From 4753e45f9564c9893f97a2d47a8d632c6da07736 Mon Sep 17 00:00:00 2001
From: Huanqi Cao <caohuanqi@deepseek.com>
Date: Sat, 19 Sep 2026 13:54:48 +0800
Subject: [PATCH] test(sandbox): probe cmd's own > NUL redirection

The CI Windows runner reports an empty \0 for a PowerShell-level
'>nul' redirection around the cmd call, and PowerShell's '>nul' opens a file
named nul rather than exercising cmd's redirection. Pass the whole command
to cmd so it parses '>NUL' itself and prove it with cmd's own output.
---
 packages/sandbox/sandbox-windows-acl/tests/runner.spec.ts | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/packages/sandbox/sandbox-windows-acl/tests/runner.spec.ts b/packages/sandbox/sandbox-windows-acl/tests/runner.spec.ts
index 9cf0517661..7632c301c0 100644
--- a/packages/sandbox/sandbox-windows-acl/tests/runner.spec.ts
+++ b/packages/sandbox/sandbox-windows-acl/tests/runner.spec.ts
@@ -507,11 +507,13 @@ describe.skipIf(!isWin32 || !pwshAvailable())('windows-acl runner', () => {
 
   it('NUL writes stay ambient under the Low token in BOTH modes', () => {
     // The device DACL grants Everyone write and carries no higher label, so
-    // the documented `> NUL` redirection must survive the lowered token.
+    // the documented `> NUL` redirection must survive the lowered token. The
+    // redirection stays inside cmd's own command line: PowerShell's `>nul`
+    // opens a file named nul instead, which is a different probe.
     const cmd = join(process.env.SystemRoot ?? 'C:\\Windows', 'System32\\cmd.exe')
     const probe = [
       "$ErrorActionPreference='SilentlyContinue';",
-      `& '${cmd}' /c echo ok>nul 2>&1; 'CMD-NUL: exit=' + $LASTEXITCODE;`,
+      `& '${cmd}' /c 'echo ok>NUL&&echo CMD-NUL: OK';`,
       `& "${process.execPath}" -e "try{require('node:fs').writeFileSync(process.argv[1],'x');console.log('NODE-NUL: OK')}catch(e){console.log('NODE-NUL: DENIED '+e.code)}" '\\\\.\\NUL'`,
     ].join('')
     for (const mode of ['read-only', 'workspace-write'] as const) {
@@ -520,7 +522,7 @@ describe.skipIf(!isWin32 || !pwshAvailable())('windows-acl runner', () => {
         '--', 'pwsh', '/NoLogo', '/NonInteractive', '/NoProfile', '/Command', probe,
       ])
       expect(result.status, `mode: ${mode}\nstderr: ${result.stderr}`).toBe(0)
-      expect(result.stdout, `mode: ${mode}`).toContain('CMD-NUL: exit=0')
+      expect(result.stdout, `mode: ${mode}`).toContain('CMD-NUL: OK')
       expect(result.stdout, `mode: ${mode}`).toContain('NODE-NUL: OK')
     }
   }, 30_000)