@argszero/cordis-plugin-sandbox-grant-advisor 0.9.1 → 0.11.0

package/lib/advice.js

@@ -3,7 +3,7 @@
  * environment failure, and what is deliberately withheld.
  *
  * The text is assembled here as pure functions so every sentence can be pinned
- * by a test, one family at a time. The three families are shaped by the same
+ * by a test, one family at a time. The four families are shaped by the same
  * question — is this the sandbox's doing, and what can the reader do about it —
  * and they answer it differently:
  *
@@ -56,13 +56,35 @@
  *   keeps the token lowering yields a workspace the confined child cannot write
  *   to. That is stated instead of a bare "no", because a reader told only "no"
  *   reaches for the workaround without knowing what else it would have to change.
+ *
+ *   **It also states what the grant leaves behind** (`#8312`, `#8314`), because
+ *   this is the module that hands over the command applying that grant, and these
+ *   are facts a reader needs at that moment rather than from a broken build in
+ *   another project later. The three entries are standing by design — the
+ *   backend's dispose path leaves them, and its own failure-cleanup comment calls
+ *   them "the intended end state (the reuse cache)" — the Low label is
+ *   inheritable and lives in the SACL (so resetting the DACL does not remove it),
+ *   and an NTFS hard link is a second name for one file object, so a pnpm
+ *   workspace's `node_modules` → content-addressed-store links carry that label
+ *   out of the tree and leave it on objects other projects build from. The
+ *   section offers no removal command: the maintainers' own diagnosis skill
+ *   reports the label and leaves it, removing one needs `WRITE_OWNER`, and this
+ *   project has no Windows host on which to verify a line.
  * - **The persistent-shell failure** (`pty-startup`) is *not* fixable by the
  *   caller — least of all by the model, which has no shell to run anything in.
  *   So its advice says so and stops: the remedy is a user-side preset choice,
  *   and the model's instruction is to stop retrying and use its file tools.
  *   Handing the model a command here would be advice to run something that
  *   cannot run, and naming a one-shot shell tool would be advice to call a tool
- *   the failing composition does not mount.
+ *   the failing composition does not mount. **Inside a confining mode the host
+ *   binary decides**, which `#8322` separated with one runner and one ConPTY in
+ *   every arm: a console-subsystem `node.exe` host starts the confined shell,
+ *   while the packaged desktop's GUI-subsystem Electron host kills it silently.
+ *   That is the same console rule the native-init family states — under the
+ *   restricted token a console can be inherited but not created — so the advisory
+ *   names the host alongside the mode, says the outcome is deterministic per
+ *   (session mode × host) rather than intermittent, and offers the console-owning
+ *   host as a user-side option `#8313` measured working.
  * - **The native-init death** (`native-init`) is the one whose remedy is **split**:
  *   the *class* is not the model's to fix, but one of its two measured producers
  *   is. A confined child that died with `STATUS_DLL_INIT_FAILED` never ran
@@ -90,6 +112,31 @@
  *   want of that variable. A withdrawn cause earns its sentence because this
  *   advisory shipped it twice; a confidently wrong cause is worse than two named
  *   ones with one shared remedy.
+ * - **The workspace-internal denial** (`workspace-denial`, #423) is the fourth,
+ *   and it is the first whose remedy is **withheld on purpose**. The failure is
+ *   not that a command failed but that the workspace's own grant does not cover
+ *   part of the workspace: the grant is written once on the root and depends on
+ *   ACE inheritance, so an already-existing object whose DACL the caller could
+ *   not write kept its older DACL, and the backend's root-only `hasExactGrant`
+ *   check means it is never revisited. Retrying is therefore provably useless,
+ *   which is what the text leads with. What it does **not** do is print a repair
+ *   command: the obvious one (`icacls` recursing the capability SID) is refused
+ *   by Windows itself with `ERROR_NONE_MAPPED` (1332), because that SID has no
+ *   name to map, and the line that would work needs the right that is missing —
+ *   so the advisory states the mechanism, names the ceiling, and says out loud
+ *   that it prints no command because this project has no Windows host to verify
+ *   one on. That is the same standard the standing-grant section is held to, and
+ *   it is the reason this family can be useful without being prescriptive.
