fix(sandbox): drop Authenticated Users from both restricting lists — close the C:\\-root escape, CIM unavailable in every confined mode

workspace-write now runs [logon SID, Everyone, orphan]: the two lists differ only by the orphan, and the keep-alive group (logon SID + Everyone) is the single shared invariant. The WMI namespace security check fails in BOTH modes (0x80041003), so CIM/Get-ComputerInfo are unavailable everywhere — the price of closing the C:\\-root tree-creation escape (AU:(AD) + AU:(OI)(CI)(IO)(M)) in workspace-write too. The unused WinLocalSid/WinInteractiveSid/WinAuthenticatedUserSid constants and their ABI-probe prints are removed; the enforcement 'full' claim now stands on a closed NTFS surface. New regression: a C:\\Users\\Public subdirectory write is denied under BOTH modes (the ambient-writable blind spot the review flagged — INTERACTIVE is absent from both lists). FAT-class (non-ACL) targets outside the granted roots remain writable (no security descriptors to intersect) — documented as a legacy residue, warn-only, not engineered around. Docs/design note/PR body updated in both languages (list I/J terminology gone everywhere).

packages/sandbox/sandbox-local/src/index.ts

@@ -381,7 +381,7 @@ export class LocalSandboxProvider extends SandboxProvider {
    * NOTHING — its token alone restricts every write, and a standing grant
    * from an earlier workspace-write period is KEPT through a downgrade
    * (never revoked): the read-only restricted token carries no orphan SID
-   * (list I), so the ACE is inert there, while the map hit keeps the
+   * (the read-only list), so the ACE is inert there, while the map hit keeps the
    * re-upgrade free of re-propagation. Fail-closed: a half-materialized
    * grant is revoked before the error propagates.
    * @param record - the session's durable record.

packages/sandbox/sandbox-local/tests/acl-session.spec.ts

@@ -199,7 +199,7 @@ describe('windows-acl per-session grant (LocalSandboxProvider)', () => {
       expect(mockState.grants).toHaveLength(1)
 
       // Downgrade: the standing grant is KEPT — never revoked, never
-      // re-granted. The read-only restricted token's list I carries no
+      // re-granted. The read-only restricted token's list carries no
       // orphan SID (pinned by the windows-acl runner regression), so the
       // ACE is inert under read-only while the map hit keeps the
       // re-upgrade free of eager propagation.

packages/sandbox/sandbox-windows-acl/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/sandbox/sandbox-windows-acl/README.md
-README.md: 2e3a16fa84541ffb2eb442c953777f37407e1b46
-README.zh.md: e58b70a120875ee57fe6e90376f7e36d9ce32ca3
+README.md: e9309caa874a33d3df32cc23b50c0d6375ee3066
+README.zh.md: eabf8f1c1e7e985960beee5abb540a33d052a05e

packages/sandbox/sandbox-windows-acl/README.md

@@ -40,9 +40,11 @@ The runner creates the restricted token, spawns the wrapped argv under it with t
 
 **Per-session grant reuse** (`--write-sid`): the seam provisions ONE orphan SID per session — stored as a log-only `sandbox/acl-session` event on the session log, so a resumed session replays the SAME SID and a fork mints a fresh one — and materializes its ACEs lazily at the session's first confined execution, holding them for the SERVER process's lifetime (revoked on provider dispose). Under `--write-sid` the runner neither grants nor revokes (`manageDacls: false`); without it (standalone use) it self-manages per-call grants as before. Re-granting after a restart is idempotent: `grantWrite` reads the current DACL and SKIPS the `SetNamedSecurityInfoW` apply when the exact ACE already stands (that apply eagerly re-propagates the identical ACE across the whole tree — minutes on large workspaces). Standing ACEs from an unclean shutdown need no garbage collection: the session's record re-grants the same SID, and the next dispose revokes them. Known cost: materializing a grant on a big workspace tree blocks for the full eager propagation once per session per server lifetime.
 
