@argszero/cordis-plugin-sandbox-grant-advisor 0.6.0 → 0.7.0

package/README.md

@@ -236,8 +236,9 @@ the advisory never names the dead directory.
 
 ### 3. A confined child that never started (`native-init`)
 
-Two reports of one exit code: [`#7876`] (the packaged desktop app) and [`#7877`]
-(MSYS2 / Git Bash). Both are `0xC0000142` `STATUS_DLL_INIT_FAILED` — the Windows
+Three reports of one exit code: [`#7876`] and [`#8193`] (the packaged desktop
+app, measured twice) and [`#7877`] (MSYS2 / Git Bash). All are `0xC0000142`
+`STATUS_DLL_INIT_FAILED` — the Windows
 loader terminated the process while it was initializing its native images, i.e.
 **before the program's entry point**. A command that ran and then failed exits
 with its own status and prints its own output; this one produced neither.
@@ -258,16 +259,27 @@ Two producers have been measured under a confining mode:
    (`@deepseek-ai/dsh-base/cordis.patch.yml`), so the combination is likely
    never covered upstream. The **one conversion a model can make itself** is to
    write the same work as a PowerShell or `cmd` command.
-2. **The packaged desktop app's sandbox runner** ([`#7876`]).
+2. **The packaged desktop app's sandbox runner** ([`#7876`], [`#8193`]).
    `dsh-sandbox-local` launches the runner as `[process.execPath, entry]`, and
-   in the packaged build `process.execPath` is the Electron executable, which
-   starts as an *application* unless the child's environment carries
-   `ELECTRON_RUN_AS_NODE=1` — so the runner never runs and every confined command
-   reports this code with **no output at all**. The unpacked node host
-   (`node apps/cli/lib/bin.js web`) is unaffected. The plugin reports whether
-   *this* process is an Electron binary (`process.versions.electron`) as a
-   measured fact rather than assuming it, because that is the check the
-   discriminator turns on.
+   in the packaged build `process.execPath` is the Electron executable. Two
+   measurements of that host exist and — from inside a session — they are
+   indistinguishable, so the advisory names **both** instead of asserting one:
+   **(a)** the runner does not start at all — the Electron binary begins as an
+   *application* unless the child's environment carries `ELECTRON_RUN_AS_NODE=1`,
+   so nothing on the runner path ran ([`#7876`]); **(b)** the runner *does*
+   start — the desktop launcher sets exactly that variable — and the command
+   still dies, because the restricted token is derived from the Electron process
+   image and the child does not survive being started under it ([`#8193`]). A
+   reader outside the session separates them (is `ELECTRON_RUN_AS_NODE` set for
+   that host, and does the ACL runner appear among its processes while the
+   command runs?); from inside the session they are one finding with one remedy.
+   The unpacked node host (`node apps/cli/lib/bin.js web`) is unaffected. The
+   plugin reports whether *this* process is an Electron binary
+   (`process.versions.electron`) as a measured fact rather than assuming it,
+   because that is the check the discriminator turns on. **0.6.0 asserted shape
+   (a) alone** — "so the runner never runs" — and handed the Electron reader a
+   cause that [`#8193`] measures to be false; the single-cause sentence is gone,
+   and a test arm keeps it gone.
 
 **Why this family is read from a successful result.** The producer never marks
 it an error, and that is a fact about upstream rather than a choice here:
@@ -325,7 +337,10 @@ backend's own source avoids `CREATE_NO_WINDOW` for). So the advisory diagnoses
 the **class** ("the process never reached its entry point") and enumerates the
 producers measured under a confining mode, each with the check that separates
 them — one of which the reader answers (what program failed to start) and one of
-which the plugin answers (is this host the packaged desktop binary). It never
+which the plugin answers (is this host the packaged desktop binary). Where a
+producer has more than one measured shape, the advisory names all of them and
+records which check separates them outside the session, rather than asserting
+the single shape that happened to be measured first. It never
 offers `danger-full-access` as a fix and never suggests a sandbox setting be
 relaxed.
 
