@sysid/sandbox-runtime-improved 0.0.61-sysid.1 → 0.0.64-sysid.1

package/dist/sandbox/windows-sandbox-utils.js

@@ -1,9 +1,11 @@
 import * as fs from 'node:fs';
+import * as net from 'node:net';
 import * as path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { once } from 'node:events';
 import { fileURLToPath } from 'node:url';
 import { logForDebugging } from '../utils/debug.js';
-import { containsGlobCharsWin, expandGlobPattern, generateProxyEnvVars, normalizePathForSandbox, } from './sandbox-utils.js';
+import { generateProxyEnvVars, normalizePathForSandbox, containsGlobCharsWin, expandGlobPattern, } from './sandbox-utils.js';
 // Re-export so existing tests (glob-expand.test.ts) and any
 // out-of-tree caller keep their import path.
 export { containsGlobCharsWin, stripExtendedPathPrefix, } from './sandbox-utils.js';
@@ -11,28 +13,31 @@ export { containsGlobCharsWin, stripExtendedPathPrefix, } from './sandbox-utils.
  * Windows sandbox backend.
  *
  * Network isolation is enforced by `srt-win.exe` — a Rust helper that
- * manages a local discriminator group, a machine-wide WFP filter set
- * keyed on that group's SID, and an `exec` subcommand that spawns the
- * target under a restricted token (group flipped deny-only) inside a
- * hardened job. The sandboxed child reaches the host only via the JS
- * http/socks proxies, which `srt-win exec` points at via env vars.
+ * provisions a dedicated `srt-sandbox` local user account, installs a
+ * machine-wide WFP filter set keyed on that account's SID, and
+ * provides an `exec` subcommand that spawns the target via a two-hop
+ * launch (broker → `CreateProcessWithLogonW(runner)` → runner →
+ * restricted-token child) under `srt-sandbox`. The sandboxed child
+ * reaches the host only via the JS mux proxy, which the caller
+ * passes in via `--env`.
+ *
+ * The separate-user account structurally closes the surrogate-spawn
+ * class (schtasks, `PROC_THREAD_ATTRIBUTE_PARENT_PROCESS`, BITS,
+ * RunAs="Interactive User" COM): the child's token carries a
+ * different user SID, so it cannot reach real-user processes, tasks
+ * register under `srt-sandbox`, and the user-SID WFP filter fences
+ * `srt-sandbox` egress regardless of how the child was spawned.
  *
  * This module is a thin wrapper around the `srt-win` CLI; all status
- * comes from live enumeration (group via `LookupAccountNameW` +
- * token-membership check; WFP via providerData-tag enumeration under
- * the configured sublayer). There is no marker file.
+ * comes from live enumeration. There is no marker file.
  *
- * Filesystem deny (`denyRead`/`denyWrite`) is enforced via
- * `srt-win acl stamp` at session start: a broker-only DACL is
- * applied to each listed file plus a `Modify`-minus-`FILE_DELETE_CHILD`
- * allow-list on its immediate parent directory, with restore state
- * sealed by an inert hash-ACE marker so the on-disk SD is
- * self-authenticating. See {@link stampWindowsAcl}.
+ * Filesystem rules (`denyRead`/`denyWrite`/`allowRead`/`allowWrite`)
+ * are enforced via additive explicit ACEs for `<sb-SID>` — see
+ * {@link grantWindowsAcl} / {@link stampWindowsAcl}.
  */
 // ────────────────────────────────────────────────────────────────────
 // Types
 // ────────────────────────────────────────────────────────────────────
-export const DEFAULT_WINDOWS_GROUP_NAME = 'sandbox-runtime-net';
 export const DEFAULT_WINDOWS_PROXY_PORT_RANGE = [
     60080, 60089,
 ];
@@ -90,134 +95,248 @@ function repoRoot() {
 }
 const nodeArchToDir = { x64: 'x64', arm64: 'arm64' };
 /**
- * Locate `srt-win.exe`. Resolution order:
- *   1. `SRT_WIN_PATH` env var (CI sets this to the freshly-built binary).
- *   2. `<root>/vendor/srt-win/{arch}/srt-win.exe` (prebuilt — published npm
+ * Locate the packaged `srt-win.exe`. Resolution order:
+ *   1. `<root>/vendor/srt-win/{arch}/srt-win.exe` (prebuilt — published npm
  *      package, or after `npm run build:srt-win` locally).
- *   3. `<root>/vendor/srt-win-src/target/release/srt-win.exe` (local
+ *   2. `<root>/vendor/srt-win-src/target/release/srt-win.exe` (local
  *      `cargo build --release` fallback for development).
- *   4. `<root>/vendor/srt-win/target/release/srt-win.exe` (transitional:
- *      stale local build from before the srt-win-src rename).
  *
  * `<root>` is {@link repoRoot} — `__dirname/../..`, which resolves to the
  * repo root from `src/sandbox/` and `dist/sandbox/` alike, and to the
  * package root when installed under `node_modules`.
  *
+ * Callers that ship their own binary (or a multicall binary that
+ * routes on `argv[1] == `{@link SRT_WIN_DISPATCH_ARG1}) pass
+ * `windows.srtWin` instead of relying on this lookup — see
+ * {@link resolveSrtWin}.
+ *
  * Resolution via the optional `@anthropic-ai/sandbox-runtime-win32-*`
  * platform packages is added separately.
  *
  * @throws if none exist.
  */
 export function getSrtWinPath() {
-    const envPath = process.env.SRT_WIN_PATH;
-    if (envPath && fs.existsSync(envPath)) {
-        return envPath;
-    }
     const root = repoRoot();
     const arch = nodeArchToDir[process.arch];
     const candidates = [];
     if (arch) {
         candidates.push(path.join(root, 'vendor', 'srt-win', arch, 'srt-win.exe'));
     }
-    candidates.push(path.join(root, 'vendor', 'srt-win-src', 'target', 'release', 'srt-win.exe'), 
-    // transitional: stale local build from before the srt-win-src rename
-    path.join(root, 'vendor', 'srt-win', 'target', 'release', 'srt-win.exe'));
+    candidates.push(path.join(root, 'vendor', 'srt-win-src', 'target', 'release', 'srt-win.exe'));
     for (const c of candidates) {
         if (fs.existsSync(c))
             return c;
     }
-    throw new Error(`srt-win.exe not found. Set SRT_WIN_PATH or build with ` +
+    throw new Error(`srt-win.exe not found. Set windows.srtWin.path or build with ` +
         `\`cargo build --release --manifest-path vendor/srt-win-src/Cargo.toml\`. ` +
-        `Looked in: ${[envPath, ...candidates].filter(Boolean).join(', ')}`);
+        `Looked in: ${candidates.join(', ')}`);
 }
-// ────────────────────────────────────────────────────────────────────
-// Internal: spawn helpers
-// ────────────────────────────────────────────────────────────────────
-function groupRefArgs(ref) {
-    if (ref.groupSid)
-        return ['--group-sid', ref.groupSid];
-    return ['--name', ref.groupName ?? DEFAULT_WINDOWS_GROUP_NAME];
+/**
+ * `argv[1]` sentinel a multicall embedder's dispatcher matches
+ * against to route into `srt_win::run_from_args`. Mirrors the Rust
+ * `srt_win::SRT_WIN_DISPATCH_ARG1`; the two MUST stay in sync.
+ * `run_from_args` strips it before clap, so the standalone binary
+ * accepts it harmlessly.
