@wzwjustdoit/dsh-plugin-git-bash 0.0.0-stage → 0.4.0

package/lib/index.js

@@ -0,0 +1,369 @@
+import { LocalBashExecutor } from "@deepseek-ai/dsh-bash-local";
+import { SandboxUnavailableError } from "@deepseek-ai/dsh-sandbox";
+import z from "@deepseek-ai/schemastery";
+import { spawnSync } from "node:child_process";
+import { accessSync, constants, statSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { GIT_BASH_PATH_CONFINED_ENV, configuredGitBashPath, resolveGitBashPath } from "./discovery.js";
+export { GIT_BASH_PATH_CONFINED_ENV, GIT_BASH_PATH_ENV, configuredGitBashPath, gitBashCandidates, resolveGitBashPath, } from "./discovery.js";
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const GUARD_EXECUTABLE = resolve(PACKAGE_ROOT, "native", "bin", "win32-x64", "msys-token-guard.exe");
+const GUARD_HOOK = resolve(PACKAGE_ROOT, "native", "bin", "win32-x64", "msys-token-guard-hook.dll");
+const EXECUTABLE_SPAWN_CODES = new Set(["EACCES", "ENOENT"]);
+const GIT_BASH_EXECUTABLE_PATTERN = /^(?:[A-Z]:[\\/]|\\\\[^\\/]+[\\/][^\\/]+[\\/]|%[^%]+%[\\/])(?:.*[\\/])?bash\.exe$/i;
+const GUARD_FAILURE_RULE = {
+    allowedExitCodes: [125],
+    fatalSignatures: ["msys-token-guard:"],
+};
+// The guard's child-token setup fails when the restricted DACL (inherited from
+// the server token's default DACL) offers no usable ordinary SID to the guard.
+const SERVER_DACL_FAILURE_SIGNATURE = "openprocesstoken(child default dacl)";
+// DSH derives every restricted token from the server's own process token, and
+// the restricted DACL starts as a copy of the server's default DACL. Servers
+// started outside MSYS2 can carry a DACL without the user SID, which blocks
+// the guard's workspace-write child-token setup (exit 125). Run the guard
+// helper once per server process to stamp the standard DACL shape — the same
+// normalization starting `dsh web` from Git Bash gets for free.
+function normalizeServerDefaultDacl() {
+    if (process.platform !== "win32" || process.arch !== "x64")
+        return false;
+    let result;
+    try {
+        result = spawnSync(GUARD_EXECUTABLE, ["--normalize-server-dacl"], {
+            timeout: 10_000,
+            windowsHide: true,
+        });
+    }
+    catch {
+        return false;
+    }
+    return result.status === 0;
+}
+const LOCAL_BASH_CONFIG = LocalBashExecutor.Config;
+// Keep the field schema permissive enough to render a recovery card for a
+// legacy bad value; resolveConfiguredExecutable enforces it on new writes and use.
+//
+// Extend the base schema with `set` rather than `z.intersect`: intersect rebuilds
+// the object and drops the inherited `volatile` metadata, which the host needs to
+// parse a live config section (otherwise the first command fails with
+// "config.timeoutMs.get is not a function").
+export const Config = LOCAL_BASH_CONFIG
+    .set("executable", z.string()
+    .default("")
+    .role("path")
+    .description("Absolute path to Git for Windows bash.exe; blank uses automatic discovery."))
+    .set("confinedExecutable", z.string()
+    .default("")
+    .role("path")
+    .description("Absolute path to the bash.exe used by read-only / workspace-write; must be a"
+    + " different Git installation than `executable`. Blank falls back to"
+    + " DSH_GIT_BASH_PATH_CONFINED, then to `executable`."));
+function checkExecutableShape(executable) {
+    if (!GIT_BASH_EXECUTABLE_PATTERN.test(executable)) {
+        throw new TypeError("git-bash: executable must be an absolute Windows path ending in bash.exe");
+    }
+}
+function resolveConfiguredExecutable(config) {
+    const executable = config.executable?.trim();
+    if (!executable)
+        return undefined;
+    checkExecutableShape(executable);
+    return resolveGitBashPath(executable);
+}
+/**
+ * The `bash.exe` for the confined modes, or `undefined` to fall back to
+ * {@link resolveConfiguredExecutable} / auto-discovery. Order: the
+ * `confinedExecutable` field, then {@link GIT_BASH_PATH_CONFINED_ENV}.
