[BUG](windows沙箱问题)(DSH GUI模式)会话里跑在非「完全权限」模式在项目文件夹根目录生成Windows 强制完整性标签，导致二进制生成文件权限受限

[yuing798]

Windows 沙箱：撤销工作区授权后会留下一个可继承的“低完整性”标签，且在该工作区内构建的可执行文件此后将无法正常运行

中文摘要

workspace-write 模式下，DSH 给工作区根目录写了一个可继承的「低完整性 + 禁止向上写」强制标签
（Mandatory Label\Low Mandatory Level:(OI)(CI)(NW)）。撤销授权时这个标签不会被回滚，于是工作区里
之后生成的一切对象（尤其是 build\...\App.exe）都带上 Low 标签；Windows 会以低完整性启动这类
可执行文件，而低完整性进程禁止写入 Medium 级别的 %TEMP%。这个拒绝在 ACL 里完全看不到
（icacls %TEMP% 没有任何拒绝项），所以用户用 icacls / takeown / /reset / 改 TEMP 全都无效，
表现为"Flutter 启动 VM（应用）时完全拿不到 Temp 权限"。修复建议：撤销授权时把授权前的标签 ACL 写回去
（readCurrentSecurity 已经读到了旧值），或提供一条官方的重置命令。

Summary

In a Windows session whose file policy is workspace-write, DSH provisions the workspace write grant by
editing the folder's security descriptor. Part of that edit is a mandatory integrity label:

Mandatory Label\Low Mandatory Level:(OI)(CI)(NW)      <- Low (S-1-16-4096) + NO_WRITE_UP, inheritable

Two consequences, both silent and both very hard for a user to diagnose:

1. The label is never removed when the grant is revoked. After the session goes back to
   danger-full-access, the workspace root keeps the Low label. Every object created afterwards inside the
   workspace inherits it — including the project's own build outputs.
2. Windows starts a Low-labelled executable as a Low-integrity process. A Low-integrity process is
   denied writes to %TEMP% (and %LOCALAPPDATA%), because those objects are Medium integrity and the
   label carries NO_WRITE_UP. The denial is not visible in the ACL — icacls %TEMP% shows no deny
   entry at all, and %TEMP%'s permissions are perfectly normal.

So a Windows project that builds and then runs its own artifacts breaks in a way that looks like a
Windows/Temp permission problem and cannot be fixed with icacls, takeown, icacls /reset, or by pointing
TEMP somewhere else.

Concrete user-visible symptom

Flutter Windows desktop project (flutter run -d windows):

• flutter_tools itself runs from D:\flutter\... (outside the workspace) → the tool is Medium, and it
  creates %TEMP%\flutter_tools.* normally.
• It then launches …\build\windows\x64\runner\Debug\App.exe, which was produced inside the
  Low-labelled workspace → the app runs at Low integrity → the app and its Dart VM cannot create
  anything under %TEMP%.
• Result: "the VM cannot get permission to the Temp folder" / Access is denied for temp files, failed
  debug connection / VM service, and app crashes (0xc000041d in flutter_windows.dll was observed in the
  Windows event log for this project, with %TEMP% ACL clean).
• Red herrings that cannot fix it: icacls "%TEMP%" /grant <user>:(OI)(CI)F /T, takeown /F "%TEMP%" /R /A,
  icacls "%TEMP%" /reset /T, $env:TEMP=D:\SomeOtherFolder (also Medium), firewall rules for the VM
  service port.

Minimal reproduction (no Flutter needed)

# 0. a project folder inside a workspace that was once granted write in workspace-write mode
$proj = 'D:\proj'

# 1. the workspace root carries the leftover label (after the session is back to full access)
icacls $proj
#    -> Mandatory Label\Low Mandatory Level:(OI)(CI)(NW)

# 2. any executable that lives inside it inherits it
Copy-Item C:\Windows\System32\whoami.exe $proj\whoami.exe
Copy-Item C:\Windows\System32\cmd.exe    $proj\cmd.exe
icacls "$proj\cmd.exe"
#    -> Mandatory Label\Low Mandatory Level:(I)(NW)

# 3. Windows starts it at Low integrity (this is the whole bug)
& "$proj\whoami.exe" /groups | Select-String Mandatory
#    -> Mandatory Label\Low Mandatory Level  S-1-16-4096

# 4. a Low process cannot write to the Medium-integrity %TEMP%
& "$proj\cmd.exe" /c "echo x> `"$env:TEMP\probe.txt`""
#    -> Access is denied.
icacls $env:TEMP
#    -> no deny entry anywhere; the ACL is normal

