@tonyclaw/agent-inspector 3.0.45 → 3.0.47

package/src/proxy/privateDataPath.ts

@@ -1,6 +1,16 @@
 import { spawnSync } from "node:child_process";
-import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, statSync } from "node:fs";
-import { dirname, join } from "node:path";
+import {
+  closeSync,
+  constants,
+  fchmodSync,
+  fstatSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readdirSync,
+  realpathSync,
+} from "node:fs";
+import { join, parse, resolve, sep } from "node:path";
 
 export const PRIVATE_DIRECTORY_MODE = 0o700;
 export const PRIVATE_FILE_MODE = 0o600;
@@ -17,15 +27,35 @@ export type WindowsCommandRunner = (
   args: readonly string[],
 ) => WindowsCommandResult;
 
-const securedPaths = new Set<string>();
-const securedFileIdentities = new Map<string, string>();
+type PathEntry = {
+  path: string;
+  kind: PrivateDataPathKind;
+  identity: string;
+  mode: number;
+};
+
+type PathChainSnapshot = {
+  absolutePath: string;
+  complete: boolean;
+  entries: readonly PathEntry[];
+  missingParts: readonly string[];
+};
+
+type TreeEntry = {
+  path: string;
+  kind: PrivateDataPathKind;
+  fingerprint: string;
+};
+
+type PathEntryRead =
+  | { status: "ok"; entry: PathEntry }
+  | { status: "missing" }
+  | { status: "unsafe" };
+
+const securedPathFingerprints = new Map<string, string>();
 let cachedWindowsSid: string | null = null;
 
-// Always invoke the system copies of `whoami.exe` / `icacls.exe` regardless
-// of PATH ordering. Git Bash and similar shells ship stub binaries (e.g.
-// `/usr/bin/whoami.exe`) that take precedence on the inherited PATH and do
-// not understand Windows ACL arguments, which makes `ensurePrivate*` fail
-// in environments where `C:\Windows\System32` is not first.
+// Always invoke the system copies of Windows security utilities regardless of PATH ordering.
 function windowsSystemPath(executable: string): string {
   const systemRoot = process.env["SystemRoot"] ?? "C:\\Windows";
   return `${systemRoot}\\System32\\${executable}`;
@@ -62,19 +92,12 @@ function windowsBroadGroupRemovalArgs(): readonly string[] {
   return ["/remove:g", "*S-1-1-0", "*S-1-5-11", "*S-1-5-32-545"];
 }
 
-/**
- * Remove inherited Windows permissions and grant full control only to the
- * account that owns the current process. Commands are executed directly,
- * never through a shell, and no path content is interpreted as command text.
- */
-export function applyWindowsUserOnlyAcl(
+function applyWindowsAclWithSid(
   path: string,
   kind: PrivateDataPathKind,
-  run: WindowsCommandRunner = runWindowsCommand,
+  sid: string,
+  run: WindowsCommandRunner,
 ): boolean {
-  const sid = resolveWindowsUserSid(run);
-  if (sid === null) return false;
-
   const access = kind === "directory" ? `(OI)(CI)F` : "F";
   const result = run("icacls.exe", [
     path,
@@ -87,111 +110,310 @@ export function applyWindowsUserOnlyAcl(
   return result.status === 0;
 }
 
-/** Apply a user-only ACL to an existing Windows tree in one bounded process. */
-export function applyWindowsUserOnlyTreeAcl(
-  root: string,
+/** Remove inherited Windows permissions and grant access only to the current process user. */
+export function applyWindowsUserOnlyAcl(
+  path: string,
+  kind: PrivateDataPathKind,
   run: WindowsCommandRunner = runWindowsCommand,
 ): boolean {
   const sid = resolveWindowsUserSid(run);
-  if (sid === null) return false;
-  const result = run("icacls.exe", [
-    root,
-    "/inheritance:r",
-    "/grant:r",
-    `*${sid}:(OI)(CI)F`,
-    `*${sid}:F`,
-    ...windowsBroadGroupRemovalArgs(),
-    "/T",
-    "/C",
-    "/Q",
-  ]);
-  return result.status === 0;
+  return sid !== null && applyWindowsAclWithSid(path, kind, sid, run);
 }
 
