Windows sandbox: first permission propagation in a large project can exceed other helpers' 60 s lock timeout
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
Research direction
Start with the Windows permission and lock code in win.rs: inspect ensure_project_grant (lines 867-885), revoke_project (887-907), and PermissionLock::acquire (1149-1165), along with the measurements from #103. Determine how to avoid helpers timing out during propagation while preserving crash safety; done when the large-project scenario no longer causes lock-acquisition failures and the error message explains ongoing propagation.
Written by the indexing model from the issue text.
Description
Found in the 2026-10-07 code review (inferred from #103's measurements and the lock scopes; not reproduced).
Problem
ensure_project_grant (win.rs:867-885) spreads FILE_MODIFY across the whole project tree while holding the global Local\PatchSandboxPermissions mutex. PermissionLock::acquire (win.rs:1149-1165) waits only 60 s. Every helper start also takes that lock (recover_abandoned_runs), and so does revoke_project (win.rs:887-907). #103 measured 23.4 s per 100,000 files, so a project of roughly 260,000 files or more exceeds the timeout.
Scenario
- The agent starts
npm run devin the background in a large monorepo. - The tool returns after 3 s while the helper is still propagating.
- The agent's next
run_commandfails after a minute with "cannot acquire sandbox permission lock". - Closing the project during propagation makes all 5 revoke attempts fail, so the grant is kept.
Fix
Hold a per-project lock (a named mutex derived from the capability name) during propagation instead of the global one; the marker file already handles crash safety. Or wait without a limit while the lock holder is alive (WAIT_ABANDONED covers its death). Make the error message say that propagation is in progress.
- Dominant language
- TypeScript
- Stars
- 2
- Forks
- 2
- Avg merge
- 5h 28m
- Merged PRs (30d)
- 24
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PierrunoYT/patch
-
Claude Code chats: tool calls made inside Claude Code subagents leave cards that end as "(stopped)"Openbug priority: low severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
PierrunoYT/patch#289 ·
Maintainers usually reply within 1 day
-
bug priority: medium severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
PierrunoYT/patch#285 ·
Maintainers usually reply within 1 day
-
priority: medium security severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
PierrunoYT/patch#283 ·
Maintainers usually reply within 1 day
-
enhancement priority: medium security severity: medium
Difficulty 5/5 Over a week Newbie friendliness 35/100
PierrunoYT/patch#294 ·
Maintainers usually reply within 1 day
-
priority: low security severity: low
Difficulty 4/5 1-2 days Newbie friendliness 38/100
PierrunoYT/patch#293 ·
Maintainers usually reply within 1 day
All issues in PierrunoYT/patch
Similar issues
-
Difficulty 1/5 1-3 hours Newbie friendliness 70/100
siyuan-note/siyuan#20517 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
NaturalIntelligence/fast-xml-parser#890 · 1 comment ·
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
zsviczian/obsidian-excalidraw-plugin#3000 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
pnpm/get.pnpm.io#68 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
nuxt-modules/better-auth#578 · 2 comments ·
Maintainers usually reply within 1 day