windows-development-sandbox 1.14.0 → 1.15.0

package/native/csharp/HcsHost/WsbGuard.cs

@@ -0,0 +1,130 @@
+// The one exception to "only systems this tool created" (docs/design/hcs-live-folders.md, section 4): the wsb-share
+// verb may add a vSMB share to the running Windows Sandbox. It acts only when exactly one compute system is a running
+// VirtualMachine with a GUID id and an Owner from a fixed list, and that id is the one asked for. An unknown Owner,
+// none or two candidates (another user's sandbox, Application Guard) all fail closed. Ids with this tool's own prefix
+// are refused here, and `share` refuses GUIDs, so neither verb reaches the other's systems.
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.Text.RegularExpressions;
+using System.Web.Script.Serialization;
+
+namespace AgentSandbox.HcsHost
+{
+    public static class WsbGuard
+    {
+        /// <summary>The Owner Windows Sandbox's compute system is reported to have (unconfirmed: the PC test records it).</summary>
+        private static readonly string[] Owners = new string[] { "Madrid" };
+        private static readonly Regex GuidId = new Regex("^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+
+        /// <summary>Null when `id` has the shape of Windows Sandbox's id (a GUID, never one of ours).</summary>
+        public static string IdProblem(string id)
+        {
+            if (id == null || id.StartsWith(Guard.IdPrefix, StringComparison.OrdinalIgnoreCase) || !GuidId.IsMatch(id))
+            {
+                return "only the running Windows Sandbox (a GUID id) can be given a live folder";
+            }
+            return null;
+        }
+
+        /// <summary>One system from HCS JSON: its Id, SystemType, Owner and State ("" when missing).</summary>
+        private static string Field(Dictionary<string, object> s, string key)
+        {
+            object value;
+            return s != null && s.TryGetValue(key, out value) && value is string ? (string)value : "";
+        }
+
+        private static bool IsCandidate(Dictionary<string, object> s)
+        {
+            return Field(s, "SystemType") == "VirtualMachine" && Field(s, "State") == "Running" &&
+                Array.IndexOf(Owners, Field(s, "Owner")) >= 0 && GuidId.IsMatch(Field(s, "Id"));
+        }
+
+        /// <summary>
+        /// Pure: the Windows Sandbox candidate in HcsEnumerateComputeSystems' answer. Null (with `id`) when there is
+        /// exactly one; otherwise why not.
+        /// </summary>
+        public static string Candidate(string enumerateJson, out string id)
+        {
+            id = null;
+            object parsed;
+            try
+            {
+                parsed = new JavaScriptSerializer().DeserializeObject(enumerateJson ?? "");
+            }
+            catch (ArgumentException)
+            {
+                return "the list of compute systems is not JSON";
+            }
+            catch (InvalidOperationException)
+            {
+                return "the list of compute systems is not JSON";
+            }
+            IEnumerable systems = parsed as object[];
+            if (systems == null)
+            {
+                return "the list of compute systems is not a list";
+            }
+            List<string> found = new List<string>();
+            foreach (object o in systems)
+            {
+                Dictionary<string, object> s = o as Dictionary<string, object>;
+                if (IsCandidate(s))
+                {
+                    found.Add(Field(s, "Id"));
+                }
+            }
+            if (found.Count != 1)
+            {
+                return "exactly one running Windows Sandbox is needed, and " + found.Count + " were found (another user's sandbox or Application Guard counts too; a Windows Sandbox whose Owner is not " + string.Join(", ", Owners) + " is not recognised)";
+            }
+            id = found[0];
+            return null;
+        }
+
+        /// <summary>Pure: null when the candidate is the system asked for (case-insensitive GUIDs).</summary>
+        public static string MatchProblem(string candidate, string wanted)
+        {
+            if (wanted != null && wanted.Length > 0 && !string.Equals(candidate, wanted, StringComparison.OrdinalIgnoreCase))