+ *   Its discriminator is the **two-sided** one, which is not obvious and which a
+ *   reader checking only the ACE would get wrong: reading and listing use the
+ *   normal token while writing and deleting use the restricted one, so an object
+ *   whose DACL names only `Administrators`/`SYSTEM` plus the capability SID is
+ *   refused on the read side too and looks granted to a grep for the SID
+ *   (#423 measured it). The variant that would otherwise be missed gets its own
+ *   sentence as well — the same shape with the missing coverage on the mandatory
+ *   label instead of the DACL (reported 2026-09-29 in the same thread), which is
+ *   indistinguishable from inside a session and separable by the repository's own
+ *   diagnosis skill.
  *
  * Both give a **discriminator, not just a remedy**: applying a fix without
  * confirming the cause teaches nothing when the fix does not work. For the ACL
@@ -104,16 +151,72 @@
  * wrong remedy. Inside that Electron answer there is a third thing the code
  * cannot separate, and the advisory deliberately does not try: it names both
  * measurements and says the remedy does not depend on choosing between them.
+ * For the workspace-denial family the discriminator is the **path**, which is
+ * why the advisory prints the path it keyed on beside the root it tested it
+ * against: the reader can audit the plugin's own reasoning instead of taking a
+ * claim about two strings on faith. That family's check is also the one place
+ * where a single fact is not enough — reachability has two sides, and the text
+ * says which one a check on the ACE alone would miss.
  *
  * @module
  */
 import { failureLine, STATUS_DLL_INIT_FAILED } from './signature.js';
-/** The upstream threads the ACL advisory is a stopgap for. */
-export const ACL_DISCUSSIONS = '#7538 / #7622 / #7646 / #7720 / #7750 / #7735 / #7771 / #7804 / #7816 / #8232 / #8272 / #8275';
-/** The upstream thread the persistent-shell advisory is a stopgap for. */
-export const PTY_DISCUSSIONS = '#7638';
-/** The upstream threads the native-init-death advisory is a stopgap for. */
-export const NATIVE_INIT_DISCUSSIONS = '#7876 / #7877 / #8193 / #8208';
+/**
+ * The upstream threads the ACL advisory is a stopgap for.
+ *
+ * The first twelve report the provisioning failure itself (the merged DACL +
+ * label write being refused). The last two, `#8312` and `#8314`, report the
+ * other end of the same backend — what its grant leaves behind once it
+ * *succeeds* — which the advisory states because it is the fact a reader needs
+ * at the moment it hands them the command that applies that grant.
+ */
+export const ACL_DISCUSSIONS = '#7538 / #7622 / #7646 / #7720 / #7750 / #7735 / #7771 / #7804 / #7816 / #8232 / #8272 / #8275 / #8312 / #8314';
+/**
+ * The upstream threads the persistent-shell advisory is a stopgap for.
+ *
+ * `#7638` is the failure and its three-arm control (the mode is the
+ * discriminator); `#8322` is the one that separated the arms inside a confining
+ * mode and found the sandbox runner's host binary — same runner, same ConPTY,
+ * console-subsystem `node.exe` host works where a GUI-subsystem one dies
+ * silently — which is why the advisory names the host as well as the mode.
+ */
+export const PTY_DISCUSSIONS = '#7638 / #8322';
+/**
+ * The upstream threads the native-init-death advisory is a stopgap for.
+ *
+ * `#8313` is the fifth report of the same code and the one that states the host
+ * difference from the outside: the desktop build fails where the same version
+ * launched from a terminal does not, which is the same variable the PTY family
+ * now names.
+ */
+export const NATIVE_INIT_DISCUSSIONS = '#7876 / #7877 / #8193 / #8208 / #8313';
+/**
+ * The upstream thread the workspace-denial advisory is a stopgap for.
