@argszero/cordis-plugin-sandbox-grant-advisor 0.3.0 → 0.4.0

package/README.md

@@ -30,10 +30,12 @@ stuck.
 
 ### 1. Workspace provisioning — the Windows ACL failure (`acl-provisioning`)
 
-Four reports describe this exact line: [discussion #7538], [discussion #7622],
-[discussion #7646], [discussion #7720]. In each one every sandboxed command fails
-the same way, before it runs, and the error names neither the missing right nor
-a remedy.
+Six reports describe this exact line: [discussion #7538], [discussion #7622],
+[discussion #7646], [discussion #7720], [discussion #7750], [discussion #7735]
+(the last two on data-volume workspaces, where *no* ACE names the caller at all —
+the inherited `Authenticated Users: Modify` is the whole of their access). In each
+one every sandboxed command fails the same way, before it runs, and the error names
+neither the missing right nor a remedy.
 
 `#7720` is worth reading for where the failure lands: the grant is materialized
 at sandbox **initialization**, so this is not one refused operation but *every*
@@ -66,7 +68,26 @@ Two consequences follow from that one line:
    is the token-privilege form of the same idea, and it is the hypothesis the
    reports naturally reach for — `whoami /priv` cannot tell the two apart,
    because `WRITE_OWNER` is an object right and never appears in that table.
-   Granting Full control to the workspace root needs **no** elevation.
+   Granting `WRITE_OWNER` on the workspace root needs **no** elevation. `#7735`
+   settles the gate with an isolation table on one machine and one unprivileged
+   account: the label write succeeds with Full control *or with Take-ownership
+   alone*, and fails with `ChangePermissions`, `ReadPermissions` or `Modify`
+   alone — so the gate is `WRITE_OWNER` and nothing else.
+3. **The remedy is the narrowest form of that right.** The advisory recommends
+   `icacls <dir> /grant "<user>:(OI)(CI)(WO)"` — `WO` *is* `WRITE_OWNER`, i.e.
+   literally the right the documented prerequisite names, so the one-liner grants
+   nothing the harness did not ask for — and offers Full control second, as the
+   same line with `F` in place of `(WO)`. Both assume the caller owns the
+   directory: owner-implicit rights cover the DACL half of the merged write.
+4. **The version boundary is stated, because the error cannot carry it.** Up to
+   `0.1.6-alpha.x` the backend's `SetNamedSecurityInfoW` wrote the DACL only
+   (flag 4) and a Modify-only workspace provisioned fine; the mandatory label —
+   and with it the SACL, flag 20 — arrives in `0.1.7-alpha.1`. So the same string
+   on an older line belongs to a different cause space, and the natural reach
+   (downgrade to the build that "worked") is refused with its reason: the label is
+   what confines deletes to the workspace, and reverting it reintroduces the
+   escape it closed. `#7750` asks for exactly this and explains why it is a
+   usability regression traded for a security fix.
 
 The grant is materialized lazily, on the first confined call, and **nothing is
 cached when it throws** — so the same failure repeats per command (850 calls
@@ -84,12 +105,17 @@ What was reported:
 Why it is refused while the directory looks writable: that call is a MERGED write ...
   ... the label half additionally needs WRITE_OWNER on the directory. ...
 
+A version boundary worth knowing before reaching for an older build: the label half is new to this package.
+Up to `0.1.6-alpha.x` the backend touched the DACL only (flag 4) ... `0.1.7-alpha.1` is where the mandatory
+label — and with it the SACL, flag 20 — arrives. ... Rolling back is not the fix either: the label is what
+confines deletes to the workspace, and reverting it reintroduces the escape it closed.
+
 Confirm the cause (unelevated) — `icacls` is a normal user command:
   icacls "D:\ws"
 
