looply-cli 0.0.0-stage → 0.3.0

package/win/appcontainer.ps1

@@ -0,0 +1,500 @@
+<#
+    THE WINDOWS HALF OF UNTRUSTED EXECUTION.
+
+    Node cannot reach the AppContainer APIs, so this script is the bridge. It is
+    the smallest thing that works: source-controlled PowerShell, compiled at
+    runtime by the .NET Framework compiler every Windows box already has. No npm
+    dependency, no build step, no downloaded binary, no administrator.
+
+    IT TAKES JSON ON STDIN AND WRITES ONE JSON OBJECT TO STDOUT. Never a shell
+    string: the executable and its arguments arrive as separate fields and are
+    passed to CreateProcess as separate things, so nothing the agent writes can
+    become a command.
+
+    What it does, in order:
+
+      1. ensure an AppContainer profile exists for the requested identity
+      2. grant that container SID access to exactly the paths named, and nothing
+         else
+      3. launch the process inside the container with an explicit cwd and an
+         explicit environment block
+      4. hold it in a job object so descendants die with it
+      5. wait, with a timeout, and report the exit code
+
+    The security property is deny-by-default: a path nobody granted is a path
+    the child cannot reach, whatever the child tries.
+#>
+[CmdletBinding()]
+param()
+
+$ErrorActionPreference = 'Stop'
+
+function Write-Result($obj) {
+  # One line, one object. The caller parses stdout as a single document.
+  [Console]::Out.Write((ConvertTo-Json $obj -Compress -Depth 6))
+  [Console]::Out.Flush()
+}
+
+$src = @'
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+
+public static class LooplyAc {
+  [StructLayout(LayoutKind.Sequential)] public struct SID_AND_ATTRIBUTES {
+    public IntPtr Sid; public uint Attributes; }
+  [StructLayout(LayoutKind.Sequential)] public struct SECURITY_CAPABILITIES {
+    public IntPtr AppContainerSid; public IntPtr Capabilities; public uint CapabilityCount; public uint Reserved; }
+  [StructLayout(LayoutKind.Sequential)] public struct SECURITY_ATTRIBUTES {
+    public int nLength; public IntPtr lpSecurityDescriptor; public int bInheritHandle; }
+  [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)] public struct STARTUPINFOEX {
+    public int cb; public string lpReserved; public string lpDesktop; public string lpTitle;
+    public int dwX; public int dwY; public int dwXSize; public int dwYSize;
+    public int dwXCountChars; public int dwYCountChars; public int dwFillAttribute; public int dwFlags;
+    public short wShowWindow; public short cbReserved2; public IntPtr lpReserved2;
+    public IntPtr hStdInput; public IntPtr hStdOutput; public IntPtr hStdError; public IntPtr lpAttributeList; }
+  [StructLayout(LayoutKind.Sequential)] public struct PROCESS_INFORMATION {
+    public IntPtr hProcess; public IntPtr hThread; public int dwProcessId; public int dwThreadId; }
+  [StructLayout(LayoutKind.Sequential)] public struct JOBOBJECT_BASIC_LIMIT_INFORMATION {
+    public long PerProcessUserTimeLimit; public long PerJobUserTimeLimit; public uint LimitFlags;
+    public UIntPtr MinimumWorkingSetSize; public UIntPtr MaximumWorkingSetSize; public uint ActiveProcessLimit;
+    public UIntPtr Affinity; public uint PriorityClass; public uint SchedulingClass; }
+  [StructLayout(LayoutKind.Sequential)] public struct IO_COUNTERS {
+    public ulong ReadOperationCount; public ulong WriteOperationCount; public ulong OtherOperationCount;
+    public ulong ReadTransferCount; public ulong WriteTransferCount; public ulong OtherTransferCount; }
+  [StructLayout(LayoutKind.Sequential)] public struct JOBOBJECT_EXTENDED_LIMIT_INFORMATION {
+    public JOBOBJECT_BASIC_LIMIT_INFORMATION BasicLimitInformation; public IO_COUNTERS IoInfo;
+    public UIntPtr ProcessMemoryLimit; public UIntPtr JobMemoryLimit;
+    public UIntPtr PeakProcessMemoryUsed; public UIntPtr PeakJobMemoryUsed; }
+
+  [DllImport("userenv.dll", CharSet=CharSet.Unicode)] public static extern int CreateAppContainerProfile(string n, string d, string desc, IntPtr caps, uint c, out IntPtr sid);
+  [DllImport("userenv.dll", CharSet=CharSet.Unicode)] public static extern int DeriveAppContainerSidFromAppContainerName(string n, out IntPtr sid);
+  [DllImport("userenv.dll", CharSet=CharSet.Unicode)] public static extern int DeleteAppContainerProfile(string n);
+  // CharSet matters: without it this binds ConvertSidToStringSidA and the
+  // wide read below returns question marks instead of a SID.
