@sysid/sandbox-runtime-improved 0.0.61-sysid.1 → 0.0.64-sysid.1

package/dist/sandbox/sandbox-manager.js

@@ -4,7 +4,7 @@ import { createMuxProxyServer } from './mux-proxy.js';
 import { listenInRange } from './listen-in-range.js';
 import { SentinelRegistry } from './credential-sentinel.js';
 import { MaskedFileStore, buildMaskedFileBinds, } from './credential-mask-files.js';
-import { createMitmCA, disposeMitmCA } from './mitm-ca.js';
+import { createMitmCA, CRL_PATH, disposeMitmCA, } from './mitm-ca.js';
 import { logForDebugging } from '../utils/debug.js';
 import { whichSync } from '../utils/which.js';
 import { getPlatform, getWslVersion } from '../utils/platform.js';
@@ -12,12 +12,14 @@ import * as fs from 'fs';
 import { randomBytes, X509Certificate } from 'node:crypto';
 import { wrapCommandWithSandboxLinux, initializeLinuxNetworkBridge, checkLinuxDependencies, cleanupBwrapMountPoints, } from './linux-sandbox-utils.js';
 import { wrapCommandWithSandboxMacOS, startMacOSSandboxLogMonitor, } from './macos-sandbox-utils.js';
-import { checkWindowsDependencies, wrapCommandWithSandboxWindows, parseWindowsBinShell, expandWindowsFsDenyPaths, stampWindowsAcl, restoreWindowsAcl, getWindowsSandboxUserStatus, getWindowsSandboxCaCert, WINDOWS_ACL_PATH_OK, WINDOWS_ACL_PARENT_OK, DEFAULT_WINDOWS_GROUP_NAME, DEFAULT_WINDOWS_PROXY_PORT_RANGE, } from './windows-sandbox-utils.js';
-import { getDefaultWritePaths, containsGlobChars, removeTrailingGlobSuffix, expandGlobPattern, normalizePathForSandbox, ensureSandboxTmpdir, } from './sandbox-utils.js';
+import { startLinuxSandboxViolationMonitor, } from './linux-violation-monitor.js';
+import { checkWindowsDependencies, wrapCommandWithSandboxWindows, parseWindowsBinShell, expandWindowsFsPaths, stampWindowsAcl, restoreWindowsAcl, grantWindowsAcl, revokeWindowsAcl, getWindowsSandboxUserStatus, getWindowsSandboxCaCert, verifyWindowsWfpEgress, resolveSrtWin, DEFAULT_WINDOWS_PROXY_PORT_RANGE, } from './windows-sandbox-utils.js';
+import { getDefaultWritePaths, containsGlobChars, removeTrailingGlobSuffix, expandGlobPattern, ensureSandboxTmpdir, } from './sandbox-utils.js';
 import { SandboxViolationStore } from './sandbox-violation-store.js';
 import { canonicalizeHost, isValidHost, redactUrl, resolveParentProxy, } from './parent-proxy.js';
 import { matchesDomainPattern } from './domain-pattern.js';
 import { EOL } from 'node:os';
+import { dirname } from 'node:path';
 // ============================================================================
 // Private Module State
 // ============================================================================
@@ -29,27 +31,36 @@ let managerContext;
 let initializationPromise;
 let cleanupRegistered = false;
 let logMonitorShutdown;
+let linuxMonitor;
 let parentProxy;
 let mitmCA;
 // Per-session proxy auth token. Generated at proxy start, exported only into
 // the sandbox child env, checked on every CONNECT/request — so a host process
 // dialing 127.0.0.1:<proxyPort> can't reach the filter callback.
 let proxyAuthToken;
-// Windows: the resolved {denyRead, denyWrite} that was actually
-// passed to `srt-win acl stamp` at initialize(). `undefined` means
-// no stamp was applied (gates passing `--holder-pid` to exec —
-// which engages the per-exec dir/file fence — and running `acl
-// restore` at reset()).
+// Windows: the resolved access set that was actually applied at
+// initialize(). `undefined` means no stamp/grant was applied
+// (gates running `acl restore`/`acl revoke` at reset()).
 let windowsFsStampedSet;
-// The group reference that was passed to `srt-win acl stamp`.
-// reset() restores against THIS, not the current config — a
-// group change between stamp and restore would otherwise
-// target the wrong group's broker DACL.
-let windowsFsStampedGroup;
+// The sandbox user SID captured at initialize(). reset() uses this
+// so a config change between init and reset can't strand ACEs
+// under a different SID.
+let windowsFsSbUserSid;
 // The RAW config inputs that produced `windowsFsStampedSet`.
 // updateConfig() compares these (not the resolved set) so it never
 // re-expands globs — see `sameWindowsStampSet`.
 let windowsFsRawInputs;
+// `verifyWindowsWfpEgress()` is once per PROCESS (it spawns a
+// CreateProcessWithLogonW runner; first call may create the sandbox
+// user's profile). The WFP fence is install-scoped, not config- or
+// session-scoped — reset() does NOT clear this, so updateConfig()'s
+// reset+reinit and the test suite's per-test reset() don't re-verify.
+let windowsWfpVerified = false;
+// Resolved once at initialize() (`resolveSrtWin` stats the disk).
+// Captured so wrapWithSandboxArgv/reset() don't re-resolve per call
+// and so reset()'s revoke/restore addresses the SAME binary the
+// grants/stamps were applied with even if `config` mutated between.
+let srtWinSpawn;
 const sandboxViolationStore = new SandboxViolationStore();
 // Per-session sentinel↔real-value map for masked credentials. Lives only in
 // process memory; never written to disk or logged. Cleared on reset().
