dodo-mcp 1.0.0

package/dist/setup/windowsChromiumAcl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowsChromiumAcl.js","sourceRoot":"","sources":["../../src/setup/windowsChromiumAcl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAE1E,4EAA4E;AAC5E,+EAA+E;AAC/E,uDAAuD;AACvD,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,YAAY,CAAU,CAAC;AAE7D,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,uDAAuD,CAAC,CAAC;IAC7J,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAAC,UAAkB;IACjE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC;IACpD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;IACxJ,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,wDAAwD,CAAC,CAAC;IACtH,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,oFAAoF,CAAC,CAAC;IAEhK,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,8CAA8C,CAAC,CAAC;IACzH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,uDAAuD,CAAC,CAAC;IAEtJ,MAAM,MAAM,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACtI,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,sGAAsG,CAAC,CAAC;IACtL,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,4DAA4D,CAAC,CAAC;IACtJ,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/setup/windowsSandboxInstall.js

@@ -0,0 +1,94 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { pathToFileURL } from 'node:url';
+import { DodoError } from '../errors.js';
+import { SRT_VERSION, findWindowsSandbox } from '../platform/windowsSandbox.js';
+import { windowsSystemExecutable } from '../platform/system.js';
+import { activateManagedTools, registerManagedPath, assertSetupPrivatePaths } from './managedTools.js';
+import { verifySandbox } from './sandboxProbe.js';
+export const RUNTIME_ACL_VERIFY = String.raw `
+$ErrorActionPreference='Stop'
+$sid=[Security.Principal.SecurityIdentifier]::new($env:DODO_SRT_GROUP_SID)
+$required=[Security.AccessControl.FileSystemRights]::ReadAndExecute
+# Composite rights such as FullControl/Modify contain read bits, so they cannot
+# be used as a forbidden bitmask. Reject only atomic write/delete/ACL authority.
+$forbidden=[Security.AccessControl.FileSystemRights]::WriteData -bor [Security.AccessControl.FileSystemRights]::AppendData -bor [Security.AccessControl.FileSystemRights]::WriteExtendedAttributes -bor [Security.AccessControl.FileSystemRights]::WriteAttributes -bor [Security.AccessControl.FileSystemRights]::DeleteSubdirectoriesAndFiles -bor [Security.AccessControl.FileSystemRights]::Delete -bor [Security.AccessControl.FileSystemRights]::ChangePermissions -bor [Security.AccessControl.FileSystemRights]::TakeOwnership
+$paths=@($env:DODO_SRT_RUNTIME_DIR,(Join-Path $env:DODO_SRT_RUNTIME_DIR 'srt-win.exe'))
+foreach($p in $paths){
+  $item=Get-Item -LiteralPath $p -Force
+  if(($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0){throw 'runtime reparse'}
+  $rules=(Get-Acl -LiteralPath $p).GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])
+  $ours=@($rules|Where-Object{$_.IdentityReference.Value -eq $sid.Value -and $_.AccessControlType -eq 'Allow'})
+  if($ours.Count -eq 0){throw 'missing runtime RX'}
+  foreach($r in $ours){
+    if(($r.FileSystemRights -band $required) -ne $required){throw 'runtime group missing read/execute'}
+    if(($r.FileSystemRights -band $forbidden) -ne 0){throw 'runtime group received write authority'}
+  }
+}
+[Console]::Write('rx-only')
+`;
+export function sandboxRuntimeAclArgs(directory, groupSid) {
+    if (!/^S-1-5-(?:\d+-)+\d+$/.test(groupSid))
+        throw new DodoError('INVALID_INPUT', 'sandbox runtime returned an invalid local group SID');
+    return [directory, '/grant', `*${groupSid}:(OI)(CI)(RX)`, '/T', '/C', '/Q'];
+}
+function grantSandboxRuntimeReadExecute(directory, groupSid) {
+    const grant = spawnSync(windowsSystemExecutable('icacls.exe'), sandboxRuntimeAclArgs(directory, groupSid), { shell: false, windowsHide: true, timeout: 120000, maxBuffer: 256 * 1024, encoding: 'utf8' });
+    if (grant.error || grant.status !== 0)
