evolcore 0.0.25 → 0.0.27

package/bin/codex-managed-acl.ps1

@@ -1,160 +1,203 @@
-param([Parameter(Mandatory = $true)][string]$Request)
-
-# Called by the Node installer. Paths and security descriptors are data, never
-# interpolated into PowerShell source. Use Windows PowerShell's built-in .NET ACL API.
-$ErrorActionPreference = 'Stop'
-$ProgressPreference = 'SilentlyContinue'
-# A parent pwsh session can export its incompatible PowerShell 7 modules.
-# This helper always runs in Windows PowerShell 5.1.
-$env:PSModulePath = Join-Path $PSHOME 'Modules'
-[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
-
-function Get-Descriptor([string]$Target) {
-  return (Get-Acl -LiteralPath $Target).GetSecurityDescriptorSddlForm(
-    [Security.AccessControl.AccessControlSections]'Access,Owner,Group')
-}
-
-function Set-Descriptor([string]$Target, [string]$Sddl) {
-  $acl = Get-Acl -LiteralPath $Target
-  $acl.SetSecurityDescriptorSddlForm($Sddl, [Security.AccessControl.AccessControlSections]'Access,Owner,Group')
-  Set-Acl -LiteralPath $Target -AclObject $acl
-}
-
-function Add-Grant($Acl, [string]$Sid, [Security.AccessControl.FileSystemRights]$Rights, [bool]$Directory) {
-  $inheritance = if ($Directory) { [Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit' } else { [Security.AccessControl.InheritanceFlags]::None }
-  $rule = New-Object Security.AccessControl.FileSystemAccessRule(
-    (New-Object Security.Principal.SecurityIdentifier($Sid)), $Rights, $inheritance,
-    [Security.AccessControl.PropagationFlags]::None, [Security.AccessControl.AccessControlType]::Allow)
-  $Acl.AddAccessRule($rule)
-}
-
-function Initialize-AccessProbe {
-  # An elevated process reading the file is not evidence that a normal process
-  # can read it. Evaluate the DACL with its UAC linked token when available.
-  Add-Type -TypeDefinition @'
-using System;
-using System.Runtime.InteropServices;
-using System.Security.Principal;
-public static class EvolCoreAclProbe {
-  [StructLayout(LayoutKind.Sequential)]
-  struct Mapping { public uint Read, Write, Execute, All; }
-  [DllImport("advapi32.dll", SetLastError=true)]
-  static extern bool GetTokenInformation(IntPtr token, int type, out IntPtr linked, int size, out int returned);
-  [DllImport("advapi32.dll", SetLastError=true)]
-  static extern bool DuplicateTokenEx(IntPtr token, uint desiredAccess, IntPtr tokenAttributes,
-    int impersonationLevel, int tokenType, out IntPtr duplicate);
-  [DllImport("advapi32.dll", SetLastError=true)]
-  static extern bool AccessCheck(byte[] descriptor, IntPtr token, uint desired,
-    ref Mapping mapping, byte[] privileges, ref uint length, out uint granted, out bool allowed);
-  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
-  public static string TokenKind;
-  public static long Granted(byte[] descriptor) {
-    using (var identity = WindowsIdentity.GetCurrent()) {
-      var principal = new WindowsPrincipal(identity);
-      IntPtr token = identity.Token, linked = IntPtr.Zero, duplicate = IntPtr.Zero;
-      try {
-        if (identity.IsSystem || principal.IsInRole(WindowsBuiltInRole.Administrator)) {
-          int size;
-          if (!GetTokenInformation(token, 19, out linked, IntPtr.Size, out size)) {
-            TokenKind = "unavailable";
-            return -1;
-          }
-          token = linked;
-          TokenKind = "linked-token";
-        } else { TokenKind = "current-token"; }
-        // AccessCheck only needs SecurityIdentification (1). A UAC linked
-        // token can be limited to that level, so requesting the higher
-        // SecurityImpersonation level fails with ERROR_BAD_IMPERSONATION_LEVEL.
