Sandboxed commands lose ALL outbound network access on Windows (ACL restricted token)

[Freezing0325]

报告 2：Windows 沙箱（ACL 受限令牌）下命令完全丧失出站网络能力

Packages / 涉及包: @deepseek-ai/dsh-sandbox-windows-acl (+ dsh-pwsh-sandbox / dsh-bash-sandbox)

Symptom / 症状

Any command executed under the default sandbox modes (read-only / workspace-write) on Windows cannot make ANY outbound TCP connection — even to domestic sites:

• curl https://www.baidu.com → 000 (connection failure)
• curl https://api.github.com → 000
• curl via the local proxy → 000
• Test-NetConnection <ip> -Port 443 → False
• curl -v shows: schannel: AcquireCredentialsHandle failed: SEC_E_NO_CREDENTIALS (0x8009030E)

ICMP to the gateway still works (physical link is fine). Running the SAME commands under danger-full-access works perfectly (all return 200).

Windows 上，在默认沙箱模式（read-only / workspace-write）下执行的任何命令都无法建立任何出站 TCP 连接——连国内站点都不行：

• curl https://www.baidu.com → 000（连接失败）
• curl https://api.github.com → 000
• 走本地代理的 curl → 000
• Test-NetConnection <ip> -Port 443 → False
• curl -v 显示：schannel: AcquireCredentialsHandle failed: SEC_E_NO_CREDENTIALS (0x8009030E)

到网关的 ICMP 仍然正常（物理链路没问题）。同样的命令在 danger-full-access 模式下完全正常（全部返回 200）。

Contradiction with documented behavior / 与文档描述的矛盾

The ACL sandbox's own header comment (src/index.ts) states:

writes are restricted; reads, network, and process visibility are NOT

…but in practice outbound TCP is entirely broken under the restricted token (CreateRestrictedToken with DISABLE_MAX_PRIVILEGE + restricting SIDs).

ACL 沙箱源码自己的注释（src/index.ts）写着：

writes are restricted; reads, network, and process visibility are NOT（仅限制写入；读取、网络和进程可见性不受限制）

但实际上，受限令牌（CreateRestrictedToken + DISABLE_MAX_PRIVILEGE + restricting SIDs）下的进程出站 TCP 完全不可用。

Impact / 影响

Any tool command needing the network inside the sandbox (git clone/fetch, npm install, curl, pip install, etc.) fails on Windows. The only workaround today is escalating every network command to danger-full-access, which disables the sandbox entirely.

沙箱内任何需要网络的工具命令（git clone/fetch、npm install、curl、pip install 等）在 Windows 上都会失败。目前唯一的绕过方式是每次把网络命令升级到 danger-full-access，但这会完全禁用沙箱。

Suggested direction / 建议方向

Investigate why the restricted token breaks the network stack (likely Schannel credential acquisition / WFP interaction) and either fix it, or expose a network capability grantable without full access.

调查受限令牌为何会破坏网络栈（可能与 Schannel 凭据获取 / WFP 的交互有关），修复它；或者提供一个无需完全访问权限即可授予的网络能力。

Environment / 环境

Windows 10, dsh 0.1.0-rc.6 (npm). Reproduced locally.

Windows 10，dsh 0.1.0-rc.6（npm）。本机复现。