@argszero/cordis-plugin-sandbox-grant-advisor 0.7.0 → 0.7.1

package/README.md

@@ -281,6 +281,44 @@ Two producers have been measured under a confining mode:
    cause that [`#8193`] measures to be false; the single-cause sentence is gone,
    and a test arm keeps it gone.
 
+   **The remedy is the host, and 0.7.1 says so in that order.** [`#8193`] did not
+   only split the producer — it measured the way out: hosted on the desktop's own
+   bundled standalone node
+   (`resources/runtime/primary-runtime/dependencies/node/bin/node.exe`, v24.21.0)
+   the *same* confined `pwsh.exe` / `cmd.exe` spawns succeed (exit 81 / 82), with
+   workspace, temp directory, mode, SIDs, target and runner `sha256` all held
+   constant. The advisory now leads the Electron branch with that, and demotes
+   `danger-full-access` to what it actually is — a way to **confirm** the
+   diagnosis, not a fix, and on this platform one that silently removes the
+   sandbox from every shell call. The reporter's own reason is the one the plugin
+   repeats: *"the practical effect is that Windows Desktop users must escalate to
+   full access for all shell work, which silently removes the sandbox on that
+   platform"*, and they asked explicitly that this not be "fixed" with
+   `--disable-sandbox` / `--disable-gpu-sandbox` — those disable Chromium's
+   renderer sandbox, a different layer from the DSH file policy. The advisory also
+   warns off the opposite-looking move: unsetting `ELECTRON_RUN_AS_NODE` does not
+   help, because the desktop's runner **is** that Electron binary and without the
+   variable it cannot execute `runner.js` at all — the interaction [`#8193`]
+   records with [`#8174`], where a fix that tombstones the variable in the shared
+   child environment would take the ACL runner down with it, so the two changes
+   have to land together.
+
+   **What the flag vocabulary actually is.** The backend's own source records one
+   inherent boundary: *"console isolation is unavailable — children share the host
+   console (`CREATE_NO_WINDOW` / `CREATE_NEW_CONSOLE` children die with
+   `STATUS_DLL_INIT_FAILED` under the restriction)"*
+   (`packages/sandbox/sandbox-windows-acl/src/index.ts`), echoed at
+   `packages/subprocess/win32-process/src/process.ts:454`. [`#8193`] refines that
+   recording instead of repeating it, and the refinement is worth keeping exact:
+   the restricted-token path spawns with **`CREATE_SUSPENDED` alone**
+   (`process.ts:537-545`) and the ordinary current-token path with
+   **`CREATE_SUSPENDED | CREATE_UNICODE_ENVIRONMENT`** (`process.ts:567`, i.e.
+   `0x404`); `CREATE_NO_WINDOW` (`0x08000000`) is **not a constant anywhere in
+   that source** — only those two comments name it at all. So the flags in use are
+   a necessary-but-insufficient ingredient: the same flags that are fatal under an
+   Electron host succeed under a real-node host, and the host process image is
+   what turns them fatal.
+
 **Why this family is read from a successful result.** The producer never marks
 it an error, and that is a fact about upstream rather than a choice here:
 `RUNNER_FAILURE_RULES['windows-acl']` admits exactly one code —
@@ -539,7 +577,7 @@ the newest of that line.
 
 The whole set is re-probed whenever this package's source changes rather than
 carried over from an earlier version: the range is a claim about *this* build of
-the plugin, so `0.7.0` re-ran all five lines above. A line whose probe fails is
+the plugin, so `0.7.1` re-ran all five lines above. A line whose probe fails is
 removed from the range rather than left claimed. The scratch tree's resolved
 versions are the ones to read back when a probe is quoted as evidence — the probe
 script pins them by exact version, and `--keep` leaves the tree in place to check.
@@ -590,3 +628,4 @@ the current runtime cannot distinguish rather than counting it as a pass.
