fix(windows): pin the Node runtime so validators cannot be redirected

Get-DreamSkinNodeRuntime accepted $env:CODEX_DREAM_SKIN_NODE and, failing
that, whatever node.exe PATH resolved to. Get-DreamSkinValidatedNodeRuntime
then 'validated' the candidate by running `node -p process.versions.node` --
so a hostile binary executed before any check ran. Validation was execution.

That runtime runs every validator this project owns: Safe CSS
(theme-windows.ps1:293), the theme package validator (:1038), image metadata
limits (:246) and the injector (:1269). Anyone able to write HKCU\Environment
-- no admin rights required -- could point all four at their own node.exe and
bypass them at once, including the Safe CSS allowlist that community themes
are gated on.

macOS never had this: require_signed_node_runtime pins the path inside the
ChatGPT bundle, codesigns it and compares team IDs, with no env override.
This closes the asymmetry.

- Pin to the engine's bundled runtime\node\node.exe, which the installer
  stages and the engine manifest hash-verifies. No env override, no PATH.
- Add Assert-DreamSkinTrustedNodeImage, called before the first execution:
  Authenticode status must be Valid and the signer must be OpenJS/Node.js
  Foundation or Microsoft.
- run-tests.ps1 asserted the env var was present, pinning the unsafe shape in
  place -- same trap as the -32000 readiness test. It now asserts the opposite,
  plus that no PATH fallback exists and that the signature check precedes the
  probe. Verified by injection: each regression flips its assertion red.

Author: Fei-Away

windows/scripts/common-windows.ps1

@@ -419,6 +419,22 @@ function Invoke-DreamSkinNative {
   }
 }
 
+function Assert-DreamSkinTrustedNodeImage {
+  param([Parameter(Mandatory = $true)][string]$Path)
+
+  # Runs BEFORE the binary is ever executed. Get-DreamSkinValidatedNodeRuntime
+  # learns the version by running `node -p`, so any authenticity check placed
+  # after that point would already have executed attacker-controlled code.
+  $signature = Get-AuthenticodeSignature -LiteralPath $Path -ErrorAction Stop
+  if ("$($signature.Status)" -ine 'Valid') {
+    throw "The Node.js runtime is not validly signed: $Path ($($signature.Status))."
+  }
+  $subject = "$($signature.SignerCertificate.Subject)"
+  if ($subject -notmatch '(?i)O=(OpenJS Foundation|Node\.js Foundation|Microsoft Corporation)') {
+    throw "The Node.js runtime is signed by an unexpected publisher: $subject"
+  }
+}
+
 function Get-DreamSkinValidatedNodeRuntime {
   param(
     [Parameter(Mandatory = $true)][string]$Path,
@@ -428,6 +444,7 @@ function Get-DreamSkinValidatedNodeRuntime {
   if (-not (Test-Path -LiteralPath $candidate -PathType Leaf)) {
     throw "Node.js runtime does not exist: $candidate"
   }
+  Assert-DreamSkinTrustedNodeImage -Path $candidate
   $versionProbe = Invoke-DreamSkinNative -FilePath $candidate -ArgumentList @('-p', 'process.versions.node') -DiscardStderr
   $version = ($versionProbe.Output -join '').Trim()
   if ($versionProbe.ExitCode -ne 0 -or -not $version) { throw 'The Node.js runtime could not be validated.' }
@@ -446,22 +463,20 @@ function Get-DreamSkinValidatedNodeRuntime {
 function Get-DreamSkinNodeRuntime {
   param([int]$MinimumMajor = 22)
 