-Modes (the token's restricting-SID list follows the mode):
-- `workspace-write` (list J = logon SID, Everyone, Authenticated Users, orphan): the workspace and the session's PRIVATE temp subdirectory carry the orphan-SID Write grant; every other write is denied by the token intersection. Authenticated Users stays in the list so the CIM path keeps working (`Get-CimInstance`, `Get-ComputerInfo`); the price is the residual Authenticated-Users-writable surface — notably the C:\ drive root, where standing `AU:(AD)` + `AU:(OI)(CI)(IO)(M)` ACEs admit an AU-confined tree-creation escape — see the design note.
-- `read-only` (list I = logon SID, Everyone — NO orphan): STRICT zero grants — nothing is writable, and the token also DROPS Authenticated Users for a zero ambient-write surface (the C:\-root escape above is closed). The orphan stays OUT of list I on purpose: a standing grant ACE from an earlier workspace-write period (a `/permission` downgrade, or a crash-resumed session) remains INERT under read-only because the write-restricted pass-2 check grants only what the restricting list carries — while the unrevoked ACE keeps the re-upgrade free of re-propagation. The NUL device is a securable object and is NOT granted (unlike Linux's `/dev/null` sink): `Set-Content NUL` and native `> NUL` writes fail with access denied, while PowerShell's `> $null` redirection keeps working (it discards without opening NUL). The cost is CIM unavailability: the WMI namespace security check fails (`0x80041003`), so CIM cmdlets and `Get-ComputerInfo` (which silently returns incomplete results rather than an error) are unavailable — the model-facing surface documents that contract, not a prompt promise.
+Modes (the token's restricting-SID list follows the mode; the keep-alive group is logon SID + Everyone in BOTH modes — early DLL init dies with `0xC0000142` and CNG crashes pwsh with `0xE0434352` without them):
+- `workspace-write` (logon SID, Everyone, orphan): the workspace and the session's PRIVATE temp subdirectory carry the orphan-SID Write grant; every other write is denied by the token intersection.
+- `read-only` (logon SID, Everyone — NO orphan): STRICT zero grants — nothing is writable. The orphan stays OUT of the list on purpose: a standing grant ACE from an earlier workspace-write period (a `/permission` downgrade, or a crash-resumed session) remains INERT under read-only because the write-restricted pass-2 check grants only what the restricting list carries — while the unrevoked ACE keeps the re-upgrade free of re-propagation. The NUL device is a securable object and is NOT granted (unlike Linux's `/dev/null` sink): `Set-Content NUL` and native `> NUL` writes fail with access denied, while PowerShell's `> $null` redirection keeps working (it discards without opening NUL).
+
+Authenticated Users is absent from BOTH lists — the WMI namespace security check fails (`0x80041003`), so CIM cmdlets and `Get-ComputerInfo` (which silently returns incomplete results rather than an error) are unavailable in EVERY confined mode, and the C:\-root tree-creation escape (standing `AU:(AD)` + `AU:(OI)(CI)(IO)(M)` ACEs) is closed in both — the model-facing surface documents that contract, not a prompt promise. INTERACTIVE/LOCAL are absent from BOTH lists too: the host's Public tree grants write to INTERACTIVE, so Public writes are denied — pinned by the runner's ambient-writable Public-probe regression (see the design note).
 
 The `AclSandbox` class (`tempDir: null` disables the temp grant) remains the programmatic API for direct spawns; `AclWriteGrant` is the server-side materialization half of the per-session contract.
 
