## Why
Executor config reads omitted the startup `features.prefer_mxc` override, so clients could not see the CLI sandbox preference.
## What changed
- Include the explicit CLI `features.prefer_mxc` value in `environmentConfig/read` as a `session-flags` layer, above project config and below legacy managed file and MDM config.
- Retain only this preference from startup overrides.
- Expose `windows_mxc_allowed_by_config` to share MXC eligibility checks after callers resolve the active permission profile.
## Testing
Add CLI and remote executor coverage for preference propagation and filtering, plus a unit test verifying that both legacy managed config sources retain precedence.
GitOrigin-RevId: 5ac6f5257f1e807c2f197dcf5dcb2385cedca0ea
## What changed
Add `resolve_root_git_project_uri_for_trust` to resolve repository trust roots through `ExecutorFileSystem` using executor path conventions. Share repository and linked-worktree validation with native lookup while preserving native ancestry for paths with opaque URI representations.
Extract `ProjectTrustLookup` to match merged project settings using supplied path spellings and an explicit path convention. Preserve canonical-before-original and cwd-before-repository-root precedence, including cwd entries without a trust level, with ASCII case-insensitive matching for Windows.
## Testing
Add coverage for POSIX, Windows drive and UNC trust roots, project-key precedence and case handling, and native/URI lookup parity. Extend environment-config coverage to verify returned `projects` entries include entries without a trust level.
GitOrigin-RevId: 315434802e86cceee85b14bc1c3767a45e3139f5
## What changed
- Report the executor's user home in environment metadata.
- Cache the reported home on selected turn environments and include it in
filesystem sandbox contexts, including `apply_patch` requests.
- Preserve compatibility with executors that do not report a home directory.
## Testing
- Cover local, remote, inherited, serialized, and `apply_patch` sandbox
contexts.
GitOrigin-RevId: ea65e68e33a80bc9bcfc7c53b1486ab944699470
## What changed
- Add `environmentConfigRead` to exec-server environment capabilities and advertise it for local executors.
- Default the capability to `false` when deserializing responses from older executors.
## Testing
- Verify legacy capability responses remain compatible and the environment config integration reports support.
GitOrigin-RevId: c2110fea9e0e6e756eaeaaad096c50a943668c99
## What changed
- Add the `environmentConfig/read` RPC for selecting literal TOML paths from executor-local config and requirements layers.
- Return layer precedence, cloud insertion points, source and base-directory metadata, and executor home and hostname context without normalizing path-bearing values.
- Expose the operation through both remote clients and local `Environment` instances, with invalid selectors reported as invalid parameters.
## Testing
- Cover projected remote config reads and rejection of empty selectors.
GitOrigin-RevId: fee15bf833de6bcb2058d405ed5b1d5d928d7218
zm-oai