PowerShell and search tools fail on Windows when sandbox fallback requires WRITE_DAC

## Reported behavior

Multiple users reported that sandbox-backed tools stop working on Windows in existing chats and automations. The failure persists across repeated attempts and does not recover during the session.

## Affected tools

- PowerShell and shell execution
- `grep`
- `glob`

## Unaffected tools

- File viewing and editing
- SQL
- Canvases
- MCP tools
- Session tools

A normal shell launched through the terminal canvas works for the same non-elevated user. This suggests that general process execution is available and that the failure is specific to the sandbox-backed tool path.

## Error

```text
backend_unavailable: BaseContainer is unavailable; DACL fallback requires
write-DAC permission on '', which the current user lacks
(ERROR_ACCESS_DENIED (WRITE_DAC not granted)).
```

The affected directory has varied between reports, including an application installation directory and a tools directory.

## Environment

- Windows
- Standard, non-elevated user
- Existing chats and automations
- The affected path is not writable by the current user

## Impact

The agent cannot run builds, commands, or repository searches through its normal tools. Users must route commands through a terminal canvas and poll for completion manually.

This workaround does not provide the same completion signaling. Users may need to ask for status updates or use sentinel files for long-running operations.

## Possible cause

This is an inference from the error, not a confirmed root cause.

The primary `BaseContainer` backend appears to be unavailable. The fallback then attempts a DACL operation that requires `WRITE_DAC` on a protected directory. A standard user does not have that permission, so both execution paths fail.

It is not clear why `BaseContainer` is unavailable or why the fallback needs to modify permissions on that directory.

## Expected behavior

- Shell and search tools work without administrator access.
- The fallback uses a user-writable location or another viable execution strategy.
- Read-only search tools can use a safe degraded path when sandbox execution is unavailable.
- The app reports the degraded state once, with actionable diagnostics, instead of failing every tool call separately.

Bắt đầu bằng cách tái hiện lỗi trên Windows với tư cách người dùng tiêu chuẩn, không có quyền nâng cao, bằng PowerShell, thực thi shell, grep và glob. Theo dõi đường dẫn BaseContainer và cơ chế dự phòng DACL của nó, tập trung vào lỗi WRITE_DAC đã được báo cáo và các thư mục được bảo vệ bị ảnh hưởng. Được xem là hoàn tất khi các công cụ này hoạt động mà không cần quyền quản trị viên hoặc cung cấp một đường dẫn suy giảm an toàn cùng thông tin chẩn đoán có thể hành động khi việc thực thi sandbox không khả dụng.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.