@@ -288,88 +299,165 @@ async function initialize(runtimeConfig, sandboxAskCallback, enableLogMonitor =
         logMonitorShutdown = startMacOSSandboxLogMonitor(sandboxViolationStore.addViolation.bind(sandboxViolationStore), config.ignoreViolations);
         logForDebugging('Started macOS sandbox log monitor');
     }
+    if (enableLogMonitor && getPlatform() === 'linux') {
+        linuxMonitor = startLinuxSandboxViolationMonitor(sandboxViolationStore.addViolation.bind(sandboxViolationStore), {
+            // apply-seccomp's observer reports every write-intent syscall
+            // (allowed or not). Only paths bwrap would actually refuse — outside
+            // allowWrite or inside a denyWrite carve-out — go to the store.
+            allowWritePaths: [
+                ...getDefaultWritePaths(),
+                ...config.filesystem.allowWrite,
+            ],
+            denyWritePaths: config.filesystem.denyWrite,
+            ignoreViolations: config.ignoreViolations,
+        });
+        // Don't block initialization on listen() — wrap-time checks
+        // fs.existsSync(observeSocketPath) and degrades gracefully.
+        void linuxMonitor.ready;
+        logForDebugging('Started Linux seccomp violation monitor');
+    }
     // Register cleanup handlers first time
     registerCleanup();
-    // Windows: apply the file-deny stamp set BEFORE any sandboxed
-    // child can be spawned. Synchronous (spawnSync) and independent
-    // of the network proxies, so do it here rather than inside the
-    // initializationPromise. Throws on any failure (including a
-    // partial — exit 2 means at least one input was skipped):
-    // fail-closed at session start.
+    // Windows: validate provisioning + filesystem config BEFORE any
+    // sandboxed child can be spawned. Doing this at initialize() (not
+    // wrap-time) means the host gets a single actionable error before
+    // any per-exec work happens, instead of exit-15 on every command.
     if (getPlatform() === 'windows') {
-        // Separate-user opt-in: refuse early when the config asks for
-        // it but the account isn't provisioned. Doing this at
-        // initialize() (not wrap-time) means the host gets a single
-        // actionable error before any per-exec work happens, instead of
-        // exit-15 on every command.
-        if (runtimeConfig.windows?.asSandboxUser) {
-            const u = getWindowsSandboxUserStatus();
-            if (!u.provisioned || !u.credPresent) {
+        // Resolve once (stats disk); captured module-level for wrap/reset.
+        srtWinSpawn = resolveSrtWin(runtimeConfig.windows?.srtWin);
+        const srtWin = srtWinSpawn;
+        const u = getWindowsSandboxUserStatus({ srtWin });
+        if (!u.provisioned || !u.credPresent) {
+            config = undefined;
+            throw new Error(`Windows sandbox user is not provisioned (user=` +
+                `${u.provisioned}, cred=${u.credPresent}). Run \`npx ` +
+                `sandbox-runtime windows-install\` (one UAC prompt) to ` +
+                `provision it.`);
+        }
+        // Behavioral proof the WFP egress fence is active for the
+        // sandbox user — BFE enumeration (`wfp status`) is admin-gated,
+        // so this is the non-elevated readiness check. Fails closed: a
+        // stale install (user provisioned but filters since removed)
+        // throws here instead of running every exec with full egress.
+        // After the user-status check so the not-provisioned message is
+        // the actionable one. Once per process — the fence is install-
+        // scoped, not session-scoped.
+        if (!windowsWfpVerified) {
+            try {
+                await verifyWindowsWfpEgress({
+                    proxyPortRange: runtimeConfig.windows?.proxyPortRange,
+                    srtWin,
+                });
+            }
+            catch (e) {
                 config = undefined;
-                throw new Error(`windows.asSandboxUser is set but the sandbox user is not ` +
-                    `provisioned (user=${u.provisioned}, cred=${u.credPresent}). ` +
-                    `Run \`npx sandbox-runtime windows-install\` (one UAC ` +
-                    `prompt) to provision it.`);
+                throw e;
             }
-            // schannel-level trust under the sandbox user is install-time
-            // (cert lifecycle = sandbox-user lifecycle), not per-session.
-            // The env-var trust layer covers OpenSSL clients regardless,
-            // but System32 curl / IWR / .NET / default-backend git only
-            // trust what's in the sandbox user's `CurrentUser\Root` —
-            // which `srt-win exec` does not (and must not) write. Gate
-            // only on `asSandboxUser`: the same-user path lands on the
-            // REAL user's Root, which is out of scope (env-var trust
-            // only). Compare thumbprints so a stale install-time CA
-            // doesn't pass the gate while schannel rejects the session's
-            // proxy-minted leaves.
-            if (runtimeConfig.network.tlsTerminate && mitmCA) {
-                const installed = getWindowsSandboxCaCert(u);
-                const sessionThumb = new X509Certificate(mitmCA.certPem).fingerprint
-                    .replace(/:/g, '')
-                    .toUpperCase();
-                if (!installed) {
-                    config = undefined;
-                    throw new Error(`tlsTerminate with windows.asSandboxUser requires the ` +
-                        `sandbox to be installed with this CA (thumb=` +
-                        `${sessionThumb}): run \`srt-win user trust-ca ` +
-                        `${mitmCA.certPath}\`. Per-exec installs into the ` +
-                        `sandbox user's Root store are not supported.`);
-                }
-                if (installed.thumb !== sessionThumb) {
-                    config = undefined;
-                    throw new Error(`tlsTerminate with windows.asSandboxUser: the sandbox's ` +
-                        `installed CA (thumb=${installed.thumb}) doesn't match ` +
-                        `this session's CA (thumb=${sessionThumb}). Run ` +
-                        `\`srt-win user trust-ca ${mitmCA.certPath}\` to ` +
-                        `update it.`);
-                }
+            windowsWfpVerified = true;
+        }
+        // schannel-level trust under the sandbox user is install-time
+        // (cert lifecycle = sandbox-user lifecycle), not per-session.