+  [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)] public static extern bool ConvertSidToStringSid(IntPtr sid, out IntPtr str);
+  [DllImport("kernel32.dll", SetLastError=true)] public static extern bool InitializeProcThreadAttributeList(IntPtr l, int c, int f, ref IntPtr size);
+  [DllImport("kernel32.dll", SetLastError=true)] public static extern bool UpdateProcThreadAttribute(IntPtr l, uint f, IntPtr a, IntPtr v, IntPtr s, IntPtr p, IntPtr r);
+  [DllImport("kernel32.dll")] public static extern void DeleteProcThreadAttributeList(IntPtr l);
+  [DllImport("kernel32.dll", SetLastError=true, CharSet=CharSet.Unicode)] public static extern bool CreateProcess(string app, StringBuilder cmd, IntPtr pa, IntPtr ta, bool inherit, uint flags, IntPtr env, string cwd, ref STARTUPINFOEX si, out PROCESS_INFORMATION pi);
+  [DllImport("kernel32.dll", SetLastError=true, CharSet=CharSet.Unicode)] public static extern IntPtr CreateFile(string name, uint access, uint share, ref SECURITY_ATTRIBUTES sa, uint disp, uint flags, IntPtr tmpl);
+  [DllImport("kernel32.dll")] public static extern uint WaitForSingleObject(IntPtr h, uint ms);
+  [DllImport("kernel32.dll")] public static extern bool GetExitCodeProcess(IntPtr h, out uint c);
+  [DllImport("kernel32.dll")] public static extern bool TerminateProcess(IntPtr h, uint c);
+  [DllImport("kernel32.dll")] public static extern bool CloseHandle(IntPtr h);
+  [DllImport("kernel32.dll")] public static extern void LocalFree(IntPtr p);
+  [DllImport("kernel32.dll", SetLastError=true, CharSet=CharSet.Unicode)] public static extern IntPtr CreateJobObject(IntPtr sa, string name);
+  [DllImport("kernel32.dll", SetLastError=true)] public static extern bool AssignProcessToJobObject(IntPtr job, IntPtr proc);
+  [DllImport("kernel32.dll", SetLastError=true)] public static extern bool SetInformationJobObject(IntPtr job, int cls, IntPtr info, uint len);
+
+  public const uint CREATE_UNICODE_ENVIRONMENT = 0x00000400;
+  public const uint EXTENDED_STARTUPINFO_PRESENT = 0x00080000;
+  public const uint CREATE_NO_WINDOW = 0x08000000;
+  public const uint CREATE_SUSPENDED = 0x00000004;
+  public const uint STARTF_USESTDHANDLES = 0x00000100;
+
+  /**
+   * The container SID for a name, creating the profile on first use.
+   *
+   * Kept in a static and returned as a string rather than through an `out`
+   * parameter: PowerShell does not bind C# `out IntPtr` through [ref], and the
+   * silent result is a null SID that fails much later, at the ACL call, with an
+   * error naming sddlForm rather than the profile.
+   */
+  public static IntPtr Sid = IntPtr.Zero;
+  public static string Ensure(string name) {
+    IntPtr sid;
+    int hr = CreateAppContainerProfile(name, name, "Looply untrusted execution", IntPtr.Zero, 0, out sid);
+    if (hr != 0) {
+      // 0x800700B7 is "already exists", which is the ordinary second call.
+      int hr2 = DeriveAppContainerSidFromAppContainerName(name, out sid);
+      if (hr2 != 0) return "ERR profile create hr=0x" + hr.ToString("X8") + " derive hr=0x" + hr2.ToString("X8");
+    }
+    Sid = sid;
+    return SidToString(sid);
+  }
+
+  public static string SidToString(IntPtr sid) {
+    IntPtr p; ConvertSidToStringSid(sid, out p);
+    string s = Marshal.PtrToStringUni(p); LocalFree(p); return s;
+  }
+
+  /**
+   * A UTF-16 environment block: KEY=VALUE\0 ... \0\0, and nothing inherited.