@@ -81,5 +83,5 @@ None directly; the denial surface belongs to the tool layer.
 - **Grant materialization is an eager full-tree propagation.** `SetNamedSecurityInfoW` on a directory with inheritable ACEs walks every descendant immediately (NOT lazily per access — measured at tens of seconds on large workspace trees plus the real temp root). The per-session reuse pays it once per session per server lifetime (lazily at the first confined execution, skipped entirely when the exact ACE survives a restart); the self-managed runner fallback still pays it per invocation. If a session's workspace is huge, the first pwsh call of each server lifetime is correspondingly slow.
 - **Resuming one session concurrently in two server processes grants two SIDs.** The durable record lives in the session log; both processes read or provision it independently, the per-path lock keeps the DACL merges consistent, and the last-written record wins for future resumes — the losing SID's ACEs are revoked by its own process's dispose. Single-writer session usage (the normal deployment) never sees this.
 - **Read-side confinement and network policy are out of scope** — `WRITE_RESTRICTED` intersects write accesses only; pair this backend with a read-side policy for stronger confinement.
-- **Wide-directory and FAT-volume warnings are deferred** — the UI-side warnings for granting unusually wide directories or FAT-class (non-ACL) volumes are not yet implemented; a FAT volume simply fails the grant loudly.
+- **Wide-directory and FAT-volume warnings are deferred; FAT-class targets stay writable.** The UI-side warnings for granting unusually wide directories or FAT-class (non-ACL) volumes are not yet implemented, and a FAT volume as a grant ROOT simply fails the grant loudly (no ACL support). A FAT-class target OUTSIDE the granted roots is different: it has no security descriptors, so the restricted token's write check passes (Everyone sits in both lists) and such targets are writable under BOTH confined modes. FAT is treated as a legacy residue — unsupported and not engineered around; this warn-only posture is documented here rather than mitigated.
 - **Both confined modes run `pwsh` in ConstrainedLanguage.** The restricted token trips PowerShell's lockdown detection, so under `read-only` AND `workspace-write` the language mode is ConstrainedLanguage: `Add-Type` (C# compile, P/Invoke), non-core .NET static calls (`[System.IO.*]::`, `[math]::`, `[Environment]::`), COM objects, and reflection fail with `Cannot create type` / `Cannot invoke method` ("only core types") errors, and `$ExecutionContext.SessionState.LanguageMode = 'FullLanguage'` is refused. Core cmdlets, core types (`[string]`, `[datetime]`, `[regex]`, `[guid]`), `-f` formatting, and property access keep working. The `pwsh` tool description teaches this contract to the model; `danger-full-access` calls run unconfined at FullLanguage.

packages/sandbox/sandbox-windows-acl/README.zh.md

@@ -40,9 +40,11 @@ runner 创建受限令牌，在令牌下启动被包裹的 argv，stdio 直接
 
 **按会话授权复用**（`--write-sid`）：seam 为每个会话只配置一个孤儿 SID——以仅作日志记录的 `sandbox/acl-session` 事件写入会话日志，因此恢复的会话回放**同一个** SID，fork 则铸造一个新的——并在会话首次受限执行时惰性物化其 ACE，在**服务器**进程生命周期内持有（提供方 dispose 时撤销）。传入 `--write-sid` 时 runner 既不授权也不回收（`manageDacls: false`）；不传它（独立使用）则与之前一样按调用自行管理授权。重启后重新授权是幂等的：`grantWrite` 读取当前 DACL，当完全相同的 ACE 已存在时跳过 `SetNamedSecurityInfoW` 的应用（该应用会把相同的 ACE 急切地重新传播到整棵树——大型工作区上以分钟计）。异常关闭遗留的 ACE 无需垃圾回收：会话记录重新授权同一个 SID，下一次 dispose 即撤销它们。已知代价：在大型工作区树上物化授权会阻塞整次急切传播，每个服务器生命周期内每会话一次。
 