+        // System32 curl / IWR / .NET / default-backend git only trust
+        // what's in the sandbox user's `CurrentUser\Root` — which
+        // `srt-win exec` does not (and must not) write. Compare
+        // thumbprints so a stale install-time CA doesn't pass the gate
+        // while schannel rejects the session's proxy-minted leaves.
+        if (runtimeConfig.network.tlsTerminate && mitmCA) {
+            const installed = getWindowsSandboxCaCert(u);
+            const sessionThumb = new X509Certificate(mitmCA.certPem).fingerprint
+                .replace(/:/g, '')
+                .toUpperCase();
+            if (!installed) {
+                config = undefined;
+                throw new Error(`tlsTerminate on Windows requires the sandbox to be ` +
+                    `installed with this CA (thumb=${sessionThumb}): run ` +
+                    `\`srt-win user trust-ca ${mitmCA.certPath}\`. Per-exec ` +
+                    `installs into the sandbox user's Root store are not ` +
+                    `supported.`);
+            }
+            if (installed.thumb !== sessionThumb) {
+                config = undefined;
+                throw new Error(`tlsTerminate on Windows: the sandbox's installed CA ` +
+                    `(thumb=${installed.thumb}) doesn't match this ` +
+                    `session's CA (thumb=${sessionThumb}). Run \`srt-win ` +
+                    `user trust-ca ${mitmCA.certPath}\` to update it.`);
             }
         }
+        // Filesystem grants/denies — additive sandbox-user ACEs.
         try {
-            const deny = computeWindowsFsDenySet(runtimeConfig);
-            if (deny.denyRead.length > 0 || deny.denyWrite.length > 0) {
-                const group = getWindowsGroupRef();
+            const acc = computeWindowsFsAccessSet(runtimeConfig);
+            // The trust bundle the CA-trust env vars point at
+            // (NODE_EXTRA_CA_CERTS etc.) must be readable by the
+            // srt-sandbox child. It's written into the broker's %TEMP%,
+            // which the sandbox user has no inherent rights on, so it
+            // rides the same session-level `acl grant` read-set as the
+            // working tree. Granted on the mkdtemp DIR (not the file)
+            // so the (OI)(CI) ACE covers both the file open AND the
+            // parent-directory list that cmd's `type`/`FindFirstFile`
+            // does before opening. Mirrors the mac/linux
+            // `expandedAllowRead` push in wrapWithSandbox.
+            if (mitmCA) {
+                acc.grantRead.push(dirname(mitmCA.trustBundlePath));
+            }
+            // `u` was fetched once above for the provisioning gate; the
+            // same status carries the SID — don't re-spawn `srt-win user
+            // status` here.
+            if (!u.sid) {
+                throw new Error('sandbox user SID missing from `srt-win user status` ' +
+                    '(provisioned but in an inconsistent state)');
+            }
+            const sb = u.sid;
+            // Record module-level state BEFORE the first acl call so the
+            // catch's best-effort revoke/restore can address whatever
+            // partially landed.
+            windowsFsSbUserSid = sb;
+            // Grant FIRST so the sandbox user has working-tree access by
+            // the time the deny stamp runs. The two are independent
+            // refcounted state-DB sets keyed on the same holder PID.
+            if (acc.grantRead.length > 0 || acc.grantWrite.length > 0) {
+                grantWindowsAcl({
+                    sandboxUserSid: sb,
+                    read: acc.grantRead,
+                    write: acc.grantWrite,
+                    srtWin,
+                });
+            }
+            if (acc.denyRead.length > 0 || acc.denyWrite.length > 0) {
                 stampWindowsAcl({
-                    group,
-                    denyRead: deny.denyRead,
-                    denyWrite: deny.denyWrite,
+                    sandboxUserSid: sb,
+                    denyRead: acc.denyRead,
+                    denyWrite: acc.denyWrite,
+                    srtWin,
                 });
-                // Only record the set AFTER a successful stamp — the
-                // catch below clears `config`, and a non-undefined
-                // stampedSet would leave reset()/updateConfig() seeing a
-                // stamp that never landed.
-                windowsFsStampedSet = deny;
-                windowsFsStampedGroup = group;
-                logForDebugging(`[Sandbox Windows] file deny stamped: ` +
-                    `${deny.denyRead.length} denyRead, ${deny.denyWrite.length} denyWrite`);
+            }
+            // Only record when something was actually applied — gates
+            // running revoke/restore at reset(). Recorded AFTER success —
+            // the catch below clears `config`, and a non-undefined
+            // stampedSet would leave reset()/updateConfig() seeing state
+            // that never landed.
+            const anyApplied = acc.grantRead.length > 0 ||
+                acc.grantWrite.length > 0 ||
+                acc.denyRead.length > 0 ||
+                acc.denyWrite.length > 0;
+            if (anyApplied) {
+                windowsFsStampedSet = acc;
+                logForDebugging(`[Sandbox Windows] fs applied: ` +
+                    `${acc.grantWrite.length} grantWrite, ` +
+                    `${acc.grantRead.length} grantRead, ` +
+                    `${acc.denyRead.length} denyRead, ` +
+                    `${acc.denyWrite.length} denyWrite`);
             }
             windowsFsRawInputs = rawWindowsFsInputs(runtimeConfig);
         }
         catch (e) {
-            // Best-effort release of whatever WAS stamped before the
-            // failure (exit-2 partial stamps the resolvable inputs;
-            // harmless if nothing was stamped — no holds for this PID).
