{"record":{"id":"abf55e94e407d85a","repo":"JuliusBrussee/caveman","slug":"native-runtime-current-user-sid-unavailable","errorCode":null,"errorMessage":"native runtime current user SID: unavailable","messagePattern":"native runtime current user SID: unavailable","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/internal/nativeruntime/server_windows.go","lineNumber":46,"sourceCode":"}\n\nfunc dialNativeRuntime(ctx context.Context, home string) (net.Conn, error) {\n\treturn winio.DialPipeContext(ctx, SocketPath(home))\n}\n\n// Serve exposes the same bounded JSON protocol over a user-only Windows named\n// pipe. go-winio rejects remote clients at pipe creation; explicit owner SID\n// ACL prevents another local user from attaching.\nfunc Serve(ctx context.Context, home string, runtime *Runtime) error {\n\tif runtime == nil || runtime.store == nil {\n\t\treturn errors.New(\"native runtime: store is required\")\n\t}\n\tuser, err := windows.GetCurrentProcessToken().GetTokenUser()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"native runtime current user SID: %w\", err)\n\t}\n\tif user == nil || user.User.Sid == nil {\n\t\treturn errors.New(\"native runtime current user SID: unavailable\")\n\t}\n\tsddl := \"D:P(A;;GA;;;\" + user.User.Sid.String() + \")\"\n\tlistener, err := winio.ListenPipe(SocketPath(home), &winio.PipeConfig{\n\t\tSecurityDescriptor: sddl,\n\t\tInputBufferSize:    maxRequestBytes,\n\t\tOutputBufferSize:   maxRequestBytes,\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"native runtime named-pipe listen: %w\", err)\n\t}\n\tdefer listener.Close()\n\tgo func() {\n\t\t<-ctx.Done()\n\t\t_ = listener.Close()\n\t}()\n\tfor {\n\t\tconn, err := listener.Accept()\n\t\tif err != nil {","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/proxy/internal/nativeruntime/server_windows.go#L28-L64","documentation":"To build the owner-only named-pipe ACL, Serve fetches the current process token's user SID. If GetTokenUser returns an error, or the returned token user or SID is nil, Serve cannot construct a secure SDDL descriptor and refuses to create an unprotected pipe.","triggerScenarios":"windows.GetCurrentProcessToken().GetTokenUser() fails, or returns user == nil / user.User.Sid == nil — e.g. running in a service/session context without a proper user token, restricted sandbox, or exotic Windows security configurations.","commonSituations":"Running the agent as a Windows service under an account with a stripped token; executing inside restricted job objects/containers where the token query is denied; unusual impersonation contexts in tests.","solutions":["Run the coding agent in an interactive user session (normal user process) so the process token carries a user SID.","Inspect the wrapped GetTokenUser error (native runtime current user SID: %w) for the underlying OS failure code.","If running as a service, configure the service to log on as a real user account rather than a synthetic identity.","As a workaround, disable the Windows named-pipe runtime surface if the environment cannot provide a user token."],"exampleFix":"// before\n// agent started as Windows service without a user token\n// after\n// configure service logon as a user account, or skip:\nif err := nativeruntime.Serve(ctx, home, rt); err != nil {\n    log.Warnf(\"native runtime disabled: %v\", err)\n}","handlingStrategy":"fallback","validationCode":"u, err := windows.GetCurrentProcessToken().GetTokenUser()\nif err != nil || u == nil || u.User.Sid == nil {\n    // cannot build owner-only ACL; skip pipe serving\n}","typeGuard":"func hasUserSID() bool {\n    u, err := windows.GetCurrentProcessToken().GetTokenUser()\n    return err == nil && u != nil && u.User != nil && u.User.Sid != nil\n}","tryCatchPattern":"if err := nativeruntime.Serve(ctx, home, rt); err != nil {\n    if strings.Contains(err.Error(), \"SID\") {\n        log.Warnf(\"native runtime unavailable without user token: %v\", err)\n        return nil\n    }\n    return err\n}","preventionTips":["Run the agent as an interactive user process, not a synthetic service identity","Avoid impersonation contexts that strip token user info","Feature-detect SID availability before enabling the pipe runtime"],"tags":["windows","security","acl","named-pipe"],"backgroundTag":"insufficient-permissions","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}