-模式（令牌的 restricting SID 列表随模式而定）：
-- `workspace-write`（列表 J = 登录 SID、Everyone、Authenticated Users、孤儿 SID）：工作区与会话的**私有**临时子目录携带孤儿 SID 的 Write 授权；其余写全部被令牌交集拒绝。Authenticated Users 保留在列表中，CIM 路径才能继续工作（`Get-CimInstance`、`Get-ComputerInfo`）；代价是残留的 Authenticated Users 可写面——尤其是 C:\ 盘根，那里驻留的 `AU:(AD)` + `AU:(OI)(CI)(IO)(M)` ACE 允许 AU 受限的子进程通过创建目录树逃逸——见设计笔记。
-- `read-only`（列表 I = 登录 SID、Everyone——不含孤儿 SID）：**严格零授权**——没有任何可写位置，令牌还**去掉** Authenticated Users，让环境写入面归零（上述 C:\ 根逃逸被关闭）。孤儿 SID 有意留在列表 I **之外**：先前 workspace-write 时期留下的驻留授权 ACE（`/permission` 降级，或崩溃后恢复的会话）在 read-only 下保持**失效**，因为 write-restricted 的 pass-2 检查只授予 restricting 列表所携带的内容——而未撤销的 ACE 让重新升级免于重新传播。NUL 设备是带安全描述符的对象，同样不被授权（区别于 Linux 的 `/dev/null` sink）：`Set-Content NUL` 与原生 `> NUL` 写会以 access denied 失败，而 PowerShell 的 `> $null` 重定向不受影响（它直接丢弃、不打开 NUL）。代价是 CIM 不可用：WMI 命名空间安全检查失败（`0x80041003`），因此 CIM cmdlet 与 `Get-ComputerInfo`（静默返回不完整结果而非报错）不可用——模型可见面文档化的是这一契约，而非提示词承诺。
+模式（令牌的 restricting SID 列表随模式而定；保活组在**两种**模式下都是登录 SID + Everyone——没有它们，早期 DLL init 会以 `0xC0000142` 死亡，CNG 会让 pwsh 以 `0xE0434352` 崩溃）：
+- `workspace-write`（登录 SID、Everyone、孤儿 SID）：工作区与会话的**私有**临时子目录携带孤儿 SID 的 Write 授权；其余写全部被令牌交集拒绝。
+- `read-only`（登录 SID、Everyone——不含孤儿 SID）：**严格零授权**——没有任何可写位置。孤儿 SID 有意留在列表**之外**：先前 workspace-write 时期留下的驻留授权 ACE（`/permission` 降级，或崩溃后恢复的会话）在 read-only 下保持**失效**，因为 write-restricted 的 pass-2 检查只授予 restricting 列表所携带的内容——而未撤销的 ACE 让重新升级免于重新传播。NUL 设备是带安全描述符的对象，同样不被授权（区别于 Linux 的 `/dev/null` sink）：`Set-Content NUL` 与原生 `> NUL` 写会以 access denied 失败，而 PowerShell 的 `> $null` 重定向不受影响（它直接丢弃、不打开 NUL）。
+
+Authenticated Users 在**两种**列表中都缺席——WMI 命名空间安全检查失败（`0x80041003`），因此 CIM cmdlet 与 `Get-ComputerInfo`（静默返回不完整结果而非报错）在**每一种**受限模式下都不可用，且 C:\-root 建树逃逸（驻留的 `AU:(AD)` + `AU:(OI)(CI)(IO)(M)` ACE）在两种模式下都被关闭——模型可见面文档化的是这一契约，而非提示词承诺。INTERACTIVE/LOCAL 同样在**两种**列表中都缺席：宿主的 Public 树把写权限授予 INTERACTIVE，因此 Public 写入会被拒绝——由 runner 的环境可写 Public-probe 回归钉住（见设计笔记）。
 
 `AclSandbox` 类（`tempDir: null` 关闭临时目录授权）仍是直接 spawn 场景的程序化 API；`AclWriteGrant` 是按会话契约中服务器侧的物化半边。
 
@@ -81,5 +83,5 @@ g++ -std=c++20 -municode -O2 -o abi-probe.exe verify/abi-probe.cpp -ladvapi32 &&
 - **授权物化是急切的全树传播。** 对带可继承 ACE 的目录调用 `SetNamedSecurityInfoW` 会立即遍历每个后代（**不是**按访问惰性求值——实测在大型工作区树加上真实临时根上要几十秒）。按会话复用使它在每个服务器生命周期内每会话只付一次（在首次受限执行时惰性发生；完全相同的 ACE 历经重启存活时整体跳过）；自管理的 runner 回退路径仍每次调用都付。若会话的工作区巨大，每个服务器生命周期内的第一次 pwsh 调用会相应地变慢。
 - **在两个服务器进程中并发恢复同一会话会产生两个 SID。** 持久化记录存放在会话日志中；两个进程各自读取或创建记录，按路径的锁保持 DACL 合并一致，最后写入的记录胜出并用于后续恢复——落败 SID 的 ACE 由其所属进程的 dispose 撤销。单写者的会话用法（常规部署形态）不会遇到这种情况。
 - **读侧隔离与网络策略超出范围** —— `WRITE_RESTRICTED` 只对写访问做交集检查；更强的隔离需叠加读侧策略。
-- **宽目录与 FAT 卷警告留待后续** —— 针对异常宽的目录或 FAT 类（无 ACL）卷授权的 UI 侧警告尚未实现；FAT 卷只会让授权立即报错。
+- **宽目录与 FAT 卷警告留待后续；FAT 类目标保持可写。** 针对异常宽的目录或 FAT 类（无 ACL）卷授权的 UI 侧警告尚未实现，且 FAT 卷作为授权**根**时只会让授权立即报错（无 ACL 支持）。位于授权根**之外**的 FAT 类目标则不同：它没有安全描述符，因此受限令牌的写检查会通过（Everyone 在两种列表中都存在），这类目标在**两种**受限模式下都可写。FAT 视作历史残留——不支持、不工程化应对；这一仅警告性姿态在此记录成文，而非加以缓解。
 - **两种受限模式都以 ConstrainedLanguage 运行 `pwsh`。** 受限令牌触发 PowerShell 的锁定检测，因此在 `read-only` 与 `workspace-write` 下语言模式都是 ConstrainedLanguage：`Add-Type`（C# 编译、P/Invoke）、非核心 .NET 静态调用（`[System.IO.*]::`、`[math]::`、`[Environment]::`）、COM 对象与反射都会以 `Cannot create type` / `Cannot invoke method`（“only core types”）错误失败，且 `$ExecutionContext.SessionState.LanguageMode = 'FullLanguage'` 会被拒绝。核心 cmdlet、核心类型（`[string]`、`[datetime]`、`[regex]`、`[guid]`）、`-f` 格式化与属性访问继续工作。`pwsh` 工具描述把这一契约教给模型；`danger-full-access` 调用不受隔离、以 FullLanguage 运行。

