larkin 0.2.78 → 0.2.80

package/dist/app/local-control.mjs

@@ -7,7 +7,10 @@ import path from "node:path";
 import { readProcessState } from "../platform/process-state.mjs";
 import { currentProcessMetadata } from "../platform/process-inspect.cjs";
 import { processCommandToken } from "./internal-command.mjs";
-import { isWindows, notGroupOrWorldAccessible } from "../platform/secure-metadata.mjs";
+import { isWindows, notGroupOrWorldAccessible, secureWindowsDirectoryAcl } from "../platform/secure-metadata.mjs";
+// Windows 上 socket 无法 lstat（EACCES），用全数字占位 binding 使 authority 校验通过；
+// 该平台的安全边界是 socket root 目录的 ACL，而非 inode 身份比对。
+const WINDOWS_SOCKET_BINDING = { device: "0", inode: "0", owner: "0", changeTimeNs: "0" };
 const AGENT_ID = /^cli_[A-Za-z0-9]+$/;
 const OPERATION_ID = /^[A-Za-z0-9_-]{8,128}$/;
 const AUTHORIZATION = /^[A-Za-z0-9_-]{43,128}$/;
@@ -32,6 +35,12 @@ function controlSocketRoot(larkinHome) {
     throw new Error("无法生成满足 Unix socket 长度限制的 control root");
 }
 function assertSecureSocketDirectory(root) {
+    if (isWindows) {
+        // Windows：socket 本身无法 lstat（EACCES），安全边界是目录 ACL。
+        // 每次启动重新收紧为「当前用户 + SYSTEM」并回读校验。
+        secureWindowsDirectoryAcl(root, { label: "control socket root" });
+        return root;
+    }
     const stat = fs.lstatSync(root);
     if (!stat.isDirectory() || stat.isSymbolicLink()
         || (typeof process.getuid === "function" && stat.uid !== process.getuid())
@@ -223,6 +232,15 @@ function assertSupervisorAuthority(larkinHome, expectedToken) {
     return authority;
 }
 function prepareSocket(socket) {
+    if (isWindows) {
+        // Windows：socket 路径无法 lstat（EACCES）；尽力清除陈旧占用，失败即忽略，
+        // 由 listen 的独占语义兜底（见 listenPrivate 的 win32 分支）。
+        try {
+            fs.unlinkSync(socket);
+        }
+        catch { /* ignore */ }
+        return;
+    }
     try {
         const stat = fs.lstatSync(socket);
         if (!stat.isSocket() || stat.isSymbolicLink()
@@ -246,6 +264,14 @@ function cleanupSocketRoot(root) {
     }
 }
 async function closePrivateServer(server, socket, identity) {
+    if (isWindows) {
+        // Windows：socket 无 lstat 身份可比对，直接关服并清理目录（残留由 ENOTEMPTY 忽略）。
+        if (server.listening) {
+            await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+        }
+        cleanupSocketRoot(path.dirname(socket));
+        return;
+    }
     let shield = null;
     let closeError;
     try {
@@ -301,6 +327,26 @@ async function closePrivateServer(server, socket, identity) {
         throw closeError;
 }
 async function listenPrivate(server, socket) {
+    if (isWindows) {
+        // Windows：bun 的 unix socket 可正常 listen/connect/chmod/close，但 lstatSync(socket)
+        // 抛 EACCES（socket 不是普通文件系统节点）。因此跳过 lstat 身份比对，安全边界
+        // 由 assertSecureSocketDirectory 收紧的目录 ACL 承担。
+        try {
+            await new Promise((resolve, reject) => {
+                server.once("error", reject);
+                server.listen(socket, () => { server.off("error", reject); resolve(); });
+            });
+            try {
+                fs.chmodSync(socket, 0o600);
+            }
+            catch { /* Windows chmod best-effort */ }
+            return WINDOWS_SOCKET_BINDING;
+        }
+        catch (error) {
+            await closePrivateServer(server, socket, WINDOWS_SOCKET_BINDING);
+            throw error;
+        }
+    }
     let identity = null;
     try {
         await new Promise((resolve, reject) => {

