jev-agent-tools 0.1.4 → 0.3.0

package/src/adapters/locate-file.ts

@@ -34,6 +34,7 @@ export async function readLocateFile(
   if (/^[a-z][a-z0-9+.-]*:\/\//i.test(path))
     return {
       ok: false,
+      cause: "forbidden_path",
       error: `Internal URLs are not files; use read for ${path}.`,
     };
   const opened = await openRepoFile(cwd, path, { exec, signal });
@@ -41,7 +42,12 @@ export async function readLocateFile(
   const handle = opened.handle;
   try {
     const stat = await handle.stat();
-    if (!stat.isFile()) return { ok: false, error: `Not a file: ${path}.` };
+    if (!stat.isFile())
+      return {
+        ok: false,
+        cause: "file_unavailable",
+        error: `Not a file: ${path}.`,
+      };
     const buffer = Buffer.alloc(
       Math.min(stat.size + 1, LOCATE_WHOLE_MAX_BYTES + 1),
     );
@@ -58,10 +64,19 @@ export async function readLocateFile(
       count += read.bytesRead;
     }
     if (buffer.subarray(0, count).includes(0))
-      return { ok: false, error: `Not a text file: ${path}.` };
+      return {
+        ok: false,
+        cause: "binary_or_non_utf8",
+        error: `Not a text file: ${path}.`,
+      };
     if (count < buffer.length) {
       const decoded = decodeUtf8(buffer.subarray(0, count));
-      if (!decoded.ok) return { ok: false, error: `${path}: ${decoded.error}` };
+      if (!decoded.ok)
+        return {
+          ok: false,
+          cause: "binary_or_non_utf8",
+          error: `${path}: ${decoded.error}`,
+        };
       const text = decoded.text;
       if (text.length <= LOCATE_WHOLE_MAX_CHARS)
         return {
@@ -85,7 +100,11 @@ export async function readLocateFile(
         }
       : scan;
   } catch (error) {
-    return { ok: false, error: `Cannot read ${path}: ${String(error)}` };
+    return {
+      ok: false,
+      cause: signal?.aborted ? "cancelled" : "file_unavailable",
+      error: `Cannot read ${path}: ${String(error)}`,
+    };
   } finally {
     await handle.close();
   }
@@ -171,26 +190,49 @@ export async function scanRange(
         break;
       }
       if (buffer.subarray(0, read.bytesRead).includes(0))
-        return { ok: false, error: `Not a text file: ${path}.` };
+        return {
+          ok: false,
+          cause: "binary_or_non_utf8",
+          error: `Not a text file: ${path}.`,
+        };
       bytes += read.bytesRead;
       const decoded = decode(buffer.subarray(0, read.bytesRead));
-      if (!decoded.ok) return { ok: false, error: `${path}: ${decoded.error}` };
+      if (!decoded.ok)
+        return {
+          ok: false,
+          cause: "binary_or_non_utf8",
+          error: `${path}: ${decoded.error}`,
+        };
       if (!consume(decoded.text))
         return {
           ok: false,
+          cause: "evidence_too_large",
           error: `Selected range exceeds ${STATE_MAX_CHARS} chars; read a narrower range directly.`,
         };
       if (range && line > range.end) break;
     }
     const end = reachedEof ? decode() : { ok: true as const, text: "" };
-    if (!end.ok) return { ok: false, error: `${path}: ${end.error}` };
+    if (!end.ok)
+      return {
+        ok: false,
+        cause: "binary_or_non_utf8",
+        error: `${path}: ${end.error}`,
+      };
     if (!consume(end.text))
-      return { ok: false, error: "Selected range too large." };
+      return {
+        ok: false,
+        cause: "evidence_too_large",
+        error: "Selected range too large.",
+      };
     const lines = line - Number(!pending);
     if (lines > 0 && (windows.at(-1)?.end ?? 0) < lines) finishWindow(lines);
     return { ok: true, bytes, lines, windows, text };
   } catch (error) {
-    return { ok: false, error: `Cannot read ${path}: ${String(error)}` };
+    return {
+      ok: false,
+      cause: signal?.aborted ? "cancelled" : "file_unavailable",
+      error: `Cannot read ${path}: ${String(error)}`,
+    };
   } finally {
     await handle.close();
   }

