@argszero/cordis-plugin-sandbox-grant-advisor 0.2.0 → 0.4.0

package/README.md

@@ -30,9 +30,22 @@ stuck.
 
 ### 1. Workspace provisioning — the Windows ACL failure (`acl-provisioning`)
 
-Three reports describe this exact line: [discussion #7538], [discussion #7622],
-[discussion #7646]. In each one every sandboxed command fails the same way,
-before it runs, and the error names neither the missing right nor a remedy.
+Six reports describe this exact line: [discussion #7538], [discussion #7622],
+[discussion #7646], [discussion #7720], [discussion #7750], [discussion #7735]
+(the last two on data-volume workspaces, where *no* ACE names the caller at all —
+the inherited `Authenticated Users: Modify` is the whole of their access). In each
+one every sandboxed command fails the same way, before it runs, and the error names
+neither the missing right nor a remedy.
+
+`#7720` is worth reading for where the failure lands: the grant is materialized
+at sandbox **initialization**, so this is not one refused operation but *every*
+shell tool at once — the reporter could not run `netstat` or even `icacls` to
+diagnose the error they were staring at (on `0.1.5-rc.3` the same directory
+worked, because confinement was skipped silently rather than failing closed).
+They also report the two remedies that look right and are not
+(`takeown /F <dir> /R /D Y`, `icacls <dir> /reset /T /C`), which is why the
+advisory names them with the reason each fails instead of leaving the reader to
+discover it.
 
 The Windows backend provisions a workspace by writing the directory's DACL and
 its mandatory-integrity label in **one** `SetNamedSecurityInfoW` call
@@ -55,7 +68,26 @@ Two consequences follow from that one line:
    is the token-privilege form of the same idea, and it is the hypothesis the
    reports naturally reach for — `whoami /priv` cannot tell the two apart,
    because `WRITE_OWNER` is an object right and never appears in that table.
-   Granting Full control to the workspace root needs **no** elevation.
+   Granting `WRITE_OWNER` on the workspace root needs **no** elevation. `#7735`
+   settles the gate with an isolation table on one machine and one unprivileged
+   account: the label write succeeds with Full control *or with Take-ownership
+   alone*, and fails with `ChangePermissions`, `ReadPermissions` or `Modify`
+   alone — so the gate is `WRITE_OWNER` and nothing else.
+3. **The remedy is the narrowest form of that right.** The advisory recommends
+   `icacls <dir> /grant "<user>:(OI)(CI)(WO)"` — `WO` *is* `WRITE_OWNER`, i.e.
+   literally the right the documented prerequisite names, so the one-liner grants
+   nothing the harness did not ask for — and offers Full control second, as the
+   same line with `F` in place of `(WO)`. Both assume the caller owns the
+   directory: owner-implicit rights cover the DACL half of the merged write.
+4. **The version boundary is stated, because the error cannot carry it.** Up to
+   `0.1.6-alpha.x` the backend's `SetNamedSecurityInfoW` wrote the DACL only
+   (flag 4) and a Modify-only workspace provisioned fine; the mandatory label —
+   and with it the SACL, flag 20 — arrives in `0.1.7-alpha.1`. So the same string
+   on an older line belongs to a different cause space, and the natural reach
+   (downgrade to the build that "worked") is refused with its reason: the label is
+   what confines deletes to the workspace, and reverting it reintroduces the
+   escape it closed. `#7750` asks for exactly this and explains why it is a
+   usability regression traded for a security fix.
 
 The grant is materialized lazily, on the first confined call, and **nothing is
 cached when it throws** — so the same failure repeats per command (850 calls
@@ -73,12 +105,24 @@ What was reported:
 Why it is refused while the directory looks writable: that call is a MERGED write ...
   ... the label half additionally needs WRITE_OWNER on the directory. ...
 
+A version boundary worth knowing before reaching for an older build: the label half is new to this package.
+Up to `0.1.6-alpha.x` the backend touched the DACL only (flag 4) ... `0.1.7-alpha.1` is where the mandatory
+label — and with it the SACL, flag 20 — arrives. ... Rolling back is not the fix either: the label is what
+confines deletes to the workspace, and reverting it reintroduces the escape it closed.
