3 Commits

Include renames

Author	SHA1	Message	Date
OrcaWinandOrca Worker	4559c250b3	fix(windows): restrict secure files in-process instead of spawning icacls (#28135) ... * fix(windows): restrict secure files in-process instead of spawning icacls Every secure write on Windows spawned icacls.exe five times on the calling thread (the Electron main thread for most stores): verify, /reset, /inheritance:r /grant:r, verify, verify. Process creation under endpoint security costs ~0.6 s each, so each write froze the UI for seconds (#26027). The /reset + /inheritance:r pair is also what behavioural EDR scores as ransomware tradecraft (#25583). Add native/windows-security (@orca/windows-security): a small N-API addon over advapi32 that reads and writes DACLs in-process. It exposes the token user SID, a DACL read as SDDL, a DACL write (sync and on the thread pool), a create-with-DACL file write, and an additive grant. Policy and verification stay in TypeScript. - writeSecureFile creates each temp file already carrying the protected user/SYSTEM/Administrators DACL (CreateFileW + SECURITY_ATTRIBUTES), reads it back once, and renames it. No ACL is modified on the write path and no process starts. Before: 5-7 spawns, 94-138 ms per write. After: 0 spawns, ~0.5 ms. - A secure directory is verified once per process. It is rewritten only when verification fails, on the thread pool, because the write walks every descendant (~2 s on a 29k-entry userData). - The verifier follows OpenSSH's rule: only the user, SYSTEM and Administrators may be granted anything, and the path must be protected (or, for a file, inherit from a secure parent). DACLs written by the icacls-era hardening pass unchanged, so there is no migration. - If the addon cannot load, the write still happens and reports unrestricted, logged once. There is no icacls or PowerShell fallback. - grantDirAcl, the startup userData grant, and the install-dir probe and package repair use the same addon, so whoami.exe and icacls.exe are no longer spawned anywhere at runtime. - orcad's Windows slots ship the addon beside their bundles (built per arch, PE-machine checked). Its data-root privacy check fails closed, so without the addon a Windows orcad would not start. Fixes #26027 Fixes #25583 * refactor(secure-file): harden existing Windows files through the sync lane The read path called restrictWindowsPathSync directly and recorded success itself; the existing sync lane already does both. One call site fewer. * refactor(windows-security): one load, one rule, no fallthrough (review #28135) - The descriptor parser is anchored, so a conditional ACE (its body holds parentheses) or anything else it cannot read fails closed instead of verifying the ACEs before it. - findSecureDaclViolation is one flat rule: protected, allow rules only for the user, SYSTEM and Administrators (OpenSSH's ACE rule), and full control for the user. The inherits-from-a-secure-parent exception is gone: it accepted exactly what loosening the parent reaches. - The addon and the user SID load once, behind one wrapper that adds the extended-length prefix to every path and runs async DACL writes to one path in order, so a startup grant cannot land after a re-lock and restore the broader DACL. - With the addon loaded, a failed born-restricted create throws with the matching Node error code instead of falling back to a plain write. - A grant leaves a NULL DACL untouched instead of turning 'everyone' into 'only this SID'. WriteFile runs once and fails on a short write. - The artifact create-intent store writes through writeSecureFile and drops its own temp writer, directory LRU and synchronous directory re-lock. - Test seams the global fake makes redundant are gone. * fix(packaging): fail a Windows build whose workspace addon binary is missing or foreign-arch The @orca/windows-* workspace links exist on every host, so their presence proved nothing: a missing or wrong-architecture .node only surfaced at runtime, as unrestricted secure files or an orcad that refuses to start. beforePack now reads each addon's PE machine against the target arch. * refactor(windows-security): prune what the native ACL left dead (review #28135) - Sync-spawn ratchet: hardenSecurePath and the sync-flag exemption it alone used are gone, and the advice and baseline header no longer say secure writers run icacls. - The install-dir probe reads ACEs through