+            {
+                return "the running Windows Sandbox is not the one this live folder was recorded for (it was restarted)";
+            }
+            return null;
+        }
+
+        /// <summary>Pure: null when an opened system's own properties still say it is the running Windows Sandbox `id`.</summary>
+        public static string PropertiesProblem(string propertiesJson, string id)
+        {
+            Dictionary<string, object> s;
+            try
+            {
+                s = new JavaScriptSerializer().Deserialize<Dictionary<string, object>>(propertiesJson ?? "");
+            }
+            catch (ArgumentException)
+            {
+                return "its properties are not JSON";
+            }
+            catch (InvalidOperationException)
+            {
+                return "its properties are not JSON";
+            }
+            if (!IsCandidate(s) || !string.Equals(Field(s, "Id"), id, StringComparison.OrdinalIgnoreCase))
+            {
+                return "the opened system is no longer the running Windows Sandbox";
+            }
+            return null;
+        }
+
+        /// <summary>Live: asks HCS for every system and finds Windows Sandbox (null with `id`, or why not).</summary>
+        public static string Find(out string id)
+        {
+            id = null;
+            HcsReply reply = Hcs.Enumerate(null);
+            if (!reply.Ok)
+            {
+                return "the compute systems could not be listed: " + reply.Message();
+            }
+            return Candidate(reply.Json, out id);
+        }
+    }
+}

package/native/csharp/HcsHost/WsbShare.cs

@@ -0,0 +1,295 @@
+// wsb-share (docs/design/hcs-live-folders.md): adds or removes one live folder on the running Windows Sandbox, run by
+// native\scripts\hcs-live-share.ps1 from an administrator-only copy of this exe. One process holds one handle to the
+// system for the whole add:
+//  1. the request (its exact bytes hashed and compared), the folder (FolderAccess) and the system (WsbGuard: exactly
+//     one candidate, the id asked for if one was recorded, its own properties re-read through the handle);
+//  2. a canary: a fresh folder next to this exe (Administrators, SYSTEM and the Virtual Machines group only) holding a
+//     random 128-bit token, shared read-only under a random name; canary.json in the request's folder tells the
+//     unelevated caller its name; the token our sandbox's daemon read from that share must come back in answer.txt
+//     within the time limit;
+//  3. only then the real folder is shared. The canary share and folder are always removed again.
+// It never terminates, pauses or saves the system, and every HCS operation waits at most 60 seconds.
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Security.AccessControl;
+using System.Security.Cryptography;
+using System.Security.Principal;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Threading;
+
+namespace AgentSandbox.HcsHost
+{
+    public static class WsbShare
+    {
+        private const uint OperationMs = 60000;
+        private const int CanaryWaitMs = 45000;
+        private const int PollMs = 250;
+        private const string CanaryFile = "canary.json";
+        private const string AnswerFile = "answer.txt";
+        private const string TokenFile = "token.txt";
+        private static readonly Regex Token = new Regex("^[0-9a-f]{32}$");
+        private static readonly SecurityIdentifier VirtualMachines = new SecurityIdentifier("S-1-5-83-0");
+
+        /// <summary>Adds or removes per the request; `values` say what happened (id, canary, the share request).</summary>
+        public static bool Run(string requestFile, string sha256, IDictionary<string, string> values, out string message)
+        {
+            string problem;
+            ShareRequest request = ShareRequest.Read(requestFile, sha256, out problem);
+            if (problem != null)
+            {
+                message = "Refused: " + problem;
+                return false;
+            }
+            // Elevated with another account's password (a standard user's prompt): the profile, access and ownership
+            // checks would be that account's, so it is refused. Live folders need your own administrator account.