package/dist/platform/secure-metadata.cjs

@@ -8,8 +8,12 @@ exports.exactMode = exactMode;
 exports.notGroupOrWorldAccessible = notGroupOrWorldAccessible;
 exports.fsyncDirectory = fsyncDirectory;
 exports.fsyncDirectoryOf = fsyncDirectoryOf;
+exports.runWindowsDirectoryAcl = runWindowsDirectoryAcl;
+exports.secureWindowsDirectoryAcl = secureWindowsDirectoryAcl;
 const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
+const node_child_process_1 = require("node:child_process");
 /**
  * Cross-platform secure-metadata helpers. POSIX platforms enforce ownership and
  * mode bits (fail-closed). Windows has no POSIX mode bits, so mode-bit assertions
@@ -46,3 +50,66 @@ function fsyncDirectory(directory) {
 function fsyncDirectoryOf(file) {
     fsyncDirectory(node_path_1.default.dirname(file));
 }
+const SYSTEM_SID = "*S-1-5-18";
+const ACE_LINE = /^\s*(.+?)\s*:(\((?:[A-Za-z]+)\))+\s*$/;
+function allowedAclPrincipal(principal, username) {
+    const candidate = principal.trim().toLocaleLowerCase("en-US");
+    const user = username.toLocaleLowerCase("en-US");
+    if (!candidate)
+        return false;
+    if (candidate === user)
+        return true;
+    const suffix = candidate.split("\\").at(-1) ?? candidate;
+    if (suffix === user)
+        return true;
+    if (candidate === "*s-1-5-18" || candidate === "system" || candidate === "nt authority\\system")
+        return true;
+    return false;
+}
+/**
+ * 执行 Windows ACL 收紧序列（无平台守卫，供测试直接驱动与 win32 分支调用）：
+ * 1) /inheritance:r 去除继承；2) 只授予当前用户 + SYSTEM 完全控制；
+ * 3) 显式移除 Users/Authenticated Users/Everyone；4) 回读 ACL 校验，
+ * 任何残留第三方 ACE 一律 fail-closed。icacls 为 Windows 内置工具。
+ */
+function runWindowsDirectoryAcl(directory, options = {}) {
+    const label = options.label ?? directory;
+    const username = String(options.username ?? node_os_1.default.userInfo().username ?? "").trim();
+    if (!username)
+        throw new Error(`Windows ACL 收紧失败（${label}）：无法取得当前用户名`);
+    const run = (args) => {
+        const result = (options.spawn ?? node_child_process_1.spawnSync)("icacls", [directory, ...args], {
+            encoding: "utf8", windowsHide: true, maxBuffer: 1024 * 1024,
+        });
+        if (result.error || result.status !== 0) {
+            throw new Error(`Windows ACL 收紧失败（${label}）：icacls ${args[0] ?? "查询"} 退出 ${result.status ?? "无"}${result.error ? `（${result.error.message}）` : ""}`);
+        }
+        return String(result.stdout || "");
+    };
+    run(["/inheritance:r"]);
+    run(["/grant:r", `${username}:(OI)(CI)F`, "/grant:r", `${SYSTEM_SID}:(OI)(CI)F`]);
+    run(["/remove:g", "Users", "/remove:g", "Authenticated Users", "/remove:g", "Everyone"]);
+    const listing = run([]);
+    // icacls 首行是「<路径> <首条 ACE>」同行，其余 ACE 缩进另起一行；先剥掉已知目录前缀再解析。
+    const pathPrefix = directory.toLocaleLowerCase("en-US");
+    const offenders = listing.split(/\r?\n/).map((line) => {
+        let body = line.trimStart();
+        if (body.toLocaleLowerCase("en-US").startsWith(`${pathPrefix} `))
+            body = body.slice(directory.length + 1).trimStart();
+        return body;
+    }).filter((line) => ACE_LINE.test(line))
+        .map((line) => (line.match(ACE_LINE) ?? ["", ""])[1])
+        .filter((principal) => !allowedAclPrincipal(principal, username));
+    if (offenders.length > 0) {
+        throw new Error(`Windows ACL 校验失败（${label}）：存在未授权访问者 ${offenders.join(", ")}`);
+    }
+}
+/**
+ * Windows 没有 POSIX 权限位（mode 恒为 0o666、getuid 为 undefined）：
+ * 用 runWindowsDirectoryAcl 收紧目录 ACL 并回读校验。非 win32 平台 no-op。
+ */
+function secureWindowsDirectoryAcl(directory, options = {}) {
+    if (!exports.isWindows)
+        return;
+    runWindowsDirectoryAcl(directory, options);
+}