packages/sandbox/sandbox-windows-acl/src/index.ts

@@ -195,14 +195,9 @@ export class AclSandbox {
       this.sidAllocations.push(logonSid)
       const worldSid = makeWellKnownSid(api, abi.WinWorldSid)
       this.sidAllocations.push(worldSid)
-      const authUserSid = makeWellKnownSid(api, abi.WinAuthenticatedUserSid)
-      this.sidAllocations.push(authUserSid)
       const restricted = createRestrictedToken(
         api, currentToken, logonSid, writeSidPtr,
-        {
-          world: worldSid,
-          authUser: authUserSid,
-        },
+        { world: worldSid },
         this.mode,
       )
       this.token = restricted

packages/sandbox/sandbox-windows-acl/src/runner.ts

@@ -15,9 +15,12 @@
  *  - workspace-write: the workspace and temp directories carry the orphan-SID
  *    Write grant; every other write is denied by the token intersection.
  *  - read-only: STRICT zero grants — no directory is writable, not even the
- *    NUL device (`> $null` fails with access denied); the token's restricting
- *    list also drops Authenticated Users (CIM unavailable — documented in
- *    README).
+ *    NUL device (`> $null` fails with access denied); the restricting list
+ *    carries no orphan SID, so a standing grant ACE from an earlier
+ *    workspace-write period stays inert. BOTH modes drop Authenticated Users
+ *    (CIM unavailable — documented in README) and INTERACTIVE/LOCAL (the
+ *    Public tree writes are denied); the two lists share the keep-alive group
+ *    (logon SID, EVERYONE) and differ only by the orphan.
  *
  * `--write-sid`: the seam's per-session grant contract — the CALLER has
  * already materialized the orphan-SID ACEs (once per session, server

packages/sandbox/sandbox-windows-acl/src/token.ts

@@ -101,44 +101,41 @@ function buildRestrictingSids(sids: readonly NativePtr[]): Buffer {
   return buffer
 }
 
-/** The well-known SIDs packed into every restricted token's restricting list. */
+/** The well-known SID packed into every restricted token's restricting list. */
 export interface RestrictingSidSet {
   world: NativePtr
-  authUser: NativePtr
 }
 
