v0.2.1 — security fixes from three adversarial review rounds (AI-generated, not human-reviewed)

Superseded by v0.2.1 — that release fixes two code-execution paths found in an adversarial review of this bundle (module-resolution hijack in the shim and in the provider), an arbitrary-path file write, and a preload that could break every sandboxed command.

⚠️ NOT REVIEWED BY ANY HUMAN

AI-generated by DeepSeek V4.1-flash, an AI agent running in DeepSeek Harness, under human direction and approval. No human has read, reviewed, audited or approved this code.

Security fixes (three adversarial review rounds)

Every finding below was reproduced on one machine before it was fixed, and every fix was re-attacked with the same technique.

• Removed a code-execution path inside the sandbox runner. console-shim.mjs resolved koffi through a bare specifier, which walks the plugin's ancestor directories — all writable by any local process. A planted package executed inside the runner, which runs outside the sandbox. Reproduced; now resolved only from inside the running Harness installation.
• Validated the base-class resolution. index.js loaded @deepseek-ai/dsh-sandbox-local through the same unvalidated walk-up chain, inside the Harness process, and the returned class controls windowsAclRunnerInvocation(). Reproduced with a planted package; the resolved realpath must now be inside this plugin's own node_modules or the dsh profile root.
• Removed an arbitrary-path file write. The diagnostic env var wrote and truncated whatever path it was given. It now emits one stderr line and writes no files.
• A broken preload no longer breaks every command. A missing shim used to be injected anyway, so the runner failed to start; the shim is now checked before it is preloaded.
• Strengthened the post-merge verification: the token's Default DACL is walked, and the ACE must name Everyone and carry FILE_ALL_ACCESS, instead of comparing ACE counts.
• Released the token handle, the SID and the merged ACL; guarded the 64-bit-only struct layout; guarded each step of the fallback's standard-handle restore.
• scripts/validate-manifests.cjs gained nine assertions (row-guard polarity and form, no bare specifier, no file writes, x64 guard, mask check, resource release, base-class provenance, shim existence).

Measured after the fix

Check	Result
GUI host + workspace-write, plugin only	child exit 0
the confined child reads its own restricted token Default DACL	Everyone ACE present, mask 0x1f01ff
writes outside the workspace	denied and absent
the child's own console	created, never visible across 1.6 s
runner token change affecting the parent process	none (PARENT 3 / CHILD 4 / PARENT 3 ACEs)

Unresolved, disclosed

The bundle's source directory is executed through a link: install. On the machine used for this review that directory inherited an Authenticated Users: Modify ACE from the volume root, so any authenticated local user could rewrite code the Harness executes — including cordis.patch.yml, whose !!js expressions the Loader evaluates. That is a deployment property, not something this bundle can fix in code; tighten the directory's ACL or accept the trust premise. Uninstall the bundle before validating a Harness upgrade — while installed, its disabled patch silently discards upstream changes to the shipped sandbox row.

Superseded by v0.2.0 — this release fixes the failure from the console side; v0.2.0 fixes the Default DACL instead, with the console kept only as a fallback.

⚠️ NOT REVIEWED BY ANY HUMAN

AI-generated by DeepSeek V4.1-flash, an AI agent running in DeepSeek Harness, under human direction and approval. No human has read, reviewed, audited or approved this code.

Changed

• Primary mechanism replaced. The shim now merges an Everyone full-access ACE into the runner process token's Default DACL before the runner derives the restricted token — the same ACE the shipped runner already merges in read-only — instead of relying on giving the runner a console.
• The console allocation is kept as an automatic fallback when that merge cannot be applied.
• DSH_SANDBOX_CONSOLE_FIX_DEBUG=<file> records which path was taken.

Measured before shipping

check	result
token adjustable	SetTokenInformation ok; Default DACL gains Everyone without losing existing ACEs
struct layout	EXPLICIT_ACCESS_W = 48 bytes, matching the shipped runner's entries.length / 48
child starts	GUI host + workspace-write, shim only, no console shim -> childExit 0, stdout CHILD-OK (control: 3221225794)
confinement intact	four out-of-workspace targets denied and absent; in-workspace write succeeds
window	the child's own console is created and never visible across 1.6 s

The structural fix belongs upstream — a one-line Default-DACL change (routing index: #9195; cross-check: #9280). > Superseded by v0.1.1 — this release's shim did not restore the runner's three standard handles and could allocate a visible console window. Install v0.1.1 instead.

