Windows workspace-write sandbox: every confined child dies with 0xC0000142 (root cause + verified patch)

[Xialibarenud]

Component: packages/sandbox/sandbox-windows-acl (@deepseek-ai/dsh-sandbox-windows-acl)
Host version: @deepseek-ai/dsh@0.2.0-rc.2 (Desktop profile, Web GUI)
Platform: Windows 10 (10.0.19041), x64, Node 24.21.0, PowerShell 7.6.6
Severity: confined shell is completely unusable in the default (workspace-write) mode

---

Summary

On this host, every command run through the pwsh tool while the session file policy is
workspace-write fails with a bare [exit code: 3221225794] (0xC0000142,
STATUS_DLL_INIT_FAILED) — no stdout, no stderr, no windows-acl-run: runner-failure signature.
The same host, same session, same binary works fine in read-only.

Root cause is a single line in AclSandbox.init(): the restricted token's default DACL is
seeded with the capability write SID in workspace-write, while read-only falls back to
Everyone. On a host where the parent process token's default DACL lacks Everyone, the child
cannot complete process/DLL initialization and dies before it can print anything. Adding
Everyone alongside the capability SID fixes it without weakening confinement.

---

Reproduction

# runner + dependencies extracted verbatim from resources/app.asar
$env:ELECTRON_RUN_AS_NODE = 1
& 'D:\...\DeepSeek Harness.exe' `
  'D:\...\app.asar\dsh\node_modules\@deepseek-ai\dsh-sandbox-windows-acl\lib\runner.js' `
  --workspace '<workspace>' --temp '<granted private temp dir>' `
  --mode workspace-write --write-sid '<S-1-4-…>' --temp-write-sid '<S-1-4-…>' `
  -- 'C:\Program Files\PowerShell\7\pwsh.exe' -NoLogo -NoProfile -Command Write-Output CHILD_OK
# -> exit -1073741502 (0xC0000142)

Bisection (one variable per step)

#	Variable	Result
1	runner = plain node.exe, workspace-write	✅ pass
2	windowsHide + piped stdio	✅ pass
3	seam-managed grants (--write-sid / --temp-write-sid)	✅ pass
4	private temp dir and TMP/TEMP rewrite (3 variants)	❌ fails (not the cause)
5	child = cmd.exe / node.exe / pwsh.exe	❌ all fail (child-independent)
6	runner = process.execPath (Electron binary as node)	❌ reproduces
7	restricting SID list forced to the read-only list	❌ still fails (not the SID list)
8	default-DACL seed forced to Everyone	✅ passes
9	capability SID and Everyone both seeded	✅ passes

Root cause

AclSandbox.init() (lib/types-*.js):

setTokenDefaultDaclGrant(api, restrictedToken, this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid);

setTokenDefaultDaclGrant merges one full-access ACE into the token's existing default DACL:

• read-only — no write SIDs exist, so it falls back to worldSid → the default DACL keeps an
  Everyone ACE → works.
• workspace-write — it resolves to the capability SID S-1-4-… → the default DACL receives
  only that ACE and loses Everyone → the confined child fails DLL initialization and
  exits with STATUS_DLL_INIT_FAILED.

This is why the error looks like a file-permission problem but is not: the bundled
diagnose-windows-sandbox-acl run reports NOT_THIS_CLASS (full WRITE_DAC/WRITE_OWNER on the
whole chain, zero foreign package SIDs). It is a token default, not a file ACL.

Suggested fix

 setTokenDefaultDaclGrant(api, restrictedToken, this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid);
+if (this.mode !== "read-only") setTokenDefaultDaclGrant(api, restrictedToken, worldSid);

Keeps the capability SID and restores the Everyone ACE that read-only already gets. Write
confinement is unchanged: writes are still gated by the write-restricted SID list and the
capability-SID allow ACEs; the default DACL only affects objects the confined child creates.

Verification after the fix

Check	Before	After
Electron runner + workspace-write	❌ 0xC0000142	✅ exit 0
Electron runner + read-only	✅	✅
Write inside the workspace	—	✅ allowed
Write outside the workspace (C:\…)	—	✅ denied, no file left behind
Real lib/runner.js from the archive	❌	✅

Verified on a live installation. The patch was written into the production
resources/app.asar (archive rebuilt; all 11,470 packed entries re-read and byte-compared — 0
mismatches; only the target file changed, +92 bytes) and DSH was restarted. With the session back
on the default workspace-write policy:

SHELL_STARTED
VERSION 7.6.6 EDITION Core
INSIDE_WRITE=ALLOWED      # workspace writes work
OUTSIDE_WRITE=DENIED      # confinement intact

End-to-end, archify doctor (a Node CLI that previously required switching the session to
danger-full-access) now runs confined with all 20 checks passing and exit code 0.

The patched app.asar was rebuilt byte-exactly: all 11,470 packed entries re-read and compared
against the original — 0 mismatches; only the target file changed (+92 bytes), and
node --check passes on the patched module.

Open question

Identical unpatched code passes when the runner is a plain node.exe and fails when the runner
is process.execPath (the Electron binary) — same parent, same token origin. The suspicion is that
Electron/Chromium tightens the main process token's default DACL at startup, which is why seeding
only the capability SID is insufficient in production. Not confirmed; the fix above holds either way.

Excluded causes (with evidence)

Hypothesis	Evidence
Workspace/ancestor ACL	diagnose-windows-sandbox-acl → NOT_THIS_CLASS, no repairs needed
Foreign AppContainer package SIDs	zero on the whole chain
PowerShell 5.1 fallback	installed 7.6.6, restarted — still failed; confined shell really runs 7.6.6
Smart App Control / WDAC / AppLocker	SAC = 0, no active WDAC policies, no AppLocker blocks
Missing keep-alive group (logon SID + Everyone)	present in both modes in the source
Capability SIDs in the restricting list	forcing the read-only list still fails
Private temp dir / TMP·TEMP rewrite	all three variants fail
Insufficient write permission	workspace-write's restricting list is a superset of read-only's

---

中文摘要

Windows 上 workspace-write（默认）模式下，受限 shell 一律以 0xC0000142 死亡，read-only 正常。
根因是 AclSandbox.init() 里给受限令牌设置默认 DACL 的那一行：workspace-write 下只写入了
能力 SID S-1-4-…，丢掉了 read-only 会回退到的 Everyone。补回 Everyone（保留能力 SID）即可修复，
且不削弱写入隔离——实测工作区内可写、工作区外仍被拒绝。