parseSddlDacl, so an ACE it cannot parse fails the whole reading closed instead of being skipped; AC is a resolved alias there now. - The packaging check reads the addon binary through node_modules, the copy that ships. - No winCode-to-errno table: nothing reads .code off a failed secure write. - The load memo is not mutated; secure-path keeps its own log-once flag. - grantInstallDirPackageAcl is a plain function, and secure-file restricts a Windows directory and a POSIX path directly instead of through one two-platform helper. * fix(windows-security): resolve LA in real-ACL tests; tear a file whose close fails - The GitHub Windows runner is the built-in Administrator (RID 500), whose SID reads back as LA. Production already resolves it through localDomainSidOf; the win32 test helpers parsed without it. One shared readDaclOf resolves aliases for every real-ACL suite, and the verifier's unit test covers an LA-aliased directory and LA as a stranger. - createFileWithDacl treats a failed CloseHandle like a failed write (lost data on a network volume) and deletes the torn file. - Drop a duplicate test reset and a typo. * fix(windows-security): load only from inside the app; read DACLs as structure (review #28135) - Loader: orcad's staged binary first, then the workspace package only if its real path is inside the app (process.resourcesPath, or this checkout). A bare specifier otherwise walks every parent up to C:\node_modules, which any local user may create, and orcad holds credentials. - The addon reads a DACL as { protected, aces: [{ type, flags, mask, sid }] } via GetAce, with a SID only for plain allow/deny ACEs and null for a NULL DACL. findSecureDaclViolation and the install-dir probe check that structure, so conditional, callback and object ACEs fail closed. The SDDL parser, its alias table, LA/localDomainSid resolution and getDaclSddl are gone; SDDL is only the write format. - Install-dir tree pass: files flagless as before, but a directory only when its own DACL is protected (inheritably). Re-granting inheriting directories re-propagated each subtree (3.2 s for 1,093 directories). The root is no longer granted, or counted, twice. The two passes are plain functions behind a { root, tree } seam. - One namespacing (path.win32.toNamespacedPath) at the addon boundary, also the per-path ordering key; the comment states the real sync-grant invariant. - restrictWindowsDirectory(dir): Promise<boolean> replaces the callback lane; the reporter is guarded once, so the 'settle' stage is gone. - Sync-spawn ratchet: the secure writers no longer spawn or block, so they leave the gate (109 -> 61 uses). - Errors name the Win32 call and code only; a failed GetSecurityDescriptorControl fails the write instead of defaulting to unprotected. * test(secure-file): assert the durable POSIX write's outcome, not the old chmod order writeSecureFile now chmods the temp file to 0o600 before fsyncing it, so the fsync also covers the mode change and the file is owner-writable when opened. Assert what matters under umask 0o200: the write succeeds, the temp file is fsynced read-only, and the published file is exactly 0o600. * fix(windows-security): namespace paths with the host's toNamespacedPath path.win32.toNamespacedPath rewrote POSIX temp paths (/tmp/x -> \tmp\x) in the Linux runs of the Windows-logic unit tests, so the fake addon wrote to the wrong place. The addon only runs on Windows, where the host function is the win32 one; elsewhere it is the identity. The long-path assertion runs on Windows only. * test(windows-security): assert the install-dir long-path prefix on Windows only The prefix comes from the host's toNamespacedPath, which is the identity off Windows; the Linux run of this suite expected the win32 escape. * fix(windows-user-data-acl): grant the root even when its children cannot be listed (review #28135) A readdir failure on userData aborted the whole grant, so the root grant that could repair a DACL refusing the listing was never attempted. The listing failure is now recorded, the root is still granted, and the marker stays withheld so the next launch retries. * test(windows-security): wait for relock propagation, accept Entra ID SIDs (review #28135) - The large-relock test waited only for the parent to turn protected, which happens before propagation reaches the children, then read a child. It now waits on the parent and both ends of the child range. - The token-user test rejected S-1-12-1 (Entra ID) accounts, failing the suite on Entra-joined dev machines. --------- Co-authored-by: Orca Worker <orca-worker@localhost>	2026-10-13 01:56:55 -07:00