+   *
+   * Marshalled as BYTES rather than through StringToHGlobalUni. The block is
+   * defined by its embedded nulls, and a string marshaller is exactly the kind
+   * of thing that treats the first one as the end — so the copy is done
+   * explicitly, where the length is ours to decide.
+   *
+   * Sorted, because CreateProcess documents the block as sorted and answers
+   * ERROR_ENVVAR_NOT_FOUND rather than anything more specific when it is not.
+   */
+  public static IntPtr EnvBlock(string[] pairs) {
+    string[] sorted = (string[])pairs.Clone();
+    Array.Sort(sorted, StringComparer.OrdinalIgnoreCase);
+    StringBuilder sb = new StringBuilder();
+    foreach (string p in sorted) {
+      if (p == null || p.Length == 0 || p.IndexOf('=') <= 0) continue;
+      sb.Append(p); sb.Append('\0');
+    }
+    sb.Append('\0');
+    byte[] bytes = Encoding.Unicode.GetBytes(sb.ToString());
+    IntPtr mem = Marshal.AllocHGlobal(bytes.Length + 2);
+    Marshal.Copy(bytes, 0, mem, bytes.Length);
+    // One more UTF-16 null, so the block is terminated even if the last entry
+    // was dropped by the filter above.
+    Marshal.WriteInt16(mem, bytes.Length, 0);
+    return mem;
+  }
+
+  /**
+   * A file opened for READING, inheritable, to become the child's stdin.
+   *
+   * The prompt is many lines of model instructions and must never be part of a
+   * command line: a shell would eat the newlines and quoting, and on Windows a
+   * command line is capped besides. It travels as bytes through a handle
+   * instead, which also means the container needs no grant to read it.
+   */
+  public static IntPtr OpenForRead(string path) {
+    SECURITY_ATTRIBUTES sa = new SECURITY_ATTRIBUTES();
+    sa.nLength = Marshal.SizeOf(typeof(SECURITY_ATTRIBUTES));
+    sa.lpSecurityDescriptor = IntPtr.Zero;
+    sa.bInheritHandle = 1;
+    // OPEN_EXISTING, GENERIC_READ, share read.
+    return CreateFile(path, 0x80000000, 0x00000001, ref sa, 3, 0x80, IntPtr.Zero);
+  }
+
+  public static IntPtr OpenForWrite(string path) {
+    SECURITY_ATTRIBUTES sa = new SECURITY_ATTRIBUTES();
+    sa.nLength = Marshal.SizeOf(typeof(SECURITY_ATTRIBUTES));
+    sa.lpSecurityDescriptor = IntPtr.Zero;
+    sa.bInheritHandle = 1;
+    // CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, GENERIC_WRITE, share read+write.
+    return CreateFile(path, 0x40000000, 0x00000003, ref sa, 2, 0x80, IntPtr.Zero);
+  }
+
+  /**
+   * Launch inside the container and wait.
+   *
+   * The stdout/stderr handles are opened by US and inherited, so the child
+   * writes through a handle it was given rather than through a path it must be
+   * granted — the output files never widen the container's filesystem policy.
+   */
+  [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]
+  static extern bool ConvertStringSidToSid(string s, out IntPtr sid);
+
+  /**
+   * The capability SIDs a container is given, as a native array.
+   *
+   * A container with none has no network at all, which is what a gate wants and
+   * what an agent cannot live with — it has to reach its model. `internetClient`
+   * (S-1-15-3-1) is the outbound-client capability, and it is granted to the
+   * AGENT profile only.
+   *
+   * This is broad: it is "may make outbound connections", not "may reach this
+   * one host". Narrowing it to the provider's endpoints is egress policy and
+   * belongs to a later phase; what matters here is that the agent holds no
+   * machine or broker credential to send anywhere.
