feat(config): make Windows cache-dir DACL hardening configurable

Add an opt-out for the Windows cache-directory DACL hardening (upstream
#1624): CBM_SKIP_DACL_HARDENING=1 as an env kill switch effective from the
first run, plus a persisted windows-dacl-hardening config key (default true)
effective from the second run, with env taking precedence.

When disabled: the creation-time stamp keeps the exact-owner stamp but drops
the owner-only protected DACL; the runtime-directory walk skips the
re-protection and restores the parent-inherited DACL (SE_DACL_PROTECTED
cleared) on a directory hardened by a previous run, supplying a real ACL
rather than a NULL DACL; the validators accept the OS-default inherited DACL.
Owner validation stays active in every path, and the default behavior is
unchanged.

Docs updated (CONFIGURATION.md runtime settings + environment variables,
README env table) and three Windows-only unit tests added in
tests/test_daemon_ipc.c.

Author: roosteer

README.md

@@ -682,6 +682,7 @@ codebase-memory-mcp config reset auto_index              # reset to default
 | `CBM_WORKERS` | *(detected)* | Override the parallel-indexing worker count returned by `cbm_default_worker_count`. Useful inside containers where `sysconf(_SC_NPROCESSORS_ONLN)` reports host CPUs rather than the cgroup's effective quota. Range 1–256; invalid values are ignored with a warning. |
 | `CBM_MEM_BUDGET_MB` | *(detected)* | Override the in-memory graph budget with an explicit cap in MiB, taking precedence over the `ram_fraction × total_RAM` default. Useful on bare-metal hosts without a cgroup limit, or to pin a budget *below* the cgroup limit so headroom is left for sibling processes. Must be a positive integer; it is clamped to detected total RAM (logged as `mem.budget.clamped`), and non-numeric or non-positive values are ignored with a warning (`mem.budget.env.invalid`). |
 | `CBM_DUMP_VERIFY_MIN_RATIO` | `0.5` | After indexing, compare persisted SQLite node count to the in-memory dump count. When persisted nodes fall below this fraction of committed nodes (and committed > 50), `index_repository` returns `status:"degraded"` instead of silent `indexed`. Range 0–1; set `0` to disable. Invalid values are ignored with a warning. |
+| `CBM_SKIP_DACL_HARDENING` | *(unset)* | Windows only: set to `1` to disable cache-directory DACL hardening from the very first run (the `windows-dacl-hardening` config key applies from run 2, since `_config.db` lives inside the cache directory). Overrides the config key; owner validation stays active. Use on hosts where the protected DACL breaks index publication. |
 
 Environment used by daemon-owned components—such as diagnostics, daemon logging, and process-wide indexing resource limits—is captured from the first daemon-backed session that starts the daemon. Later sessions join that process and cannot replace those values. To change them, close all daemon-backed sessions, update the relevant agent configurations consistently, and restart a session. `CBM_ALLOWED_ROOT` remains session-specific, a conflicting `CBM_CACHE_DIR` is rejected, and one-shot CLI commands read their own environment without starting the daemon.
 

docs/CONFIGURATION.md

@@ -86,6 +86,9 @@ Current keys:
 |---|---|---|
 | `auto_index` | `false` | Automatically index new projects when an MCP session starts. |
 | `auto_index_limit` | `50000` | Maximum file count allowed for automatic indexing of a new project. |
+| `windows-dacl-hardening` | `true` | Windows only: keep the cache-directory DACL hardened (owner-only, inheritance disabled). Set `false` to opt out; owner validation stays active. |
+
+`windows-dacl-hardening` is effective from the **second run**: the config store (`_config.db`) lives inside the cache directory, so it does not exist when the first run creates that directory. On the second run the directory is no longer re-protected, and a DACL hardened by the previous run has inheritance restored automatically. For an effect from the very first run, set `CBM_SKIP_DACL_HARDENING=1` instead (it overrides the config key). Disabling the hardening is intended for hosts where the protected DACL breaks index publication (`MoveFileExW` rename-replace fails with `ERROR_ACCESS_DENIED`, surfacing as the generic "Pipeline failed"); it is not recommended on multi-user or terminal-server hosts, where the owner-only DACL is the protection against other local accounts.
 