+            string me = WindowsIdentity.GetCurrent().User.Value;
+            if (string.IsNullOrEmpty(request.UserSid) || !string.Equals(request.UserSid, me, StringComparison.OrdinalIgnoreCase))
+            {
+                message = "Refused: the permission prompt was answered with another account; live folders need your own administrator account";
+                return false;
+            }
+            string wanted = string.IsNullOrEmpty(request.Id) ? null : request.Id;
+            if (wanted != null && (problem = WsbGuard.IdProblem(wanted)) != null)
+            {
+                message = "Refused: " + problem;
+                return false;
+            }
+            if (!request.Add && wanted == null)
+            {
+                message = "Refused: a live folder is only removed from the sandbox it was added to (give its id)";
+                return false;
+            }
+            string folder = null;
+            IntPtr held = IntPtr.Zero;
+            if (request.Add && (problem = FolderAccess.Problem(request.Path, request.ReadOnly, request.StorageRoot, request.DataPath, out folder, out held)) != null)
+            {
+                message = "Refused: " + problem;
+                return false;
+            }
+            try
+            {
+                return WithFolder(request, requestFile, folder, held, wanted, values, out message);
+            }
+            finally
+            {
+                FolderAccess.Close(held);
+            }
+        }
+
+        /// <summary>The rest of Run, while the folder to share is held open (it cannot be renamed or replaced).</summary>
+        private static bool WithFolder(ShareRequest request, string requestFile, string folder, IntPtr held, string wanted, IDictionary<string, string> values, out string message)
+        {
+            string problem;
+            string id;
+            if ((problem = WsbGuard.Find(out id)) != null || (problem = WsbGuard.MatchProblem(id, wanted)) != null)
+            {
+                message = "Refused: " + problem;
+                return false;
+            }
+            values["id"] = id;
+            IntPtr system;
+            int hr = Hcs.Open(id, out system);
+            if (hr != 0)
+            {
+                HcsReply failed = new HcsReply();
+                failed.HResult = hr;
+                message = "Windows Sandbox could not be opened: " + failed.Message();
+                return false;
+            }
+            try
+            {
+                HcsReply props = Hcs.PropertiesOf(system);
+                if (!props.Ok || (problem = WsbGuard.PropertiesProblem(props.Json, id)) != null)
+                {
+                    message = "Refused: " + (problem ?? "its properties could not be read: " + props.Message());
+                    return false;
+                }
+                if (!request.Add)
+                {
+                    string remove = ShareRequest.Build(false, request.Name, null, true);
+                    values["request"] = remove;
+                    return Reply(Hcs.ModifyOn(system, remove, OperationMs), "removed", out message);
+                }
+                return AddWithCanary(system, request, folder, held, Path.GetDirectoryName(Path.GetFullPath(requestFile)), values, out message);
+            }
+            finally
+            {
+                Hcs.Close(system);
+            }
+        }
+
+        private static bool Reply(HcsReply reply, string done, out string message)
+        {
+            message = reply.Ok ? done : "The Host Compute Service said: " + reply.Message() + " (0x" + reply.HResult.ToString("X8") + ")";
+            return reply.Ok;
+        }
+
+        private static string RandomHex(int bytes)
+        {
+            byte[] b = new byte[bytes];
+            using (RandomNumberGenerator rng = RandomNumberGenerator.Create())
+            {
+                rng.GetBytes(b);
+            }
+            return BitConverter.ToString(b).Replace("-", "").ToLowerInvariant();
+        }
+
+        /// <summary>A new folder only Administrators, SYSTEM and the VM worker processes can use (made with that DACL).</summary>
+        private static string MakeCanaryFolder(string token)
+        {
+            string here = Path.GetDirectoryName(typeof(WsbShare).Assembly.Location);
+            string dir = Path.Combine(here, "canary-" + RandomHex(8));
+            if (Directory.Exists(dir) || File.Exists(dir))
+            {
+                throw new IOException("the canary folder exists already");
+            }
+            DirectorySecurity security = new DirectorySecurity();
+            security.SetAccessRuleProtection(true, false);
+            security.SetOwner(new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null));
+            InheritanceFlags inherit = InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit;
+            security.AddAccessRule(new FileSystemAccessRule(new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null), FileSystemRights.FullControl, inherit, PropagationFlags.None, AccessControlType.Allow));
+            security.AddAccessRule(new FileSystemAccessRule(new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null), FileSystemRights.FullControl, inherit, PropagationFlags.None, AccessControlType.Allow));
+            security.AddAccessRule(new FileSystemAccessRule(VirtualMachines, FileSystemRights.ReadAndExecute, inherit, PropagationFlags.None, AccessControlType.Allow));
+            Directory.CreateDirectory(dir, security);
+            File.WriteAllText(Path.Combine(dir, TokenFile), token, new UTF8Encoding(false));
+            return dir;
+        }
+
+        /// <summary>Writes a small file whole: a temp name first, then moved into place.</summary>
+        private static void WriteWhole(string file, string text)
+        {
+            // The caller's own temp folder: checked for a link right before writing, and only a new file is made there
+            // (never over an existing file or link).