-  if ($env:CODEX_DREAM_SKIN_NODE) {
-    return Get-DreamSkinValidatedNodeRuntime -Path $env:CODEX_DREAM_SKIN_NODE -MinimumMajor $MinimumMajor
-  }
-
+  # The runtime that runs Safe CSS validation, theme-package validation, image
+  # metadata limits and the injector is pinned to the engine's own bundled
+  # copy, which install-dream-skin.ps1 stages and the engine manifest
+  # hash-verifies. Neither an environment variable nor PATH may redirect it:
+  # anyone able to write HKCU\Environment (no admin needed) could otherwise
+  # point every validator at their own node.exe and bypass all of them at once.
+  # macOS pins the same way -- see require_signed_node_runtime in
+  # macos/scripts/common-macos.sh.
   $runtimeRoot = Split-Path -Parent $PSScriptRoot
   $bundledNode = Join-Path $runtimeRoot 'runtime\node\node.exe'
-  if (Test-Path -LiteralPath $bundledNode -PathType Leaf) {
-    return Get-DreamSkinValidatedNodeRuntime -Path $bundledNode -MinimumMajor $MinimumMajor
-  }
-
-  $command = Get-Command node.exe -ErrorAction SilentlyContinue
-  if (-not $command) { $command = Get-Command node -ErrorAction SilentlyContinue }
-  if (-not $command) {
-    throw "Bundled Node.js is missing and Node.js $MinimumMajor or newer was not found in PATH."
+  if (-not (Test-Path -LiteralPath $bundledNode -PathType Leaf)) {
+    throw "The bundled Node.js runtime is missing: $bundledNode. Reinstall Codex Dream Skin to restore it."
   }
-  return Get-DreamSkinValidatedNodeRuntime -Path $command.Source -MinimumMajor $MinimumMajor
+  return Get-DreamSkinValidatedNodeRuntime -Path $bundledNode -MinimumMajor $MinimumMajor
 }
 
 function ConvertTo-DreamSkinCodexInstall {

windows/tests/run-tests.ps1

@@ -175,16 +175,35 @@ try {
     throw 'Runtime scripts are not unblocked only after staged byte-content verification.'
   }
   foreach ($requiredNodeBehavior in @(
-    '$env:CODEX_DREAM_SKIN_NODE',
     'runtime\node\node.exe',
     'runtime\node\LICENSE',
     '$sourceHasBundledRuntime',
-    'Get-DreamSkinValidatedNodeRuntime'
+    'Get-DreamSkinValidatedNodeRuntime',
+    'Assert-DreamSkinTrustedNodeImage'
   )) {
     if (-not $commonSource.Contains($requiredNodeBehavior)) {
       throw "Bundled Node.js discovery is missing: $requiredNodeBehavior"
     }
   }
+  # The Node runtime executes every validator we own (Safe CSS, theme package,
+  # image metadata, injector), so its path must not be redirectable by anyone
+  # who can write HKCU\Environment without admin rights.
+  if ($commonSource.Contains('$env:CODEX_DREAM_SKIN_NODE')) {
+    throw 'The Node.js runtime path must not be overridable through an environment variable.'
+  }
+  if ($commonSource -match "Get-Command node(\.exe)? -ErrorAction SilentlyContinue") {
+    throw 'The Node.js runtime must not fall back to whatever node.exe PATH resolves to.'
+  }
+  # Authenticity must be proven before the binary runs; `node -p` is execution.
+  $trustIndex = $commonSource.IndexOf(
+    'Assert-DreamSkinTrustedNodeImage -Path $candidate', [System.StringComparison]::Ordinal
+  )
+  $probeIndex = $commonSource.IndexOf(
+    "Invoke-DreamSkinNative -FilePath `$candidate", [System.StringComparison]::Ordinal
+  )
+  if ($trustIndex -lt 0 -or $probeIndex -le $trustIndex) {
+    throw 'The Node.js runtime is executed before its signature is verified.'
+  }
   $trayGuardIndex = $installSource.IndexOf('if (Test-DreamSkinTrayActive)', [System.StringComparison]::Ordinal)
   $engineInstallIndex = $installSource.IndexOf('$engine = Install-DreamSkinRuntimeEngine', [System.StringComparison]::Ordinal)
   if ($trayGuardIndex -lt 0 -or $engineInstallIndex -le $trayGuardIndex) {