-            restoreWindowsAcl({ group: getWindowsGroupRef() });
+            // Best-effort release of whatever WAS applied before the
+            // failure (exit-2 partial stamps/grants the resolvable
+            // inputs; harmless if nothing was — no holds for this PID).
+            if (windowsFsSbUserSid) {
+                revokeWindowsAcl({ sandboxUserSid: windowsFsSbUserSid, srtWin });
+                restoreWindowsAcl({ sandboxUserSid: windowsFsSbUserSid, srtWin });
+            }
+            windowsFsSbUserSid = undefined;
             config = undefined;
             throw e;
         }
@@ -402,6 +490,18 @@ async function initialize(runtimeConfig, sandboxAskCallback, enableLogMonitor =
                 : undefined;
             const httpProxyPort = config.network.httpProxyPort ?? muxPort;
             const socksProxyPort = config.network.socksProxyPort ?? muxPort;
+            // Leaves are minted lazily per-CONNECT (after this point), so setting
+            // the CDP URL now means every leaf carries it. See MitmCA.crlUrl.
+            // Windows-only: on Linux the child runs under bwrap --unshare-net and
+            // reaches the proxy via a socat bridge on a fixed netns port, so a
+            // host-namespace mux port would be unreachable — worse than no CDP,
+            // since a Schannel-analog client (Java, OpenSSL with CRL_CHECK) then
+            // hard-fails "CRL fetch error" instead of soft-passing "no CDP". macOS
+            // has no in-tree Schannel-analog client. Also gated on `muxPort`: an
+            // external `network.httpProxyPort` doesn't answer /srt.crl.
+            if (mitmCA && muxPort !== undefined && getPlatform() === 'windows') {
+                mitmCA.crlUrl = `http://127.0.0.1:${muxPort}${CRL_PATH}`;
+            }
             if (config.network.httpProxyPort !== undefined) {
                 logForDebugging(`Using external HTTP proxy on port ${httpProxyPort}`);
             }
@@ -444,16 +544,6 @@ function isSupportedPlatform() {
     }
     return platform === 'macos' || platform === 'windows';
 }
-/**
- * Resolve the Windows group reference from config. Used by both the
- * dependency check and `wrapWithSandbox` so they agree.
- */
-function getWindowsGroupRef() {
-    return {
-        groupName: config?.windows?.groupName ?? DEFAULT_WINDOWS_GROUP_NAME,
-        groupSid: config?.windows?.groupSid,
-    };
-}
 function isSandboxingEnabled() {
     // Sandboxing is enabled if config has been set (via initialize())
     return config !== undefined;
@@ -487,7 +577,18 @@ function checkDependencies(ripgrepConfig) {
         warnings.push(...linuxDeps.warnings);
     }
     else if (platform === 'windows') {
-        const winDeps = checkWindowsDependencies(getWindowsGroupRef(), config?.windows?.wfpSublayerGuid);
+        let srtWin;
+        try {
+            srtWin = resolveSrtWin(config?.windows?.srtWin);
+        }
+        catch (e) {
+            errors.push(e.message);
+            return { errors, warnings };
+        }
+        const winDeps = checkWindowsDependencies({
+            sublayerGuid: config?.windows?.sublayerGuid ?? config?.windows?.wfpSublayerGuid,
+            srtWin,
+        });
         errors.push(...winDeps.errors);
         warnings.push(...winDeps.warnings);
     }
@@ -539,10 +640,13 @@ function getCredentialRestrictions(credentials, allowedDomains) {
     // Masked files: read the real bytes on the host, register a sentinel,
     // write it to a fake file in the manager-owned temp dir. Missing/unreadable
     // entries are skipped (same posture as an unset masked env var).
+    // degradeToDenyPaths carries paths whose extract pattern matched
+    // nothing with onExtractNoMatch: "deny" — merged into denyReadPaths
+    // below so both the read-deny config and the platform builders see them.
     const files = credentials.files ?? [];
-    const maskedFileBinds = buildMaskedFileBinds(files, allowedDomains ?? [], sentinelRegistry, maskedFileStore);
+    const { binds: maskedFileBinds, degradeToDenyPaths } = buildMaskedFileBinds(files, allowedDomains ?? [], sentinelRegistry, maskedFileStore);
     return {
-        denyReadPaths,
+        denyReadPaths: [...new Set([...denyReadPaths, ...degradeToDenyPaths])],
         unsetEnvVars: [...new Set(unsetEnvVars)],
         setEnvVars,
         maskedFileBinds,
@@ -560,13 +664,6 @@ function getCredentialDenyReadPaths(credentials) {
     const files = credentials?.files ?? [];
     return [...new Set(files.filter(f => f.mode === 'deny').map(f => f.path))];
 }
-/** Order-insensitive string-set equality. */
-function setEq(a, b) {
-    if (a.length !== b.length)
-        return false;
-    const bs = new Set(b);
-    return a.every(v => bs.has(v));
-}
 /**
  * Union the explicit `filesystem.denyRead` with credential-derived
  * deny paths. The single source of "what files does this config
@@ -650,78 +747,81 @@ function getFsWriteConfig() {
     };
 }
 /**
- * Build the Windows file-deny set from `runtimeConfig`. Globs are
- * expanded to concrete file paths (point-in-time — a file
- * appearing after this returns is NOT covered). Throws on any
- * directory match (file-only for now) and on any unsupported
- * config field that would otherwise be silently dropped.