+ */
+export const SRT_WIN_DISPATCH_ARG1 = '--srt-win';
+/**
+ * Resolve the `srt-win` spawn target from config. When `cfg.path` is
+ * set it is used verbatim (no fallback to the packaged binary — an
+ * explicit override is a directive, not a hint) and
+ * {@link SRT_WIN_DISPATCH_ARG1} is prepended so a multicall
+ * dispatcher routes on `argv[1]`. When unset, falls back to
+ * {@link getSrtWinPath} with no sentinel (the packaged binary
+ * doesn't need it; `run_from_args` would strip it anyway).
+ */
+export function resolveSrtWin(cfg) {
+    if (cfg?.path !== undefined) {
+        if (!fs.existsSync(cfg.path)) {
+            throw new Error(`windows.srtWin.path is set to '${cfg.path}' but the file does ` +
+                `not exist; remove srtWin.path to fall back to the packaged ` +
+                `binary`);
+        }
+        return { exe: cfg.path, prependArgs: [SRT_WIN_DISPATCH_ARG1] };
+    }
+    return { exe: getSrtWinPath(), prependArgs: [] };
 }
-function runSrtWin(args, stdin, timeoutMs = 15000) {
-    const exe = getSrtWinPath();
-    const r = spawnSync(exe, args, {
+function runSrtWin(args, opts = {}) {
+    // Direct callers of the exported helpers may omit `srtWin`
+    // (backward-compat) — fall back to the packaged-binary lookup.
+    // `SandboxManager` resolves once at `initialize()` and threads the
+    // handle, so this per-call resolve is only hit outside a session.
+    const { exe, prependArgs } = opts.srtWin ?? resolveSrtWin();
+    const r = spawnSync(exe, [...prependArgs, ...args], {
         encoding: 'utf8',
-        timeout: timeoutMs,
-        ...(stdin !== undefined && { input: stdin }),
+        timeout: opts.timeoutMs ?? 15000,
+        ...(opts.stdin !== undefined ? { input: opts.stdin } : {}),
     });
     if (r.error) {
         throw new Error(`srt-win ${args[0]}: spawn failed: ${r.error.message}`);
     }
     return {
         status: r.status,
+        signal: r.signal,
         stdout: (r.stdout ?? '').trim(),
         stderr: (r.stderr ?? '').trim(),
     };
 }
 function runSrtWinJson(args, opts) {
-    const r = runSrtWin(args, undefined, opts?.timeoutMs);
-    // Parse stdout BEFORE the exit-code check so `allowNonZero`
-    // can hand back the JSON on exit≠0. JSON.parse never returns
-    // `undefined`, so `json !== undefined` ⇔ parse succeeded.
-    let json;
-    let parseErr;
+    const r = runSrtWin(args, opts);
+    if (r.status !== 0) {
+        throw new Error(`srt-win ${args.join(' ')} exited ${r.status}: ${r.stderr || r.stdout}`);
+    }
     try {
-        json = JSON.parse(r.stdout);
+        return JSON.parse(r.stdout);
     }
     catch (e) {
-        parseErr = e.message;
+        throw new Error(`srt-win ${args.join(' ')}: unparseable JSON output ` +
+            `${JSON.stringify(r.stdout)}: ${e.message}`);
     }
-    if (opts?.allowNonZero && json !== undefined) {
-        return { ok: r.status === 0, json, stderr: r.stderr };
+}
+/**
+ * As {@link runSrtWinJson} but parses stdout BEFORE checking the
+ * exit code, so a non-zero exit with the per-path JSON intact
+ * still surfaces every entry. For best-effort teardown helpers
+ * (`acl restore`/`acl revoke`).
+ */
+function runSrtWinJsonAllowFail(args, opts) {
+    const r = runSrtWin(args, opts);
+    let json;
+    try {
+        json = JSON.parse(r.stdout);
     }
-    if (r.status !== 0) {
-        throw new Error(`srt-win ${args.join(' ')} exited ${r.status}: ${r.stderr || r.stdout}`);
+    catch (e) {
+        throw new Error(`srt-win ${args.join(' ')}: unparseable JSON output ` +
+            `${JSON.stringify(r.stdout)}: ${e.message}`);
     }
-    if (json !== undefined)
-        return json;
-    throw new Error(`srt-win ${args.join(' ')}: unparseable JSON output ` +
-        `${JSON.stringify(r.stdout)}: ${parseErr}`);
+    return { ok: r.status === 0, json, stderr: r.stderr };
 }
 // ────────────────────────────────────────────────────────────────────
 // Status / install API
 // ────────────────────────────────────────────────────────────────────
 /**
- * Query the discriminator group's state in SAM and in the current
- * process's `TokenGroups`. `ready` means the group exists AND is
- * enabled in the caller's token (i.e. the logout/login dance has
- * happened). `created-not-on-token` means the install step ran but
- * a fresh logon is needed before {@link initialize} can succeed.
- */
-export function getWindowsGroupStatus(ref) {
-    return runSrtWinJson(['group', 'status', ...groupRefArgs(ref)]);
-}
-/**
- * Query the WFP filter set under the given sublayer. `installed` means
- * srt-win-tagged `permit-group` AND `block` filters are both present
- * under that sublayer. Detection is **tag-based** (providerData JSON);
- * filters installed by other tooling without the tag are not counted.
+ * Query the WFP filter set under the given sublayer via live BFE
+ * enumeration. `installed` means at least one srt-win-tagged
+ * `block-user` filter is present. Detection is **tag-based**
+ * (providerData JSON); filters installed by other tooling without the
+ * tag are not counted.
+ *
+ * BFE enumeration is admin-gated — a non-elevated caller gets
+ * `state:"cannot-read"` with a `hint` (not an error). The
+ * non-elevated readiness check is {@link verifyWindowsWfpEgress}.
  */
 export function getWindowsWfpStatus(opts = {}) {
     const args = ['wfp', 'status'];
     if (opts.sublayerGuid)
         args.push('--sublayer-guid', opts.sublayerGuid);
-    const raw = runSrtWinJson(args);
+    const raw = runSrtWinJson(args, { srtWin: opts.srtWin });
     return {
         state: raw.state,
         filters: raw.filters,
         ...(raw.port_range && { portRange: raw.port_range }),
-        userFilters: raw.user_filters ?? 0,
         ...(raw.user_sid && { userSid: raw.user_sid }),
+        ...(raw.hint && { hint: raw.hint }),
     };
 }
+/**
+ * Behavioral proof that the WFP egress fence is active for the
+ * sandbox user. Binds a local listener on an ephemeral loopback port
+ * outside the WFP loopback-permit range, then spawns `srt-win
+ * runner` as the sandbox user (via `CreateProcessWithLogonW`) to
+ * attempt a direct TCP connect to it. The WFP block-user filter
+ * fires at `ALE_AUTH_CONNECT` — before any packet leaves — so an
+ * active fence yields WSAEACCES immediately and a missing fence lets
+ * the connect through (the kernel completes the handshake against
+ * the listening socket's backlog; no event-loop tick required, so
+ * the synchronous `runSrtWin` is safe). Does not require elevation
+ * and does not depend on any external host.
+ *
+ * `initialize()` calls this once per session, so a stale install
+ * (sandbox user provisioned but filters since removed) fails closed
+ * at session start instead of running every exec with full egress.
+ *
+ * @param opts.target overrides the probe target (skips the local
+ *   listener bind).
+ * @param opts.proxyPortRange the WFP loopback-permit range the
+ *   listener must avoid. Default
+ *   {@link DEFAULT_WINDOWS_PROXY_PORT_RANGE}.
+ * @throws on any outcome other than `blocked` (exit 0).
