fix: apply Windows private ACLs to scan output directories

sdk/typescript/src/bulk-scan-discovery.ts

@@ -1,13 +1,14 @@
 import { execFile as execFileCallback } from "node:child_process";
 import { createHash } from "node:crypto";
-import { lstat, mkdir, writeFile } from "node:fs/promises";
+import { chmod, lstat, mkdir, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { stdin } from "node:process";
 import { Writable } from "node:stream";
 import { promisify } from "node:util";
 import { confirm, input, search } from "@inquirer/prompts";
 import { Octokit } from "@octokit/core";
 import Papa from "papaparse";
+import { requirePrivateScanOutput } from "./runtime.js";
 import { resolveTrustedExecutable } from "./trusted-executable.js";
 
 const execFile = promisify(execFileCallback);
@@ -178,6 +179,15 @@ export async function runBulkScanWizard(
   signal?.throwIfAborted();
 
   await mkdir(outputDir, { recursive: true, mode: 0o700 });
+  let prepared = await lstat(outputDir);
+  if (!prepared.isDirectory() || prepared.isSymbolicLink()) {
+    throw new Error("The scan output must be a non-symlink directory.");
+  }
+  if (process.platform !== "win32" && (prepared.mode & 0o777) !== 0o700) {
+    await chmod(outputDir, 0o700);
+    prepared = await lstat(outputDir);
+  }
+  await requirePrivateScanOutput(prepared, outputDir);
   await writeFile(
     inputPath,
     `${Papa.unparse(

sdk/typescript/src/contract.ts

@@ -18,7 +18,7 @@ import type {
   ScanManifest,
 } from "./models.js";
 import {
-  requirePrivateOutputDirectory,
+  requirePrivateScanOutput,
   requireSecureOutputAncestry,
 } from "./runtime.js";
 import type { NormalizedTarget, ScanMode } from "./targets.js";
@@ -586,8 +586,9 @@ async function requireScanRoot(
       throw new Error("not a directory");
     }
     try {
-      requirePrivateOutputDirectory(returned, canonical);
-      await requireSecureOutputAncestry(canonical);
+      const secured = await requirePrivateScanOutput(returned, canonical);
+      await requireSecureOutputAncestry(secured.path);
+      return { path: secured.path, metadata: secured.metadata };
     } catch (error) {
       throw new ContractValidationError(
         error instanceof Error
@@ -596,7 +597,6 @@ async function requireScanRoot(
         { cause: error },
       );
     }
-    return { path: canonical, metadata: returned };
   } catch (error) {
     throwIfAborted(signal);
     if (error instanceof ContractValidationError) throw error;
@@ -622,8 +622,14 @@ async function verifyScanRoot(
     ) {
       throw new Error("scan directory changed while reading");
     }
-    requirePrivateOutputDirectory(current, root.path);
-    await requireSecureOutputAncestry(root.path);
+    const secured = await requirePrivateScanOutput(current, root.path);
+    if (
+      secured.metadata.dev !== root.metadata.dev ||
+      secured.metadata.ino !== root.metadata.ino
+    ) {
+      throw new Error("scan directory changed while reading");
+    }
+    await requireSecureOutputAncestry(secured.path);
   } catch (error) {
     throwIfAborted(signal);
     throw new ContractValidationError(

sdk/typescript/src/multiscan.ts

@@ -1,6 +1,7 @@
 import { execFile as execFileCallback } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import {
+  chmod,
   lstat,
   mkdir,
   open,
@@ -18,6 +19,7 @@ import type { CodexSecurity } from "./api.js";
 import type { CodexSecurityConfig } from "./config.js";
 import type { ScanCost } from "./cost.js";
 import { redactedErrorMessage } from "./errors.js";
+import { requirePrivateScanOutput } from "./runtime.js";
 import type { ScanMode } from "./targets.js";
 import { resolveTrustedExecutable } from "./trusted-executable.js";
 
