[bug]: visual-sandbox File vault sandbox-on cannot run on Windows — generated policy (network: none / AppContainer) incompatible with its git-bash demo command; works only as RestrictedToken + msys2_child_ipc + host; deny-read vault/** glob still dropped (#36 incomplete)

[0xReSan]

finsafe version

0.9.44 (Windows 11 Pro, build 26200, NT 10.0.26200.9168)

Platform

• Windows 11 Pro, build 26200
• finsafe probe --json: appcontainer_works=true, helper_installed=false (helper/WFP setup on this machine is tracked separately in [bug]: Windows setup-windows cannot establish helper IPC — finsafe-winhelper named pipe rejects Read/Write connections (PIPE NOT AVAILABLE); WFP never registered; allowlist unusable (persists across reboots, build 26200) #37)

Component

Personal CLI — finsafe visual-sandbox, File vault tab, sandbox-on side (policy generation + demo command generation)

Steps to reproduce

1. finsafe visual-sandbox --port 8787, open http://127.0.0.1:8787.
2. File vault tab → pick the salaries preset → Run comparison.
3. Observe the sandbox-on side.

Expected behavior

The sandbox-on side of File vault should start and demonstrate that reads of vault/* are denied (deny-read rule active) while workspace/* writes are allowed.

Actual behavior

1) The sandbox-on side cannot start

UI error:

The sandbox could not start
This is a configuration problem, not a policy decision — nothing was blocked or allowed.
finsafe failed to start

Running the exact generated policy from a non-elevated shell gives the real error:

finsafe: launching under Windows sandbox (profile=windows-managed, backend=auto, network=none, ...)
finsafe: posture=windows-managed fallback_used=false
finsafe: Windows sandbox launch failed: Windows sandbox launch failed: NetLocalGroupAdd(finsafe-net): 5
Run: finsafe setup-windows

2) Generated policy still drops the deny-read rule

The generated wrapper.yaml (verbatim; temp dir %LOCALAPPDATA%\Temp\finsafe-visual-sandbox-policy-*\wrapper.yaml):

# Generated by FinSAFE visual sandbox from the on-screen controls.
# Every rule below came from a UI control — nothing is hardcoded.
schema_version: 1
kind: local-wrapper
program_mode: short-lived
degrade:
  allow_fallback: false
audit:
  require_policy_digest: true
  require_resolved_posture: true
stdio:
  mode: capture

# Offline: no egress at all.
network: none

resources:
  memory_max: "2G"
  pids_max: "512"
  cpu_max: "100000 100000"
  timeout_ms: 15000

filesystem:
  read_only_paths: []
  read_write_paths:
    - "\\\\?\\C:\\Users\\xuls2\\AppData\\Local\\Temp\\finsafe-visual-sandbox-kit"
  # ignored (no writable root contains it): \\?\C:\Users\xuls2\AppData\Local\Temp\finsafe-visual-sandbox-kit\vault\**

Notes:

• read_only_paths: [] is now correctly emitted (the 0.9.44 fix for the missing field read_only_paths error works).
• But the deny-read glob is still dropped — same # ignored (no writable root contains it) comment as 0.9.42, even though vault\** sits directly under the declared writable root ...\finsafe-visual-sandbox-kit. So even if the sandbox started, the File vault demo would NOT block reads of the sample files. Issue [bug]: visual-sandbox generates invalid wrapper policy — missing filesystem.read_only_paths so the sandbox cannot start; deny-read vault/** silently dropped (Windows) #36's second half (Windows deny-glob containment) is not fixed.

3) The demo command is a git-bash binary, which neither Windows backend can run as generated

The sandbox-off side executes cmd /C 'head -c 4000 '\''vault/HR-Salaries-2026.csv'\''' from the kit working directory. head is an MSYS2/Git-for-Windows binary (C:\Users\xuls2\AppData\Local\hermes\git\usr\bin\head.exe).

Matrix of what happens with the same policy + same command (cmd /C "head -c 200 vault/HR-Salaries-2026.csv", cwd = kit dir):

Configuration	Backend	Result
network: none (as generated)	AppContainer (auto)	launch fails non-elevated: NetLocalGroupAdd(finsafe-net): 5; even elevated, AppContainer is not a git-bash/MSYS path (documented)
network: host, no msys2 flag	RestrictedToken	sandbox starts, then head dies in Cygwin init: *** fatal error - CreateFileMapping S-1-5-21-...-1001.1, Win32 error 5. Terminating. (the #29/#34 class)
network: host + windows.msys2_child_ipc: true	RestrictedToken	WORKS — CSV read successfully, exit 0

The visual-sandbox demo commands are shell/Unix-style (head, etc.) while the generated policy targets network: none → AppContainer, which is fundamentally incompatible with git-bash-derived commands on Windows.