 /**
  * Create the write-restricted token with the mode-selected restricting list
- * (dual lists verified on Win11 26200, see the POC-worktree restrict-variant
- * harness):
- *  - list I (read-only):   [logon SID, EVERYONE]
- *  - list J (workspace-write): [logon SID, EVERYONE, Authenticated Users, orphan]
+ * (verified on Win11 26200, see the POC-worktree restrict-variant harness):
+ *  - read-only:       [logon SID, EVERYONE]
+ *  - workspace-write: [logon SID, EVERYONE, orphan]
  *
- * The logon SID and EVERYONE are shared: they keep the early startup chain
- * (0xC0000142 without them) and CNG (`\Device\CNG` write trustee — pwsh
- * crashes 0xE0434352 without EVERYONE) alive. Authenticated Users exists in
- * list J ONLY because the CIM path's WMI namespace security check requires it
- * (0x80041003 otherwise) — read-only drops it for a zero ambient-write
- * surface (it closes the host's C:\-root tree-creation escape, where
- * `AU:(AD)` + `AU:(OI)(CI)(IO)(M)` ACEs stand) at the cost of CIM
- * unavailability; documented in README. List I also carries NO orphan: a
- * standing grant ACE from an earlier workspace-write period (a
- * `/permission` mode downgrade, or a crash-resumed session) must stay INERT
- * under read-only — the WRITE_RESTRICTED pass-2 check grants only what the
- * restricting list carries, so omitting the orphan keeps read-only strictly
- * zero-grant even with stale ACEs standing, while the unrevoked ACE keeps
- * the re-upgrade free (the seam's grant map hits it — no re-propagation).
- * INTERACTIVE/LOCAL are absent from BOTH lists — the host's Public tree
- * grants write to INTERACTIVE, so removing it closes that escape. S-1-2-1
- * (console logon) is intentionally absent: see win32-abi.ts for the
- * verified failure modes. FAILS CLOSED: any failure throws — never spawn
- * unrestricted.
+ * The logon SID + EVERYONE keep-alive group is shared by both modes: early
+ * DLL init dies with 0xC0000142 and CNG (`\Device\CNG` write trustee —
+ * pwsh crashes 0xE0434352) fails without them. The orphan SID joins ONLY
+ * workspace-write — read-only carries no orphan, so a standing grant ACE
+ * from an earlier workspace-write period (a `/permission` mode downgrade, or
+ * a crash-resumed session) stays INERT under read-only: the WRITE_RESTRICTED
+ * pass-2 check grants only what the restricting list carries, keeping
+ * read-only strictly zero-grant even with stale ACEs standing, while the
+ * unrevoked ACE keeps the re-upgrade free (the seam's grant map hits it — no
+ * re-propagation). Authenticated Users is absent from BOTH lists: the WMI
+ * namespace security check fails (0x80041003), so CIM is unavailable in
+ * every confined mode, and the C:\-root tree-creation escape (standing
+ * `AU:(AD)` + `AU:(OI)(CI)(IO)(M)` ACEs) is closed in both — documented in
+ * README. INTERACTIVE/LOCAL are absent from BOTH lists too — the host's
+ * Public tree grants write to INTERACTIVE, so removing it closes that
+ * escape. S-1-2-1 (console logon) is intentionally absent: see win32-abi.ts
+ * for the verified failure modes. FAILS CLOSED: any failure throws — never
+ * spawn unrestricted.
  * @param api - the binding table.
  * @param currentToken - the process token to restrict.
  * @param logonSid - the copied logon session SID.
- * @param writeSid - the orphan SID forming the write allowlist (list J only).
+ * @param writeSid - the orphan SID forming the write allowlist (workspace-write only).
  * @param known - the well-known SIDs entering the restricting list.
- * @param mode - selects the restricting list (I for read-only, J for workspace-write).
+ * @param mode - selects the restricting list (workspace-write adds the orphan).
  * @returns the restricted token handle.
  */
 export function createRestrictedToken(
@@ -151,7 +148,7 @@ export function createRestrictedToken(
 ): NativePtr {
   const restrictingSids = buildRestrictingSids(mode === 'read-only'
     ? [logonSid, known.world]
-    : [logonSid, known.world, known.authUser, writeSid])
+    : [logonSid, known.world, writeSid])
   const tokenSlot = allocPtrSlot()
   const created = api.createRestrictedToken(
     currentToken,

packages/sandbox/sandbox-windows-acl/src/win32-abi.ts

@@ -79,20 +79,8 @@ export const LUA_TOKEN = 0x4
 export const WRITE_RESTRICTED = 0x8
 
 // WELL_KNOWN_SID_TYPE (winnt.h lines ~3369-3407)
-/** WinWorldSid: S-1-1-0 (Everyone). */
+/** WinWorldSid: S-1-1-0 (Everyone) — the only well-known SID the restricted tokens use (keep-alive group; see token.ts). */
 export const WinWorldSid = 1
-/**
- * WinLocalSid: S-1-2-0 (LOCAL) — safe, created successfully on every init
- * (it sits in every restricted token's restricting list). The
- * CreateWellKnownSid ERROR_INVALID_PARAMETER failure documented in this
- * module's header comment belongs to WinLocalLogonSid (S-1-2-1), NOT to
- * this type.
- */
-export const WinLocalSid = 2
-/** WinInteractiveSid: S-1-5-4 (INTERACTIVE). */
-export const WinInteractiveSid = 11
-/** WinAuthenticatedUserSid: S-1-5-11 (Authenticated Users). */
-export const WinAuthenticatedUserSid = 17
 