 ## 3. UI Settings
 
@@ -121,6 +124,7 @@ These environment variables affect runtime behavior:
 | `CBM_DIAGNOSTICS` | `false` | Enable periodic `snapshot.json` and retained `trajectory.ndjson` below a fresh owner-private directory in the system temp directory. The daemon records the randomized paths in the `diagnostics.start` discovery record (a single JSON line) in `${CBM_CACHE_DIR}/logs/cbm-daemon.log`; that one record is emitted even when `CBM_LOG_LEVEL` suppresses ordinary logging, so the paths always remain discoverable. |
 | `CBM_DOWNLOAD_URL` | GitHub releases | Override the update download URL. |
 | `CBM_LOG_LEVEL` | `info` | Set the log level to `debug`, `info`, `warn`, `error`, or `none` (or `0`-`4`). Thin-frontend messages use that session's stderr; detached daemon events use `${CBM_CACHE_DIR}/logs/cbm-daemon.log`. |
+| `CBM_SKIP_DACL_HARDENING` | *(unset)* | Windows only: set to `1` to disable cache-directory DACL hardening from the **very first run**, before any config store exists (the `windows-dacl-hardening` key only applies from run 2). Overrides the config key; owner validation of the cache directory stays active. Use it on hosts where the protected DACL breaks index publication. |
 | `CBM_WORKERS` | auto-detected | Override the indexing worker count. |
 
 Environment used by daemon-owned components—such as diagnostics, daemon logging, and process-wide indexing resource limits—is captured from the first daemon-backed session that starts the daemon. Later sessions join the existing process and cannot replace those values. To change them, close every daemon-backed session, update the relevant agent configurations consistently, and restart a session. `CBM_ALLOWED_ROOT` remains session-specific, a conflicting `CBM_CACHE_DIR` is rejected, and one-shot CLI commands use their own current environment without starting the daemon.

src/cli/cli.c

@@ -6592,6 +6592,8 @@ static const config_key_def_t CONFIG_KEYS[] = {
     {CBM_CONFIG_UI_LANG, "auto", "Pin graph UI language: en, zh, or auto"},
     {CBM_CONFIG_UI_ENABLED, "false", "Serve the graph UI on a loopback HTTP port"},
     {CBM_CONFIG_UI_PORT, "9749", "Port for the graph UI listener when enabled"},
+    {CBM_CONFIG_WINDOWS_DACL_HARDENING, "true",
+     "Protect Windows cache-dir DACL (ownership kept when off)"},
 };
 
 /* #1558: ui_enabled and ui_port were reachable ONLY by hand-editing

src/cli/cli.h

@@ -418,6 +418,7 @@ int cbm_config_delete(cbm_config_t *cfg, const char *key);
  * than the key-value store, but surfaced through `config` so it is findable. */
 #define CBM_CONFIG_UI_ENABLED "ui_enabled"
 #define CBM_CONFIG_UI_PORT "ui_port"
+#define CBM_CONFIG_WINDOWS_DACL_HARDENING "windows-dacl-hardening"
 