+            string dir = Path.GetDirectoryName(file);
+            if ((File.GetAttributes(dir) & FileAttributes.ReparsePoint) != 0)
+            {
+                throw new IOException("the request folder became a link");
+            }
+            string temp = file + "." + RandomHex(4) + ".tmp";
+            byte[] bytes = new UTF8Encoding(false).GetBytes(text);
+            using (FileStream stream = new FileStream(temp, FileMode.CreateNew, FileAccess.Write, FileShare.None))
+            {
+                stream.Write(bytes, 0, bytes.Length);
+            }
+            File.Move(temp, file);
+        }
+
+        /// <summary>The token the caller relays from our sandbox's daemon (32 hex digits), or null until it is there.</summary>
+        private static string ReadAnswer(string file)
+        {
+            try
+            {
+                FileInfo info = new FileInfo(file);
+                if (!info.Exists || info.Length > 64)
+                {
+                    return null;
+                }
+                string text = File.ReadAllText(file, Encoding.ASCII).Trim();
+                return text.Length > 0 ? text : null;
+            }
+            catch (IOException)
+            {
+                return null; // still being written
+            }
+            catch (UnauthorizedAccessException)
+            {
+                return null;
+            }
+        }
+
+        private static bool FixedTimeEquals(string a, string b)
+        {
+            if (a == null || b == null || a.Length != b.Length)
+            {
+                return false;
+            }
+            int diff = 0;
+            for (int i = 0; i < a.Length; i++)
+            {
+                diff |= a[i] ^ b[i];
+            }
+            return diff == 0;
+        }
+
+        private static bool AddWithCanary(IntPtr system, ShareRequest request, string folder, IntPtr held, string exchange, IDictionary<string, string> values, out string message)
+        {
+            string token = RandomHex(16);
+            string canaryName = "agentsbx-" + RandomHex(8);
+            string canaryDir = null;
+            bool canaryAdded = false;
+            try
+            {
+                canaryDir = MakeCanaryFolder(token);
+                // Removed in finally even when the add fails: an add that timed out may still complete.
+                canaryAdded = true;
+                HcsReply added = Hcs.ModifyOn(system, ShareRequest.Build(true, canaryName, canaryDir, true), OperationMs);
+                if (!added.Ok)
+                {
+                    values["canary"] = "not added";
+                    return Reply(added, "", out message);
+                }
+                WriteWhole(Path.Combine(exchange, CanaryFile), "{\"share\":" + Json.Quote(canaryName) + "}");
+                string answer = null;
+                for (int waited = 0; waited < CanaryWaitMs && answer == null; waited += PollMs)
+                {
+                    Thread.Sleep(PollMs);
+                    answer = ReadAnswer(Path.Combine(exchange, AnswerFile));
+                }
+                if (answer == null || answer == "none")
+                {
+                    values["canary"] = answer == null ? "no answer" : "not read";
+                    message = "The sandbox did not read the test share" + (answer == null ? " in time" : "") + ", so this may not be your sandbox; nothing was shared";
+                    return false;
+                }
+                if (!Token.IsMatch(answer) || !FixedTimeEquals(answer, token))
+                {
+                    values["canary"] = "wrong token";
+                    message = "The test share came back with the wrong token, so this is not your sandbox; nothing was shared";
+                    return false;
+                }
+                values["canary"] = "matched";
+                string add = ShareRequest.Build(true, request.Name, folder, request.ReadOnly);
+                values["request"] = add;
+                HcsReply real = Hcs.ModifyOn(system, add, OperationMs);
+                string moved = real.Ok ? FolderAccess.MovedProblem(held, folder) : null;
+                if (!real.Ok || moved != null)
+                {
+                    // Failed, timed out (it may still complete) or the folder moved: the share is taken away again.
