rtrt-agent 0.2.0 → 0.2.1

package/runtime/dashboard-acl.ps1

@@ -0,0 +1,103 @@
+$ErrorActionPreference = 'Stop'
+$target = $env:RTRT_ACL_PATH
+$action = $env:RTRT_ACL_ACTION
+if (-not [IO.Path]::IsPathRooted($target) -or $target.Contains([char]0)) { throw 'Invalid ACL path' }
+$self = [Security.Principal.WindowsIdentity]::GetCurrent().User
+$system = New-Object Security.Principal.SecurityIdentifier 'S-1-5-18'
+$admins = New-Object Security.Principal.SecurityIdentifier 'S-1-5-32-544'
+$creatorOwner = New-Object Security.Principal.SecurityIdentifier 'S-1-3-0'
+
+function Assert-Item([string] $name) {
+    $item = Get-Item -LiteralPath $name -Force
+    if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'Reparse point refused' }
+    return $item
+}
+
+function Assert-Private([string] $name) {
+    $item = Assert-Item $name
+    $acl = Get-Acl -LiteralPath $name
+    if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -ne $self.Value -or
+        -not $acl.AreAccessRulesProtected) { throw 'Private owner or inheritance mismatch' }
+    $rules = @($acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier]))
+    if ($rules.Count -ne 1) { throw 'Private ACE count mismatch' }
+    $rule = $rules[0]
+    if ($rule.IsInherited -or $rule.IdentityReference.Value -ne $self.Value -or
+        $rule.AccessControlType -ne [Security.AccessControl.AccessControlType]::Allow -or
+        [int]$rule.FileSystemRights -ne [int][Security.AccessControl.FileSystemRights]::FullControl) {
+        throw 'Private ACE mismatch'
+    }
+    if ($item.PSIsContainer) {
+        if ($rule.InheritanceFlags -ne ([Security.AccessControl.InheritanceFlags]::ContainerInherit -bor
+            [Security.AccessControl.InheritanceFlags]::ObjectInherit) -or
+            $rule.PropagationFlags -ne [Security.AccessControl.PropagationFlags]::None) { throw 'Private directory ACE mismatch' }
+    } elseif ($rule.InheritanceFlags -ne [Security.AccessControl.InheritanceFlags]::None) {
+        throw 'Private file ACE mismatch'
+    }
+}
+
+if ($action -eq 'private-create') {
+    $item = Assert-Item $target
+    if ($item.PSIsContainer) {
+        $acl = New-Object Security.AccessControl.DirectorySecurity
+        $flags = 'ContainerInherit,ObjectInherit'
+        $rule = New-Object Security.AccessControl.FileSystemAccessRule -ArgumentList @($self, 'FullControl', $flags, 'None', 'Allow')
+    } else {
+        $acl = New-Object Security.AccessControl.FileSecurity
+        $rule = New-Object Security.AccessControl.FileSystemAccessRule -ArgumentList @($self, 'FullControl', 'Allow')
+    }
+    $acl.SetOwner($self)
+    $acl.SetAccessRuleProtection($true, $false)
+    $acl.AddAccessRule($rule)
+    Set-Acl -LiteralPath $target -AclObject $acl
+    Assert-Private $target
+} elseif ($action -eq 'private-check') {
+    Assert-Private $target
+} elseif ($action -eq 'binary-check') {
+    $current = $target
+    $trustedInstaller = New-Object Security.Principal.SecurityIdentifier 'S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464'
+    $trustedBinarySids = @($self.Value, $system.Value, $admins.Value, $trustedInstaller.Value)
+    $writes = [int]([Security.AccessControl.FileSystemRights]::WriteData -bor
+        [Security.AccessControl.FileSystemRights]::AppendData -bor
+        [Security.AccessControl.FileSystemRights]::WriteExtendedAttributes -bor
+        [Security.AccessControl.FileSystemRights]::WriteAttributes -bor
+        [Security.AccessControl.FileSystemRights]::Delete -bor
+        [Security.AccessControl.FileSystemRights]::DeleteSubdirectoriesAndFiles -bor
+        [Security.AccessControl.FileSystemRights]::ChangePermissions -bor
+        [Security.AccessControl.FileSystemRights]::TakeOwnership)
+    $replaceChildren = [int]([Security.AccessControl.FileSystemRights]::Delete -bor
+        [Security.AccessControl.FileSystemRights]::DeleteSubdirectoriesAndFiles -bor
+        [Security.AccessControl.FileSystemRights]::ChangePermissions -bor
+        [Security.AccessControl.FileSystemRights]::TakeOwnership)
+    while ($current) {
+        $item = Assert-Item $current
+        $acl = Get-Acl -LiteralPath $current
+        $owner = $acl.GetOwner([Security.Principal.SecurityIdentifier]).Value
+        if ($trustedBinarySids -cnotcontains $owner) { throw 'Untrusted binary owner' }
+        $effectiveWrites = $writes
+        if ($item.PSIsContainer) {
+            # Creation and directory-metadata rights alone cannot replace protected checked
+            # children; deletion or ACL/ownership control can.
+            $effectiveWrites = $replaceChildren
+        }
+        foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+            $sid = $rule.IdentityReference.Value
+            $rights = [int]$rule.FileSystemRights
+            # Expand generic masks before comparing filesystem rights. GenericWrite creates
+            # directory entries but does not itself grant delete-child or ownership control.
+            if (($rights -band 0x10000000) -ne 0) {
+                $rights = $rights -bor [int][Security.AccessControl.FileSystemRights]::FullControl
+            }
+            if (($rights -band 0x40000000) -ne 0) {
+                $rights = $rights -bor [int][Security.AccessControl.FileSystemRights]::Write
+            }
+            if ($rule.AccessControlType -eq [Security.AccessControl.AccessControlType]::Allow -and
+                $trustedBinarySids -cnotcontains $sid -and
+                $sid -ne $creatorOwner.Value -and
+                (([int]$rule.PropagationFlags -band [int][Security.AccessControl.PropagationFlags]::InheritOnly) -eq 0) -and
+                ($rights -band $effectiveWrites) -ne 0) { throw 'Untrusted binary writer' }
+        }
+        $parent = [IO.Path]::GetDirectoryName($current.TrimEnd([IO.Path]::DirectorySeparatorChar))
+        if (-not $parent -or $parent -eq $current) { break }
+        $current = $parent
+    }
+} else { throw 'Invalid ACL operation' }