-function applyPrivatePermissionsSync(path: string, kind: PrivateDataPathKind): boolean {
+function comparablePath(path: string): string {
+  let normalized = path;
   if (process.platform === "win32") {
-    return applyWindowsUserOnlyAcl(path, kind);
+    if (normalized.startsWith("\\\\?\\UNC\\")) {
+      normalized = `\\\\${normalized.slice(8)}`;
+    } else if (normalized.startsWith("\\\\?\\")) {
+      normalized = normalized.slice(4);
+    }
   }
+  const absolute = resolve(normalized);
+  return process.platform === "win32" ? absolute.toLowerCase() : absolute;
+}
+
+type PathStats = NonNullable<ReturnType<typeof lstatSync>>;
 
+function pathIdentity(stats: PathStats): string {
+  return `${String(stats.dev)}:${String(stats.ino)}:${String(stats.birthtimeMs)}`;
+}
+
+function readPathEntry(path: string): PathEntryRead {
+  let stats: PathStats;
   try {
-    chmodSync(path, kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
-    return true;
+    const observed = lstatSync(path);
+    if (observed === undefined) return { status: "missing" };
+    stats = observed;
   } catch {
-    return false;
+    return { status: "missing" };
   }
-}
 
-function secureOnce(path: string, kind: PrivateDataPathKind): boolean {
-  const cacheKey = `${kind}:${path}`;
-  if (securedPaths.has(cacheKey)) return true;
-  if (!applyPrivatePermissionsSync(path, kind)) return false;
-  securedPaths.add(cacheKey);
-  return true;
-}
+  // On Windows, junctions and the supported reparse indirections are surfaced as symbolic links.
+  // The realpath equality check also rejects path aliases whose target differs from the lexical path.
+  if (stats.isSymbolicLink()) return { status: "unsafe" };
+  const kind: PrivateDataPathKind | null = stats.isDirectory()
+    ? "directory"
+    : stats.isFile()
+      ? "file"
+      : null;
+  if (kind === null) return { status: "unsafe" };
 
-export function ensurePrivateDirectorySync(path: string): boolean {
+  let canonical: string;
   try {
-    mkdirSync(path, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+    canonical = realpathSync.native(path);
   } catch {
-    return false;
+    return { status: "unsafe" };
   }
-  return secureOnce(path, "directory");
+  if (comparablePath(canonical) !== comparablePath(path)) return { status: "unsafe" };
+
+  return {
+    status: "ok",
+    entry: {
+      path,
+      kind,
+      identity: pathIdentity(stats),
+      mode: stats.mode & 0o777,
+    },
+  };
 }
 