package/dist/platform/secure-metadata.mjs

@@ -1,5 +1,7 @@
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
+import { spawnSync } from "node:child_process";
 /**
  * Cross-platform secure-metadata helpers. POSIX platforms enforce ownership and
  * mode bits (fail-closed). Windows has no POSIX mode bits, so mode-bit assertions
@@ -36,3 +38,66 @@ export function fsyncDirectory(directory) {
 export function fsyncDirectoryOf(file) {
     fsyncDirectory(path.dirname(file));
 }
+const SYSTEM_SID = "*S-1-5-18";
+const ACE_LINE = /^\s*(.+?)\s*:(\((?:[A-Za-z]+)\))+\s*$/;
+function allowedAclPrincipal(principal, username) {
+    const candidate = principal.trim().toLocaleLowerCase("en-US");
+    const user = username.toLocaleLowerCase("en-US");
+    if (!candidate)
+        return false;
+    if (candidate === user)
+        return true;
+    const suffix = candidate.split("\\").at(-1) ?? candidate;
+    if (suffix === user)
+        return true;
+    if (candidate === "*s-1-5-18" || candidate === "system" || candidate === "nt authority\\system")
+        return true;
+    return false;
+}
+/**
+ * 执行 Windows ACL 收紧序列（无平台守卫，供测试直接驱动与 win32 分支调用）：
+ * 1) /inheritance:r 去除继承；2) 只授予当前用户 + SYSTEM 完全控制；
+ * 3) 显式移除 Users/Authenticated Users/Everyone；4) 回读 ACL 校验，
+ * 任何残留第三方 ACE 一律 fail-closed。icacls 为 Windows 内置工具。
+ */
+export function runWindowsDirectoryAcl(directory, options = {}) {
+    const label = options.label ?? directory;
+    const username = String(options.username ?? os.userInfo().username ?? "").trim();
+    if (!username)
+        throw new Error(`Windows ACL 收紧失败（${label}）：无法取得当前用户名`);
+    const run = (args) => {
+        const result = (options.spawn ?? spawnSync)("icacls", [directory, ...args], {
+            encoding: "utf8", windowsHide: true, maxBuffer: 1024 * 1024,
+        });
+        if (result.error || result.status !== 0) {
+            throw new Error(`Windows ACL 收紧失败（${label}）：icacls ${args[0] ?? "查询"} 退出 ${result.status ?? "无"}${result.error ? `（${result.error.message}）` : ""}`);
+        }
+        return String(result.stdout || "");
+    };
+    run(["/inheritance:r"]);
+    run(["/grant:r", `${username}:(OI)(CI)F`, "/grant:r", `${SYSTEM_SID}:(OI)(CI)F`]);
+    run(["/remove:g", "Users", "/remove:g", "Authenticated Users", "/remove:g", "Everyone"]);
+    const listing = run([]);
+    // icacls 首行是「<路径> <首条 ACE>」同行，其余 ACE 缩进另起一行；先剥掉已知目录前缀再解析。
+    const pathPrefix = directory.toLocaleLowerCase("en-US");
+    const offenders = listing.split(/\r?\n/).map((line) => {
+        let body = line.trimStart();
+        if (body.toLocaleLowerCase("en-US").startsWith(`${pathPrefix} `))
+            body = body.slice(directory.length + 1).trimStart();
+        return body;
+    }).filter((line) => ACE_LINE.test(line))
+        .map((line) => (line.match(ACE_LINE) ?? ["", ""])[1])
+        .filter((principal) => !allowedAclPrincipal(principal, username));
+    if (offenders.length > 0) {
+        throw new Error(`Windows ACL 校验失败（${label}）：存在未授权访问者 ${offenders.join(", ")}`);
+    }
+}
+/**
+ * Windows 没有 POSIX 权限位（mode 恒为 0o666、getuid 为 undefined）：
+ * 用 runWindowsDirectoryAcl 收紧目录 ACL 并回读校验。非 win32 平台 no-op。
+ */
+export function secureWindowsDirectoryAcl(directory, options = {}) {
+    if (!isWindows)
+        return;
+    runWindowsDirectoryAcl(directory, options);
+}