Suggested fix directions

1. Windows scenario config: for File vault (and any scenario whose demo command is git-bash-based), generate a RestrictedToken policy with network: host + windows.msys2_child_ipc: true when running on Windows — reference config below — instead of network: none.
2. Or use native Windows commands for the demo actions (e.g. cmd /c type, PowerShell Get-Content) so the AppContainer / network: none path works without MSYS.
3. Deny-glob containment: fix the Windows containment check so vault\** under a \\?\-prefixed writable root is actually emitted as a deny-read rule (the File vault demo is meaningless without it).

Reference config that works (verified on 0.9.44)

schema_version: 1
kind: local-wrapper
program_mode: short-lived
degrade: { allow_fallback: false }
audit: { require_policy_digest: true, require_resolved_posture: true }
stdio: { mode: capture }
network: host
windows:
  backend: restricted_token
  msys2_child_ipc: true
resources:
  memory_max: "2G"
  pids_max: "512"
  cpu_max: "100000 100000"
  timeout_ms: 15000
filesystem:
  read_only_paths: []
  read_write_paths:
    - "\\\\?\\C:\\Users\\xuls2\\AppData\\Local\\Temp\\finsafe-visual-sandbox-kit"

Run from the kit working directory (C:\Users\xuls2\AppData\Local\Temp\finsafe-visual-sandbox-kit):

finsafe --policy <above>.yaml run -- cmd /c "head -c 200 vault/HR-Salaries-2026.csv"

Verified output (exit 0):

finsafe: launching under Windows sandbox (profile=windows-managed, backend=RestrictedToken, network=host, ...)
finsafe: completed exit_code=Some(0) timed_out=false reason=completed
employee,band,base_salary
A. Chen,VP,412000
B. Okafor,Director,268000

Additional context

• Note that even the working config above does not carry the deny-read vault\** rule (it was dropped by the generator), so the "file vault denies reads" demonstration itself still needs fix AppContainer sandbox blocks directory listing (dir) and file deletion on paths listed in read_write_paths #3 to be meaningful.
• Full generated policy and both error traces are included above; happy to attach the procmon/console captures if useful.
• Related: [bug]: visual-sandbox File vault runs a command with a wrong path — 'demo-kit' does not match created kit dir 'finsafe-visual-sandbox-kit', target file not found (Windows) #35 (command path, fixed/verified), [bug]: visual-sandbox generates invalid wrapper policy — missing filesystem.read_only_paths so the sandbox cannot start; deny-read vault/** silently dropped (Windows) #36 (read_only_paths emitted, deny-glob containment not fixed), [bug]: Windows setup-windows cannot establish helper IPC — finsafe-winhelper named pipe rejects Read/Write connections (PIPE NOT AVAILABLE); WFP never registered; allowlist unusable (persists across reboots, build 26200) #37 (helper/WFP setup failure on this machine — separate root cause).

[Geeksfino]

Automated fix: A pull request is open for this issue.

• PR: Geeksfino/finsafe (branch cursor/fix-visual-sandbox-file-vault-windows-7d0e)
• Status: In review — merge and public release are handled by a separate ship step.
• You will get another comment here when a public release is published.

What changed: The policy generator no longer treats ? in Windows \\?\\ paths as a glob wildcard (that was dropping vault/** deny rules). File vault demo commands on Windows now use native cmd type/echo instead of git-bash head, so the existing network: none AppContainer policy can start and enforce deny-read.

Note: If AppContainer launch still fails with NetLocalGroupAdd(finsafe-net): 5, that is the separate helper/setup issue tracked in #37 — run finsafe setup-windows once from an elevated shell.

[Geeksfino]

Correction: the fix PR is Geeksfino/finsafe#305 — https://github.com/Geeksfino/finsafe/pull/305

[Geeksfino]

Automated dispatch: Cloud agent started for Geeksfino/finsafe.

• Agent: bc-437d50ba-46a7-4910-a77c-67ea2c9b7d0e
• Run: run-a53cccd6-7d16-4270-b7d0-b24f0293296b

A PR will be opened when the agent finishes. Fixes will reference this issue.

[Geeksfino]

Automated review: Fix merged to main.

• PR: Geeksfino/finsafe#305
• Next: Automated release pipeline (issue-ship-release.yml) will run Windows acceptance when required, then publish a public release and comment here again.

[Geeksfino]

Resolved — fix shipped in a public release.

• Version: v0.9.45
• Release: https://github.com/finogeeks/finsafe/releases/tag/v0.9.45
• Merge: Geeksfino/finsafe#305
• Summary: fix(visual-sandbox): File vault Windows deny-glob and native demo commands

Install or upgrade: see the release assets on the link above.