 [#7876]: https://github.com/deepseek-ai/deepseek-harness/discussions/7876
 [#7877]: https://github.com/deepseek-ai/deepseek-harness/discussions/7877
 [#8193]: https://github.com/deepseek-ai/deepseek-harness/discussions/8193
+[#8174]: https://github.com/deepseek-ai/deepseek-harness/discussions/8174

package/lib/advice.js

@@ -377,24 +377,36 @@ function nativeInitAdvisory(failure, mode, onElectron, href) {
         '     A reader outside the session separates them (is `ELECTRON_RUN_AS_NODE` set for that host, and does',
         '     the ACL runner appear among its processes while the command runs?); from inside the session they are',
         '     one finding with one remedy, so nothing here waits on telling them apart.',
-        onElectron
-            ? '     This process IS an Electron binary (`process.versions.electron` is set), so that producer applies here:'
-            : '     This process is NOT an Electron binary (`process.versions.electron` is unset), so the runner is a real',
-        onElectron
-            ? '     run the same command with `danger-full-access`, or from an unpacked `node apps/cli/lib/bin.js web`'
-            : '     Node binary here and that producer cannot be the cause. If the program was not an MSYS2 one either,',
-        onElectron
-            ? '     host where the runner is a real Node binary. The command starts there in either shape, and that — the host, not the flags — is the discriminator.'
-            : '     this failure is outside both measured producers: stop and hand it to the user.',
+        ...(onElectron
+            ? [
+                '     This process IS an Electron binary (`process.versions.electron` is set), so that producer applies here.',
+                '     The way out is a real node host, not a wider mode: the packaged desktop ships one at',
+                '     `resources/runtime/primary-runtime/dependencies/node/bin/node.exe`, and the unpacked',
+                '     `node apps/cli/lib/bin.js web` host works for the same reason — the same confined `pwsh`/`cmd` calls',
+                '     start there (#8193 measured exit 81/82). The command starts there in either shape, and that — the',
+                '     host, not the flags — is the discriminator. `danger-full-access` only CONFIRMS the diagnosis: on this',
+                '     platform it silently removes the sandbox from every shell call. Do not unset `ELECTRON_RUN_AS_NODE`',
+                '     instead either — the desktop runner IS that Electron binary, so without it `runner.js` cannot',
+                '     execute at all (#8193 records this interaction with #8174).',
+            ]
+            : [
+                '     This process is NOT an Electron binary (`process.versions.electron` is unset), so the runner is a real',
+                '     Node binary here and that producer cannot be the cause. If the program was not an MSYS2 one either,',
+                '     this failure is outside both measured producers: stop and hand it to the user.',
+            ]),
         '',
         'Do not retry this call: the environment has not changed, and the identical call produces the identical',
         'code. Convert the work only in case 1; otherwise stop and hand it to the user.',
         '',
         'Honest boundary — 0xC0000142 has producers this list does not have: a program that cannot load one of',
-        'its own DLLs dies this way too, and the sandbox backend\'s own source records that a child started with',
-        'a hidden console window does as well (which is why that backend avoids `CREATE_NO_WINDOW`). This is not',
-        'a claim that the sandbox caused the failure — the code cannot say that. What is claimed is narrower and',
-        'checkable: the process never reached its entry point, and under this mode these two producers are known.',
+        'its own DLLs dies this way too, and the backend\'s own source records that a child created with a hidden',
+        'console window can as well (`CREATE_NO_WINDOW` can fail restricted-token DLL initialization). #8193',
+        'refines that recording rather than repeating it: `CREATE_NO_WINDOW` is not among the flags actually passed',
+        '(they are `CREATE_SUSPENDED`, and `CREATE_SUSPENDED | CREATE_UNICODE_ENVIRONMENT` on the unrestricted',
+        'path), and the same flags succeed under a real-node host — so the flag is a necessary ingredient and the',
+        'host process image is what turns it fatal. This is not a claim that the sandbox caused the failure — the',
+        'code cannot say that. What is claimed is narrower and checkable: the process never reached its entry',
+        'point, and under this mode these two producers are known.',
         '',
         'This is a stopgap, ' + where + '. What it is NOT: this plugin neither changes an environment nor',
         'widens the sandbox — the checks above are yours to make, and `danger-full-access` is not offered as a fix.',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@argszero/cordis-plugin-sandbox-grant-advisor",