-        if (!DuplicateTokenEx(token, 0x0000000A, IntPtr.Zero, 1, 2, out duplicate))
-          throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
-        var mapping = new Mapping { Read=0x120089, Write=0x120116, Execute=0x1200a0, All=0x1f01ff };
-        uint length=1024, granted;
-        bool allowed;
-        if (!AccessCheck(descriptor, duplicate, 0x02000000, ref mapping,
-            new byte[length], ref length, out granted, out allowed))
-          throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
-        return allowed ? granted : 0;
-      } finally {
-        if (duplicate != IntPtr.Zero) CloseHandle(duplicate);
-        if (linked != IntPtr.Zero) CloseHandle(linked);
-      }
-    }
-  }
-}
-'@
-}
-
-function Verify-Access($Entry) {
-  $target = [string]$Entry.path
-  $acl = Get-Acl -LiteralPath $target
-  $read = [long][Security.AccessControl.FileSystemRights]::ReadAndExecute
-  $write = [long][Security.AccessControl.FileSystemRights]'Write,Delete,DeleteSubdirectoriesAndFiles,ChangePermissions,TakeOwnership'
-  if ($Entry.protected) {
-    $grants = @{}
-    foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
-      if (($rule.PropagationFlags -band [Security.AccessControl.PropagationFlags]::InheritOnly) -ne 0) { continue }
-      $sid = $rule.IdentityReference.Value
-      $rights = [long]$rule.FileSystemRights
-      if ($sid -in @('S-1-1-0','S-1-5-11','S-1-5-32-545')) {
-        if ($rule.AccessControlType -eq 'Allow' -and ($rights -band $write) -ne 0) {
-          throw "Unsafe write permission on ${target}: $sid has $($rule.FileSystemRights). Existing policy was not removed."
-        }
-        if ($rule.AccessControlType -eq 'Deny' -and ($rights -band $read) -ne 0) {
-          throw "Read permission denied on ${target}: $sid. Existing policy was not removed."
-        }
-      }
-      if ($rule.AccessControlType -eq 'Allow') { $grants[$sid] = ([long]$grants[$sid]) -bor $rights }
-    }
-    foreach ($sid in @('S-1-5-18','S-1-5-32-544','S-1-5-32-545')) {
-      $required = if ($sid -eq 'S-1-5-32-545') { $read } else { [long][Security.AccessControl.FileSystemRights]::FullControl }
-      if ((([long]$grants[$sid]) -band $required) -ne $required) { throw "Missing required access on ${target}: $sid" }
-    }
-  }
-  $granted = [EvolCoreAclProbe]::Granted($acl.GetSecurityDescriptorBinaryForm())
-  if ($granted -ge 0) {
-    $required = if ($Entry.execute) { $read } else { [long][Security.AccessControl.FileSystemRights]::Read }
-    if (($granted -band $required) -ne $required) { throw "Normal-token read/execute access denied: $target" }
-    if ($Entry.protected -and ($granted -band $write) -ne 0) { throw "Normal token can modify the protected file or its ACL: $target" }
-  }
-  return @{ path = $target; userProbe = [EvolCoreAclProbe]::TokenKind }
-}
-
-try {
-  $payload = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($Request)) | ConvertFrom-Json
-  $result = switch ($payload.action) {
-    'preflight' {
-      $principal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
-      if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
-        throw 'Machine-wide Codex hook provisioning requires an elevated Windows installer. npm installation does not require this step.'
-      }
-      @{ elevated = $true }
-    }
-    'snapshot' { @{ sddl = (Get-Descriptor $payload.path) } }
-    'prepare' {
-      $target = [string]$payload.path
-      if ($payload.reference) {
-        # Same-directory staging preserves the shared configuration's owner,
-        # inherited policy and custom administrator ACEs. Never reset its ACL.