+
 Confirm the cause (unelevated) — `icacls` is a normal user command:
   icacls "D:\ws"
 
 Fix it (unelevated, one line) and then run the command again:
-  PowerShell: icacls "D:\ws" /grant "$env:USERNAME:(OI)(CI)F"
-  cmd:        icacls "D:\ws" /grant "%USERNAME%:(OI)(CI)F"
+  PowerShell: icacls "D:\ws" /grant "$env:USERNAME:(OI)(CI)(WO)"
+  cmd:        icacls "D:\ws" /grant "%USERNAME%:(OI)(CI)(WO)"
+
+What will NOT fix it — both look like the right move, and both were tried and reported:
+  takeown /F "D:\ws" /R /D Y
+    makes you the owner, but ownership's implicit rights are READ_CONTROL and WRITE_DAC only.
+    The owner does not implicitly hold WRITE_OWNER, which is the right this call needs.
+  icacls "D:\ws" /reset /T /C
+    restores inheritance, and inheritance is what supplied the Modify-only ACE above.
 ```
 
 ### 2. Persistent shell startup (`pty-startup`)
@@ -277,6 +321,12 @@ than one that stays silent.
   replace it.** That guard keys on **call identity** (identical arguments
   retried); this one keys on the **environment signature**, which is how several
   *different* commands share one cause. Mounting both is sensible.
+- **The plugin cannot see the launcher half of `#7735`.** The Low label's other
+  side effect — the shell's publisher confirmation before launching a
+  Low-integrity `.bat`/`.cmd`/`.exe` — never appears in a tool result, so it is
+  outside the seam this plugin subscribes to. The report and its proposed fix
+  stay with the maintainers; all this plugin can do is explain the provisioning
+  failure that shares its root.
 - **The real fix is upstream, in both families.** For the ACL failure,
   `grantWrite` already computes `hasExactGrant` / `hasExactDeny` /
   `hasExactLabel` and discards which one was false, so the diagnostic that turns
@@ -307,11 +357,19 @@ composition that does not mount the service degrades to silence instead of
 failing to load. See `src/mode.ts`.
 
 Probed at the newest build of every line the range admits — `0.1.2-rc.1`,
-`0.1.3-alpha.2`, `0.1.5-rc.3`, `0.1.6-alpha.2`, `0.1.7-rc.1` (the build the third
-report ran) — with `npm run test:probe-lines`, which derives those builds from
-this range, installs each one from the registry into a scratch tree and runs the
-suite against it. A line whose probe fails is removed from the range rather than
-left claimed.
+`0.1.3-alpha.2`, `0.1.5-rc.3`, `0.1.6-alpha.2`, `0.1.7-rc.2` (the newest build of
+the line the later Windows reports ran on) — with `npm run test:probe-lines`,
+which derives those builds from this range, installs each one from the registry
+into a scratch tree and runs the suite against it. `0.1.7-rc.1`, the build the
+third report ran, is admitted by the same `||` segment and was probed while it was
+the newest of that line.
+
+The whole set is re-probed whenever this package's source changes rather than
+carried over from an earlier version: the range is a claim about *this* build of
+the plugin, so `0.4.0` re-ran all five lines above. A line whose probe fails is
+removed from the range rather than left claimed. The scratch tree's resolved
+versions are the ones to read back when a probe is quoted as evidence — the probe
+script pins them by exact version, and `--keep` leaves the tree in place to check.
 
 ## Development
 
@@ -338,4 +396,7 @@ the current runtime cannot distinguish rather than counting it as a pass.
 [discussion #7538]: https://github.com/deepseek-ai/deepseek-harness/discussions/7538
 [discussion #7622]: https://github.com/deepseek-ai/deepseek-harness/discussions/7622
 [discussion #7646]: https://github.com/deepseek-ai/deepseek-harness/discussions/7646
+[discussion #7720]: https://github.com/deepseek-ai/deepseek-harness/discussions/7720
+[discussion #7750]: https://github.com/deepseek-ai/deepseek-harness/discussions/7750
+[discussion #7735]: https://github.com/deepseek-ai/deepseek-harness/discussions/7735
 [discussion #7638]: https://github.com/deepseek-ai/deepseek-harness/discussions/7638

package/lib/advice.js

@@ -13,6 +13,13 @@
  *   the caller can grant itself with `icacls`, unelevated. It is **not**
  *   `SeSecurityPrivilege`, the token privilege the reports naturally reach for;
  *   `whoami /priv` cannot show the difference, and elevation is the wrong lever.