+ */
+export async function verifyWindowsWfpEgress(opts = {}) {
+    let target = opts.target;
+    let server;
+    if (!target) {
+        // Bind ephemeral; retry if it lands inside the WFP
+        // loopback-permit range (a port in-range would be PERMITted
+        // even with the fence active → false `connected`).
+        const [lo, hi] = opts.proxyPortRange ?? DEFAULT_WINDOWS_PROXY_PORT_RANGE;
+        for (let i = 0; i < 5; i++) {
+            const s = net.createServer();
+            s.listen(0, '127.0.0.1');
+            await once(s, 'listening');
+            const p = s.address().port;
+            if (p < lo || p > hi) {
+                server = s;
+                target = `127.0.0.1:${p}`;
+                break;
+            }
+            s.close();
+        }
+        if (!target) {
+            throw new Error(`verifyWindowsWfpEgress: could not bind a loopback ` +
+                `listener outside the WFP permit range [${lo},${hi}] in ` +
+                `5 attempts`);
+        }
+    }
+    try {
+        // 30s: first call after install may create the sandbox user's
+        // profile (LOGON_WITH_PROFILE) via CreateProcessWithLogonW —
+        // same budget as windowsTrustCa, plus the runner's own 2s
+        // connect timeout.
+        const r = runSrtWin(['wfp', 'verify', '--target', target], {
+            timeoutMs: 30000,
+            srtWin: opts.srtWin,
+        });
+        logForDebugging(`[Sandbox Windows] wfp verify exit=${r.status}: ${r.stderr || r.stdout}`);
+        let raw;
+        try {
+            raw = JSON.parse(r.stdout);
+        }
+        catch {
+            // status=null → spawnSync killed the child (timeout or external
+            // signal). Include signal + stderr so the CI log self-explains
+            // instead of just `exited null with unparseable output ""`.
+            throw new Error(`WFP egress fence could not be verified — \`srt-win wfp ` +
+                `verify\` exited ${r.status}` +
+                (r.signal ? ` (signal ${r.signal})` : '') +
+                ` with unparseable output ${JSON.stringify(r.stdout)} ` +
+                `(stderr: ${JSON.stringify(r.stderr)})`);
+        }
+        if (r.status === 3) {
+            throw new Error(`WFP egress fence is not active — direct outbound from the ` +
+                `sandbox user to ${raw.target} succeeded. Re-run ` +
+                `\`srt-win install\` (one UAC prompt). (${r.stderr})`);
+        }
+        if (r.status !== 0) {
+            throw new Error(`WFP egress fence could not be verified — probe to ` +
+                `${raw.target} was '${raw.egress_probe}' (exit ` +
+                `${r.status}). The fence may be absent. Re-run \`srt-win ` +
+                `install\`. (${r.stderr})`);
+        }
+        return { target: raw.target, stderr: r.stderr };
+    }
+    finally {
+        server?.close();
+    }
+}
 /**
  * Query the sandbox user account's provisioning state. Each field
  * is independently observed so a half-provisioned install (e.g.
  * user exists but credential file missing) is distinguishable.
  * Does not require elevation.
  */
-export function getWindowsSandboxUserStatus() {
-    const raw = runSrtWinJson(['user', 'status']);
+export function getWindowsSandboxUserStatus(opts = {}) {
+    const raw = runSrtWinJson(['user', 'status'], { srtWin: opts.srtWin });
     return {
         provisioned: raw.user.exists,
         ...(raw.user.sid && { sid: raw.user.sid }),
@@ -230,6 +349,7 @@ export function getWindowsSandboxUserStatus() {
         ...(typeof raw.marker_version === 'number' && {
             markerVersion: raw.marker_version,
         }),
+        realUserSid: raw.real_user_sid,
         ...(raw.ca_cert_thumb && { caCertThumb: raw.ca_cert_thumb }),
         ...(raw.ca_cert_pem && { caCertPem: raw.ca_cert_pem }),
     };
@@ -240,18 +360,18 @@ export function getWindowsSandboxUserStatus() {
  * Returns `null` when no CA was installed. The PEM is what `srt-win
  * user status` reconstructs from the DER stored in `state.db`.
  *
- * On Windows with `windows.asSandboxUser`, `tlsTerminate` requires
- * this CA to be present in the sandbox user's `CurrentUser\Root`
- * (schannel-level trust is an install-time concern, not
- * per-session); the host calls this from `initialize()` to fail
- * early with an actionable message when it isn't.
+ * On Windows, `tlsTerminate` requires this CA to be present in the
+ * sandbox user's `CurrentUser\Root` (schannel-level trust is an
+ * install-time concern, not per-session); the host calls this from
+ * `initialize()` to fail early with an actionable message when it
+ * isn't.
  *
  * @param status pass an already-fetched
  *   {@link getWindowsSandboxUserStatus} result to avoid a second
  *   `srt-win user status` spawn.
  */
-export function getWindowsSandboxCaCert(status) {
-    const u = status ?? getWindowsSandboxUserStatus();
+export function getWindowsSandboxCaCert(status, opts = {}) {
+    const u = status ?? getWindowsSandboxUserStatus(opts);
     if (!u.caCertThumb || !u.caCertPem)
         return null;
     return { pem: u.caCertPem, thumb: u.caCertThumb };
@@ -266,17 +386,19 @@ export function getWindowsSandboxCaCert(status) {
  *
  * The CA has a separate lifecycle from {@link installWindowsSandbox}
  * — install provisions the account/filters and never touches the CA;
- * call this AFTER install when `tlsTerminate` will be used with
- * `windows.asSandboxUser`.
+ * call this AFTER install when `tlsTerminate` will be used.
  *
  * @throws when the sandbox user is not provisioned, the file is not a
  *   parseable X.509 certificate, or the registry write into the
  *   sandbox user's hive fails.
  */
-export function windowsTrustCa(caCertPath) {
+export function windowsTrustCa(caCertPath, opts = {}) {
     // 60s: first call may create the sandbox user's profile
     // (LOGON_WITH_PROFILE) via the one-shot CreateProcessWithLogonW.
-    const r = runSrtWin(['user', 'trust-ca', caCertPath], undefined, 60000);
+    const r = runSrtWin(['user', 'trust-ca', caCertPath], {
+        timeoutMs: 60000,
+        srtWin: opts.srtWin,
+    });
     logForDebugging(`[Sandbox Windows] user trust-ca exit=${r.status}: ${r.stderr || r.stdout}`);
     if (r.status !== 0) {
         throw new Error(`srt-win user trust-ca '${caCertPath}' failed (exit ` +
@@ -284,92 +406,72 @@ export function windowsTrustCa(caCertPath) {
     }
 }
 /**
- * One-shot install: creates the discriminator group, adds the
- * current user (or `userSid`), and installs the machine-wide WFP
- * filter set — all in a single self-elevating process (one UAC
- * prompt). Idempotent.
+ * One-shot install: provisions the `srt-sandbox` user account and
+ * installs the user-SID-keyed WFP filter set — all in a single
+ * self-elevating process (one UAC prompt). Idempotent; re-running
+ * rotates the sandbox user's password.
  *
- * Network for the calling user is **not disrupted** before the
- * required logout: while the group is absent from the token, WFP
- * filter-0 (PERMIT non-members) matches and traffic flows normally.
- * After log-out/log-in, the group is enabled in the token and
- * filter-1 (PERMIT group-enabled) takes over for the broker; only
- * `srt-win exec` children (group flipped deny-only) fall through to
- * the loopback/BLOCK filters.
+ * Network for the calling user is **not disrupted**: the filters key
+ * on the `srt-sandbox` user's SID, so the broker, services, and
+ * every other principal fall through to default-permit. No logout
+ * is required.
