[Bug][Desktop] Windows 客户端下载下来启动报错，加上--no-sandbox 后可正常启动

[chenguangju]

系统：Windows x64

版本：@deepseek-ai/dsh-desktop 0.2.1-rc.3

Electron：44.7.0

现象：启动即崩溃，渲染控制台无 error 输出

绕过方案：加 --no-sandbox 后可正常启动

你的推断：疑似 Electron 44 在 Windows 上的沙箱兼容性问题

[PerryLink]

--no-sandbox working points at Chromium's own sandbox.

The desktop shell runs the host inside Electron with Chromium's sandbox enabled. When the installation directory's DACL carries an AppContainer package SID without the ALL APPLICATION PACKAGES counterpart, Chromium's install-directory access check fails and the browser process exits before any window — exactly "process starts, no window, renderer console empty". --no-sandbox skips that check, which is why it appears to fix it.

There is an easy way to confirm: start once with --enable-logging and look at stderr for install_dir_access. If that line is there, the fix is to remove the stray package ACE from the install directory — the bundled diagnose-windows-sandbox-acl does that (packages/sandbox/sandbox-windows-acl/README.md:78-80), run unconfined:

& '<skill-dir>\scripts\diagnose-windows-sandbox-acl.ps1' -Path '<install-dir>' -AllowRoot '<install-dir>' -Out '<recovery-dir>'

Every DACL change is backed up, re-read to verify, and printed with a rollback command. It refuses managed application trees, so a refusal is possible for an install directory — in that case the same edit has to be made by hand after icacls <install-dir> /save.

If install_dir_access is not in the log, this is not it and the log line you do see is the next thing to go on. I read the check and the skill at f3803c96; I did not reproduce your startup.

[Czerror]

#8453 这个问题我提过了,你把这个地址发给codex 或别的工具让他帮你修