package/runtime/dashboard-binary.js

@@ -2,6 +2,7 @@ import { lstat, readFile } from "node:fs/promises"
 import path from "node:path"
 import { fileURLToPath } from "node:url"
 import { readRegular, realPath, unavailable } from "./dashboard-files.js"
+import { windowsAcl } from "./dashboard-acl.js"
 
 const PACKAGES = new Map([
   ["linux-x64", "rtrt-dashboard-linux-x64"],
@@ -52,11 +53,15 @@ export async function resolveDashboardBinary({
         if (parent === ancestor) break
         ancestor = parent
       }
+      if (platform === "win32") await windowsAcl(path.join(directory, "package.json"), "binary-check")
       const manifest = JSON.parse(await readRegular(path.join(directory, "package.json"), validate))
       if (manifest.name !== name || manifest.version !== expected) continue
       const binary = path.join(directory, "bin", platform === "win32" ? "rtrt-dashboard.exe" : "rtrt-dashboard")
       await realPath(binary)
       validate(await lstat(path.dirname(binary)))
+      if (platform === "win32") {
+        await windowsAcl(binary, "binary-check")
+      }
       const stat = await lstat(binary)
       validate(stat)
       if (!stat.isFile() || stat.nlink !== 1 || (platform !== "win32" && (stat.mode & 0o111) === 0)) throw unavailable()