  *
- * Returns the post-call group + WFP state. If the user cancels the
- * UAC prompt this returns `{cancelled: true, …}` rather than
- * throwing — cancellation is a user choice, not an error.
+ * Returns the post-call WFP + sandbox-user state. If the user
+ * cancels the UAC prompt this returns `{cancelled: true, …}` rather
+ * than throwing — cancellation is a user choice, not an error.
  *
- * @throws on group/WFP creation failure, or if filters already
- *   exist under `sublayerGuid` with different configuration and
- *   `force` is not set.
+ * @throws on user/WFP creation failure, or if filters already exist
+ *   under `sublayerGuid` with a different port range and `force` is
+ *   not set.
  */
 export function installWindowsSandbox(opts = {}) {
-    const args = ['install', ...groupRefArgs(opts)];
-    if (opts.userSid)
-        args.push('--user-sid', opts.userSid);
+    const srtWin = opts.srtWin ?? resolveSrtWin();
+    const args = ['install'];
     if (opts.sublayerGuid)
         args.push('--sublayer-guid', opts.sublayerGuid);
     if (opts.proxyPortRange) {
         args.push('--proxy-port-range', `${opts.proxyPortRange[0]}-${opts.proxyPortRange[1]}`);
     }
+    if (opts.sandboxUser)
+        args.push('--sandbox-user', opts.sandboxUser);
     if (opts.force)
         args.push('--force');
-    const r = runSrtWin(args, undefined, 60000);
+    const r = runSrtWin(args, { timeoutMs: 60000, srtWin });
     logForDebugging(`[Sandbox Windows] install exit=${r.status}: ${r.stderr || r.stdout}`);
     // srt-win install exit-code contract:
     //   0  ok
     //   10 user cancelled UAC elevation
-    //   11 group create failed
     //   12 WFP install failed
     //   13 already installed with different config (use --force)
     //   14 sandbox-user provisioning failed
     //   1  other error (stderr has detail)
     const out = r.stderr || r.stdout;
+    const readBack = () => ({
+        wfp: getWindowsWfpStatus({ sublayerGuid: opts.sublayerGuid, srtWin }),
+        user: getWindowsSandboxUserStatus({ srtWin }),
+    });
     switch (r.status) {
         case 0:
-            break;
+            return readBack();
         case 10:
-            return {
-                group: getWindowsGroupStatus(opts),
-                wfp: getWindowsWfpStatus({ sublayerGuid: opts.sublayerGuid }),
-                user: getWindowsSandboxUserStatus(),
-                cancelled: true,
-            };
-        case 11:
-            throw new Error(`srt-win install: group create failed: ${out}`);
+            return { ...readBack(), cancelled: true };
         case 12:
             throw new Error(`srt-win install: WFP filter install failed: ${out}`);
         case 14:
             throw new Error(`srt-win install: sandbox user provisioning failed: ${out}`);
         case 13:
             throw new Error(`srt-win install: filters already exist under this sublayer with ` +
-                `different configuration (group SID or port range). ` +
-                `Pass {force: true} to replace, or pick a different sublayerGuid. ` +
+                `a different port range or sandbox-user name. Pass ` +
+                `{force: true} to replace, or pick a different sublayerGuid. ` +
                 `Output: ${out}`);
         default:
             throw new Error(`srt-win install failed (exit ${r.status}): ${out}`);
     }
-    return {
-        group: getWindowsGroupStatus(opts),
-        wfp: getWindowsWfpStatus({ sublayerGuid: opts.sublayerGuid }),
-        user: getWindowsSandboxUserStatus(),
-    };
 }
 /**
- * Remove the WFP filter set under `sublayerGuid` (one UAC prompt).
- * Idempotent.
- *
- * **Does NOT delete the discriminator group** — group membership is
- * persistent user state and removing it would force every user to
- * re-do the logout dance on the next install. Call
- * {@link deleteWindowsGroup} explicitly if you want full teardown.
- *
- * **Does** remove the `srt-sandbox` account, its credential file,
- * and the setup marker, unless `keepUser` is set — the credential
- * is useless without the account and vice versa, so they're
- * treated as one unit.
+ * Remove the WFP filter set under `sublayerGuid` and the
+ * `srt-sandbox` account, its credential file, and the setup marker
+ * (one UAC prompt). Idempotent.
  *
  * @returns `{cancelled: true}` if the user dismissed UAC.
  */
@@ -379,7 +481,7 @@ export function uninstallWindowsSandbox(opts = {}) {
         args.push('--sublayer-guid', opts.sublayerGuid);
     if (opts.keepUser)
         args.push('--keep-user');
-    const r = runSrtWin(args);
+    const r = runSrtWin(args, { srtWin: opts.srtWin });
     logForDebugging(`[Sandbox Windows] uninstall exit=${r.status}: ${r.stderr || r.stdout}`);
     if (r.status === 10)
         return { cancelled: true };
@@ -389,78 +491,17 @@ export function uninstallWindowsSandbox(opts = {}) {
     return {};
 }
 /**
- * Delete the discriminator group. Separate from
- * {@link uninstallWindowsSandbox} so that uninstall→reinstall
- * doesn't force a fresh logout for every member. **Requires
- * elevation.** Idempotent (no-op if the group doesn't exist).
- */
-export function deleteWindowsGroup(ref) {
-    const r = runSrtWin(['group', 'delete', ...groupRefArgs(ref)]);
-    if (r.status !== 0) {
-        throw new Error(`srt-win group delete failed (exit ${r.status}). ` +
-            `Requires elevation. Output: ${r.stderr || r.stdout}`);
-    }
-    logForDebugging(`[Sandbox Windows] group delete: ${r.stderr || r.stdout}`);
-}
-/**
- * Granular primitive: create the discriminator group and add the
- * current user (or `userSid`). Most callers should use
- * {@link installWindowsSandbox} instead; this exists for
- * enterprise/CI flows that manage group and WFP separately.
- * **Requires elevation.** Idempotent.
- */
-export function createWindowsGroup(ref) {
-    const args = ['group', 'create', ...groupRefArgs(ref)];
-    if (ref.userSid)
-        args.push('--user-sid', ref.userSid);
-    const r = runSrtWin(args);
-    if (r.status !== 0) {
-        throw new Error(`srt-win group create failed (exit ${r.status}). ` +
-            `This requires elevation — run as administrator. ` +
-            `Output: ${r.stderr || r.stdout}`);
-    }
-    logForDebugging(`[Sandbox Windows] group create: ${r.stderr || r.stdout}`);
-}
-/**
- * Granular primitive: install the machine-wide WFP filter set
- * under `sublayerGuid` keyed on the group SID. Most callers should
- * use {@link installWindowsSandbox} instead; this exists for
- * enterprise/CI flows that manage group and WFP separately.
- * **Requires elevation.** Idempotent — re-running replaces any
- * existing srt-win-tagged filters under that sublayer.
+ * Resolve any Windows filesystem-config path list — `allowRead`/
+ * `allowWrite` grants and `denyRead`/`denyWrite` stamps — to
+ * concrete existing paths via the single platform-aware
+ * {@link normalizePathForSandbox} chokepoint (Linux/macOS parity:
+ * point-in-time expansion at session initialize, not per-exec).
+ * Glob patterns are expanded; non-glob paths are normalized and
+ * returned 1:1. Missing paths are dropped (statSync probe).
+ * Directory targets are accepted — the additive sandbox-user ACE
+ * carries `(OI)(CI)` so it covers the subtree.