+ */
+function resolveConfinedExecutable(config) {
+    const configured = config.confinedExecutable?.trim();
+    if (configured) {
+        checkExecutableShape(configured);
+        return resolveGitBashPath(configured);
+    }
+    return configuredGitBashPath(GIT_BASH_PATH_CONFINED_ENV);
+}
+function checkedCompositionConfig(config) {
+    // Blank configuration intentionally defers auto-discovery so the host still
+    // composes when Git for Windows is not installed yet.
+    resolveConfiguredExecutable(config);
+    resolveConfinedExecutable(config);
+    return config;
+}
+function isUsableWorkdir(path) {
+    try {
+        if (!statSync(path).isDirectory())
+            return false;
+        accessSync(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isRunnerSpawnFailure(error, runnerProgram, workdir) {
+    if (runnerProgram === undefined || !isUsableWorkdir(workdir))
+        return false;
+    if (typeof error !== "object" || error === null)
+        return false;
+    const { code, path, syscall } = error;
+    if (typeof code !== "string" || !EXECUTABLE_SPAWN_CODES.has(code))
+        return false;
+    if (typeof syscall !== "string")
+        return false;
+    const exactSyscall = "spawn " + runnerProgram;
+    if (path === undefined)
+        return syscall === exactSyscall;
+    if (typeof path !== "string" || path.length === 0 || path !== runnerProgram)
+        return false;
+    return syscall === "spawn" || syscall === exactSyscall;
+}
+function matchesSignature(exitCode, stderr, signatures) {
+    if (exitCode === null || exitCode === 0)
+        return false;
+    const lowered = stderr.toLowerCase();
+    return signatures.some((signature) => lowered.includes(signature.toLowerCase()));
+}
+function classifyDenial(result, signatures) {
+    return matchesSignature(result.exitCode, result.stderr.text, signatures);
+}
+// Turn the guard's bare DACL failure line into an actionable message: the
+// automatic normalization ran (or was skipped) and the server still serves
+// restricted tokens without ordinary user coverage.
+export function describeGuardFailure(detail) {
+    if (!detail.toLowerCase().includes(SERVER_DACL_FAILURE_SIGNATURE))
+        return detail;
+    return detail + " (git-bash: the DSH server process token's default DACL lacks the user SID,"
+        + " so the guard cannot prepare the restricted child token. Start `dsh web` from Git Bash"
+        + " so MSYS2 restores the standard DACL shape, and see"
+        + " https://github.com/wzwjustdoit/dsh-git-bash/issues/4)";
+}
+function classifyRunnerFailure(exitCode, stderr, rules) {
+    if (exitCode === null || exitCode === 0)
+        return undefined;
+    const lines = stderr.split(/\r?\n/);
+    for (const rule of rules) {
+        if (rule.allowedExitCodes !== undefined && !rule.allowedExitCodes.includes(exitCode)) {
+            continue;
+        }
+        const informationalLines = new Set((rule.informationalLines ?? []).map((line) => line.toLowerCase()));
+        const fatalSignatures = rule.fatalSignatures
+            .filter((signature) => signature.trim().length > 0)
+            .map((signature) => signature.toLowerCase());
+        for (const line of lines) {
+            const lowered = line.toLowerCase();
+            if (informationalLines.has(lowered))
+                continue;
+            if (fatalSignatures.some((signature) => lowered.includes(signature))) {
+                return { detail: line };
+            }
+        }
+    }
+    return undefined;
+}
+function assertNativeGuard(mode) {
+    if (process.platform !== "win32" || process.arch !== "x64") {
+        throw new SandboxUnavailableError(mode, "Git Bash restricted mode requires win32-x64, received " +
+            process.platform + "-" + process.arch);
+    }
+    for (const artifact of [GUARD_EXECUTABLE, GUARD_HOOK]) {
+        try {
+            if (!statSync(artifact).isFile())
+                throw new Error("not a file");
+            accessSync(artifact, constants.R_OK);
+        }
+        catch (error) {
+            throw new SandboxUnavailableError(mode, "Git Bash native guard artifact is unavailable: " + artifact + " (" + String(error) + ")");
+        }
+    }
+}
+// DSH shell executor backed by Git for Windows Bash.