@@ -257,6 +259,15 @@ async function ensureOutputDirectory(path: string): Promise<void> {
     throw new Error("Multiscan output directories must not be symbolic links.");
   }
   await mkdir(path, { recursive: true, mode: 0o700 });
+  let prepared = await lstat(path);
+  if (!prepared.isDirectory() || prepared.isSymbolicLink()) {
+    throw new Error("Multiscan output must be a non-symlink directory.");
+  }
+  if (process.platform !== "win32" && (prepared.mode & 0o777) !== 0o700) {
+    await chmod(path, 0o700);
+    prepared = await lstat(path);
+  }
+  await requirePrivateScanOutput(prepared, path);
 }
 
 async function appendReceipt(path: string, receipt: string): Promise<void> {

sdk/typescript/src/runtime.ts

@@ -269,6 +269,18 @@ export async function requirePrivateCredentialHome(
 }
 
 async function secureWindowsCredentialHome(path: string): Promise<void> {
+  await secureWindowsPrivateDirectory(path, "Credential");
+}
+
+async function secureWindowsScanOutput(path: string): Promise<void> {
+  await secureWindowsPrivateDirectory(path, "Scan output");
+}
+
+/** Restrict a Windows directory ACL to the current user, then verify. */
+async function secureWindowsPrivateDirectory(
+  path: string,
+  label: "Credential" | "Scan output",
+): Promise<void> {
   const systemRoot = process.env["SystemRoot"] ?? "C:\\Windows";
   const powershell = join(
     systemRoot,
@@ -279,7 +291,8 @@ async function secureWindowsCredentialHome(path: string): Promise<void> {
   );
   const script = [
     "$ErrorActionPreference = 'Stop'",
-    "$path = [Environment]::GetEnvironmentVariable('CODEX_SECURITY_CREDENTIAL_ACL_PATH', 'Process')",
+    "$path = [Environment]::GetEnvironmentVariable('CODEX_SECURITY_PRIVATE_ACL_PATH', 'Process')",
+    "$label = [Environment]::GetEnvironmentVariable('CODEX_SECURITY_PRIVATE_ACL_LABEL', 'Process')",
     "$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()",
     "if ($null -eq $identity.User) { throw 'Unable to identify the current Windows user' }",
     "$acl = New-Object System.Security.AccessControl.DirectorySecurity",
@@ -290,17 +303,18 @@ async function secureWindowsCredentialHome(path: string): Promise<void> {
     "$acl.SetAccessRule($rule)",
     "[System.IO.Directory]::SetAccessControl($path, $acl)",
     "$verified = [System.IO.Directory]::GetAccessControl($path)",
-    "if (-not $verified.AreAccessRulesProtected) { throw 'Credential ACL still inherits access rules' }",
+    'if (-not $verified.AreAccessRulesProtected) { throw "$label ACL still inherits access rules" }',
     "$unexpected = @($verified.Access | Where-Object { $_.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow -and $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value -ne $identity.User.Value })",
-    "if ($unexpected.Count -ne 0) { throw 'Credential ACL grants access to another identity' }",
+    'if ($unexpected.Count -ne 0) { throw "$label ACL grants access to another identity" }',
   ].join("; ");
   await execFile(
     powershell,
     ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script],
     {
       env: {
         ...process.env,
-        CODEX_SECURITY_CREDENTIAL_ACL_PATH: path,
+        CODEX_SECURITY_PRIVATE_ACL_PATH: path,
+        CODEX_SECURITY_PRIVATE_ACL_LABEL: label,
       },
       encoding: "utf8",
       windowsHide: true,
@@ -704,11 +718,9 @@ export async function validateOutputDir(
           `Scan output directory is not empty: ${path}. To keep the existing results and start a new scan, add --archive-existing.`,
         );
       }
-      requirePrivateOutputDirectory(metadata, path);
-      await requireSecureOutputAncestry(path);
-      const canonical = await realpath(path);
-      requireModelSafeOutputDir(canonical);
-      return canonical;
+      const secured = await requirePrivateScanOutput(metadata, path);
+      await requireSecureOutputAncestry(secured.path);
+      return secured.path;
     }
 
