Windows: sandboxed pwsh spawns show a new console window per command (no parent console in windows-acl runner)

[wanantara-green]

---

title: "Windows: sandboxed pwsh spawns show a new console window per command (no parent console in windows-acl runner)"
labels: [bug, windows, sandbox]

中文简述：Windows 上，@deepseek-ai/dsh-sandbox-windows-acl 的 runner 在受限令牌下为每次命令创建了新的可见控制台窗口（pwsh 是 console 程序且 runner 自身没有控制台）。已定位根因并给出建议修复，见下。上游对应桌面端 issue：#16 (bruc3van/dsh-desktop#16)。

Summary

On Windows, every agent command executed through the sandbox (pwsh -NoLogo -NoProfile -NonInteractive -Command …) flashes a visible PowerShell console window. The number of windows equals the number of tool invocations.

Affected packages (this monorepo):

• @deepseek-ai/dsh-sandbox-windows-acl — packages/sandbox/sandbox-windows-acl
• @deepseek-ai/dsh-subprocess-local — packages/subprocess/subprocess-local (related spawn seam)

Root cause

The windows-acl runner (lib/runner.js) spawns the confined child with piped stdio via CreateProcessAsUserW under a restricted token, without CREATE_NO_WINDOW / CREATE_NEW_CONSOLE. The bundled code in lib/types-*.js documents why these flags were omitted:

"Console isolation (CREATE_NO_WINDOW / CREATE_NEW_CONSOLE) is intentionally absent: under this restriction scheme hidden-console children die with STATUS_DLL_INIT_FAILED (0xC0000142) — verified empirically."

Because the runner process itself has no attached console, every console-subsystem child (pwsh) must allocate a brand-new console, and Windows surfaces each one as a visible window. windowsHide: true on the outer Node child_process.spawn (in dsh-subprocess-local) does not help: it only hides the node runner, not the native CreateProcessAsUserW path below it.

Proposed fix

Do not use CREATE_NO_WINDOW (keeps the restricted-token constraint). Instead give the runner one hidden console so confined children inherit that console instead of creating new visible ones:

1. Expose console bindings (kernel32/user32) in the Win32 binding layer used by sandbox-windows-acl:

   • AllocConsole() → int
   • GetConsoleWindow() → HWND
   • ShowWindow(HWND, int) → int (SW_HIDE = 0)

2. In lib/runner.js (source: src/runner.ts), right after the existing SetConsoleCtrlHandler call and before spawning children:

// hidden console host: confined console children (pwsh) inherit it instead of
// allocating a visible window per command
if (!api.getConsoleWindow()) api.allocConsole();
const w = api.getConsoleWindow();
if (w) api.showWindow(w, 0 /* SW_HIDE */);

3. In dsh-subprocess-local, add windowsHide: true on Windows for the plain (non-terminal) spawn() so every non-sandboxed spawn is also windowless:

const child = spawn(program, args, {
  cwd: spec.cwd,
  env,
  stdio: [/* as today */],
  detached: process.platform !== "win32",
  windowsHide: process.platform === "win32",
});

Why this works

• Children keep console-subsystem semantics (stdout/stderr still flow through the inherited pipes).
• A real (hidden) console exists, so the documented STATUS_DLL_INIT_FAILED failure mode for CREATE_NO_WINDOW under the restricted token is avoided.
• Result: exactly one hidden console per runner; no per-command window.

Verification performed on the packaged build

• Applied the equivalent patch to the desktop runtime (resources/dsh-runtime/node_modules/@deepseek-ai/dsh-sandbox-windows-acl/lib/{runner.js,types-CNjZgO4h.js} and dsh-subprocess-local/lib/index.js), backup of originals retained.
• Bindings verified working through koffi; files syntax-checked.
• After a full DSH Desktop restart, running multiple sandboxed pwsh commands in sequence produced no visible console windows (user-confirmed); command output, exit codes and both sandbox modes (read-only / workspace-write) behaved unchanged.

Notes

• The source repo's binding layer may live in @deepseek-ai/dsh-win32-process (workspace dependency of sandbox-windows-acl) — the fix should add the three console functions there and call them from the runner.
• Happy to open a PR if maintainers prefer; the exact source-level diff can be prepared from the published bundle deltas.

[wanantara-green]

Implementasi siap di fork: branch wanantara-green:fix/windows-sandbox-console-popup (3 file berubah):

• packages/sandbox/sandbox-windows-acl/src/ffi.ts — binding AllocConsole / GetConsoleWindow / ShowWindow (kernel32 + user32)
• packages/sandbox/sandbox-windows-acl/src/runner.ts — runner meng-attach satu console tersembunyi (SW_HIDE) agar anak proses console mewarisinya dan tidak membuka jendela baru per perintah
• packages/subprocess/subprocess-local/src/spawn.ts — windowsHide: true untuk spawn background di Windows

Commit: b1117c8 — direktori perbandingan (compare) untuk membuat PR:
master...wanantara-green:fix/windows-sandbox-console-popup

(Token CLI saya tidak berizin membuat cross-repo PR ke repo ini, jadi saya serahkan pembuatan PR lewat tautan di atas.)

