@argszero/cordis-plugin-sandbox-grant-advisor 0.2.0 → 0.3.0

package/README.md

@@ -30,9 +30,20 @@ stuck.
 
 ### 1. Workspace provisioning — the Windows ACL failure (`acl-provisioning`)
 
-Three reports describe this exact line: [discussion #7538], [discussion #7622],
-[discussion #7646]. In each one every sandboxed command fails the same way,
-before it runs, and the error names neither the missing right nor a remedy.
+Four reports describe this exact line: [discussion #7538], [discussion #7622],
+[discussion #7646], [discussion #7720]. In each one every sandboxed command fails
+the same way, before it runs, and the error names neither the missing right nor
+a remedy.
+
+`#7720` is worth reading for where the failure lands: the grant is materialized
+at sandbox **initialization**, so this is not one refused operation but *every*
+shell tool at once — the reporter could not run `netstat` or even `icacls` to
+diagnose the error they were staring at (on `0.1.5-rc.3` the same directory
+worked, because confinement was skipped silently rather than failing closed).
+They also report the two remedies that look right and are not
+(`takeown /F <dir> /R /D Y`, `icacls <dir> /reset /T /C`), which is why the
+advisory names them with the reason each fails instead of leaving the reader to
+discover it.
 
 The Windows backend provisions a workspace by writing the directory's DACL and
 its mandatory-integrity label in **one** `SetNamedSecurityInfoW` call
@@ -79,6 +90,13 @@ Confirm the cause (unelevated) — `icacls` is a normal user command:
 Fix it (unelevated, one line) and then run the command again:
   PowerShell: icacls "D:\ws" /grant "$env:USERNAME:(OI)(CI)F"
   cmd:        icacls "D:\ws" /grant "%USERNAME%:(OI)(CI)F"
+
+What will NOT fix it — both look like the right move, and both were tried and reported:
+  takeown /F "D:\ws" /R /D Y
+    makes you the owner, but ownership's implicit rights are READ_CONTROL and WRITE_DAC only.
+    The owner does not implicitly hold WRITE_OWNER, which is the right this call needs.
+  icacls "D:\ws" /reset /T /C
+    restores inheritance, and inheritance is what supplied the Modify-only ACE above.
 ```
 
 ### 2. Persistent shell startup (`pty-startup`)
@@ -338,4 +356,5 @@ the current runtime cannot distinguish rather than counting it as a pass.
 [discussion #7538]: https://github.com/deepseek-ai/deepseek-harness/discussions/7538
 [discussion #7622]: https://github.com/deepseek-ai/deepseek-harness/discussions/7622
 [discussion #7646]: https://github.com/deepseek-ai/deepseek-harness/discussions/7646
+[discussion #7720]: https://github.com/deepseek-ai/deepseek-harness/discussions/7720
 [discussion #7638]: https://github.com/deepseek-ai/deepseek-harness/discussions/7638

package/lib/advice.js

@@ -33,7 +33,7 @@
  */
 import { failureLine } from './signature.js';
 /** The upstream threads the ACL advisory is a stopgap for. */
-export const ACL_DISCUSSIONS = '#7538 / #7622 / #7646';
+export const ACL_DISCUSSIONS = '#7538 / #7622 / #7646 / #7720';
 /** The upstream thread the persistent-shell advisory is a stopgap for. */
 export const PTY_DISCUSSIONS = '#7638';
 /** The documented prerequisite, quoted from the backend's README. */
@@ -57,6 +57,21 @@ export const GLOBAL_PATCH = '$DSH_HOME/cordis.patch.yml';
 export const MINIMAL_PRESET_ROW = 'preset-minimal';
 /** The one-shot shell tool the `standard` preset mounts on Windows. */
 export const ONE_SHOT_SHELL = '@deepseek-ai/dsh-tool-pwsh';
+/**
+ * The two remedies that look like the fix and are not.
+ *
+ * Both were applied by the reporter of `#7720` before finding the one that
+ * works, and both are the *natural* reach: making yourself the owner and
+ * resetting the directory's ACL are how one normally repairs a Windows
+ * permission problem. They fail here for two different reasons, and naming the
+ * reason is what makes this section worth its lines — a reader who already
+ * tried them learns why, and a reader who has not is spared the attempt. See
+ * {@link nonFixes} for when this is emitted.
