Skip to content

fix(sandbox): keep Windows restricted-token SIDs narrow and fail closed on DenyRead #4317

fix(sandbox): keep Windows restricted-token SIDs narrow and fail closed on DenyRead

fix(sandbox): keep Windows restricted-token SIDs narrow and fail closed on DenyRead #4317

Triggered via pull request September 4, 2026 04:06
Status Success
Total duration 11m 3s
Artifacts 1

ci.yml

on: pull_request
Performance Smoke
35s
Performance Smoke
Security & code health
1m 58s
Security & code health
Matrix: smoke
Fit to window
Zoom out
Zoom in

Annotations

24 errors and 5 warnings
Security & code health: internal/providers/factory.go#L116
unreachable func: NewTurnSessionProvider
Security & code health: internal/pathjail/pathjail.go#L130
unreachable func: trimTrailingSeparators
Security & code health: internal/pathjail/pathjail.go#L101
unreachable func: RefuseReparse
Security & code health: internal/pathjail/pathjail.go#L52
unreachable func: Open
Security & code health: internal/mcp/client.go#L81
unreachable func: Connect
Security & code health: internal/cron/store.go#L343
unreachable func: Store.Runs
Security & code health: internal/agenteval/trace.go#L32
unreachable func: MissingTraceEvents
Security & code health: internal/agent/prompt_fingerprint.go#L202
unreachable func: ComputePrefixFingerprint
Security & code health: internal/agent/prompt_fingerprint.go#L31
unreachable func: buildPromptSubstrings
Security & code health: internal/agent/compaction.go#L724
unreachable func: summarizeWithFallback
Smoke (windows-latest)
Process completed with exit code 2.
Smoke (windows-latest): internal/sandbox/windows_acl_apply_windows_test.go#L54
func dirDeniesReadSID is unused (unused)
Smoke (windows-latest): internal/sandbox/windows_acl_apply_windows.go#L398
func windowsPreservedReadDenyAccessEntries is unused (unused)
Smoke (windows-latest): internal/sandbox/windows_acl_apply_windows.go#L277
QF1011: could omit type uint32 from declaration; it will be inferred from the right-hand side (staticcheck)
Smoke (windows-latest): internal/providers/factory.go#L116
unreachable func: NewTurnSessionProvider
Smoke (windows-latest): internal/pathjail/pathjail.go#L130
unreachable func: trimTrailingSeparators
Smoke (windows-latest): internal/pathjail/pathjail.go#L101
unreachable func: RefuseReparse
Smoke (windows-latest): internal/pathjail/pathjail.go#L52
unreachable func: Open
Smoke (windows-latest): internal/mcp/client.go#L81
unreachable func: Connect
Smoke (windows-latest): internal/cron/store.go#L343
unreachable func: Store.Runs
Smoke (windows-latest): internal/agenteval/trace.go#L32
unreachable func: MissingTraceEvents
Smoke (windows-latest): internal/agent/prompt_fingerprint.go#L202
unreachable func: ComputePrefixFingerprint
Smoke (windows-latest): internal/agent/prompt_fingerprint.go#L31
unreachable func: buildPromptSubstrings
Smoke (windows-latest): internal/agent/compaction.go#L724
unreachable func: summarizeWithFallback
Performance Smoke
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Security & code health
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Smoke (macos-latest)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Smoke (ubuntu-latest)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Smoke (windows-latest)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime
Name Size Digest
zero-performance-smoke
679 Bytes
sha256:3f1fd2cd13e8c71c0e0e5402ad711e8628b0b2c28cfd59e0ea0e87d65951f465