+//
+// The host interface is `execute(spec)`: a subclass replaces the public
+// command's `bash -c` argv at the execution boundary through `executeArgv`,
+// and stamps settlement facts in `onProcessDone`. There is no separate
+// foreground/background entry point to override — "foreground" is decided by
+// whether the caller awaits the returned handle's `result()`.
+export class GitBashExecutor extends LocalBashExecutor {
+    static inject = ["subprocess", "sandbox", "sandboxPolicy"];
+    // The extended schema adds `executable`; the static-side cast keeps this
+    // subclass assignable to the host's base class, while the runtime schema the
+    // host actually parses stays the intersected one.
+    static Config = Config;
+    executableCache = new Map();
+    mode;
+    processFacts = new Map();
+    constructor(ctx, config) {
+        // The host owns shell settings; this executor only resolves and validates
+        // its composition config (including the executable-aware extension).
+        super(ctx, checkedCompositionConfig(config));
+        this.mode = ctx.sandboxPolicy.defaultMode;
+    }
+    /**
+     * The bash.exe for one file-effect mode. `danger-full-access` uses the
+     * unconfined installation (`executable` / {@link GIT_BASH_PATH_ENV}); the
+     * confined modes prefer their dedicated installation (`confinedExecutable` /
+     * {@link GIT_BASH_PATH_CONFINED_ENV}) so their MSYS shared object is created
+     * fresh by the Low-integrity child rather than inherited as a Medium object.
+     * @param mode - the resolved policy mode for this execution.
+     */
+    executableFor(mode) {
+        const config = this.config;
+        const confined = mode !== "danger-full-access";
+        const configured = (confined ? config.confinedExecutable : config.executable)?.trim() ?? "";
+        const cached = this.executableCache.get(mode);
+        if (cached?.configured === configured)
+            return cached.resolved;
+        const resolved = (confined ? resolveConfinedExecutable(config) : resolveConfiguredExecutable(config))
+            ?? resolveGitBashPath();
+        this.executableCache.set(mode, { configured, resolved });
+        return resolved;
+    }
+    /** The unconfined-mode bash.exe; kept as the public property existing tests and callers read. */
+    get executable() {
+        return this.executableFor("danger-full-access");
+    }
+    get sandboxMode() {
+        return this.mode;
+    }
+    resolve(request) {
+        const resolved = super.resolve(request);
+        return {
+            ...resolved,
+            env: {
+                ...(resolved.env ?? {}),
+                // Keep Git/MSYS2 Bash in the workspace directory instead of
+                // changing to $HOME on login-shell startup.
+                CHERE_INVOKING: "1",
+            },
+            sandboxPolicy: request.sandboxPolicy ?? this.ctx.sandboxPolicy.resolve(),
+        };
+    }
+    argv(mode, command) {
+        return [this.executableFor(mode), "--login", "-c", command];
+    }
+    guardedArgv(command, mode) {
+        assertNativeGuard(mode);
+        return [GUARD_EXECUTABLE, "--", ...this.argv(mode, command)];
+    }
+    policy(spec) {
+        if (!spec.sandboxPolicy) {
+            throw new Error("git-bash: resolved execution is missing sandbox policy");
+        }
+        return spec.sandboxPolicy;
+    }
+    async confine(command, policy, signal) {
+        this.ensureServerDaclNormalized();
+        // `ctx.sandbox.confine` is async; await it before spreading so the
+        // runner-failure rules extend the resolved wrap rather than a promise.