 /* ── Binary activation safety ─────────────────────────────────── */
 

src/daemon/ipc.c

@@ -3358,6 +3358,8 @@ typedef DWORD(WINAPI *get_security_info_fn)(HANDLE, SE_OBJECT_TYPE, SECURITY_INF
                                             PSID *, PACL *, PACL *, PSECURITY_DESCRIPTOR *);
 typedef DWORD(WINAPI *set_security_info_fn)(HANDLE, SE_OBJECT_TYPE, SECURITY_INFORMATION, PSID,
                                             PSID, PACL, PACL);
+typedef BOOL(WINAPI *get_security_descriptor_control_fn)(PSECURITY_DESCRIPTOR,
+                                                         PSECURITY_DESCRIPTOR_CONTROL, LPDWORD);
 typedef BOOL(WINAPI *impersonate_named_pipe_client_fn)(HANDLE);
 typedef BOOL(WINAPI *revert_to_self_fn)(void);
 typedef BOOL(WINAPI *get_named_pipe_client_process_id_fn)(HANDLE, PULONG);
@@ -3384,6 +3386,7 @@ typedef struct {
     get_ace_fn get_ace;
     get_security_info_fn get_security_info;
     set_security_info_fn set_security_info;
+    get_security_descriptor_control_fn get_security_descriptor_control;
     impersonate_named_pipe_client_fn impersonate_named_pipe_client;
     revert_to_self_fn revert_to_self;
     PSID user_sid;
@@ -3670,6 +3673,8 @@ static bool win_security_init(win_security_t *security) {
     RESOLVE_ADVAPI_MEMBER(security, get_ace, get_ace_fn, "GetAce");
     RESOLVE_ADVAPI_MEMBER(security, get_security_info, get_security_info_fn, "GetSecurityInfo");
     RESOLVE_ADVAPI_MEMBER(security, set_security_info, set_security_info_fn, "SetSecurityInfo");
+    RESOLVE_ADVAPI_MEMBER(security, get_security_descriptor_control,
+                          get_security_descriptor_control_fn, "GetSecurityDescriptorControl");
     RESOLVE_ADVAPI_MEMBER(security, impersonate_named_pipe_client, impersonate_named_pipe_client_fn,
                           "ImpersonateNamedPipeClient");
     RESOLVE_ADVAPI_MEMBER(security, revert_to_self, revert_to_self_fn, "RevertToSelf");
@@ -4088,6 +4093,16 @@ static bool win_file_acl_secure(win_security_t *security, HANDLE file, DWORD mut
     bool secure =
         status == ERROR_SUCCESS && descriptor && dacl && security->is_valid_acl(dacl) &&
         security->get_acl_information(dacl, &information, sizeof(information), AclSizeInformation);
+    if (!cbm_windows_dacl_hardening_enabled()) {
+        /* Hardening disabled (D3): accept the OS-default inherited DACL — the
+         * owner-only one-ACE shape is no longer required, and the
+         * runtime-directory walk has already restored inheritance. The owner
+         * is still validated by win_file_owner_secure. */
+        if (descriptor) {
+            (void)LocalFree(descriptor);
+        }
+        return secure;
+    }
     enum {
         WIN_FILE_ACE_ALLOW = 0x00,
         WIN_FILE_ACE_DENY = 0x01,
@@ -4158,6 +4173,77 @@ static bool win_file_security_secure(win_security_t *security, HANDLE file,
            win_file_acl_secure(security, file, mutation, ancestor);
 }
 