+ *   The remedy is the **narrowest** form of that grant — `(WO)` alone, which is
+ *   literally the right the backend's prerequisite names — with Full control
+ *   offered as the broad alternative; and the advisory carries the **version
+ *   boundary** the label introduced (`0.1.7-alpha.1`), because that is what
+ *   separates "this is the label failure" from "this is something else", and
+ *   because rolling back is the reach it invites while making the very problem
+ *   it closed come back.
  * - **The persistent-shell failure** (`pty-startup`) is *not* fixable by the
  *   caller — least of all by the model, which has no shell to run anything in.
  *   So its advice says so and stops: the remedy is a user-side preset choice,
@@ -33,7 +40,7 @@
  */
 import { failureLine } from './signature.js';
 /** The upstream threads the ACL advisory is a stopgap for. */
-export const ACL_DISCUSSIONS = '#7538 / #7622 / #7646';
+export const ACL_DISCUSSIONS = '#7538 / #7622 / #7646 / #7720 / #7750 / #7735';
 /** The upstream thread the persistent-shell advisory is a stopgap for. */
 export const PTY_DISCUSSIONS = '#7638';
 /** The documented prerequisite, quoted from the backend's README. */
@@ -57,6 +64,21 @@ export const GLOBAL_PATCH = '$DSH_HOME/cordis.patch.yml';
 export const MINIMAL_PRESET_ROW = 'preset-minimal';
 /** The one-shot shell tool the `standard` preset mounts on Windows. */
 export const ONE_SHOT_SHELL = '@deepseek-ai/dsh-tool-pwsh';
+/**
+ * The two remedies that look like the fix and are not.
+ *
+ * Both were applied by the reporter of `#7720` before finding the one that
+ * works, and both are the *natural* reach: making yourself the owner and
+ * resetting the directory's ACL are how one normally repairs a Windows
+ * permission problem. They fail here for two different reasons, and naming the
+ * reason is what makes this section worth its lines — a reader who already
+ * tried them learns why, and a reader who has not is spared the attempt. See
+ * {@link nonFixes} for when this is emitted.
+ */
+export const NOT_FIXES = [
+    'takeown /F "<dir>" /R /D Y',
+    'icacls "<dir>" /reset /T /C',
+];
 /** Placeholder the user replaces with the directory the error named. */
 const PLACEHOLDER = '<the directory from the error line above>';
 /**
@@ -72,7 +94,10 @@ function diagnosis(failure) {
                 'mandatory-integrity label go out as one `SetNamedSecurityInfoW`. The label lives in the SACL, and the',
                 "owner's implicit rights cover only READ_CONTROL and WRITE_DAC, so the label half additionally needs",
                 'WRITE_OWNER on the directory. A workspace created with `mkdir` normally inherits',
-                '"Authenticated Users: Modify" (`0x1301bf`) from the drive root — and that mask has neither right.',
+                '"Authenticated Users: Modify" (`0x1301bf`) from the drive root — and that mask has neither right; on a data',
+                'volume there may be no ACE naming you at all, so that inherited entry is the whole of your access. The two',
+                'halves go out as one call, so a refused label discards the write grant with it, and the sandbox then',
+                'refuses to start any command in the workspace instead of running it unconfined.',
                 'This is a directory ACL fact, not a token privilege: `whoami /priv` will not show it, and',
                 'SeSecurityPrivilege is the wrong lever here.',
             ].join('\n');
@@ -91,6 +116,59 @@ function diagnosis(failure) {
             ].join('\n');
     }
 }
+/**
+ * The "this is not the fix" lines for one class of failure.
+ *
+ * Emitted only for `apply-denied`, the class whose whole diagnosis is the
+ * missing `WRITE_OWNER` right — because only there is the claim true:
+ *
+ * - `read-denied` wants `READ_CONTROL`, and taking ownership *does* carry it,
+ *   so calling `takeown` a non-fix there would be false.
