Diagnose Windows sandbox ACL failures

Write every approval request in plain words, in the user's language. The prompt is all the user reads before widening access, so it must stand alone: which folder the script touches, that it adds the signed-in user's full-control entry where a right is missing and removes foreign package entries, that file contents and owners are unchanged, and that the printed recovery command undoes each change. Keep error codes, WRITE_DAC/WRITE_OWNER, S-1-15-2-* SIDs, icacls, ACL, ACE, verdict names and switches out of the request: write Windows file permissions, not ACL or ACE. Ask once, for one command.

One command diagnoses and repairs

The script has no modes. -Path, -AllowRoot and -Out read the path and every ancestor and repair what the observations prove, in the same run:

• directories on that chain that lack effective WRITE_DAC or WRITE_OWNER receive a full-control allow ACE for the signed-in user, because DSH cannot provision its workspace grant without them;
• explicit AppContainer package allow ACEs (S-1-15-2-*, except the well-known groups ending in 1 or 2) are removed at their sources, ancestor first, which also removes those packages' access;
• a directory the sandbox cannot provision — the state its provisioning error reports on the workspace root — or the authorized root itself also has its subtree searched for those ACEs in the same run, so a deeper entry needs no second request. That bounded walk reports truncated and unreadable directories; if truncated, pass the still-failing deeper path once more.

Every change is backed up, then verified by re-reading it. -AllowRoot bounds all of it: an object is changed only when it is that directory or strictly inside it, so a workspace root can repair itself. Never split this into a diagnostic call and a repair call, never ask twice for one repair, and never pass a mode switch that does not exist.

& '<skill-directory>\scripts\diagnose-windows-sandbox-acl.ps1' -Path '<failing-path>' -AllowRoot '<authorized-directory>' -Out '<recovery-directory>'
exit $LASTEXITCODE