- *
- * `denyRead` ← `filesystem.denyRead` ∪ `credentials`-derived deny
- *              paths (via {@link getCredentialDenyReadPaths}).
- * `denyWrite` ← `filesystem.denyWrite`.
+ * Build the Windows file-access set (deny stamps + sandbox-user
+ * grants) from `runtimeConfig`. Globs are expanded to concrete
+ * paths (point-in-time — a path appearing after this returns is NOT
+ * covered). Directory targets are accepted (the `(OI)(CI)` ACEs
+ * cover the subtree).
  *
- * Not supported on Windows (throws if non-empty so the caller
- * never silently runs with a weaker-than-configured policy):
- *   - `filesystem.allowRead` (re-allow within a denied region)
- *   - `filesystem.allowWrite` as a write allow-list — the Windows
- *     backend is deny-listed only; the sandboxed child writes
- *     wherever the host user can, minus `denyWrite`.
+ * The sandbox user has no inherent rights on real-user-owned files,
+ * so `allowWrite` (the working-tree roots) becomes a per-session
+ * `MODIFY_NO_FDC` ALLOW ACE for `<sb-SID>`, `allowRead` a
+ * `READ|EXECUTE` ALLOW ACE, and `denyRead`/`denyWrite` become an
+ * explicit DENY ACE for `<sb-SID>` on the target plus a
+ * `(OI)(CI) FILE_DELETE_CHILD` DENY on its parent.
  */
-function computeWindowsFsDenySet(c) {
+function computeWindowsFsAccessSet(c) {
     const fs = c.filesystem;
     // filesystem.disabled bypasses ALL filesystem rule generation —
     // same as the macOS/Linux wrapWithSandbox path (readConfig /
     // writeConfig left undefined). On Windows this means no ACL
-    // stamp; credential FILE denies are dropped along with the rest
-    // (credential ENV scrubbing is independent and still applied at
-    // wrap time). Returning empty here means initialize() applies no
-    // stamp.
+    // stamp/grant; credential FILE denies are dropped along with the
+    // rest (credential ENV: mode:'deny' is structural under the
+    // fresh srt-sandbox env; mode:'mask' sentinels are passed via
+    // the --env overlay).
     if (fs?.disabled) {
-        return { denyRead: [], denyWrite: [] };
+        return { grantRead: [], grantWrite: [], denyRead: [], denyWrite: [] };
     }
-    if (fs?.allowRead?.length) {
-        throw new Error(`filesystem.allowRead (re-allow within denyRead) is not supported ` +
-            `on Windows. Remove the entries or narrow filesystem.denyRead to ` +
-            `exclude them.`);
-    }
-    if (fs?.allowWrite?.length) {
-        throw new Error(`filesystem.allowWrite is not supported on Windows — the Windows ` +
-            `sandbox is deny-listed only (the child writes wherever the host ` +
-            `user can, minus filesystem.denyWrite). Remove the allowWrite ` +
-            `entries.`);
-    }
-    const denyRead = expandWindowsFsDenyPaths([
+    const expand = expandWindowsFsPaths;
+    const denyRead = expand([
         ...new Set([
             ...(fs?.denyRead ?? []),
             ...getCredentialDenyReadPaths(c.credentials),
         ]),
     ]);
-    const denyWrite = expandWindowsFsDenyPaths(fs?.denyWrite ?? []);
-    return { denyRead, denyWrite };
+    const denyWrite = expand(fs?.denyWrite ?? []);
+    return {
+        // `allowRead` also serves as `allowWithinDeny`: a file under a
+        // denied dir gets an explicit ALLOW ACE for the sandbox user,
+        // and explicit DENY on the parent doesn't override it because
+        // the recompose chokepoint orders deny-before-allow per-path.
+        grantRead: expand(fs?.allowRead ?? []),
+        grantWrite: expand(fs?.allowWrite ?? []),
+        denyRead,
+        denyWrite,
+    };
 }
 /**
  * Snapshot the raw config fields that feed
- * {@link computeWindowsFsDenySet}. Used by updateConfig() to
+ * {@link computeWindowsFsAccessSet}. Used by updateConfig() to
  * short-circuit the resolved-set diff (which re-runs glob
  * expansion) when nothing relevant changed.
  */
 function rawWindowsFsInputs(c) {
-    // Keyed exactly on what {@link computeWindowsFsDenySet} reads:
-    // disabled, denyRead, denyWrite, and the credential file-deny
-    // paths. `network.allowedDomains` does NOT feed file-deny
-    // (only mask injectHosts), so a network-only updateConfig
-    // hits the cache.
+    // Keyed exactly on what {@link computeWindowsFsAccessSet} reads.
+    // `network.allowedDomains` does NOT feed file-deny (only mask
+    // injectHosts), so a network-only updateConfig hits the cache.
     return {
         disabled: c.filesystem.disabled ?? false,
         denyRead: [...c.filesystem.denyRead],
         denyWrite: [...c.filesystem.denyWrite],
+        allowRead: [...(c.filesystem.allowRead ?? [])],
+        allowWrite: [...c.filesystem.allowWrite],
         credFiles: getCredentialDenyReadPaths(c.credentials),
     };
 }
+function setEq(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const s = new Set(a);
+    return b.every(x => s.has(x));
+}
 function sameRawWindowsFsInputs(a, b) {
     return (a.disabled === b.disabled &&
         setEq(a.denyRead, b.denyRead) &&
         setEq(a.denyWrite, b.denyWrite) &&
+        setEq(a.allowRead, b.allowRead) &&
+        setEq(a.allowWrite, b.allowWrite) &&
         setEq(a.credFiles, b.credFiles));
 }
 /**
@@ -987,6 +1087,7 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
                 seccompConfig: getSeccompConfig(),
                 bwrapPath: config?.bwrapPath,
                 socatPath: config?.socatPath,
+                observeSocketPath: linuxMonitor?.observeSocketPath,
                 abortSignal,
             });
         case 'windows':
@@ -1008,14 +1109,22 @@ async function wrapWithSandbox(command, binShell, customConfig, abortSignal) {
  * `spawn(argv[0], argv.slice(1), {shell: false, env})`.
