"""Keep private Windows temporary directories accessible to this AppContainer.

Python 3.13+ gives mode 0o700 an explicit user/admin DACL on Windows. That
omits the AppContainer SID. Inside our stage, inherit the native private parent
DACL instead. Kernel permissions and the Job remain the security boundary.
"""
import os

if os.name == "nt" and os.environ.get("YCODE_SANDBOX") == "appcontainer":
    _mkdir = os.mkdir
    _stage = os.path.normcase(os.path.abspath(os.environ["YCODE_SANDBOX_ROOT"]))

    def _private_mkdir(path, mode=0o777, *, dir_fd=None):
        if mode == 0o700 and dir_fd is None:
            target = os.path.normcase(os.path.abspath(os.fsdecode(path)))
            try:
                if os.path.commonpath((_stage, target)) == _stage:
                    mode = 0o777
            except ValueError:
                pass
        return _mkdir(path, mode, dir_fd=dir_fd)

    os.mkdir = _private_mkdir