DSH Windows sandbox 0xC0000142 — community fix recipe

[CodeClicki]

Status: community workaround, not an official fix. It patches a binary application bundle.
Use it only on machines that actually hit the bug, keep a backup, and re-check after every DSH update.
Detailed root-cause analysis / verification log: see dsh-windows-sandbox-0xC0000142-fix-plan.md and dsh-windows-sandbox-0xC0000142-report.md in this repo (or the linked discussions).

---

TL;DR (English)

On Windows, with the default workspace-write sandbox mode, every pwsh tool call fails with no output and exit code 3221225794 = 0xC0000142 (STATUS_DLL_INIT_FAILED), while read-only and danger-full-access work.

Root cause: AclSandbox.init() merges the capability SID (workspace/temp write SID) into the restricted token's default DACL. Under workspace-write that default DACL then names no keep-alive SID, so objects the confined child creates (including the stdio pipe) cannot be accessed by the console host / DLL-init components — the child dies early.

Workaround: merge Everyone (worldSid) instead of the capability SID. One same-length byte replacement:

// before
setTokenDefaultDaclGrant(api, restrictedToken, this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid)
// after (right-padded to the same byte length)
setTokenDefaultDaclGrant(api, restrictedToken, worldSid                          )

Apply with patch-asar.js (in this repo), restart DSH, then verify. A better upstream fix is to use logonSid, which is narrower than Everyone — but it is unverified so far.

---

中文摘要

Windows 上 workspace-write（默认档）下所有 pwsh 调用零输出、退出码 0xC0000142（STATUS_DLL_INIT_FAILED）；read-only 与 danger-full-access 正常。

根因：AclSandbox.init() 把能力 SID（工作区/临时写 SID）合并进受限令牌的 default DACL。workspace-write 下该 default DACL 里没有 keep-alive SID，受限子进程新建的对象（含 stdio 管道）无法被控制台宿主 / DLL 初始化组件访问，子进程在初始化阶段死亡。

临时修法：把合并的 SID 改成 Everyone（worldSid），做一次等长字节替换；重启 DSH 后按 §4 验证。上游正解建议改用 logonSid（比 Everyone 窄），但尚未验证。

---

0. 先判断：你是否受影响，是否已经修好

症状（三选一即可复现）：

1. workspace-write 下 pwsh 工具执行 echo hi → 无输出，退出码 3221225794；
2. 切到 danger-full-access 后同一命令正常；
3. read-only 模式正常。

先别改文件。先做两项只读检查：

# 0.1 复现（在 DSH 会话里，保持 workspace-write）
#     期望：受影响时 no output + 3221225794

# 0.2 定位应用文件（桌面版）
Get-ChildItem 'C:\Program Files','C:\Program Files (x86)',$env:LOCALAPPDATA `
  -Filter 'app.asar' -Recurse -Depth 4 -ErrorAction SilentlyContinue |
  Where-Object { $_.DirectoryName -like '*resources*' } |
  Select-Object FullName,Length,LastWriteTime

# 0.3 判断是否已经修好（无需打补丁）
#     用脚本的只读模式：输出 "already patched" 说明已修，直接跳过本方案
node .\patch-asar.js "<install>\resources\app.asar" --check

若你的设备是 CLI / npm 安装（不是桌面版），受影响文件不是 .asar，而是：

<npm root -g>\@deepseek-ai\dsh-sandbox-windows-acl\lib\index.js
# 某些发行版也可能在 <install>\resources\runtime\... 的 node_modules 下

用 npm root -g 确认路径；下面的脚本对普通 .js 文件同样适用。

---

1. 修复（两种形态）

1.1 桌面版（app.asar）

前置条件：

• 把 patch-asar.js 保存到本机任意目录（下文用 .\patch-asar.js 指代），或用它的完整路径；
• DSH 完全退出（含托盘）；
• 对 resources\ 目录有写权限（装在 Program Files 时需管理员）；
• 有 Node.js（node --version 可用）。

# A) 只读探测：报告匹配位置，不写任何东西
node .\patch-asar.js "<install>\resources\app.asar" --check

# B) 试运行：显示将替换的字节区间，不写
node .\patch-asar.js "<install>\resources\app.asar" --dry-run

# C) 正式打补丁（自动备份 <target>.bak-<timestamp>）
node .\patch-asar.js "<install>\resources\app.asar"

# D) 重启 DSH，然后按 §4 验证

1.2 CLI / npm 安装（node_modules 内的 lib/index.js）

$pkg = Join-Path (npm root -g) '@deepseek-ai\dsh-sandbox-windows-acl\lib\index.js'
node .\patch-asar.js $pkg --check
node .\patch-asar.js $pkg