+ * - `apply-other` already says the missing-rights story does not apply
+ *   verbatim, so a section that presupposes it would contradict its own
+ *   diagnosis.
+ *
+ * A negative claim still has to be earned: the failure to avoid is advice that
+ * is confidently wrong in the other direction.
+ * @param failure - the recognized provisioning failure.
+ * @param path - the directory the error named, or the placeholder.
+ * @returns the section's lines, or an empty array for a class it does not fit.
+ */
+function nonFixes(failure, path) {
+    if (failure.klass !== 'apply-denied')
+        return [];
+    return [
+        'What will NOT fix it — both look like the right move, and both were tried and reported:',
+        `  takeown /F "${path}" /R /D Y`,
+        "    makes you the owner, but ownership's implicit rights are READ_CONTROL and WRITE_DAC only.",
+        '    The owner does not implicitly hold WRITE_OWNER, which is the right this call needs.',
+        `  icacls "${path}" /reset /T /C`,
+        '    restores inheritance, and inheritance is what supplied the Modify-only ACE above.',
+        '',
+    ];
+}
+/**
+ * When the label half arrived, and why an older build is not the remedy.
+ *
+ * Emitted for every class: the boundary is a fact about the package
+ * `sandbox-windows-acl` (whose `DACL_SECURITY_INFORMATION | LABEL_SECURITY_INFORMATION`
+ * flag is what needs `WRITE_OWNER`), not about which of its two calls failed, so
+ * it is true wherever this module is willing to speak at all. It is also the one
+ * fact neither report could get from the error: the failure looks identical on a
+ * line where the label does not exist yet, and the build that introduced it is
+ * the natural thing to reach for and the wrong one to reach for.
+ * @returns the section's lines.
+ */
+function versionBoundary() {
+    return [
+        'A version boundary worth knowing before reaching for an older build: the label half is new to this package.',
+        'Up to `0.1.6-alpha.x` the backend touched the DACL only (flag 4), so a Modify-only workspace provisioned',
+        'fine; `0.1.7-alpha.1` is where the mandatory label — and with it the SACL, flag 20 — arrives. On a',
+        '`0.1.6-alpha.x`-or-older line this exact failure therefore belongs to a different cause space, while on any',
+        '`0.1.7-*` line it is this one. Rolling back is not the fix either: the label is what confines deletes to the',
+        'workspace, and reverting it reintroduces the escape it closed.',
+    ].join('\n');
+}
 /**
  * Build the advisory attached to the failing tool result.
  *
@@ -128,15 +206,27 @@ function aclAdvisory(failure, href) {
         '',
         diagnosis(failure),
         '',
+        versionBoundary(),
+        '',
         'Confirm the cause (unelevated) — `icacls` is a normal user command:',
         `  icacls "${path}"`,
-        'Look for an ACE that names YOUR OWN account (run `whoami` if unsure) with (F) / Full control.',
-        'If the strongest entry naming you is (M) / Modify, that is this failure.',
+        'Look for an ACE that names YOUR OWN account (run `whoami` if unsure) with (F) / Full control or',
+        '(WO) / Write owner. If the strongest entry naming you is (M) / Modify — or no entry names you at all and',
+        'your access comes from an inherited `Authenticated Users:(M)` — that is this failure.',
         '',
         'Fix it (unelevated, one line) and then run the command again:',
-        `  PowerShell: icacls "${path}" /grant "$env:USERNAME:(OI)(CI)F"`,
-        `  cmd:        icacls "${path}" /grant "%USERNAME%:(OI)(CI)F"`,
+        `  PowerShell: icacls "${path}" /grant "$env:USERNAME:(OI)(CI)(WO)"`,
+        `  cmd:        icacls "${path}" /grant "%USERNAME%:(OI)(CI)(WO)"`,
+        'WRITE_OWNER is exactly the right the prerequisite names, so this grants nothing the harness did not ask for,',
+        'and (OI)(CI) makes the ACE inheritable, so one command reaches the workspace\'s existing subdirectories.',