+                    HcsReply undone = Hcs.ModifyOn(system, ShareRequest.Build(false, request.Name, null, true), OperationMs);
+                    values["undone"] = undone.Ok ? "yes" : undone.Message();
+                    if (moved != null)
+                    {
+                        message = "Refused: " + moved;
+                        return false;
+                    }
+                }
+                return Reply(real, "added", out message);
+            }
+            finally
+            {
+                if (canaryAdded)
+                {
+                    HcsReply removed = Hcs.ModifyOn(system, ShareRequest.Build(false, canaryName, null, true), OperationMs);
+                    values["canaryRemoved"] = removed.Ok ? "yes" : removed.Message();
+                }
+                if (canaryDir != null)
+                {
+                    try
+                    {
+                        Directory.Delete(canaryDir, true);
+                    }
+                    catch (IOException)
+                    {
+                        // Still open by the VM: the elevated script deletes the whole work folder afterwards.
+                    }
+                    catch (UnauthorizedAccessException)
+                    {
+                        // The same.
+                    }
+                }
+            }
+        }
+    }
+}

package/native/csharp/HostTools/AssemblyInfo.cs

@@ -8,7 +8,7 @@ using System.Runtime.InteropServices;
 [assembly: AssemblyCompany("windows-development-sandbox (open source)")]
 [assembly: AssemblyProduct("Windows Development Sandbox")]
 [assembly: AssemblyCopyright("MIT License, windows-development-sandbox contributors")]
-[assembly: AssemblyVersion("1.14.0.0")]
-[assembly: AssemblyFileVersion("1.14.0.0")]
-[assembly: AssemblyInformationalVersion("1.14.0")]
+[assembly: AssemblyVersion("1.15.0.0")]
+[assembly: AssemblyFileVersion("1.15.0.0")]
+[assembly: AssemblyInformationalVersion("1.15.0")]
 [assembly: ComVisible(false)]

package/native/csharp/StorageHelper/AssemblyInfo.cs

@@ -9,7 +9,7 @@ using System.Runtime.InteropServices;
 [assembly: AssemblyCompany("windows-development-sandbox (open source)")]
 [assembly: AssemblyProduct("Windows Development Sandbox")]
 [assembly: AssemblyCopyright("MIT License, windows-development-sandbox contributors")]
-[assembly: AssemblyVersion("1.14.0.0")]
-[assembly: AssemblyFileVersion("1.14.0.0")]
-[assembly: AssemblyInformationalVersion("1.14.0")]
+[assembly: AssemblyVersion("1.15.0.0")]
+[assembly: AssemblyFileVersion("1.15.0.0")]
+[assembly: AssemblyInformationalVersion("1.15.0")]
 [assembly: ComVisible(false)]

package/native/scripts/contained-common.ps1

@@ -15,6 +15,10 @@ function Add-Note([string]$Text) {
     $script:Lines.Add($Text)
 }
 
+function Get-Notes {
+    return @($script:Lines)
+}
+
 function Test-PlainAbsolute([string]$Path) {
     if ([string]::IsNullOrWhiteSpace($Path)) { return $false }
     if ($Path -notmatch $script:PathRule) { return $false }

package/native/scripts/hcs-live-share.ps1

@@ -0,0 +1,191 @@
+#Requires -Version 5.1
+# Live folders (opt-in alpha, docs/design/hcs-live-folders.md): adds or removes one folder share on the running Windows
+# Sandbox through HcsHost.exe wsb-share. Run elevated (host/engines/hcs/live-folders.ts starts it through
+# run-elevated.ps1: one Windows permission prompt per add or remove). The request is a JSON file in a private temp
+# folder: { action, id, name, path, readOnly, storageRoot, dataPath, userSid }; its SHA-256 is on the command line, and
+# HcsHost hashes the exact bytes it parses again.