@@ -524,7 +539,7 @@ the newest of that line.
 
 The whole set is re-probed whenever this package's source changes rather than
 carried over from an earlier version: the range is a claim about *this* build of
-the plugin, so `0.6.0` re-ran all five lines above. A line whose probe fails is
+the plugin, so `0.7.0` re-ran all five lines above. A line whose probe fails is
 removed from the range rather than left claimed. The scratch tree's resolved
 versions are the ones to read back when a probe is quoted as evidence — the probe
 script pins them by exact version, and `--keep` leaves the tree in place to check.
@@ -574,3 +589,4 @@ the current runtime cannot distinguish rather than counting it as a pass.
 [#7804]: https://github.com/deepseek-ai/deepseek-harness/discussions/7804
 [#7876]: https://github.com/deepseek-ai/deepseek-harness/discussions/7876
 [#7877]: https://github.com/deepseek-ai/deepseek-harness/discussions/7877
+[#8193]: https://github.com/deepseek-ai/deepseek-harness/discussions/8193

package/lib/advice.js

@@ -58,7 +58,12 @@
  *   is guess which producer this is: the code alone cannot say, and the two
  *   checks it hands over are facts the reader holds (what program they ran;
  *   whether this is the packaged desktop app, which the plugin reports rather
- *   than assumes).
+ *   than assumes). That Electron host is itself **two measurements**, not one —
+ *   a runner that never started at all, and a runner that did start and whose
+ *   child cannot survive the restricted token derived from an Electron process
+ *   image — and the advisory names both instead of asserting the one it shipped
+ *   first, because a session cannot tell them apart and a confidently wrong
+ *   cause is worse than two named ones with one shared remedy.
  *
  * Both give a **discriminator, not just a remedy**: applying a fix without
  * confirming the cause teaches nothing when the fix does not work. For the ACL
@@ -70,7 +75,9 @@
  * family it is two checks the reader performs — which program could not start,
  * and whether this host is the packaged desktop app — because the code alone
  * cannot separate the producers and a guess would send half its readers to the
- * wrong remedy.
+ * wrong remedy. Inside that Electron answer there is a third thing the code
+ * cannot separate, and the advisory deliberately does not try: it names both
+ * measurements and says the remedy does not depend on choosing between them.
  *
  * @module
  */
@@ -80,7 +87,7 @@ export const ACL_DISCUSSIONS = '#7538 / #7622 / #7646 / #7720 / #7750 / #7735 /
 /** The upstream thread the persistent-shell advisory is a stopgap for. */
 export const PTY_DISCUSSIONS = '#7638';
 /** The upstream threads the native-init-death advisory is a stopgap for. */
-export const NATIVE_INIT_DISCUSSIONS = '#7876 / #7877';
+export const NATIVE_INIT_DISCUSSIONS = '#7876 / #7877 / #8193';
 /** The documented prerequisite, quoted from the backend's README. */
 export const PREREQUISITE = 'granted directories must be caller-owned and grant `WRITE_OWNER`';
 /**
@@ -360,9 +367,16 @@ function nativeInitAdvisory(failure, mode, onElectron, href) {
         '     continue — do not retry the MSYS2 program.',
         '  2. The packaged desktop application\'s sandbox runner. `dsh-sandbox-local` starts the runner as',
         '     `[process.execPath, runner.js]`, and in the packaged build `process.execPath` is the Electron',
-        '     executable, which starts as an *application* unless the child\'s environment carries',
-        '     `ELECTRON_RUN_AS_NODE=1` — so the runner never runs and every confined command reports this code',
-        '     with no output at all (#7876).',
+        '     executable. Two measurements of that host exist and from inside a session they are',
+        '     indistinguishable, so both are named here rather than one asserted:',
+        '     (a) the runner does not start at all: the Electron binary begins as an *application* unless the',
+        '         child\'s environment carries `ELECTRON_RUN_AS_NODE=1`, so nothing on the runner path ran (#7876);',
+        '     (b) the runner does start — the desktop launcher sets exactly that variable — and the command still',
+        '         dies, because the restricted token is derived from the Electron process image and the child does',
+        '         not survive being started under it (#8193).',
+        '     A reader outside the session separates them (is `ELECTRON_RUN_AS_NODE` set for that host, and does',
+        '     the ACL runner appear among its processes while the command runs?); from inside the session they are',
+        '     one finding with one remedy, so nothing here waits on telling them apart.',
         onElectron
             ? '     This process IS an Electron binary (`process.versions.electron` is set), so that producer applies here:'
             : '     This process is NOT an Electron binary (`process.versions.electron` is unset), so the runner is a real',
@@ -370,7 +384,7 @@ function nativeInitAdvisory(failure, mode, onElectron, href) {
             ? '     run the same command with `danger-full-access`, or from an unpacked `node apps/cli/lib/bin.js web`'
             : '     Node binary here and that producer cannot be the cause. If the program was not an MSYS2 one either,',
         onElectron
-            ? '     host where the runner is a real Node binary. If it works there, the runner never ran and this is the cause.'
+            ? '     host where the runner is a real Node binary. The command starts there in either shape, and that — the host, not the flags — is the discriminator.'
             : '     this failure is outside both measured producers: stop and hand it to the user.',
         '',
         'Do not retry this call: the environment has not changed, and the identical call produces the identical',