# 5. control: the very same binary, unlabelled, writes fine
& "$env:SystemRoot\System32\cmd.exe" /c "echo x> `"$env:TEMP\probe2.txt`""
#    -> succeeds

# 6. repair = raise the label back to Medium (needs WRITE_OWNER, which an
#    'Authenticated Users:(M)'-only child does not have, hence the grant first)
icacls $proj /grant *<your-SID>:(OI)(CI)F /T /C /Q
icacls $proj /setintegritylevel (OI)(CI)M /T /C /Q
& "$proj\whoami.exe" /groups | Select-String Mandatory   # now Medium, writes to %TEMP% succeed

Why this is a harness bug (and not user error)

• The label is a grant artifact, but the workspace it is written to is not a sandbox-private
  directory: it is the user's real project directory, and the label is inheritable to OI (objects), so it
  contaminates build outputs that outlive the sandbox session.
• It is not undone on revoke, although readCurrentSecurity already reads the previous label ACL, so the
  value needed to restore it is available at the point of the edit.
• The resulting denial is invisible to every normal ACL tool, so the user's only clue is an "Access is denied"
  on a folder whose permissions look perfect.

Impact is not Flutter-specific: any Windows workspace that produces executables (CMake/C++, Rust, .NET,
Node native modules, Flutter desktop) will silently build Low-integrity binaries that then fail on writes to
%TEMP% / %LOCALAPPDATA% when they are run outside the sandbox. As a secondary effect, Low-integrity files
are writable by any Low-integrity process, which is a small security regression for a user's source tree.

Suggested fixes

1. Restore the previous label ACL on revoke (primary). Keep the SACL read by
   readCurrentSecurity and write it back in the same revokeWrite path that removes the capability ACE, so
   a grant is a true round-trip. If the label was not present before the grant, remove it.
2. Only label when the grant is actually needed by a Low-integrity child, and never leave a label whose
   ACE this module added; treat the label like the revocable capability SID it belongs to.
3. Make it recoverable/documented: a supported way to reset a workspace (dsh command or a documented
   icacls /setintegritylevel recipe, including the grant → setintegritylevel order needed for children
   whose ACL grants only Authenticated Users:(M)), plus a warning in the session when a grant is revoked
   while a label is in place.
4. Consider not using an inheritable label for the workspace at all, or scoping the child's ability to write
   with the capability SID only (the S-1-4-… ACE) and granting that SID on the private temp plus the
   workspace, without lowering the integrity of the user's own tree.

[PerryLink]

你这条把已知代价讲得比文档更清楚——尤其是"ACL 里看不到"这一点

1. 标签的常驻性，文档是承认的

packages/sandbox/sandbox-windows-acl/README.md:121（原文）：

A standing Low label outlives DSH and widens the tree for other Low-integrity processes — the workspace's inheritable label survives the session (and same-volume moves) …

⇒ 你观察到的"撤销授权时标签不回滚"与这条一致。你的增量在于把后果说清了：在工作区里构建出来的可执行文件继承 Low 标签 ⇒ Windows 以低完整性启动它 ⇒ 低完整性进程禁止写 Medium 的 %TEMP% ⇒ 程序失效，而这个拒绝在 icacls 里看不到（因为它来自强制完整性检查，不是 ACL 项）。

这一段是本轮同族报告里最好的一条影响面分析，建议原样保留——它解释了为什么用户自助排查会一筹莫展。

2. 建议把"三样一次写入"补上（能帮维护者定位）

同 README :90 写明，一次 SetNamedSecurityInfoW 同时写三样：能力 SID 的 allow ACE、对 world SID 的 FILE_DELETE_CHILD 拒绝项、以及 Low 标签。

⇒ 所以"撤销授权"若要真正干净，必须回滚三样，而不是只去标签。建议在诉求里明确写"撤销应当回滚本次授权的全部三项编辑"——这比"请清理标签"精确得多，也让修法可验收。

3. 一个现成工具（建议先跑）

本仓自带诊断脚本：

packages/sandbox/sandbox-windows-acl/assets/diagnose-windows-sandbox-acl/scripts/diagnose-windows-sandbox-acl.ps1
  :464  匹配 'Mandatory Label\Low Mandatory Level'

