workbite 0.1.18 → 0.1.20

package/lib/private-state.js

@@ -1,116 +1,116 @@
-'use strict';
-// Private Windows state for the v2 execution UI: the native TUI intent directory and the
-// deploy journal must be owned by the current user and grant mutating access only to that
-// user, SYSTEM and Administrators (the Work Stack TUI's private-parent check), but a folder
-// created under %LOCALAPPDATA% inherits whatever its parents grant (sandbox groups included).
-// One bounded Windows PowerShell child replaces exactly the named directories' DACLs with a
-// protected private one; owner, contents and file identities are kept. Linux keeps 0700.
-const path = require('node:path');
-const { execFile } = require('node:child_process');
-const { fail } = require('./common');
-
-const RESULT_SCHEMA = 'workbite.private-directories.v1';
-const MAXIMUM = 8;
-// Constant script, no interpolation: paths arrive only as WORKBITE_PRIVATE_DIRECTORY_<n>.
-// .NET types only (no cmdlets), so a foreign PSModulePath cannot change what runs.
-const SCRIPT = String.raw`
-$ErrorActionPreference = 'Stop'
-$ProgressPreference = 'SilentlyContinue'
-try {
-  $count = [int]$env:WORKBITE_PRIVATE_DIRECTORY_COUNT
-  if ($count -lt 1 -or $count -gt ${MAXIMUM}) { throw 'invalid directory count' }
-  $me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
-  $allowed = @($me.Value, 'S-1-5-18', 'S-1-5-32-544')
-  $sid = [System.Security.Principal.SecurityIdentifier]
-  $sections = [System.Security.AccessControl.AccessControlSections]'Access, Owner'
-  $results = @()
-  for ($index = 0; $index -lt $count; $index++) {
-    $target = [Environment]::GetEnvironmentVariable('WORKBITE_PRIVATE_DIRECTORY_' + $index)
-    if (-not $target -or -not [System.IO.Path]::IsPathRooted($target)) { throw ('directory ' + $index + ' is not an absolute path') }
-    $info = [System.IO.DirectoryInfo]::new($target)
-    $info.Refresh()
-    if (-not $info.Exists) { throw ('directory ' + $index + ' is missing or not a directory') }
-    if (($info.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw ('directory ' + $index + ' is a link or reparse point') }
-    $current = $info.GetAccessControl($sections)
-    if ($current.GetOwner($sid).Value -ne $me.Value) { throw ('directory ' + $index + ' is not owned by the current Windows user') }
-    $rules = @($current.GetAccessRules($true, $true, $sid))
-    $private = $current.AreAccessRulesProtected -and $rules.Count -gt 0
-    $mine = $false
-    foreach ($rule in $rules) {
-      if ($rule.IsInherited -or $rule.AccessControlType -ne 'Allow' -or $allowed -notcontains $rule.IdentityReference.Value) { $private = $false }
-      if ($rule.IdentityReference.Value -eq $me.Value -and ($rule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -eq [System.Security.AccessControl.FileSystemRights]::FullControl) { $mine = $true }
-    }
-    if ($private -and $mine) { $results += 'kept'; continue }
-    $security = [System.Security.AccessControl.DirectorySecurity]::new()
-    $security.SetAccessRuleProtection($true, $false)
-    foreach ($principal in $allowed) {
-      $security.AddAccessRule([System.Security.AccessControl.FileSystemAccessRule]::new($sid::new($principal),
-        [System.Security.AccessControl.FileSystemRights]::FullControl,
-        [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit',
-        [System.Security.AccessControl.PropagationFlags]::None, [System.Security.AccessControl.AccessControlType]::Allow))
-    }
-    # Only the DACL section is written; the owner is left as verified above.
