mirror of
https://github.com/stablyai/orca.git
synced 2026-11-02 10:08:13 +00:00
Neil
9f62a4fa2d
* fix(windows): start the WSL holder with only a NUL handle to inherit libuv starts every Windows child with bInheritHandles=TRUE and no handle list, so a detached holder that outlives Orca kept any inheritable handle Orca had open, such as a launcher's pipe or a DevTools socket. Start it through CreateProcessW with PROC_THREAD_ATTRIBUTE_HANDLE_LIST naming one NUL handle for its stdio. The build probes now check the newest export without calling it, and the lane receipt labels ConPTY's own startup output. * fix(windows): report isolated holder exits and kills the way libuv does
82 lines
3.3 KiB
TypeScript
82 lines
3.3 KiB
TypeScript
/** Every call throws an Error whose message names the Win32 call and its error code. */
|
|
|
|
export type GrantAccessOptions = {
|
|
/** Children inherit the grant (OI|CI). Only meaningful on a directory. */
|
|
inheritable: boolean
|
|
/**
|
|
* SET_ACCESS: drop every explicit rule for the trustee, allow and deny, then grant exactly
|
|
* `accessMask`. Otherwise GRANT_ACCESS: add `accessMask` to what the trustee is already allowed.
|
|
*/
|
|
replace: boolean
|
|
}
|
|
|
|
/** The process token's user SID, e.g. `S-1-5-21-…-1001`. */
|
|
export declare function currentUserSid(): string
|
|
|
|
/**
|
|
* One DACL entry as stored. `type` and `flags` are the raw ACE_HEADER bytes; `sid` is set only for
|
|
* plain allow (0) and deny (1) ACEs and is null for every other type.
|
|
*/
|
|
export type WindowsAce = { type: number; flags: number; mask: number; sid: string | null }
|
|
|
|
/** `protected` is SE_DACL_PROTECTED. */
|
|
export type WindowsDacl = { protected: boolean; aces: WindowsAce[] }
|
|
|
|
/** The path's DACL as structure, or null for a NULL DACL (which grants everyone everything). */
|
|
export declare function getDaclAces(path: string): WindowsDacl | null
|
|
|
|
/**
|
|
* Installs exactly the DACL in `sddl`. Its `P` flag picks protected or inheriting. A directory
|
|
* propagates to every existing descendant, which is seconds on a large tree.
|
|
*/
|
|
export declare function setDaclSddl(path: string, sddl: string): void
|
|
export declare function setDaclSddlAsync(path: string, sddl: string): Promise<void>
|
|
|
|
/** Creates a NEW file already carrying the DACL in `sddl`, then writes `data` into it. */
|
|
export declare function createFileWithDacl(path: string, sddl: string, data: Uint8Array): void
|
|
|
|
/**
|
|
* Adds an allow rule for `sid` to the existing DACL, keeping its protection state; Windows orders
|
|
* the result canonically. A NULL DACL already allows everyone, so it is left untouched.
|
|
*/
|
|
export declare function grantAccess(
|
|
path: string,
|
|
sid: string,
|
|
accessMask: number,
|
|
options: GrantAccessOptions
|
|
): void
|
|
export declare function grantAccessAsync(
|
|
path: string,
|
|
sid: string,
|
|
accessMask: number,
|
|
options: GrantAccessOptions
|
|
): Promise<void>
|
|
|
|
export type StdHandleInheritanceFailure = { stream: 'stdin' | 'stdout' | 'stderr'; code: number }
|
|
|
|
/**
|
|
* Makes the process's std handles non-inheritable, skipping absent ones. Never throws; returns the
|
|
* handles SetHandleInformation rejected (e.g. a legacy console pseudo-handle) with their Win32 code.
|
|
*/
|
|
export declare function clearStdHandleInheritance(): StdHandleInheritanceFailure[]
|
|
|
|
/** `exitWatchError` is the Win32 code when the exit can't be observed; the child still runs. */
|
|
export type IsolatedSpawnResult = { pid: number; exitWatchError: number | null }
|
|
|
|
/**
|
|
* Starts `file` detached and hidden, inheriting only a NUL handle for its stdio, so none of this
|
|
* process's other inheritable handles reach it. `commandLine` is the full, already quoted line
|
|
* (argv[0] included); an empty `cwd` keeps ours; `environmentBlock` is `K=V\0…\0\0`. `onExit` gets the exit code and never
|
|
* keeps the event loop alive. Throws an Error naming the failed Win32 call.
|
|
*/
|
|
export declare function spawnDetachedIsolated(
|
|
file: string,
|
|
commandLine: string,
|
|
cwd: string,
|
|
environmentBlock: string,
|
|
onExit: (code: number) => void
|
|
): IsolatedSpawnResult
|
|
|
|
/** Whether the resolved binary exports `name`; loads it, but calls nothing else. */
|
|
export declare function hasNativeExport(name: string): boolean
|