1.3 不用脚本时的等价手工步骤（仅适合能精确编辑二进制的人）

1. 备份目标文件；
2. 在文件中搜索唯一字符串
   setTokenDefaultDaclGrant(api, restrictedToken, this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid
3. 用 worldSid + 39 个空格 覆盖其中的 this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid（保持总字节数不变）；
4. 保存后确认文件大小不变，且该字符串仅出现一次。

手工替换极易写坏二进制；优先用脚本。不要按固定偏移硬改——偏移随版本变化。

---

2. 脚本的安全约束（patch-asar.js）

• 必须恰好 1 处匹配；0 处或多处直接退出，一个字节都不写；
• 替换串右填充到完全等长，文件大小与全部偏移不变；
• 写入前校验：匹配区间之外逐字节相同、区间内必须变成替换串；
• 写入前自动备份（<target>.bak-<timestamp>）；
• 写入后重新读取并校验（大小不变、原串消失、新串唯一）；
• --check / --dry-run 完全不写文件；
• 找不到字符串时不猜测，直接失败（说明构建已变化或不受影响）。

---

3. 不要盲目执行：给 AI/自动化代理的停止条件

如果由 AI 读取本文并操作：

1. 先只读探测（--check），再决定是否写；
2. 以下任一情况必须停止并回报，不得继续：
   • 目标文件不存在或不是预期安装形态；
   • 匹配 0 处或多处；
   • 版本未知 / 与已验证版本（0.2.0-rc.2、0.2.1-rc.2）不同且 --check 结构不符；
   • 没有写权限、DSH 未关闭、杀软锁定文件；
   • 已命中补丁串（已修好）。
3. 正式写入前，要求人工确认目标路径；
4. 写入后必须跑 §4 验证矩阵；失败则按 §5 回滚。

---

4. 验证矩阵（必做）

在 workspace-write 会话（DSH_PERMISSION_MODE 未设置）中：

#	检查	期望
1	echo hi	有输出，退出码 0
2	$PSVersionTable.PSVersion	正常打印（7.x / Core）
3	工作区内写一个探针文件	成功
4	写 C:\Windows\Temp\dsh-probe.txt	被拒（Access denied）
5	echo ok | Measure-Object	管道正常（覆盖 stdio 管道路径）
6	（可选）whoami /groups	显示 Low Mandatory Level，说明受限令牌仍在

第 4 项是关键：它证明修复的是沙箱本身，不是绕过沙箱。若第 4 项也能写，说明围栏失效，立即回滚。

---

5. 回滚

# 关闭 DSH 后，用备份覆盖（备份路径见上一步输出）
Copy-Item '<target>.bak-<timestamp>' '<target>' -Force

⚠️ 备份绑定版本：如果期间 DSH 自动更新过，旧备份是旧版本的完整文件，回滚会把整个应用降级，可能与主程序不匹配而无法启动。升级后应"重新打补丁 + 另存新备份"，而不是用旧备份回滚。回滚后 workspace-write 的 shell 会重新不可用（故障重现，不是新问题）。

---

6. 风险与限制

项	说明
非官方	非官方方案
升级覆盖	nightly/自动更新会重写 app.asar，补丁失效，需重打
asar integrity	当前版本未校验（可加载）；若未来启用每文件 SHA256 校验，补丁会被拒（表现为启动失败）
隔离强度	对象级默认 DACL 从能力 SID 放宽到 Everyone（匿名管道/事件/互斥体）；文件级实测未见 Everyone，但这是有意的降级
版本相关	字符串随上游重构可能变化；脚本会安全失败，不会误写
平台假设	只在 Windows 10 19045 + 0.2.0-rc.2/0.2.1-rc.2 上验证；其他版本先 --check

---

7. 给上游的建议

1. setTokenDefaultDaclGrant 合并的 SID 应选保活组 SID：优先 logonSid（登录会话级，比 Everyone 窄）；若不可行再退回 worldSid 并注释权衡；
2. 回归测试补：受限令牌 + 管道 stdio 下 cmd.exe/pwsh 必须成功；覆盖 Electron 宿主、无控制台宿主、workspace-write + 控制台子系统叶命令；
3. 受限子进程以 0xC0000142 死亡时按沙箱失败上报（附 restricting SID 列表 / 完整性级别 / flags / default DACL 合并 SID），不要只回传裸退出码；
4. 提供"无沙箱但保留文件围栏"的中间档，避免用户被迫切 danger-full-access。