+/* True when the object's DACL is protected (inheritance disabled) — the state
+ * hardening applies and the opt-out restores. */
+static bool win_directory_dacl_protected(win_security_t *security, HANDLE directory) {
+    if (!security || !directory) {
+        return false;
+    }
+    PSECURITY_DESCRIPTOR descriptor = NULL;
+    DWORD status = security->get_security_info(directory, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
+                                               NULL, NULL, NULL, NULL, &descriptor);
+    SECURITY_DESCRIPTOR_CONTROL control = 0;
+    DWORD revision = 0;
+    bool protected_dacl =
+        status == ERROR_SUCCESS && descriptor &&
+        security->get_security_descriptor_control(descriptor, &control, &revision) != 0 &&
+        (control & SE_DACL_PROTECTED) != 0;
+    if (descriptor) {
+        (void)LocalFree(descriptor);
+    }
+    return protected_dacl;
+}
+
+/* Copy the parent directory's DACL — the ACE set a freshly created child
+ * inherits — so the opt-out can restore the OS-default inherited shape. The
+ * returned DACL is owned by *descriptor_out (LocalFree) and must stay alive
+ * until the SetSecurityInfo call that consumes it. */
+static bool win_directory_parent_dacl(win_security_t *security, const wchar_t *directory_path,
+                                      PACL *dacl_out, PSECURITY_DESCRIPTOR *descriptor_out) {
+    if (!security || !directory_path || !directory_path[0] || !dacl_out || !descriptor_out) {
+        return false;
+    }
+    size_t length = wcslen(directory_path);
+    if (length == 0) {
+        return false;
+    }
+    wchar_t *parent_path = wide_copy(directory_path);
+    if (!parent_path) {
+        return false;
+    }
+    size_t separator = length;
+    while (separator > 0 && parent_path[separator - 1] != L'\\' &&
+           parent_path[separator - 1] != L'/') {
+        separator--;
+    }
+    if (separator == 0) {
+        free(parent_path);
+        return false;
+    }
+    parent_path[separator - 1] = L'\0';
+    HANDLE parent = CreateFileW(
+        parent_path, READ_CONTROL, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL,
+        OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, NULL);
+    free(parent_path);
+    if (parent == INVALID_HANDLE_VALUE) {
+        return false;
+    }
+    PACL dacl = NULL;
+    PSECURITY_DESCRIPTOR descriptor = NULL;
+    DWORD status = security->get_security_info(parent, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
+                                               NULL, NULL, &dacl, NULL, &descriptor);
+    (void)CloseHandle(parent);
+    if (status != ERROR_SUCCESS || !descriptor || !dacl || !security->is_valid_acl(dacl)) {
+        if (descriptor) {
+            (void)LocalFree(descriptor);
+        }
+        return false;
+    }
+    *dacl_out = dacl;
+    *descriptor_out = descriptor;
+    return true;
+}
+
 static bool win_runtime_directory_secure(const wchar_t *runtime_dir) {
     win_security_t security;
     if (!win_security_init(&security)) {
@@ -4206,11 +4292,46 @@ static bool win_runtime_directory_secure(const wchar_t *runtime_dir) {
                                     win_file_owner_secure(&security, directory, false));
     DWORD secure_result = ERROR_ACCESS_DENIED;
     if (valid_handle && owner_ok) {
-        secure_result = security.set_security_info(
-            directory, SE_FILE_OBJECT,
-            (owner_exact ? 0U : (DWORD)OWNER_SECURITY_INFORMATION) | DACL_SECURITY_INFORMATION |
-                PROTECTED_DACL_SECURITY_INFORMATION,
-            owner_exact ? NULL : security.user_sid, NULL, security.directory_acl, NULL);
+        if (cbm_windows_dacl_hardening_enabled()) {
+            secure_result = security.set_security_info(
+                directory, SE_FILE_OBJECT,
+                (owner_exact ? 0U : (DWORD)OWNER_SECURITY_INFORMATION) | DACL_SECURITY_INFORMATION |
+                    PROTECTED_DACL_SECURITY_INFORMATION,
+                owner_exact ? NULL : security.user_sid, NULL, security.directory_acl, NULL);
+        } else {
+            /* Hardening disabled (D3): keep the exact-owner repair (owner
+             * validators stay active) but never re-protect the DACL, and
+             * restore inheritance on a directory hardened by a previous run
+             * so rename-replace works again without manual icacls. */
+            secure_result = ERROR_SUCCESS;
+            if (!owner_exact && can_write_owner) {
+                secure_result = security.set_security_info(directory, SE_FILE_OBJECT,
+                                                           OWNER_SECURITY_INFORMATION,
+                                                           security.user_sid, NULL, NULL, NULL);
+            }
+            if (secure_result == ERROR_SUCCESS &&
+                win_directory_dacl_protected(&security, directory)) {
+                /* Restore the inherited DACL shape: copy the parent's DACL
+                 * (the ACEs a freshly created directory inherits) and clear
+                 * SE_DACL_PROTECTED. A NULL pDacl with
+                 * DACL_SECURITY_INFORMATION would create a NULL DACL — full
+                 * access to everyone — so a real ACL is always supplied. */
+                PACL inherited = NULL;
+                PSECURITY_DESCRIPTOR parent_descriptor = NULL;
+                if (win_directory_parent_dacl(&security, runtime_dir, &inherited,
+                                              &parent_descriptor)) {
+                    secure_result = security.set_security_info(
+                        directory, SE_FILE_OBJECT,
+                        UNPROTECTED_DACL_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, NULL,
+                        NULL, inherited, NULL);
+                } else {
+                    secure_result = ERROR_ACCESS_DENIED;
+                }
+                if (parent_descriptor) {
+                    (void)LocalFree(parent_descriptor);
+                }
+            }
+        }
     }
     if (valid_handle && owner_ok && secure_result != ERROR_SUCCESS) {
         ipc_validation_detail_set("owner/DACL repair failed (status %lu%s)",

src/foundation/compat_fs.c

@@ -27,10 +27,41 @@
 #include <errno.h>  /* errno for spawn-failure logging */
 #include <fcntl.h>  /* _O_RDONLY */
 #include <io.h>     /* _wunlink, _open_osfhandle, _close */
+#include <stdatomic.h>
 #include <stdint.h> /* intptr_t */
 #include "foundation/log.h"
+#include "foundation/platform.h" /* cbm_safe_getenv */
 #include "foundation/win_utf8.h"
 