package/runtime/dashboard-bootstrap.js

@@ -0,0 +1,45 @@
+import { randomBytes } from "node:crypto"
+import { constants } from "node:fs"
+import { lstat, open, rename, unlink } from "node:fs/promises"
+import path from "node:path"
+import { privateMetadata, realPath, unavailable } from "./dashboard-files.js"
+import { windowsAcl } from "./dashboard-acl.js"
+
+export async function writeDashboardBootstrap(state, credential, { platform = process.platform, uid = process.geteuid?.() } = {}) {
+  if (!/^[A-Za-z0-9_-]{87}$/.test(credential)) throw unavailable()
+  await realPath(state)
+  const stateMetadata = await lstat(state)
+  privateMetadata(stateMetadata, { platform, uid }, 0o700)
+  if (!stateMetadata.isDirectory()) throw unavailable()
+  if (platform === "win32") await windowsAcl(state, "private-check")
+  const destination = path.join(state, "bootstrap.html")
+  try {
+    const existing = await lstat(destination)
+    privateMetadata(existing, { platform, uid }, 0o600)
+    if (!existing.isFile() || existing.nlink !== 1 || existing.size > 512) throw unavailable()
+    if (platform === "win32") await windowsAcl(destination, "private-check")
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error
+  }
+  const temporary = path.join(state, `.bootstrap-${randomBytes(16).toString("hex")}.tmp`)
+  const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600)
+  try {
+    if (platform === "win32") await windowsAcl(temporary, "private-create")
+    privateMetadata(await handle.stat(), { platform, uid }, 0o600)
+    const body = `<!doctype html><meta http-equiv="refresh" content="0;url=http://127.0.0.1:7311/#bootstrap=${credential}">`
+    await handle.writeFile(body)
+    await handle.sync()
+  } catch (error) {
+    await handle.close()
+    await unlink(temporary)
+    throw error
+  }
+  await handle.close()
+  try {
+    await rename(temporary, destination)
+  } catch (error) {
+    await unlink(temporary)
+    throw error
+  }
+  return destination
+}

package/runtime/dashboard-files.js

@@ -1,6 +1,7 @@
 import { constants } from "node:fs"
 import { lstat, mkdir, open, rmdir } from "node:fs/promises"
 import path from "node:path"
+import { windowsAcl } from "./dashboard-acl.js"
 
 export const unavailable = () => new Error("Dashboard unavailable.")
 
@@ -11,7 +12,8 @@ export async function realPath(candidate) {
   let current = path.parse(normalized).root
   for (const part of parts) {
     current = path.join(current, part)
-    if ((await lstat(current)).isSymbolicLink()) throw unavailable()
+    const stat = await lstat(current)
+    if (stat.isSymbolicLink()) throw unavailable()
   }
   return normalized
 }
@@ -48,6 +50,7 @@ export function dashboardFiles({ home, uid, platform }) {
     const stat = await lstat(candidate)
     privateMetadata(stat, identity, 0o700)
     if (!stat.isDirectory()) throw unavailable()
+    if (platform === "win32") await windowsAcl(candidate, "private-check")
   }
   const checkLock = async () => {
     try { await directory(lock) } catch (error) {
@@ -59,7 +62,10 @@ export function dashboardFiles({ home, uid, platform }) {
     const stat = await lstat(home)
     if (!stat.isDirectory() || (platform !== "win32" && (stat.uid !== uid || (stat.mode & 0o022) !== 0))) throw unavailable()
     for (const candidate of [path.dirname(state), state]) {
-      try { await mkdir(candidate, { mode: 0o700 }) } catch (error) {
+      try {
+        await mkdir(candidate, { mode: 0o700 })
+        if (platform === "win32") await windowsAcl(candidate, "private-create")
+      } catch (error) {
         if (error.code !== "EEXIST") throw error
       }
       await directory(candidate)
@@ -69,6 +75,13 @@ export function dashboardFiles({ home, uid, platform }) {
   const readToken = async () => {
     await realPath(state)
     let raw
+    if (platform === "win32") {
+      try { await lstat(credential) } catch (error) {
+        if (error.code === "ENOENT") return undefined
+        throw error
+      }
+      await windowsAcl(credential, "private-check")
+    }
     try { raw = await readRegular(credential, (stat) => privateMetadata(stat, identity, 0o600)) } catch (error) {
       if (error.code === "ENOENT") return undefined
       throw error
@@ -83,6 +96,7 @@ export function dashboardFiles({ home, uid, platform }) {
     if (!/^[a-fA-F0-9]{64}$/.test(token)) throw unavailable()
     const handle = await open(credential, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600)
     try {
+      if (platform === "win32") await windowsAcl(credential, "private-create")
       privateMetadata(await handle.stat(), identity, 0o600)
       await handle.writeFile(`RTRT_DASHBOARD_TOKEN=${token}\n`)
       await handle.sync()
@@ -91,7 +105,10 @@ export function dashboardFiles({ home, uid, platform }) {
     }
   }
   const acquire = async () => {
-    try { await mkdir(lock, { mode: 0o700 }) } catch (error) {
+    try {
+      await mkdir(lock, { mode: 0o700 })
+      if (platform === "win32") await windowsAcl(lock, "private-create")
+    } catch (error) {
       if (error.code !== "EEXIST") throw error
       await directory(lock)
       return undefined