-    $info.SetAccessControl($security)
-    $info.Refresh()
-    if (($info.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw ('directory ' + $index + ' changed while protecting it') }
-    $after = $info.GetAccessControl($sections)
-    if ($after.GetOwner($sid).Value -ne $me.Value -or -not $after.AreAccessRulesProtected) { throw ('directory ' + $index + ' did not keep a protected private DACL') }
-    foreach ($rule in @($after.GetAccessRules($true, $true, $sid))) {
-      if ($rule.IsInherited -or $rule.AccessControlType -ne 'Allow' -or $allowed -notcontains $rule.IdentityReference.Value) { throw ('directory ' + $index + ' still grants another principal access') }
-    }
-    $results += 'protected'
-  }
-  [Console]::Out.Write('{"schema":"${RESULT_SCHEMA}","results":["' + ($results -join '","') + '"]}')
-  exit 0
-} catch {
-  $message = ($_.Exception.Message -replace '[\x00-\x1f\x7f]', ' ')
-  if ($message.Length -gt 300) { $message = $message.Substring(0, 300) }
-  [Console]::Error.Write($message)
-  exit 3
-}
-`;
-const ENCODED = Buffer.from(SCRIPT, 'utf16le').toString('base64');
-
-function windowsPowerShell(environment) {
-  const root = environment.SystemRoot || environment.SYSTEMROOT || environment.windir || 'C:\\Windows';
-  if (!/^[A-Za-z]:\\[^\x00-\x1f"*?<>|]*$/.test(root)) fail('Cannot locate Windows PowerShell: SystemRoot is not an absolute local path.');
-  return path.win32.join(root, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
-}
-const bounded = text => String(text || '').replace(/[\x00-\x1f\x7f]/g, ' ').trim().slice(0, 300);
-
-// Windows only: each directory must already exist (created by safeDirectory). Returns 'kept'
-// or 'protected' per directory; anything else refuses and nothing that uses them is started.
-// No-op elsewhere: Linux directories are created 0700 and checked by the native TUI itself.
-async function protectPrivateDirectories(directories, { platform = process.platform, environment = process.env,
-  execImpl = execFile, timeout = 60000 } = {}) {
-  if (platform !== 'win32') return null;
-  if (!Array.isArray(directories) || !directories.length || directories.length > MAXIMUM
-      || directories.some(value => typeof value !== 'string' || !path.win32.isAbsolute(value) || /^[\\/]{2}|[\x00-\x1f]/.test(value))) {
-    fail('WorkBite private state directories must be absolute local paths.');
-  }
-  const childEnvironment = {};
-  for (const [key, value] of Object.entries(environment)) {
-    // Windows PowerShell must not load another PowerShell's modules; earlier helper values are replaced.
-    if (value !== undefined && key.toUpperCase() !== 'PSMODULEPATH' && !/^WORKBITE_PRIVATE_DIRECTORY_/i.test(key)) childEnvironment[key] = value;
-  }
-  childEnvironment.WORKBITE_PRIVATE_DIRECTORY_COUNT = String(directories.length);
-  directories.forEach((value, index) => { childEnvironment[`WORKBITE_PRIVATE_DIRECTORY_${index}`] = path.win32.resolve(value); });
-  const file = windowsPowerShell(environment);
-  const result = await new Promise(resolve => {
-    execImpl(file, ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', ENCODED],
-      { env: childEnvironment, shell: false, windowsHide: true, timeout, maxBuffer: 64 * 1024, encoding: 'utf8' },
-      (error, stdout, stderr) => resolve({ error, stdout: stdout || '', stderr: stderr || '' }));
-  });
-  let record = null;
-  try { record = JSON.parse(result.stdout.trim()); } catch { record = null; }
-  if (result.error || record === null || typeof record !== 'object' || Array.isArray(record)
-      || Object.keys(record).length !== 2 || record.schema !== RESULT_SCHEMA || !Array.isArray(record.results)
-      || record.results.length !== directories.length || record.results.some(value => value !== 'kept' && value !== 'protected')) {
-    fail(`WorkBite could not make its private execution state private (${bounded(result.stderr) || 'no result'}); `
-      + `nothing that uses ${directories.join(', ')} was started. Each must be a real directory owned by the current `
-      + 'Windows user; WorkBite does not take ownership or follow links.');
-  }
-  return record.results;
-}
-
-module.exports = { protectPrivateDirectories, RESULT_SCHEMA };
+'use strict';
+// Private Windows state for the v2 execution UI: the native TUI intent directory and the
+// deploy journal must be owned by the current user and grant mutating access only to that
+// user, SYSTEM and Administrators (the Work Stack TUI's private-parent check), but a folder
+// created under %LOCALAPPDATA% inherits whatever its parents grant (sandbox groups included).