-export function securePrivateFileSync(path: string, forceAcl = false): boolean {
-  let identity: string;
+function snapshotPathChain(path: string): PathChainSnapshot | null {
+  const absolutePath = resolve(path);
+  const root = parse(absolutePath).root;
+  const suffix = absolutePath.slice(root.length);
+  const parts = suffix === "" ? [] : suffix.split(sep).filter((part) => part !== "");
+  const entries: PathEntry[] = [];
+  let current = root;
+
+  const rootRead = readPathEntry(root);
+  if (rootRead.status !== "ok" || rootRead.entry.kind !== "directory") return null;
+  entries.push(rootRead.entry);
+
+  for (let index = 0; index < parts.length; index += 1) {
+    const part = parts[index];
+    if (part === undefined) return null;
+    current = join(current, part);
+    const read = readPathEntry(current);
+    if (read.status === "unsafe") return null;
+    if (read.status === "missing") {
+      return {
+        absolutePath,
+        complete: false,
+        entries,
+        missingParts: parts.slice(index),
+      };
+    }
+    if (index < parts.length - 1 && read.entry.kind !== "directory") return null;
+    entries.push(read.entry);
+  }
+
+  return { absolutePath, complete: true, entries, missingParts: [] };
+}
+
+function chainFingerprint(snapshot: PathChainSnapshot): string {
+  return snapshot.entries.map((entry) => `${entry.path}:${entry.identity}`).join("|");
+}
+
+function snapshotsRetainPrefix(before: PathChainSnapshot, after: PathChainSnapshot): boolean {
+  if (after.entries.length < before.entries.length) return false;
+  return before.entries.every((entry, index) => {
+    const next = after.entries[index];
+    return next !== undefined && next.path === entry.path && next.identity === entry.identity;
+  });
+}
+
+function completeSnapshotForKind(
+  path: string,
+  kind: PrivateDataPathKind,
+): PathChainSnapshot | null {
+  const snapshot = snapshotPathChain(path);
+  if (snapshot === null || !snapshot.complete) return null;
+  const leaf = snapshot.entries.at(-1);
+  return leaf !== undefined && leaf.kind === kind ? snapshot : null;
+}
+
+function applyPosixPermissions(
+  path: string,
+  kind: PrivateDataPathKind,
+  expectedIdentity: string,
+): boolean {
+  let descriptor: number | null = null;
   try {
-    const stats = statSync(path);
-    identity = `${String(stats.dev)}:${String(stats.ino)}:${String(stats.birthtimeMs)}`;
+    const directoryFlag = kind === "directory" ? constants.O_DIRECTORY : 0;
+    descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | directoryFlag);
+    const before = fstatSync(descriptor);
+    if (pathIdentity(before) !== expectedIdentity) return false;
+    fchmodSync(descriptor, kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
+    const after = fstatSync(descriptor);
+    return (
+      pathIdentity(after) === expectedIdentity &&
+      (after.mode & 0o777) === (kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE)
+    );
   } catch {
     return false;
+  } finally {
+    if (descriptor !== null) {
+      try {
+        closeSync(descriptor);
+      } catch {
+        // The permission result already fails closed; descriptor cleanup is best effort here.
+      }
+    }
   }
-  if (securedFileIdentities.get(path) === identity) return true;
-  if (process.platform === "win32" && !forceAcl && securedPaths.has(`directory:${dirname(path)}`)) {
-    securedFileIdentities.set(path, identity);
-    return true;
+}
+
+function permissionsArePrivate(entry: PathEntry): boolean {
+  if (process.platform === "win32") return true;
+  return entry.mode === (entry.kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
+}
+
+function secureExistingPath(
+  path: string,
+  kind: PrivateDataPathKind,
+  forcePermissions = false,
+): boolean {
+  const before = completeSnapshotForKind(path, kind);
+  if (before === null) return false;
+  const leaf = before.entries.at(-1);
+  if (leaf === undefined) return false;
+  const cacheKey = `${kind}:${before.absolutePath}`;
+  const beforeFingerprint = chainFingerprint(before);
+  if (
+    !forcePermissions &&
+    securedPathFingerprints.get(cacheKey) === beforeFingerprint &&
+    permissionsArePrivate(leaf)
+  ) {
+    const cachedCheck = completeSnapshotForKind(path, kind);
+    return cachedCheck !== null && chainFingerprint(cachedCheck) === beforeFingerprint;
   }
-  if (!applyPrivatePermissionsSync(path, "file")) return false;
-  securedFileIdentities.set(path, identity);
+
+  const applied =
+    process.platform === "win32"
+      ? applyWindowsUserOnlyAcl(path, kind)
+      : applyPosixPermissions(path, kind, leaf.identity);
+  if (!applied) return false;
+
+  const after = completeSnapshotForKind(path, kind);
+  if (after === null || !snapshotsRetainPrefix(before, after)) return false;
+  const afterLeaf = after.entries.at(-1);
+  if (afterLeaf === undefined || afterLeaf.identity !== leaf.identity) return false;
+  if (!permissionsArePrivate(afterLeaf)) return false;
+  securedPathFingerprints.set(cacheKey, chainFingerprint(after));
   return true;
 }
 
-/** Secure an existing tree without following symbolic links. */
-export function securePrivateTreeSync(root: string): boolean {
-  if (!existsSync(root)) return false;
+export function ensurePrivateDirectorySync(path: string): boolean {
+  const before = snapshotPathChain(path);
+  if (before === null) return false;
 