package/runtime/dashboard-process.js

@@ -48,12 +48,13 @@ export function launchDetached(binary, args, { spawnProcess = spawn, ...options
   })
 }
 
-export async function openDashboardBrowser(url, { platform = process.platform, launch = launchDetached } = {}) {
-  // Never consult BROWSER or PATH. URL is generated locally, not supplied by a tool argument.
+export async function openDashboardBrowser(file, { platform = process.platform, launch = launchDetached } = {}) {
+  // Never consult BROWSER or PATH. Ordinary opener argv carries only a local file path.
+  if (!path.isAbsolute(file) || /:\/\/|#|bootstrap=/i.test(file)) throw unavailable()
   switch (platform) {
-    case "linux": return launch("/usr/bin/xdg-open", [url])
-    case "darwin": return launch("/usr/bin/open", [url])
-    case "win32": return launch("C:\\Windows\\System32\\rundll32.exe", ["url.dll,FileProtocolHandler", url])
+    case "linux": return launch("/usr/bin/xdg-open", [file])
+    case "darwin": return launch("/usr/bin/open", [file])
+    case "win32": return launch(path.win32.join(process.env.SystemRoot || "C:\\Windows", "System32", "rundll32.exe"), ["url.dll,FileProtocolHandler", file])
     default: throw unavailable()
   }
 }

package/runtime/dashboard-supervisor.js

@@ -4,6 +4,7 @@ import { setTimeout as delay } from "node:timers/promises"
 import { dashboardFiles, unavailable } from "./dashboard-files.js"
 import { resolveDashboardBinary } from "./dashboard-binary.js"
 import { launchDetached, openDashboardBrowser, probeDashboard } from "./dashboard-process.js"
+import { writeDashboardBootstrap } from "./dashboard-bootstrap.js"
 
 export function createDashboardSupervisor({
   env = process.env, platform = process.platform, arch = process.arch, uid = process.geteuid?.(),
@@ -85,7 +86,8 @@ export function createDashboardSupervisor({
       createHmac("sha256", Buffer.from(token, "hex"))
         .update("rtrt-dashboard-browser-bootstrap\0v1\0")
         .update(wire.subarray(0, 33)).digest().copy(wire, 33)
-      await openBrowser(`http://127.0.0.1:7311/#bootstrap=${wire.toString("base64url")}`, { platform })
+      const bootstrap = await writeDashboardBootstrap(files.state, wire.toString("base64url"), { platform, uid })
+      await openBrowser(bootstrap, { platform })
       return "Dashboard open requested."
     } catch {
       // Never expose dependency errors: process errors can contain the bootstrap URL.