feat: support native artifact downloads on Windows (#346)

Author: signal-forge-lab

docs/artifact-exchange.md

@@ -37,8 +37,13 @@ file-object shape, trusted OpenAI download hosts, and redirects before streaming
 Malformed references, unknown fields, absolute paths, traversal, and symlinked
 parents are rejected.
 
-Downloads are streamed under `artifacts.maxFileBytes` and published as
-owner-only files without overwriting an existing destination. The tool is
-currently available on Linux. It is not registered on macOS, Windows, or BSD
-because Node.js does not expose the required descriptor-relative filesystem
-operations there.
+Downloads are streamed under `artifacts.maxFileBytes` and published without
+overwriting an existing destination. The tool is available on Linux and
+Windows. Linux uses descriptor-anchored directory operations. Windows pins
+each destination directory with native handles that reject reparse points and
+prevent rename/replacement while the transfer is in progress. macOS and BSD
+remain unsupported.
+
+On POSIX filesystems the partial is created with mode `0600`. Windows file
+permissions follow the destination directory's ACL inheritance rather than
+POSIX mode bits.

docs/configuration.md

@@ -192,8 +192,8 @@ them.
 
 Set `artifacts.enabled` to `true` when a host needs to save a native attached or
 generated file into an open workspace. `artifacts.maxFileBytes` limits one
-streamed file. The secure publication path is currently available only on
-Linux; the tool is not registered on macOS, Windows, or BSD.
+streamed file. The secure publication path is available on Linux and Windows;
+the tool is not registered on macOS or BSD.
 
 ## Environment boundary
 

docs/security.md

@@ -106,8 +106,13 @@ credentials, malformed references, and unknown object fields are rejected.
 
 Absolute paths, traversal, symlinked parents, and existing destinations also
 fail closed. Downloads stream under the configured per-file limit and are
-published without overwrite as owner-only files. DevSpace does not extract or
-execute transferred content.
+published without overwrite. On Linux, destination traversal stays anchored to
+opened directory descriptors. On Windows, DevSpace holds native directory
+handles without delete sharing, rejects reparse points, and keeps those handles
+open while Node performs the path-based write and publication operations. On
+POSIX systems the partial is created with mode `0600`; Windows permissions
+follow inherited ACLs. DevSpace does not extract or execute transferred
+content.
 
 ## Logs
 

package.json

@@ -66,6 +66,7 @@
     "drizzle-orm": "^0.45.2",
     "express": "^5.2.1",
     "jsonc-parser": "^3.3.1",
+    "koffi": "^3.1.2",
     "lucide": "^1.24.0",
     "react": "^19.2.6",
     "react-dom": "^19.2.6",

pnpm-lock.yaml

@@ -2,5 +2,6 @@ allowBuilds:
   '@google/genai': false
   better-sqlite3: true
   esbuild: true
+  koffi: true
   node-pty: true
   protobufjs: false