+ *
+ * One thread, because this family is one report and its own follow-up: `#423`
+ * is the failure and its measurements (170 of 729 objects missing the grant,
+ * root-level files among them, and the two-sided reachability rule), and the
+ * second comment in that thread is the mandatory-label variant of the same
+ * shape.
+ */
+export const WORKSPACE_DENIAL_DISCUSSIONS = '#423';
+/**
+ * The thread list each family's withholding note cites.
+ *
+ * A withheld recognition is a decision the host log has to account for, and the
+ * note a maintainer reads is only useful if it points at *that* family's
+ * report — a withheld native-init death and a withheld workspace denial are
+ * different reports, and a note that cites the wrong one is its own small
+ * misdiagnosis. Kept beside the constants it assembles rather than at the
+ * withholding site, so a family added without a thread is a type error instead
+ * of a note that quietly cites another family's.
+ */
+export const DISCUSSIONS_OF = {
+    'acl-provisioning': ACL_DISCUSSIONS,
+    'pty-startup': PTY_DISCUSSIONS,
+    'native-init': NATIVE_INIT_DISCUSSIONS,
+    'workspace-denial': WORKSPACE_DENIAL_DISCUSSIONS,
+};
 /** The documented prerequisite, quoted from the backend's README. */
 export const PREREQUISITE = 'granted directories must be caller-owned and grant `WRITE_OWNER`';
 /**
@@ -232,7 +335,9 @@ function nonFixes(failure, path) {
         '    supplies the DACL half and still not WRITE_OWNER, the right this call needs. In the second branch above',
         '    it is a legitimate first step with elevation; it is never the fix by itself.',
         `  icacls "${path}" /reset /T /C`,
-        '    restores inheritance, and inheritance is what supplied the Modify-only ACE above.',
+        '    restores inheritance, and inheritance is what supplied the Modify-only ACE above. Where it strips the last',
+        '    entry naming you, the directory ends up in exactly the state the diagnosis above describes — its only access',
+        '    the inherited `Authenticated Users:(M)` (#8314 measured that follow-on failure).',
         '',
     ];
 }
@@ -307,6 +412,76 @@ function degradedGrant() {
         'This is not offered here as a fix, and neither is `danger-full-access`.',
     ];
 }
+/**
+ * What the grant leaves behind once it applies, and how far its label travels.
+ *
+ * The advisory hands the reader a command that makes the backend's workspace
+ * grant succeed. This section says what that grant *is* from the other side —
+ * not as a warning against running it (without it nothing sandboxed runs at
+ * all) but because the effect outlives the session and reaches outside the
+ * workspace, and a reader who learns that from a broken build three projects
+ * later has learned it too late. `#8312` collected those far-away symptoms;
+ * `#8314` measured how the label gets there.
+ *
+ * Every claim is read off the shipped source rather than repeated from the
+ * reports: the standing edits and the dispose path that leaves them
+ * (`src/grant.ts`, whose `dispose` doc says the standing edits are skipped by
+ * design, and `src/index.ts`, whose fail-closed cleanup says the same in
+ * plainer words); the label's `(OI|CI)` inheritance and its home in the SACL
+ * (`src/acl.ts`, the merged security-information flags); and the hard-link
+ * boundary, which the backend's own suite pins as a known reach
+ * (`tests/runner.spec.ts`, "a workspace hard link lets the grant reach an
+ * external file object").
+ *
+ * Two things it deliberately does **not** do. It does not offer a removal
+ * command: the maintainers' own diagnosis skill reports the label and leaves it,
+ * removing one needs `WRITE_OWNER`, and this project has no Windows host to
+ * verify a line on — shipping an unverified removal command would be the same
+ * defect the rest of this module exists to answer. And it does not present the
+ * out-of-tree reach as universally true: it is what happens when the workspace
+ * contains hard links into a store on the same volume, which is what a pnpm
+ * install produces and what the report measured.
