Reject unpackaged Windows sandbox provisioning clients (#55593)

Remove the exception that allowed clients without a package identity to connect
when the provisioning service had one. Keep the debug foreground-mode exception.

GitOrigin-RevId: def2d22a91575477d73e3d8c6ac14808a2ff3b2b
This commit is contained in:
chess
2026-10-20 14:48:59 +00:00
committed by copyberry
parent 60d78332fc
commit d34f104c22
@@ -71,7 +71,6 @@ pub(crate) fn authorize_client_process(pipe: HANDLE) -> Result<AuthorizedClientP
}
None => bail!("provisioning service has no package identity"),
},
None if service_family.is_some() => {}
#[cfg(debug_assertions)]
None if FOREGROUND_MODE.load(Ordering::Acquire) => {}
None => bail!("provisioning clients must run with an installed Codex package identity"),