[WRONG BRANCH] fix(windows): always remove secret ACL inheritance

[luvs01]

Motivation

• Close a security gap where an opt-in fast-path inferred a protected DACL from plain icacls <path> textual ACE output and could skip the destructive /inheritance:r step, allowing later ancestor-inherited ACEs to expose secrets.
• The change ensures the hardening helper enforces the documented per-user isolation invariants by always performing the authoritative mutation sequence when required.

Description

• Remove the read-only shortcut that parsed icacls stdout to decide the object was already compliant and could be skipped. The parser and the sync/async shortcut checks were deleted so the hardener no longer treats an owner-only textual ACE listing as proof of protection. (src/lib/windows-secret-acl.ts)
• Keep the secure, explicit hardening sequence intact: grant current user Full Control, run /inheritance:r to disable inheritance, then remove broad SIDs with /remove:g (the mutation flow in runIcacls is unchanged).
• Update tests to assert that an owner-only ACL listing does not skip mutation and that both sync and async hardening always execute the /grant:r, /inheritance:r, and /remove:g steps when required; renamed/adjusted tests to reflect the hardened behavior. (tests/windows-secret-acl.test.ts)
• Preserve non-Windows behavior and memoization guards; the optional timeout/memo semantics and required/optional failure policies are unchanged except for removing the unsafe early-return optimization.

Testing

• Ran the focused Windows ACL tests with bun test tests/windows-secret-acl.test.ts, which passed (Windows ACL-focused cases green).
• Ran typechecking with bun run typecheck, which completed successfully.
• Ran privacy scan with bun run privacy:scan, which passed.
• Ran the full test suite with bun run test; the Windows ACL regression remained green but several unrelated integration tests timed out or failed in this environment (these failures are unrelated to the ACL change).

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: db3c7755-7978-45db-818d-d5761c73ba31

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T01:01:07.370130Z	db14878	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request is being kept as a draft automatically. Once every issue above is resolved, it will be marked ready for review again.