+ *
+ * Emitted for every class, like {@link versionBoundary} and for the same reason:
+ * the fact is about the package's grant (and the remedy the advisory hands over
+ * in every class is that grant), not about which of its two calls failed.
+ * @returns the section's lines, ending with the blank separator line.
+ */
+function standingEdits() {
+    return [
+        'What the grant leaves behind, once it applies — worth knowing before you run the command above, because the',
+        'backend does not take it back:',
+        '  The three entries are STANDING, deliberately, and nothing revokes them. The workspace grant is a reuse cache:',
+        '  the dispose path is documented to revoke the revocable (temp) grants and leave "the standing workspace edits',
+        '  in place", and the failure-cleanup path says it in plainer words — standing ACEs "are NOT revoked — they are',
+        '  the intended end state (the reuse cache), not an error artifact". They outlive the session and the harness',
+        '  exiting (`sandbox-windows-acl/src/grant.ts`, `src/index.ts`).',
+        '  The Low integrity label is INHERITABLE (`(OI|CI)`) and it lives in the SACL — which is why the `icacls',
+        '  /reset` above does not take it off: that command rebuilds the DACL. Windows starts a process at the minimum',
+        '  of the user\'s and the program\'s integrity, so anything started from a tree the harness has written to runs at',
+        '  LOW integrity, and none of the symptoms names DSH (#8312 collects them): an Electron/Chromium app exiting',
+        '  `0x80000003` at startup with no output (#7709), msbuild / dotnet / npm refusing or warning about the files as',
+        '  if they came from the Internet when no `Zone.Identifier` exists (#8175), a double-clicked `.exe` / `.cmd`',
+        '  reporting "publisher could not be verified" (#7735).',
+        '  It can also leave the workspace. An NTFS hard link is a SECOND NAME for one file object, so both names share',
+        '  one security descriptor — and a pnpm workspace is largely hard links (`node_modules` pointing into a',
+        '  content-addressed store on the same volume). An inheritable label written inside the tree therefore lands on',
+        '  the STORE\'s objects and stays there, after which every project using that store builds with executables that',
+        '  start at Low integrity, and the failure surfaces as the build tool rather than the sandbox: `vite build` unable',
+        '  to remove its own temp file, `pnpm install` unable to replace a hook (#8314 measured the whole chain). The',
+        '  backend\'s own suite pins the link reach as a known boundary — "a workspace hard link lets the grant reach an',
+        '  external file object" — and its README calls refusing multiply-linked files unviable for ordinary pnpm',
+        '  installs, which leaves the out-of-tree reach open rather than unknown.',
+        '  It is also why the label is not simply removable here: the built-in `diagnose-windows-sandbox-acl` skill',
+        '  (0.2.0 and later) reports `LOW_LABEL` and by design does not remove it, and removing an integrity label needs',
+        '  WRITE_OWNER — the same right this whole failure is about. This advisory hands over no removal command: the',
+        '  maintainers\' own skill does not, and an unverified one would be the defect this plugin exists to answer.',
+        'None of this makes the command above the wrong move — without it, nothing sandboxed runs in this workspace. It',
+        'is what the harness does to a directory it has been pointed at, and it is worth knowing before rather than',
+        'discovering it as a broken build in some other project later.',
+        '',
+    ];
+}
 /**
  * Build the advisory attached to the failing tool result.
  *
@@ -331,6 +506,8 @@ export function advisoryText(failure, context = {}) {
         }
         return nativeInitAdvisory(failure, context.mode, context.electronHost ?? electronHost(), context.href);
     }
+    if (failure.family === 'workspace-denial')
+        return workspaceDenialAdvisory(failure, context.tool, context.href);
     return aclAdvisory(failure, context.href);
 }
 /**
@@ -395,6 +572,7 @@ function aclAdvisory(failure, href) {
         'inherits Full control for you — and open the session on that one.',
         '',
         ...nonFixes(failure, path),
+        ...standingEdits(),
         ...(failure.klass === 'apply-denied' ? [...degradedGrant(), ''] : []),
         'How to read this: the harness documents the prerequisite (' + PREREQUISITE + ') and this',
         'error does not name it yet, so the advice is delivered here instead. This is a stopgap, ' + where + '.',
@@ -542,7 +720,7 @@ function nativeInitAdvisory(failure, mode, onElectron, href) {
  * @returns the user-role notice text.