package/src/adapters/private-storage.ts

@@ -0,0 +1,155 @@
+import { execFile } from "node:child_process";
+import type { Stats } from "node:fs";
+import { join } from "node:path";
+import { PRIVATE_STORAGE_TIMEOUT_MS } from "../constants.ts";
+import { withoutApiKey } from "./shell.ts";
+
+/**
+ * Owner-only storage, checked with each operating system's own model.
+ *
+ * POSIX: no group/other mode bits and owned by the current user.
+ * Windows: mode bits are synthesized (always 0o666), so the real ACL is read.
+ * Storage is private when every allow entry belongs to the current user,
+ * SYSTEM or the Administrators group (the Windows equivalent of root), and
+ * the owner is the current user or Administrators. Entries are compared as
+ * SIDs, so localized account names do not matter.
+ */
+export interface PrivateStorage {
+  /** True when every path is private. One check for all paths. */
+  isPrivate(
+    entries: readonly { path: string; stat: Stats }[],
+  ): Promise<boolean>;
+  /** Restrict a directory the current user owns so new files inherit privacy. */
+  restrictDirectory(path: string): Promise<void>;
+}
+
+const SYSTEM = "S-1-5-18";
+const ADMINISTRATORS = "S-1-5-32-544";
+const CREATOR_OWNER = "S-1-3-0";
+
+export const posixStorage: PrivateStorage = {
+  async isPrivate(entries) {
+    return entries.every(
+      ({ stat }) =>
+        (stat.mode & 0o077) === 0 &&
+        (!process.getuid || stat.uid === process.getuid()),
+    );
+  },
+  async restrictDirectory() {
+    // mkdir(..., { mode: 0o700 }) already creates POSIX directories privately.
+  },
+};
+
+// Paths arrive as JSON in an environment variable, never in the command text.
+const CHECK = `$ErrorActionPreference = 'Stop'
+$me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+$trusted = @($me, '${SYSTEM}', '${ADMINISTRATORS}')
+$sid = [System.Security.Principal.SecurityIdentifier]
+$results = foreach ($path in (ConvertFrom-Json $env:JEV_PRIVATE_PATHS)) {
+  try {
+    $acl = Get-Acl -LiteralPath $path
+    $owner = $acl.GetOwner($sid).Value
+    $private = ($owner -eq $me) -or ($owner -eq '${ADMINISTRATORS}')
+    foreach ($rule in $acl.GetAccessRules($true, $true, $sid)) {
+      if ($rule.AccessControlType -ne 'Allow') { continue }
+      $id = $rule.IdentityReference.Value
+      $inheritOnly = ($rule.PropagationFlags -band [System.Security.AccessControl.PropagationFlags]::InheritOnly) -ne 0
+      if ($id -eq '${CREATOR_OWNER}' -and $inheritOnly) { continue }
+      if ($trusted -notcontains $id) { $private = $false }
+    }
+    $private
+  } catch { $false }
+}
+ConvertTo-Json -Compress @($results)`;
+
+const RESTRICT = `$ErrorActionPreference = 'Stop'
+$path = $env:JEV_PRIVATE_PATH
+$me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$acl = Get-Acl -LiteralPath $path
+if ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $me.Value) { throw 'not owner' }
+$acl.SetAccessRuleProtection($true, $false)
+foreach ($rule in @($acl.Access)) { [void]$acl.RemoveAccessRuleAll($rule) }
+$inherit = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+foreach ($id in @($me.Value, '${SYSTEM}', '${ADMINISTRATORS}')) {
+  $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
+    (New-Object System.Security.Principal.SecurityIdentifier($id)),
+    'FullControl', $inherit, 'None', 'Allow')
+  $acl.AddAccessRule($rule)
+}
+Set-Acl -LiteralPath $path -AclObject $acl`;
+
+/**
+ * Host environment for the ACL helper, without the Jev API key. PowerShell 7
+ * parents export PSModulePath, which stops Windows PowerShell 5.1 from loading
+ * its own Get-Acl module; 5.1 rebuilds it when unset.
+ */
+export function powershellEnv(
+  host: NodeJS.ProcessEnv,
+  env: Record<string, string>,
+): NodeJS.ProcessEnv {
+  const childEnv = withoutApiKey({ ...host, ...env });
+  for (const key of Object.keys(childEnv))
+    if (key.toLowerCase() === "psmodulepath") delete childEnv[key];
+  return childEnv;
+}
+
+function powershell(
+  script: string,
+  env: Record<string, string>,
+): Promise<string> {
+  const root = process.env.SystemRoot ?? "C:\\Windows";
+  // A fixed system path, so a powershell.exe earlier on PATH is never used.
+  const executable = join(
+    root,
+    "System32",
+    "WindowsPowerShell",
+    "v1.0",
+    "powershell.exe",
+  );
+  const childEnv = powershellEnv(process.env, env);
+  const { promise, resolve, reject } = Promise.withResolvers<string>();
+  execFile(
+    executable,
+    [
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      // UTF-16LE base64 runs the script as one unit; stdin runs line by line.
+      "-EncodedCommand",
+      Buffer.from(script, "utf16le").toString("base64"),
+    ],
+    { env: childEnv, windowsHide: true, timeout: PRIVATE_STORAGE_TIMEOUT_MS },
+    (error, stdout) => (error ? reject(error) : resolve(stdout)),
+  );
+  return promise;
+}
+
+export const windowsStorage: PrivateStorage = {
+  async isPrivate(entries) {
+    if (!entries.length) return true;
+    try {
+      const output = await powershell(CHECK, {
+        JEV_PRIVATE_PATHS: JSON.stringify(entries.map(({ path }) => path)),
+      });
+      const results: unknown = JSON.parse(output.trim());
+      return (
+        Array.isArray(results) &&
+        results.length === entries.length &&
+        results.every((result) => result === true)
+      );
+    } catch {
+      // An ACL that cannot be read is never treated as private.
+      return false;
+    }
+  },
+  async restrictDirectory(path) {
+    await powershell(RESTRICT, { JEV_PRIVATE_PATH: path });
+  },
+};
+
+export function privateStorage(
+  platform: NodeJS.Platform = process.platform,
+): PrivateStorage {
+  return platform === "win32" ? windowsStorage : posixStorage;
+}