+        'Full control works just as well — the same line with `F` in place of `(WO)`:',
+        `  icacls "${path}" /grant "$env:USERNAME:(OI)(CI)F"`,
+        'Both assume you own the directory: owner-implicit rights cover the DACL half of the merged write, so',
+        'WRITE_OWNER is the single missing piece. A directory owned by someone else is a bigger change than a',
+        'one-liner — that is the harness\'s documented prerequisite, and it is why this failure is loud instead of',
+        'silently skipped.',
         '',
+        ...nonFixes(failure, path),
         'How to read this: the harness documents the prerequisite (' + PREREQUISITE + ') and this',
         'error does not name it yet, so the advice is delivered here instead. This is a stopgap, ' + where + '.',
         'What it is NOT: this plugin neither edits ACLs nor elevates — the command above is yours to run.',
@@ -219,7 +309,7 @@ export function denialText(failure, observed, denial, maxDenials) {
         '',
         'Retrying cannot succeed — the sandbox cannot start a command until the directory grant applies.',
         'Stop, and either apply the fix or hand the problem to the user:',
-        failure.path === undefined ? '' : `  icacls "${failure.path}" /grant "$env:USERNAME:(OI)(CI)F"`,
+        failure.path === undefined ? '' : `  icacls "${failure.path}" /grant "$env:USERNAME:(OI)(CI)(WO)"`,
         '',
         suffix > 0
             ? `This is automatic block ${String(denial)} of ${String(maxDenials)}; after that the call is allowed again.`

package/lib/index.js

@@ -4,8 +4,8 @@
  *
  * ## The two failures it recognizes
  *
- * **Workspace provisioning (Windows ACL).** Three reports of one signature
- * (`#7538`, `#7622`, `#7646`) describe the same shape: the host-side write grant
+ * **Workspace provisioning (Windows ACL).** Four reports of one signature
+ * (`#7538`, `#7622`, `#7646`, `#7720`) describe the same shape: the host-side write grant
  * for a sandboxed workspace cannot be applied, every sandboxed command then
  * fails identically **before it runs**, and the error text is a bare Win32 line:
  *
@@ -18,6 +18,13 @@
  * caller `WRITE_OWNER` — never reaches the user, so sessions escape into
  * `danger-full-access` or die on the model's output cap.
  *
+ * `#7720` sharpens where this lands: because the grant is materialized at
+ * sandbox *initialization*, that failure takes **every** shell tool with it, not
+ * one operation — the reporter could not run `netstat` or `icacls` to diagnose
+ * the failure they were looking at. It also contributes the two remedies that
+ * look right and are not (`takeown /R /D Y`, `icacls /reset /T /C`), which the
+ * ACL advisory now names along with the reason each fails.
+ *
  * **Persistent shell startup (#7638).** With the `minimal` preset on Windows the
  * only shell tool is a persistent PTY (`dsh-terminal-bash` +
  * `dsh-tool-pwsh-persistent`), and under a *confining* sandbox mode every call
@@ -59,8 +66,9 @@
  *    failure of a family, the failing tool result is enriched with a user-role
  *    notice. For the ACL family it names the missing right (`WRITE_OWNER` on the
  *    directory, not `SeSecurityPrivilege`), gives the unelevated one-line
- *    `icacls` remedy, and gives the discriminator that separates a Modify-only
- *    directory from a wrong prerequisite. For the PTY family it names the
+ *    `icacls` remedy, gives the discriminator that separates a Modify-only
+ *    directory from a wrong prerequisite, and names the two remedies that look
+ *    right and are not (`takeown`, `icacls /reset`), each with its reason. For the PTY family it names the
  *    combination that fails (persistent PTY × a confining mode), states the
  *    resolved mode, says plainly that no command can fix it, and hands the
  *    user-side preset choice over. Both ride `additionalContexts`, so the model

package/lib/signature.js

@@ -30,6 +30,21 @@
  *   the advisory can quote the exact line the model and the user are looking
  *   at, and the path can be re-used in the fix command.