 Fix it (unelevated, one line) and then run the command again:
-  PowerShell: icacls "D:\ws" /grant "$env:USERNAME:(OI)(CI)F"
-  cmd:        icacls "D:\ws" /grant "%USERNAME%:(OI)(CI)F"
+  PowerShell: icacls "D:\ws" /grant "$env:USERNAME:(OI)(CI)(WO)"
+  cmd:        icacls "D:\ws" /grant "%USERNAME%:(OI)(CI)(WO)"
 
 What will NOT fix it — both look like the right move, and both were tried and reported:
   takeown /F "D:\ws" /R /D Y
@@ -295,6 +321,12 @@ than one that stays silent.
   replace it.** That guard keys on **call identity** (identical arguments
   retried); this one keys on the **environment signature**, which is how several
   *different* commands share one cause. Mounting both is sensible.
+- **The plugin cannot see the launcher half of `#7735`.** The Low label's other
+  side effect — the shell's publisher confirmation before launching a
+  Low-integrity `.bat`/`.cmd`/`.exe` — never appears in a tool result, so it is
+  outside the seam this plugin subscribes to. The report and its proposed fix
+  stay with the maintainers; all this plugin can do is explain the provisioning
+  failure that shares its root.
 - **The real fix is upstream, in both families.** For the ACL failure,
   `grantWrite` already computes `hasExactGrant` / `hasExactDeny` /
   `hasExactLabel` and discards which one was false, so the diagnostic that turns
@@ -325,11 +357,19 @@ composition that does not mount the service degrades to silence instead of
 failing to load. See `src/mode.ts`.
 
 Probed at the newest build of every line the range admits — `0.1.2-rc.1`,
-`0.1.3-alpha.2`, `0.1.5-rc.3`, `0.1.6-alpha.2`, `0.1.7-rc.1` (the build the third
-report ran) — with `npm run test:probe-lines`, which derives those builds from
-this range, installs each one from the registry into a scratch tree and runs the
-suite against it. A line whose probe fails is removed from the range rather than
-left claimed.
+`0.1.3-alpha.2`, `0.1.5-rc.3`, `0.1.6-alpha.2`, `0.1.7-rc.2` (the newest build of
+the line the later Windows reports ran on) — with `npm run test:probe-lines`,
+which derives those builds from this range, installs each one from the registry
+into a scratch tree and runs the suite against it. `0.1.7-rc.1`, the build the
+third report ran, is admitted by the same `||` segment and was probed while it was
+the newest of that line.
+
+The whole set is re-probed whenever this package's source changes rather than
+carried over from an earlier version: the range is a claim about *this* build of
+the plugin, so `0.4.0` re-ran all five lines above. A line whose probe fails is
+removed from the range rather than left claimed. The scratch tree's resolved
+versions are the ones to read back when a probe is quoted as evidence — the probe
+script pins them by exact version, and `--keep` leaves the tree in place to check.
 
 ## Development
 
@@ -357,4 +397,6 @@ the current runtime cannot distinguish rather than counting it as a pass.
 [discussion #7622]: https://github.com/deepseek-ai/deepseek-harness/discussions/7622
 [discussion #7646]: https://github.com/deepseek-ai/deepseek-harness/discussions/7646
 [discussion #7720]: https://github.com/deepseek-ai/deepseek-harness/discussions/7720
+[discussion #7750]: https://github.com/deepseek-ai/deepseek-harness/discussions/7750
+[discussion #7735]: https://github.com/deepseek-ai/deepseek-harness/discussions/7735
 [discussion #7638]: https://github.com/deepseek-ai/deepseek-harness/discussions/7638

