Merge remote-tracking branch 'origin/master' into worktree/windows-acl-hardening-followup

# Conflicts: # packages/sandbox/sandbox-windows-acl/src/index.ts
2026-08-10 21:50:09 +08:00
parent 138d513a9a cd226191a8
commit f5b12d12d4
111 changed files with 2325 additions and 375 deletions
@@ -408,6 +408,8 @@ export class AclSandbox {
      freeSidBestEffort(api, sidPtr, label, failures)
    }
    const token = this.token
+    /* v8 ignore next -- init assigns this.api only after this.token, so an initialized instance always
+       has its token; the guard mirrors the write-SID guard. */
    if (token !== undefined) {
      try {
        if (api.closeHandle(token) === 0) throwLastError(api, 'CloseHandle', 'restricted token')