  */
-export function createWindowsWfp(ref) {
-    const args = ['wfp', 'install', ...groupRefArgs(ref)];
-    if (ref.sublayerGuid)
-        args.push('--sublayer-guid', ref.sublayerGuid);
-    if (ref.proxyPortRange) {
-        args.push('--proxy-port-range', `${ref.proxyPortRange[0]}-${ref.proxyPortRange[1]}`);
-    }
-    const r = runSrtWin(args);
-    if (r.status !== 0) {
-        throw new Error(`srt-win wfp install failed (exit ${r.status}). ` +
-            `This requires elevation — run as administrator. ` +
-            `Output: ${r.stderr || r.stdout}`);
-    }
-    logForDebugging(`[Sandbox Windows] wfp install: ${r.stderr || r.stdout}`);
-}
-/**
- * Expand the `denyRead`/`denyWrite` input set to a flat list of
- * existing FILE paths for `srt-win acl stamp`.
- *
- * Every input goes through {@link normalizePathForSandbox} (the
- * single Windows-aware chokepoint: `\\?\`/UNC-strip, drive-letter
- * case-fold, ~-expand, realpath). Globs (`*`/`?` only — `[`/`]`
- * are legal Win32 filename chars) expand via the shared walker
- * with case-insensitive matching (point-in-time: a file appearing
- * after this returns is NOT covered). Each candidate is checked
- * with one `statSync({throwIfNoEntry:false})`: missing → drop
- * (the protection model covers files present at session start);
- * directory → reject (the file stamp applies a per-file DACL plus
- * a per-parent-directory allow-list; stamping a directory itself
- * would touch every child); file → keep.
- */
-export function expandWindowsFsDenyPaths(patterns) {
+export function expandWindowsFsPaths(patterns) {
     const out = new Set();
     for (const raw of patterns) {
         const norm = normalizePathForSandbox(raw);
@@ -471,32 +512,26 @@ export function expandWindowsFsDenyPaths(patterns) {
             const st = fs.statSync(c, { throwIfNoEntry: false });
             if (!st)
                 continue;
-            if (st.isDirectory()) {
-                throw new Error(`Windows fs deny requires explicit file paths; ` +
-                    `${JSON.stringify(raw)} resolved to directory ` +
-                    `${JSON.stringify(c)}. Directory targets are not supported.`);
-            }
             out.add(c);
         }
     }
     return [...out];
 }
 /**
- * Apply the file-deny stamp set for one host session. Idempotent
- * via `srt-win`'s disk-first `ensure_stamped` chokepoint — calling
- * this again with overlapping paths re-verifies the on-disk DACL
- * against the hash-ACE marker rather than trusting state-DB rows.
+ * Apply the file-deny ACE set for one host session: an additive
+ * `(D;OICI;mask;;;<sb-SID>)` on the target plus a
+ * `(D;OICI;FILE_DELETE_CHILD;;;<sb-SID>)` on the parent — no
+ * PROTECTED rewrite, no SD snapshot. Idempotent and refcounted via
+ * srt-win's `working_aces` table.
  *
- * Inputs are passed verbatim to `srt-win` (which canonicalizes,
- * rejects directories and globs, and stamps each file plus its
- * immediate parent directory). Callers that accept globs should
- * pre-expand via {@link expandWindowsFsDenyPaths}.
+ * Inputs are passed verbatim to `srt-win` (which canonicalizes and
+ * rejects globs). Callers that accept globs should pre-expand via
+ * {@link expandWindowsFsPaths}.
  *
  * @throws on exit ≠ 0 — including exit 2 (one or more inputs
  *   skipped). srt-win stamps the resolvable inputs before exiting
  *   2, so on throw the caller should call {@link restoreWindowsAcl}
- *   to release whatever WAS stamped (fail-closed at session start
- *   means tearing down a partial setup).
+ *   to release whatever WAS stamped.
  */
 export function stampWindowsAcl(opts) {
     const holder = opts.holderPid ?? process.pid;
@@ -504,54 +539,55 @@ export function stampWindowsAcl(opts) {
         denyRead: opts.denyRead,
         denyWrite: opts.denyWrite,
     });
-    const r = runSrtWin(['acl', 'stamp', ...groupRefArgs(opts.group), '--holder-pid', `${holder}`], stdin, 60000);
+    const r = runSrtWin([
+        'acl',
+        'stamp',
+        '--holder-pid',
+        `${holder}`,
+        '--sandbox-user-sid',
+        opts.sandboxUserSid,
+    ], { timeoutMs: 60000, stdin, srtWin: opts.srtWin });
     logForDebugging(`[Sandbox Windows] acl stamp exit=${r.status}: ${r.stderr || r.stdout}`);
     if (r.status !== 0) {
-        // exit 2 = partial (some inputs skipped); exit 1 = at least
-        // one path could not be stamped. Either is a setup failure.
         throw new Error(`srt-win acl stamp exited ${r.status} ` +
             (r.status === 2 ? '(partial — some inputs skipped)' : '(failed)') +
             `: ${r.stderr || r.stdout}`);
     }
 }
 /**
- * Release this holder's file-deny stamps and return per-path /
- * per-parent outcomes. Best-effort: a non-`restored` entry means
- * the file's stamp was LEFT in place (fail-closed) — see
- * {@link WindowsAclPathOutcome} for the cases. Does not throw on
- * anomalies; the caller decides whether to surface them.
- *
- * Returns `undefined` when `srt-win acl restore` itself failed
- * (no JSON to parse) — the caller should log and move on rather
- * than block teardown.
+ * Release this holder's deny ACEs and remove the sandbox-user ACE
+ * on any path whose refcount falls to zero. Best-effort (does not
+ * throw on per-path anomalies); returns per-path outcomes for the
+ * caller to surface. Returns `undefined` only when `srt-win`
+ * itself failed (no JSON to parse).
  */
 export function restoreWindowsAcl(opts) {
     const holder = opts.holderPid ?? process.pid;
-    const args = [
-        'acl',
-        'restore',
-        ...groupRefArgs(opts.group),
-        '--holder-pid',
-        `${holder}`,
-        '--json',
-    ];
     // Don't let a teardown helper throw — the caller's reset() must
-    // complete. runSrtWinJson parses stdout before checking the
-    // exit code, so a non-zero exit with the per-path JSON intact
-    // (`acl restore` prints outcomes THEN errors when any path
-    // stayed stamped) still surfaces every entry to reset()'s loop
-    // instead of collapsing to `undefined`. Only spawn-fail /
-    // unparseable output throws → log and return undefined.
+    // complete. runSrtWinJsonAllowFail parses stdout before checking
+    // the exit code, so a non-zero exit with the per-path JSON intact
+    // still surfaces every entry to reset()'s loop. Only spawn-fail
+    // / unparseable output throws → log and return undefined.
     try {
-        const r = runSrtWinJson(args, {
-            timeoutMs: 60000,
-            allowNonZero: true,
-        });
+        const r = runSrtWinJsonAllowFail([
+            'acl',
+            'restore',
+            '--holder-pid',
+            `${holder}`,
+            '--sandbox-user-sid',
+            opts.sandboxUserSid,
+            '--json',
+        ], { timeoutMs: 60000, srtWin: opts.srtWin });
         if (!r.ok) {
             logForDebugging(`[Sandbox Windows] acl restore exited non-zero (per-path ` +
                 `outcomes preserved): ${r.stderr}`, { level: 'error' });
         }
-        return r.json;
+        // Pre- same-user-removal builds emit `{paths, parents}`; post-
+        // emit a flat array. Flatten either so reset()'s logging loop
+        // is shape-agnostic across the transition.
