{"record":{"id":"18f4fd232f20815c","repo":"deepseek-ai/deepseek-harness","slug":"sandbox-local-windows-acl-workspace-grant-failed-a","errorCode":null,"errorMessage":"sandbox-local windows-acl workspace grant failed and its cleanup also failed","messagePattern":"sandbox-local windows-acl workspace grant failed and its cleanup also failed","errorType":"exception","errorClass":"AggregateError","httpStatus":null,"severity":"error","filePath":"packages/sandbox/sandbox-local/src/index.ts","lineNumber":406,"sourceCode":"   * @param sessionId - the policy's calling-session identity.\n   * @param workspaceRoot - the resolved policy root.\n   * @returns the pair's private temp directory and write capability.\n   */\n  private materializeAclGrant(sessionId: SessionId, workspaceRoot: string): AclTempCapability {\n    assertTempRootOutsideWorkspace(workspaceRoot, tmpdir())\n    const writeSid = workspaceWriteSid(workspaceRoot)\n    if (!this.workspaceGrants.has(workspaceRoot)) {\n      const grant = AclWriteGrant.create(writeSid)\n      try {\n        grant.add(workspaceRoot, true)\n      } catch (error) {\n        // Free the SID; a standing ACE (if the apply succeeded before a\n        // post-apply throw) is the intended end state, not an error\n        // artifact — nothing to revoke.\n        try {\n          grant.dispose()\n        } catch (cleanupError) {\n          throw new AggregateError([error, cleanupError], 'sandbox-local windows-acl workspace grant failed and its cleanup also failed')\n        }\n        throw error\n      }\n      this.workspaceGrants.set(workspaceRoot, grant)\n    }\n    const key = JSON.stringify([String(sessionId), workspaceRoot])\n    const existing = this.tempCapabilities.get(key)\n    if (existing !== undefined) return existing\n    const tempDir = mkdtempSync(join(tmpdir(), 'dsh-'))\n    const tempSid = tempWriteSid(tempDir)\n    let grant: AclWriteGrant | undefined\n    try {\n      grant = AclWriteGrant.create(tempSid)\n      grant.add(tempDir)\n    } catch (error) {\n      const cleanupFailures: unknown[] = []\n      if (grant !== undefined) {\n        try {","sourceCodeStart":388,"sourceCodeEnd":424,"githubUrl":"https://github.com/deepseek-ai/deepseek-harness/blob/b150a551b8d465e31e418e1b2eaf5e79bbb7d28e/packages/sandbox/sandbox-local/src/index.ts#L388-L424","documentation":"Error \"sandbox-local windows-acl workspace grant failed and its cleanup also failed\" thrown in deepseek-ai/deepseek-harness.","triggerScenarios":"Thrown at packages/sandbox/sandbox-local/src/index.ts:406 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the Windows ACL state manually, remove stale workspace grants, and retry."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b150a551b8d465e31e418e1b2eaf5e79bbb7d28e","analyzedAt":"2026-08-24T18:12:29.105Z","schemaVersion":2},"datasetVersion":"2026-08-24T22:17:12.610Z"}