{"record":{"id":"c40e7e262861fb5c","repo":"deepseek-ai/deepseek-harness","slug":"convertstringsidtosidw-failed-win32-win32code","errorCode":null,"errorMessage":"ConvertStringSidToSidW failed (Win32 ${win32Code}): ${sid}","messagePattern":"ConvertStringSidToSidW failed \\(Win32 (.+?)\\): (.+?)","errorType":"exception","errorClass":"Win32Error","httpStatus":null,"severity":"error","filePath":"packages/sandbox/sandbox-windows-acl/src/index.ts","lineNumber":235,"sourceCode":"  get tempDir(): string | null | undefined {\n    return this.tempDirResolved\n  }\n\n  /** Create the restricted token and apply the capability-SID grants. Idempotent-unsafe: once per instance. */\n  async init(): Promise<void> {\n    if (this.api !== undefined) throw new Error('AclSandbox is already initialized')\n    const api = await win32()\n    const currentToken = openCurrentProcessToken(api)\n    let currentTokenOpen = true\n    let restrictedToken: NativePtr | undefined\n    try {\n      const parseSid = (sid: string): NativePtr => {\n        const sidSlot = allocPtrSlot()\n        if (api.convertStringSidToSidW(sid, sidSlot) === 0) {\n          throwLastError(api, 'ConvertStringSidToSidW', sid)\n        }\n        const parsedSid = decodePtr(sidSlot)\n        if (parsedSid === null) throw new Win32Error('ConvertStringSidToSidW', api.getLastError(), sid)\n        return parsedSid\n      }\n      this.writeSidPtr = this.writeSid === undefined ? undefined : parseSid(this.writeSid)\n      this.tempWriteSidPtr = this.tempWriteSid === undefined ? undefined : parseSid(this.tempWriteSid)\n\n      const tempDir = this.mode === 'read-only' || this.tempDirOption === null ? null : this.tempDirOption\n      /* v8 ignore next -- constructor validation requires workspace-write to supply\n         an explicit temp directory or null; the other branches normalize to null. */\n      if (tempDir === undefined) throw new Error('AclSandbox workspace-write temp directory was not resolved')\n      if (tempDir !== null) {\n        if (!existsSync(tempDir) || !statSync(tempDir).isDirectory()) {\n          throw new Error(`AclSandbox temp dir does not exist or is not a directory: ${tempDir}`)\n        }\n        assertPrivateTempDisjoint(this.writableDirs, tempDir)\n      }\n      this.tempDirResolved = tempDir\n\n      // manageDacls: false — the caller (the sandbox seam's grant) already","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/deepseek-ai/deepseek-harness/blob/b150a551b8d465e31e418e1b2eaf5e79bbb7d28e/packages/sandbox/sandbox-windows-acl/src/index.ts#L217-L253","documentation":"Error \"ConvertStringSidToSidW failed (Win32 ${win32Code}): ${sid}\" thrown in deepseek-ai/deepseek-harness.","triggerScenarios":"Thrown at packages/sandbox/sandbox-windows-acl/src/index.ts:235 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the SID string: it must be a valid SDDL SID (S-1-...) accepted by ConvertStringSidToSidW."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b150a551b8d465e31e418e1b2eaf5e79bbb7d28e","analyzedAt":"2026-08-24T18:12:29.105Z","schemaVersion":2},"datasetVersion":"2026-08-24T22:17:12.610Z"}