+/* DACL-hardening process flag: -1 undecided, 0 disabled, 1 enabled. The
+ * accessor lazily resolves the CBM_SKIP_DACL_HARDENING kill switch ONLY — it
+ * must stay dependency-free because it is reached from the stamp path, which
+ * runs before the config store exists. The persisted windows-dacl-hardening
+ * key is applied later through the explicit setter (env > config). */
+static atomic_int g_dacl_hardening = -1;
+
+bool cbm_windows_dacl_hardening_enabled(void) {
+    int state = atomic_load_explicit(&g_dacl_hardening, memory_order_acquire);
+    if (state >= 0) {
+        return state == 1;
+    }
+    char buf[CBM_SZ_32];
+    bool skip =
+        cbm_safe_getenv("CBM_SKIP_DACL_HARDENING", buf, sizeof(buf), NULL) != NULL && buf[0] == '1';
+    atomic_store_explicit(&g_dacl_hardening, skip ? 0 : 1, memory_order_release);
+    return !skip;
+}
+
+void cbm_windows_dacl_hardening_set(bool enabled) {
+    atomic_store_explicit(&g_dacl_hardening, enabled ? 1 : 0, memory_order_release);
+}
+
+#ifdef CBM_ENABLE_TEST_SEAMS
+void cbm_windows_dacl_hardening_reset_for_testing(void) {
+    atomic_store_explicit(&g_dacl_hardening, -1, memory_order_release);
+}
+#endif
+
 struct cbm_dir {
     HANDLE find_handle;
     WIN32_FIND_DATAW find_data;
@@ -461,10 +492,17 @@ static void cbm_windows_stamp_dir_owner(const wchar_t *path) {
                         FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, NULL);
         if (directory != INVALID_HANDLE_VALUE) {
             if (SetEntriesInAclW(1U, &access, NULL, &acl) == ERROR_SUCCESS) {
-                (void)SetSecurityInfo(directory, SE_FILE_OBJECT,
-                                      OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION |
-                                          PROTECTED_DACL_SECURITY_INFORMATION,
-                                      user->User.Sid, NULL, acl, NULL);
+                /* D3: when hardening is disabled the exact-owner stamp stays
+                 * (the owner validators remain active) but the owner-only
+                 * protected DACL is dropped, leaving the OS-default DACL. */
+                DWORD stamp = OWNER_SECURITY_INFORMATION;
+                PACL stamp_acl = NULL;
+                if (cbm_windows_dacl_hardening_enabled()) {
+                    stamp |= DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION;
+                    stamp_acl = acl;
+                }
+                (void)SetSecurityInfo(directory, SE_FILE_OBJECT, stamp, user->User.Sid, NULL,
+                                      stamp_acl, NULL);
             }
             (void)CloseHandle(directory);
         }
@@ -951,6 +989,20 @@ int cbm_exec_no_shell(const char *const *argv) {
     return CBM_NOT_FOUND; /* killed by signal */
 }
 
+/* DACL hardening is Windows-only; the accessor keeps the safe default and the
+ * setter is a no-op so shared callers (main_build_identity) compile unchanged. */
+bool cbm_windows_dacl_hardening_enabled(void) {
+    return true;
+}
+
+void cbm_windows_dacl_hardening_set(bool enabled) {
+    (void)enabled;
+}
+
+#ifdef CBM_ENABLE_TEST_SEAMS
+void cbm_windows_dacl_hardening_reset_for_testing(void) {}
+#endif
+
 #endif /* _WIN32 */
 
 /* Canonicalize an EXISTING path (collapse `..`, resolve links/junctions):

src/foundation/compat_fs.h

@@ -59,6 +59,20 @@ int cbm_pclose(FILE *f);
 /* Create directory (and parents). mode is ignored on Windows. Returns true on success. */
 bool cbm_mkdir_p(const char *path, int mode);
 
+/* Windows cache-directory DACL hardening opt-out (#1624). The accessor
+ * reflects CBM_SKIP_DACL_HARDENING (env-only, safe before the config store
+ * exists); the setter applies the persisted windows-dacl-hardening key once
+ * the store is readable (env wins over config). POSIX builds compile the
+ * accessor to the default (hardening on) and the setter to a no-op — every
+ * DACL site is Windows-only. */
+bool cbm_windows_dacl_hardening_enabled(void);
+void cbm_windows_dacl_hardening_set(bool enabled);
+#ifdef CBM_ENABLE_TEST_SEAMS
+/* Reset the lazily-cached flag so a test can re-resolve CBM_SKIP_DACL_HARDENING
+ * regardless of earlier calls in the same process. */
+void cbm_windows_dacl_hardening_reset_for_testing(void);
+#endif
+
 /* Delete a file. Returns 0 on success. */
 int cbm_unlink(const char *path);
 /* Remove <db_path>-wal/-shm/-journal. MUST be called by any path installing a fresh