What causes "native runtime current user SID: %w" in JuliusBrussee/caveman?

Run the runtime from a normal interactive user session with a valid process token

native runtime current user SID

Error message

native runtime current user SID: %w

What it means

On Windows, Serve resolves the current user's SID via GetCurrentProcessToken().GetTokenUser() to build a restrictive SDDL ACL for the named pipe. If the token user cannot be retrieved, it returns "native runtime current user SID". This is required to scope the pipe to the current user.

Solutions

Run the runtime from a normal interactive user session with a valid process token
Check that the Windows user profile and access token are healthy (whoami, log off/on)
Avoid launching the runtime from heavily restricted service or impersonation contexts

Example fix

// before (service session lacking token user)
net start caveman-runtime
// after
run as interactive user:
caveman-runtime serve  # from a normal logged-in session

Defensive patterns

Strategy: try-catch

Validate before calling

if runtime.GOOS != "windows" {
	return errors.New("Serve is Windows-only; use ServeUnix")
}

Try / catch

err := nativeruntime.Serve(ctx, home, rt)
if err != nil {
	if strings.Contains(err.Error(), "current user SID") {
		// relaunch in an interactive session or fall back to a user-run service
	}
	return err
}

Prevention

Launch the runtime from a normal interactive Windows session
Avoid impersonated or stripped service tokens
Verify token health (whoami /user) before starting in CI runners

When it happens

Trigger: windows.GetCurrentProcessToken().GetTokenUser() fails: running in a context without a valid access token (odd service/session setups), or token query API failure.

Common situations: Running under a Windows service account with a restricted or impersonated token; executing inside unusual sandboxed environments (e.g. some CI runners) that lack a queryable process token; corrupted user profile/token.

Related errors

AI-assisted analysis of JuliusBrussee/caveman@3ee70a1026 (2026-09-20). Data as JSON: /api/errors/38826f1d7d3b435f. Report an issue: GitHub.

Appendix: source

Thrown at proxy/internal/nativeruntime/server_windows.go:43

	normalized := strings.ToLower(filepath.Clean(absolute))
	sum := sha256.Sum256([]byte(normalized))
	return `\\.\pipe\caveman-native-` + hex.EncodeToString(sum[:8])
}

func dialNativeRuntime(ctx context.Context, home string) (net.Conn, error) {
	return winio.DialPipeContext(ctx, SocketPath(home))
}

// Serve exposes the same bounded JSON protocol over a user-only Windows named
// pipe. go-winio rejects remote clients at pipe creation; explicit owner SID
// ACL prevents another local user from attaching.
func Serve(ctx context.Context, home string, runtime *Runtime) error {
	if runtime == nil || runtime.store == nil {
		return errors.New("native runtime: store is required")
	}
	user, err := windows.GetCurrentProcessToken().GetTokenUser()
	if err != nil {
		return fmt.Errorf("native runtime current user SID: %w", err)
	}
	if user == nil || user.User.Sid == nil {
		return errors.New("native runtime current user SID: unavailable")
	}
	sddl := "D:P(A;;GA;;;" + user.User.Sid.String() + ")"
	listener, err := winio.ListenPipe(SocketPath(home), &winio.PipeConfig{
		SecurityDescriptor: sddl,
		InputBufferSize:    maxRequestBytes,
		OutputBufferSize:   maxRequestBytes,
	})
	if err != nil {
		return fmt.Errorf("native runtime named-pipe listen: %w", err)
	}
	defer listener.Close()
	go func() {
		<-ctx.Done()
		_ = listener.Close()
	}()

View on GitHub (pinned to 3ee70a1026)