-        Set-Descriptor $target (Get-Descriptor $payload.reference)
-      } else {
-        $flags = if ($payload.directory) { 'OICI' } else { '' }
-        Set-Descriptor $target "O:BAG:BAD:P(A;${flags};FA;;;SY)(A;${flags};FA;;;BA)(A;${flags};FRFX;;;BU)"
-      }
-      $acl = Get-Acl -LiteralPath $target
-      Add-Grant $acl 'S-1-5-18' 'FullControl' ([bool]$payload.directory)
-      Add-Grant $acl 'S-1-5-32-544' 'FullControl' ([bool]$payload.directory)
-      Add-Grant $acl 'S-1-5-32-545' 'ReadAndExecute' ([bool]$payload.directory)
-      Set-Acl -LiteralPath $target -AclObject $acl
-      @{ prepared = $true }
-    }
-    'verify' {
-      Initialize-AccessProbe
-      @($payload.entries | ForEach-Object { Verify-Access $_ })
-    }
-    default { throw "Unknown ACL operation: $($payload.action)" }
-  }
-  ConvertTo-Json -InputObject $result -Depth 8 -Compress
-} catch {
-  [Console]::Error.WriteLine("[evolcore] ACL $($payload.action) failed for $($payload.path): $($_.Exception.Message)")
-  exit 1
-}
+param([Parameter(Mandatory = $true)][string]$Request)
+
+# Called by the Node installer. Paths and security descriptors are data, never
+# interpolated into PowerShell source. Use Windows PowerShell's built-in .NET ACL API.
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+# A parent pwsh session can export its incompatible PowerShell 7 modules.
+# This helper always runs in Windows PowerShell 5.1.
+$env:PSModulePath = Join-Path $PSHOME 'Modules'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+
+function Get-Descriptor([string]$Target) {
+  return (Get-Acl -LiteralPath $Target).GetSecurityDescriptorSddlForm(
+    [Security.AccessControl.AccessControlSections]'Access,Owner,Group')
+}
+
+function Set-Descriptor([string]$Target, [string]$Sddl) {
+  $acl = Get-Acl -LiteralPath $Target
+  $acl.SetSecurityDescriptorSddlForm($Sddl, [Security.AccessControl.AccessControlSections]'Access,Owner,Group')
+  Set-Acl -LiteralPath $Target -AclObject $acl
+}
+
+function Add-Grant($Acl, [string]$Sid, [Security.AccessControl.FileSystemRights]$Rights, [bool]$Directory) {
+  $inheritance = if ($Directory) { [Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit' } else { [Security.AccessControl.InheritanceFlags]::None }
+  $rule = New-Object Security.AccessControl.FileSystemAccessRule(
+    (New-Object Security.Principal.SecurityIdentifier($Sid)), $Rights, $inheritance,
+    [Security.AccessControl.PropagationFlags]::None, [Security.AccessControl.AccessControlType]::Allow)
+  $Acl.AddAccessRule($rule)
+}
+
+function Grant-PipeAccess([string]$Target) {
+  $prefix = '\\.\pipe\'
+  if (-not $Target.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase)) {
+    throw 'Only a local named pipe can receive Codex sandbox access.'
+  }
+  $pipeName = $Target.Substring($prefix.Length)
+  if (-not $pipeName -or $pipeName.Contains('\') -or $pipeName.Contains('/')) {
+    throw 'Invalid local named pipe name.'
+  }
+  $accounts = @()
+  foreach ($name in @('CodexSandboxOffline', 'CodexSandboxOnline')) {
+    try {
+      $account = New-Object Security.Principal.NTAccount([Environment]::MachineName, $name)
+      $sid = $account.Translate([Security.Principal.SecurityIdentifier])
+      $accounts += @{ name = $name; sid = $sid }
+    } catch [Security.Principal.IdentityNotMappedException] {
+      # Codex creates these local users during sandbox provisioning. Do not
+      # replace a missing user with Everyone, Authenticated Users, or a group.
+    }
+  }
+  if ($accounts.Count -eq 0) { return @{ granted = @() } }
+  $pipe = New-Object System.IO.Pipes.NamedPipeClientStream('.', $pipeName,
+    [System.IO.Pipes.PipeAccessRights]'ReadWrite,ReadPermissions,ChangePermissions',
+    [System.IO.Pipes.PipeOptions]::Asynchronous,
+    [Security.Principal.TokenImpersonationLevel]::Identification,
+    [System.IO.HandleInheritability]::None)
+  try {
+    $pipe.Connect(5000)
+    $acl = $pipe.GetAccessControl()
+    $rights = [System.IO.Pipes.PipeAccessRights]'ReadWrite,Synchronize'
+    foreach ($account in $accounts) {
+      # GenericWrite/FullControl also grant CreateNewInstance on named pipes.