package/lib/advice.js

@@ -13,6 +13,13 @@
  *   the caller can grant itself with `icacls`, unelevated. It is **not**
  *   `SeSecurityPrivilege`, the token privilege the reports naturally reach for;
  *   `whoami /priv` cannot show the difference, and elevation is the wrong lever.
+ *   The remedy is the **narrowest** form of that grant — `(WO)` alone, which is
+ *   literally the right the backend's prerequisite names — with Full control
+ *   offered as the broad alternative; and the advisory carries the **version
+ *   boundary** the label introduced (`0.1.7-alpha.1`), because that is what
+ *   separates "this is the label failure" from "this is something else", and
+ *   because rolling back is the reach it invites while making the very problem
+ *   it closed come back.
  * - **The persistent-shell failure** (`pty-startup`) is *not* fixable by the
  *   caller — least of all by the model, which has no shell to run anything in.
  *   So its advice says so and stops: the remedy is a user-side preset choice,
@@ -33,7 +40,7 @@
  */
 import { failureLine } from './signature.js';
 /** The upstream threads the ACL advisory is a stopgap for. */
-export const ACL_DISCUSSIONS = '#7538 / #7622 / #7646 / #7720';
+export const ACL_DISCUSSIONS = '#7538 / #7622 / #7646 / #7720 / #7750 / #7735';
 /** The upstream thread the persistent-shell advisory is a stopgap for. */
 export const PTY_DISCUSSIONS = '#7638';
 /** The documented prerequisite, quoted from the backend's README. */
@@ -87,7 +94,10 @@ function diagnosis(failure) {
                 'mandatory-integrity label go out as one `SetNamedSecurityInfoW`. The label lives in the SACL, and the',
                 "owner's implicit rights cover only READ_CONTROL and WRITE_DAC, so the label half additionally needs",
                 'WRITE_OWNER on the directory. A workspace created with `mkdir` normally inherits',
-                '"Authenticated Users: Modify" (`0x1301bf`) from the drive root — and that mask has neither right.',
+                '"Authenticated Users: Modify" (`0x1301bf`) from the drive root — and that mask has neither right; on a data',
+                'volume there may be no ACE naming you at all, so that inherited entry is the whole of your access. The two',
+                'halves go out as one call, so a refused label discards the write grant with it, and the sandbox then',
+                'refuses to start any command in the workspace instead of running it unconfined.',
                 'This is a directory ACL fact, not a token privilege: `whoami /priv` will not show it, and',
                 'SeSecurityPrivilege is the wrong lever here.',
             ].join('\n');
@@ -137,6 +147,28 @@ function nonFixes(failure, path) {
         '',
     ];
 }
+/**
+ * When the label half arrived, and why an older build is not the remedy.
+ *
+ * Emitted for every class: the boundary is a fact about the package
+ * `sandbox-windows-acl` (whose `DACL_SECURITY_INFORMATION | LABEL_SECURITY_INFORMATION`
+ * flag is what needs `WRITE_OWNER`), not about which of its two calls failed, so
+ * it is true wherever this module is willing to speak at all. It is also the one
+ * fact neither report could get from the error: the failure looks identical on a
+ * line where the label does not exist yet, and the build that introduced it is
+ * the natural thing to reach for and the wrong one to reach for.
+ * @returns the section's lines.
+ */
+function versionBoundary() {
+    return [
+        'A version boundary worth knowing before reaching for an older build: the label half is new to this package.',
+        'Up to `0.1.6-alpha.x` the backend touched the DACL only (flag 4), so a Modify-only workspace provisioned',
+        'fine; `0.1.7-alpha.1` is where the mandatory label — and with it the SACL, flag 20 — arrives. On a',
+        '`0.1.6-alpha.x`-or-older line this exact failure therefore belongs to a different cause space, while on any',
+        '`0.1.7-*` line it is this one. Rolling back is not the fix either: the label is what confines deletes to the',
+        'workspace, and reverting it reintroduces the escape it closed.',
+    ].join('\n');
+}
 /**
  * Build the advisory attached to the failing tool result.
  *
@@ -174,14 +206,25 @@ function aclAdvisory(failure, href) {
         '',
         diagnosis(failure),
         '',
+        versionBoundary(),
+        '',
         'Confirm the cause (unelevated) — `icacls` is a normal user command:',
         `  icacls "${path}"`,
-        'Look for an ACE that names YOUR OWN account (run `whoami` if unsure) with (F) / Full control.',
-        'If the strongest entry naming you is (M) / Modify, that is this failure.',
+        'Look for an ACE that names YOUR OWN account (run `whoami` if unsure) with (F) / Full control or',
+        '(WO) / Write owner. If the strongest entry naming you is (M) / Modify — or no entry names you at all and',
+        'your access comes from an inherited `Authenticated Users:(M)` — that is this failure.',
         '',
         'Fix it (unelevated, one line) and then run the command again:',
-        `  PowerShell: icacls "${path}" /grant "$env:USERNAME:(OI)(CI)F"`,
-        `  cmd:        icacls "${path}" /grant "%USERNAME%:(OI)(CI)F"`,
+        `  PowerShell: icacls "${path}" /grant "$env:USERNAME:(OI)(CI)(WO)"`,
+        `  cmd:        icacls "${path}" /grant "%USERNAME%:(OI)(CI)(WO)"`,
+        'WRITE_OWNER is exactly the right the prerequisite names, so this grants nothing the harness did not ask for,',
+        'and (OI)(CI) makes the ACE inheritable, so one command reaches the workspace\'s existing subdirectories.',
+        'Full control works just as well — the same line with `F` in place of `(WO)`:',
+        `  icacls "${path}" /grant "$env:USERNAME:(OI)(CI)F"`,
+        'Both assume you own the directory: owner-implicit rights cover the DACL half of the merged write, so',
+        'WRITE_OWNER is the single missing piece. A directory owned by someone else is a bigger change than a',
+        'one-liner — that is the harness\'s documented prerequisite, and it is why this failure is loud instead of',
+        'silently skipped.',
         '',
         ...nonFixes(failure, path),
         'How to read this: the harness documents the prerequisite (' + PREREQUISITE + ') and this',
@@ -266,7 +309,7 @@ export function denialText(failure, observed, denial, maxDenials) {
         '',
         'Retrying cannot succeed — the sandbox cannot start a command until the directory grant applies.',
         'Stop, and either apply the fix or hand the problem to the user:',
-        failure.path === undefined ? '' : `  icacls "${failure.path}" /grant "$env:USERNAME:(OI)(CI)F"`,
+        failure.path === undefined ? '' : `  icacls "${failure.path}" /grant "$env:USERNAME:(OI)(CI)(WO)"`,
         '',
         suffix > 0
             ? `This is automatic block ${String(denial)} of ${String(maxDenials)}; after that the call is allowed again.`