+ */
+export const NOT_FIXES = [
+    'takeown /F "<dir>" /R /D Y',
+    'icacls "<dir>" /reset /T /C',
+];
 /** Placeholder the user replaces with the directory the error named. */
 const PLACEHOLDER = '<the directory from the error line above>';
 /**
@@ -91,6 +106,37 @@ function diagnosis(failure) {
             ].join('\n');
     }
 }
+/**
+ * The "this is not the fix" lines for one class of failure.
+ *
+ * Emitted only for `apply-denied`, the class whose whole diagnosis is the
+ * missing `WRITE_OWNER` right — because only there is the claim true:
+ *
+ * - `read-denied` wants `READ_CONTROL`, and taking ownership *does* carry it,
+ *   so calling `takeown` a non-fix there would be false.
+ * - `apply-other` already says the missing-rights story does not apply
+ *   verbatim, so a section that presupposes it would contradict its own
+ *   diagnosis.
+ *
+ * A negative claim still has to be earned: the failure to avoid is advice that
+ * is confidently wrong in the other direction.
+ * @param failure - the recognized provisioning failure.
+ * @param path - the directory the error named, or the placeholder.
+ * @returns the section's lines, or an empty array for a class it does not fit.
+ */
+function nonFixes(failure, path) {
+    if (failure.klass !== 'apply-denied')
+        return [];
+    return [
+        'What will NOT fix it — both look like the right move, and both were tried and reported:',
+        `  takeown /F "${path}" /R /D Y`,
+        "    makes you the owner, but ownership's implicit rights are READ_CONTROL and WRITE_DAC only.",
+        '    The owner does not implicitly hold WRITE_OWNER, which is the right this call needs.',
+        `  icacls "${path}" /reset /T /C`,
+        '    restores inheritance, and inheritance is what supplied the Modify-only ACE above.',
+        '',
+    ];
+}
 /**
  * Build the advisory attached to the failing tool result.
  *
@@ -137,6 +183,7 @@ function aclAdvisory(failure, href) {
         `  PowerShell: icacls "${path}" /grant "$env:USERNAME:(OI)(CI)F"`,
         `  cmd:        icacls "${path}" /grant "%USERNAME%:(OI)(CI)F"`,
         '',
+        ...nonFixes(failure, path),
         'How to read this: the harness documents the prerequisite (' + PREREQUISITE + ') and this',
         'error does not name it yet, so the advice is delivered here instead. This is a stopgap, ' + where + '.',
         'What it is NOT: this plugin neither edits ACLs nor elevates — the command above is yours to run.',

package/lib/index.js

@@ -4,8 +4,8 @@
  *
  * ## The two failures it recognizes
  *
- * **Workspace provisioning (Windows ACL).** Three reports of one signature
- * (`#7538`, `#7622`, `#7646`) describe the same shape: the host-side write grant
+ * **Workspace provisioning (Windows ACL).** Four reports of one signature
+ * (`#7538`, `#7622`, `#7646`, `#7720`) describe the same shape: the host-side write grant
  * for a sandboxed workspace cannot be applied, every sandboxed command then
  * fails identically **before it runs**, and the error text is a bare Win32 line:
  *
@@ -18,6 +18,13 @@
  * caller `WRITE_OWNER` — never reaches the user, so sessions escape into
  * `danger-full-access` or die on the model's output cap.
  *
+ * `#7720` sharpens where this lands: because the grant is materialized at
+ * sandbox *initialization*, that failure takes **every** shell tool with it, not
+ * one operation — the reporter could not run `netstat` or `icacls` to diagnose
+ * the failure they were looking at. It also contributes the two remedies that
+ * look right and are not (`takeown /R /D Y`, `icacls /reset /T /C`), which the
+ * ACL advisory now names along with the reason each fails.