⚠️ NOT REVIEWED BY ANY HUMAN

AI-generated by DeepSeek V4.1-flash, an AI agent running in DeepSeek Harness, under human
direction and approval. No human has read, reviewed, audited or approved this code. Read
index.js, console-shim.mjs and cordis.patch.yml before installing.

Fixed

• console-shim.mjs now saves and restores the runner's three standard handles around AllocConsole(),
  so the runner's own stdout/stderr keep pointing back at the Harness. Measured in the Harness Electron
  environment: 1816/1624/1700 -> 712/716/720 without the restore, unchanged with it.
• console-shim.mjs now hides the console window it allocates. A console allocated in a host that was
  not spawned with SW_HIDE is otherwise visible (IsWindowVisible(GetConsoleWindow()) true, window
  titled after the host image); an already-existing console is left untouched for developers running
  from a terminal.

Verified

Re-checked end to end in a real workspace-write session after the change — no reinstall and no restart
needed, because the runner reads the shim on every spawn: pwsh 7.6.6, in-workspace writes succeed, and
writes to %USERPROFILE%, the drive root and C:\Windows\Temp are denied with the files absent.

Documentation

The failure shape is now recorded as the native-init family named by
@argszero/cordis-plugin-sandbox-grant-advisor, with the measured remedies from discussions
#8193/#8208, the write-up in #9238, and the ruling that makes the failure opaque
(RUNNER_FAILURE_RULES['windows-acl'] is exit-127-gated by design).

Supersedes v0.1.0, whose shim did not restore the standard handles and could allocate a visible window. > # ⚠️ NOT REVIEWED BY ANY HUMAN

AI-generated by DeepSeek V4.1-flash, an AI agent running in DeepSeek Harness, under human
direction and approval. No human has read, reviewed, audited or approved this code. Read
index.js, console-shim.mjs and cordis.patch.yml before installing.

What it does

Fixes the Windows desktop failure where every workspace-write shell call dies instantly with
0xC0000142 (STATUS_DLL_INIT_FAILED): the Windows ACL sandbox runner is spawned with the Electron
binary, which has no console, while the confined child is expected to inherit one. The bundle inserts
--import <console-shim> in front of the runner entry, so the runner allocates a console. No token,
ACL, integrity label, policy or fs rule is changed.

Install

Plugin Manager -> install bundle -> https://github.com/TJZF-4j97/dsh-sandbox-console-fix (or a local
checkout of this directory), then restart the Harness. The package declares no dependencies, so nothing
is downloaded and no build script is requested.

Verified

Windows 11 22H2 x64, desktop 0.2.0-rc.2 (Electron 44.0.0 / Node 24.18.1), in a real workspace-write
session with the platform-guarded patch loaded:

• a workspace-write shell call returns pwsh 7.6.6 instead of 0xC0000142;
• in-workspace writes succeed;
• writes outside the workspace (%USERPROFILE%, the drive root, C:\Windows\Temp) are denied and the
  files are absent afterwards;
• 5,000 lines of stdout and the child's stderr both arrive intact; the child's console exists but is not
  visible.

Full record, failure matrix and everything that was ruled out: docs/VERIFICATION.md.

Known limits

• Why the child's own console creation succeeds in read-only but fails in workspace-write is still
  not isolated (sections 5 and 9 of the verification record).
• Piped stdio between programs inside a confined shell is blocked by the sandbox itself — that is not
  this bundle's doing, and it is why the reproduction scripts must run outside a confined shell. > # ⚠️ NOT REVIEWED BY ANY HUMAN

AI-generated by DeepSeek V4.1-flash, an AI agent running in DeepSeek Harness, under human
direction and approval. No human has read, reviewed, audited or approved this code. Read
index.js, console-shim.mjs and cordis.patch.yml before installing.

What it does

Fixes the Windows desktop failure where every workspace-write shell call dies instantly with
0xC0000142 (STATUS_DLL_INIT_FAILED): the Windows ACL sandbox runner is spawned with the Electron
binary, which has no console, while the confined child is expected to inherit one. The bundle inserts
--import <console-shim> in front of the runner entry, so the runner allocates a console. No token,
ACL, integrity label, policy or fs rule is changed.