package/lib/signature.js

@@ -30,6 +30,21 @@
  *   the advisory can quote the exact line the model and the user are looking
  *   at, and the path can be re-used in the fix command.
  *
+ * One signature covers two environments, and the text is identical in both, so
+ * the classifier cannot and must not try to tell them apart: a workspace the
+ * caller created with `mkdir` that inherits "Authenticated Users: Modify" from
+ * the drive root (`#7622`, `#7646`, `#7720`), and a directory on a data volume
+ * where **no ACE names the caller at all** so that the inherited entry is the
+ * whole of their access (`#7750` on D:/E:, `#7735`'s second defect). Both are
+ * the same gate — `WRITE_OWNER` on the directory — and the same one-line remedy
+ * satisfies both, which is why they share a class and the advisory names both
+ * shapes instead of guessing which one it is looking at. What the text *does*
+ * carry that the failure does not is the version boundary: the merged
+ * DACL + label write exists only from `0.1.7-alpha.1` on
+ * (`packages/sandbox/sandbox-windows-acl/src/acl.ts`, flag
+ * `DACL_SECURITY_INFORMATION | LABEL_SECURITY_INFORMATION`), so on an older line
+ * the same string belongs to a different cause space.
+ *
  * ## The persistent-shell startup failure (`pty-startup`)
  *
  * `dsh-terminal-bash` throws `PTY shell exited during startup` when the shell