-  let stats: ReturnType<typeof lstatSync>;
-  try {
-    stats = lstatSync(root);
-  } catch {
-    return false;
+  let current = before.entries.at(-1)?.path;
+  if (current === undefined) return false;
+  for (const part of before.missingParts) {
+    const next = join(current, part);
+    try {
+      mkdirSync(next, { mode: PRIVATE_DIRECTORY_MODE });
+    } catch {
+      const raced = readPathEntry(next);
+      if (raced.status !== "ok" || raced.entry.kind !== "directory") return false;
+    }
+    if (!secureExistingPath(next, "directory", true)) return false;
+    current = next;
   }
-  if (stats.isSymbolicLink()) return true;
-  if (!stats.isDirectory()) return securePrivateFileSync(root, true);
-  if (process.platform === "win32") {
-    if (!applyWindowsUserOnlyTreeAcl(root)) return false;
-    securedPaths.add(`directory:${root}`);
+
+  const complete = completeSnapshotForKind(path, "directory");
+  if (complete === null || !snapshotsRetainPrefix(before, complete)) return false;
+  return secureExistingPath(path, "directory");
+}
+
+export function securePrivateFileSync(path: string, forceAcl = false): boolean {
+  return secureExistingPath(path, "file", forceAcl);
+}
+
+function collectSafeTree(root: string): TreeEntry[] | null {
+  const collected: TreeEntry[] = [];
+
+  const visit = (path: string): boolean => {
+    const snapshot = snapshotPathChain(path);
+    if (snapshot === null || !snapshot.complete) return false;
+    const leaf = snapshot.entries.at(-1);
+    if (leaf === undefined) return false;
+    const fingerprint = chainFingerprint(snapshot);
+    collected.push({ path: snapshot.absolutePath, kind: leaf.kind, fingerprint });
+    if (leaf.kind === "file") return true;
+
+    let entries: string[];
+    try {
+      entries = readdirSync(path);
+    } catch {
+      return false;
+    }
+    const afterRead = completeSnapshotForKind(path, "directory");
+    if (afterRead === null || chainFingerprint(afterRead) !== fingerprint) return false;
+    for (const entry of entries) {
+      if (!visit(join(path, entry))) return false;
+    }
     return true;
-  }
-  if (!ensurePrivateDirectorySync(root)) return false;
+  };
 
-  let entries: string[];
-  try {
-    entries = readdirSync(root);
-  } catch {
-    return false;
+  return visit(root) ? collected : null;
+}
+
+function treeFingerprintsMatch(
+  expected: readonly TreeEntry[],
+  observed: readonly TreeEntry[] | null,
+): boolean {
+  if (observed === null || observed.length !== expected.length) return false;
+  return expected.every((entry, index) => {
+    const next = observed[index];
+    return (
+      next !== undefined &&
+      next.path === entry.path &&
+      next.kind === entry.kind &&
+      next.fingerprint === entry.fingerprint
+    );
+  });
+}
+
+/** Read-only preflight used before copy/import operations that must not follow indirection. */
+export function isPathTreeFreeOfIndirectionSync(root: string): boolean {
+  return collectSafeTree(root) !== null;
+}
+
+/** Apply ACLs item by item after a no-follow scan; never use icacls /T across a reparse point. */
+export function applyWindowsUserOnlyTreeAcl(
+  root: string,
+  run: WindowsCommandRunner = runWindowsCommand,
+): boolean {
+  const entries = collectSafeTree(root);
+  if (entries === null) return false;
+  const sid = resolveWindowsUserSid(run);
+  if (sid === null) return false;
+
+  for (const entry of entries) {
+    const before = completeSnapshotForKind(entry.path, entry.kind);
+    if (before === null || chainFingerprint(before) !== entry.fingerprint) return false;
+    if (!applyWindowsAclWithSid(entry.path, entry.kind, sid, run)) return false;
+    const after = completeSnapshotForKind(entry.path, entry.kind);
+    if (after === null || chainFingerprint(after) !== entry.fingerprint) return false;
+    securedPathFingerprints.set(`${entry.kind}:${entry.path}`, entry.fingerprint);
   }
+  return treeFingerprintsMatch(entries, collectSafeTree(root));
+}
+
+/** Secure an existing tree while refusing every symlink, junction, or reparse indirection. */
+export function securePrivateTreeSync(root: string): boolean {
+  const entries = collectSafeTree(root);
+  if (entries === null) return false;
+  if (process.platform === "win32") return applyWindowsUserOnlyTreeAcl(root);
 
-  let secured = true;
   for (const entry of entries) {
-    const childPath = join(root, entry);
-    if (!securePrivateTreeSync(childPath)) secured = false;
+    if (!secureExistingPath(entry.path, entry.kind, true)) return false;
   }
-  return secured;
+  return treeFingerprintsMatch(entries, collectSafeTree(root));
 }
 
 export function _resetPrivateDataPathCacheForTests(): void {
-  securedPaths.clear();
-  securedFileIdentities.clear();
+  securedPathFingerprints.clear();
   cachedWindowsSid = null;
 }