 // TOKEN_INFORMATION_CLASS (winnt.h line ~3963: TokenUser=1, TokenGroups=2)
 /** TokenGroups: GetTokenInformation class returning the token's group SIDs. */

packages/sandbox/sandbox-windows-acl/tests/runner.spec.ts

@@ -38,6 +38,13 @@ describe.skipIf(!isWin32 || !pwshAvailable())('windows-acl runner', () => {
   let isolatedTemp!: string
   let secretFile!: string
   let escapeFile!: string
+  // The ambient-writable probe target: a subdirectory of C:\Users\Public.
+  // INTERACTIVE/LOCAL are absent from BOTH restricting lists, so the Public
+  // tree's INTERACTIVE grant must NOT satisfy the write check — the ambient
+  // boundary the dual-list design closes (bot-reported blind spot). The
+  // Public tree may be unavailable or unwritable for the test user on some
+  // hosts; the probe test skips itself when the directory cannot be created.
+  let publicProbeDir: string | undefined
 
   beforeAll(() => {
     scratchRoot = mkdtempSync(join(tmpdir(), 'dsh-acl-runner-'))
@@ -47,11 +54,17 @@ describe.skipIf(!isWin32 || !pwshAvailable())('windows-acl runner', () => {
     secretFile = join(scratchRoot, 'secret.txt')
     writeFileSync(secretFile, 'top secret - must stay readable to prove the read boundary')
     escapeFile = join(scratchRoot, 'escaped.txt')
+    try {
+      publicProbeDir = mkdtempSync(join(process.env.PUBLIC ?? 'C:\\Users\\Public', 'dsh-acl-public-'))
+    } catch {
+      publicProbeDir = undefined
+    }
   })
 
   afterAll(() => {
     rmSync(scratchRoot, { recursive: true, force: true })
     rmSync(isolatedTemp, { recursive: true, force: true })
+    if (publicProbeDir !== undefined) rmSync(publicProbeDir, { recursive: true, force: true })
   })
 
   it('workspace-write: the confined child writes granted directories only', () => {
@@ -65,8 +78,10 @@ describe.skipIf(!isWin32 || !pwshAvailable())('windows-acl runner', () => {
       `try{Set-Content -Path '${isolatedTemp}\\child-wrote.txt' -Value ok -ErrorAction Stop;'TEMP-WRITE: OK'}catch{'TEMP-WRITE: DENIED'};`,
       `try{Set-Content -Path '${escapeFile}' -Value ok -ErrorAction Stop;'ESCAPE-WRITE: OK (ESCAPE!)'}catch{'ESCAPE-WRITE: DENIED'};`,
       `try{Get-Content '${secretFile}' -ErrorAction Stop | Out-Null;'SECRET-READ: OK'}catch{'SECRET-READ: DENIED'};`,
-      // List J carries Authenticated Users: the CIM path (WMI namespace
-      // security check) stays alive under workspace-write.
+      // Authenticated Users is absent from BOTH lists: the WMI namespace
+      // security check fails (0x80041003) — CIM is unavailable under every
+      // confined mode (the documented contract; the C:\-root tree-creation
+      // escape is closed in both as the other side of the trade).
       "try{Get-CimInstance Win32_OperatingSystem -ErrorAction Stop | Out-Null;'CIM: OK'}catch{'CIM: DENIED'}",
     ].join('')
     const result = runRunner([
@@ -79,12 +94,12 @@ describe.skipIf(!isWin32 || !pwshAvailable())('windows-acl runner', () => {
     expect(result.stdout).toContain('TEMP-WRITE: OK')
     expect(result.stdout).toContain('ESCAPE-WRITE: DENIED')
     expect(result.stdout).toContain('SECRET-READ: OK')
-    expect(result.stdout).toContain('CIM: OK')
+    expect(result.stdout).toContain('CIM: DENIED')
     expect(existsSync(escapeFile)).toBe(false)
     expect(existsSync(join(writableDir, 'child-wrote.txt'))).toBe(true)
   }, 30_000)
 