package/src/adapters/risk-callers.ts

@@ -1,5 +1,5 @@
 import { type FileHandle, lstat } from "node:fs/promises";
-import { resolve } from "node:path";
+import { posix } from "node:path";
 import type { SgNode } from "@ast-grep/napi";
 import { CONCURRENCY, STATE_MAX_CHARS, TIMEOUT_MS } from "../constants.ts";
 import type { GitExec } from "../core/git.ts";
@@ -9,6 +9,7 @@ import {
   type CallerSource,
   prepareRiskCallers,
 } from "../core/risk-callers.ts";
+import { SECRET_NAME_GLOBS } from "../core/secret-path.ts";
 import type { SyntaxRootParser } from "../core/syntax.ts";
 import type { EvidenceUnit, SourceFile } from "../core/units.ts";
 import {
@@ -201,6 +202,8 @@ export async function collectRiskCallers(
         ref,
         "--",
         ...extensions.map((extension) => `*.${extension}`),
+        // Base-tree secret-named files are never searched or read.
+        ...SECRET_NAME_GLOBS.map((glob) => `:(exclude,icase,glob)**/${glob}`),
       ],
       { cwd, timeout: TIMEOUT_MS, signal: options.signal },
     ).catch((error: unknown) => ({
@@ -460,8 +463,10 @@ export async function collectRiskCallers(
                   typeof source.beforePath === "string"
                     ? source.beforePath
                     : source.path;
+                // Repository paths are always "/"-separated; the platform
+                // resolve would yield "C:\\src\\..." on Windows.
                 const basePath = specifier.startsWith(".")
-                  ? resolve("/", sourcePath, "..", specifier).slice(1)
+                  ? posix.resolve("/", sourcePath, "..", specifier).slice(1)
                   : specifier.replaceAll(".", "/");
                 const runtimeSource = basePath.replace(
                   /\.(js|jsx|mjs|cjs)$/,