  *
  * On Windows this is the ONLY supported wrap method (see
- * {@link wrapWithSandbox}); `env` carries the full proxy set that the
- * sandboxed child inherits (`srt-win exec` forwards its environment
- * verbatim — see {@link wrapCommandWithSandboxWindows}). On
+ * {@link wrapWithSandbox}); `env` is the broker process's spawn env
+ * — the sandboxed child gets a fresh `srt-sandbox` profile env with
+ * only the `--env` overlay baked into `argv` (see
+ * {@link wrapCommandWithSandboxWindows}). On
  * macOS/Linux `argv` is `[binShell, '-c', <wrapWithSandbox result>]`
  * (proxy env is baked into that command) and `env` is the unchanged
  * `process.env`, so callers can spawn uniformly across platforms.
+ *
+ * @param cwd the working directory the caller will spawn the result
+ *   with. On Windows the child's cwd is whatever the caller passes
+ *   as the spawn `{cwd:}` option (there is no `--cwd` flag), and
+ *   the `safe.directory` git-config injection derives from this — so
+ *   pass the same value here as to `spawn({cwd})`. Defaults to
+ *   `process.cwd()`. Currently unused on macOS/Linux.
  */
-async function wrapWithSandboxArgv(command, binShell, customConfig, abortSignal) {
+async function wrapWithSandboxArgv(command, binShell, customConfig, abortSignal, cwd) {
     const platform = getPlatform();
     if (platform === 'windows') {
         const hasNetworkConfig = customConfig?.network?.allowedDomains !== undefined ||
@@ -1026,44 +1135,34 @@ async function wrapWithSandboxArgv(command, binShell, customConfig, abortSignal)
         const credentialRestrictions = getCredentialRestrictions(customConfig?.credentials ?? config?.credentials, customConfig?.network?.allowedDomains ?? config?.network?.allowedDomains);
         // Per-exec FILE denies (customConfig only — the session-level
         // config's denies were already stamped at initialize()).
-        // Unlike the session-level set, paths are passed through
-        // VERBATIM (normalized only): no glob expansion, no
-        // existsSync filter. `srt-win exec`'s
-        // `canonicalize_deny_targets` is the authority — it
-        // hard-fails on glob/dir/nonexistent so a missing path is a
-        // visible caller error, not a silent skip (the session-level
-        // expand-and-drop-missing was for tolerant point-in-time
-        // globs at init; per-exec is "deny THIS one command" and a
-        // path that doesn't resolve is a bug the caller must see).
+        // Paths go through `expandWindowsFsPaths` — the SAME
+        // chokepoint the session-level set uses (point-in-time glob
+        // expand, normalize, missing→drop) — so a per-exec entry
+        // resolves identically to its session-level equivalent.
+        // macOS/Linux per-exec already reuses session-level expansion;
+        // Windows now matches.
         //
         // The dedup against `windowsFsStampedSet` is an OPTIMIZATION,
         // not a correctness gate: re-stamping a session-held path
-        // under the exec's distinct holder is refcount-safe but
-        // wastes a SetSecurityInfo round-trip. The mask-escalation /
-        // hardlink-alias guard lives in srt-win's `ensure_stamped`
-        // (`refuse_escalation = true`), NOT here — canonical-path
-        // identity and concurrent holders are only visible to Rust.
+        // under the exec's distinct holder is refcount-safe but wastes
+        // a SetSecurityInfo round-trip.
         //
         // filesystem.disabled bypasses ALL filesystem rule generation
         // — including credential-derived file denies — same ordering
-        // as session-level `computeWindowsFsDenySet` (credential ENV
-        // scrubbing is independent and still applied at wrap time).
-        // allowRead/allowWrite throw, also matching session-level:
-        // the Windows file-deny sandbox is deny-only.
+        // as session-level `computeWindowsFsAccessSet` (credential
+        // ENV: mode:'deny' is structural under the fresh srt-sandbox
+        // env; mode:'mask' sentinels are passed via the --env
+        // overlay).
+        // Per-exec allowRead/allowWrite throw — `srt-win exec` only
+        // exposes `--deny-*`; per-exec grants are not implemented.
         const fsCfg = customConfig?.filesystem;
         let perExecDenyRead = [];
         let perExecDenyWrite = [];
         if (!fsCfg?.disabled) {
-            if (fsCfg?.allowRead?.length) {
-                throw new Error(`Per-exec filesystem.allowRead (re-allow within denyRead) is ` +
-                    `not supported on Windows. Remove the entries or narrow ` +
-                    `filesystem.denyRead to exclude them.`);
-            }
-            if (fsCfg?.allowWrite?.length) {
-                throw new Error(`Per-exec filesystem.allowWrite is not supported on Windows — ` +
-                    `the Windows sandbox is deny-listed only (the child writes ` +
-                    `wherever the host user can, minus filesystem.denyWrite). ` +
-                    `Remove the allowWrite entries.`);
+            if (fsCfg?.allowRead?.length || fsCfg?.allowWrite?.length) {
+                throw new Error(`Per-exec filesystem.allowRead/allowWrite is not supported ` +
+                    `on Windows — \`srt-win exec\` only exposes per-exec ` +
+                    `denies. Set them at the session level (initialize()).`);
             }
             const rawRead = [
                 ...(fsCfg?.denyRead ?? []),
@@ -1071,18 +1170,13 @@ async function wrapWithSandboxArgv(command, binShell, customConfig, abortSignal)
             ];
             const rawWrite = fsCfg?.denyWrite ?? [];
             // Skip on the dominant path (no per-exec fs or
-            // credential-file deny) — this used to call
-            // `computeWindowsFsDenySet` (glob walk + statSync per
-            // match) on every exec, including with
-            // `customConfig === undefined`.