+        throw new Error('sandbox helper read/execute ACL could not be established');
+    const verify = spawnSync(windowsSystemExecutable('WindowsPowerShell/v1.0/powershell.exe'), ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(RUNTIME_ACL_VERIFY, 'utf16le').toString('base64')], {
+        shell: false, windowsHide: true, timeout: 30000, maxBuffer: 16384, encoding: 'utf8',
+        env: { ...process.env, DODO_SRT_GROUP_SID: groupSid, DODO_SRT_RUNTIME_DIR: directory },
+    });
+    if (verify.error || verify.status !== 0 || verify.stdout.trim() !== 'rx-only')
+        throw new Error('sandbox helper ACL verification failed; no confinement success is claimed');
+}
+/** Local CLI only. The dependency itself is installed using the reviewed npm recipe in setup.ts. */
+export async function provisionWindowsSandbox(configDir, workspaceRoot, packageRoot, log) {
+    if (process.platform !== 'win32')
+        throw new DodoError('NOT_SUPPORTED', 'Windows provisioning was requested on another OS');
+    const pkg = JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+    if (pkg.name !== '@anthropic-ai/sandbox-runtime' || pkg.version !== SRT_VERSION)
+        throw new Error('sandbox runtime pin mismatch');
+    const directory = path.join(packageRoot, 'vendor', 'srt-win', process.arch);
+    const expectedExecutable = path.join(directory, 'srt-win.exe');
+    // package JS stays owner-private. The native helper directory gets a narrow
+    // RX grant to the dedicated sandbox group after provisioning, so it is not
+    // checked with the generic owner-only ACL predicate on repeat setup runs.
+    assertSetupPrivatePaths([configDir, path.join(configDir, 'tools'), packageRoot]);
+    if (!fs.existsSync(expectedExecutable))
+        throw new Error('reviewed runtime does not contain this Windows architecture');
+    const executableStat = fs.lstatSync(expectedExecutable);
+    if (!executableStat.isFile() || executableStat.isSymbolicLink() || executableStat.nlink !== 1)
+        throw new Error('reviewed Windows sandbox executable is not a regular private file');
+    registerManagedPath(configDir, directory);
+    activateManagedTools(configDir, workspaceRoot);
+    const api = await import(pathToFileURL(path.join(packageRoot, 'dist', 'index.js')).href);
+    if (typeof api.resolveSrtWin !== 'function' || typeof api.checkWindowsSandboxStatusAsync !== 'function' || typeof api.installWindowsSandboxAsync !== 'function')
+        throw new Error('sandbox runtime API contract mismatch');
+    if (fs.realpathSync.native(api.VENDORED_SRT_WIN_EXE) !== fs.realpathSync.native(expectedExecutable))
+        throw new Error('sandbox runtime exported an unexpected Windows helper path');
+    const srtWin = api.resolveSrtWin({ path: expectedExecutable });
+    let status = await api.checkWindowsSandboxStatusAsync({ srtWin });
+    if (!status.user.provisioned || !status.user.credPresent || status.wfp.state === 'absent') {
+        log('[setup] Windows sandbox: provisioning a dedicated srt-sandbox account and SID-scoped WFP network rules. Approve the native UAC prompt; cancellation is not bypassed.');
+        const result = await api.installWindowsSandboxAsync({ timeoutMs: 180000, force: false, srtWin });
+        if (result.cancelled)
+            throw new DodoError('FORBIDDEN', 'Windows sandbox installation was canceled by the owner; no successful installation is claimed');
+        status = result;
+    }
+    if (!status.user.provisioned || !status.user.credPresent || status.wfp.state === 'absent')
+        throw new Error('Windows sandbox provisioning is incomplete');
+    if (!status.user.groupSid)
+        throw new Error('Windows sandbox group SID is unavailable after provisioning');
+    // srt-win is launched AS srt-sandbox via CreateProcessWithLogonW. Grant the
+    // dedicated sandbox group read+execute only on this architecture's native
+    // helper subtree; no write rights and no access to DODO owner state/JS.