  */
 function ptyAdvisory(failure, mode, tool, href) {
-    const where = href === undefined ? `tracked upstream (discussion ${PTY_DISCUSSIONS})` : `tracked upstream: ${href}`;
+    const where = href === undefined ? `tracked upstream (discussions ${PTY_DISCUSSIONS})` : `tracked upstream: ${href}`;
     const call = tool === undefined ? 'This tool' : `The \`${tool}\` tool`;
     return [
         'Persistent shell failed to start — command execution is unavailable in this session, and retrying cannot fix it.',
@@ -556,6 +734,24 @@ function ptyAdvisory(failure, mode, tool, href) {
         'shell works under `danger-full-access`, and the one-shot shell tool works under the same confining mode:',
         'persistent PTY × confining sandbox is the combination that fails.',
         '',
+        'Which sessions fail inside that combination is not chance — it is deterministic per (session mode × the host',
+        'binary carrying the sandbox runner), so a "working now" attempt in the same session is not evidence of flakiness.',
+        'Measured against the desktop build with the same runner and the same ConPTY in every arm (#8322):',
+        '  - runner hosted by a plain console-subsystem `node.exe` → the confined shell starts, prompt and shell-integration',
+        '    marks correct;',
+        '  - runner hosted by the packaged desktop\'s GUI-subsystem Electron executable (started with',
+        '    `ELECTRON_RUN_AS_NODE=1`) → the child dies silently: zero bytes on stdout AND stderr, and the non-interactive',
+        '    arm exits 0 with everything it printed lost.',
+        'The rule behind both this and the `0xC0000142` family is the one stated there for its own case: under the',
+        'restricted token a console can be INHERITED but not CREATED — so the host binary, the thing that owns a console',
+        'or owns none, is what the arms above turn on. It is also why the same build behaves differently depending on how',
+        'it was started: the same version run as the desktop app fails, while the Web UI started from a terminal —',
+        'whose `process.execPath` is a real `node.exe` — is reported working under the same confining mode (#8313).',
+        'And the mode that decides is the one the SESSION records, not the one the environment now holds: a session',
+        'whose stream recorded the confining mode keeps failing',
+        'after the app is restarted with a different mode in the environment, while switching it inside that session',
+        'takes effect immediately (#8322).',
+        '',
         'Do NOT retry, and do not look for a command that fixes it: every attempt will fail identically, and there is no',
         'shell to run a command in. Use your file read/write tools instead, and hand the choice below to the user.',
         '',
@@ -566,14 +762,128 @@ function ptyAdvisory(failure, mode, tool, href) {
         `     \`${GLOBAL_PATCH}\` for every profile — replacing its \`persistent-shell\` group with`,
         `     \`${ONE_SHOT_SHELL}\` (a one-shot subprocess, no PTY); the patch layer is yours, so an upgrade`,
         '     will not overwrite it; or',
-        '  3. run the session with `danger-full-access`, which drops the very confinement the sandbox exists to give.',
-        '     Prefer 1 or 2.',
+        '  3. run the session from a host that owns a console instead of the packaged desktop app — the Web UI started',
+        '     from a terminal (`process.execPath` is a real `node.exe` there) was reported working under the same',
+        '     confining mode and the same version (#8313); or',
+        '  4. run the session with `danger-full-access`, which drops the very confinement the sandbox exists to give.',
+        '     Prefer 1 to 3.',
         '',
         'How to read this: the failure names no cause and points at no remedy, so the diagnosis is delivered here instead.',
         'This is a stopgap, ' + where + '. Unless the mode is `danger-full-access`, this plugin stays silent, because a',
         'shell can fail to start for other reasons and a confident wrong cause is worse than no answer.',
     ].join('\n');
 }
+/**
+ * Build the advisory for a confined command that was denied a path inside its
+ * own workspace.