package/src/adapters/shell.ts

@@ -0,0 +1,113 @@
+import { accessSync, constants } from "node:fs";
+// Candidates are Windows paths whatever the host OS, so the helpers use win32
+// semantics explicitly; the host-native `node:path` splits PATH on ":" on POSIX.
+import { win32 } from "node:path";
+
+export interface ShellInvocation {
+  executable: string;
+  /** Arguments placed before the `-c` script. */
+  prefix: string[];
+  /** Exports prepended to the script when the launcher cannot set them. */
+  scriptPrefix: string;
+}
+
+export type ShellResolution =
+  | ({ ok: true } & ShellInvocation)
+  | { ok: false; error: string };
+
+function executable(path: string): boolean {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Windows ships `bash.exe` launchers for WSL in System32 (and SysWOW64,
+ * Sysnative) and in WindowsApps. They run in a Linux VM that cannot see Windows
+ * temporary paths, so they are never used for command evidence, including
+ * when named explicitly in JEV_TOOLS_BASH.
+ */
+export function isWslLauncher(path: string): boolean {
+  const lower = win32.normalize(path).toLowerCase();
+  return (
+    /\\windows\\(system32|syswow64|sysnative)\\/.test(lower) ||
+    lower.includes("\\microsoft\\windowsapps\\")
+  );
+}
+
+/** Permitted Git for Windows bash candidates, most specific first. */
+export function windowsBashCandidates(env: NodeJS.ProcessEnv): string[] {
+  const candidates: string[] = [];
+  if (env.JEV_TOOLS_BASH?.trim()) candidates.push(env.JEV_TOOLS_BASH.trim());
+  const pathEntries = (env.PATH ?? env.Path ?? "")
+    .split(win32.delimiter)
+    .filter(Boolean);
+  for (const entry of pathEntries) {
+    candidates.push(win32.join(entry, "bash.exe"));
+    // Git\cmd\git.exe or Git\bin\git.exe on PATH implies Git\bin\bash.exe.
+    if (/[\\/](cmd|bin)$/i.test(entry))
+      candidates.push(win32.join(win32.dirname(entry), "bin", "bash.exe"));
+  }
+  for (const root of [
+    env.ProgramFiles,
+    env["ProgramFiles(x86)"],
+    env.LOCALAPPDATA && win32.join(env.LOCALAPPDATA, "Programs"),
+  ])
+    if (root) candidates.push(win32.join(root, "Git", "bin", "bash.exe"));
+  // Filter every source, so no candidate can reintroduce a WSL launcher.
+  return [...new Set(candidates)].filter(
+    (candidate) => win32.isAbsolute(candidate) && !isWslLauncher(candidate),
+  );
+}
+
+const UNAVAILABLE =
+  "No permitted bash found: install Git for Windows or set JEV_TOOLS_BASH to the full path of a bash that is not the WSL launcher.";
+/** Never handed to command children: the Jev API key stays with the extension. */
+export const API_KEY_VARIABLE = "JEV_TOOLS_API_KEY";
+
+/** Copy of `env` without the Jev API key (any case, for Windows). */
+export function withoutApiKey(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  const copy = { ...env };
+  for (const key of Object.keys(copy))
+    if (key.toUpperCase() === API_KEY_VARIABLE) delete copy[key];
+  return copy;
+}
+let cached: ShellResolution | undefined;
+
+/**
+ * POSIX hosts run `env -u JEV_TOOLS_API_KEY CI=1 bash -c`. Windows has no
+ * `env` and its default `bash` is the WSL launcher, so resolve Git for Windows
+ * bash (or JEV_TOOLS_BASH) to an absolute, permitted path, and unset the key
+ * and export CI inside the script. When none is found this fails closed: no
+ * bare name is returned, because spawning one would search PATH again without
+ * the WSL exclusion.
+ */
+export function resolveShell(
+  platform: NodeJS.Platform = process.platform,
+  env: NodeJS.ProcessEnv = process.env,
+  isExecutable: (path: string) => boolean = executable,
+): ShellResolution {
+  if (platform !== "win32")
+    return {
+      ok: true,
+      executable: "env",
+      prefix: ["-u", API_KEY_VARIABLE, "CI=1", "bash"],
+      scriptPrefix: "",
+    };
+  const useCache = isExecutable === executable && env === process.env;
+  if (useCache && cached) return cached;
+  const found = windowsBashCandidates(env).find((path) => isExecutable(path));
+  const resolved: ShellResolution = found
+    ? {
+        ok: true,
+        executable: found,
+        prefix: [],
+        scriptPrefix: `unset ${API_KEY_VARIABLE}; export CI=1; `,
+      }
+    : { ok: false, error: UNAVAILABLE };
+  if (useCache && found) cached = resolved;
+  return resolved;
+}

