Windows port — Phase 2: privilege elevation#8

Merged

ronylicha merged 9 commits into

feat/win-phase-2

Jun 26, 2026

Commits on Jun 26, 2026

docs(win): Phase 2 implementation plan (privilege elevation)
rony
committed
feat: core_trash::execute_root_plan shared validator; privhelper uses it
rony
committed
feat(win): elevated --apply executor (headless child runs the validated root plan)
rony
committed
fix(win/security): reject non-numeric --apply token (path-traversal hardening, elevated process)
rony
committed
feat(win): elevate via PowerShell RunAs self-relaunch (--apply); SMART stub for Phase 3
rony
committed
fix(win): gate Write/Stdio imports to cfg(linux) (unused on Windows/macOS after pkexec_helper split)
rony
committed
fix(win/security): hard-coded canonicalized privileged zone (P2 final-review)
rony
committed
fix(win): dunce-canonicalize zone matching in core-trash (root cause)
rony
committed
fix(win): canonicalize zones in Zones::contains (match canonical candidates on Windows + macOS /tmp)
rony
committed