+        const confined = await this.ctx.sandbox.confine(this.guardedArgv(command, policy.mode), policy, signal);
+        return {
+            ...confined,
+            runnerFailureRules: [...confined.runnerFailureRules, GUARD_FAILURE_RULE],
+        };
+    }
+    serverDaclNormalized = false;
+    ensureServerDaclNormalized() {
+        if (this.serverDaclNormalized)
+            return;
+        this.serverDaclNormalized = true;
+        normalizeServerDefaultDacl();
+    }
+    async execute(spec) {
+        const policy = this.policy(spec);
+        const { mode } = policy;
+        if (mode === "danger-full-access") {
+            // Unconfined, but still the configured Git Bash. The host base class
+            // hardcodes `["bash", "-c", …]` (a PATH lookup), which would silently
+            // ignore `executable` and DSH_GIT_BASH_PATH; route through the same
+            // argv the confined branch builds so all three modes share one
+            // resolution chain.
+            const execution = await this.executeArgv(spec, this.argv(mode, spec.command));
+            return GitBashExecutor.decorateResult(execution, (result) => ({
+                ...result,
+                sandbox: { mode, denied: false },
+            }));
+        }
+        let confined;
+        const execution = await this.executeArgv(spec, async (signal) => {
+            const prepared = await this.confine(spec.command, { ...policy, mode }, signal);
+            signal.throwIfAborted();
+            confined = prepared;
+            return prepared.argv;
+        }, (process) => {
+            const facts = confined;
+            if (facts === undefined)
+                return;
+            this.processFacts.set(process, {
+                mode,
+                enforcement: facts.enforcement,
+                denialSignatures: facts.denialSignatures,
+                runnerFailureRules: facts.runnerFailureRules,
+                runnerProgram: facts.argv[0],
+                workdir: spec.workdir,
+            });
+        });
+        return GitBashExecutor.decorateResult(execution, (result) => {
+            if (confined === undefined) {
+                return { ...result, sandbox: { mode, denied: false } };
+            }
+            const runnerFailure = classifyRunnerFailure(result.exitCode, result.stderr.text, confined.runnerFailureRules);
+            if (runnerFailure !== undefined) {
+                throw new SandboxUnavailableError(mode, describeGuardFailure(runnerFailure.detail));
+            }
+            return {
+                ...result,
+                sandbox: {
+                    mode,
+                    denied: classifyDenial(result, confined.denialSignatures),
+                    enforcement: confined.enforcement,
+                },
+            };
+        }, (error) => {
+            if (spec.signal?.aborted === true)
+                spec.signal.throwIfAborted();
+            if (confined !== undefined && isRunnerSpawnFailure(error, confined.argv[0], spec.workdir)) {
+                throw new SandboxUnavailableError(mode, String(error));
+            }
+            throw error;
+        });
+    }
+    /**
+     * Decorate the handle's foreground projection in place, memoized once. The
+     * handle keeps its identity (never wrapped in a second object) because the
+     * per-process facts and `onProcessDone` key on the exact instance.
+     */
+    static decorateResult(execution, map, mapError) {
+        const base = execution.result.bind(execution);
+        let decorated;
+        execution.result = () => {
+            decorated ??= mapError === undefined ? base().then(map) : base().then(map, mapError);
+            return decorated;
+        };
+        return execution;
+    }
+    /**
+     * Stamp per-process sandbox facts before `done` settles. Full-access
+     * processes carry no facts; provider rejections are classified as runner
+     * failures rather than denials.