+// One bounded Windows PowerShell child replaces exactly the named directories' DACLs with a
+// protected private one; owner, contents and file identities are kept. Linux keeps 0700.
+const path = require('node:path');
+const { execFile } = require('node:child_process');
+const { fail } = require('./common');
+
+const RESULT_SCHEMA = 'workbite.private-directories.v1';
+const MAXIMUM = 8;
+// Constant script, no interpolation: paths arrive only as WORKBITE_PRIVATE_DIRECTORY_<n>.
+// .NET types only (no cmdlets), so a foreign PSModulePath cannot change what runs.
+const SCRIPT = String.raw`
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+try {
+  $count = [int]$env:WORKBITE_PRIVATE_DIRECTORY_COUNT
+  if ($count -lt 1 -or $count -gt ${MAXIMUM}) { throw 'invalid directory count' }
+  $me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+  $allowed = @($me.Value, 'S-1-5-18', 'S-1-5-32-544')
+  $sid = [System.Security.Principal.SecurityIdentifier]
+  $sections = [System.Security.AccessControl.AccessControlSections]'Access, Owner'
+  $results = @()
+  for ($index = 0; $index -lt $count; $index++) {
+    $target = [Environment]::GetEnvironmentVariable('WORKBITE_PRIVATE_DIRECTORY_' + $index)
+    if (-not $target -or -not [System.IO.Path]::IsPathRooted($target)) { throw ('directory ' + $index + ' is not an absolute path') }
+    $info = [System.IO.DirectoryInfo]::new($target)
+    $info.Refresh()
+    if (-not $info.Exists) { throw ('directory ' + $index + ' is missing or not a directory') }
+    if (($info.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw ('directory ' + $index + ' is a link or reparse point') }
+    $current = $info.GetAccessControl($sections)
+    if ($current.GetOwner($sid).Value -ne $me.Value) { throw ('directory ' + $index + ' is not owned by the current Windows user') }
+    $rules = @($current.GetAccessRules($true, $true, $sid))
+    $private = $current.AreAccessRulesProtected -and $rules.Count -gt 0
+    $mine = $false
+    foreach ($rule in $rules) {
+      if ($rule.IsInherited -or $rule.AccessControlType -ne 'Allow' -or $allowed -notcontains $rule.IdentityReference.Value) { $private = $false }
+      if ($rule.IdentityReference.Value -eq $me.Value -and ($rule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -eq [System.Security.AccessControl.FileSystemRights]::FullControl) { $mine = $true }
+    }
+    if ($private -and $mine) { $results += 'kept'; continue }
+    $security = [System.Security.AccessControl.DirectorySecurity]::new()
+    $security.SetAccessRuleProtection($true, $false)
+    foreach ($principal in $allowed) {
+      $security.AddAccessRule([System.Security.AccessControl.FileSystemAccessRule]::new($sid::new($principal),
+        [System.Security.AccessControl.FileSystemRights]::FullControl,
+        [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit',
+        [System.Security.AccessControl.PropagationFlags]::None, [System.Security.AccessControl.AccessControlType]::Allow))
+    }
+    # Only the DACL section is written; the owner is left as verified above.
