{"record":{"id":"00f60a2a101d3633","repo":"deepseek-ai/deepseek-harness","slug":"windows-acl-temp-root-must-be-outside-the-workspac","errorCode":null,"errorMessage":"Windows ACL temp root must be outside the workspace: workspace=${workspaceRoot}; temp=${tempRoot}","messagePattern":"Windows ACL temp root must be outside the workspace: workspace=(.+?); temp=(.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/sandbox/sandbox-windows-acl/src/path-boundary.ts","lineNumber":24,"sourceCode":"\nimport { realpathSync } from 'node:fs'\nimport { isAbsolute, relative, sep } from 'node:path'\n\n/** Whether `root` is the same canonical directory as `candidate` or contains it. */\nfunction containsDirectory(root: string, candidate: string): boolean {\n  const relation = relative(realpathSync.native(root), realpathSync.native(candidate))\n  return relation === '' || (!isAbsolute(relation) && relation !== '..' && !relation.startsWith(`..${sep}`))\n}\n\n/**\n * Reject a temp parent that is inside the workspace: every child created\n * below it would inherit the standing workspace capability.\n * @param workspaceRoot - the canonical workspace root that receives the standing ACE.\n * @param tempRoot - the existing parent beneath which a private temp child would be created.\n */\nexport function assertTempRootOutsideWorkspace(workspaceRoot: string, tempRoot: string): void {\n  if (containsDirectory(workspaceRoot, tempRoot)) {\n    throw new Error(`Windows ACL temp root must be outside the workspace: workspace=${workspaceRoot}; temp=${tempRoot}`)\n  }\n}\n\n/**\n * Reject overlap between an actual private temp directory and any writable\n * directory: either inheritance direction would merge the two capabilities.\n * @param writableDirs - directories carrying the standing workspace capability.\n * @param tempDir - the existing directory carrying the revocable temp capability.\n */\nexport function assertPrivateTempDisjoint(writableDirs: readonly string[], tempDir: string): void {\n  for (const writableDir of writableDirs) {\n    if (containsDirectory(writableDir, tempDir) || containsDirectory(tempDir, writableDir)) {\n      throw new Error(`AclSandbox private temp directory must be disjoint from writable directories: writable=${writableDir}; temp=${tempDir}`)\n    }\n  }\n}\n","sourceCodeStart":6,"sourceCodeEnd":41,"githubUrl":"https://github.com/deepseek-ai/deepseek-harness/blob/b150a551b8d465e31e418e1b2eaf5e79bbb7d28e/packages/sandbox/sandbox-windows-acl/src/path-boundary.ts#L6-L41","documentation":"Error \"Windows ACL temp root must be outside the workspace: workspace=${workspaceRoot}; temp=${tempRoot}\" thrown in deepseek-ai/deepseek-harness.","triggerScenarios":"Thrown at packages/sandbox/sandbox-windows-acl/src/path-boundary.ts:24 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Point tempRoot at a directory outside the workspace tree.","Set TEMP/TMP to a location outside the workspace, or pass an explicit tempRoot."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b150a551b8d465e31e418e1b2eaf5e79bbb7d28e","analyzedAt":"2026-08-24T18:12:29.105Z","schemaVersion":2},"datasetVersion":"2026-08-24T22:17:12.610Z"}