+     */
+    onProcessDone(proc, stderr, providerRejected, providerError) {
+        const facts = this.processFacts.get(proc);
+        if (facts !== undefined) {
+            this.processFacts.delete(proc);
+            const runnerFailed = providerRejected
+                ? isRunnerSpawnFailure(providerError, facts.runnerProgram, facts.workdir)
+                : classifyRunnerFailure(proc.exitCode, stderr, facts.runnerFailureRules) !== undefined;
+            proc.sandbox = {
+                mode: facts.mode,
+                denied: !runnerFailed && matchesSignature(proc.exitCode, stderr, facts.denialSignatures),
+                enforcement: facts.enforcement,
+                ...(runnerFailed ? { runnerFailed } : {}),
+            };
+        }
+        super.onProcessDone(proc, stderr, providerRejected, providerError);
+    }
+}
+export default GitBashExecutor;
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAkBnE,OAAO,CAAC,MAAM,0BAA0B,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEvG,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC5E,MAAM,gBAAgB,GAAG,OAAO,CAC9B,YAAY,EACZ,QAAQ,EACR,KAAK,EACL,WAAW,EACX,sBAAsB,CACvB,CAAC;AACF,MAAM,UAAU,GAAG,OAAO,CACxB,YAAY,EACZ,QAAQ,EACR,KAAK,EACL,WAAW,EACX,2BAA2B,CAC5B,CAAC;AACF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC7D,MAAM,2BAA2B,GAC/B,mFAAmF,CAAC;AACtF,MAAM,kBAAkB,GAAsB;IAC5C,gBAAgB,EAAE,CAAC,GAAG,CAAC;IACvB,eAAe,EAAE,CAAC,mBAAmB,CAAC;CACvC,CAAC;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,6BAA6B,GAAG,sCAAsC,CAAC;AAE7E,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,gEAAgE;AAChE,SAAS,0BAA0B;IACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,gBAAgB,EAAE,CAAC,yBAAyB,CAAC,EAAE;YAChE,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC;AAaD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,MAAM,CAAC;AAEnD,0EAA0E;AAC1E,mFAAmF;AACnF,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,sEAAsE;AACtE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,MAAM,GAAG,iBAAiB;KACpC,GAAG,CACF,YAAY,EACZ,CAAC,CAAC,MAAM,EAAE;KACP,OAAO,CAAC,EAAE,CAAC;KACX,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,4EAA4E,CAAC,CAC7F;KACA,GAAG,CACF,oBAAoB,EACpB,CAAC,CAAC,MAAM,EAAE;KACP,OAAO,CAAC,EAAE,CAAC;KACX,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CACV,8EAA8E;MAC5E,oEAAoE;MACpE,oDAAoD,CACvD,CACS,CAAC;AAEjB,SAAS,oBAAoB,CAAC,UAAkB;IAC9C,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CACjB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,MAAc;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjC,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,MAAc;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,UAAU,EAAE,CAAC;QACf,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjC,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,qBAAqB,CAAC,0BAA0B,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAc;IAC9C,4EAA4E;IAC5E,sDAAsD;IACtD,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACpC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAeD,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,KAAK,CAAC;QAChD,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAc,EACd,aAAiC,EACjC,OAAe;IAEf,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAA8B,CAAC;IAC/D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE9C,MAAM,YAAY,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC9C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,KAAK,YAAY,CAAC;IACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IAC1F,OAAO,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,YAAY,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAuB,EACvB,MAAc,EACd,UAA6B;IAE7B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,cAAc,CAAC,MAAsB,EAAE,UAA6B;IAC3E,OAAO,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC3E,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,oDAAoD;AACpD,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAAE,OAAO,MAAM,CAAC;IACjF,OAAO,MAAM,GAAG,6EAA6E;UACzF,wFAAwF;UACxF,qDAAqD;UACrD,wDAAwD,CAAC;AAC/D,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAuB,EACvB,MAAc,EACd,KAAmC;IAEnC