package/dist/runtime/pi-official-auth.mjs

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
 import { pathToFileURL } from "node:url";
+import { isWindows, secureWindowsDirectoryAcl } from "../platform/secure-metadata.mjs";
 // proper-lockfile does not publish TypeScript declarations.
 // @ts-expect-error bundled CommonJS dependency
 import properLockfile from "proper-lockfile";
@@ -22,6 +23,11 @@ function ensureLockDirectory(lockPath) {
     const directory = path.dirname(lockPath);
     fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
     fs.chmodSync(directory, 0o700);
+    if (isWindows) {
+        // Windows 无 POSIX 权限位（mode 恒 0o666）：改用 icacls 收紧 ACL 并回读校验。
+        secureWindowsDirectoryAcl(directory, { label: "Pi credential lock 目录" });
+        return;
+    }
     const stat = fs.lstatSync(directory);
     if (!stat.isDirectory() || stat.isSymbolicLink()
         || (typeof process.getuid === "function" && stat.uid !== process.getuid())
@@ -85,6 +91,11 @@ function ensurePrivateDirectory(directory) {
     fs.chmodSync(path.dirname(directory), 0o700);
     fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
     fs.chmodSync(directory, 0o700);
+    if (isWindows) {
+        // Windows 无 POSIX 权限位：icacls 收紧为「当前用户 + SYSTEM」并回读校验。
+        secureWindowsDirectoryAcl(directory, { label: "Pi official credential 目录" });
+        return;
+    }
     const stat = fs.lstatSync(directory);
     if (!stat.isDirectory() || stat.isSymbolicLink()
         || (typeof process.getuid === "function" && stat.uid !== process.getuid())
@@ -97,7 +108,7 @@ function safeRead(file) {
         const stat = fs.lstatSync(file);
         if (!stat.isFile() || stat.isSymbolicLink()
             || (typeof process.getuid === "function" && stat.uid !== process.getuid())
-            || (stat.mode & 0o777) !== 0o600)
+            || (!isWindows && (stat.mode & 0o777) !== 0o600))
             throw new Error(`unsafe Pi auth file: ${path.basename(file)}`);
         return fs.readFileSync(file);
     }

