From ba63251c48cb1ade938d46b8ab089325c44c89bc Mon Sep 17 00:00:00 2001
From: Tianyi Cui <53024+tianyicui@users.noreply.github.com>
Date: Mon, 10 Aug 2026 17:56:38 +0800
Subject: [PATCH] fix(sandbox): clear failed ACL temp state

---
 packages/sandbox/sandbox-windows-acl/src/index.ts        | 1 +
 packages/sandbox/sandbox-windows-acl/tests/probe.spec.ts | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/packages/sandbox/sandbox-windows-acl/src/index.ts b/packages/sandbox/sandbox-windows-acl/src/index.ts
index e074e055de..fce54583d2 100644
--- a/packages/sandbox/sandbox-windows-acl/src/index.ts
+++ b/packages/sandbox/sandbox-windows-acl/src/index.ts
@@ -324,6 +324,7 @@ export class AclSandbox {
       this.token = undefined
       this.writeSidPtr = undefined
       this.tempWriteSidPtr = undefined
+      this.tempDirResolved = undefined
       this.grantedPaths = []
       if (cleanupFailures.length > 0) {
         throw new AggregateError(
diff --git a/packages/sandbox/sandbox-windows-acl/tests/probe.spec.ts b/packages/sandbox/sandbox-windows-acl/tests/probe.spec.ts
index 8d20c4ab32..117052da1c 100644
--- a/packages/sandbox/sandbox-windows-acl/tests/probe.spec.ts
+++ b/packages/sandbox/sandbox-windows-acl/tests/probe.spec.ts
@@ -98,4 +98,13 @@ describe.skipIf(!isWin32 || !pwshAvailable())('AclSandbox write restriction', ()
     const broken = new AclSandbox({ writableDirs: [writableDir], tempDir: null, writeSid: 'S-1-4-abc-1', mode: 'workspace-write' })
     await expect(broken.init()).rejects.toThrow(/ConvertStringSidToSidW/u)
   }, 15_000)
+
+  it('failed init clears provisional temp state before a retry', async () => {
+    const broken = new AclSandbox({ writableDirs: [writableDir], tempDir: null, writeSid: 'S-1-4-abc-1', mode: 'workspace-write' })
+    const provisionalState = broken as unknown as { tempDirResolved: string | undefined }
+    provisionalState.tempDirResolved = isolatedTemp
+
+    await expect(broken.init()).rejects.toThrow(/ConvertStringSidToSidW/u)
+    expect(broken.tempDir).toBeUndefined()
+  }, 15_000)
 })