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrF,SAAS;QACX,CAAC;QACD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,CAAC,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAClE,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe;aACzC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;aAClD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC9C,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACrE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAyB;IAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3D,MAAM,IAAI,uBAAuB,CAC/B,IAAI,EACJ,wDAAwD;YACtD,OAAO,CAAC,QAAQ,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,CACxC,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;YAChE,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,IAAI,EACJ,iDAAiD,GAAG,QAAQ,GAAG,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,uEAAuE;AACvE,6EAA6E;AAC7E,8DAA8D;AAC9D,MAAM,OAAO,eAAgB,SAAQ,iBAAiB;IACpD,MAAM,CAAU,MAAM,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IACpE,yEAAyE;IACzE,6EAA6E;IAC7E,kDAAkD;IAClD,MAAM,CAAU,MAAM,GAAG,MAAoD,CAAC;IAE7D,eAAe,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC9E,IAAI,CAAc;IAClB,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEtE,YAAY,GAAY,EAAE,MAAc;QACtC,0EAA0E;QAC1E,qEAAqE;QACrE,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACK,aAAa,CAAC,IAAiB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgB,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,KAAK,oBAAoB,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5F,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,MAAM,EAAE,UAAU,KAAK,UAAU;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;QAE9D,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;eAChG,kBAAkB,EAAE,CAAC;QAC1B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,iGAAiG;IACjG,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAClD,CAAC;IAED,IAAa,WAAW;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEQ,OAAO,CAAC,OAAyB;QACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO;YACL,GAAG,QAAQ;YACX,GAAG,EAAE;gBACH,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC;gBACvB,4DAA4D;gBAC5D,4CAA4C;gBAC5C,cAAc,EAAE,GAAG;aACpB;YACD,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE;SACzE,CAAC;IACJ,CAAC;IAEO,IAAI,CAAC,IAAiB,EAAE,OAAe;QAC7C,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAEO,WAAW,CAAC,OAAe,EAAE,IAAyB;QAC5D,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IAEO,MAAM,CAAC,IAAmB;QAChC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,OAAe,EACf,MAAqB,EACrB,MAAoB;QAEpB,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAClC,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAC7C,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EACtC,MAAM,EACN,MAAM,CACP,CAAC;QACF,OAAO;YACL,GAAG,QAAQ;YACX,kBAAkB,EAAE,CAAC,GAAG,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;SACzE,CAAC;IACJ,CAAC;IAEO,oBAAoB,GAAG,KAAK,CAAC;IAE7B,0BAA0B;QAChC,IAAI,IAAI,CAAC,oBAAoB;YAAE,OAAO;QACtC,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACjC,0BAA0B,EAAE,CAAC;IAC/B,CAAC;IAEQ,KAAK,CAAC,OAAO,CAAC,IAAmB;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QAExB,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,qEAAqE;YACrE,sEAAsE;YACtE,oEAAoE;YACpE,+DAA+D;YAC/D,oBAAoB;YACpB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9E,OAAO,eAAe,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC5D,GAAG,MAAM;gBACT,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;aACjC,CAAC,CAAC,CAAC;QACN,CAAC;QAED,IAAI,QAAkC,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CACtC,IAAI,EACJ,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YAC/E,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,QAAQ,GAAG,QAAQ,CAAC;YACpB,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC,EACD,CAAC,OAAO,EAAE,EAAE;YACV,MAAM,KAAK,GAAG,QAAQ,CAAC;YACvB,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO;YAChC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE;gBAC7B,IAAI;gBACJ,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QAEF,OAAO,eAAe,CAAC,cAAc,CACnC,SAAS,EACT,CAAC,MAAM,EAAE,EAAE;YACT,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