What causes "Windows returned an invalid current-user SID" in astrid-runtime/astrid?

Restart the offending process to obtain a fresh, healthy process token.

Windows returned an invalid current-user SID

Error message

Windows returned an invalid current-user SID

What it means

astrid-core resolves the current process token to build a SID identifying the current user, which it uses to construct and validate private-file ACLs on Windows. Before using the TOKEN_USER buffer, it calls Win32 IsValidSid; if the OS returned a SID that fails that check, it raises io::ErrorKind::InvalidData with this message. This is a defensive guard against a corrupt or unexpected token response, not a user-code mistake.

Solutions

Restart the offending process to obtain a fresh, healthy process token.
Check for security software, hooking DLLs, or job/sandbox configuration that tampers with the process token; exclude the process or disable token manipulation.
Verify the process is running as an authenticated interactive/service identity, not a stripped token; run under a normal user account.
File a bug with the library maintainers including the Windows version if the error persists on a stock system.

Defensive patterns

Strategy: try-catch

Try / catch

match CurrentUserSid::get() {
    Ok(sid) => { /* proceed */ }
    Err(e) if e.kind() == io::ErrorKind::InvalidData
        && e.to_string().contains("invalid current-user SID") => {
        // token corruption: restart process / alert operator
    }
    Err(e) => return Err(e),
}

Prevention

Run the process under a normal authenticated account without token-manipulation tooling.
Avoid security software or sandboxes that hook token APIs for this process.
Treat this error as environmental: log it with OS/token context for diagnosis.

When it happens

Trigger: Calling any private-path API (e.g. private_temp, private lock acquisition, guarded file creation) on Windows triggers RequiredSids/CurrentUserSid::get(); the error fires only when OpenProcessToken/GetTokenInformation succeeded but IsValidSid rejects the returned TokenUser SID pointer.

Common situations: Corrupted process token state, security-software or token-manipulation tools interfering with the process token, running inside unusual sandboxes/job objects that mangle token information, or OS-level bugs. Extremely rare in normal operation.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/25e90eae63fcb262. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-core/src/platform_fs/windows/acl.rs:181

                token.0,
                TokenUser,
                token_info.as_mut_ptr().cast::<c_void>(),
                length,
                &raw mut length,
            )
        } == 0
        {
            return Err(io::Error::last_os_error());
        }

        let result = Self {
            _token: token,
            token_info,
        };
        // SAFETY: `as_ptr` points into the initialized TOKEN_USER buffer owned
        // by `result`.
        if unsafe { IsValidSid(result.as_ptr()) } == 0 {
            return Err(io::Error::new(
                io::ErrorKind::InvalidData,
                "Windows returned an invalid current-user SID",
            ));
        }
        Ok(result)
    }

    pub(super) fn as_ptr(&self) -> PSID {
        let token_user = self.token_info.as_ptr().cast::<TOKEN_USER>();
        // SAFETY: `token_info` was filled by `GetTokenInformation(TokenUser)`,
        // is aligned as `usize`, and lives for the returned SID pointer.
        unsafe { (*token_user).User.Sid }
    }
}

#[repr(align(4))]
pub(super) struct SidBytes([u8; SECURITY_MAX_SID_SIZE as usize]);

View on GitHub (pinned to affd8760f4)