+# Safety, all checked here again: the temp folder is the user's and not a link; HcsHost.exe is compiled here, from the
+# sources next to this script (copied first), into a fresh folder under %ProgramData%\AgentSandboxLiveFolders that only
+# administrators and SYSTEM may use (checked, and repaired when someone else made it, on every run), never taken from
+# the caller; one add or remove at a time (a machine-wide lock). HcsHost does the rest (the caller must be the account
+# that answered the prompt, which compute system, which folder, the canary). Work folders left by an earlier run (a
+# canary the sandbox kept busy) are swept. -DryRun checks the request and prints what it would do, and does nothing
+# else. The result goes to result.json next to the request file.
+param(
+    [Parameter(Mandatory = $true)][string]$Json,
+    [string]$Sha256 = '',
+    [switch]$DryRun
+)
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 2.0
+. (Join-Path $PSScriptRoot 'contained-common.ps1')
+
+$result = @{ ok = $false; message = ''; id = ''; canary = '' }
+$AdminSids = @('S-1-5-18', 'S-1-5-32-544')
+
+function Assert-LiveRequest($Req) {
+    foreach ($name in @('action', 'name', 'userSid')) {
+        if (-not ($Req.PSObject.Properties.Name -contains $name) -or -not $Req.$name) { throw "The request has no $name." }
+    }
+    if (@('add', 'remove') -notcontains [string]$Req.action) { throw 'The action must be add or remove.' }
+    if ([string]$Req.name -cnotmatch '^agentsbx-[0-9a-f]{8,32}$') { throw "Not one of this tool's share names: $($Req.name)" }
+    if ([string]$Req.userSid -notmatch '^S-1-[0-9-]{3,120}$') { throw 'The request has no valid user.' }
+    if ($Req.PSObject.Properties.Name -contains 'id' -and $Req.id -and ([string]$Req.id -notmatch '^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$')) {
+        throw 'The sandbox id must be a GUID.'
+    }
+    if ($Req.action -eq 'remove' -and -not $Req.id) { throw 'A remove needs the id of the sandbox the folder was added to.' }
+    if ($Req.action -eq 'add') {
+        if (-not ($Req.PSObject.Properties.Name -contains 'path') -or -not (Test-PlainAbsolute $Req.path)) { throw 'The request has no plain full path to share.' }
+        if (-not ($Req.PSObject.Properties.Name -contains 'readOnly') -or -not ($Req.readOnly -is [bool])) { throw 'readOnly must be true or false.' }
+        foreach ($name in @('storageRoot', 'dataPath')) {
+            if (-not ($Req.PSObject.Properties.Name -contains $name) -or -not (Test-PlainAbsolute $Req.$name)) { throw "The request has no plain full $name." }
+        }
+    }
+}
+
+# The request's own folder: a private temp folder of the user who asked, not a link.
+function Assert-PrivateTemp($Req, [string]$Dir) {
+    if (Test-ReparsePoint $Dir) { throw "Refusing a link: $Dir" }
+    $acl = Get-Acl -LiteralPath $Dir
+    $owner = $acl.GetOwner([Security.Principal.SecurityIdentifier]).Value
+    if (@($Req.userSid, 'S-1-5-32-544') -notcontains $owner) { throw "The request folder is not yours (owner $owner)." }
+    foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+        if ($rule.AccessControlType -ne 'Allow') { continue }
+        if (@('S-1-1-0', 'S-1-5-11', 'S-1-5-32-545') -contains $rule.IdentityReference.Value) { throw 'The request folder is open to other users.' }
+    }
+}
+
+function New-AdminSecurity {
+    $acl = New-Object Security.AccessControl.DirectorySecurity
+    $acl.SetOwner((New-Object Security.Principal.SecurityIdentifier('S-1-5-32-544')))
+    $acl.SetAccessRuleProtection($true, $false)
+    $inherit = [Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+    foreach ($sid in $AdminSids) {
+        $who = New-Object Security.Principal.SecurityIdentifier($sid)
+        $acl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($who, 'FullControl', $inherit, 'None', 'Allow')))
+    }
+    return $acl
+}
+
+function Test-AdminOnly([string]$Path) {
+    $acl = Get-Acl -LiteralPath $Path
+    if ($AdminSids -notcontains $acl.GetOwner([Security.Principal.SecurityIdentifier]).Value) { return $false }
+    if (-not $acl.AreAccessRulesProtected) { return $false }
+    foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+        if ($rule.AccessControlType -eq 'Allow' -and $AdminSids -notcontains $rule.IdentityReference.Value) { return $false }
+    }
+    return $true
+}
+
+# %ProgramData%\AgentSandboxLiveFolders: made with an administrator-only DACL. One that someone else made first (any
+# user may create folders in ProgramData) is taken over: owner Administrators and the DACL written whole; its old
+# content stays, unused (each run works in a new random folder made with its own DACL).