  *
+ * One signature covers two environments, and the text is identical in both, so
+ * the classifier cannot and must not try to tell them apart: a workspace the
+ * caller created with `mkdir` that inherits "Authenticated Users: Modify" from
+ * the drive root (`#7622`, `#7646`, `#7720`), and a directory on a data volume
+ * where **no ACE names the caller at all** so that the inherited entry is the
+ * whole of their access (`#7750` on D:/E:, `#7735`'s second defect). Both are
+ * the same gate — `WRITE_OWNER` on the directory — and the same one-line remedy
+ * satisfies both, which is why they share a class and the advisory names both
+ * shapes instead of guessing which one it is looking at. What the text *does*
+ * carry that the failure does not is the version boundary: the merged
+ * DACL + label write exists only from `0.1.7-alpha.1` on
+ * (`packages/sandbox/sandbox-windows-acl/src/acl.ts`, flag
+ * `DACL_SECURITY_INFORMATION | LABEL_SECURITY_INFORMATION`), so on an older line
+ * the same string belongs to a different cause space.
+ *
  * ## The persistent-shell startup failure (`pty-startup`)
  *
  * `dsh-terminal-bash` throws `PTY shell exited during startup` when the shell

package/lib/types/advice.d.ts

@@ -13,6 +13,13 @@
  *   the caller can grant itself with `icacls`, unelevated. It is **not**
  *   `SeSecurityPrivilege`, the token privilege the reports naturally reach for;
  *   `whoami /priv` cannot show the difference, and elevation is the wrong lever.
+ *   The remedy is the **narrowest** form of that grant — `(WO)` alone, which is
+ *   literally the right the backend's prerequisite names — with Full control
+ *   offered as the broad alternative; and the advisory carries the **version
+ *   boundary** the label introduced (`0.1.7-alpha.1`), because that is what
+ *   separates "this is the label failure" from "this is something else", and
+ *   because rolling back is the reach it invites while making the very problem
+ *   it closed come back.
  * - **The persistent-shell failure** (`pty-startup`) is *not* fixable by the
  *   caller — least of all by the model, which has no shell to run anything in.
  *   So its advice says so and stops: the remedy is a user-side preset choice,
@@ -34,7 +41,7 @@
 import type { ProvisioningFailure, RecognizedFailure } from './signature.js';
 import type { SandboxModeName } from './mode.js';
 /** The upstream threads the ACL advisory is a stopgap for. */
-export declare const ACL_DISCUSSIONS = "#7538 / #7622 / #7646";
+export declare const ACL_DISCUSSIONS = "#7538 / #7622 / #7646 / #7720 / #7750 / #7735";
 /** The upstream thread the persistent-shell advisory is a stopgap for. */
 export declare const PTY_DISCUSSIONS = "#7638";
 /** The documented prerequisite, quoted from the backend's README. */
@@ -58,6 +65,18 @@ export declare const GLOBAL_PATCH = "$DSH_HOME/cordis.patch.yml";
 export declare const MINIMAL_PRESET_ROW = "preset-minimal";
 /** The one-shot shell tool the `standard` preset mounts on Windows. */
 export declare const ONE_SHOT_SHELL = "@deepseek-ai/dsh-tool-pwsh";
+/**
+ * The two remedies that look like the fix and are not.
+ *
+ * Both were applied by the reporter of `#7720` before finding the one that
+ * works, and both are the *natural* reach: making yourself the owner and
+ * resetting the directory's ACL are how one normally repairs a Windows
+ * permission problem. They fail here for two different reasons, and naming the
+ * reason is what makes this section worth its lines — a reader who already
+ * tried them learns why, and a reader who has not is spared the attempt. See
+ * {@link nonFixes} for when this is emitted.
+ */
+export declare const NOT_FIXES: readonly ["takeown /F \"<dir>\" /R /D Y", "icacls \"<dir>\" /reset /T /C"];
 /** What the caller knows about the failing call, beyond the failure text. */
 export interface AdvisoryContext {
     /** URL quoted in place of the discussions list; optional. */

package/lib/types/index.d.ts

@@ -4,8 +4,8 @@
  *
  * ## The two failures it recognizes
  *
- * **Workspace provisioning (Windows ACL).** Three reports of one signature
- * (`#7538`, `#7622`, `#7646`) describe the same shape: the host-side write grant
+ * **Workspace provisioning (Windows ACL).** Four reports of one signature
+ * (`#7538`, `#7622`, `#7646`, `#7720`) describe the same shape: the host-side write grant
  * for a sandboxed workspace cannot be applied, every sandboxed command then
  * fails identically **before it runs**, and the error text is a bare Win32 line:
  *
@@ -18,6 +18,13 @@
  * caller `WRITE_OWNER` — never reaches the user, so sessions escape into
  * `danger-full-access` or die on the model's output cap.