+      # Grant only data I/O to the actual restricted user; the sandbox group
+      # alone does not satisfy Windows restricted-token access checks.
+      $acl.AddAccessRule((New-Object System.IO.Pipes.PipeAccessRule(
+        $account.sid, $rights, [Security.AccessControl.AccessControlType]::Allow)))
+    }
+    $pipe.SetAccessControl($acl)
+    return @{ granted = @($accounts | ForEach-Object { $_.name }) }
+  } finally { $pipe.Dispose() }
+}
+
+function Initialize-AccessProbe {
+  # An elevated process reading the file is not evidence that a normal process
+  # can read it. Evaluate the DACL with its UAC linked token when available.
+  Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using System.Security.Principal;
+public static class EvolCoreAclProbe {
+  [StructLayout(LayoutKind.Sequential)]
+  struct Mapping { public uint Read, Write, Execute, All; }
+  [DllImport("advapi32.dll", SetLastError=true)]
+  static extern bool GetTokenInformation(IntPtr token, int type, out IntPtr linked, int size, out int returned);
+  [DllImport("advapi32.dll", SetLastError=true)]
+  static extern bool DuplicateTokenEx(IntPtr token, uint desiredAccess, IntPtr tokenAttributes,
+    int impersonationLevel, int tokenType, out IntPtr duplicate);
+  [DllImport("advapi32.dll", SetLastError=true)]
+  static extern bool AccessCheck(byte[] descriptor, IntPtr token, uint desired,
+    ref Mapping mapping, byte[] privileges, ref uint length, out uint granted, out bool allowed);
+  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+  public static string TokenKind;
+  public static long Granted(byte[] descriptor) {
+    using (var identity = WindowsIdentity.GetCurrent()) {
+      var principal = new WindowsPrincipal(identity);
+      IntPtr token = identity.Token, linked = IntPtr.Zero, duplicate = IntPtr.Zero;
+      try {
+        if (identity.IsSystem || principal.IsInRole(WindowsBuiltInRole.Administrator)) {
+          int size;
+          if (!GetTokenInformation(token, 19, out linked, IntPtr.Size, out size)) {
+            TokenKind = "unavailable";
+            return -1;
+          }
+          token = linked;
+          TokenKind = "linked-token";
+        } else { TokenKind = "current-token"; }
+        // AccessCheck only needs SecurityIdentification (1). A UAC linked
+        // token can be limited to that level, so requesting the higher
+        // SecurityImpersonation level fails with ERROR_BAD_IMPERSONATION_LEVEL.
+        if (!DuplicateTokenEx(token, 0x0000000A, IntPtr.Zero, 1, 2, out duplicate))
+          throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
+        var mapping = new Mapping { Read=0x120089, Write=0x120116, Execute=0x1200a0, All=0x1f01ff };
+        uint length=1024, granted;
+        bool allowed;
+        if (!AccessCheck(descriptor, duplicate, 0x02000000, ref mapping,
+            new byte[length], ref length, out granted, out allowed))
+          throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
+        return allowed ? granted : 0;
+      } finally {
+        if (duplicate != IntPtr.Zero) CloseHandle(duplicate);
+        if (linked != IntPtr.Zero) CloseHandle(linked);
+      }
+    }
+  }
+}
+'@
+}
+
+function Verify-Access($Entry) {
+  $target = [string]$Entry.path
+  $acl = Get-Acl -LiteralPath $target
+  $read = [long][Security.AccessControl.FileSystemRights]::ReadAndExecute
+  $write = [long][Security.AccessControl.FileSystemRights]'Write,Delete,DeleteSubdirectoriesAndFiles,ChangePermissions,TakeOwnership'
+  if ($Entry.protected) {
+    $grants = @{}
+    foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+      if (($rule.PropagationFlags -band [Security.AccessControl.PropagationFlags]::InheritOnly) -ne 0) { continue }
+      $sid = $rule.IdentityReference.Value
+      $rights = [long]$rule.FileSystemRights
+      if ($sid -in @('S-1-1-0','S-1-5-11','S-1-5-32-545')) {
+        if ($rule.AccessControlType -eq 'Allow' -and ($rights -band $write) -ne 0) {
+          throw "Unsafe write permission on ${target}: $sid has $($rule.FileSystemRights). Existing policy was not removed."