Install

Plugin Manager -> install bundle -> https://github.com/TJZF-4j97/dsh-sandbox-console-fix (or a local
checkout of this directory), then restart the Harness. The package declares no dependencies, so nothing
is downloaded and no build script is requested.

Verified

Windows 11 22H2 x64, desktop 0.2.0-rc.2 (Electron 44.0.0 / N...

v0.2.0 — Default-DACL fix (primary), console fallback (AI-generated, not human-reviewed)

Superseded by v0.2.0 — this release fixes the failure from the console side; v0.2.0 fixes the Default DACL instead, with the console kept only as a fallback.

⚠️ NOT REVIEWED BY ANY HUMAN

AI-generated by DeepSeek V4.1-flash, an AI agent running in DeepSeek Harness, under human direction and approval. No human has read, reviewed, audited or approved this code.

Changed

• Primary mechanism replaced. The shim now merges an Everyone full-access ACE into the runner process token's Default DACL before the runner derives the restricted token — the same ACE the shipped runner already merges in read-only — instead of relying on giving the runner a console.
• The console allocation is kept as an automatic fallback when that merge cannot be applied.
• DSH_SANDBOX_CONSOLE_FIX_DEBUG=<file> records which path was taken.

Measured before shipping

check	result
token adjustable	SetTokenInformation ok; Default DACL gains Everyone without losing existing ACEs
struct layout	EXPLICIT_ACCESS_W = 48 bytes, matching the shipped runner's entries.length / 48
child starts	GUI host + workspace-write, shim only, no console shim -> childExit 0, stdout CHILD-OK (control: 3221225794)
confinement intact	four out-of-workspace targets denied and absent; in-workspace write succeeds
window	the child's own console is created and never visible across 1.6 s

The structural fix belongs upstream — a one-line Default-DACL change (routing index: #9195; cross-check: #9280). > Superseded by v0.1.1 — this release's shim did not restore the runner's three standard handles and could allocate a visible console window. Install v0.1.1 instead.

⚠️ NOT REVIEWED BY ANY HUMAN

AI-generated by DeepSeek V4.1-flash, an AI agent running in DeepSeek Harness, under human
direction and approval. No human has read, reviewed, audited or approved this code. Read
index.js, console-shim.mjs and cordis.patch.yml before installing.

Fixed

• console-shim.mjs now saves and restores the runner's three standard handles around AllocConsole(),
  so the runner's own stdout/stderr keep pointing back at the Harness. Measured in the Harness Electron
  environment: 1816/1624/1700 -> 712/716/720 without the restore, unchanged with it.
• console-shim.mjs now hides the console window it allocates. A console allocated in a host that was
  not spawned with SW_HIDE is otherwise visible (IsWindowVisible(GetConsoleWindow()) true, window
  titled after the host image); an already-existing console is left untouched for developers running
  from a terminal.

Verified

Re-checked end to end in a real workspace-write session after the change — no reinstall and no restart
needed, because the runner reads the shim on every spawn: pwsh 7.6.6, in-workspace writes succeed, and
writes to %USERPROFILE%, the drive root and C:\Windows\Temp are denied with the files absent.

Documentation

The failure shape is now recorded as the native-init family named by
@argszero/cordis-plugin-sandbox-grant-advisor, with the measured remedies from discussions
#8193/#8208, the write-up in #9238, and the ruling that makes the failure opaque
(RUNNER_FAILURE_RULES['windows-acl'] is exit-127-gated by design).

Supersedes v0.1.0, whose shim did not restore the standard handles and could allocate a visible window. > # ⚠️ NOT REVIEWED BY ANY HUMAN

AI-generated by DeepSeek V4.1-flash, an AI agent running in DeepSeek Harness, under human
direction and approval. No human has read, reviewed, audited or approved this code. Read
index.js, console-shim.mjs and cordis.patch.yml before installing.

What it does

Fixes the Windows desktop failure where every workspace-write shell call dies instantly with
0xC0000142 (STATUS_DLL_INIT_FAILED): the Windows ACL sandbox runner is spawned with the Electron
binary, which has no console, while the confined child is expected to inherit one. The bundle inserts
--import <console-shim> in front of the runner entry, so the runner allocates a console. No token,
ACL, integrity label, policy or fs rule is changed.

