{"record":{"id":"38826f1d7d3b435f","repo":"JuliusBrussee/caveman","slug":"native-runtime-current-user-sid-w","errorCode":null,"errorMessage":"native runtime current user SID: %w","messagePattern":"native runtime current user SID: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/internal/nativeruntime/server_windows.go","lineNumber":43,"sourceCode":"\tnormalized := strings.ToLower(filepath.Clean(absolute))\n\tsum := sha256.Sum256([]byte(normalized))\n\treturn `\\\\.\\pipe\\caveman-native-` + hex.EncodeToString(sum[:8])\n}\n\nfunc dialNativeRuntime(ctx context.Context, home string) (net.Conn, error) {\n\treturn winio.DialPipeContext(ctx, SocketPath(home))\n}\n\n// Serve exposes the same bounded JSON protocol over a user-only Windows named\n// pipe. go-winio rejects remote clients at pipe creation; explicit owner SID\n// ACL prevents another local user from attaching.\nfunc Serve(ctx context.Context, home string, runtime *Runtime) error {\n\tif runtime == nil || runtime.store == nil {\n\t\treturn errors.New(\"native runtime: store is required\")\n\t}\n\tuser, err := windows.GetCurrentProcessToken().GetTokenUser()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"native runtime current user SID: %w\", err)\n\t}\n\tif user == nil || user.User.Sid == nil {\n\t\treturn errors.New(\"native runtime current user SID: unavailable\")\n\t}\n\tsddl := \"D:P(A;;GA;;;\" + user.User.Sid.String() + \")\"\n\tlistener, err := winio.ListenPipe(SocketPath(home), &winio.PipeConfig{\n\t\tSecurityDescriptor: sddl,\n\t\tInputBufferSize:    maxRequestBytes,\n\t\tOutputBufferSize:   maxRequestBytes,\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"native runtime named-pipe listen: %w\", err)\n\t}\n\tdefer listener.Close()\n\tgo func() {\n\t\t<-ctx.Done()\n\t\t_ = listener.Close()\n\t}()","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/proxy/internal/nativeruntime/server_windows.go#L25-L61","documentation":"On Windows, Serve resolves the current user's SID via GetCurrentProcessToken().GetTokenUser() to build a restrictive SDDL ACL for the named pipe. If the token user cannot be retrieved, it returns \"native runtime current user SID\". This is required to scope the pipe to the current user.","triggerScenarios":"windows.GetCurrentProcessToken().GetTokenUser() fails: running in a context without a valid access token (odd service/session setups), or token query API failure.","commonSituations":"Running under a Windows service account with a restricted or impersonated token; executing inside unusual sandboxed environments (e.g. some CI runners) that lack a queryable process token; corrupted user profile/token.","solutions":["Run the runtime from a normal interactive user session with a valid process token","Check that the Windows user profile and access token are healthy (whoami, log off/on)","Avoid launching the runtime from heavily restricted service or impersonation contexts"],"exampleFix":"// before (service session lacking token user)\nnet start caveman-runtime\n// after\nrun as interactive user:\ncaveman-runtime serve  # from a normal logged-in session","handlingStrategy":"try-catch","validationCode":"if runtime.GOOS != \"windows\" {\n\treturn errors.New(\"Serve is Windows-only; use ServeUnix\")\n}","typeGuard":null,"tryCatchPattern":"err := nativeruntime.Serve(ctx, home, rt)\nif err != nil {\n\tif strings.Contains(err.Error(), \"current user SID\") {\n\t\t// relaunch in an interactive session or fall back to a user-run service\n\t}\n\treturn err\n}","preventionTips":["Launch the runtime from a normal interactive Windows session","Avoid impersonated or stripped service tokens","Verify token health (whoami /user) before starting in CI runners"],"tags":["windows","security","sid","named-pipe"],"backgroundTag":"authentication-required","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}