  *
+ * `#7720` sharpens where this lands: because the grant is materialized at
+ * sandbox *initialization*, that failure takes **every** shell tool with it, not
+ * one operation — the reporter could not run `netstat` or `icacls` to diagnose
+ * the failure they were looking at. It also contributes the two remedies that
+ * look right and are not (`takeown /R /D Y`, `icacls /reset /T /C`), which the
+ * ACL advisory now names along with the reason each fails.
+ *
  * **Persistent shell startup (#7638).** With the `minimal` preset on Windows the
  * only shell tool is a persistent PTY (`dsh-terminal-bash` +
  * `dsh-tool-pwsh-persistent`), and under a *confining* sandbox mode every call
@@ -59,8 +66,9 @@
  *    failure of a family, the failing tool result is enriched with a user-role
  *    notice. For the ACL family it names the missing right (`WRITE_OWNER` on the
  *    directory, not `SeSecurityPrivilege`), gives the unelevated one-line
- *    `icacls` remedy, and gives the discriminator that separates a Modify-only
- *    directory from a wrong prerequisite. For the PTY family it names the
+ *    `icacls` remedy, gives the discriminator that separates a Modify-only
+ *    directory from a wrong prerequisite, and names the two remedies that look
+ *    right and are not (`takeown`, `icacls /reset`), each with its reason. For the PTY family it names the
  *    combination that fails (persistent PTY × a confining mode), states the
  *    resolved mode, says plainly that no command can fix it, and hands the
  *    user-side preset choice over. Both ride `additionalContexts`, so the model

package/lib/types/signature.d.ts

@@ -30,6 +30,21 @@
  *   the advisory can quote the exact line the model and the user are looking
  *   at, and the path can be re-used in the fix command.
  *
+ * One signature covers two environments, and the text is identical in both, so
+ * the classifier cannot and must not try to tell them apart: a workspace the
+ * caller created with `mkdir` that inherits "Authenticated Users: Modify" from
+ * the drive root (`#7622`, `#7646`, `#7720`), and a directory on a data volume
+ * where **no ACE names the caller at all** so that the inherited entry is the
+ * whole of their access (`#7750` on D:/E:, `#7735`'s second defect). Both are
+ * the same gate — `WRITE_OWNER` on the directory — and the same one-line remedy
+ * satisfies both, which is why they share a class and the advisory names both
+ * shapes instead of guessing which one it is looking at. What the text *does*
+ * carry that the failure does not is the version boundary: the merged
+ * DACL + label write exists only from `0.1.7-alpha.1` on
+ * (`packages/sandbox/sandbox-windows-acl/src/acl.ts`, flag
+ * `DACL_SECURITY_INFORMATION | LABEL_SECURITY_INFORMATION`), so on an older line
+ * the same string belongs to a different cause space.
+ *
  * ## The persistent-shell startup failure (`pty-startup`)
  *
  * `dsh-terminal-bash` throws `PTY shell exited during startup` when the shell
@@ -56,7 +71,13 @@
  */
 /** Which provisioning operation failed, and which diagnosis follows from it. */
 export type FailureClass = 
-/** `SetNamedSecurityInfoW` returned `ERROR_ACCESS_DENIED` (5): the merged DACL + label write was refused. */
+/**
+ * `SetNamedSecurityInfoW` returned `ERROR_ACCESS_DENIED` (5): the merged
+ * DACL + label write was refused. Both environments in the module doc land
+ * here — the `mkdir`-inherited Modify workspace and the data-volume directory
+ * with no ACE naming the caller — because the failure text cannot separate
+ * them and the remedy is the same `WRITE_OWNER` grant.