+ *
+ * Four things this text must do, and one it must not. It must lead with the
+ * fact that **retrying is provably useless** (the backend's provisioning check
+ * short-circuits on the root, so the object that missed the propagation is never
+ * revisited) — that is the whole reason the model needs telling rather than
+ * discovering. It must show the **path it keyed on and the root it tested it
+ * against**, because the family's claim is a statement about two strings and the
+ * reader is entitled to audit it. It must give the **two-sided** reachability
+ * rule, since a check that only looks for the capability ACE reports an object
+ * as granted when the read side is refused as well. And it must name the
+ * **label variant** of the same shape, because from inside a session the two are
+ * indistinguishable and a reader who repairs the wrong half has learned
+ * nothing.
+ *
+ * What it must not do is print a repair command. The obvious one is refused by
+ * Windows with `ERROR_NONE_MAPPED` (1332) — a capability SID has no name for
+ * `icacls` to map — and the one that would work needs `WRITE_DAC` on the object,
+ * which is the right in question. This project has no Windows host to verify a
+ * line on, and the standing-grant section of the ACL advisory is held to the
+ * same standard for the same reason: an unverified remedy delivered confidently
+ * is the defect this plugin exists to answer. The mechanism is stated instead,
+ * and the reader is told why the command is absent.
+ * @param failure - the recognized failure.
+ * @param tool - the tool whose call was denied, when the caller knows it.
+ * @param href - optional URL shown for the upstream thread.
+ * @returns the user-role notice text.
+ */
+function workspaceDenialAdvisory(failure, tool, href) {
+    const where = href === undefined
+        ? `tracked upstream (discussion ${WORKSPACE_DENIAL_DISCUSSIONS})`
+        : `tracked upstream: ${href}`;
+    const call = tool === undefined ? 'This command' : `The \`${tool}\` command`;
+    const subject = failure.paths[0] ?? '<the path from the error line above>';
+    return [
+        'Denied inside your own workspace — the workspace grant does not reach that part of the tree, and retrying cannot repair it.',
+        '',
+        'What was reported:',
+        `  ${failureLine(failure)}`,
+        `${call} ran under sandbox mode \`${failure.mode}\`, where a write INSIDE the workspace is supposed to succeed, and every`,
+        'path it named is inside this session\'s workspace:',
+        ...failure.paths.map(path => `  ${path}`),
+        `  (workspace root: ${failure.workspaceRoot})`,
+        'So this is not the sandbox declining work that belongs outside the workspace. It is the workspace\'s own grant',
+        'failing to cover an object inside it, which is why every command touching that object fails the same way.',
+        '',
+        'Why — and why retrying cannot fix it:',
+        '  The host-side grant is written ONCE, on the workspace ROOT, and relies on Windows ACE inheritance to reach',
+        '  everything beneath it. Writing an inherited ACE into an ALREADY-EXISTING child needs WRITE_DAC on that child;',
+        '  where the caller does not hold it, Windows skips the child silently — no error, no return value, no log line.',
+        '  The backend then checks only the root (`hasExactGrant(workspaceRoot)`) and returns early when the grant is',
+        '  already there, which it is from the first call onwards. The descendants that missed the propagation are',
+        '  therefore never revisited — not later in this session, not in any later one — so the identical command keeps',
+        '  failing and there is no number of attempts that changes that',
+        '  (`packages/sandbox/sandbox-windows-acl/src/acl.ts`).',
+        '  WHICH objects miss it is a fact about who created them: objects the harness itself creates inherit the ACE,',
+        '  while objects that already existed or that another account or tool created (an installer, an editor, another',
+        '  agent harness running under its own account) are the ones the propagation skipped. #423 measured 170 of 729',
+        '  objects missing it, INCLUDING root-level files — so it is not only subdirectories, and "write it at the',
+        '  workspace root instead" is not a safe move either.',
+        '',