+        return Array.isArray(r.json)
+            ? r.json
+            : [...(r.json.paths ?? []), ...(r.json.parents ?? [])];
     }
     catch (e) {
         logForDebugging(`[Sandbox Windows] acl restore: ${e.message}`, {
@@ -561,22 +597,143 @@ export function restoreWindowsAcl(opts) {
     }
 }
 /**
- * Per-path outcomes that mean the file's DACL was returned to its
- * pre-stamp state (or was already there). Anything else left the
- * stamp in place and should be surfaced to the user.
+ * Apply per-session additive `(OI)(CI)` ALLOW ACEs for the sandbox
+ * user on each path. The sandbox user has no inherent rights on
+ * real-user-owned files; this is what makes the working tree (and
+ * explicit `allowRead`/`allowWrite` paths) reachable from the
+ * child. Idempotent and refcounted via srt-win's `working_aces`
+ * table.
+ *
+ * @throws on exit ≠ 0. On throw the caller should call
+ *   {@link revokeWindowsAcl} to release whatever WAS granted.
  */
-export const WINDOWS_ACL_PATH_OK = new Set([
-    'restored',
-]);
+export function grantWindowsAcl(opts) {
+    const holder = opts.holderPid ?? process.pid;
+    const stdin = JSON.stringify({ read: opts.read, write: opts.write });
+    const r = runSrtWin([
+        'acl',
+        'grant',
+        '--holder-pid',
+        `${holder}`,
+        '--sandbox-user-sid',
+        opts.sandboxUserSid,
+    ], { timeoutMs: 60000, stdin, srtWin: opts.srtWin });
+    logForDebugging(`[Sandbox Windows] acl grant exit=${r.status}: ${r.stderr || r.stdout}`);
+    if (r.status !== 0) {
+        throw new Error(`srt-win acl grant exited ${r.status}: ${r.stderr || r.stdout}`);
+    }
+}
 /**
- * Per-parent-directory outcomes that are expected during normal
- * teardown. `stillHeld` is normal when another active session
- * still references a file under this directory.
+ * Release this holder's grants and remove the sandbox-user ACE on
+ * any path whose refcount falls to zero. Best-effort (does not
+ * throw); logs anomalies.
  */
-export const WINDOWS_ACL_PARENT_OK = new Set(['restored', 'alreadyOriginal', 'stillHeld']);
+export function revokeWindowsAcl(opts) {
+    const holder = opts.holderPid ?? process.pid;
+    try {
+        const r = runSrtWinJsonAllowFail([
+            'acl',
+            'revoke',
+            '--holder-pid',
+            `${holder}`,
+            '--sandbox-user-sid',
+            opts.sandboxUserSid,
+            '--json',
+        ], { timeoutMs: 60000, srtWin: opts.srtWin });
+        if (!r.ok) {
+            logForDebugging(`[Sandbox Windows] acl revoke exited non-zero: ${r.stderr}`, { level: 'error' });
+        }
+        return r.json;
+    }
+    catch (e) {
+        logForDebugging(`[Sandbox Windows] acl revoke: ${e.message}`, {
+            level: 'error',
+        });
+        return undefined;
+    }
+}
 // ────────────────────────────────────────────────────────────────────
 // Wrap
 // ────────────────────────────────────────────────────────────────────
+/**
+ * `safe.directory` entries above this count collapse to a single
+ * `safe.directory=*`. Keeps `GIT_CONFIG_COUNT` (and the `--env`
+ * argv it rides on) bounded when `allowWrite` is wide.
+ */
+const SAFE_DIRECTORY_WILDCARD_THRESHOLD = 8;
+/**
+ * Build the `GIT_CONFIG_COUNT` / `GIT_CONFIG_KEY_<n>` /
+ * `GIT_CONFIG_VALUE_<n>` env-var set for the sandboxed child.
+ *
+ * Emits:
+ *   - `safe.directory=<dir>` for each entry in `safeDirs` (or one
+ *     `safe.directory=*` when the list is long) — the working tree
+ *     is owned by the real user, so git running as `srt-sandbox`
+ *     refuses with "detected dubious ownership" without it.
+ *   - `http.schannelUseSSLCAInfo=true` and
+ *     `http.schannelCheckRevoke=false` when `schannelCa` — makes
+ *     git's default (schannel) backend honor `GIT_SSL_CAINFO`
+ *     without `-c http.sslBackend=openssl`. Revocation is disabled
+ *     because CryptoAPI CRL/OCSP fetches ignore proxy env and would
+ *     be WFP-fenced.
+ *
+ * Composes with an existing `GIT_CONFIG_COUNT` in `baseEnv` by
+ * continuing its numbering; the returned `GIT_CONFIG_COUNT` is the
+ * new total. Under the two-hop launch the broker's own environment
+ * never reaches the child, so `baseEnv` is the caller-supplied
+ * overlay ({@link WindowsSandboxParams.setEnvVars}), not
+ * `process.env`.
+ *
+ * Paths are emitted with forward slashes so the value survives
+ * msys2's env conversion untouched and native git accepts it.
+ */
+export function buildGitConfigEnv(opts) {
+    // An explicit `GIT_CONFIG_COUNT=0` in baseEnv is an opt-out ("no
+    // env-level git config") — respect it rather than overwriting.
+    if (opts.baseEnv?.GIT_CONFIG_COUNT === '0')
+        return {};
+    const parsed = Number.parseInt(opts.baseEnv?.GIT_CONFIG_COUNT ?? '', 10);
+    const start = Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+    let n = start;
+    const out = {};
+    const emit = (key, value) => {
+        out[`GIT_CONFIG_KEY_${n}`] = key;
+        out[`GIT_CONFIG_VALUE_${n}`] = value;
+        n++;
+    };
+    const dirs = [
+        ...new Set(opts.safeDirs
+            .filter((d) => !!d)
+            .map(d => {
+            const fwd = d.replace(/\\/g, '/');
+            const stripped = fwd.replace(/\/+$/, '');
+            // Don't strip the trailing slash off a drive root — `C:`
+            // is drive-relative-cwd, not the root; git wants `C:/`.
+            return /^[A-Za-z]:$/.test(stripped) ? `${stripped}/` : stripped;
+        })),
+    ];
+    if (dirs.length > SAFE_DIRECTORY_WILDCARD_THRESHOLD) {
+        emit('safe.directory', '*');
+    }
+    else {
+        // git matches safe.directory against the REPO TOP-LEVEL exactly,
+        // so a workspace root doesn't cover a nested repo. Emit both the
+        // exact path and the `<dir>/*` glob (git ≥2.46) so any repo
+        // at-or-under a granted dir is trusted.
+        for (const d of dirs) {
+            emit('safe.directory', d);
+            emit('safe.directory', `${d}/*`);
+        }
+    }
+    if (opts.schannelCa) {
+        emit('http.schannelUseSSLCAInfo', 'true');
+        emit('http.schannelCheckRevoke', 'false');
+    }
+    if (n === start)
+        return {};
+    out.GIT_CONFIG_COUNT = String(n);
+    return out;
+}
 /**
  * Build the spawn descriptor for running `command` inside the Windows
  * sandbox: an `argv` array plus the `env` to spawn it with.
@@ -590,65 +747,62 @@ export const WINDOWS_ACL_PARENT_OK = new Set(['restored', 'alreadyOriginal', 'st
  * Proxy configuration is single-sourced by {@link generateProxyEnvVars}
  * (the same canonical builder used on macOS/Linux). `srt-win exec`
  * takes no `--http-proxy` / `--socks-proxy` flags and synthesizes no
- * proxy env; it forwards its own environment to the sandboxed child
- * verbatim. So the full proxy set is merged over the broker's
- * environment here and the child inherits it through the spawn.