+ */
 'apply-denied'
 /** `SetNamedSecurityInfoW` failed with a Win32 code other than `ERROR_ACCESS_DENIED`. */
  | 'apply-other'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@argszero/cordis-plugin-sandbox-grant-advisor",
-  "description": "Turns two sandbox environment failures that name neither their cause nor a remedy into a diagnosis with a path forward. Family 1, the Windows workspace ACL: three reports (#7538, #7622, #7646) of one signature — every sandboxed command fails before it runs with `SetNamedSecurityInfoW failed (Win32 5): grantWrite(<workspace>)`, because the merged DACL + mandatory-label write needs WRITE_OWNER on the directory (an object right the caller can self-grant), not SeSecurityPrivilege and not elevation; the host grant is materialized lazily and caches nothing on the failure path, so the same failure repeats per command. Family 2, the persistent shell (#7638): with the `minimal` preset under a confining sandbox mode every shell call dies instantly with `PTY shell exited during startup` because the terminal backend cannot create the pseudo-console inside the sandbox, retrying never helps, and `minimal` mounts no fallback shell tool. The plugin observes the public `tools/post-execute` waterfall, classifies both signatures narrowly (only the two `...NamedSecurityInfoW` operations; the PTY message matched on a whole line, never as a substring, and only under a mode the policy resolver reports as confining), and attaches ONE durable user-role advisory per agent per family through `additionalContexts`. The ACL advisory names the missing right, the discriminator, and the unelevated `icacls` fix; the PTY advisory names the failing combination, states the resolved mode, tells the model to stop rather than retry, and hands the user-side preset choice over — it never names a shell tool the failing composition does not mount. An optional, off-by-default `enforceAfter` refuses an identical ACL call this plugin has watched fail, bounded by `maxDenials`; the blocking half is ACL-only by design. It never edits an ACL, never elevates, and never changes a preset or a mode, and it complements repeat-guard-escalation, which keys on call identity rather than on the environment signature.",
-  "version": "0.2.0",
+  "description": "Turns two sandbox environment failures that name neither their cause nor a remedy into a diagnosis with a path forward. Family 1, the Windows workspace ACL: six reports (#7538, #7622, #7646, #7720, #7750, #7735) of one signature — every sandboxed command fails before it runs with `SetNamedSecurityInfoW failed (Win32 5): grantWrite(<workspace>)`, because the merged DACL + mandatory-label write needs WRITE_OWNER on the directory (an object right the caller can self-grant), not SeSecurityPrivilege and not elevation; the host grant is materialized lazily and caches nothing on the failure path, so the same failure repeats per command. Family 2, the persistent shell (#7638): with the `minimal` preset under a confining sandbox mode every shell call dies instantly with `PTY shell exited during startup` because the terminal backend cannot create the pseudo-console inside the sandbox, retrying never helps, and `minimal` mounts no fallback shell tool. The plugin observes the public `tools/post-execute` waterfall, classifies both signatures narrowly (only the two `...NamedSecurityInfoW` operations; the PTY message matched on a whole line, never as a substring, and only under a mode the policy resolver reports as confining), and attaches ONE durable user-role advisory per agent per family through `additionalContexts`. The ACL advisory names the missing right, both environments the identical text can describe (an inherited Modify-only entry, and a data volume where no ACE names the caller at all), the version boundary that arrived with the mandatory label (0.1.7-alpha.1, flag 20, versus the DACL-only flag 4 up to 0.1.6-alpha.x) together with why downgrading is not the remedy, the discriminator, the unelevated `icacls ... :(OI)(CI)(WO)` fix — the narrowest form of the exact right the backend's prerequisite names, with Full control offered second — and the two remedies that look right and are not (`takeown`, `icacls /reset`), each with the reason it fails; the PTY advisory names the failing combination, states the resolved mode, tells the model to stop rather than retry, and hands the user-side preset choice over — it never names a shell tool the failing composition does not mount. An optional, off-by-default `enforceAfter` refuses an identical ACL call this plugin has watched fail, bounded by `maxDenials`; the blocking half is ACL-only by design. It never edits an ACL, never elevates, and never changes a preset or a mode, and it complements repeat-guard-escalation, which keys on call identity rather than on the environment signature.",
+  "version": "0.4.0",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",