     let parent = dirname(path);
@@ -829,6 +841,10 @@ export async function prepareOutputDir(
 export async function validatePreparedOutputDir(
   path: string,
   validateLocation?: (path: string) => void,
+  options: {
+    platform?: NodeJS.Platform;
+    secureWindowsOutput?: (path: string) => Promise<void>;
+  } = {},
 ): Promise<string> {
   const metadata = await lstat(path);
   if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
@@ -843,9 +859,79 @@ export async function validatePreparedOutputDir(
       `Scan output directory must be empty: ${path}`,
     );
   }
-  requirePrivateOutputDirectory(metadata, path);
-  await requireSecureOutputAncestry(canonical);
-  return canonical;
+  const secured = await requirePrivateScanOutput(metadata, path, options);
+  await requireSecureOutputAncestry(secured.path);
+  return secured.path;
+}
+
+/**
+ * Enforce that scan output stays private to the current user.
+ * On Windows this applies and verifies a current-user-only ACL (same boundary
+ * as credential homes), then re-binds the path to the same directory identity.
+ * On POSIX this checks mode/owner and re-binds the canonical path.
+ */
+export async function requirePrivateScanOutput(
+  metadata: Stats,
+  path: string,
+  options: {
+    platform?: NodeJS.Platform;
+    secureWindowsOutput?: (path: string) => Promise<void>;
+  } = {},
+): Promise<{ path: string; metadata: Stats }> {
+  if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+    throw new OutputDirectoryError(`Scan output is not a directory: ${path}`);
+  }
+  if ((options.platform ?? process.platform) !== "win32") {
+    requirePrivateOutputDirectory(metadata, path);
+    return await bindPrivateScanOutputPath(path, metadata);
+  }
+
+  try {
+    await (options.secureWindowsOutput ?? secureWindowsScanOutput)(path);
+  } catch (error) {
+    throw new OutputDirectoryError(
+      `Unable to create a private Windows scan output directory: ${path}`,
+      { cause: error },
+    );
+  }
+  return await bindPrivateScanOutputPath(path, metadata);
+}
+
+async function bindPrivateScanOutputPath(
+  path: string,
+  expected: Pick<Stats, "dev" | "ino">,
+): Promise<{ path: string; metadata: Stats }> {
+  let after: Stats;
+  try {
+    after = await lstat(path);
+  } catch (error) {
+    throw new OutputDirectoryError(
+      `Unable to inspect scan output directory: ${path}`,
+      { cause: error },
+    );
+  }
+  if (!after.isDirectory() || after.isSymbolicLink()) {
+    throw new OutputDirectoryError(`Scan output is not a directory: ${path}`);
+  }
+  if (after.dev !== expected.dev || after.ino !== expected.ino) {
+    throw new OutputDirectoryError(
+      `Scan output directory was replaced: ${path}`,
+    );
+  }
+  const canonical = await realpath(path);
+  requireModelSafeOutputDir(canonical);
+  const canonicalMetadata = await lstat(canonical);
+  if (
+    !canonicalMetadata.isDirectory() ||
+    canonicalMetadata.isSymbolicLink() ||
+    canonicalMetadata.dev !== expected.dev ||
+    canonicalMetadata.ino !== expected.ino
+  ) {
+    throw new OutputDirectoryError(
+      `Scan output directory was replaced: ${canonical}`,
+    );
+  }
+  return { path: canonical, metadata: canonicalMetadata };
 }
 
 export function requirePrivateOutputDirectory(

sdk/typescript/tests-ts/multiscan.test.ts

@@ -2,6 +2,7 @@ import { execFileSync } from "node:child_process";
 import {
   access,
   appendFile,
+  chmod,
   mkdir,
   mkdtemp,
   readFile,
@@ -631,7 +632,10 @@ describe("multiscan", () => {
       const preserved = join(external, "victim", "keep.txt");
       await mkdir(join(external, "victim"), { recursive: true });
       await writeFile(preserved, "preserved\n");
-      if (directory) await mkdir(paths.output);
+      if (directory) {
+        await mkdir(paths.output, { mode: 0o700 });
+        if (process.platform !== "win32") await chmod(paths.output, 0o700);
+      }
       await symlink(
         external,
         directory ? join(paths.output, directory) : paths.output,