[wanantara-green]

Since opening a cross-repo PR from this fork is blocked at the account level, attaching the complete unified diff here so it can be reviewed/applied directly.

Commit: b1117c8 · Branch: wanantara-green:fix/windows-sandbox-console-popup · Compare: master...wanantara-green:fix/windows-sandbox-console-popup

Apply on the monorepo:
git apply fix-windows-console-popup.patch

Or for the packaged DSH Desktop runtime (same three files under resources/dsh-runtime/node_modules/@deepseek-ai/...), apply the equivalent changes from issue bruc3van/dsh-desktop#16.

diff --git a/packages/sandbox/sandbox-windows-acl/src/ffi.ts b/packages/sandbox/sandbox-windows-acl/src/ffi.ts
index 983f595..e1bd18c 100644
--- a/packages/sandbox/sandbox-windows-acl/src/ffi.ts
+++ b/packages/sandbox/sandbox-windows-acl/src/ffi.ts
@@ -73,6 +73,9 @@ export interface Win32Bindings extends Win32ProcessBindings {
   getTempPathW(length: number, buffer: Buffer): number
   setEnvironmentVariableW(name: string, value: string): number
   setConsoleCtrlHandler(handler: null, add: number): number
+  allocConsole(): number
+  getConsoleWindow(): NativePtr
+  showWindow(hWnd: NativePtr, nCmdShow: number): number
   createFileW(
     fileName: string,
     desiredAccess: number,
@@ -221,6 +224,7 @@ let cached: Win32Bindings | undefined
 
 function bindings(): Win32Bindings {
   if (cached !== undefined) return cached
+  const user32 = koffi.load('user32.dll')
   cached = extendWin32ProcessBindings(({ kernel32, advapi32, bind }) => ({
     openProcess: bind(kernel32, 'OpenProcess', PVOID, ['uint32', 'int', 'uint32']),
     openProcessToken: bind(advapi32, 'OpenProcessToken', 'int', [PVOID, 'uint32', PPVOID]),
@@ -250,6 +254,9 @@ function bindings(): Win32Bindings {
     getTempPathW: bind(kernel32, 'GetTempPathW', 'uint32', ['uint32', PVOID]),
     setEnvironmentVariableW: bind(kernel32, 'SetEnvironmentVariableW', 'int', ['str16', 'str16']),
     setConsoleCtrlHandler: bind(kernel32, 'SetConsoleCtrlHandler', 'int', [PVOID, 'int']),
+    allocConsole: bind(kernel32, 'AllocConsole', 'int', []),
+    getConsoleWindow: bind(kernel32, 'GetConsoleWindow', PVOID, []),
+    showWindow: bind(user32, 'ShowWindow', 'int', [PVOID, 'int']),
     createFileW: bind(kernel32, 'CreateFileW', PVOID, [
       'str16', 'uint32', 'uint32', PVOID, 'uint32', 'uint32', PVOID,
     ]),
diff --git a/packages/sandbox/sandbox-windows-acl/src/runner.ts b/packages/sandbox/sandbox-windows-acl/src/runner.ts
index 8d5fe35..0080aeb 100644
--- a/packages/sandbox/sandbox-windows-acl/src/runner.ts
+++ b/packages/sandbox/sandbox-windows-acl/src/runner.ts
@@ -47,7 +47,7 @@
 import { existsSync, mkdtempSync, rmSync, statSync } from 'node:fs'
 import { join } from 'node:path'
 
-import { win32 } from './ffi.ts'
+import { isNullPtr, win32 } from './ffi.ts'
 import { AclSandbox, assertTempRootOutsideWorkspace } from './index.ts'
 import { tempWriteSid, workspaceWriteSid } from './workspace-sid.ts'
 
@@ -138,6 +138,23 @@ async function main(): Promise<number> {
     fail(`SetConsoleCtrlHandler failed (Win32 ${api.getLastError()})`)
   }
 
