Windows: sandbox user can't stat ancestors of allowed folders, and placeholder deny targets are left in the caller's cwd #657

Environment: Windows 11 x64, sandbox-runtime 0.0.77, srt-win built from main plus #648.

1. No read-attributes on ancestors of allowed folders

When an allowed folder sits two or more levels under the user profile (e.g. C:\Users\me\code\repo), srt-sandbox can open files inside it but can't stat the folders in between (C:\Users\me\code). Anything that stats each ancestor fails:

• git in a repo there: fatal: failed to stat 'C:\Users\me\code': Permission denied
• Node's JS fs.realpathSync, which lstats every path component: EPERM

Granting it by hand with icacls C:\Users\me\code /grant srt-sandbox:(RA) fixes both. As far as I can tell vendor/srt-win-src/src/acl.rs only stamps ACEs on the granted paths, so nothing gives their ancestors read-attributes.

Ask: grant a non-inheritable FILE_READ_ATTRIBUTES ACE on each ancestor of an allowed path that srt-sandbox can't already stat, and remove it on restore. Read-attributes doesn't expose file contents or directory listings.

2. Placeholder deny targets land in the caller's cwd and stay there

For a deny target that doesn't exist, acl stamp creates a placeholder so it has something to put the deny ACE on (dist/sandbox/windows-sandbox-utils.js around line 950). Relative deny paths resolve against process.cwd() (dist/sandbox/sandbox-utils.js:393 and :397), so denying .git/hooks, .gitconfig and .gitlab-ci.yml leaves an empty .git\hooks folder and two empty files in whatever folder the process started in. They're still there after the session ends.

The empty .git folder is the bigger problem: tools that look for a .git entry treat the folder as a repo, and git then fails with not a git repository.

Ask: remove placeholders that srt-win created when the session restores the ACLs, or let callers opt out of creating them.