+ * proxy env. The two-hop runner starts with the SANDBOX user's
+ * profile env (`USERPROFILE`/`TEMP` isolated) and overlays exactly
+ * what we pass as `--env` — built here from the broker's `PATH` plus
+ * the generated proxy set.
  */
 export function wrapCommandWithSandboxWindows(p) {
-    const exe = getSrtWinPath();
+    const { exe, prependArgs } = p.srtWin ?? resolveSrtWin();
     // Generated proxy + CA-trust env. Single-sourced here so the
     // same object feeds (a) the spawn env merge below and (b) the
-    // explicit `--env` overlay for the two-hop launch.
+    // explicit `--env` overlay for the runner.
     //
-    // Under `asSandboxUser` the CA-bundle path is OMITTED: it points
-    // into the broker's `%TEMP%\srt-sandbox-…`, which the
-    // `srt-sandbox` user cannot read — OpenSSL-backed clients (msys2
-    // curl, `git -c http.sslBackend=openssl`, node, python) would
-    // fail to open it (curl exit 77 etc.). Schannel-level trust comes
-    // from the registry write `srt-win user trust-ca` did at install
-    // time; the env-var bundle layer for the two-hop path lands with
-    // the working-tree/profile-grant work. See WindowsSandboxParams.
-    if (p.asSandboxUser && p.caCertPath !== undefined) {
-        logForDebugging(`[Sandbox Windows] caCertPath '${p.caCertPath}' not forwarded ` +
-            `under asSandboxUser (broker %TEMP% is unreadable by ` +
-            `srt-sandbox); schannel trust via 'srt-win user trust-ca' ` +
-            `is the only CA-trust path for the two-hop launch`);
-    }
-    const generated = envListToObject(generateProxyEnvVars(p.httpProxyPort, p.socksProxyPort, p.asSandboxUser ? undefined : p.caCertPath, p.proxyAuthToken));
+    // The CA trust-bundle path is emitted with forward slashes:
+    // msys2's POSIX-path conversion leaves `C:/…` alone and every
+    // tool we set the var for (curl, git, node, python, …) accepts
+    // forward slashes on Windows; backslashes would be mangled if
+    // the value passes through a bash command line. Schannel-level
+    // trust comes from the registry write `srt-win user trust-ca`
+    // did at install time; the env-var layer here covers the
+    // OpenSSL-backed tools.
+    const generated = envListToObject(generateProxyEnvVars(p.httpProxyPort, p.socksProxyPort, p.caCertPath?.replace(/\\/g, '/'), p.proxyAuthToken));
     // TMPDIR is a POSIX path meant for the macOS/Linux FS sandbox — it
     // serves no purpose on Windows and breaks msys2 tools (mktemp etc.).
     delete generated.TMPDIR;
-    const argv = [exe, 'exec', ...groupRefArgs(p.group)];
-    // Format-validated at the config boundary
-    // (`WindowsConfigSchema.wfpSublayerGuid: z.string().uuid()`),
-    // and again by clap's GUID parser at the binary boundary; the
-    // outer spawn is `shell:false`, so the value is an argv element,
-    // never shell-interpolated.
-    if (p.sublayerGuid)
-        argv.push('--sublayer-guid', p.sublayerGuid);
-    if (p.holderPid !== undefined) {
-        argv.push('--holder-pid', `${p.holderPid}`);
-    }
-    for (const f of p.denyRead ?? [])
-        argv.push('--deny-read', f);
-    for (const f of p.denyWrite ?? [])
-        argv.push('--deny-write', f);
-    if (p.asSandboxUser) {
-        argv.push('--as-sandbox-user');
-        // The two-hop runner starts with the SANDBOX user's profile env
-        // (USERPROFILE/TEMP isolated) and overlays exactly what we pass
-        // as `--env`. The broker does NOT enumerate its own env — the
-        // overlay is built here from the same single source as the
-        // same-user path's spawn env.
-        const overlay = {
-            PATH: process.env.PATH,
-            PATHEXT: process.env.PATHEXT,
-            ...generated,
-        };
-        for (const [k, v] of Object.entries(overlay)) {
-            if (v !== undefined)
-                argv.push('--env', `${k}=${v}`);
-        }
+    // GIT_CONFIG_* set — safe.directory (dubious-ownership) + the
+    // schannel CA knobs. Composed against setEnvVars so a caller
+    // that already emits GIT_CONFIG_COUNT keeps its entries.
+    const gitCfg = buildGitConfigEnv({
+        safeDirs: [p.cwd ?? process.cwd(), ...(p.allowWrite ?? [])],
+        schannelCa: p.caCertPath !== undefined,
+        baseEnv: p.setEnvVars,
+    });
+    const argv = [exe, ...prependArgs, 'exec'];
+    for (const d of p.denyRead ?? [])
+        argv.push('--deny-read', d);
+    for (const d of p.denyWrite ?? [])
+        argv.push('--deny-write', d);
+    // The two-hop runner starts with the SANDBOX user's profile env
+    // (USERPROFILE/TEMP isolated) and overlays exactly what we pass as
+    // `--env`. The broker does NOT enumerate its own env — the overlay
+    // is built here from the broker's PATH, the mode:'mask' sentinel
+    // set, the generated proxy set, and the GIT_CONFIG_* set.
+    // Sentinels precede `generated` so a caller masking e.g.
+    // `HTTPS_PROXY` cannot break the sandbox's own proxy plumbing —
+    // same precedence as the macOS/Linux `env -u … VAR=…
+    // sandbox-exec` order. `gitCfg` is last so its GIT_CONFIG_COUNT
+    // (which composes against setEnvVars) wins.
+    const overlay = {
+        PATH: process.env.PATH,
+        PATHEXT: process.env.PATHEXT,
+        ...(p.setEnvVars ?? {}),
+        ...generated,
+        ...gitCfg,
+    };
+    for (const [k, v] of Object.entries(overlay)) {
+        if (v !== undefined)
+            argv.push('--env', `${k}=${v}`);
     }
     argv.push('--');
     const systemRoot = process.env.SystemRoot ?? 'C:\\Windows';
@@ -660,9 +814,6 @@ export function wrapCommandWithSandboxWindows(p) {
             // string with its own internal quoting; srt-win's `build_cmdline`
             // takes the generic non-cmd branch and MSVCRT-quotes it as a
             // SINGLE argv element, so bash receives it intact as argv[2].
-            // TODO: MSYS2 derives POSIX /tmp from Windows TEMP/TMP itself;
-            // revisit whether any extra TEMP/TMP normalisation is needed for
-            // the bash inner shell under the restricted token.
             argv.push(sh.path, '-c', p.command);
             break;
         case 'pwsh':
@@ -681,43 +832,21 @@ export function wrapCommandWithSandboxWindows(p) {
     }
     // CreateProcessW's lpCommandLine is capped at 32 767 WCHARs.
     // Node's `shell:false` spawn builds it by MSVCRT-quoting each
-    // argv element and joining with spaces; the worst-case quote
-    // overhead per element is +2 (wrapping `"`) plus backslash
-    // doubling before embedded quotes (rare in file paths). A
-    // path-count proxy can't see this — 60 long paths overflow
-    // while 200 short ones fit — so estimate the actual command
-    // line and refuse with the same guidance the old count check
-    // gave. ~30 000 leaves headroom for the quote overhead the
-    // estimate doesn't model.