+   */
+  public static IntPtr CapabilityArray(string[] sids, out uint count) {
+    count = 0;
+    if (sids == null || sids.Length == 0) return IntPtr.Zero;
+    int size = Marshal.SizeOf(typeof(SID_AND_ATTRIBUTES));
+    IntPtr block = Marshal.AllocHGlobal(size * sids.Length);
+    uint n = 0;
+    foreach (string s in sids) {
+      IntPtr sid;
+      if (!ConvertStringSidToSid(s, out sid)) continue;
+      SID_AND_ATTRIBUTES sa = new SID_AND_ATTRIBUTES();
+      sa.Sid = sid;
+      sa.Attributes = 4; // SE_GROUP_ENABLED
+      Marshal.StructureToPtr(sa, (IntPtr)(block.ToInt64() + size * (int)n), false);
+      n++;
+    }
+    count = n;
+    return n == 0 ? IntPtr.Zero : block;
+  }
+
+  public static string Run(string exe, string cmdLine, string cwd, string[] env,
+                           string outPath, string errPath, string inPath, uint timeoutMs, string[] capabilities,
+                           out uint exitCode, out bool timedOut) {
+    exitCode = 0xFFFFFFFF; timedOut = false;
+    uint capCount;
+    IntPtr caps = CapabilityArray(capabilities, out capCount);
+    SECURITY_CAPABILITIES sc = new SECURITY_CAPABILITIES();
+    sc.AppContainerSid = Sid; sc.Capabilities = caps; sc.CapabilityCount = capCount; sc.Reserved = 0;
+
+    /*
+     * TWO attributes, not one. The second is the handle list, and it is the
+     * difference between "the child gets the three handles we opened for it"
+     * and "the child gets those AND everything inheritable this process holds".
+     *
+     * 🔴 bInheritHandles IS STILL true BELOW, AND MUST BE. The handle list only
+     * NARROWS what an already-inheriting CreateProcess passes; with inheritance
+     * off it does nothing and stdio breaks, because an AppContainer cannot open
+     * a Windows named pipe (see appcontainer-limits.spec.ts) and handle-inherited
+     * file stdio is the only arrangement that works here.
+     *
+     * What was crossing before: powershell.exe is spawned by Node with
+     * stdio:['pipe','pipe','pipe'], and an inherited handle keeps the source
+     * handle's HANDLE_FLAG_INHERIT. So this process holds three inheritable
+     * NAMED PIPE handles into a trusted, uncontained Node parent — and passed
+     * all three to the contained child. That is a channel out of the container
+     * that no ACL can deny, on the very pipe the daemon parses as its single
+     * JSON reply.
+     *
+     * The capacity in BOTH calls must match the number of UpdateProcThreadAttribute
+     * calls; adding more attributes than the list was sized for corrupts it
+     * silently.
+     */
+    IntPtr size = IntPtr.Zero;
+    InitializeProcThreadAttributeList(IntPtr.Zero, 2, 0, ref size);
+    IntPtr attrs = Marshal.AllocHGlobal(size);
+    if (!InitializeProcThreadAttributeList(attrs, 2, 0, ref size)) return "attrlist: " + Marshal.GetLastWin32Error();
+    IntPtr scPtr = Marshal.AllocHGlobal(Marshal.SizeOf(sc));
+    Marshal.StructureToPtr(sc, scPtr, false);
+    // PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES — the containment boundary,
+    // untouched.
+    if (!UpdateProcThreadAttribute(attrs, 0, (IntPtr)0x00020009, scPtr, (IntPtr)Marshal.SizeOf(sc), IntPtr.Zero, IntPtr.Zero))
+      return "attrupdate: " + Marshal.GetLastWin32Error();
+
+    IntPtr hOut = OpenForWrite(outPath);
+    IntPtr hErr = OpenForWrite(errPath);
+
+    STARTUPINFOEX si = new STARTUPINFOEX();
+    si.cb = Marshal.SizeOf(si);
+    si.lpAttributeList = attrs;
+    si.dwFlags = (int)STARTF_USESTDHANDLES;
+    IntPtr hIn = string.IsNullOrEmpty(inPath) ? IntPtr.Zero : OpenForRead(inPath);
+    si.hStdInput = hIn; si.hStdOutput = hOut; si.hStdError = hErr;
+
+    /*
+     * Every handle in the list must be valid and inheritable, or CreateProcess
+     * fails with ERROR_INVALID_PARAMETER (87) — which reads exactly like a
+     * containment failure and would be misdiagnosed as one. So the opens are
+     * checked HERE, where the cause can still be named, rather than becoming
+     * silent bad stdio further down.