package/lib/types/advice.d.ts

@@ -58,7 +58,12 @@
  *   is guess which producer this is: the code alone cannot say, and the two
  *   checks it hands over are facts the reader holds (what program they ran;
  *   whether this is the packaged desktop app, which the plugin reports rather
- *   than assumes).
+ *   than assumes). That Electron host is itself **two measurements**, not one —
+ *   a runner that never started at all, and a runner that did start and whose
+ *   child cannot survive the restricted token derived from an Electron process
+ *   image — and the advisory names both instead of asserting the one it shipped
+ *   first, because a session cannot tell them apart and a confidently wrong
+ *   cause is worse than two named ones with one shared remedy.
  *
  * Both give a **discriminator, not just a remedy**: applying a fix without
  * confirming the cause teaches nothing when the fix does not work. For the ACL
@@ -70,7 +75,9 @@
  * family it is two checks the reader performs — which program could not start,
  * and whether this host is the packaged desktop app — because the code alone
  * cannot separate the producers and a guess would send half its readers to the
- * wrong remedy.
+ * wrong remedy. Inside that Electron answer there is a third thing the code
+ * cannot separate, and the advisory deliberately does not try: it names both
+ * measurements and says the remedy does not depend on choosing between them.
  *
  * @module
  */
@@ -81,7 +88,7 @@ export declare const ACL_DISCUSSIONS = "#7538 / #7622 / #7646 / #7720 / #7750 /
 /** The upstream thread the persistent-shell advisory is a stopgap for. */
 export declare const PTY_DISCUSSIONS = "#7638";
 /** The upstream threads the native-init-death advisory is a stopgap for. */
-export declare const NATIVE_INIT_DISCUSSIONS = "#7876 / #7877";
+export declare const NATIVE_INIT_DISCUSSIONS = "#7876 / #7877 / #8193";
 /** The documented prerequisite, quoted from the backend's README. */
 export declare const PREREQUISITE = "granted directories must be caller-owned and grant `WRITE_OWNER`";
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@argszero/cordis-plugin-sandbox-grant-advisor",
-  "description": "Turns three sandbox environment failures that name neither their cause nor a remedy into a diagnosis with a path forward. Family 1, the Windows workspace ACL: nine reports (#7538, #7622, #7646, #7720, #7750, #7735, #7771, #7804, #7816) of one signature \u2014 every sandboxed command fails before it runs with `SetNamedSecurityInfoW failed (Win32 5): grantWrite(<workspace>)`, because the merged DACL + mandatory-label write needs WRITE_OWNER on the directory (an object right the caller can self-grant), not SeSecurityPrivilege and not elevation; the host grant is materialized lazily and caches nothing on the failure path, so the same failure repeats per command. Family 2, the persistent shell (#7638): with the `minimal` preset under a confining sandbox mode every shell call dies instantly with `PTY shell exited during startup` because the terminal backend cannot create the pseudo-console inside the sandbox, retrying never helps, and `minimal` mounts no fallback shell tool. Family 3, a confined Windows child that died during native initialization (#7876, #7877): every command spawned through the sandbox runner can report exit 0xC0000142 STATUS_DLL_INIT_FAILED with the process never reaching its entry point \u2014 the packaged desktop starts that runner as [process.execPath, entry] and Electron launches as an application unless the child's environment carries ELECTRON_RUN_AS_NODE=1 (#7876), and an MSYS2 / Git-Bash program cannot create its signal pipe under the restricted token while cmd.exe and pwsh run fine in the same workspace under the same mode (#7877) \u2014 and because upstream's runner-failure rules admit only exit 127 with the `windows-acl-run: ` signature, the code is never an error: it arrives as the canonical value of a result the pipeline calls a success. The plugin observes the