+            // credential-file deny).
             if (rawRead.length > 0 || rawWrite.length > 0) {
                 const sessRead = new Set(windowsFsStampedSet?.denyRead ?? []);
                 const sessWrite = new Set(windowsFsStampedSet?.denyWrite ?? []);
-                const norm = (raw) => [
-                    ...new Set(raw.map(normalizePathForSandbox)),
-                ];
-                perExecDenyRead = norm(rawRead).filter(p => !sessRead.has(p));
-                perExecDenyWrite = norm(rawWrite).filter(p => !sessRead.has(p) && !sessWrite.has(p));
+                const expand = expandWindowsFsPaths;
+                perExecDenyRead = expand(rawRead).filter(p => !sessRead.has(p));
+                perExecDenyWrite = expand(rawWrite).filter(p => !sessRead.has(p) && !sessWrite.has(p));
             }
         }
         // Per-exec deny rides on argv (`acl stamp` reads stdin, but
@@ -1090,37 +1184,31 @@ async function wrapWithSandboxArgv(command, binShell, customConfig, abortSignal)
         // length check lives in `wrapCommandWithSandboxWindows`
         // where the full argv (incl. shell + user command) is known.
         //
-        // Credential env restrictions are passed INTO the wrapper so it
-        // can apply them BEFORE merging the proxy env (same precedence
-        // as the macOS/Linux `env -u … VAR=… sandbox-exec` order — the
-        // sandbox's own proxy plumbing must survive a caller listing
-        // e.g. HTTPS_PROXY as a denied credential). The `denyReadPaths`
-        // half of the SESSION-level credentials is already unioned into
-        // the stamp set at initialize() time via
-        // `computeWindowsFsDenySet`.
+        // The `denyReadPaths` half of the SESSION-level credentials
+        // is already unioned into the stamp set at initialize() time
+        // via `computeWindowsFsAccessSet`.
         return wrapCommandWithSandboxWindows({
             command,
-            group: getWindowsGroupRef(),
-            sublayerGuid: config?.windows?.wfpSublayerGuid,
             httpProxyPort: hasNetworkConfig ? getProxyPort() : undefined,
             socksProxyPort: hasNetworkConfig ? getSocksProxyPort() : undefined,
             proxyAuthToken: hasNetworkConfig ? proxyAuthToken : undefined,
-            unsetEnvVars: credentialRestrictions.unsetEnvVars,
+            // mode:'deny' env vars are structurally absent (fresh
+            // srt-sandbox profile env). mode:'mask' sentinels are
+            // passed via the --env overlay so the sandboxed child sees
+            // the sentinel value, same as macOS/Linux.
             setEnvVars: credentialRestrictions.setEnvVars,
-            // Engage the session-level fence only when this session
-            // actually stamped — keeps `srt-win exec` standalone (no
-            // state-DB dependency) when no file-deny is configured. The
-            // per-exec deny below opens its own fence under the exec's
-            // own PID regardless.
-            holderPid: windowsFsStampedSet ? process.pid : undefined,
             denyRead: perExecDenyRead,
             denyWrite: perExecDenyWrite,
-            // Opt-in two-hop separate-user launch. Additive — defaults
-            // false, the same-user deny-only-group path is unchanged.
-            // Provisioning was checked at initialize().
-            asSandboxUser: config?.windows?.asSandboxUser ?? false,
+            // safe.directory: cwd + the resolved session-level write
+            // grants — exactly the working-tree roots the sandbox user
+            // has MODIFY on and where git will see real-user-owned files.
+            cwd,
+            allowWrite: windowsFsStampedSet?.grantWrite,
             caCertPath: mitmCA?.trustBundlePath,
             binShell: parseWindowsBinShell(binShell),
+            srtWin: customConfig?.windows?.srtWin
+                ? resolveSrtWin(customConfig.windows.srtWin)
+                : (srtWinSpawn ?? resolveSrtWin(config?.windows?.srtWin)),
         });
     }
     // macOS/Linux: delegate to the existing string wrapper, then put
@@ -1140,7 +1228,7 @@ function getConfig() {
  * Update the sandbox configuration in place.
  *
  * **Network/allowlist changes are a live swap**: the running
- * http/socks proxies read `config.network.allowedDomains` /
+ * mux proxy reads `config.network.allowedDomains` /
  * `deniedDomains` per-request (via `filterNetworkRequest`), so
  * reassigning `config` here takes effect on the next connection
  * with no proxy rebind and no port change — on every platform,
@@ -1149,32 +1237,20 @@ function getConfig() {
  *
  * Filesystem changes (denyRead/denyWrite) are NOT applied live:
  * macOS bakes them into the seatbelt profile at wrap time, and
- * Windows applies the ACL stamp once at `initialize()` (a live
- * swap would mean releasing all of this holder's claims and
- * re-stamping, which opens an unprotected window). To change FS
- * restrictions, `reset()` then `initialize()` with the new
- * config; on Windows, calling this with a config whose file-deny
- * inputs (`filesystem.denyRead`/`denyWrite`, `credentials.files`)
- * differ from those passed at `initialize()` logs a warning and
- * the stamped set stays as-is.