+function Get-AdminParent {
+    $base = [Environment]::GetFolderPath('CommonApplicationData')
+    if (-not $base -or (Test-ReparsePoint $base)) { throw "ProgramData is missing or a link: $base" }
+    $parent = Join-Path $base 'AgentSandboxLiveFolders'
+    if (-not (Test-Path -LiteralPath $parent)) {
+        [void][IO.Directory]::CreateDirectory($parent, (New-AdminSecurity))
+    }
+    if (Test-ReparsePoint $parent) { throw "Refusing a link: $parent" }
+    if (-not (Test-AdminOnly $parent)) {
+        Add-Note "taking over $parent (someone else made it or may use it)"
+        Set-Acl -LiteralPath $parent -AclObject (New-AdminSecurity)
+        if ((Test-ReparsePoint $parent) -or -not (Test-AdminOnly $parent)) { throw "$parent could not be made administrator-only." }
+    }
+    # Work folders an earlier run could not delete (the sandbox kept its canary busy): gone after an hour.
+    foreach ($old in @(Get-ChildItem -LiteralPath $parent -Force -Directory -ErrorAction SilentlyContinue)) {
+        if ($old.Name -match '^[0-9a-f]{32}$' -and -not ($old.Attributes -band [IO.FileAttributes]::ReparsePoint) -and $old.CreationTimeUtc -lt [DateTime]::UtcNow.AddHours(-1)) {
+            Remove-Item -LiteralPath $old.FullName -Recurse -Force -ErrorAction SilentlyContinue
+        }
+    }
+    return $parent
+}
+
+# HcsHost.exe built here from this package's sources (copied into the admin-only work folder first), with the
+# compiler that ships with Windows: nothing the caller names is ever run elevated.
+function Build-HcsHost([string]$Work) {
+    $sources = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..\csharp\HcsHost'))
+    if (-not (Test-Path -LiteralPath $sources -PathType Container) -or (Test-ReparsePoint $sources)) { throw "The HcsHost sources are missing or a link: $sources" }
+    $copy = Join-Path $Work 'src'
+    [void][IO.Directory]::CreateDirectory($copy)
+    foreach ($file in @(Get-ChildItem -LiteralPath $sources -Filter '*.cs' -File)) {
+        if ($file.Attributes -band [IO.FileAttributes]::ReparsePoint) { throw "Refusing a link: $($file.FullName)" }
+        [IO.File]::Copy($file.FullName, (Join-Path $copy $file.Name), $false)
+    }
+    $csc = Join-Path ([Environment]::GetFolderPath('Windows')) 'Microsoft.NET\Framework64\v4.0.30319\csc.exe'
+    $exe = Join-Path $Work 'HcsHost.exe'
+    $files = @(Get-ChildItem -LiteralPath $copy -Filter '*.cs' -File | ForEach-Object { $_.FullName })
+    if ($files.Count -eq 0) { throw 'No HcsHost sources were found.' }
+    & $csc '/nologo' '/optimize' '/target:exe' '/r:System.Web.Extensions.dll' ('/out:' + $exe) @files | Out-Null
+    if (-not (Test-Path -LiteralPath $exe -PathType Leaf)) { throw 'HcsHost.exe could not be built (the .NET Framework compiler that ships with Windows is needed).' }
+    return $exe
+}
+
+function Invoke-Live($Req, [string]$JsonPath, [string]$Checksum) {
+    $parent = Get-AdminParent
+    $work = Join-Path $parent ([Guid]::NewGuid().ToString('N'))
+    if (Test-Path -LiteralPath $work) { throw "The work folder exists already: $work" }
+    [void][IO.Directory]::CreateDirectory($work, (New-AdminSecurity))
+    try {
+        $exe = Build-HcsHost $work
+        $out = Join-Path $work 'reply.json'
+        & $exe 'wsb-share' $JsonPath '--sha256' $Checksum '--out' $out | Out-Null
+        if (-not (Test-Path -LiteralPath $out)) { throw 'HcsHost.exe gave no answer.' }
+        $bytes = [IO.File]::ReadAllBytes($out)