+     */
+    IntPtr INVALID = new IntPtr(-1);
+    if (hOut == INVALID) return "stdio: cannot open the stdout file for the contained child";
+    if (hErr == INVALID) return "stdio: cannot open the stderr file for the contained child";
+    if (!string.IsNullOrEmpty(inPath) && hIn == INVALID) return "stdio: cannot open the stdin file for the contained child";
+
+    int hCount = (hIn == IntPtr.Zero) ? 2 : 3;
+    IntPtr[] inheritable = (hCount == 2) ? new IntPtr[] { hOut, hErr } : new IntPtr[] { hOut, hErr, hIn };
+    IntPtr hlPtr = Marshal.AllocHGlobal(IntPtr.Size * hCount);
+    Marshal.Copy(inheritable, 0, hlPtr, hCount);
+    // PROC_THREAD_ATTRIBUTE_HANDLE_LIST — exactly the three we opened, and
+    // nothing this process happens to be holding.
+    if (!UpdateProcThreadAttribute(attrs, 0, (IntPtr)0x00020002, hlPtr, (IntPtr)(IntPtr.Size * hCount), IntPtr.Zero, IntPtr.Zero))
+      return "handlelist: " + Marshal.GetLastWin32Error();
+
+    // NEVER IntPtr.Zero: that means "inherit mine", which is the daemon's
+    // environment and the whole thing we are keeping away from this child.
+    if (env.Length == 0) return "environment: refusing to launch with no environment block, because a null block would inherit the daemon's";
+    IntPtr envPtr = EnvBlock(env);
+    PROCESS_INFORMATION pi;
+    bool ok = CreateProcess(exe, new StringBuilder(cmdLine), IntPtr.Zero, IntPtr.Zero, true,
+      CREATE_UNICODE_ENVIRONMENT | EXTENDED_STARTUPINFO_PRESENT | CREATE_NO_WINDOW | CREATE_SUSPENDED,
+      envPtr, cwd, ref si, out pi);
+    if (!ok) { int e = Marshal.GetLastWin32Error(); CloseHandle(hOut); CloseHandle(hErr); return "launch: " + e; }
+
+    // A job object so descendants cannot outlive the command. This is LIFETIME
+    // control, not the authority boundary — the container is the boundary.
+    //
+    // 🔴 EVERY STEP IS CHECKED, AND A FAILURE REFUSES TO LAUNCH.
+    //
+    // This block used to discard all three results: `CreateJobObject` returning
+    // null skipped the `if` entirely, and `SetInformationJobObject` and
+    // `AssignProcessToJobObject` were called for effect with their `bool`
+    // thrown away. Any of the three failing left the process resuming OUTSIDE
+    // any job, with no kill-on-close and nothing anywhere saying so — the
+    // lifetime boundary silently absent while every caller believed it was
+    // there.
+    //
+    // Failing closed is clean here precisely because of the ordering already
+    // chosen: the process is created SUSPENDED, so nothing of it has run yet
+    // and terminating it costs nothing. That ordering was correct for the
+    // reason it was written — there is no window in which a child could escape
+    // before assignment — and it is what makes refusal possible now.
+    IntPtr job = CreateJobObject(IntPtr.Zero, null);
+    if (job == IntPtr.Zero) {
+      int e = Marshal.GetLastWin32Error();
+      TerminateProcess(pi.hProcess, 1);
+      CloseHandle(pi.hThread); CloseHandle(pi.hProcess);
+      CloseHandle(hOut); CloseHandle(hErr); if (hIn != IntPtr.Zero) CloseHandle(hIn);
+      return "job: could not create a job object (" + e + ")";
+    }
+    JOBOBJECT_EXTENDED_LIMIT_INFORMATION li = new JOBOBJECT_EXTENDED_LIMIT_INFORMATION();
+    li.BasicLimitInformation.LimitFlags = 0x00002000; // KILL_ON_JOB_CLOSE
+    IntPtr lp = Marshal.AllocHGlobal(Marshal.SizeOf(li));
+    Marshal.StructureToPtr(li, lp, false);
+    bool limitsSet = SetInformationJobObject(job, 9, lp, (uint)Marshal.SizeOf(li));
+    Marshal.FreeHGlobal(lp);
+    bool assigned = limitsSet && AssignProcessToJobObject(job, pi.hProcess);
+    if (!assigned) {
+      int e = Marshal.GetLastWin32Error();
+      TerminateProcess(pi.hProcess, 1);