+ * Linux/Windows bake them into the bwrap argv / DENY-ACE set at
+ * wrap time. Call reset() + initialize() to apply a new
+ * filesystem config.
  *
  * @param newConfig - The new configuration to use
  */
 function updateConfig(newConfig) {
-    if (getPlatform() === 'windows' &&
-        config &&
-        (newConfig.windows?.groupSid !== config.windows?.groupSid ||
-            newConfig.windows?.groupName !== config.windows?.groupName)) {
-        throw new Error('Changing the Windows sandbox group requires reset() and ' +
-            're-initialize().');
-    }
     if (getPlatform() === 'windows' &&
         config &&
         !sameWindowsStampSet(newConfig)) {
-        logForDebugging(`[Sandbox Windows] updateConfig: the resolved file-deny set ` +
-            `(filesystem.denyRead/denyWrite ∪ credentials.files) changed but ` +
-            `the ACL stamp is session-wide — call reset() then initialize() ` +
-            `to apply. The previously-stamped set stays in effect.`, { level: 'warn' });
+        logForDebugging(`[Sandbox Windows] updateConfig: the resolved file-access set ` +
+            `(filesystem.* ∪ credentials.files) changed but the ACL ` +
+            `stamp/grant is session-wide — call reset() then initialize() ` +
+            `to apply. The previously-applied set stays in effect.`, { level: 'warn' });
     }
     // Deep clone the config to avoid mutations. structuredClone cannot clone
     // functions, so pull filterRequest out, clone the rest, and put it back —
@@ -1312,39 +1388,38 @@ function forceCloseHttpServer(server) {
     });
 }
 async function reset() {
-    // Windows: release this session's file-deny stamps. Best-effort
-    // — log anomalies (relocated/missing/tampered/…) rather than
-    // throw, so teardown always completes. The on-disk hash-ACE
-    // marker means a stamp left in place is recoverable later via
-    // `srt-win acl recover`.
-    if (windowsFsStampedSet) {
-        const r = restoreWindowsAcl({
-            group: windowsFsStampedGroup ?? getWindowsGroupRef(),
-        });
-        if (r) {
-            for (const e of r.paths ?? []) {
-                if (!WINDOWS_ACL_PATH_OK.has(e.status)) {
-                    const tail = e.status === 'missing'
-                        ? ' — file no longer exists; snapshot row kept for tracking'
-                        : (e.movedTo ? ` (now at '${e.movedTo}')` : '') +
-                            ' — stamp left in place; resolve and run ' +
-                            '`srt-win acl recover` to clear';
-                    logForDebugging(`[Sandbox Windows] file-deny restore: '${e.path}' ` +
-                        `${e.status}${tail}`, { level: 'warn' });
-                }
-            }
-            for (const e of r.parents ?? []) {
-                if (!WINDOWS_ACL_PARENT_OK.has(e.status)) {
-                    logForDebugging(`[Sandbox Windows] file-deny restore: parent ` +
-                        `'${e.path}' ${e.status}` +
-                        (e.error ? `: ${e.error}` : ''), { level: 'warn' });
-                }
+    // Windows: release this session's sandbox-user ACEs. Best-effort
+    // — log anomalies rather than throw, so teardown always
+    // completes. Leftover ACEs are recoverable later via
+    // `srt-win acl recover` (which sweeps by trustee SID).
+    if (windowsFsStampedSet && windowsFsSbUserSid) {
+        const sb = windowsFsSbUserSid;
+        // Captured at initialize() — the SAME binary the grants/stamps
+        // were applied with, immune to `config` mutation between.
+        const srtWin = srtWinSpawn;
+        // 'restored'/'alreadyOriginal' are the pre- same-user-removal
+        // srt-win's success vocabulary; 'revoked'/'stillHeld' are the
+        // post-. Either is non-anomalous.
+        const ok = new Set(['revoked', 'stillHeld', 'restored', 'alreadyOriginal']);
+        const log = (kind, e) => {
+            if (!ok.has(e.status)) {
+                logForDebugging(`[Sandbox Windows] ${kind}: '${e.path}' ${e.status} — ` +
+                    `ACE may be left in place; resolve and run ` +
+                    `\`srt-win acl recover\` to clear`, { level: 'warn' });
             }
+        };
+        for (const e of revokeWindowsAcl({ sandboxUserSid: sb, srtWin }) ?? []) {
+            log('grant revoke', e);
+        }
+        for (const e of restoreWindowsAcl({ sandboxUserSid: sb, srtWin }) ?? []) {
+            log('deny restore', e);
         }
     }
     windowsFsStampedSet = undefined;
-    windowsFsStampedGroup = undefined;
+    windowsFsSbUserSid = undefined;
     windowsFsRawInputs = undefined;
+    srtWinSpawn = undefined;
+    // windowsWfpVerified is NOT cleared — per-process, not per-session.
     // Clean up any leftover bwrap mount points. Force past the
     // active-sandbox counter — reset() means the session is over.
     cleanupBwrapMountPoints({ force: true });
@@ -1353,6 +1428,10 @@ async function reset() {
         logMonitorShutdown();
         logMonitorShutdown = undefined;
     }
+    if (linuxMonitor) {
+        linuxMonitor.stop();
+        linuxMonitor = undefined;
+    }
     if (managerContext?.linuxBridge) {
         const { httpSocketPath, socksSocketPath, httpBridgeProcess, socksBridgeProcess, } = managerContext.linuxBridge;
         // Kill both bridges and wait for them to exit