public `tools/post-execute` waterfall, classifies all three signatures narrowly (only the two `...NamedSecurityInfoW` operations; the PTY message matched on a whole line, never as a substring; the loader status read as a 32-bit integer out of the shell tool's own canonical success value, never from rendered text; both mode-gated families advised only under a mode the policy resolver reports as confining), and attaches ONE durable user-role advisory per agent per family through `additionalContexts`. The ACL advisory names the missing right, both environments the identical text can describe (an inherited Modify-only entry, a data volume where no ACE names the caller at all, and a directory owned by another account), the version boundary that arrived with the mandatory label (0.1.7-alpha.1, flag 20, versus the DACL-only flag 4 up to 0.1.6-alpha.x) together with why downgrading is not the remedy, the discriminator, the remedy forked on an ownership check the user runs (`(Get-Acl \"<dir>\").Owner`), because one command cannot serve both rights situations: where the caller owns the directory, the unelevated `icacls ... :(OI)(CI)(WO)` is the whole of what is missing \u2014 the owner's implicit WRITE_DAC already covers the DACL half \u2014 and where the caller does not own it that same command is refused for want of WRITE_DAC, so the grant has to come from an elevated account, or by taking ownership first, or by moving the workspace under %USERPROFILE% \u2014 and the two remedies that look right and are not (`takeown`, `icacls /reset`), each with the reason it fails; the PTY advisory names the failing combination, states the resolved mode, tells the model to stop rather than retry, and hands the user-side preset choice over \u2014 it never names a shell tool the failing composition does not mount; the native-init advisory states the resolved mode, says the process died before its entry point, enumerates the two producers measured under a confining mode with the check that separates them (what program the reader ran; whether this host is the packaged desktop binary, which the plugin measures and reports rather than assumes), carries the one conversion a model can make itself (rewrite the work as PowerShell or `cmd` when an MSYS2 program is what could not start), and says plainly which producers it does not know \u2014 it never claims the sandbox caused the failure and never offers a widened mode as a fix. An optional, off-by-default `enforceAfter` refuses an identical ACL call this plugin has watched fail, bounded by `maxDenials`; the blocking half is ACL-only by design. It never edits an ACL, never elevates, never sets another process's environment, and never changes a preset or a mode, and it complements repeat-guard-escalation, which keys on call identity rather than on the environment signature.",
-  "version": "0.6.0",
+  "description": "Turns three sandbox environment failures that name neither their cause nor a remedy into a diagnosis with a path forward. Family 1, the Windows workspace ACL: nine reports (#7538, #7622, #7646, #7720, #7750, #7735, #7771, #7804, #7816) of one signature \u2014 every sandboxed command fails before it runs with `SetNamedSecurityInfoW failed (Win32 5): grantWrite(<workspace>)`, because the merged DACL + mandatory-label write needs WRITE_OWNER on the directory (an object right the caller can self-grant), not SeSecurityPrivilege and not elevation; the host grant is materialized lazily and caches nothing on the failure path, so the same failure repeats per command. Family 2, the persistent shell (#7638): with the `minimal` preset under a confining sandbox mode every shell call dies instantly with `PTY shell exited during startup` because the terminal backend cannot create the pseudo-console inside the sandbox, retrying never helps, and `minimal` mounts no fallback shell tool. Family 3, a confined Windows child that died during native initialization (#7876, #7877): every command spawned through the sandbox runner can report exit 