Neil	c8996d76a5	Speed up daemon smoke checks and keep compiler slots busy (#28106) ... * Remove repeated daemon smoke builds and idle compiler slots * Test compiler scheduling through its process interface * Keep preview component below the existing line limit with a type-only split	2026-10-12 17:20:19 -07:00
Brennan Benson	fa4ef2b961	ci: stop new main-process code from freezing Orca with synchronous launches (#27756) ... * ci: ratchet synchronous child-process launches in main and shared code The Electron main process freezes every window while a synchronous child process runs, and on Windows each launch is slow because antivirus scans it. Nothing stopped new synchronous launches from landing in main-process code, and the spawn observer behind ORCA_MAIN_THREAD_DIAGNOSTICS only saw async spawns, so the worst blocks were invisible to it. Ratchet: check:main-sync-spawn-ratchet parses production src/main and src/shared files (test-only paths excluded) and fails when a file not in config/main-sync-spawn-baseline.txt reaches execFileSync, spawnSync or execSync from child_process, runProcessSync from @orca/process-host, or one of the synchronous secure-file writers (they run icacls on Windows). Named, aliased, namespace, default, require() and import() forms count. A baseline entry whose file no longer launches synchronously fails as stale, so the list can only shrink. It runs in lint and in the PR static-analysis job next to the process-host import check. Observer: runProcessSync now reports to the spawn observer, timing the whole call (that is how long the thread was stuck) and reporting from a finally so failing, throwing and timed-out children are counted too. Runtime behavior is unchanged except that the diagnostics observer now sees synchronous launches; with no observer registered the sync path pays one extra branch. * ci: count sync launches per file and gate the repo's sync wrappers The sync-spawn ratchet only tracked which files launched synchronously, so a file already on the list (wsl.ts, win32-utils.ts, git-exec-file.ts) could add more launches unnoticed, and new callers of the repo's own synchronous wrappers passed CI. The baseline now stores a per-file count of uses, in the same format as the focus-read ratchet: a rise or a new file fails, a lower or zero count fails until `pnpm check:main-sync-spawn-ratchet --prune` lowers it, and --prune never raises an entry. Every value reference to a gated function counts (call, hand-off, alias and its uses, re-export); imports alone count nothing. Gated wrappers: gitExecFileSync (and the git/runner re-export), restrictWindowsPathSync, hardenSecurePath when called with sync: true, grantDirAcl, getWslHome, listWslDistros, wslUncDirectoryExists, isWslAvailable (and the wsl.ts re-export), isPwshAvailable. Their 18 current caller files join the baseline. Failure messages now give advice per family: the async process-host API for child-process launches, the async twin for wrappers, and for the secure writers a note that no async secure writer exists yet, so the sync one stays and must never become a plain write (that drops the Windows ACL hardening). Also refresh two stale blockMs descriptions and drop a no-op line from the spawn-observer "stays silent" test. * ci: count hardenSecurePath unless visibly async, and tighten ratchet tests hardenSecurePath was counted only when `{ sync: true }` was written inline, so moving the options into a variable or a spread dropped the count and the check then asked for a prune. It now counts every use except a call with no options or a spread-free object literal whose `sync` is absent or false. Also: resolve backslash paths in the importing file as well as the specifier; still visit heritage and instantiation expressions (`extends mixin(fn)`, `fn<T>`); state the reference-only counting limit; and point the secure-writer advice at raising this file's baseline count. Tests cover the hardenSecurePath shapes, the alias chains that need the fixpoint loop, and a prune that must not raise a grown row. * test(ci): pin the main sync-spawn ratchet background step * fix: count secure hardening calls with spread arguments	2026-10-12 11:28:25 -07:00