YACzD,CAAC;YACD,MAAM,aAAa,GAAG,qBAAqB,CACzC,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,MAAM,CAAC,IAAI,EAClB,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;YACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,uBAAuB,CAAC,IAAI,EAAE,oBAAoB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YACtF,CAAC;YACD,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE;oBACP,IAAI;oBACJ,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC;oBACzD,WAAW,EAAE,QAAQ,CAAC,WAAW;iBAClC;aACF,CAAC;QACJ,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI;gBAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAChE,IAAI,QAAQ,KAAK,SAAS,IAAI,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1F,MAAM,IAAI,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,cAAc,CAC3B,SAAyB,EACzB,GAA+C,EAC/C,QAAoC;QAEpC,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,SAA8C,CAAC;QACnD,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE;YACtB,SAAS,KAAK,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACrF,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACgB,aAAa,CAC9B,IAAkB,EAClB,MAAc,EACd,gBAAyB,EACzB,aAAuB;QAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,YAAY,GAAG,gBAAgB;gBACnC,CAAC,CAAC,oBAAoB,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC;gBACzE,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC,KAAK,SAAS,CAAC;YACzF,IAAI,CAAC,OAAO,GAAG;gBACb,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,CAAC,YAAY,IAAI,gBAAgB,CACvC,IAAI,CAAC,QAAQ,EACb,MAAM,EACN,KAAK,CAAC,gBAAgB,CACvB;gBACD,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACrE,CAAC;;AAGH,eAAe,eAAe,CAAC"}

package/native/CMakeLists.txt

@@ -0,0 +1,58 @@
+cmake_minimum_required(VERSION 3.25)
+project(dsh_msys_token_guard LANGUAGES CXX)
+
+set(DETOURS_DIR "${CMAKE_CURRENT_SOURCE_DIR}/vendor/detours")
+add_library(detours STATIC
+  "${DETOURS_DIR}/detours.cpp"
+  "${DETOURS_DIR}/modules.cpp"
+  "${DETOURS_DIR}/disasm.cpp"
+  "${DETOURS_DIR}/image.cpp"
+  "${DETOURS_DIR}/creatwth.cpp"
+)
+target_include_directories(detours PUBLIC "${DETOURS_DIR}")
+target_compile_definitions(detours PRIVATE WIN32_LEAN_AND_MEAN _WIN32_WINNT=0x0A00)
+set_target_properties(detours PROPERTIES
+  MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>"
+)
+
+add_executable(msys-token-guard msys-token-guard.cpp)
+add_library(msys-token-guard-hook SHARED msys-token-guard-hook.cpp)
+
+foreach(target IN ITEMS msys-token-guard msys-token-guard-hook)
+  target_compile_features(${target} PRIVATE cxx_std_20)
+  target_compile_definitions(${target} PRIVATE UNICODE _UNICODE)
+  target_link_libraries(${target} PRIVATE detours advapi32)
+  set_target_properties(${target} PROPERTIES
+    MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>"
+    RUNTIME_OUTPUT_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/bin/win32-x64"
+    RUNTIME_OUTPUT_DIRECTORY_DEBUG "${CMAKE_CURRENT_SOURCE_DIR}/bin/win32-x64"
+    RUNTIME_OUTPUT_DIRECTORY_RELEASE "${CMAKE_CURRENT_SOURCE_DIR}/bin/win32-x64"
+    RUNTIME_OUTPUT_DIRECTORY_RELWITHDEBINFO "${CMAKE_CURRENT_SOURCE_DIR}/bin/win32-x64"
+    RUNTIME_OUTPUT_DIRECTORY_MINSIZEREL "${CMAKE_CURRENT_SOURCE_DIR}/bin/win32-x64"
+  )
+endforeach()
+
+if(MSVC)
+  target_compile_options(detours PRIVATE
+    /W4 /WX /GS /guard:cf /sdl /utf-8 /Zc:inline /Zc:preprocessor
+  )
+  foreach(target IN ITEMS msys-token-guard msys-token-guard-hook)
+    target_compile_options(${target} PRIVATE
+      /W4 /WX /permissive- /EHsc /GS /guard:cf /sdl /utf-8
+      /Zc:__cplusplus /Zc:inline /Zc:preprocessor
+    )
+    target_link_options(${target} PRIVATE
+      /DYNAMICBASE /NXCOMPAT /guard:cf /CETCOMPAT /OPT:REF /OPT:ICF /Brepro
+    )
+  endforeach()
+  target_link_options(msys-token-guard PRIVATE
+    "/MANIFESTUAC:level='asInvoker' uiAccess='false'"
+  )
+  target_link_options(msys-token-guard-hook PRIVATE
+    "/EXPORT:DetourFinishHelperProcess,@1,NONAME"
+  )
+else()
+  foreach(target IN ITEMS detours msys-token-guard msys-token-guard-hook)
+    target_compile_options(${target} PRIVATE -Wall -Wextra -Wpedantic -Werror)
+  endforeach()
+endif()