package/lib/types/advice.d.ts

@@ -13,6 +13,13 @@
  *   the caller can grant itself with `icacls`, unelevated. It is **not**
  *   `SeSecurityPrivilege`, the token privilege the reports naturally reach for;
  *   `whoami /priv` cannot show the difference, and elevation is the wrong lever.
+ *   The remedy is the **narrowest** form of that grant — `(WO)` alone, which is
+ *   literally the right the backend's prerequisite names — with Full control
+ *   offered as the broad alternative; and the advisory carries the **version
+ *   boundary** the label introduced (`0.1.7-alpha.1`), because that is what
+ *   separates "this is the label failure" from "this is something else", and
+ *   because rolling back is the reach it invites while making the very problem
+ *   it closed come back.
  * - **The persistent-shell failure** (`pty-startup`) is *not* fixable by the
  *   caller — least of all by the model, which has no shell to run anything in.
  *   So its advice says so and stops: the remedy is a user-side preset choice,
@@ -34,7 +41,7 @@
 import type { ProvisioningFailure, RecognizedFailure } from './signature.js';
 import type { SandboxModeName } from './mode.js';
 /** The upstream threads the ACL advisory is a stopgap for. */
-export declare const ACL_DISCUSSIONS = "#7538 / #7622 / #7646 / #7720";
+export declare const ACL_DISCUSSIONS = "#7538 / #7622 / #7646 / #7720 / #7750 / #7735";
 /** The upstream thread the persistent-shell advisory is a stopgap for. */
 export declare const PTY_DISCUSSIONS = "#7638";
 /** The documented prerequisite, quoted from the backend's README. */

