fix(windows): soft-fail icacls ACL harden so Kimi auth is not blocked#157
Closed
Wibias wants to merge 1 commit into
Closed
fix(windows): soft-fail icacls ACL harden so Kimi auth is not blocked#157Wibias wants to merge 1 commit into
Wibias wants to merge 1 commit into
Conversation
Replace execFileSync icacls with Bun.spawnSync (windowsHide, retries, lock). Soft-fail ETIMEDOUT/EPERM/EACCES on required writes so login and token refresh continue with chmod-only hardening.
2 tasks
lidge-jun
added a commit
that referenced
this pull request
Jul 19, 2026
…shared deadline Absorbs the intent of community PR #157 (source head e19f38b) with a maintainer redesign per Sol review: - icacls runs through Bun.spawnSync (windowsHide) via an injectable runner seam; errors keep honest codes — ETIMEDOUT only for real timeouts, EICACLS (with exit code) otherwise. The source PR's blanket EPERM mapping made every failure soft-failable, defeating required:true on secret publication. - Soft-fail on required paths is TIMEOUT-ONLY (the reported field symptom: Kimi auth blocked behind a hung icacls). Real EPERM/EACCES still throw. - /remove:g failures are verified with locale-independent /findsid per broad SID before being accepted as harmless; a remaining ACE propagates the error. - One shared 5s deadline per harden call replaces stacked 3x15s retries that could stall loadConfig ~135s; timed-out paths are cached for the process lifetime so auth is never re-stalled. - Dropped the module-local boolean lock (serialized nothing across processes; sync calls already serialize in-process). - Failure paths are activation-tested via runner/platform/clock seams: timeout soft-fail + warn, EPERM throw, /findsid verification both ways, shared-deadline cutoff + no-retry cache. Co-authored-by: Wibias <37517432+Wibias@users.noreply.github.com>
Owner
|
Thanks for tackling this — the field symptom (Kimi auth blocked behind a hung icacls) was real, and the fix landed on
Full suite green (3,087 tests). Closing in favor of the dev-landed commit; ships with the next release. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
icaclswas failing on Windows withETIMEDOUT/EPERM, blockingauth.jsonwrites during Kimi login and token refresh (surfaced asinvalid_api_key).Bun.spawnSyncwithwindowsHide, retries, and a process lock.ETIMEDOUT/EPERM/EACCESon required writes so auth continues with chmod-only hardening.Example error this fixes:
Test plan
bun test tests/windows-secret-acl.test.ts