+    $info.SetAccessControl($security)
+    $info.Refresh()
+    if (($info.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw ('directory ' + $index + ' changed while protecting it') }
+    $after = $info.GetAccessControl($sections)
+    if ($after.GetOwner($sid).Value -ne $me.Value -or -not $after.AreAccessRulesProtected) { throw ('directory ' + $index + ' did not keep a protected private DACL') }
+    foreach ($rule in @($after.GetAccessRules($true, $true, $sid))) {
+      if ($rule.IsInherited -or $rule.AccessControlType -ne 'Allow' -or $allowed -notcontains $rule.IdentityReference.Value) { throw ('directory ' + $index + ' still grants another principal access') }
+    }
+    $results += 'protected'
+  }
+  [Console]::Out.Write('{"schema":"${RESULT_SCHEMA}","results":["' + ($results -join '","') + '"]}')
+  exit 0
+} catch {
+  $message = ($_.Exception.Message -replace '[\x00-\x1f\x7f]', ' ')
+  if ($message.Length -gt 300) { $message = $message.Substring(0, 300) }
+  [Console]::Error.Write($message)
+  exit 3
+}
+`;
+const ENCODED = Buffer.from(SCRIPT, 'utf16le').toString('base64');
+
+function windowsPowerShell(environment) {
+  const root = environment.SystemRoot || environment.SYSTEMROOT || environment.windir || 'C:\\Windows';
+  if (!/^[A-Za-z]:\\[^\x00-\x1f"*?<>|]*$/.test(root)) fail('Cannot locate Windows PowerShell: SystemRoot is not an absolute local path.');
+  return path.win32.join(root, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+}
+const bounded = text => String(text || '').replace(/[\x00-\x1f\x7f]/g, ' ').trim().slice(0, 300);
+
+// Windows only: each directory must already exist (created by safeDirectory). Returns 'kept'
+// or 'protected' per directory; anything else refuses and nothing that uses them is started.
+// No-op elsewhere: Linux directories are created 0700 and checked by the native TUI itself.
+async function protectPrivateDirectories(directories, { platform = process.platform, environment = process.env,
+  execImpl = execFile, timeout = 60000 } = {}) {
+  if (platform !== 'win32') return null;
+  if (!Array.isArray(directories) || !directories.length || directories.length > MAXIMUM
+      || directories.some(value => typeof value !== 'string' || !path.win32.isAbsolute(value) || /^[\\/]{2}|[\x00-\x1f]/.test(value))) {
+    fail('WorkBite private state directories must be absolute local paths.');
+  }
+  const childEnvironment = {};
+  for (const [key, value] of Object.entries(environment)) {
+    // Windows PowerShell must not load another PowerShell's modules; earlier helper values are replaced.
+    if (value !== undefined && key.toUpperCase() !== 'PSMODULEPATH' && !/^WORKBITE_PRIVATE_DIRECTORY_/i.test(key)) childEnvironment[key] = value;
+  }
+  childEnvironment.WORKBITE_PRIVATE_DIRECTORY_COUNT = String(directories.length);
+  directories.forEach((value, index) => { childEnvironment[`WORKBITE_PRIVATE_DIRECTORY_${index}`] = path.win32.resolve(value); });
+  const file = windowsPowerShell(environment);
+  const result = await new Promise(resolve => {
+    execImpl(file, ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', ENCODED],
+      { env: childEnvironment, shell: false, windowsHide: true, timeout, maxBuffer: 64 * 1024, encoding: 'utf8' },
+      (error, stdout, stderr) => resolve({ error, stdout: stdout || '', stderr: stderr || '' }));
+  });
+  let record = null;
+  try { record = JSON.parse(result.stdout.trim()); } catch { record = null; }
+  if (result.error || record === null || typeof record !== 'object' || Array.isArray(record)
+      || Object.keys(record).length !== 2 || record.schema !== RESULT_SCHEMA || !Array.isArray(record.results)
+      || record.results.length !== directories.length || record.results.some(value => value !== 'kept' && value !== 'protected')) {
+    fail(`WorkBite could not make its private execution state private (${bounded(result.stderr) || 'no result'}); `
+      + `nothing that uses ${directories.join(', ')} was started. Each must be a real directory owned by the current `
+      + 'Windows user; WorkBite does not take ownership or follow links.');
+  }
+  return record.results;
+}
+
+module.exports = { protectPrivateDirectories, RESULT_SCHEMA };