---

8. 证据与引用

• 现象与排查时间线：dsh-windows-sandbox-0xC0000142-report.md
• 根因定位、修复验证、风险评估：dsh-windows-sandbox-0xC0000142-fix-plan.md
• 上游同源报告：Discussion Windows 沙箱 workspace-write 档：任何子进程启动即 0xC0000142（DLL 初始化失败） #9083、Windows 沙箱下 pwsh 无法启动，退出码 0xC0000142（STATUS_DLL_INIT_FAILED） #9923、[Bug] Windows: sandboxed pwsh always dies with 0xC0000142 under console-less host (desktop launch path) #810、Workspace-write sandbox: external processes fail with 0xC0000142 on Windows 10 (build 19041) #1847
  • Windows 沙箱 workspace-write 档：任何子进程启动即 0xC0000142（DLL 初始化失败） #9083 评论区（jambolleo）给出决定性线索：缺陷在 setTokenDefaultDaclGrant 的 SID 选择，worldSid 端到端有效，并建议 logonSid
  • Windows 沙箱下 pwsh 无法启动，退出码 0xC0000142（STATUS_DLL_INIT_FAILED） #9923 提出 CreateProcessAsUserW vs PROC_THREAD_ATTRIBUTE_TOKEN 的对照结论

如果本文对你有帮助，请回帖报告：Windows 版本、DSH 版本、安装形态（桌面/CLI）、--check 输出、验证矩阵结果。这些信息能帮助上游确定修复范围。

9.附件代码

patch-asar.js如下

#!/usr/bin/env node
/*
 * patch-asar.js — DSH Windows sandbox 0xC0000142 community workaround
 *
 * Replaces, byte-for-byte (same length), the default-DACL SID selection in
 * AclSandbox.init() from the workspace/temp capability SID to Everyone:
 *
 *   setTokenDefaultDaclGrant(api, restrictedToken, this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid)
 *   -> setTokenDefaultDaclGrant(api, restrictedToken, worldSid<padding>)
 *
 * Safe by construction:
 *   - requires exactly one match (0 or >1 aborts, nothing written);
 *   - replacement is right-padded so the file length never changes;
 *   - the in-memory edit must differ from the original in exactly one run;
 *   - a timestamped backup is written before the target is touched;
 *   - --check / --dry-run write nothing.
 *
 * Works on any file that contains the exact string:
 *   - desktop:   <install>\resources\app.asar
 *   - CLI/npm:   <npm root>\@deepseek-ai\dsh-sandbox-windows-acl\lib\index.js
 *
 * Usage:
 *   node patch-asar.js <file> --check     # locate + report, write nothing
 *   node patch-asar.js <file> --dry-run   # same + show planned change
 *   node patch-asar.js <file>             # backup + patch + verify
 *
 * Exit codes: 0 = patched or already patched, 1 = refused/failed, 2 = usage.
 */
'use strict';

const fs = require('node:fs');
const path = require('node:path');

const ORIGINAL =
  'setTokenDefaultDaclGrant(api, restrictedToken, this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid';
const STEM = 'setTokenDefaultDaclGrant(api, restrictedToken, worldSid';
const PADDING = ' '.repeat(ORIGINAL.length - STEM.length);
const PATCHED = STEM + PADDING;

function die(code, msg) {
  console.error('ERROR: ' + msg);
  process.exit(code);
}

function stamp() {
  return new Date().toISOString().replace(/[:.]/g, '-');
}

function findAll(buf, needle) {
  const out = [];
  let from = 0;
  for (;;) {
    const at = buf.indexOf(needle, from);
    if (at < 0) break;
    out.push(at);
    from = at + 1;
  }
  return out;
}

const args = process.argv.slice(2);
const file = args.find((a) => !a.startsWith('--'));
const check = args.includes('--check');
const dryRun = args.includes('--dry-run') || check;

if (!file) die(2, 'usage: node patch-asar.js <file> [--check|--dry-run]');
if (!fs.existsSync(file) || !fs.statSync(file).isFile()) die(2, 'not a file: ' + file);
if (Buffer.byteLength(ORIGINAL) !== Buffer.byteLength(PATCHED)) die(2, 'internal: length mismatch');

const buf = fs.readFileSync(file);
const hits = findAll(buf, Buffer.from(ORIGINAL, 'utf8'));
const already = findAll(buf, Buffer.from(PATCHED, 'utf8'));

console.log('file      : ' + path.resolve(file));
console.log('size      : ' + buf.length + ' bytes');
console.log('original  : ' + hits.length + ' match(es)' + (hits.length ? ' @ ' + hits.join(', ') : ''));
console.log('patched   : ' + already.length + ' match(es)' + (already.length ? ' @ ' + already.join(', ') : ''));

if (hits.length === 0) {
  if (already.length > 0) {
    console.log('RESULT: already patched — nothing to do.');
    process.exit(0);
  }
  die(1, 'pattern not found. This build changed upstream (or is not the affected package). Do NOT patch by offset; report the version and stop.');
}
if (hits.length > 1) {
  die(1, 'pattern found ' + hits.length + ' times — refusing an ambiguous edit.');
}
if (already.length > 0) {
  die(1, 'both original and patched strings are present — inconsistent file, refusing.');
}

const offset = hits[0];
const out = Buffer.from(buf);
Buffer.from(PATCHED, 'utf8').copy(out, offset);