package/src/adapters/test-inventory.ts

@@ -2,6 +2,7 @@ import { type FileHandle, lstat } from "node:fs/promises";
 import { TEST_SOURCE_MAX_BYTES, TIMEOUT_MS } from "../constants.ts";
 import type { GitExec } from "../core/git.ts";
 import type { ImportSource } from "../core/imports.ts";
+import { isSecretPath } from "../core/secret-path.ts";
 import type { Result } from "../result.ts";
 import {
   checkFileAdmission,
@@ -21,7 +22,7 @@ export async function collectTestInventory(
     read(path: string): Promise<ImportSource | undefined>;
     limits: readonly {
       path: string;
-      kind: "unreadable" | "too_large" | "not UTF-8 text";
+      kind: "unreadable" | "too_large" | "not UTF-8 text" | "secret_pattern";
     }[];
   }>
 > {
@@ -33,6 +34,7 @@ export async function collectTestInventory(
   if (root.code !== 0 || root.killed)
     return {
       ok: false,
+      cause: signal?.aborted ? "cancelled" : "git_failure",
       error: root.stderr || "Cannot identify repository root.",
     };
   cwd = root.stdout.replace(/\n$/, "");
@@ -51,6 +53,7 @@ export async function collectTestInventory(
   if (listed.code !== 0 || listed.killed)
     return {
       ok: false,
+      cause: signal?.aborted ? "cancelled" : "git_failure",
       error: listed.stderr || "Cannot inventory repository files.",
     };
   const ignored = await exec(
@@ -61,10 +64,11 @@ export async function collectTestInventory(
   if (ignored.code !== 0 || ignored.killed)
     return {
       ok: false,
+      cause: signal?.aborted ? "cancelled" : "git_failure",
       error: ignored.stderr || "Cannot identify ignored tracked files.",
     };
   const excluded = new Set(ignored.stdout.split("\0").filter(Boolean));
-  const paths = listed.stdout
+  const listedPaths = listed.stdout
     .split("\0")
     .filter(
       (path) =>
@@ -72,11 +76,15 @@ export async function collectTestInventory(
         (!excluded.has(path) ||
           /(?:^|\/)(?:package|tsconfig[^/]*)\.json$/.test(path)),
     );
+  // Secret-named files are named exclusions, never inventory members to read.
+  const paths = listedPaths.filter((path) => !isSecretPath(path));
   const admitted = new Set(paths);
   const limits: {
     path: string;
-    kind: "unreadable" | "too_large" | "not UTF-8 text";
-  }[] = [];
+    kind: "unreadable" | "too_large" | "not UTF-8 text" | "secret_pattern";
+  }[] = listedPaths
+    .filter(isSecretPath)
+    .map((path) => ({ path, kind: "secret_pattern" as const }));
   const cache = new Map<string, Promise<ImportSource | undefined>>();
   for (let offset = 0; offset < paths.length; offset += 16) {
     const inspected = await Promise.all(

package/src/configuration.ts

@@ -3,6 +3,10 @@ import { constants } from "node:fs";
 import { lstat, mkdir, open, rename, unlink } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
+import {
+  type PrivateStorage,
+  privateStorage,
+} from "./adapters/private-storage.ts";
 import { createJevClient } from "./jev/client.ts";
 import type { JevClient } from "./jev/types.ts";
 