+    grantSandboxRuntimeReadExecute(directory, status.user.groupSid);
+    log('[setup] Windows sandbox: verifying real file/network confinement and ACL cleanup.');
+    await verifySandbox(configDir, workspaceRoot);
+    if (!findWindowsSandbox(workspaceRoot, configDir)?.validated)
+        throw new Error('sandbox verification receipt did not validate');
+}
+//# sourceMappingURL=windowsSandboxInstall.js.map

package/dist/setup/windowsSandboxInstall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowsSandboxInstall.js","sourceRoot":"","sources":["../../src/setup/windowsSandboxInstall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAUlD,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;CAoB3C,CAAC;AACF,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,QAAgB;IACvE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;IACxI,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,QAAQ,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC9E,CAAC;AACD,SAAS,8BAA8B,CAAC,SAAiB,EAAE,QAAgB;IACzE,MAAM,KAAK,GAAG,SAAS,CAAC,uBAAuB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1M,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,SAAS,CAAC,uBAAuB,CAAC,uCAAuC,CAAC,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE;QACzN,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;QACnF,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,SAAS,EAAE;KACvF,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;AAC9K,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,SAAiB,EAAE,aAAqB,EAAE,WAAmB,EAAE,GAA2B;IACtI,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;IAC3H,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAsC,CAAC;IAC7H,IAAI,GAAG,CAAC,IAAI,KAAK,+BAA+B,IAAI,GAAG,CAAC,OAAO,KAAK,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjI,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC/D,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,uBAAuB,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACvH,MAAM,cAAc,GAAG,EAAE,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACxD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,cAAc,EAAE,IAAI,cAAc,CAAC,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACpL,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAAC,oBAAoB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAmB,CAAC;IAC3G,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,UAAU,IAAI,OAAO,GAAG,CAAC,8BAA8B,KAAK,UAAU,IAAI,OAAO,GAAG,CAAC,0BAA0B,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1N,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACnL,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC/D,IAAI,MAAM,GAAG,MAAM,GAAG,CAAC,8BAA8B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1F,GAAG,CAAC,sKAAsK,CAAC,CAAC;QAC5K,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,0BAA0B,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACjG,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,+FAA+F,CAAC,CAAC;QACxJ,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACzJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC1G,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,8BAA8B,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChE,GAAG,CAAC,mFAAmF,CAAC,CAAC;IACzF,MAAM,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;AACjI,CAAC"}

package/dist/setup/windowsSpeechInstall.js

@@ -0,0 +1,86 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { downloadVerified } from './download.js';
+import { registerManagedPath, activateManagedTools, assertSetupPrivatePaths } from './managedTools.js';
+import { ensurePrivateDirectory } from '../platform/privateFs.js';
+import { windowsSystemExecutable } from '../platform/system.js';
+import { removeWithRetry, renameWithRetry } from '../platform/fsRetry.js';
+import { buildChildEnv } from '../security/env.js';
+import { renderSpeech } from '../platform/speech.js';
+/** Official 1.52.0 release artifact, fetched and hashed during implementation. */
+export const ESPEAK_WINDOWS_PIN = {
+    url: 'https://github.com/espeak-ng/espeak-ng/releases/download/1.52.0/espeak-ng.msi',
+    sha256: '7f673c709ea5dd579d3b5ebb98688cc575328a6ab7438d2bc405b88cedaeafb9',
+    bytes: 12765862,
+};
+/** Owner-invoked administrative-image extraction, not a global SAPI registration. */
+export async function installWindowsSpeech(configDir, root) {
+    if (process.platform !== 'win32')
+        throw new Error('Windows speech installer called on another OS');
+    const tools = path.join(configDir, 'tools'), downloads = path.join(tools, 'downloads');
+    ensurePrivateDirectory(downloads);
+    const pin = ESPEAK_WINDOWS_PIN, archive = path.join(downloads, `espeak-${pin.sha256}.msi`);
+    await downloadVerified(pin, archive);
+    const directory = path.join(tools, `espeak-${pin.sha256.slice(0, 16)}`);
+    if (!fs.existsSync(directory)) {
+        const stage = fs.mkdtempSync(path.join(tools, '.stage-espeak-'));
+        ensurePrivateDirectory(stage);
+        try {
+            const installer = path.join(path.dirname(windowsSystemExecutable('cmd.exe')), 'msiexec.exe');