跑它可把"我用 icacls 看到的"升级为官方诊断输出，并顺带暴露另两项编辑。建议把它的输出贴进正文。

4. 这条与同族的另外几条

最近同族报告至少有四条（工作区内写不进 / 其他工具写不进 / 离开 DSH 后构建坏掉 / Electron 程序起不来 / 你现在这条"构建出的 exe 跑不起来"）。建议互相引用——它们合起来证明这不是个别现象，而是"常驻授权缺少清理路径"这一个设计缺口。

5. 最该提的诉求

DSH 应提供撤销常驻授权的入口，且回滚全部三项编辑（标签 + FILE_DELETE_CHILD 拒绝 + 能力 SID ACE），或在授权时限定作用范围使工作区不被永久改造。

6. 版本

你在 0.2.0-rc.2（DSH GUI）⇒ 属当前发布线（latest 与 next 都是 0.2.0-rc.2，最新是 alpha = 0.2.1-alpha.1），无需升级即可提。

一条边界

我确认的是文档承认常驻标签、以及一次授权写三样这两点（它们支撑你的归因与"回滚三样"的诉求）。你机器上的实际标签与拒绝项以第 3 节脚本的输出为准。

[yuing798]

感谢官方的确认和精确补全，特别是关于「一次 SetNamedSecurityInfoW 写入三样（能力 SID ACE + FILE_DELETE_CHILD 拒绝 + Low 标签）」的细节。

关于官方提出的几点要求：

1. 关于「诊断脚本（第 3 节）」
   我已经跑了本仓自带的 diagnose-windows-sandbox-acl.ps1。
   终端输出如下（包含 RECAP 和 SUMMARY）：