+        'Confirm it — this is the discriminator, and the second half is the part a single check gets wrong:',
+        `  icacls "${subject}"`,
+        'compared with the same command against the workspace root. The root carries an inheritable ACE for the workspace',
+        'capability SID — a `S-1-4-…` that `icacls` prints as an unresolved SID rather than a name — with Modify or Full',
+        'control; the failing object does not have it. Check each path listed above the same way; the first is shown here.',
+        '  THE TRAP: reading and listing go through the NORMAL token, writing and deleting through the RESTRICTED',
+        '  (low-integrity) one, and both sides must pass. An object whose DACL names only Administrators/SYSTEM plus the',
+        '  capability SID is refused on the read side as well, so it looks granted to a check that only searches for the',
+        '  capability SID — #423 measured exactly that on a `.cache` directory. A check that asks only "is the SID there?"',
+        '  reports those objects as fine while LIST and WRITE are both denied.',
+        '  A SECOND measured variant has the same shape and a different object: the coverage that is missing can be the',
+        '  mandatory-integrity LABEL rather than a DACL entry. It was reported in this same thread on 2026-09-29 against a',
+        '  `0.2.0-rc.1` install, under the same root-only short-circuit. Inside a session the two are indistinguishable;',
+        '  from outside, the repository\'s own diagnosis skill separates them — `diagnose-windows-sandbox-acl` (0.2.0 and',
+        '  later) reports `hasExactDeny()` for the DACL half and `LOW_LABEL` (`S-1-16-4096`) for the label half.',
+        '',
+        'Why the natural repair is closed — this is a Windows ceiling, not a mistake in the command:',
+        '  The grant the root carries is written for a capability SID, and a recursive `icacls /grant "*S-1-4-…:…" /T /C`',
+        '  is refused with ERROR_NONE_MAPPED (1332): the tool cannot map that SID to a name, so a grant that needs to name',
+        '  it never reaches the child. Widening the grant to a nameable account is a different grant with different',
+        '  consequences, not this one restored.',
+        '',
+        'What helps:',
+        '  - The move that is yours, and the only one available inside the session: write new files under a directory the',
+        '    harness itself created in this workspace. Those carry the grant, because their inheritance did apply — the',
+        '    reporter\'s own measurement, that objects DSH created are complete here and externally created ones are not.',
+        '  - The user\'s move: repair the specific object from an account that already holds WRITE_DAC on it, by writing',
+        '    the ACE the root carries into the child\'s own DACL. That needs the very right that is missing, so it is not',
+        '    something an unelevated prompt can do.',
+        '  No repair command is printed here on purpose. This project has no Windows host to verify one on, and shipping',
+        '  an unverified line would be the same defect this plugin exists to answer. The mechanism above is what is known;',
+        '  the line is yours to choose.',
+        '',
+        'The retry you are about to be offered: the denial surface offers one retry of this exact command under a wider',
+        'mode. That retry can only succeed by removing the confinement itself — it repairs nothing in the workspace, and',
+        'the next session meets the same gap. Take it only if that is what you mean to buy.',
+        '',
+        'Do NOT retry this call unchanged: the provisioning path short-circuits on the root grant, so the object that was',
+        'skipped is never revisited.',
+        '',
+        'How to read this: the denial names no cause and points at no repair, so the diagnosis is delivered here instead.',
+        'This is a stopgap, ' + where + '. This plugin speaks only when the mode is `workspace-write`, the host is',
+        'Windows, and every path the command names lies inside the workspace — a denial anywhere else is the sandbox',
+        'working as designed, and a confident wrong cause is worse than no answer.',
+        'What it is NOT: this plugin does not edit an ACL, does not elevate, and does not offer `danger-full-access` as a',
+        'fix.',
+    ].join('\n');
+}
 /**
  * Build the pre-dispatch denial for the optional fail-fast half.
  *