+      CloseHandle(pi.hThread); CloseHandle(pi.hProcess);
+      CloseHandle(hOut); CloseHandle(hErr); if (hIn != IntPtr.Zero) CloseHandle(hIn);
+      CloseHandle(job);
+      return (limitsSet ? "job: could not assign the process to the job (" : "job: could not set kill-on-close (") + e + ")";
+    }
+    ResumeThreadSafe(pi.hThread);
+
+    uint w = WaitForSingleObject(pi.hProcess, timeoutMs);
+    if (w == 0x00000102) { timedOut = true; TerminateProcess(pi.hProcess, 1); WaitForSingleObject(pi.hProcess, 5000); }
+    GetExitCodeProcess(pi.hProcess, out exitCode);
+
+    CloseHandle(pi.hThread); CloseHandle(pi.hProcess);
+    CloseHandle(hOut); CloseHandle(hErr);
+    if (hIn != IntPtr.Zero) CloseHandle(hIn);
+    if (job != IntPtr.Zero) CloseHandle(job);
+    DeleteProcThreadAttributeList(attrs);
+    Marshal.FreeHGlobal(attrs); Marshal.FreeHGlobal(scPtr); Marshal.FreeHGlobal(envPtr);
+    return null;
+  }
+
+  [DllImport("kernel32.dll", SetLastError=true)] static extern uint ResumeThread(IntPtr h);
+  static void ResumeThreadSafe(IntPtr h) { ResumeThread(h); }
+}
+'@
+
+try {
+  $raw = [Console]::In.ReadToEnd()
+  $req = $raw | ConvertFrom-Json
+} catch {
+  Write-Result @{ ok = $false; stage = 'request'; error = "could not read the request: $($_.Exception.Message)" }
+  exit 0
+}
+
+try {
+  Add-Type -TypeDefinition $src -Language CSharp
+} catch {
+  Write-Result @{ ok = $false; stage = 'compile'; error = $_.Exception.Message }
+  exit 0
+}
+
+# --- profile -----------------------------------------------------------------
+$sidStr = [LooplyAc]::Ensure($req.profile)
+if ($sidStr -like 'ERR *') { Write-Result @{ ok = $false; stage = 'profile'; error = $sidStr }; exit 0 }
+if (-not $sidStr) { Write-Result @{ ok = $false; stage = 'profile'; error = 'no container SID' }; exit 0 }
+
+if ($req.action -eq 'probe') {
+  Write-Result @{ ok = $true; stage = 'probe'; sid = $sidStr }
+  exit 0
+}
+if ($req.action -eq 'remove') {
+  $hr = [LooplyAc]::DeleteAppContainerProfile($req.profile)
+  Write-Result @{ ok = ($hr -eq 0); stage = 'remove'; hr = $hr }
+  exit 0
+}
+
+# --- filesystem grants -------------------------------------------------------
+# Only the paths named, only the rights named. Additive: existing ACEs are left
+# exactly as they were, so the owner never loses access to their own files.
+try {
+  $sidObj = New-Object System.Security.Principal.SecurityIdentifier($sidStr)
+  foreach ($g in @($req.grants)) {
+    if (-not $g) { continue }
+    $rights = if ($g.write) { 'Modify' } else { 'ReadAndExecute' }
+    $acl = Get-Acl $g.path
+    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
+      $sidObj, $rights, 'ContainerInherit,ObjectInherit', 'None', 'Allow')
+    $acl.AddAccessRule($rule)
+    Set-Acl $g.path $acl
+  }
+} catch {
+  Write-Result @{ ok = $false; stage = 'grant'; error = $_.Exception.Message; sid = $sidStr }
+  exit 0
+}
+
+# --- protected subtrees ------------------------------------------------------
+# A grant on the project root is inheritable, so `.git` and `.looply/state` come
+# with it unless they are taken back. They are taken back by BREAKING
+# INHERITANCE and removing the container's own ACEs — not by adding a DENY.
+#
+# Deny ACEs sort ahead of allows and would apply to anyone who happened to match
+# later, which on a path the person also owns is a good way to lock the owner
+# out of their own repository. Removing the container's allow leaves every other
+# ACE exactly as it was.
+try {
+  $ACCESS_ONLY = [System.Security.AccessControl.AccessControlSections]::Access
+  foreach ($p in @($req.protect)) {
+    if (-not $p) { continue }
+    # A path that is not there protects itself. A project without a config.yaml
+    # must not fail to run a gate over it.