+        if ($bytes.Length -gt 65536) { throw 'HcsHost.exe answered with too much text.' }
+        $reply = [Text.Encoding]::UTF8.GetString($bytes) | ConvertFrom-Json
+        $script:result.ok = [bool]$reply.ok
+        $script:result.message = [string]$reply.message
+        $names = @($reply.values.PSObject.Properties | ForEach-Object { $_.Name })
+        if ($names -contains 'id') { $script:result.id = [string]$reply.values.id }
+        if ($names -contains 'canary') { $script:result.canary = [string]$reply.values.canary }
+    } finally {
+        if (-not (Test-ReparsePoint $work)) { Remove-Item -LiteralPath $work -Recurse -Force -ErrorAction SilentlyContinue }
+    }
+}
+
+# result.json in the caller's folder: checked for a link right before, and only made as a new file.
+function Write-LiveResult([hashtable]$Result, [string]$JsonPath) {
+    $Result.notes = @(Get-Notes)
+    $dir = Split-Path -Parent $JsonPath
+    if (Test-ReparsePoint $dir) { return }
+    $bytes = (New-Object Text.UTF8Encoding($false)).GetBytes(($Result | ConvertTo-Json -Compress))
+    $stream = New-Object IO.FileStream((Join-Path $dir 'result.json'), [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)
+    try { $stream.Write($bytes, 0, $bytes.Length) } finally { $stream.Dispose() }
+}
+
+$mutex = $null
+$owned = $false
+try {
+    $request = Read-ContainedRequest -JsonPath $Json -Sha256 $Sha256 -Dry $DryRun.IsPresent
+    Assert-LiveRequest $request
+    if ($DryRun) {
+        Add-Note ("would {0} the share {1}{2} on the running Windows Sandbox{3}" -f $request.action, $request.name, $(if ($request.action -eq 'add') { ' (' + $request.path + ', ' + $(if ($request.readOnly) { 'read-only' } else { 'writable' }) + ')' } else { '' }), $(if ($request.id) { ' ' + $request.id } else { '' }))
+        $result.ok = $true
+        $result.message = 'checked'
+    } else {
+        if (-not (Test-IsAdministrator)) { throw 'Adding a folder to the running sandbox needs administrator rights.' }
+        Assert-PrivateTemp $request (Split-Path -Parent $Json)
+        $mutex = New-Object System.Threading.Mutex($false, 'Global\AgentSandboxLiveFolders')
+        try { $owned = $mutex.WaitOne(120000) } catch [System.Threading.AbandonedMutexException] { $owned = $true }
+        if (-not $owned) { throw 'Another live folder is being added or removed (maybe by another user of this PC). Try again in a few minutes.' }
+        Invoke-Live $request $Json $Sha256
+    }
+} catch {
+    $result.ok = $false
+    $result.message = $_.Exception.Message
+} finally {
+    if ($mutex) {
+        if ($owned) { $mutex.ReleaseMutex() }
+        $mutex.Dispose()
+    }
+}
+if ($DryRun) {
+    Write-ContainedResult $result $Json $true
+} else {
+    try { Write-LiveResult $result $Json } catch { [Console]::Error.WriteLine('The result could not be written: ' + $_.Exception.Message) }
+}
+if ($result.ok) { exit 0 }
+if ($DryRun) { [Console]::Error.WriteLine($result.message) }
+exit 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "windows-development-sandbox",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "description": "A disposable Windows Sandbox for development, with or without an AI agent (Claude Code, Codex, Gemini, opencode, ...): the folder you run it from is the workspace, toolchains and databases for your project install themselves, and nothing else on your PC is reachable.",
   "type": "module",
   "license": "MIT",