{"record":{"id":"a56ba98b5e4fc70a","repo":"deepseek-ai/deepseek-harness","slug":"createrestrictedtoken-prerequisite-failed-no-logo","errorCode":null,"errorMessage":"CreateRestrictedToken prerequisite failed: no logon SID found among ${groupCount} token groups","messagePattern":"CreateRestrictedToken prerequisite failed: no logon SID found among (.+?) token groups","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/sandbox/sandbox-windows-acl/src/token.ts","lineNumber":76,"sourceCode":"\n  const groups = Buffer.alloc(needed)\n  if (api.getTokenInformation(token, abi.TokenGroups, groups, groups.length, neededSlot) === 0) {\n    throwLastError(api, 'GetTokenInformation', 'TokenGroups')\n  }\n  const groupCount = groups.readUInt32LE(0)\n  for (let index = 0; index < groupCount; index++) {\n    const sidPtr = decodePtrAt(groups, abi.TOKEN_GROUPS_OFFSET + index * abi.SID_AND_ATTRIBUTES_SIZE)\n    const attributes = groups.readUInt32LE(abi.TOKEN_GROUPS_OFFSET + index * abi.SID_AND_ATTRIBUTES_SIZE + 8)\n    // >>> 0: JS bitwise & is signed 32-bit; SE_GROUP_LOGON_ID has bit 31 set.\n    const isLogonId = ((attributes & abi.SE_GROUP_LOGON_ID) >>> 0) === (abi.SE_GROUP_LOGON_ID >>> 0)\n    if (sidPtr === null || !isLogonId) continue\n    const sidLength = api.getLengthSid(sidPtr)\n    if (sidLength === 0) throwLastError(api, 'GetLengthSid', `logon SID group ${index}`)\n    const copy = allocBytes(sidLength)\n    if (api.copySid(sidLength, copy, sidPtr) === 0) throwLastError(api, 'CopySid', `logon SID group ${index}`)\n    return copy\n  }\n  throw new Error(`CreateRestrictedToken prerequisite failed: no logon SID found among ${groupCount} token groups`)\n}\n\n/**\n * Create one well-known SID (68-byte buffer) and assert its validity.\n * @param api - the binding table.\n * @param type - the WELL_KNOWN_SID_TYPE to create.\n * @returns the created SID pointer.\n */\nexport function makeWellKnownSid(api: Win32Bindings, type: number): NativePtr {\n  const sid = allocBytes(abi.SECURITY_MAX_SID_SIZE)\n  const sizeSlot = allocUint32()\n  encodeUint32(sizeSlot, abi.SECURITY_MAX_SID_SIZE)\n  if (api.createWellKnownSid(type, null, sid, sizeSlot) === 0) {\n    throwLastError(api, 'CreateWellKnownSid', `type ${type}`)\n  }\n  if (api.isValidSid(sid) === 0) throwLastError(api, 'IsValidSid', `CreateWellKnownSid type ${type}`)\n  return sid\n}","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/deepseek-ai/deepseek-harness/blob/b150a551b8d465e31e418e1b2eaf5e79bbb7d28e/packages/sandbox/sandbox-windows-acl/src/token.ts#L58-L94","documentation":"Error \"CreateRestrictedToken prerequisite failed: no logon SID found among ${groupCount} token groups\" thrown in deepseek-ai/deepseek-harness.","triggerScenarios":"Thrown at packages/sandbox/sandbox-windows-acl/src/token.ts:76 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Run under an interactive logon session whose token includes a logon SID; service or batch tokens without one cannot be restricted this way."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b150a551b8d465e31e418e1b2eaf5e79bbb7d28e","analyzedAt":"2026-08-24T18:12:29.105Z","schemaVersion":2},"datasetVersion":"2026-08-24T22:17:12.610Z"}