Route Windows sandbox proxy traffic by restricting SID (#34613)

## Why

Elevated Windows sandboxes need stable managed-proxy ports while preserving the network policy and environment attribution of each sandboxed process.

## What changed

- Keep shared HTTP and SOCKS5 loopback ingress listeners alive across managed-proxy instances.
- Add a per-route restricting SID to elevated sandbox tokens and dispatch incoming connections to the matching proxy policy after attributing the client process.
- Reject connections without exactly one registered route, remove routes when their proxy handle is dropped, and keep unsandboxed Windows launches off the managed ingress.
- Provision the elevated sandbox with the configured proxy ports and local-binding setting, honoring the selected profile and CLI overrides.

## Testing

- Add Windows unit tests for TCP ownership attribution, route selection, restricting-token propagation, and setup settings.
- Add an end-to-end Windows test covering stable ports, isolated environment policies, HTTP and SOCKS5 routing, and route teardown.

GitOrigin-RevId: 783fac6e0f904dc9bb1955b75d4a5895e8bb9690

codex-rs/exec-server/src/process_sandbox_tests.rs

@@ -231,7 +231,7 @@ async fn native_request_preserves_native_launch_fields() {
 }
 
 #[tokio::test]
-async fn remote_proxy_config_starts_executor_local_proxy() {
+async fn native_request_handles_remote_proxy_config_for_platform() {
     let cwd: AbsolutePathBuf = std::env::current_dir()
         .expect("current directory")
         .try_into()
@@ -261,12 +261,22 @@ async fn remote_proxy_config_starts_executor_local_proxy() {
         ),
     };
     let stale_proxy = "http://127.0.0.1:9".to_string();
-    let env = HashMap::from([("HTTP_PROXY".to_string(), stale_proxy.clone())]);
+    let env = HashMap::from([
+        ("HTTP_PROXY".to_string(), stale_proxy.clone()),
+        ("TEST_ENV".to_string(), "value".to_string()),
+    ]);
 
     let prepared = prepare_exec_request(&params, env, /*runtime_paths*/ None)
         .await
         .expect("prepare request with executor-local proxy");
 
+    if cfg!(target_os = "windows") {
+        assert_eq!(prepared.env.get("HTTP_PROXY"), None);
+        assert_eq!(prepared.env.get("TEST_ENV"), Some(&"value".to_string()));
+        assert!(prepared.network_proxy_handle.is_none());
+        return;
+    }
+
     let http_proxy = prepared.env.get("HTTP_PROXY").expect("HTTP proxy env");
     assert_ne!(http_proxy, &stale_proxy);
     assert!(http_proxy.starts_with("http://127.0.0.1:"));
@@ -297,6 +307,7 @@ async fn remote_proxy_config_starts_executor_local_proxy() {
         .expect("shut down executor proxy");
 }
 
+#[cfg(not(target_os = "windows"))]
 #[tokio::test]
 async fn disabled_remote_proxy_config_is_rejected_before_exporting_ports() {
     let cwd: AbsolutePathBuf = std::env::current_dir()
@@ -350,6 +361,12 @@ async fn managed_network_selects_elevated_windows_spawn() {
         cwd_uri.clone(),
     );
     sandbox.windows_sandbox_level = WindowsSandboxLevel::RestrictedToken;
+    let proxy_config = RemoteNetworkProxyConfig::from_effective_config(&NetworkProxyConfig {
+        enabled: true,
+        enable_socks5: false,
+        ..NetworkProxyConfig::default()
+    })
+    .expect("supported remote proxy config");
     let params = ExecParams {
         process_id: ProcessId::from("process-managed-network"),
         argv: vec!["cmd.exe".to_string(), "/c".to_string(), "exit".to_string()],
@@ -362,21 +379,31 @@ async fn managed_network_selects_elevated_windows_spawn() {
         sandbox: Some(sandbox),
         enforce_managed_network: true,
         managed_network: None,
-        network_proxy: None,
+        network_proxy: Some(RemoteNetworkProxyLaunchConfig::new(proxy_config)),
     };
 
-    let prepared = prepare_exec_request(&params, HashMap::new(), Some(&runtime_paths))
+    let mut prepared = prepare_exec_request(&params, HashMap::new(), Some(&runtime_paths))
         .await
         .expect("prepare sandboxed request");
-    let spawn = prepared
-        .windows_sandbox_spawn_request()
-        .expect("Windows sandbox spawn request");
+    {
+        let spawn = prepared
+            .windows_sandbox_spawn_request()
+            .expect("Windows sandbox spawn request");
 
-    assert_eq!(
-        spawn.windows_sandbox_level,
-        WindowsSandboxLevel::RestrictedToken
-    );
-    assert!(spawn.proxy_enforced);
-    assert_eq!(spawn.permission_profile, &permissions);
-    assert_eq!(spawn.workspace_roots, std::slice::from_ref(&cwd));
+        assert_eq!(
+            spawn.windows_sandbox_level,
+            WindowsSandboxLevel::RestrictedToken
+        );
+        assert!(spawn.proxy_enforced);
+        assert!(spawn.network_proxy_restricting_sid.is_some());
+        assert_eq!(spawn.permission_profile, &permissions);
+        assert_eq!(spawn.workspace_roots, std::slice::from_ref(&cwd));
+    }
+    prepared
+        .network_proxy_handle
+        .take()
+        .expect("running executor proxy")
+        .shutdown()
+        .await
+        .expect("shut down executor proxy");
 }