package/lib/types/signature.d.ts

@@ -30,6 +30,21 @@
  *   the advisory can quote the exact line the model and the user are looking
  *   at, and the path can be re-used in the fix command.
  *
+ * One signature covers two environments, and the text is identical in both, so
+ * the classifier cannot and must not try to tell them apart: a workspace the
+ * caller created with `mkdir` that inherits "Authenticated Users: Modify" from
+ * the drive root (`#7622`, `#7646`, `#7720`), and a directory on a data volume
+ * where **no ACE names the caller at all** so that the inherited entry is the
+ * whole of their access (`#7750` on D:/E:, `#7735`'s second defect). Both are
+ * the same gate — `WRITE_OWNER` on the directory — and the same one-line remedy
+ * satisfies both, which is why they share a class and the advisory names both
+ * shapes instead of guessing which one it is looking at. What the text *does*
+ * carry that the failure does not is the version boundary: the merged
+ * DACL + label write exists only from `0.1.7-alpha.1` on
+ * (`packages/sandbox/sandbox-windows-acl/src/acl.ts`, flag
+ * `DACL_SECURITY_INFORMATION | LABEL_SECURITY_INFORMATION`), so on an older line
+ * the same string belongs to a different cause space.
+ *
  * ## The persistent-shell startup failure (`pty-startup`)
  *
  * `dsh-terminal-bash` throws `PTY shell exited during startup` when the shell
@@ -56,7 +71,13 @@
  */
 /** Which provisioning operation failed, and which diagnosis follows from it. */
 export type FailureClass = 
-/** `SetNamedSecurityInfoW` returned `ERROR_ACCESS_DENIED` (5): the merged DACL + label write was refused. */
+/**
+ * `SetNamedSecurityInfoW` returned `ERROR_ACCESS_DENIED` (5): the merged
+ * DACL + label write was refused. Both environments in the module doc land
+ * here — the `mkdir`-inherited Modify workspace and the data-volume directory
+ * with no ACE naming the caller — because the failure text cannot separate
+ * them and the remedy is the same `WRITE_OWNER` grant.
+ */
 'apply-denied'
 /** `SetNamedSecurityInfoW` failed with a Win32 code other than `ERROR_ACCESS_DENIED`. */
  | 'apply-other'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@argszero/cordis-plugin-sandbox-grant-advisor",
-  "description": "Turns two sandbox environment failures that name neither their cause nor a remedy into a diagnosis with a path forward. Family 1, the Windows workspace ACL: four reports (#7538, #7622, #7646, #7720) of one signature — every sandboxed command fails before it runs with `SetNamedSecurityInfoW failed (Win32 5): grantWrite(<workspace>)`, because the merged DACL + mandatory-label write needs WRITE_OWNER on the directory (an object right the caller can self-grant), not SeSecurityPrivilege and not elevation; the host grant is materialized lazily and caches nothing on the failure path, so the same failure repeats per command. Family 2, the persistent shell (#7638): with the `minimal` preset under a confining sandbox mode every shell call dies instantly with `PTY shell exited during startup` because the terminal backend cannot create the pseudo-console inside the sandbox, retrying never helps, and `minimal` mounts no fallback shell tool. The plugin observes the public `tools/post-execute` waterfall, classifies both signatures narrowly (only the two `...NamedSecurityInfoW` operations; the PTY message matched on a whole line, never as a substring, and only under a mode the policy resolver reports as confining), and attaches ONE durable user-role advisory per agent per family through `additionalContexts`. The ACL advisory names the missing right, the discriminator, the unelevated `icacls` fix, and the two remedies that look right and are not (`takeown`, `icacls /reset`), each with the reason it fails; the PTY advisory names the failing combination, states the resolved mode, tells the model to stop rather than retry, and hands the user-side preset choice over — it never names a shell tool the failing composition does not mount. An optional, off-by-default `enforceAfter` refuses an identical ACL call this plugin has watched fail, bounded by `maxDenials`; the blocking half is ACL-only by design. It never edits an ACL, never elevates, and never changes a preset or a mode, and it complements repeat-guard-escalation, which keys on call identity rather than on the environment signature.",
-  "version": "0.3.0",
+  "description": "Turns two sandbox environment failures that name neither their cause nor a remedy into a diagnosis with a path forward. Family 1, the Windows workspace ACL: six reports (#7538, #7622, #7646, #7720, #7750, #7735) of one signature — every sandboxed command fails before it runs with `SetNamedSecurityInfoW failed (Win32 5): grantWrite(<workspace>)`, because the merged DACL + mandatory-label write needs WRITE_OWNER on the directory (an object right the caller can self-grant), not SeSecurityPrivilege and not elevation; the host grant is materialized lazily and caches nothing on the failure path, so the same failure repeats per command. Family 2, the persistent shell (#7638): with the `minimal` preset under a confining sandbox mode every shell call dies instantly with `PTY shell exited during startup` because the terminal backend cannot create the pseudo-console inside the sandbox, retrying never helps, and `minimal` mounts no fallback shell tool. The plugin observes the public `tools/post-execute` waterfall, classifies both signatures narrowly (only the two `...NamedSecurityInfoW` operations; the PTY message matched on a whole line, never as a substring, and only under a mode the policy resolver reports as confining), and attaches ONE durable user-role advisory per agent per family through `additionalContexts`. The ACL advisory names the missing right, both environments the identical text can describe (an inherited Modify-only entry, and a data volume where no ACE names the caller at all), the version boundary that arrived with the mandatory label (0.1.7-alpha.1, flag 20, versus the DACL-only flag 4 up to 0.1.6-alpha.x) together with why downgrading is not the remedy, the discriminator, the unelevated `icacls ... :(OI)(CI)(WO)` fix — the narrowest form of the exact right the backend's prerequisite names, with Full control offered second — and the two remedies that look right and are not (`takeown`, `icacls /reset`), each with the reason it fails; the PTY advisory names the failing combination, states the resolved mode, tells the model to stop rather than retry, and hands the user-side preset choice over — it never names a shell tool the failing composition does not mount. An optional, off-by-default `enforceAfter` refuses an identical ACL call this plugin has watched fail, bounded by `maxDenials`; the blocking half is ACL-only by design. It never edits an ACL, never elevates, and never changes a preset or a mode, and it complements repeat-guard-escalation, which keys on call identity rather than on the environment signature.",
+  "version": "0.4.0",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",