Install

Plugin Manager -> install bundle -> https://github.com/TJZF-4j97/dsh-sandbox-console-fix (or a local
checkout of this directory), then restart the Harness. The package declares no dependencies, so nothing
is downloaded and no build script is requested.

Verified

Windows 11 22H2 x64, desktop 0.2.0-rc.2 (Electron 44.0.0 / Node 24.18.1), in a real workspace-write
session with the platform-guarded patch loaded:

• a workspace-write shell call returns pwsh 7.6.6 instead of 0xC0000142;
• in-workspace writes succeed;
• writes outside the workspace (%USERPROFILE%, the drive root, C:\Windows\Temp) are denied and the
  files are absent afterwards;
• 5,000 lines of stdout and the child's stderr both arrive intact; the child's console exists but is not
  visible.

Full record, failure matrix and everything that was ruled out: docs/VERIFICATION.md.

Known limits

• Why the child's own console creation succeeds in read-only but fails in workspace-write is still
  not isolated (sections 5 and 9 of the verification record).
• Piped stdio between programs inside a confined shell is blocked by the sandbox itself — that is not
  this bundle's doing, and it is why the reproduction scripts must run outside a confined shell. > # ⚠️ NOT REVIEWED BY ANY HUMAN

AI-generated by DeepSeek V4.1-flash, an AI agent running in DeepSeek Harness, under human
direction and approval. No human has read, reviewed, audited or approved this code. Read
index.js, console-shim.mjs and cordis.patch.yml before installing.

What it does

Fixes the Windows desktop failure where every workspace-write shell call dies instantly with
0xC0000142 (STATUS_DLL_INIT_FAILED): the Windows ACL sandbox runner is spawned with the Electron
binary, which has no console, while the confined child is expected to inherit one. The bundle inserts
--import <console-shim> in front of the runner entry, so the runner allocates a console. No token,
ACL, integrity label, policy or fs rule is changed.

Install

Plugin Manager -> install bundle -> https://github.com/TJZF-4j97/dsh-sandbox-console-fix (or a local
checkout of this directory), then restart the Harness. The package declares no dependencies, so nothing
is downloaded and no build script is requested.

Verified

Windows 11 22H2 x64, desktop 0.2.0-rc.2 (Electron 44.0.0 / Node 24.18.1), in a real workspace-write
session with the platform-guarded patch loaded:

• a workspace-write shell call returns pwsh 7.6.6 instead of 0xC0000142;
• in-workspace writes succeed;
• writes outside the workspace (%USERPROFILE%, the drive root, C:\Windows\Temp) are denied and the
  files are absent afterwards;
• 5,000 lines of stdout and the child's stderr both arrive intact; the child's console exists but is not
  visible.

Full record, failure matrix and everything that was ruled out: docs/VERIFICATION.md.

Known limits

• Why the child's own console creation succeeds in read-only but fails in workspace-write is still
  not isolated (sections 5 and 9 of the verification record).
• Piped stdio between programs inside a confined shell is blocked by the sandbox itself — that is not
  this bundle's doing, and it is why the reproduction scripts must run outside a confined shell.

v0.1.1 — restore the runner standard handles, hide the console window (AI-generated, not human-reviewed)

Superseded by v0.1.1 — this release's shim did not restore the runner's three standard handles and could allocate a visible console window. Install v0.1.1 instead.

⚠️ NOT REVIEWED BY ANY HUMAN

AI-generated by DeepSeek V4.1-flash, an AI agent running in DeepSeek Harness, under human
direction and approval. No human has read, reviewed, audited or approved this code. Read
index.js, console-shim.mjs and cordis.patch.yml before installing.

Fixed

• console-shim.mjs now saves and restores the runner's three standard handles around AllocConsole(),
  so the runner's own stdout/stderr keep pointing back at the Harness. Measured in the Harness Electron
  environment: 1816/1624/1700 -> 712/716/720 without the restore, unchanged with it.
• console-shim.mjs now hides the console window it allocates. A console allocated in a host that was
  not spawned with SW_HIDE is otherwise visible (IsWindowVisible(GetConsoleWindow()) true, window
  titled after the host image); an already-existing console is left untouched for developers running
  from a terminal.

Verified

Re-checked end to end in a real workspace-write session after the change — no reinstall and no restart
needed, because the runner reads the shim on every spawn: pwsh 7.6.6, in-workspace writes succeed, and
writes to %USERPROFILE%, the drive root and C:\Windows\Temp are denied with the files absent.

