From be47fcec0863790b1abe37e224e5a05d2e47530c Mon Sep 17 00:00:00 2001
From: Tianyi Cui <53024+tianyicui@users.noreply.github.com>
Date: Mon, 10 Aug 2026 17:15:16 +0800
Subject: [PATCH] test(sandbox): cover workspace grant cleanup failure

---
 packages/sandbox/sandbox-local/tests/acl-grants.spec.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/packages/sandbox/sandbox-local/tests/acl-grants.spec.ts b/packages/sandbox/sandbox-local/tests/acl-grants.spec.ts
index 3f6c3f2dc3..2de4af3a3d 100644
--- a/packages/sandbox/sandbox-local/tests/acl-grants.spec.ts
+++ b/packages/sandbox/sandbox-local/tests/acl-grants.spec.ts
@@ -215,7 +215,7 @@ describe('windows-acl write grants (LocalSandboxProvider)', () => {
     }
   })
 
-  it('workspace grant failure disposes its SID and never creates a temp directory', async () => {
+  it('workspace grant failure disposes its SID, aggregates cleanup failure, and never creates a temp directory', async () => {
     try {
       const { sandbox } = await setup()
       const ws = workspaceRoot()
@@ -227,6 +227,12 @@ describe('windows-acl write grants (LocalSandboxProvider)', () => {
       })).toThrow('workspace grant exploded')
       expect(mockState.grants).toHaveLength(1)
       expect(mockState.grants[0]!.disposed).toBe(true)
+
+      mockState.disposeFailure = new Error('workspace cleanup exploded')
+      expect(() => sandbox.confine(['true'], {
+        mode: 'workspace-write', workspaceRoot: ws, sessionId: SessionId('workspace-cleanup-fail'),
+      })).toThrow(/workspace grant failed and its cleanup also failed/u)
+      expect(mockState.grants).toHaveLength(2)
     } finally {
       cleanup()
     }