-  "description": "Turns three sandbox environment failures that name neither their cause nor a remedy into a diagnosis with a path forward. Family 1, the Windows workspace ACL: nine reports (#7538, #7622, #7646, #7720, #7750, #7735, #7771, #7804, #7816) of one signature \u2014 every sandboxed command fails before it runs with `SetNamedSecurityInfoW failed (Win32 5): grantWrite(<workspace>)`, because the merged DACL + mandatory-label write needs WRITE_OWNER on the directory (an object right the caller can self-grant), not SeSecurityPrivilege and not elevation; the host grant is materialized lazily and caches nothing on the failure path, so the same failure repeats per command. Family 2, the persistent shell (#7638): with the `minimal` preset under a confining sandbox mode every shell call dies instantly with `PTY shell exited during startup` because the terminal backend cannot create the pseudo-console inside the sandbox, retrying never helps, and `minimal` mounts no fallback shell tool. Family 3, a confined Windows child that died during native initialization (#7876, #7877): every command spawned through the sandbox runner can report exit 0xC0000142 STATUS_DLL_INIT_FAILED with the process never reaching its entry point \u2014 the packaged desktop starts that runner as [process.execPath, entry], and that host has been measured twice with one indistinguishable appearance from inside a session \u2014 either nothing on the runner path ran because the Electron binary launches as an application unless the child's environment carries ELECTRON_RUN_AS_NODE=1 (#7876), or the desktop launcher does set that variable and the child still dies because the restricted token is derived from the Electron process image (#8193), and an MSYS2 / Git-Bash program cannot create its signal pipe under the restricted token while cmd.exe and pwsh run fine in the same workspace under the same mode (#7877) \u2014 and because upstream's runner-failure rules admit only exit 127 with the `windows-acl-run: ` signature, the code is never an error: it arrives as the canonical value of a result the pipeline calls a success. The plugin observes the public `tools/post-execute` waterfall, classifies all three signatures narrowly (only the two `...NamedSecurityInfoW` operations; the PTY message matched on a whole line, never as a substring; the loader status read as a 32-bit integer out of the shell tool's own canonical success value, never from rendered text; both mode-gated families advised only under a mode the policy resolver reports as confining), and attaches ONE durable user-role advisory per agent per family through `additionalContexts`. The ACL advisory names the missing right, both environments the identical text can describe (an inherited Modify-only entry, a data volume where no ACE names the caller at all, and a directory owned by another account), the version boundary that arrived with the mandatory label (0.1.7-alpha.1, flag 20, versus the DACL-only flag 4 up to 0.1.6-alpha.x) together with why downgrading is not the remedy, the discriminator, the remedy forked on an ownership check the user runs (`(Get-Acl \"<dir>\").Owner`), because one command cannot serve both rights situations: where the caller owns the directory, the unelevated `icacls ... :(OI)(CI)(WO)` is the whole of what is missing \u2014 the owner's implicit WRITE_DAC already covers the DACL half \u2014 and where the caller does not own it that same command is refused for want of WRITE_DAC, so the grant has to come from an elevated account, or by taking ownership first, or by moving the workspace under %USERPROFILE% \u2014 and the two remedies that look right and are not (`takeown`, `icacls /reset`), each with the reason it fails; the PTY advisory names the failing combination, states the resolved mode, tells the model to stop rather than retry, and hands the user-side preset choice over \u2014 it never names a shell tool the failing composition does not mount; the native-init advisory states the resolved mode, says the process died before its entry point, enumerates the two producers measured under a confining mode \u2014 naming both measured shapes of the desktop host rather than asserting the one that was measured first \u2014 with the check that separates them (what program the reader ran; whether this host is the packaged desktop binary, which the plugin measures and reports rather than assumes), carries the one conversion a model can make itself (rewrite the work as PowerShell or `cmd` when an MSYS2 program is what could not start), and says plainly which producers it does not know \u2014 it never claims the sandbox caused the failure and never offers a widened mode as a fix. An optional, off-by-default `enforceAfter` refuses an identical ACL call this plugin has watched fail, bounded by `maxDenials`; the blocking half is ACL-only by design. It never edits an ACL, never elevates, never sets another process's environment, and never changes a preset or a mode, and it complements repeat-guard-escalation, which keys on call identity rather than on the environment signature.",
-  "version": "0.7.0",