+ *
  * **Persistent shell startup (#7638).** With the `minimal` preset on Windows the
  * only shell tool is a persistent PTY (`dsh-terminal-bash` +
  * `dsh-tool-pwsh-persistent`), and under a *confining* sandbox mode every call
@@ -59,8 +66,9 @@
  *    failure of a family, the failing tool result is enriched with a user-role
  *    notice. For the ACL family it names the missing right (`WRITE_OWNER` on the
  *    directory, not `SeSecurityPrivilege`), gives the unelevated one-line
- *    `icacls` remedy, and gives the discriminator that separates a Modify-only
- *    directory from a wrong prerequisite. For the PTY family it names the
+ *    `icacls` remedy, gives the discriminator that separates a Modify-only
+ *    directory from a wrong prerequisite, and names the two remedies that look
+ *    right and are not (`takeown`, `icacls /reset`), each with its reason. For the PTY family it names the
  *    combination that fails (persistent PTY × a confining mode), states the
  *    resolved mode, says plainly that no command can fix it, and hands the
  *    user-side preset choice over. Both ride `additionalContexts`, so the model

package/lib/types/advice.d.ts

@@ -34,7 +34,7 @@
 import type { ProvisioningFailure, RecognizedFailure } from './signature.js';
 import type { SandboxModeName } from './mode.js';
 /** The upstream threads the ACL advisory is a stopgap for. */
-export declare const ACL_DISCUSSIONS = "#7538 / #7622 / #7646";
+export declare const ACL_DISCUSSIONS = "#7538 / #7622 / #7646 / #7720";
 /** The upstream thread the persistent-shell advisory is a stopgap for. */
 export declare const PTY_DISCUSSIONS = "#7638";
 /** The documented prerequisite, quoted from the backend's README. */
@@ -58,6 +58,18 @@ export declare const GLOBAL_PATCH = "$DSH_HOME/cordis.patch.yml";
 export declare const MINIMAL_PRESET_ROW = "preset-minimal";
 /** The one-shot shell tool the `standard` preset mounts on Windows. */
 export declare const ONE_SHOT_SHELL = "@deepseek-ai/dsh-tool-pwsh";
+/**
+ * The two remedies that look like the fix and are not.
+ *
+ * Both were applied by the reporter of `#7720` before finding the one that
+ * works, and both are the *natural* reach: making yourself the owner and
+ * resetting the directory's ACL are how one normally repairs a Windows
+ * permission problem. They fail here for two different reasons, and naming the
+ * reason is what makes this section worth its lines — a reader who already
+ * tried them learns why, and a reader who has not is spared the attempt. See
+ * {@link nonFixes} for when this is emitted.
+ */
+export declare const NOT_FIXES: readonly ["takeown /F \"<dir>\" /R /D Y", "icacls \"<dir>\" /reset /T /C"];
 /** What the caller knows about the failing call, beyond the failure text. */
 export interface AdvisoryContext {
     /** URL quoted in place of the discussions list; optional. */

package/lib/types/index.d.ts

@@ -4,8 +4,8 @@
  *
  * ## The two failures it recognizes
  *
- * **Workspace provisioning (Windows ACL).** Three reports of one signature
- * (`#7538`, `#7622`, `#7646`) describe the same shape: the host-side write grant
+ * **Workspace provisioning (Windows ACL).** Four reports of one signature
+ * (`#7538`, `#7622`, `#7646`, `#7720`) describe the same shape: the host-side write grant
  * for a sandboxed workspace cannot be applied, every sandboxed command then
  * fails identically **before it runs**, and the error text is a bare Win32 line:
  *
@@ -18,6 +18,13 @@
  * caller `WRITE_OWNER` — never reaches the user, so sessions escape into
  * `danger-full-access` or die on the model's output cap.
  *
+ * `#7720` sharpens where this lands: because the grant is materialized at
+ * sandbox *initialization*, that failure takes **every** shell tool with it, not
+ * one operation — the reporter could not run `netstat` or `icacls` to diagnose
+ * the failure they were looking at. It also contributes the two remedies that
+ * look right and are not (`takeown /R /D Y`, `icacls /reset /T /C`), which the
+ * ACL advisory now names along with the reason each fails.
