[Dmitriy Vasyura (dmitrivMS)]

Summary

Add native APIs needed to avoid whoami.exe and icacls.exe subprocesses in VS Code's local agent host endpoint setup (microsoft/vscode#332710).

• getCurrentProcessUserSid() reads the current process token and returns its user SID.
• setOwnerOnlyAcl(path) asynchronously replaces a file/directory DACL via Win32 APIs. The protected ACL grants inheritable full control to the current process user, SYSTEM and Administrators, preserving ownership and auditing.
• Add TypeScript declarations, documentation, argument/error handling tests, and ACL tests covering grant replacement, ownership, existing/new children, Unicode paths and concurrent calls.

Validation

Windows x64, Node 24.18.0:

• npm rebuild — passed (native addon build).
• npm run compile — passed.
• npm test — passed, 39 tests.
• npm run lint — passed.
• git diff --check — passed.

The ACL test fixture was corrected during final validation to explicitly initialize the pre-existing file with inherited permissions, rather than assume machine-specific defaults. The final full suite passed.

Locally linked into the companion VS Code checkout: targeted Electron tests passed, including a regression asserting metadata publication creates no child processes.

Release coordination

This draft supplies the API for the companion VS Code change. Publish a package version containing these APIs before updating VS Code's dependency and lockfile. No version bump or publication is included here.

[Dmitriy Vasyura (dmitrivMS)]

Companion consumer draft: microsoft/vscode#341178. Publish the native API package first, then update the dependency and lockfile in that draft before merging.