{"record":{"id":"27896e2e955c48e7","repo":"deepseek-ai/deepseek-harness","slug":"settokendefaultdaclgrant-the-token-carries-no-def","errorCode":null,"errorMessage":"setTokenDefaultDaclGrant: the token carries no default DACL to extend","messagePattern":"setTokenDefaultDaclGrant: the token carries no default DACL to extend","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/sandbox/sandbox-windows-acl/src/token.ts","lineNumber":123,"sourceCode":" * object's own DACL passes pass-2 while object creation itself stays gated by\n * the parent container's DACL (files outside the granted trees remain\n * uncreatable). Fails closed: any Win32 failure throws before the spawn.\n * @param api - the binding table.\n * @param token - the restricted token to adjust (requires TOKEN_ADJUST_DEFAULT).\n * @param sidPtr - the restricting SID whose full-access ACE joins the default DACL.\n */\nexport function setTokenDefaultDaclGrant(api: Win32Bindings, token: NativePtr, sidPtr: NativePtr): void {\n  const neededSlot = allocUint32()\n  api.getTokenInformation(token, abi.TokenDefaultDacl, null, 0, neededSlot) // expected to fail with ERROR_INSUFFICIENT_BUFFER\n  const needed = decodeUint32(neededSlot)\n  if (needed === 0) throwLastError(api, 'GetTokenInformation', 'TokenDefaultDacl size query')\n  const buffer = Buffer.alloc(needed)\n  if (api.getTokenInformation(token, abi.TokenDefaultDacl, buffer, buffer.length, neededSlot) === 0) {\n    throwLastError(api, 'GetTokenInformation', 'TokenDefaultDacl')\n  }\n  const currentDacl = decodePtrAt(buffer, 0)\n  if (currentDacl === null) {\n    throw new Error('setTokenDefaultDaclGrant: the token carries no default DACL to extend')\n  }\n  const newDaclSlot = allocPtrSlot()\n  const result = api.setEntriesInAclW(\n    1,\n    buildExplicitAccess(sidPtr, abi.GRANT_ACCESS, abi.FILE_ALL_ACCESS),\n    currentDacl,\n    newDaclSlot,\n  )\n  if (result !== abi.ERROR_SUCCESS) throwWin32(api, 'SetEntriesInAclW', result, 'default DACL merge')\n  const newDacl = decodePtr(newDaclSlot)\n  if (newDacl === null) throwWin32(api, 'SetEntriesInAclW', result, 'null merged default DACL')\n  // TOKEN_DEFAULT_DACL { PACL DefaultDacl; } — the struct is exactly the\n  // pointer; SetTokenInformation copies the ACL before returning.\n  const info = Buffer.alloc(8)\n  info.writeBigUInt64LE(newDacl, 0)\n  if (api.setTokenInformation(token, abi.TokenDefaultDacl, info, info.length) === 0) {\n    const win32Code = api.getLastError()\n    api.localFree(newDacl)","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/deepseek-ai/deepseek-harness/blob/b150a551b8d465e31e418e1b2eaf5e79bbb7d28e/packages/sandbox/sandbox-windows-acl/src/token.ts#L105-L141","documentation":"Error \"setTokenDefaultDaclGrant: the token carries no default DACL to extend\" thrown in deepseek-ai/deepseek-harness.","triggerScenarios":"Thrown at packages/sandbox/sandbox-windows-acl/src/token.ts:123 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set a default DACL on the token before extending it, or skip the default-DACL grant for tokens that carry none."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b150a551b8d465e31e418e1b2eaf5e79bbb7d28e","analyzedAt":"2026-08-24T18:12:29.105Z","schemaVersion":2},"datasetVersion":"2026-08-24T22:17:12.610Z"}