentials, customConfig?.network?.allowedDomains ?? config?.network?.allowedDomains);
+        // Per-exec FILE denies (customConfig only — the session-level
+        // config's denies were already stamped at initialize()).
+        // Paths go through `expandWindowsFsPaths` — the SAME
+        // chokepoint the session-level set uses (point-in-time glob
+        // expand, normalize, missing→drop) — so a per-exec entry
+        // resolves identically to its session-level equivalent.
+        // macOS/Linux per-exec already reuses session-level expansion;
+        // Windows now matches.
+        //
+        // The dedup against `windowsFsStampedSet` is an OPTIMIZATION,
+        // not a correctness gate: re-stamping a session-held path
+        // under the exec's distinct holder is refcount-safe but wastes
+        // a SetSecurityInfo round-trip.
+        //
+        // filesystem.disabled bypasses ALL filesystem rule generation
+        // — including credential-derived file denies — same ordering
+        // as session-level `computeWindowsFsAccessSet` (credential
+        // ENV: mode:'deny' is structural under the fresh srt-sandbox
+        // env; mode:'mask' sentinels are passed via the --env
+        // overlay).
+        // Per-exec allowRead/allowWrite throw — `srt-win exec` only
+        // exposes `--deny-*`; per-exec grants are not implemented.
+        const fsCfg = customConfig?.filesystem;
+        let perExecDenyRead = [];
+        let perExecDenyWrite = [];
+        if (!fsCfg?.disabled) {
+            if (fsCfg?.allowRead?.length || fsCfg?.allowWrite?.length) {
+                throw new Error(`Per-exec filesystem.allowRead/allowWrite is not supported ` +
+                    `on Windows — \`srt-win exec\` only exposes per-exec ` +
+                    `denies. Set them at the session level (initialize()).`);
+            }
+            const rawRead = [
+                ...(fsCfg?.denyRead ?? []),
+                ...getCredentialDenyReadPaths(customConfig?.credentials),
+            ];
+            const rawWrite = fsCfg?.denyWrite ?? [];
+            // Skip on the dominant path (no per-exec fs or
+            // credential-file deny).
+            if (rawRead.length > 0 || rawWrite.length > 0) {
+                const sessRead = new Set(windowsFsStampedSet?.denyRead ?? []);
+                const sessWrite = new Set(windowsFsStampedSet?.denyWrite ?? []);
+                const expand = expandWindowsFsPaths;
+                perExecDenyRead = expand(rawRead).filter(p => !sessRead.has(p));
+                perExecDenyWrite = expand(rawWrite).filter(p => !sessRead.has(p) && !sessWrite.has(p));
+            }
+        }
+        // Per-exec deny rides on argv (`acl stamp` reads stdin, but
+        // exec's stdin belongs to the child). The CreateProcessW
+        // length check lives in `wrapCommandWithSandboxWindows`
+        // where the full argv (incl. shell + user command) is known.
+        //
+        // The `denyReadPaths` half of the SESSION-level credentials
+        // is already unioned into the stamp set at initialize() time
+        // via `computeWindowsFsAccessSet`.
         return wrapCommandWithSandboxWindows({
             command,
-            group: getWindowsGroupRef(),
             httpProxyPort: hasNetworkConfig ? getProxyPort() : undefined,
             socksProxyPort: hasNetworkConfig ? getSocksProxyPort() : undefined,
             proxyAuthToken: hasNetworkConfig ? proxyAuthToken : undefined,
-            binShell,
+            // mode:'deny' env vars are structurally absent (fresh
+            // srt-sandbox profile env). mode:'mask' sentinels are
+            // passed via the --env overlay so the sandboxed child sees
+            // the sentinel value, same as macOS/Linux.
+            setEnvVars: credentialRestrictions.setEnvVars,
+            denyRead: perExecDenyRead,
+            denyWrite: perExecDenyWrite,
+            // safe.directory: cwd + the resolved session-level write
+            // grants — exactly the working-tree roots the sandbox user
+            // has MODIFY on and where git will see real-user-owned files.
+            cwd,
+            allowWrite: windowsFsStampedSet?.grantWrite,
+            caCertPath: mitmCA?.trustBundlePath,
+            binShell: parseWindowsBinShell(binShell),
+            srtWin: customConfig?.windows?.srtWin
+                ? resolveSrtWin(customConfig.windows.srtWin)
+                : (srtWinSpawn ?? resolveSrtWin(config?.windows?.srtWin)),
         });
     }
     // macOS/Linux: delegate to the existing string wrapper, then put
@@ -799,7 +1228,7 @@ function getConfig() {
  * Update the sandbox configuration in place.
  *
  * **Network/allowlist changes are a live swap**: the running
- * http/socks proxies read `config.network.allowedDomains` /
+ * mux proxy reads `config.network.allowedDomains` /
  * `deniedDomains` per-request (via `filterNetworkRequest`), so
  * reassigning `config` here takes effect on the next connection
  * with no proxy rebind and no port change — on every platform,
@@ -808,12 +1237,21 @@ function getConfig() {
  *
  * Filesystem changes (denyRead/denyWrite) are NOT applied live:
  * macOS bakes them into the seatbelt profile at wrap time, and
- * Windows will need an explicit re-stamp. To change FS
- * restrictions, reset() then initialize() with the new config.