+  // Hidden console host for confined children. This runner is a Node process
+  // normally launched without a console, so every console-subsystem child it
+  // spawns (pwsh, cmd, …) would allocate a brand-new console window per
+  // invocation — visible as a flashing terminal on the user's desktop.
+  // CREATE_NO_WINDOW cannot be used under the restricted token (children die
+  // with STATUS_DLL_INIT_FAILED, see win32-abi.ts), so instead we attach ONE
+  // console here and hide it: children inherit that single console and never
+  // open a window of their own. Best-effort — if console allocation fails the
+  // spawn still proceeds (children simply create their own consoles as today).
+  if (isNullPtr(api.getConsoleWindow())) {
+    api.allocConsole()
+  }
+  const consoleWindow = api.getConsoleWindow()
+  if (!isNullPtr(consoleWindow)) {
+    api.showWindow(consoleWindow, 0 /* SW_HIDE */)
+  }
+
   let ownedTempDir: string | undefined
   let sandbox: AclSandbox | undefined
   let initialized = false
diff --git a/packages/subprocess/subprocess-local/src/spawn.ts b/packages/subprocess/subprocess-local/src/spawn.ts
index 433ba01..44d5638 100644
--- a/packages/subprocess/subprocess-local/src/spawn.ts
+++ b/packages/subprocess/subprocess-local/src/spawn.ts
@@ -358,6 +358,9 @@ export function spawnSubprocess(spec: SubprocessSpawnSpec, internals: SpawnInter
     // `detached` gives teardown a tree root on POSIX (its own process group);
     // Windows terminates by root pid through taskkill /T instead.
     detached: platform !== 'win32',
+    // Never surface a console window for background helper processes; callers
+    // that intentionally attach a visible terminal use spawnTerminal instead.
+    windowsHide: platform === 'win32',
   })
 
   const collectStream = (mode: SubprocessOutputMode, stream: Readable | null, label: string): OutputCollector | undefined => {

[argszero]

在 repo 当前 master（76fda72979）源码层复核了你的 fix，方向正确，且你这个"给 runner 建一个隐藏 console 让子进程继承，而非对每个 spawn 用 CREATE_NO_WINDOW"的设计，正好绕开了 runner.ts:37 注释里钉死的那条失败路径（hidden-console children 在 restricted token 下死于 STATUS_DLL_INIT_FAILED 0xC0000142）。我确认以下三点都成立，可放心 push/wait review：

1. 三个绑定确实缺失（需加到 win32-process ffi）。
当前 packages/subprocess/win32-process/src/ffi.ts 的 kernel32 绑定里没有 AllocConsole / GetConsoleWindow / ShowWindow（只有 closeHandle/getLastError/formatMessageW/createPipe/setHandleInformation/createProcessAsUserW/readFile/peekNamedPipe/waitForSingleObject/getExitCodeProcess/createJobObjectW/setInformationJobObject/assignProcessToJobObject/resumeThread/terminateProcess/getStdHandle 等）。ShowWindow 在 user32、其余两个在 kernel32——正如你说的，正确的落点是 win32-process 这个 workspace 依赖，sandbox-windows-acl 通过 koffi.load 复用它的 api 表面。补充一个 C 签名细节：

AllocConsole: () => int                 // kernel32, BOOL
GetConsoleWindow: () => NativePtr       // kernel32, HWND
ShowWindow: (hwnd: NativePtr, nCmdShow: int) => int  // user32, BOOL

2. 插入点干净。
runner.ts 的流程是：win32() 拿 api（:133）→ setConsoleCtrlHandler（:137）→ 建 sandbox（:161-169）→ sandbox.spawn(...)（:181）。把 if (!api.getConsoleWindow()) api.allocConsole(); const w = api.getConsoleWindow(); if (w) api.showWindow(w, 0) 插在 setConsoleCtrlHandler 之后、sandbox.spawn 之前，与现有的 stdio='inherit'（:184）和 spawn flags 完全兼容——你是在 runner 进程这一层建 console，不触碰 createProcessAsUserW 的 STARTF_USESTDHANDLES/CREATE_SUSPENDED（process.ts:188-191/:361-373），所以子进程继承的是这个隐藏 console 而非新开可见窗。给 stdio='inherit' 的 confined pwsh 尤其关键：它自己是有 console-subsystem 的程序，继承了 runner 的隐藏 console 就不会再 alloc 一个可见的。

3. 一个小取舍值得写进理由。 GetConsoleWindow() 在已经 attach 到某个 console（例如从现有 DSH Desktop runtime 的宿主进程 fork 出来的子 runner）时可能返回非空。你的 if (!api.getConsoleWindow()) api.allocConsole() 已经处理了"已有则不重复 alloc"，这是对的——但要留意：如果 runner 是从一个有可见 console的父进程继承而来，getConsoleWindow() 可能返回那个可见的窗口，showWindow(w, 0) 会把父进程那个 console一并隐藏掉。这在 DSH Desktop 里通常是可接受的（runner 本来就是后台进程），但对"从交互式终端手工起 runner 调试"的场景会误藏。建议：要么在注释里说明这一取舍，要么更保守——只在 getConsoleWindow() 返回 null 时才 allocConsole，拿到新 handle 后 showWindow 只对新 alloc 的（否则 trust 父平台已有的约定）。这属于"可迁移到 maintainer review 的 refinement"，不影响你方案的主正确性。

一句话：方案正确、缺的绑定位置确认、插入点干净、避开 0xC0000142 的设计是对的。唯一值得补的注释是第 3 点的"inherit-visible-console 是否要 hide"取舍。你可以按你贴的 diff 提交；若为保险，把第 3 点的保守写法一起带上。