+        }
+        if ($rule.AccessControlType -eq 'Deny' -and ($rights -band $read) -ne 0) {
+          throw "Read permission denied on ${target}: $sid. Existing policy was not removed."
+        }
+      }
+      if ($rule.AccessControlType -eq 'Allow') { $grants[$sid] = ([long]$grants[$sid]) -bor $rights }
+    }
+    foreach ($sid in @('S-1-5-18','S-1-5-32-544','S-1-5-32-545')) {
+      $required = if ($sid -eq 'S-1-5-32-545') { $read } else { [long][Security.AccessControl.FileSystemRights]::FullControl }
+      if ((([long]$grants[$sid]) -band $required) -ne $required) { throw "Missing required access on ${target}: $sid" }
+    }
+  }
+  $granted = [EvolCoreAclProbe]::Granted($acl.GetSecurityDescriptorBinaryForm())
+  if ($granted -ge 0) {
+    $required = if ($Entry.execute) { $read } else { [long][Security.AccessControl.FileSystemRights]::Read }
+    if (($granted -band $required) -ne $required) { throw "Normal-token read/execute access denied: $target" }
+    if ($Entry.protected -and ($granted -band $write) -ne 0) { throw "Normal token can modify the protected file or its ACL: $target" }
+  }
+  return @{ path = $target; userProbe = [EvolCoreAclProbe]::TokenKind }
+}
+
+try {
+  $payload = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($Request)) | ConvertFrom-Json
+  $result = switch ($payload.action) {
+    'pipe' { Grant-PipeAccess ([string]$payload.path) }
+    'preflight' {
+      $principal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
+      if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+        throw 'Machine-wide Codex hook provisioning requires an elevated Windows installer. npm installation does not require this step.'
+      }
+      @{ elevated = $true }
+    }
+    'snapshot' { @{ sddl = (Get-Descriptor $payload.path) } }
+    'prepare' {
+      $target = [string]$payload.path
+      if ($payload.reference) {
+        # Same-directory staging preserves the shared configuration's owner,
+        # inherited policy and custom administrator ACEs. Never reset its ACL.
+        Set-Descriptor $target (Get-Descriptor $payload.reference)
+      } else {
+        $flags = if ($payload.directory) { 'OICI' } else { '' }
+        Set-Descriptor $target "O:BAG:BAD:P(A;${flags};FA;;;SY)(A;${flags};FA;;;BA)(A;${flags};FRFX;;;BU)"
+      }
+      $acl = Get-Acl -LiteralPath $target
+      Add-Grant $acl 'S-1-5-18' 'FullControl' ([bool]$payload.directory)
+      Add-Grant $acl 'S-1-5-32-544' 'FullControl' ([bool]$payload.directory)
+      Add-Grant $acl 'S-1-5-32-545' 'ReadAndExecute' ([bool]$payload.directory)
+      Set-Acl -LiteralPath $target -AclObject $acl
+      @{ prepared = $true }
+    }
+    'verify' {
+      Initialize-AccessProbe
+      @($payload.entries | ForEach-Object { Verify-Access $_ })
+    }
+    default { throw "Unknown ACL operation: $($payload.action)" }
+  }
+  ConvertTo-Json -InputObject $result -Depth 8 -Compress
+} catch {
+  [Console]::Error.WriteLine("[evolcore] ACL $($payload.action) failed for $($payload.path): $($_.Exception.Message)")
+  exit 1
+}