+ *
  * **Persistent shell startup (#7638).** With the `minimal` preset on Windows the
  * only shell tool is a persistent PTY (`dsh-terminal-bash` +
  * `dsh-tool-pwsh-persistent`), and under a *confining* sandbox mode every call
@@ -59,8 +66,9 @@
  *    failure of a family, the failing tool result is enriched with a user-role
  *    notice. For the ACL family it names the missing right (`WRITE_OWNER` on the
  *    directory, not `SeSecurityPrivilege`), gives the unelevated one-line
- *    `icacls` remedy, and gives the discriminator that separates a Modify-only
- *    directory from a wrong prerequisite. For the PTY family it names the
+ *    `icacls` remedy, gives the discriminator that separates a Modify-only
+ *    directory from a wrong prerequisite, and names the two remedies that look
+ *    right and are not (`takeown`, `icacls /reset`), each with its reason. For the PTY family it names the
  *    combination that fails (persistent PTY × a confining mode), states the
  *    resolved mode, says plainly that no command can fix it, and hands the
  *    user-side preset choice over. Both ride `additionalContexts`, so the model

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@argszero/cordis-plugin-sandbox-grant-advisor",
-  "description": "Turns two sandbox environment failures that name neither their cause nor a remedy into a diagnosis with a path forward. Family 1, the Windows workspace ACL: three reports (#7538, #7622, #7646) of one signature — every sandboxed command fails before it runs with `SetNamedSecurityInfoW failed (Win32 5): grantWrite(<workspace>)`, because the merged DACL + mandatory-label write needs WRITE_OWNER on the directory (an object right the caller can self-grant), not SeSecurityPrivilege and not elevation; the host grant is materialized lazily and caches nothing on the failure path, so the same failure repeats per command. Family 2, the persistent shell (#7638): with the `minimal` preset under a confining sandbox mode every shell call dies instantly with `PTY shell exited during startup` because the terminal backend cannot create the pseudo-console inside the sandbox, retrying never helps, and `minimal` mounts no fallback shell tool. The plugin observes the public `tools/post-execute` waterfall, classifies both signatures narrowly (only the two `...NamedSecurityInfoW` operations; the PTY message matched on a whole line, never as a substring, and only under a mode the policy resolver reports as confining), and attaches ONE durable user-role advisory per agent per family through `additionalContexts`. The ACL advisory names the missing right, the discriminator, and the unelevated `icacls` fix; the PTY advisory names the failing combination, states the resolved mode, tells the model to stop rather than retry, and hands the user-side preset choice over — it never names a shell tool the failing composition does not mount. An optional, off-by-default `enforceAfter` refuses an identical ACL call this plugin has watched fail, bounded by `maxDenials`; the blocking half is ACL-only by design. It never edits an ACL, never elevates, and never changes a preset or a mode, and it complements repeat-guard-escalation, which keys on call identity rather than on the environment signature.",
-  "version": "0.2.0",
+  "description": "Turns two sandbox environment failures that name neither their cause nor a remedy into a diagnosis with a path forward. Family 1, the Windows workspace ACL: four reports (#7538, #7622, #7646, #7720) of one signature — every sandboxed command fails before it runs with `SetNamedSecurityInfoW failed (Win32 5): grantWrite(<workspace>)`, because the merged DACL + mandatory-label write needs WRITE_OWNER on the directory (an object right the caller can self-grant), not SeSecurityPrivilege and not elevation; the host grant is materialized lazily and caches nothing on the failure path, so the same failure repeats per command. Family 2, the persistent shell (#7638): with the `minimal` preset under a confining sandbox mode every shell call dies instantly with `PTY shell exited during startup` because the terminal backend cannot create the pseudo-console inside the sandbox, retrying never helps, and `minimal` mounts no fallback shell tool. The plugin observes the public `tools/post-execute` waterfall, classifies both signatures narrowly (only the two `...NamedSecurityInfoW` operations; the PTY message matched on a whole line, never as a substring, and only under a mode the policy resolver reports as confining), and attaches ONE durable user-role advisory per agent per family through `additionalContexts`. The ACL advisory names the missing right, the discriminator, the unelevated `icacls` fix, and the two remedies that look right and are not (`takeown`, `icacls /reset`), each with the reason it fails; the PTY advisory names the failing combination, states the resolved mode, tells the model to stop rather than retry, and hands the user-side preset choice over — it never names a shell tool the failing composition does not mount. An optional, off-by-default `enforceAfter` refuses an identical ACL call this plugin has watched fail, bounded by `maxDenials`; the blocking half is ACL-only by design. It never edits an ACL, never elevates, and never changes a preset or a mode, and it complements repeat-guard-escalation, which keys on call identity rather than on the environment signature.",
+  "version": "0.3.0",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",