iteration-cli 0.13.0 → 0.14.0

package/dist/launcher.js

@@ -6,13 +6,13 @@ var __export = (target, all) => {
 };
 
 // src/launcher.ts
-import { promises as fs2 } from "node:fs";
+import { promises as fs3 } from "node:fs";
 import { pathToFileURL } from "node:url";
 
 // src/runtime.ts
-import { promises as fs } from "node:fs";
+import { promises as fs2 } from "node:fs";
 import os from "node:os";
-import path from "node:path";
+import path2 from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 
 // ../../node_modules/.pnpm/zod@4.6.4/node_modules/zod/v4/core/util.js
@@ -251,10 +251,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path2) {
-  if (!path2)
+function getElementAtPath(obj, path3) {
+  if (!path3)
     return obj;
-  return path2.reduce((acc, key) => acc?.[key], obj);
+  return path3.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -594,11 +594,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path2, issues) {
+function prefixIssues(path3, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path2);
+    iss.path.unshift(path3);
     return iss;
   });
 }
@@ -1044,16 +1044,16 @@ function flattenError(error2, mapper = (issue2) => issue2.message) {
 }
 function formatError(error2, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error3, path2 = []) => {
+  const processError = (error3, path3 = []) => {
     for (const issue2 of error3.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path2, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path3, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else {
-        const fullpath = [...path2, ...issue2.path];
+        const fullpath = [...path3, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -6545,19 +6545,149 @@ var collectorEnrollmentResponseSchema = discriminatedUnion("status", [
   }).strict()
 ]);
 