+  "description": "Turns three sandbox environment failures that name neither their cause nor a remedy into a diagnosis with a path forward. Family 1, the Windows workspace ACL: nine reports (#7538, #7622, #7646, #7720, #7750, #7735, #7771, #7804, #7816) of one signature \u2014 every sandboxed command fails before it runs with `SetNamedSecurityInfoW failed (Win32 5): grantWrite(<workspace>)`, because the merged DACL + mandatory-label write needs WRITE_OWNER on the directory (an object right the caller can self-grant), not SeSecurityPrivilege and not elevation; the host grant is materialized lazily and caches nothing on the failure path, so the same failure repeats per command. Family 2, the persistent shell (#7638): with the `minimal` preset under a confining sandbox mode every shell call dies instantly with `PTY shell exited during startup` because the terminal backend cannot create the pseudo-console inside the sandbox, retrying never helps, and `minimal` mounts no fallback shell tool. Family 3, a confined Windows child that died during native initialization (#7876, #7877): every command spawned through the sandbox runner can report exit 0xC0000142 STATUS_DLL_INIT_FAILED with the process never reaching its entry point \u2014 the packaged desktop starts that runner as [process.execPath, entry], and that host has been measured twice with one indistinguishable appearance from inside a session \u2014 either nothing on the runner path ran because the Electron binary launches as an application unless the child's environment carries ELECTRON_RUN_AS_NODE=1 (#7876), or the desktop launcher does set that variable and the child still dies because the restricted token is derived from the Electron process image (#8193), and an MSYS2 / Git-Bash program cannot create its signal pipe under the restricted token while cmd.exe and pwsh run fine in the same workspace under the same mode (#7877) \u2014 and because upstream's runner-failure rules admit only exit 127 with the `windows-acl-run: ` signature, the code is never an error: it arrives as the canonical value of a result the pipeline calls a success. The plugin observes the public `tools/post-execute` waterfall, classifies all three signatures narrowly (only the two `...NamedSecurityInfoW` operations; the PTY message matched on a whole line, never as a substring; the loader status read as a 32-bit integer out of the shell tool's own canonical success value, never from rendered text; both mode-gated families advised only under a mode the policy resolver reports as confining), and attaches ONE durable user-role advisory per agent per family through `additionalContexts`. The ACL advisory names the missing right, both environments the identical text can describe (an inherited Modify-only entry, a data volume where no ACE names the caller at all, and a directory owned by another account), the version boundary that arrived with the mandatory label (0.1.7-alpha.1, flag 20, versus the DACL-only flag 4 up to 0.1.6-alpha.x) together with why downgrading is not the remedy, the discriminator, the remedy forked on an ownership check the user runs (`(Get-Acl \"<dir>\").Owner`), because one command cannot serve both rights situations: where the caller owns the directory, the unelevated `icacls ... :(OI)(CI)(WO)` is the whole of what is missing \u2014 the owner's implicit WRITE_DAC already covers the DACL half \u2014 and where the caller does not own it that same command is refused for want of WRITE_DAC, so the grant has to come from an elevated account, or by taking ownership first, or by moving the workspace under %USERPROFILE% \u2014 and the two remedies that look right and are not (`takeown`, `icacls /reset`), each with the reason it fails; the PTY advisory names the failing combination, states the resolved mode, tells the model to stop rather than retry, and hands the user-side preset choice over \u2014 it never names a shell tool the failing composition does not mount; the native-init advisory states the resolved mode, says the process died before its entry point, enumerates the two producers measured under a confining mode \u2014 naming both measured shapes of the desktop host rather than asserting the one that was measured first \u2014 with the check that separates them (what program the reader ran; whether this host is the packaged desktop binary, which the plugin measures and reports rather than assumes), carries the one conversion a model can make itself (rewrite the work as PowerShell or `cmd` when an MSYS2 program is what could not start), and \u2014 for the Electron host \u2014 names the fix #8193 measured rather than a wider mode: host the runner on a real node.exe (the desktop ships one under `resources/runtime/primary-runtime/dependencies/node/bin/node.exe`), where the same confined `pwsh`/`cmd` spawns succeed, while `danger-full-access` is described as a way to confirm the diagnosis and not a fix, together with the warning that unsetting `ELECTRON_RUN_AS_NODE` instead would leave the desktop's Electron-hosted runner unable to execute `runner.js` at all (the interaction #8193 records with #8174), and says plainly which producers it does not know \u2014 it never claims the sandbox caused the failure and never offers a widened mode as a fix. An optional, off-by-default `enforceAfter` refuses an identical ACL call this plugin has watched fail, bounded by `maxDenials`; the blocking half is ACL-only by design. It never edits an ACL, never elevates, never sets another process's environment, and never changes a preset or a mode, and it complements repeat-guard-escalation, which keys on call identity rather than on the environment signature.",
+  "version": "0.7.1",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",