0xC0000142 STATUS_DLL_INIT_FAILED with the process never reaching its entry point \u2014 the packaged desktop starts that runner as [process.execPath, entry], and that host has been measured twice with one indistinguishable appearance from inside a session \u2014 either nothing on the runner path ran because the Electron binary launches as an application unless the child's environment carries ELECTRON_RUN_AS_NODE=1 (#7876), or the desktop launcher does set that variable and the child still dies because the restricted token is derived from the Electron process image (#8193), and an MSYS2 / Git-Bash program cannot create its signal pipe under the restricted token while cmd.exe and pwsh run fine in the same workspace under the same mode (#7877) \u2014 and because upstream's runner-failure rules admit only exit 127 with the `windows-acl-run: ` signature, the code is never an error: it arrives as the canonical value of a result the pipeline calls a success. The plugin observes the public `tools/post-execute` waterfall, classifies all three signatures narrowly (only the two `...NamedSecurityInfoW` operations; the PTY message matched on a whole line, never as a substring; the loader status read as a 32-bit integer out of the shell tool's own canonical success value, never from rendered text; both mode-gated families advised only under a mode the policy resolver reports as confining), and attaches ONE durable user-role advisory per agent per family through `additionalContexts`. The ACL advisory names the missing right, both environments the identical text can describe (an inherited Modify-only entry, a data volume where no ACE names the caller at all, and a directory owned by another account), the version boundary that arrived with the mandatory label (0.1.7-alpha.1, flag 20, versus the DACL-only flag 4 up to 0.1.6-alpha.x) together with why downgrading is not the remedy, the discriminator, the remedy forked on an ownership check the user runs (`(Get-Acl \"<dir>\").Owner`), because one command cannot serve both rights situations: where the caller owns the directory, the unelevated `icacls ... :(OI)(CI)(WO)` is the whole of what is missing \u2014 the owner's implicit WRITE_DAC already covers the DACL half \u2014 and where the caller does not own it that same command is refused for want of WRITE_DAC, so the grant has to come from an elevated account, or by taking ownership first, or by moving the workspace under %USERPROFILE% \u2014 and the two remedies that look right and are not (`takeown`, `icacls /reset`), each with the reason it fails; the PTY advisory names the failing combination, states the resolved mode, tells the model to stop rather than retry, and hands the user-side preset choice over \u2014 it never names a shell tool the failing composition does not mount; the native-init advisory states the resolved mode, says the process died before its entry point, enumerates the two producers measured under a confining mode \u2014 naming both measured shapes of the desktop host rather than asserting the one that was measured first \u2014 with the check that separates them (what program the reader ran; whether this host is the packaged desktop binary, which the plugin measures and reports rather than assumes), carries the one conversion a model can make itself (rewrite the work as PowerShell or `cmd` when an MSYS2 program is what could not start), and says plainly which producers it does not know \u2014 it never claims the sandbox caused the failure and never offers a widened mode as a fix. An optional, off-by-default `enforceAfter` refuses an identical ACL call this plugin has watched fail, bounded by `maxDenials`; the blocking half is ACL-only by design. It never edits an ACL, never elevates, never sets another process's environment, and never changes a preset or a mode, and it complements repeat-guard-escalation, which keys on call identity rather than on the environment signature.",
+  "version": "0.7.0",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",