@@ -26,17 +30,31 @@ function nonempty(value: string | undefined): value is string {
 
 function validate(values: ConfigurationValues): void {
   let validUrl = false;
+  let insecureTransport = false;
   try {
     const url = new URL(values.url);
-    validUrl =
+    const host = url.hostname.toLowerCase();
+    const loopback =
+      host === "127.0.0.1" ||
+      host === "localhost" ||
+      host === "::1" ||
+      host === "[::1]";
+    const wellFormed =
       /^https?:\/\//i.test(values.url) &&
       (url.protocol === "http:" || url.protocol === "https:") &&
       url.hostname !== "" &&
       url.username === "" &&
       url.password === "";
+    insecureTransport = wellFormed && url.protocol === "http:" && !loopback;
+    validUrl = wellFormed && (url.protocol === "https:" || loopback);
   } catch {
     // Keep user-controlled URL and credentials out of error messages.
   }
+  if (insecureTransport) {
+    throw new Error(
+      "Jev configuration refuses plain http: to a non-loopback host; use https: or an http: loopback URL (127.0.0.1, ::1 or localhost).",
+    );
+  }
   if (
     !validUrl ||
     !nonempty(values.apiKey) ||
@@ -44,7 +62,7 @@ function validate(values: ConfigurationValues): void {
     !nonempty(values.model)
   ) {
     throw new Error(
-      "Jev configuration requires a full HTTP(S) URL without embedded credentials, a nonempty HTTP-header-compatible API key, and a nonempty model.",
+      "Jev configuration requires a full https: URL (or http: to 127.0.0.1, ::1 or localhost) without embedded credentials, a nonempty HTTP-header-compatible API key, and a nonempty model.",
     );
   }
 }
@@ -56,11 +74,19 @@ export class ConfigController {
   private saved: SavedConfiguration = {};
   private session: SavedConfiguration = {};
   private readonly directory: string;
+  private readonly storage: PrivateStorage;
   private initialization: Promise<void> | undefined;
   private currentClient: JevClient | undefined;
 
-  constructor(options: { env?: NodeJS.ProcessEnv; directory?: string } = {}) {
+  constructor(
+    options: {
+      env?: NodeJS.ProcessEnv;
+      directory?: string;
+      storage?: PrivateStorage;
+    } = {},
+  ) {
     const env = options.env ?? process.env;
+    this.storage = options.storage ?? privateStorage();
     for (const [field, name] of [
       ["url", "JEV_TOOLS_URL"],
       ["apiKey", "JEV_TOOLS_API_KEY"],
@@ -163,19 +189,14 @@ export class ConfigController {
 
   private async checkDirectory(): Promise<boolean> {
     // Check ancestors too: recursive mkdir and path-based reads must not follow symlinks.
+    // Privacy of the directory itself is checked with its file in readSaved,
+    // using the operating system's own permission model.
     let path = this.directory;
     let exists = true;
     while (true) {
       try {
         const stat = await lstat(path);
         if (!stat.isDirectory() || stat.isSymbolicLink()) throw storageError();
-        if (
-          path === this.directory &&
-          ((stat.mode & 0o077) !== 0 ||
-            (process.getuid && stat.uid !== process.getuid()))
-        ) {
-          throw storageError();
-        }
       } catch (error) {
         if ((error as NodeJS.ErrnoException)?.code !== "ENOENT")
           throw storageError();
@@ -191,12 +212,20 @@ export class ConfigController {
   private async readSaved(): Promise<SavedConfiguration> {
     try {
       if (!(await this.checkDirectory())) return {};
+      const directory = {
+        path: this.directory,
+        stat: await lstat(this.directory),
+      };
       const path = join(this.directory, "config.json");
       try {
         const stat = await lstat(path);
         if (!stat.isFile() || stat.isSymbolicLink()) throw storageError();
       } catch (error) {
-        if ((error as NodeJS.ErrnoException)?.code === "ENOENT") return {};
+        if ((error as NodeJS.ErrnoException)?.code === "ENOENT") {
+          if (!(await this.storage.isPrivate([directory])))
+            throw storageError();
+          return {};
+        }
         throw error;
       }
       const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
@@ -205,8 +234,7 @@ export class ConfigController {
         if (
           !stat.isFile() ||
           stat.nlink !== 1 ||
-          (stat.mode & 0o077) !== 0 ||
-          (process.getuid && stat.uid !== process.getuid())
+          !(await this.storage.isPrivate([directory, { path, stat }]))
         ) {
           throw storageError();
         }
@@ -235,9 +263,22 @@ export class ConfigController {
   private async save(values: SavedConfiguration): Promise<void> {
     let temporary: string | undefined;
     try {
-      if (!(await this.checkDirectory())) {
+      const existed = await this.checkDirectory();
+      if (!existed) {
         await mkdir(this.directory, { recursive: true, mode: 0o700 });
       }
+      // Windows ignores mkdir's mode, so restrict the ACL before any secret is
+      // written: always for a new directory, and for an existing one only while
+      // it holds no configuration (e.g. left behind by an earlier failed save).
+      // Existing configuration is never re-permissioned; readSaved refuses it.
+      if (
+        !existed ||
+        !(await lstat(join(this.directory, "config.json")).then(
+          () => true,
+          () => false,
+        ))
+      )
+        await this.storage.restrictDirectory(this.directory);
       // Refuse to replace malformed, insecure or newly introduced storage.
       await this.readSaved();
       temporary = join(this.directory, `.config-${randomUUID()}.tmp`);

