Add native Windows sandbox helper / 添加原生 Windows 沙箱 helper#5937
Merged
SivanCola merged 10 commits intoJul 5, 2026
Conversation
github-actions
Bot
added
v2
SivanCola
force-pushed
the
feature/windows-native-sandbox
branch
5 times, most recently
from
5f027a8 to
95ff5bb
Compare
github-actions
Bot
added
skills
SivanCola
force-pushed
the
feature/windows-native-sandbox
branch
20 times, most recently
from
363620e to
83e737f
Compare
SivanCola
force-pushed
the
feature/windows-native-sandbox
branch
14 times, most recently
from
b89486a to
66f6053
Compare
Update the native Windows sandbox backend to the release that fixes the mutation-based-isolation failure modes: recursive icacls timeout on large workspaces, residual Low integrity labels after cleanup, concurrent runs corrupting each other's ACL boundary, forbid_read deny residue after a crash, forbid_read entries pointing at files being silently unprotected, and PATH-resolved icacls/taskkill. Correct the docs to match the actual Windows boundary: writable low-integrity commands can still write the narrow set of locations Windows leaves writable to any low-integrity process (e.g. AppData\LocalLow) in addition to the configured roots, concurrent commands on a shared workspace are serialized, forbid_read now covers files, and crash residue is swept by the next run.
Pick up the follow-up that pins the per-root lock to one OS thread, so a Go goroutine migrating threads cannot release a Windows mutex from a non-owning thread or re-enter it within the process. Cross-process serialization (each sandboxed command is its own helper process) was already correct; this tightens the within-process semantics the library's unit tests cover.
Picks up two upstream fixes: exe-dir contention coverage with the close of the deny-residue window (2a86cf8, 0e09612), and the follow-up that stops grantAppContainerExecutable from snapshotting, granting, or recording crash-residue on system directories (1a3e77e) — previously a crashed elevated run could leave a residue marker that made the next run strip built-in package SIDs from System32 / Program Files ACLs.
SivanCola
force-pushed
the
feature/windows-native-sandbox
branch
from
e79ad5e to
39bfc0b
Compare
Picks up the follow-up (3058fd1) that re-checks the system-root invariant at sweep time: the crash-residue marker lives in the user's %TEMP% and is untrusted, so a legacy or planted line naming System32 / Program Files could previously drive the next run's sweep to strip the broad built-in package SIDs from a system directory's factory ACLs. The sweep now refuses system paths independently of the recorder-side filter.
Picks up b79e9a5: the crash-residue marker is keyed by PID alone, so a helper process that drew a crashed predecessor's PID used to skip the stale marker in its run-start sweep (pid == self), append its own lines into the same file, and then delete the whole file on exit — orphaning the predecessor's forbid_read deny or tool-directory grant beyond any future sweep's reach. The library now tracks marker ownership in-process: cleanup only deletes a marker this process wrote, and an unowned file at the run's own PID is consumed at run start as a dead predecessor's residue. The filename stays <pid>.txt so older binaries sharing the marker directory keep parsing PIDs correctly during upgrade windows.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cache-impact: none - changes do not alter provider-visible prompts, tool schemas, ordering, or request serialization; the builtin touch is test-only.
Cache-guard: REASONIX_RELEASE_CACHE_GUARD=1 go test -p 4 -timeout=3m ./... plus existing cache-impact CI check.
Verification