Documentation

The failure shape is now recorded as the native-init family named by
@argszero/cordis-plugin-sandbox-grant-advisor, with the measured remedies from discussions
#8193/#8208, the write-up in #9238, and the ruling that makes the failure opaque
(RUNNER_FAILURE_RULES['windows-acl'] is exit-127-gated by design).

Supersedes v0.1.0, whose shim did not restore the standard handles and could allocate a visible window. > # ⚠️ NOT REVIEWED BY ANY HUMAN

AI-generated by DeepSeek V4.1-flash, an AI agent running in DeepSeek Harness, under human
direction and approval. No human has read, reviewed, audited or approved this code. Read
index.js, console-shim.mjs and cordis.patch.yml before installing.

What it does

Fixes the Windows desktop failure where every workspace-write shell call dies instantly with
0xC0000142 (STATUS_DLL_INIT_FAILED): the Windows ACL sandbox runner is spawned with the Electron
binary, which has no console, while the confined child is expected to inherit one. The bundle inserts
--import <console-shim> in front of the runner entry, so the runner allocates a console. No token,
ACL, integrity label, policy or fs rule is changed.

Install

Plugin Manager -> install bundle -> https://github.com/TJZF-4j97/dsh-sandbox-console-fix (or a local
checkout of this directory), then restart the Harness. The package declares no dependencies, so nothing
is downloaded and no build script is requested.

Verified

Windows 11 22H2 x64, desktop 0.2.0-rc.2 (Electron 44.0.0 / Node 24.18.1), in a real workspace-write
session with the platform-guarded patch loaded:

• a workspace-write shell call returns pwsh 7.6.6 instead of 0xC0000142;
• in-workspace writes succeed;
• writes outside the workspace (%USERPROFILE%, the drive root, C:\Windows\Temp) are denied and the
  files are absent afterwards;
• 5,000 lines of stdout and the child's stderr both arrive intact; the child's console exists but is not
  visible.

Full record, failure matrix and everything that was ruled out: docs/VERIFICATION.md.

Known limits

• Why the child's own console creation succeeds in read-only but fails in workspace-write is still
  not isolated (sections 5 and 9 of the verification record).
• Piped stdio between programs inside a confined shell is blocked by the sandbox itself — that is not
  this bundle's doing, and it is why the reproduction scripts must run outside a confined shell.

v0.1.0 — Windows workspace-write console fix (AI-generated, not human-reviewed)

⚠️ NOT REVIEWED BY ANY HUMAN

AI-generated by DeepSeek V4.1-flash, an AI agent running in DeepSeek Harness, under human
direction and approval. No human has read, reviewed, audited or approved this code. Read
index.js, console-shim.mjs and cordis.patch.yml before installing.

What it does

Fixes the Windows desktop failure where every workspace-write shell call dies instantly with
0xC0000142 (STATUS_DLL_INIT_FAILED): the Windows ACL sandbox runner is spawned with the Electron
binary, which has no console, while the confined child is expected to inherit one. The bundle inserts
--import <console-shim> in front of the runner entry, so the runner allocates a console. No token,
ACL, integrity label, policy or fs rule is changed.

Install

Plugin Manager -> install bundle -> https://github.com/TJZF-4j97/dsh-sandbox-console-fix (or a local
checkout of this directory), then restart the Harness. The package declares no dependencies, so nothing
is downloaded and no build script is requested.

Verified

Windows 11 22H2 x64, desktop 0.2.0-rc.2 (Electron 44.0.0 / Node 24.18.1), in a real workspace-write
session with the platform-guarded patch loaded:

• a workspace-write shell call returns pwsh 7.6.6 instead of 0xC0000142;
• in-workspace writes succeed;
• writes outside the workspace (%USERPROFILE%, the drive root, C:\Windows\Temp) are denied and the
  files are absent afterwards;
• 5,000 lines of stdout and the child's stderr both arrive intact; the child's console exists but is not
  visible.

Full record, failure matrix and everything that was ruled out: docs/VERIFICATION.md.

Known limits

• Why the child's own console creation succeeds in read-only but fails in workspace-write is still
  not isolated (sections 5 and 9 of the verification record).
• Piped stdio between programs inside a confined shell is blocked by the sandbox itself — that is not
  this bundle's doing, and it is why the reproduction scripts must run outside a confined shell.