@@ -8,7 +8,7 @@
  * current user — matching the 0600 intent.
  */
 
-import { execFileSync } from "child_process";
+import childProcess from "child_process";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
@@ -37,7 +37,7 @@ export function windowsIdentity(): string | null {
     return `${USERDOMAIN}\\${USERNAME}`;
   }
   try {
-    const stdout = execFileSync("whoami", {
+    const stdout = childProcess.execFileSync("whoami", {
       encoding: "utf8",
       timeout: 5000,
       windowsHide: true,
@@ -53,12 +53,19 @@ export function windowsIdentity(): string | null {
 /**
  * Restrict an NTFS path to the current user (Windows only; no-op elsewhere).
  *
- * Two idempotent steps:
- *  1. ``icacls /inheritance:r`` removes inherited ACEs so a permissive parent
+ * Two idempotent steps, ordered fail-safe — grant before strip:
+ *  1. ``icacls /grant:r`` grants the current user exclusive full control
+ *     (``:r`` replaces, does not append).  For a directory the grant carries
+ *     ``(OI)(CI)`` so it is inherited by existing and future children.
+ *  2. ``icacls /inheritance:r`` removes inherited ACEs so a permissive parent
  *     (e.g. the profile root granting ``Authenticated Users``) no longer
- *     applies.
- *  2. ``icacls /grant:r <user>:F`` grants the current user exclusive full
- *     control (``:r`` replaces, does not append).
+ *     applies.  For a directory this propagates to children, which is why the
+ *     grant above must already name this user.
+ *
+ * The order matters: if the grant is issued first and fails, the inherited
+ * ACEs are still in place and the path stays usable.  Stripping first can
+ * leave the path (and, via inheritance, its children) with no ACE at all — the
+ * next open then throws ``EPERM`` and the state file becomes unreachable.
  *
  * Returns whether the ACL now grants the current user alone.  Failures are
  * reported, never thrown: callers decide whether an unprotected path is
@@ -67,28 +74,37 @@ export function windowsIdentity(): string | null {
  * and leave the ACL untouched, which is how this helper silently no-opped
  * before.
  */
-export function restrictWindowsAcl(targetPath: string): boolean {
+export function restrictWindowsAcl(targetPath: string, isDirectory = false): boolean {
   if (process.platform !== "win32") {
     return true;
   }
   const identity = windowsIdentity();
   if (!identity) {
     return false;
   }
-  for (const args of [
-    [targetPath, "/inheritance:r"],
-    [targetPath, "/grant:r", `${identity}:F`],
-  ]) {
+  const grantee = isDirectory ? `${identity}:(OI)(CI)F` : `${identity}:F`;
+  const runIcacls = (args: string[]): boolean => {
     try {
-      execFileSync("icacls", args, {
+      childProcess.execFileSync("icacls", args, {
         encoding: "utf8",
         timeout: 15000,
         windowsHide: true,
         stdio: ["ignore", "pipe", "ignore"],
       });
+      return true;
     } catch {
       return false; // best-effort: keep the caller moving, but do not pretend
     }
+  };
+  // Grant first: if this fails the inherited ACEs are still in place, so the
+  // path stays usable.  Stripping first could leave a path with no ACE at all.
+  if (!runIcacls([targetPath, "/grant:r", grantee])) {
+    return false;
+  }
+  // Then drop the inherited ACEs.  For a directory this propagates to
+  // children, which is why the grant above must already name this user.
+  if (!runIcacls([targetPath, "/inheritance:r"])) {
+    return false;
   }
   return true;
 }
@@ -97,8 +113,8 @@ export function restrictWindowsAcl(targetPath: string): boolean {
  * Write a private file with user-only permissions on every platform.
  *
  * - POSIX: mode 0600 (applied by the write itself, subject to umask).
- * - Windows: mode bits are ignored by the OS, so we remove inherited ACEs
- *   and grant the current user exclusive full control.
+ * - Windows: mode bits are ignored by the OS, so we grant the current user
+ *   exclusive full control first and then remove inherited ACEs.
  *
  * Returns true when the platform's permission model was applied as requested.
  */
@@ -113,7 +129,7 @@ export function writePrivateFile(targetPath: string, contents: string): boolean
  */
 export function ensurePrivateDirectory(dirPath: string): boolean {
   fs.mkdirSync(dirPath, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
-  return process.platform === "win32" ? restrictWindowsAcl(dirPath) : true;
+  return process.platform === "win32" ? restrictWindowsAcl(dirPath, true) : true;
 }
 
 /** Home directory used for DeepCode user state. */
 
@@ -1,13 +1,14 @@
-import { afterEach, describe, it } from "node:test";
+import { afterEach, describe, it, type TestContext } from "node:test";
 import assert from "node:assert/strict";
-import { execFileSync } from "child_process";
+import childProcess from "child_process";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import {
   PRIVATE_FILE_MODE,
   PRIVATE_DIRECTORY_MODE,
   ensurePrivateDirectory,
+  restrictWindowsAcl,
   windowsIdentity,
   writePrivateFile,
 } from "../common/private-storage";
@@ -26,6 +27,42 @@ afterEach(() => {
   }
 });
 