REPORT {"kind":"invocation","operation":"repair","path":"","status":"started","reason":"Inspect the requested paths, then repair the ACL problems this run can prove, before anything else is attempted.","details":{"paths":["D:\\audio_develop\\Junk-Fusion\\junk_fusion_ui"],"allowRoot":"D:\\audio_develop\\deepseek-harness","outputDirectory":"D:\\audio_develop\\deepseek-harness\\acl_backup","recoveryRecord":""}}
REPORT {"kind":"action","operation":"prepare_report","path":"D:\\audio_develop\\deepseek-harness\\acl_backup","status":"started","reason":"Create the recovery directory and a new JSONL report that keeps every record, because tool output is truncated to its tail.","details":{"id":1,"effect":"files"}}
REPORT {"kind":"action","operation":"prepare_report","path":"D:\\audio_develop\\deepseek-harness\\acl_backup","status":"completed","reason":"Create the recovery directory and a new JSONL report that keeps every record, because tool output is truncated to its tail.","details":{"id":1,"effect":"files"}}
REPORT {"kind":"action","operation":"initialize","path":"","status":"started","reason":"Load read-only access checks and DACL-only writes before inspecting permissions.","details":{"id":2,"effect":"none"}}
REPORT {"kind":"action","operation":"initialize","path":"","status":"completed","reason":"Load read-only access checks and DACL-only writes before inspecting permissions.","details":{"id":2,"effect":"none"}}
CALLER SID=S-1-5-21-2854271594-703532866-2566609621-1001 INTEGRITY=S-1-16-8192 (Medium)
REPORT {"kind":"observation","operation":"caller","path":"","status":"read","reason":"The caller token determines effective access; unconfined execution does not imply elevation.","details":{"sid":"S-1-5-21-2854271594-703532866-2566609621-1001","integrity":"S-1-16-8192 (Medium)"}}
PATH=D:\audio_develop\Junk-Fusion\junk_fusion_ui
REPORT {"kind":"observation","operation":"inspect_acl","path":"D:\\audio_develop\\Junk-Fusion\\junk_fusion_ui","status":"read","reason":"Read the ACL and check effective WRITE_DAC and WRITE_OWNER; observed ACEs alone do not identify which rule caused a denial.","details":{"lowLabel":true,"owner":"S-1-5-21-2854271594-703532866-2566609621-1001","writeDac":true,"acesOmitted":false,"errors":[],"aces":[{"sid":"S-1-1-0","type":"Deny","rights":"DeleteSubdirectoriesAndFiles","inherited":false,"inheritance":"ContainerInherit","propagation":"None"},{"sid":"S-1-4-1058716873-208765219","type":"Allow","rights":"DeleteSubdirectoriesAndFiles, Write, Delete, Synchronize","inherited":false,"inheritance":"ContainerInherit, ObjectInherit","propagation":"None"},{"sid":"S-1-5-21-2854271594-703532866-2566609621-1001","type":"Allow","rights":"FullControl","inherited":false,"inheritance":"ContainerInherit, ObjectInherit","propagation":"None"},{"sid":"S-1-5-32-544","type":"Allow","rights":"FullControl","inherited":true,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-32-544","type":"Allow","rights":"268435456","inherited":true,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"},{"sid":"S-1-5-18","type":"Allow","rights":"FullControl","inherited":true,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-18","type":"Allow","rights":"268435456","inherited":true,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"},{"sid":"S-1-5-11","type":"Allow","rights":"Modify, Synchronize","inherited":true,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-11","type":"Allow","rights":"-536805376","inherited":true,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"},{"sid":"S-1-5-32-545","type":"Allow","rights":"ReadAndExecute, Synchronize","inherited":true,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-32-545","type":"Allow","rights":"-1610612736","inherited":true,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"}],"writeOwner":true}}
  OBJECT=D:\audio_develop\Junk-Fusion\junk_fusion_ui READABLE=True
    OWNER=S-1-5-21-2854271594-703532866-2566609621-1001 IS_CURRENT_USER=True MY_RIGHTS=[FullControl] WRITE_DAC=True WRITE_OWNER=True LOW_LABEL=True
REPORT {"kind":"observation","operation":"inspect_acl","path":"D:\\audio_develop\\Junk-Fusion","status":"read","reason":"Read the ACL and check effective WRITE_DAC and WRITE_OWNER; observed ACEs alone do not identify which rule caused a denial.","details":{"lowLabel":null,"owner":"S-1-5-21-2854271594-703532866-2566609621-1001","writeDac":true,"acesOmitted":false,"errors":[],"aces":[{"sid":"S-1-5-32-544","type":"Allow","rights":"FullControl","inherited":true,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-32-544","type":"Allow","rights":"268435456","inherited":true,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"},{"sid":"S-1-5-18","type":"Allow","rights":"FullControl","inherited":true,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-18","type":"Allow","rights":"268435456","inherited":true,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"},{"sid":"S-1-5-11","type":"Allow","rights":"Modify, Synchronize","inherited":true,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-11","type":"Allow","rights":"-536805376","inherited":true,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"},{"sid":"S-1-5-32-545","type":"Allow","rights":"ReadAndExecute, Synchronize","inherited":true,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-32-545","type":"Allow","rights":"-1610612736","inherited":true,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"}],"writeOwner":false}}
  OBJECT=D:\audio_develop\Junk-Fusion READABLE=True
    OWNER=S-1-5-21-2854271594-703532866-2566609621-1001 IS_CURRENT_USER=True MY_RIGHTS=[] WRITE_DAC=True WRITE_OWNER=False LOW_LABEL=