// The in-memory edit must touch nothing outside the matched region, and the
// matched region must become PATCHED exactly. (The raw byte difference is NOT
// one contiguous run: the old and new expressions share bytes near "worldSid".)
if (out.length !== buf.length) die(1, 'internal: length changed');
if (!out.subarray(0, offset).equals(buf.subarray(0, offset))) {
  die(1, 'internal: bytes before the match would change');
}
if (!out.subarray(offset + ORIGINAL.length).equals(buf.subarray(offset + ORIGINAL.length))) {
  die(1, 'internal: bytes after the match would change');
}
if (!out.subarray(offset, offset + ORIGINAL.length).equals(Buffer.from(PATCHED, 'utf8'))) {
  die(1, 'internal: replacement did not land as expected');
}

console.log('plan      : replace bytes [' + offset + ', ' + (offset + ORIGINAL.length - 1) + '] (' + ORIGINAL.length + ' bytes, same length)');

if (dryRun) {
  console.log('RESULT: dry run — nothing written.');
  process.exit(0);
}

const backup = file + '.bak-' + stamp();
fs.copyFileSync(file, backup);
console.log('backup    : ' + backup);

fs.writeFileSync(file, out);
const after = fs.readFileSync(file);
if (after.length !== buf.length) die(1, 'verification failed: size changed');
if (findAll(after, Buffer.from(ORIGINAL, 'utf8')).length !== 0) die(1, 'verification failed: original string still present');
if (findAll(after, Buffer.from(PATCHED, 'utf8')).length !== 1) die(1, 'verification failed: patched string not unique');

console.log('RESULT: patched successfully. Restart DSH, then run the verification matrix.');

[argszero]

Your root cause lands on the exact line, and it matches a measurement set we published separately — so here is the confirmation plus the two things the recipe does not say, both of which change how it should be applied.

The line, at master 687f282e86

packages/sandbox/sandbox-windows-acl/src/index.ts:304:

setTokenDefaultDaclGrant(api, restrictedToken, this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid)

Under workspace-write both capability SIDs exist, so worldSid is never reached and the restricted token's default DACL names the capability SID and nothing else. setTokenDefaultDaclGrant (token.ts:112) extends the existing default DACL in place, which is why your same-length, right-padded replacement is required rather than cosmetic: a shorter or longer SID shifts the ACL and the call fails on a malformed structure.

Two corrections to the framing

1. It is a conjunction, not a single cause. The failure needs no console and a default DACL naming no universally-trusted trustee. A run where the confined child inherits a console does not fail with this same DACL, and a run whose default DACL happens to name Everyone/Users does not fail even without a console. Your workaround fixes the second half, which is the half that is missing — but "the capability SID is wrong" overstates it: on a desktop-launched session the identical token works. We measured this pair of arms explicitly (Windows 10 19045, and independently reported by a third party in the advisor repo's issue #1), and it is why the recipe is right for machines that hit the bug and unnecessary for machines that do not.

2. There is a route that does not patch app.asar. The same effect is reachable by granting the ambient trustees an inherited ACE on the temp root, which is what argszero/cordis-plugin-sandbox-grant-advisor does — the repository's tools/ scripts write and measure those grants, and its issue #1 carries the measured conjunction above. Two pitfalls worth knowing before you try the scripted route: the grant must be inheritable ((OI)(CI)), because a non-inheritable ACE only fixes one directory level, and it must be written on the temp root the sandbox actually provisions, not on a look-alike.

Patching the bundle is a legitimate stopgap — it is the smallest diff that removes the failure — but it is a per-release edit inside a signed binary, and the grant route survives DSH updates.

If you want the two arms separated on your machine rather than argued: dump the restricted token's default DACL (the trustee list, not the whole token) alongside whether the confined child got a console. If Everyone is absent and there is no console, the conjunction holds and both routes work; if Everyone is present and it still fails, the cause is elsewhere and neither route will help — say so in the thread and the analysis needs redoing.