package/dist/runtime/pi-provider-config.cjs

@@ -14,6 +14,7 @@ exports.stageBuiltinPiProvider = stageBuiltinPiProvider;
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const secure_metadata_js_1 = require("../platform/secure-metadata.cjs");
 exports.BUNDLED_PI_VERSION = "0.83.0";
 // These values mirror the catalog shipped by the pinned official Pi distribution.
 // Keeping the user-facing defaults here makes endpoint changes reviewable in Larkin.
@@ -95,6 +96,11 @@ function piAgentDirectory(configDir, agentId) {
     return node_path_1.default.join(node_path_1.default.resolve(configDir), "providers", "pi", agentId);
 }
 function assertPrivateDirectory(directory) {
+    if (secure_metadata_js_1.isWindows) {
+        // Windows 无 POSIX 权限位：icacls 收紧为「当前用户 + SYSTEM」并回读校验。
+        (0, secure_metadata_js_1.secureWindowsDirectoryAcl)(directory, { label: "Pi provider 凭证目录" });
+        return;
+    }
     const stat = node_fs_1.default.lstatSync(directory);
     if (!stat.isDirectory() || stat.isSymbolicLink()
         || (typeof process.getuid === "function" && stat.uid !== process.getuid())
@@ -129,7 +135,7 @@ function readSnapshot(file) {
         const stat = node_fs_1.default.lstatSync(file);
         if (!stat.isFile() || stat.isSymbolicLink()
             || (typeof process.getuid === "function" && stat.uid !== process.getuid())
-            || (stat.mode & 0o777) !== 0o600)
+            || (!secure_metadata_js_1.isWindows && (stat.mode & 0o777) !== 0o600))
             throw new Error(`Pi provider 文件不安全: ${node_path_1.default.basename(file)}`);
         return node_fs_1.default.readFileSync(file);
     }

package/dist/runtime/pi-provider-config.mjs

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { isWindows, secureWindowsDirectoryAcl } from "../platform/secure-metadata.mjs";
 export const BUNDLED_PI_VERSION = "0.83.0";
 // These values mirror the catalog shipped by the pinned official Pi distribution.
 // Keeping the user-facing defaults here makes endpoint changes reviewable in Larkin.
@@ -82,6 +83,11 @@ export function piAgentDirectory(configDir, agentId) {
     return path.join(path.resolve(configDir), "providers", "pi", agentId);
 }
 function assertPrivateDirectory(directory) {
+    if (isWindows) {
+        // Windows 无 POSIX 权限位：icacls 收紧为「当前用户 + SYSTEM」并回读校验。
+        secureWindowsDirectoryAcl(directory, { label: "Pi provider 凭证目录" });
+        return;
+    }
     const stat = fs.lstatSync(directory);
     if (!stat.isDirectory() || stat.isSymbolicLink()
         || (typeof process.getuid === "function" && stat.uid !== process.getuid())
@@ -116,7 +122,7 @@ function readSnapshot(file) {
         const stat = fs.lstatSync(file);
         if (!stat.isFile() || stat.isSymbolicLink()
             || (typeof process.getuid === "function" && stat.uid !== process.getuid())
-            || (stat.mode & 0o777) !== 0o600)
+            || (!isWindows && (stat.mode & 0o777) !== 0o600))
             throw new Error(`Pi provider 文件不安全: ${path.basename(file)}`);
         return fs.readFileSync(file);
     }

package/dist/setup/bot-register.mjs

@@ -5,6 +5,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { registerApp as channelRegisterApp } from "@larksuite/channel";
+import { isWindows, secureWindowsDirectoryAcl } from "../platform/secure-metadata.mjs";
 import { internalCommandSpec } from "../app/internal-command.mjs";
 import * as larkinConfig from "../platform/config.mjs";
 import { createAgentStateStore } from "../agent/agent-state-store.mjs";
@@ -230,6 +231,13 @@ function ensureSecureBotsDir() {
         if (error?.code !== "EEXIST")
             throw error;
     }
+    if (isWindows) {
+        // Windows 无 POSIX 权限位（mode 恒 0o666）：改用 icacls 收紧 CFG_DIR 与 bots 目录
+        // 的 ACL 为「当前用户 + SYSTEM」并回读校验，fail-closed。
+        secureWindowsDirectoryAcl(CFG_DIR, { label: "Larkin 配置目录" });
+        secureWindowsDirectoryAcl(directory, { label: "bots 凭证目录" });
+        return directory;
+    }
     const stat = fs.lstatSync(directory);
     if (!stat.isDirectory() || stat.isSymbolicLink()
         || (typeof process.getuid === "function" && stat.uid !== process.getuid())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "larkin",
-  "version": "0.2.78",
+  "version": "0.2.80",
   "private": false,
   "larkinPackageRole": "npm-published",
   "files": [