+            const result = spawnSync(installer, ['/a', archive, '/qn', '/norestart', `TARGETDIR=${stage}`], {
+                cwd: tools, shell: false, windowsHide: true, timeout: 180000, maxBuffer: 65536,
+                env: buildChildEnv({ parentEnv: process.env, workspaceRoot: root, extraAllowlist: [] }),
+            });
+            if (result.error || result.status !== 0)
+                throw new Error(`eSpeak administrative extraction failed (${result.status ?? 'spawn failure'}); no global voice registration or automatic reboot was requested`);
+            renameWithRetry(stage, directory);
+        }
+        finally {
+            if (fs.existsSync(stage))
+                removeWithRetry(stage, true);
+        }
+    }
+    assertSetupPrivatePaths([directory]);
+    const candidates = [];
+    const walk = (dir, depth) => {
+        if (depth > 8)
+            throw new Error('unexpected eSpeak archive depth');
+        for (const item of fs.readdirSync(dir, { withFileTypes: true })) {
+            if (item.isSymbolicLink())
+                throw new Error('eSpeak installation contains a directory link');
+            const file = path.join(dir, item.name);
+            if (item.isDirectory())
+                walk(file, depth + 1);
+            else if (item.isFile() && item.name.toLowerCase() === 'espeak-ng.exe')
+                candidates.push(file);
+        }
+    };
+    walk(directory, 0);
+    if (candidates.length !== 1)
+        throw new Error('eSpeak extraction did not produce one unambiguous CLI executable');
+    const selected = candidates[0];
+    const probe = spawnSync(selected, ['--version'], {
+        cwd: path.dirname(selected), shell: false, windowsHide: true, timeout: 10000, maxBuffer: 16384,
+        env: buildChildEnv({ parentEnv: process.env, workspaceRoot: root, extraAllowlist: [] }),
+    });
+    if (probe.error || probe.status !== 0)
+        throw new Error('extracted eSpeak executable did not pass its native version probe');
+    const verify = fs.realpathSync.native(fs.mkdtempSync(path.join(os.tmpdir(), 'dodo-espeak-probe-')));
+    ensurePrivateDirectory(verify);
+    try {
+        const input = path.join(verify, 'input.txt'), output = path.join(verify, 'output.wav');
+        fs.writeFileSync(input, 'DODO setup speech verification.', { flag: 'wx', mode: 0o600 });
+        await renderSpeech({ kind: 'espeak-ng', program: selected }, input, output);
+        const bytes = fs.readFileSync(output);
+        if (bytes.length < 100 || bytes.subarray(0, 4).toString('ascii') !== 'RIFF')
+            throw new Error('extracted eSpeak did not render a valid WAV file');
+    }
+    finally {
+        removeWithRetry(verify, true);
+    }
+    registerManagedPath(configDir, path.dirname(selected));
+    activateManagedTools(configDir, root);
+}
+//# sourceMappingURL=windowsSpeechInstall.js.map

package/dist/setup/windowsSpeechInstall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowsSpeechInstall.js","sourceRoot":"","sources":["../../src/setup/windowsSpeechInstall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAoB,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAgB;IAC7C,GAAG,EAAE,+EAA+E;IACpF,MAAM,EAAE,kEAAkE;IAC1E,KAAK,EAAE,QAAQ;CAChB,CAAC;AAEF,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,IAAY;IACxE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACvF,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAC3F,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAChG,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;YAC7F,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,KAAK,EAAE,CAAC,EAAE;gBAC9F,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK;gBAC9E,GAAG,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;aACxF,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,CAAC,MAAM,IAAI,eAAe,mEAAmE,CAAC,CAAC;YAC1M,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;IACvE,CAAC;IACD,uBAAuB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;QAChD,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC5F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;iBACzC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe;gBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACnB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACjH,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;IAChC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE;QAC/C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK;QAC9F,GAAG,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;KACxF,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC5H,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACpI,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACvF,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,iCAAiC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACnJ,CAAC;YAAS,CAAC;QAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IAC5C,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChG,CAAC"}