+/**
+ * Pretend to be Windows and record every execFileSync call.  The platform
+ * property is patched so these regression tests run on every OS upstream CI
+ * uses — the icacls ordering bug is Windows-only and would otherwise get zero
+ * coverage off-Windows.  ``restore()`` puts platform/env back; the mock itself
+ * is unwound by node:test at test end.
+ */
+function pretendWindows(
+  t: TestContext,
+  impl: (cmd: string, args: string[]) => string
+): { calls: string[][]; restore: () => void } {
+  const platformDesc = Object.getOwnPropertyDescriptor(process, "platform");
+  Object.defineProperty(process, "platform", { value: "win32", configurable: true });
+  const prevDomain = process.env.USERDOMAIN;
+  const prevUser = process.env.USERNAME;
+  process.env.USERDOMAIN = "TESTDOM";
+  process.env.USERNAME = "testuser";
+  const calls: string[][] = [];
+  t.mock.method(childProcess, "execFileSync", (cmd: string, args: string[] = []) => {
+    calls.push([cmd, ...args]);
+    return impl(cmd, args);
+  });
+  return {
+    calls,
+    restore: () => {
+      if (platformDesc) {
+        Object.defineProperty(process, "platform", platformDesc);
+      }
+      if (prevDomain === undefined) delete process.env.USERDOMAIN;
+      else process.env.USERDOMAIN = prevDomain;
+      if (prevUser === undefined) delete process.env.USERNAME;
+      else process.env.USERNAME = prevUser;
+    },
+  };
+}
+
 describe("private-storage", () => {
   it("writes files with 0600 mode on POSIX", () => {
     if (process.platform === "win32") {
@@ -65,7 +102,7 @@ describe("private-storage", () => {
       return;
     }
 
-    const out = execFileSync("icacls", [file], {
+    const out = childProcess.execFileSync("icacls", [file], {
       encoding: "utf8",
       windowsHide: true,
     });
@@ -97,4 +134,68 @@ describe("private-storage", () => {
     assert.equal(fs.readFileSync(file, "utf8"), "2", "last write must win");
     assert.equal(second, first, "repeated writes must report the same outcome");
   });
+
+  it("grants the user before stripping inheritance (fail-safe order)", (t) => {
+    // Regression: when the strip ran first, a failed grant left the path with
+    // no ACE at all and the next write threw EPERM (errno -4048).
+    const { calls, restore } = pretendWindows(t, () => "");
+    try {
+      assert.equal(restrictWindowsAcl("C:\\state\\settings.json"), true, "clean run must report success");
+    } finally {
+      restore();
+    }
+    assert.deepEqual(
+      calls.map((args) => args.slice(1)),
+      [
+        ["C:\\state\\settings.json", "/grant:r", "TESTDOM\\testuser:F"],
+        ["C:\\state\\settings.json", "/inheritance:r"],
+      ],
+      "the grant must be issued before the inheritance strip"
+    );
+  });
+
+  it("keeps the inherited ACEs when the grant fails (no lockout)", (t) => {
+    const { calls, restore } = pretendWindows(t, (_cmd, args) => {
+      if (args.includes("/grant:r")) {
+        throw Object.assign(new Error("icacls: Access is denied."), { status: 5 });
+      }
+      return "";
+    });
+    try {
+      assert.equal(restrictWindowsAcl("C:\\state\\settings.json"), false, "a failed grant must report failure");
+    } finally {
+      restore();
+    }
+    // Negative control: stripping after a failed grant is the lockout.  The
+    // inherited ACEs must stay untouched so the path remains usable.
+    assert.ok(
+      calls.some((args) => args.includes("/grant:r")),
+      "the grant must have been attempted"
+    );
+    assert.ok(
+      calls.every((args) => !args.includes("/inheritance:r")),
+      `inheritance must not be stripped after a failed grant: ${JSON.stringify(calls)}`
+    );
+  });
+
+  it("directory grants are inheritable so children keep access", (t) => {
+    // Root cause companion: /inheritance:r on a directory propagates to its
+    // children, so the grant must already reach them ((OI)(CI)) or the state
+    // files inside become unopenable.
+    const { calls, restore } = pretendWindows(t, () => "");
+    const dir = tempDir("dc-priv-dir-acl-");
+    try {
+      assert.equal(ensurePrivateDirectory(path.join(dir, "deep")), true, "directory must report success");
+    } finally {
+      restore();
+    }
+    assert.deepEqual(
+      calls.map((args) => args.slice(1)),
+      [
+        [path.join(dir, "deep"), "/grant:r", "TESTDOM\\testuser:(OI)(CI)F"],
+        [path.join(dir, "deep"), "/inheritance:r"],
+      ],
+      "directory grants must be inheritable and come first"
+    );
+  });
 });