+// src/private-storage.ts
+import { promises as fs } from "node:fs";
+
+// src/windows-powershell.ts
+import { execFile as execFileCallback } from "node:child_process";
+import path from "node:path";
+import { promisify } from "node:util";
+var execFile = promisify(execFileCallback);
+function windowsPowerShellPath() {
+  return path.join(
+    process.env.SystemRoot ?? "C:\\Windows",
+    "System32",
+    "WindowsPowerShell",
+    "v1.0",
+    "powershell.exe"
+  );
+}
+function powershellLiteral(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+function encodedPowerShell(script) {
+  return Buffer.from(script, "utf16le").toString("base64");
+}
+async function runWindowsPowerShell(operation, script) {
+  try {
+    const { stdout } = await execFile(
+      windowsPowerShellPath(),
+      [
+        "-NoLogo",
+        "-NoProfile",
+        "-NonInteractive",
+        "-EncodedCommand",
+        encodedPowerShell(
+          `$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)
+${script}`
+        )
+      ],
+      {
+        timeout: 3e4,
+        maxBuffer: 1024 * 1024,
+        windowsHide: true
+      }
+    );
+    return stdout.trim();
+  } catch (error2) {
+    const failure2 = object({ stderr: string2() }).safeParse(error2);
+    const detail = failure2.success ? failure2.data.stderr.trim().slice(0, 4096) : "";
+    throw new Error(
+      `Windows could not ${operation}.${detail ? `
+${detail}` : ""}`,
+      { cause: error2 }
+    );
+  }
+}
+
+// src/private-storage.ts
+var securedDirectories = /* @__PURE__ */ new Map();
+var MAX_SECURED_DIRECTORIES = 128;
+async function secureWindowsDirectory(directory) {
+  await runWindowsPowerShell(
+    "secure private collector storage",
+    `
+$root = ${powershellLiteral(directory)}
+$owner = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$principals = @($owner, [System.Security.Principal.SecurityIdentifier]::new('S-1-5-18'), [System.Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'))
+$pending = [System.Collections.Generic.Stack[string]]::new()
+$pending.Push($root)
+$count = 0
+while ($pending.Count -gt 0) {
+  $entry = $pending.Pop()
+  try {
+  $item = Get-Item -LiteralPath $entry -Force
+  if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'Private storage cannot contain filesystem links.' }
+  if (++$count -gt 65536) { throw 'Private storage has too many entries to secure.' }
+  if ($item.PSIsContainer) {
+    $acl = [System.Security.AccessControl.DirectorySecurity]::new()
+    $inheritance = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+  } else {
+    $acl = [System.Security.AccessControl.FileSecurity]::new()
+    $inheritance = [System.Security.AccessControl.InheritanceFlags]::None
+  }
+  $acl.SetOwner($owner)
+  $acl.SetAccessRuleProtection($true, $false)
+  foreach ($principal in $principals) {
+    $acl.AddAccessRule([System.Security.AccessControl.FileSystemAccessRule]::new($principal, 'FullControl', $inheritance, 'None', 'Allow'))
+  }
+  # Set-Acl may request audit privileges on a protected DACL. Persist only
+  # the changed owner and access rules so repair needs no elevation.
+  $item.SetAccessControl($acl)
+  $actual = Get-Acl -LiteralPath $item.FullName
+  if (!$actual.AreAccessRulesProtected -or $actual.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $owner.Value) { throw 'Private storage ACL verification failed.' }
+  foreach ($rule in $actual.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+    if ($rule.AccessControlType -ne 'Allow' -or $principals.Value -notcontains $rule.IdentityReference.Value) { throw 'Private storage contains an unexpected access rule.' }
+  }
+  if ($item.PSIsContainer) {
+    foreach ($child in [System.IO.Directory]::EnumerateFileSystemEntries($item.FullName)) {
+      if ($count + $pending.Count -ge 65536) { throw 'Private storage has too many entries to secure.' }
+      $pending.Push($child)
+    }
+  }
+  } catch [System.Management.Automation.ItemNotFoundException] {
+    if ($entry -eq $root) { throw }
+  }
+}
+`
+  );
+}
+async function ensurePrivateDirectory(directory) {
+  await fs.mkdir(directory, { recursive: true, mode: 448 });
+  if (process.platform !== "win32") {
+    await fs.chmod(directory, 448);
+    return;
+  }
+  const resolved = await fs.realpath(directory);
+  let secured = securedDirectories.get(resolved);
+  if (secured === void 0) {
+    if (securedDirectories.size >= MAX_SECURED_DIRECTORIES) {
+      const oldest = securedDirectories.keys().next().value;
+      if (oldest !== void 0) securedDirectories.delete(oldest);
+    }
+    secured = secureWindowsDirectory(resolved).catch((error2) => {
+      securedDirectories.delete(resolved);
+      throw error2;
+    });
+    securedDirectories.set(resolved, secured);
+  }
+  await secured;
+}
+
 // src/runtime.ts
 function runtimePaths(home = os.homedir()) {
-  const root = path.join(home, ".config", "iteration", "runtime");
+  const root = path2.join(home, ".config", "iteration", "runtime");
   return {
     home,
     root,
-    versions: path.join(root, "versions"),
-    staging: path.join(root, "staging"),
-    state: path.join(root, "state.json"),
-    settings: path.join(root, "settings.json"),
-    lock: path.join(root, "state.lock"),
-    updateLock: path.join(root, "update.lock"),
-    launcher: path.join(root, "launcher.js")
+    versions: path2.join(root, "versions"),
+    staging: path2.join(root, "staging"),
+    state: path2.join(root, "state.json"),
+    settings: path2.join(root, "settings.json"),
+    lock: path2.join(root, "state.lock"),
+    updateLock: path2.join(root, "update.lock"),
+    launcher: path2.join(root, "launcher.js")
   };
 }
 var MAX_TRIAL_STARTS = 3;
@@ -6601,25 +6731,24 @@ function isVersion(value) {
 }
 async function ensureRuntimeDirectory(paths) {
   for (const directory of [paths.root, paths.versions, paths.staging]) {
-    await fs.mkdir(directory, { recursive: true, mode: 448 });
-    await fs.chmod(directory, 448);
+    await ensurePrivateDirectory(directory);
   }
 }
 async function writeFileAtomic(filename, contents, mode) {
   const temporary = `${filename}.${process.pid}.${Date.now()}.tmp`;
-  const handle = await fs.open(temporary, "w", mode);
+  const handle = await fs2.open(temporary, "w", mode);
   try {
     await handle.writeFile(contents, "utf8");
     await handle.sync();
   } finally {
     await handle.close();
   }
-  await fs.rename(temporary, filename);
+  await fs2.rename(temporary, filename);
 }
 async function readRuntimeState(paths) {
   let contents;
   try {
-    contents = await fs.readFile(paths.state, "utf8");
+    contents = await fs2.readFile(paths.state, "utf8");
   } catch (error2) {
     if (errorCode(error2) === "ENOENT") return null;
     throw error2;
@@ -6653,19 +6782,19 @@ var LockBusyError = class extends Error {
 async function tryLock(filename) {
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      const handle = await fs.open(filename, "wx", 384);
+      const handle = await fs2.open(filename, "wx", 384);
       await handle.writeFile(`${process.pid}
 `, "utf8");
       await handle.close();
       return async () => {
-        const owner = await fs.readFile(filename, "utf8").catch(() => "");
+        const owner = await fs2.readFile(filename, "utf8").catch(() => "");
         if (owner.trim() === String(process.pid))
-          await fs.rm(filename, { force: true });
+          await fs2.rm(filename, { force: true });
       };
     } catch (error2) {
       if (errorCode(error2) !== "EEXIST") throw error2;
       const owner = Number(
-        (await fs.readFile(filename, "utf8").catch(() => "")).trim()
+        (await fs2.readFile(filename, "utf8").catch(() => "")).trim()
       );
       if (Number.isSafeInteger(owner) && owner > 1) {
         try {
@@ -6675,7 +6804,7 @@ async function tryLock(filename) {
           if (errorCode(processError) !== "ESRCH") throw processError;
         }
       }
-      await fs.rm(filename, { force: true });
+      await fs2.rm(filename, { force: true });
     }
   }
   throw new LockBusyError(`Could not obtain ${filename}.`);
@@ -6740,10 +6869,10 @@ function launchDecision(state, command, source, nowMs) {
 function versionDirectory(paths, version2) {
   if (!isVersion(version2))
     throw new Error(`Invalid Iteration version ${version2}.`);
-  return path.join(paths.versions, version2);
+  return path2.join(paths.versions, version2);
 }
 function versionEntry(paths, version2, entry) {
-  return path.join(versionDirectory(paths, version2), "dist", entry);
+  return path2.join(versionDirectory(paths, version2), "dist", entry);
 }
 var packageSchema = object({ name: literal("iteration-cli"), version: versionSchema }).loose();
 
@@ -6784,7 +6913,7 @@ async function launch() {
     command === "cursor-hook" ? "cursor-hook-entry.js" : "cli.js"
   );
   if (command === "launcher-check") {
-    await fs2.access(entry);
+    await fs3.access(entry);
     process.stdout.write(`${version2}
 `);
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iteration-cli",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "type": "module",
   "repository": {
     "type": "git",
@@ -22,7 +22,7 @@
     "@secretlint/secretlint-rule-preset-recommend": "13.0.6",
     "esbuild": "0.28.2",
     "zod": "4.6.4",
-    "iteration-trace-contracts": "0.10.0"
+    "iteration-trace-contracts": "0.11.0"
   },
   "scripts": {
     "build": "pnpm --filter iteration-trace-contracts build && tsc -p tsconfig.json --noEmit && node build.mjs"