REPORT {"kind":"observation","operation":"inspect_acl","path":"D:\\audio_develop","status":"read","reason":"Read the ACL and check effective WRITE_DAC and WRITE_OWNER; observed ACEs alone do not identify which rule caused a denial.","details":{"lowLabel":null,"owner":"S-1-5-21-2854271594-703532866-2566609621-1001","writeDac":true,"acesOmitted":false,"errors":[],"aces":[{"sid":"S-1-5-32-544","type":"Allow","rights":"FullControl","inherited":true,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-32-544","type":"Allow","rights":"268435456","inherited":true,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"},{"sid":"S-1-5-18","type":"Allow","rights":"FullControl","inherited":true,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-18","type":"Allow","rights":"268435456","inherited":true,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"},{"sid":"S-1-5-11","type":"Allow","rights":"Modify, Synchronize","inherited":true,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-11","type":"Allow","rights":"-536805376","inherited":true,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"},{"sid":"S-1-5-32-545","type":"Allow","rights":"ReadAndExecute, Synchronize","inherited":true,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-32-545","type":"Allow","rights":"-1610612736","inherited":true,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"}],"writeOwner":false}}
  OBJECT=D:\audio_develop READABLE=True
    OWNER=S-1-5-21-2854271594-703532866-2566609621-1001 IS_CURRENT_USER=True MY_RIGHTS=[] WRITE_DAC=True WRITE_OWNER=False LOW_LABEL=
REPORT {"kind":"observation","operation":"inspect_acl","path":"D:\\","status":"read","reason":"Read the ACL and check effective WRITE_DAC and WRITE_OWNER; observed ACEs alone do not identify which rule caused a denial.","details":{"lowLabel":null,"owner":"S-1-5-18","writeDac":false,"acesOmitted":false,"errors":[],"aces":[{"sid":"S-1-5-11","type":"Allow","rights":"-536805376","inherited":false,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"},{"sid":"S-1-5-11","type":"Allow","rights":"Modify, Synchronize","inherited":false,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-18","type":"Allow","rights":"FullControl","inherited":false,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-18","type":"Allow","rights":"268435456","inherited":false,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"},{"sid":"S-1-5-32-544","type":"Allow","rights":"268435456","inherited":false,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"},{"sid":"S-1-5-32-544","type":"Allow","rights":"FullControl","inherited":false,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-32-545","type":"Allow","rights":"ReadAndExecute, Synchronize","inherited":false,"inheritance":"None","propagation":"None"},{"sid":"S-1-5-32-545","type":"Allow","rights":"-1610612736","inherited":false,"inheritance":"ContainerInherit, ObjectInherit","propagation":"InheritOnly"}],"writeOwner":false}}
  OBJECT=D:\ READABLE=True
    OWNER=S-1-5-18 IS_CURRENT_USER=False MY_RIGHTS=[] WRITE_DAC=False WRITE_OWNER=False LOW_LABEL=
VERDICT=NOT_THIS_CLASS
REPORT {"kind":"decision","operation":"classify","path":"D:\\audio_develop\\Junk-Fusion\\junk_fusion_ui","status":"NOT_THIS_CLASS","reason":"No package allow ACE was observed and both required rights are available. Other ACL restrictions and causes of the original failure are not ruled out.","details":{"writeDac":true,"packageObjects":[],"writeOwner":true}}
REPORT {"kind":"decision","operation":"repair","path":"D:\\audio_develop\\Junk-Fusion\\junk_fusion_ui","status":"skipped","reason":"No package allow ACE and no missing WRITE_DAC or WRITE_OWNER was observed on the inspected objects; no ACL change was needed.","details":{}}
REPORT {"kind":"summary","operation":"repair","path":"D:\\audio_develop\\Junk-Fusion\\junk_fusion_ui","status":"completed","reason":"Operation completion records API execution; verification records the observed result. Only rerunning the original confined operation can confirm its failure is resolved.","details":{"scanTruncated":false,"exitCode":0,"refused":0,"rollback":"not-needed","granted":0,"observationFailures":0,"automaticRollback":true,"operations":[{"id":1,"operation":"prepare_report","path":"D:\\audio_develop\\deepseek-harness\\acl_backup","effect":"files","status":"completed"},{"id":2,"operation":"initialize","path":"","effect":"none","status":"completed"}],"nextAction":"stop","fixed":0,"report":"D:\\audio_develop\\deepseek-harness\\acl_backup\\acl-report-7044a45bd0fe46418e92fb5c0f618a3e.jsonl","rollbackCommands":[],"recoveries":[],"restored":0}}
RECAP {"verdicts":[{"path":"D:\\audio_develop\\Junk-Fusion\\junk_fusion_ui","writeDac":true,"verdict":"NOT_THIS_CLASS","packageObjects":[],"writeOwner":true}],"changes":[],"verifications":[],"refusals":[],"scans":[],"report":"D:\\audio_develop\\deepseek-harness\\acl_backup\\acl-report-7044a45bd0fe46418e92fb5c0f618a3e.jsonl"}
REPORT_FILE D:\audio_develop\deepseek-harness\acl_backup\acl-report-7044a45bd0fe46418e92fb5c0f618a3e.jsonl
SUMMARY FIXED=0 GRANTED=0 REFUSED=0 RESTORED=0

完整的 .jsonl 诊断报告见附件
acl_backup.zip

2. 关于「修正诉求（第 5 节）」
   根据文档承认的「撤销常驻授权缺少清理路径」以及「一次写入三样」的事实，我的诉求修正为：
   DSH 应提供撤销常驻授权的官方入口，且撤销操作必须回滚本次授权写入的全部三项编辑：Low 标签 + FILE_DELETE_CHILD 拒绝项 + 能力 SID 的 Allow ACE。
   只有这三样全部回滚，才算是真正的「授权回滚（round-trip）」，否则工作区就会被永久改造。

3. 关于「同族报告（第 4 节）」
   我会在相关的同族 issue（工作区内写不进 / 其他工具写不进 / 离开 DSH 后构建坏掉 / Electron 程序起不来）下引用此贴，方便维护者进行合并和统一修复。

4. 版本确认
   确认在 0.2.0-rc.2（DSH GUI）复现，已知 latest 和 next 均为同版本，等待官方统一修复。