+    if (-not (Test-Path $p)) { continue }
+    # THE DACL ONLY. Get-Acl/Set-Acl round-trip the audit section too, and
+    # writing a SACL needs SeSecurityPrivilege, which an ordinary user does not
+    # hold — the operation then fails naming a privilege rather than a path.
+    # A protected path may be a file — `.looply/config.yaml` names the gate
+    # commands and the rails, so it is as worth protecting as the state
+    # directory, and FileInfo carries the same access-control surface.
+    if (Test-Path $p -PathType Leaf) {
+      $di = New-Object System.IO.FileInfo($p)
+    } else {
+      $di = New-Object System.IO.DirectoryInfo($p)
+    }
+    $acl = $di.GetAccessControl($ACCESS_ONLY)
+    # (true, true): stop inheriting, and keep what was inherited as explicit
+    # entries, so SYSTEM, Administrators and the owner are unaffected.
+    # TWO STEPS, and the order is the whole trick. An INHERITED entry cannot be
+    # removed where it appears — it lives on the parent. Breaking inheritance
+    # with (true, true) copies it down as an explicit entry, but only once that
+    # has been SAVED; purging before the save silently removes nothing and
+    # reports success.
+    $acl.SetAccessRuleProtection($true, $true)
+    $di.SetAccessControl($acl)
+
+    $acl = $di.GetAccessControl($ACCESS_ONLY)
+    # Purge by IDENTITY, not by rule: RemoveAccessRule matches rights and
+    # inheritance flags too, so an entry differing in any of them survives.
+    $acl.PurgeAccessRules($sidObj)
+    $di.SetAccessControl($acl)
+    # Prove it, rather than trust it: if the container can still be found in
+    # the effective ACL, the protection did not happen.
+    $after = (New-Object System.IO.DirectoryInfo($p)).GetAccessControl($ACCESS_ONLY)
+    foreach ($rule in @($after.Access)) {
+      if ($rule.IdentityReference.Value -eq $sidStr) {
+        throw "the container is still granted on $p after protection"
+      }
+    }
+  }
+} catch {
+  # FAIL CLOSED. A protected path that could not be protected must not become a
+  # path the container may write; nothing has been launched yet.
+  Write-Result @{ ok = $false; stage = 'protect'; error = $_.Exception.Message; sid = $sidStr }
+  exit 0
+}
+
+# --- launch ------------------------------------------------------------------
+$envPairs = @()
+foreach ($p in $req.env.PSObject.Properties) { $envPairs += ("{0}={1}" -f $p.Name, $p.Value) }
+
+$exitCode = [uint32]0
+$timedOut = $false
+# internetClient (S-1-15-3-1) for the agent; nothing at all for the gate.
+$caps = @()
+if ($req.network -eq 'internet-client') {
+  # internetClient, plus privateNetworkClientServer so an endpoint on the
+  # machine's own subnet is reachable too. Neither covers loopback: an
+  # AppContainer needs a separate CheckNetIsolation exemption for 127.0.0.1,
+  # which is why a loopback probe cannot tell these two profiles apart.
+  $caps = @('S-1-15-3-1', 'S-1-15-3-3')
+}
+$stdinPath = if ($req.stdinPath) { [string]$req.stdinPath } else { '' }
+$runErr = [LooplyAc]::Run($req.executable, $req.commandLine, $req.cwd, [string[]]$envPairs,
+                          $req.stdoutPath, $req.stderrPath, $stdinPath, [uint32]$req.timeoutMs, [string[]]$caps,
+                          [ref]$exitCode, [ref]$timedOut)
+if ($runErr) {
+  # The environment count travels with the failure: CreateProcess answers 203
+  # (ERROR_ENVVAR_NOT_FOUND) for an EMPTY block as readily as a malformed one,
+  # and those two look identical from the outside.
+  Write-Result @{ ok = $false; stage = 'launch'; error = $runErr; sid = $sidStr; envCount = $envPairs.Count; envSample = ($envPairs -join '|'); exeOk = (Test-Path $req.executable); cwdOk = (Test-Path $req.cwd) }
+  exit 0
+}
+
+Write-Result @{ ok = $true; stage = 'ran'; sid = $sidStr; exitCode = [int]$exitCode; timedOut = $timedOut }
+exit 0