[xin-yifan]

logonSid verified — narrower than worldSid, and it is the right upstream fix

I can confirm the diagnosis in the OP and I can close the "logonSid — unverified" gap: logonSid works, and it is strictly narrower than Everyone.

What actually fails

The confined child is spawned with creationFlags = 0 (inherit the host console), but the host is a GUI process with no console, so Windows starts conhost.exe for the child. conhost must open the client process for write-class access. For a WRITE_RESTRICTED token (CreateRestrictedToken flags 13), that access check can only be satisfied by an ACE whose grantee SID is both an enabled group in the token and present in the restricting SID list (restricted-access pass 1).

The capability/workspace SID (S-1-4-…) is in the restricting list but is not a token group, so the check fails:

START pwsh.exe    pid=10548
START conhost.exe pid=6892  ppid=10548
EXIT  conhost.exe status=0xC0000022   (STATUS_ACCESS_DENIED)
EXIT  pwsh.exe    status=0xC0000142   (STATUS_DLL_INIT_FAILED)

worldSid (Everyone) happens to be a token group, which is why the worldSid patch works — and also why read-only mode has never shown the bug (that path already passes worldSid).

The logon SID (S-1-5-5-0-<n>) is also a token group and is already in the restricting list ([logonSid, Everyone, ...writeSids]), so it satisfies pass 1 without granting anything to other users.

Verification matrix

Reproducer: standalone C# P/Invoke, no DSH involved — CreateRestrictedToken(flags=13, restricting=[logon, Everyone, ws]) + Low IL + SetTokenInformation(TokenDefaultDacl) + CreateProcessAsUserW + CREATE_NEW_CONSOLE, child = pwsh.exe (any console exe behaves the same: cmd.exe, csc.exe, GUI notepad.exe with a console too).

Restricted token default DACL grants	Child result
logon SID	exit 0 ✅
S-1-4-… workspace SID (current code)	0xC0000142 ❌
workspace SID + logon SID	exit 0 ✅
logon SID, but logon SID not in the restricting list	0xC0000142 ❌
workspace SID + S-1-5-4 / S-1-2-0 / S-1-5-11 / S-1-5-32-545 (one by one)	0xC0000142 ❌
no override; parent token default DACL already contains logon SID	exit 0 ✅

Other controls: DETACHED_PROCESS (no console) works even with the restricted token; CREATE_NO_WINDOW fails exactly like CREATE_NEW_CONSOLE; unrestricted token + CREATE_NEW_CONSOLE is fine; Low IL on its own is not the trigger.

Verified live, without touching app.asar

On a running DSH 0.2.1-rc.2 instance I only changed the process token's default DACL to
D:(A;;GA;;;S-1-5-5-0-<n>)(A;;GA;;;WD)(A;;GA;;;SY)(A;;GA;;;BA):

• sandboxed command works: PSVersion 7.6.8 / PSEdition Core;
• writes inside the workspace work;
• writes outside are still denied (C:\Users\…, C:\Windows\Temp, D:\ root);
• whoami /groups still shows Mandatory Label\Low Mandatory Level.

A small launcher that adds the logon SID to its own token default DACL before Start-Process-ing DSH makes this persistent (children inherit the DACL) — that is what I use as the end-user workaround, no asar patching and no permission downgrade.

Suggested upstream change

// before
setTokenDefaultDaclGrant(api, restrictedToken,
  this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid);
// after (keep the capability SID if you want, but the logon SID must be there)
setTokenDefaultDaclGrant(api, restrictedToken, [
  this.logonSidPtr,
  this.tempWriteSidPtr ?? this.writeSidPtr,
]);

logonSid is already resolved for the restricting list in the same file, so this needs no new SID plumbing. If a narrower-than-Everyone fix is not wanted yet, at minimum the invariant should be documented: the DACL SID must be a token group, i.e. worldSid or logonSid, never a bare capability SID.

I can attach the ~200-line standalone reproducer (repro-default-dacl.ps1) and the full write-up (environment, every excluded hypothesis: antivirus filter driver, AMSI provider, %TEMP% ACLs, seclogon, Low IL, restricting-SID contents) if useful.

———
中文摘要：已实测确认 logonSid 方案可用，且比 Everyone 更窄。机理是 conhost 打开受限子进程时需要"令牌组成员 + restricting 成员"同时成立，S-1-4-… 只是 restricting SID、不是令牌组，故被拒（0xC0000022 → 0xC0000142）；而登录 SID 既是令牌成员又在 restricting 列表里。上表为完整矩阵，另附"不改 asar、只改运行中进程令牌默认 DACL"的验证与启动器做法。建议上游把登录 SID 并入默认 DACL 授予列表。