+ * Linux/Windows bake them into the bwrap argv / DENY-ACE set at
+ * wrap time. Call reset() + initialize() to apply a new
+ * filesystem config.
  *
  * @param newConfig - The new configuration to use
  */
 function updateConfig(newConfig) {
+    if (getPlatform() === 'windows' &&
+        config &&
+        !sameWindowsStampSet(newConfig)) {
+        logForDebugging(`[Sandbox Windows] updateConfig: the resolved file-access set ` +
+            `(filesystem.* ∪ credentials.files) changed but the ACL ` +
+            `stamp/grant is session-wide — call reset() then initialize() ` +
+            `to apply. The previously-applied set stays in effect.`, { level: 'warn' });
+    }
     // Deep clone the config to avoid mutations. structuredClone cannot clone
     // functions, so pull filterRequest out, clone the rest, and put it back —
     // a function reference is immutable in the sense that matters here.
@@ -950,6 +1388,38 @@ function forceCloseHttpServer(server) {
     });
 }
 async function reset() {
+    // Windows: release this session's sandbox-user ACEs. Best-effort
+    // — log anomalies rather than throw, so teardown always
+    // completes. Leftover ACEs are recoverable later via
+    // `srt-win acl recover` (which sweeps by trustee SID).
+    if (windowsFsStampedSet && windowsFsSbUserSid) {
+        const sb = windowsFsSbUserSid;
+        // Captured at initialize() — the SAME binary the grants/stamps
+        // were applied with, immune to `config` mutation between.
+        const srtWin = srtWinSpawn;
+        // 'restored'/'alreadyOriginal' are the pre- same-user-removal
+        // srt-win's success vocabulary; 'revoked'/'stillHeld' are the
+        // post-. Either is non-anomalous.
+        const ok = new Set(['revoked', 'stillHeld', 'restored', 'alreadyOriginal']);
+        const log = (kind, e) => {
+            if (!ok.has(e.status)) {
+                logForDebugging(`[Sandbox Windows] ${kind}: '${e.path}' ${e.status} — ` +
+                    `ACE may be left in place; resolve and run ` +
+                    `\`srt-win acl recover\` to clear`, { level: 'warn' });
+            }
+        };
+        for (const e of revokeWindowsAcl({ sandboxUserSid: sb, srtWin }) ?? []) {
+            log('grant revoke', e);
+        }
+        for (const e of restoreWindowsAcl({ sandboxUserSid: sb, srtWin }) ?? []) {
+            log('deny restore', e);
+        }
+    }
+    windowsFsStampedSet = undefined;
+    windowsFsSbUserSid = undefined;
+    windowsFsRawInputs = undefined;
+    srtWinSpawn = undefined;
+    // windowsWfpVerified is NOT cleared — per-process, not per-session.
     // Clean up any leftover bwrap mount points. Force past the
     // active-sandbox counter — reset() means the session is over.
     cleanupBwrapMountPoints({ force: true });
@@ -958,6 +1428,10 @@ async function reset() {
         logMonitorShutdown();
         logMonitorShutdown = undefined;
     }
+    if (linuxMonitor) {
+        linuxMonitor.stop();
+        linuxMonitor = undefined;
+    }
     if (managerContext?.linuxBridge) {
         const { httpSocketPath, socksSocketPath, httpBridgeProcess, socksBridgeProcess, } = managerContext.linuxBridge;
         // Kill both bridges and wait for them to exit
@@ -994,6 +1468,13 @@ async function reset() {
     if (mitmCA) {
         closePromises.push(disposeMitmCA(mitmCA));
     }
+    if (muxProxyServer) {
+        closePromises.push(muxProxyServer.close().catch((error) => {
+            logForDebugging(`Error closing mux proxy server: ${error.message}`, {
+                level: 'error',
+            });
+        }));
+    }
     if (httpProxyServer) {
         closePromises.push(forceCloseHttpServer(httpProxyServer));
     }
@@ -1008,6 +1489,7 @@ async function reset() {
     // Wait for all servers to close
     await Promise.all(closePromises);
     // Clear references
+    muxProxyServer = undefined;
     httpProxyServer = undefined;
     proxyAuthToken = undefined;
     socksProxyServer = undefined;
@@ -1015,6 +1497,8 @@ async function reset() {
     initializationPromise = undefined;
     parentProxy = undefined;
     mitmCA = undefined;
+    sentinelRegistry.clear();
+    maskedFileStore.dispose();
 }
 function getSandboxViolationStore() {
     return sandboxViolationStore;
@@ -1045,7 +1529,7 @@ function annotateStderrWithSandboxFailures(command, stderr) {
 function getLinuxGlobPatternWarnings() {
     // Only warn on Linux/WSL (bubblewrap doesn't support globs)
     // macOS supports glob patterns via regex conversion
-    if (getPlatform() !== 'linux' || !config) {
+    if (getPlatform() !== 'linux' || !config || config.filesystem.disabled) {
         return [];
     }
     const globPatterns = [];
@@ -1096,6 +1580,8 @@ export const SandboxManager = {
     cleanupAfterCommand,
     reset,
     getMitmCA: () => mitmCA,
+    getSentinelRegistry: () => sentinelRegistry,
+    getMaskedFileStore: () => maskedFileStore,
     getSandboxViolationStore,
     annotateStderrWithSandboxFailures,
     getLinuxGlobPatternWarnings,