package/src/constants.ts

@@ -5,6 +5,17 @@ export const ASK_NOTE_MAX_CHARS = 8_000;
 export const ASK_MAX_FILES = 20;
 export const ASK_TIMEOUT_S = 60;
 export const ASK_TIMEOUT_MAX_S = 300;
+export const PROCESS_KILL_GRACE_MS = 2_000;
+export const PROCESS_PIPE_GRACE_MS = 1_000;
+export const PROCESS_TREE_TIMEOUT_MS = 5_000;
+export const MCP_SHUTDOWN_FLUSH_TIMEOUT_MS = 1_000;
+export const PRIVATE_STORAGE_TIMEOUT_MS = 20_000;
+export const MCP_VALIDATION_MAX_ERRORS = 5;
+export const MCP_PACKAGE_REPLY_TIMEOUT_MS = 20_000;
+export const MCP_PACKAGE_EXIT_TIMEOUT_MS = 10_000;
+export const MCP_PACKAGE_KILL_TIMEOUT_MS = 2_000;
+export const MCP_PACKAGE_INSTALL_TIMEOUT_MS = 300_000;
+export const MCP_PACKAGE_STDERR_MAX_CHARS = 2_000;
 export const OUTPUT_REPEAT_MIN = 5;
 export const OUTPUT_CHUNK_CHARS = 2_500;
 export const OUTPUT_FIND_MAX_CALLS = 40;
@@ -99,11 +110,32 @@ export const RUNNER_PACKAGE_MAX_BYTES = 64 * 1024;
 
 // ADR 0001: allowed local dependencies, including erased type imports.
 export const IMPORT_LAYERS = {
-  core: ["core", "constants.ts", "result.ts", "jev/types.ts"],
-  presets: ["presets", "core", "constants.ts", "result.ts", "jev/types.ts"],
-  adapters: ["adapters", "core", "constants.ts", "result.ts", "jev/types.ts"],
-  jev: ["jev", "core", "constants.ts", "result.ts"],
+  core: [
+    "core",
+    "constants.ts",
+    "result.ts",
+    "result-types.ts",
+    "jev/types.ts",
+  ],
+  presets: [
+    "presets",
+    "core",
+    "constants.ts",
+    "result.ts",
+    "result-types.ts",
+    "jev/types.ts",
+  ],
+  adapters: [
+    "adapters",
+    "core",
+    "constants.ts",
+    "result.ts",
+    "result-types.ts",
+    "jev/types.ts",
+  ],
+  jev: ["jev", "core", "constants.ts", "result.ts", "result-types.ts"],
   texts: ["texts", "constants.ts", "presets"],
   "constants.ts": [],
-  "result.ts": [],
+  "result.ts": ["result-types.ts"],
+  "result-types.ts": [],
 } as const;