+    // argv element and joining with spaces; ~30 000 leaves headroom
+    // for the quote overhead the estimate doesn't model.
     const cmdlineEstimate = argv.reduce((n, a) => n + a.length + 3, 0);
     if (cmdlineEstimate > 30000) {
-        const nDeny = (p.denyRead?.length ?? 0) + (p.denyWrite?.length ?? 0);
         throw new Error(`Windows sandbox argv is ~${cmdlineEstimate} chars ` +
-            `(CreateProcessW limit is 32 767). ${nDeny} per-exec ` +
-            `file-deny path(s) ride on this argv — move broad globs to ` +
-            `the session-level filesystem.denyRead/denyWrite (passed to ` +
-            `SandboxManager.initialize(), stdin-passed to \`acl stamp\`) ` +
-            `instead, or shorten the command.`);
-    }
-    // Drop/overwrite denied credential env vars from the inherited
-    // environment FIRST. The proxy assignments below must come LAST
-    // so SRT's own proxy plumbing vars survive even if a caller lists
-    // one of them as a denied credential — same precedence as the
-    // macOS/Linux `env -u … VAR=… sandbox-exec` order.
-    //
-    // Windows env is case-insensitive but Node preserves the OS
-    // casing on enumeration, so a `delete baseEnv['SECRET']` would
-    // miss a `Secret` key. Match by uppercased name instead.
-    const baseEnv = { ...process.env };
-    const unsetUpper = new Set((p.unsetEnvVars ?? []).map(k => k.toUpperCase()));
-    for (const k of Object.keys(baseEnv)) {
-        if (unsetUpper.has(k.toUpperCase()))
-            delete baseEnv[k];
-    }
-    Object.assign(baseEnv, p.setEnvVars ?? {});
-    // Generated proxy vars override any inherited (or just-masked)
-    // ones so the child always routes through this sandbox's proxies.
-    const env = { ...baseEnv, ...generated };
+            `(CreateProcessW limit is 32 767). Shorten the command, ` +
+            `or move broad globs to session-level filesystem.denyRead.`);
+    }
+    // The two-hop runner starts with a FRESH `srt-sandbox` profile
+    // env (`lpEnvironment = NULL` + `LOGON_WITH_PROFILE`), so the
+    // broker process's environment never reaches the child. The
+    // returned `env` is the spawn env for the broker (srt-win)
+    // process only; the child sees the `--env` overlay built into
+    // `argv` above (PATH/PATHEXT + mode:'mask' sentinels + proxy).
+    const env = { ...process.env, ...generated };
     return { argv, env };
 }
 /**
@@ -740,80 +869,71 @@ function envListToObject(list) {
 // ────────────────────────────────────────────────────────────────────
 /**
  * Install instructions, surfaced verbatim in error messages.
- * Tailored to the observed group state: if the install already
- * ran (`created-not-on-token`), only the logout is missing.
  */
-export function windowsInstallInstructions(ref, sublayerGuid, groupState) {
-    if (groupState === 'created-not-on-token') {
-        return (`The discriminator group exists but is not yet in this session's ` +
-            `token. LOG OUT and back in to pick up the new group membership ` +
-            `(it enters TokenGroups at logon). Network is not disrupted ` +
-            `meanwhile — WFP filter-0 PERMITs traffic while the group is absent ` +
-            `from your token.`);
-    }
-    const g = ref.groupSid
-        ? `--group-sid ${ref.groupSid}`
-        : `--name ${ref.groupName ?? DEFAULT_WINDOWS_GROUP_NAME}`;
+export function windowsInstallInstructions(sublayerGuid) {
     const sl = sublayerGuid ? ` --sublayer-guid ${sublayerGuid}` : '';
     return (`Windows sandbox needs a one-time install (one UAC prompt):\n` +
         `  npx sandbox-runtime windows-install\n` +
         `  — or call installWindowsSandbox(), or run ` +
-        `\`srt-win.exe install ${g}${sl}\` directly —\n` +
-        `then LOG OUT and back in (the group SID enters TokenGroups at logon).\n` +
-        `Network is not disrupted before the logout: while the group is absent ` +
-        `from your token, WFP filter-0 PERMITs all traffic.`);
+        `\`srt-win.exe install${sl}\` directly.\n` +
+        `No logout is needed: the WFP filter keys on the dedicated ` +
+        `\`srt-sandbox\` user's SID, so your network is unaffected.`);
 }
 /**
  * Check the Windows backend is ready to sandbox. Errors block
  * `initialize()`; warnings are informational.
  */
-export function checkWindowsDependencies(ref, sublayerGuid) {
+export function checkWindowsDependencies(opts = {}) {
+    const { sublayerGuid } = opts;
     const errors = [];
     const warnings = [];
-    // 1. Binary present.
-    let exe;
+    // 1. Binary present (`resolveSrtWin` throws on a missing
+    // override, `getSrtWinPath` on a missing packaged binary). Resolve
+    // once and reuse for the status calls below.
+    let srtWin;
     try {
-        exe = getSrtWinPath();
+        srtWin = opts.srtWin ?? resolveSrtWin();
     }
     catch (e) {
         return { errors: [e.message], warnings };
     }
-    logForDebugging(`[Sandbox Windows] using srt-win at ${exe}`);
-    // 2. Group ready (exists AND enabled in the caller's token).
-    let gs;
+    logForDebugging(`[Sandbox Windows] using srt-win at ${srtWin.exe}`);
+    // 2. Sandbox user provisioned + credential readable.
+    let us;
     try {
-        gs = getWindowsGroupStatus(ref);
+        us = getWindowsSandboxUserStatus({ srtWin });
     }
     catch (e) {
-        errors.push(`srt-win group status failed: ${e.message}`);
+        errors.push(`srt-win user status failed: ${e.message}`);
         return { errors, warnings };
     }
-    if (gs.state !== 'ready') {
-        errors.push(`Discriminator group is ${gs.state}` +
-            (gs.sid ? ` (sid=${gs.sid})` : '') +
-            `. ` +
-            windowsInstallInstructions(ref, sublayerGuid, gs.state));
+    if (!us.provisioned || !us.credPresent) {
+        errors.push(`Sandbox user is not provisioned (user=${us.provisioned}, ` +
+            `cred=${us.credPresent}). ` +
+            windowsInstallInstructions(sublayerGuid));
     }
-    if (gs.warning)
-        warnings.push(gs.warning);
-    // 3. WFP filters installed under the sublayer.
+    // 3. WFP filters installed under the sublayer. BFE enumeration is
+    // admin-gated; `cannot-read` is informational only — the
+    // BEHAVIORAL check (`verifyWindowsWfpEgress`) runs at
+    // `initialize()` and is what actually fails closed.
     let ws;
     try {
-        ws = getWindowsWfpStatus({ sublayerGuid });
+        ws = getWindowsWfpStatus({ sublayerGuid, srtWin });
     }
     catch (e) {
         errors.push(`srt-win wfp status failed: ${e.message}`);
         return { errors, warnings };
     }
-    if (ws.state !== 'installed') {
-        // If the group is also not-ready, the group-state error above
-        // already gave the right instruction; don't repeat. Only
-        // surface a separate WFP error when group IS ready (i.e.
-        // someone uninstalled filters but kept the group).
-        if (gs.state === 'ready') {
+    if (ws.state === 'cannot-read') {
+        logForDebugging(`[Sandbox Windows] wfp status cannot-read (non-elevated): ${ws.hint}`);
+    }
+    else if (ws.state !== 'installed') {
+        // 'absent'. If the user is also not-provisioned, the user-state
+        // error above already gave the right instruction; don't repeat.
+        if (us.provisioned && us.credPresent) {
             errors.push(`WFP filters not installed under sublayer ` +
                 `${sublayerGuid ?? '(default)'}. ` +
-                windowsInstallInstructions(ref, sublayerGuid, 'absent'));
+                windowsInstallInstructions(sublayerGuid));
         }
     }
     else if (ws.portRange) {