-  it('read-only: strict zero grants — no writes anywhere (not even NUL), reads and $null redirection fine, CIM unavailable (list I)', () => {
+  it('read-only: strict zero grants — no writes anywhere (not even NUL), reads and $null redirection fine, CIM unavailable', () => {
     const probe = [
       "$ErrorActionPreference='SilentlyContinue';",
       '\'LANGMODE: \' + $ExecutionContext.SessionState.LanguageMode;',
@@ -95,9 +110,9 @@ describe.skipIf(!isWin32 || !pwshAvailable())('windows-acl runner', () => {
       // PowerShell's $null redirection discards without opening NUL — must keep working.
       'echo hi > $null;\'DOLLAR-NULL: OK\';',
       `try{Get-Content '${secretFile}' -ErrorAction Stop | Out-Null;'SECRET-READ: OK'}catch{'SECRET-READ: DENIED'};`,
-      // List I drops Authenticated Users: the WMI namespace security check
-      // fails (0x80041003) — the documented read-only CIM boundary, the
-      // price of the zero ambient-write surface.
+      // BOTH lists drop Authenticated Users: the WMI namespace security
+      // check fails (0x80041003) — the documented CIM boundary of every
+      // confined mode, the price of the zero ambient-write surface.
       "try{Get-CimInstance Win32_OperatingSystem -ErrorAction Stop | Out-Null;'CIM: OK'}catch{'CIM: DENIED'}",
     ].join('')
     const result = runRunner([
@@ -177,7 +192,7 @@ describe.skipIf(!isWin32 || !pwshAvailable())('windows-acl runner', () => {
   it('mode-downgrade leak regression: a STANDING workspace grant is inert under read-only and effective again on re-upgrade', () => {
     // The reported defect: a session that materialized its grant in
     // workspace-write keeps the ACE standing for the server lifetime. After
-    // switching to read-only, the restricted token's list I must carry NO
+    // switching to read-only, the restricted token's read-only list must carry NO
     // orphan SID — the standing ACE stays but the pass-2 check cannot use
     // it, so the workspace write is denied (previously it LEAKED). The
     // switch back reuses the SAME standing ACE: the re-upgrade write lands
@@ -214,6 +229,30 @@ describe.skipIf(!isWin32 || !pwshAvailable())('windows-acl runner', () => {
     }
   }, 30_000)
 
+  it('ambient-writable escape regression: a C:\\Users\\Public subdirectory is denied under BOTH modes (INTERACTIVE absent from both lists)', (ctx) => {
+    // The Public tree grants write to INTERACTIVE; the D1-D6 matrix pinned
+    // that removing INTERACTIVE from the restricting lists closes the escape.
+    // The committed suites never probed it — this pins the ambient boundary
+    // end to end with the real restricted token.
+    if (publicProbeDir === undefined) {
+      ctx.skip() // Public unavailable/unwritable on this host
+      return
+    }
+    const probe = [
+      "$ErrorActionPreference='SilentlyContinue';",
+      `try{Set-Content -Path '${publicProbeDir}\\public-escaped.txt' -Value ok -ErrorAction Stop;'PUBLIC-WRITE: OK (ESCAPE!)'}catch{'PUBLIC-WRITE: DENIED'}`,
+    ].join('')
+    for (const mode of ['read-only', 'workspace-write'] as const) {
+      const result = runRunner([
+        '--workspace', writableDir, '--temp', isolatedTemp, '--mode', mode,
+        '--', 'pwsh', '/NoLogo', '/NonInteractive', '/NoProfile', '/Command', probe,
+      ])
+      expect(result.status, `stderr: ${result.stderr}`).toBe(0)
+      expect(result.stdout, `mode: ${mode}`).toContain('PUBLIC-WRITE: DENIED')
+      expect(existsSync(join(publicProbeDir, 'public-escaped.txt')), `mode: ${mode}`).toBe(false)
+    }
+  }, 30_000)
+
   it('runner-side failure: signature on stderr and exit 127, the command never runs', () => {
     const result = runRunner(['--workspace', writableDir, '--temp', isolatedTemp, '--mode', 'workspace-write'])
     expect(result.status).toBe(127)

packages/sandbox/sandbox-windows-acl/verify/abi-probe.cpp

@@ -109,9 +109,6 @@ int wmain()
 	P(WRITE_RESTRICTED);
 
 	P((int)WinWorldSid);
-	P((int)WinLocalSid);
-	P((int)WinInteractiveSid);
-	P((int)WinAuthenticatedUserSid);
 	P((int)WinLocalLogonSid);
 	P((int)WinConsoleLogonSid);