deepseek-ai/deepseek-harness · error · AggregateError

sandbox-local windows-acl temp grant materialization failed

Error message

sandbox-local windows-acl temp grant materialization failed and its cleanup also failed

What it means

Error "sandbox-local windows-acl temp grant materialization failed and its cleanup also failed" thrown in deepseek-ai/deepseek-harness.

Source

Thrown at packages/sandbox/sandbox-local/src/index.ts:436

    try {
      grant = AclWriteGrant.create(tempSid)
      grant.add(tempDir)
    } catch (error) {
      const cleanupFailures: unknown[] = []
      if (grant !== undefined) {
        try {
          grant.dispose()
        } catch (cleanupError) {
          cleanupFailures.push(cleanupError)
        }
      }
      try {
        this.removeTempDir(tempDir)
      } catch (cleanupError) {
        cleanupFailures.push(cleanupError)
      }
      if (cleanupFailures.length > 0) {
        throw new AggregateError([error, ...cleanupFailures], 'sandbox-local windows-acl temp grant materialization failed and its cleanup also failed')
      }
      throw error
    }
    const capability = { dir: tempDir, writeSid: tempSid, grant }
    this.tempCapabilities.set(key, capability)
    return capability
  }

  /**
   * Dispose every write grant (provider dispose): the revocable temp ACEs
   * are revoked, the private temp directories this provider created are
   * removed, and every SID allocation is freed; the standing workspace ACEs
   * stay (the reuse cache). Cleanup failures are reported, not thrown:
   * cordis teardown must not be aborted by grant cleanup. A crash skips all
   * of it, but a new provider never reuses the residue's random path or SID;
   * OS temp hygiene (or manual removal) eventually reclaims it.
   */
  private revokeAclGrants(): void {

View on GitHub (pinned to b150a551b8)

Solutions

1. Inspect the Windows ACL state manually, remove stale temp grants, and retry.

When it happens

Trigger: Thrown at packages/sandbox/sandbox-local/src/index.ts:436 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of deepseek-ai/deepseek-harness@b150a551b8 (2026-08-24). Data as JSON: /api/errors/c7deb0281446824c. Report an issue: GitHub.