deepseek-ai/deepseek-harness · error · AggregateError

AclSandbox init failed and ${cleanupFailures.length} cleanup

Error message

AclSandbox init failed and ${cleanupFailures.length} cleanup operation(s) also failed

What it means

Error "AclSandbox init failed and ${cleanupFailures.length} cleanup operation(s) also failed" thrown in deepseek-ai/deepseek-harness.

Source

Thrown at packages/sandbox/sandbox-windows-acl/src/index.ts:332

        try {
          revokeWrite(api, grant.path, grant.sidPtr)
        } catch (cleanupError) {
          cleanupFailures.push(cleanupError)
        }
      }
      for (const [label, sidPtr] of [['workspace write SID', this.writeSidPtr], ['temp write SID', this.tempWriteSidPtr]] as const) {
        freeSidBestEffort(api, sidPtr, label, cleanupFailures)
      }
      for (const sidPtr of this.sidAllocations.splice(0)) {
        freeSidBestEffort(api, sidPtr, 'init SID allocation', cleanupFailures)
      }
      this.token = undefined
      this.writeSidPtr = undefined
      this.tempWriteSidPtr = undefined
      this.tempDirResolved = undefined
      this.grantedPaths = []
      if (cleanupFailures.length > 0) {
        throw new AggregateError(
          [error, ...cleanupFailures],
          `AclSandbox init failed and ${cleanupFailures.length} cleanup operation(s) also failed`,
        )
      }
      throw error
    }
  }

  /**
   * Spawn a process under the restricted token. Fails closed: throws on every
   * Win32 failure; the child is never created unrestricted. With
   * `stdio: 'inherit'` the child shares the caller's stdio directly and is
   * placed in a kill-on-close job (dies with the caller). Call dispose() only
   * after all children have exited — revoking grants under a live child
   * removes its remaining write allowance.
   * @param options - the program, argv/cwd, and stdio shape.
   * @returns the running child.
   */

View on GitHub (pinned to b150a551b8)

Solutions

1. Fix the root initialization failure first, then inspect the attached cleanup failure causes and remove leftover ACL entries manually.

When it happens

Trigger: Thrown at packages/sandbox/sandbox-windows-acl/src/index.ts:332 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of deepseek-ai/deepseek-harness@b150a551b8 (2026-08-24). Data as JSON: /api/errors/1ca5364a704fc2a9. Report an issue: GitHub.