viyatb-oai a6ed292aa3 Centralize managed proxy preparation and sandbox routing (#59792) ...

## What changed

Move proxy configuration and routing selection into `prepare_managed_network`. Keep native Windows launches direct by stripping managed proxy variables before credential brokering, and select dedicated listeners only for Windows MXC launches.

Consolidate managed network context filtering in `SandboxManager` and simplify proxy preparation for Linux and MXC while preserving the macOS Seatbelt context.

## Testing

Add Windows regression coverage for native launches with both disabled and enabled proxy configurations, verifying that managed proxy variables are removed while caller environment values and API credentials are preserved.

GitOrigin-RevId: 29fe1fb02afb574b4108032b7e8028d19d8270b4

2026-11-06 02:21:14 +00:00

..

capability_discovery

Cache empty remote skill discovery with filesystem watches (#57598)

2026-10-27 23:53:09 +00:00

common

Propagate authentication header failures before sending requests (#55607)

2026-10-20 15:43:19 +00:00

exec_process

Centralize managed proxy preparation and sandbox routing (#59792)

2026-11-06 02:21:14 +00:00

file_system

Preserve remote read compatibility with older executors (#58195)

2026-10-29 23:56:17 +00:00

relay

Stop Noise relay recovery on rejected executor credentials (#59750)

2026-11-05 22:03:55 +00:00

support

Move relay helpers into exec-server test support (#40712)

2026-08-25 21:31:40 +00:00

unit

Recover deferred environments after provisioning failure (#42388)

2026-09-02 23:49:29 +00:00

accepted_websocket.rs

Propagate authentication header failures before sending requests (#55607)

2026-10-20 15:43:19 +00:00

capabilities_v2.rs

Remove the legacy sandbox policy constructor (#59772)

2026-11-06 00:37:27 +00:00

capability_discovery.rs

Cache empty remote skill discovery with filesystem watches (#57598)

2026-10-27 23:53:09 +00:00

chatgpt_cloudflare_affinity.rs

Enable credential masking for remote exec-server commands (#54309)

2026-10-15 14:41:16 +00:00

deferred_environment.rs

Expose the last accepted environment ready report (#42403)

2026-09-03 01:12:36 +00:00

environment_config.rs

Preserve the CLI MXC preference in executor config reads (#51525)

2026-10-07 00:29:04 +00:00

environment.rs

Preserve remote read compatibility with older executors (#58195)

2026-10-29 23:56:17 +00:00

exec_process.rs

Remove the legacy sandbox policy constructor (#59772)

2026-11-06 00:37:27 +00:00

file_stream.rs

Add streaming file replacement to filesystem abstractions (#54505)

2026-10-16 04:42:32 +00:00

file_system_unix.rs

Bind final-message output before running sandboxed tools (#58974)

2026-11-02 20:36:39 +00:00

file_system_windows.rs

Remove the legacy sandbox policy constructor (#59772)

2026-11-06 00:37:27 +00:00

forward.rs

Share byte buffers across exec-server output chunks (#49972)

2026-10-01 12:41:39 +00:00

health.rs

Expose a stable executor build identity in environment metadata (#43513)

2026-09-07 16:55:06 +00:00

http_client.rs

Cache executor metadata from initialization (#40343)

2026-08-24 06:43:07 +00:00

http_request_logging.rs

Decouple exec-server HTTP from reqwest types (#35059)

2026-07-24 00:53:05 +00:00

http_request.rs

Protect the guardian decisions API key from environment forwarding (#50019)

2026-10-01 15:57:53 +00:00

initialize.rs

Wire V2 capability discovery through exec-server RPC (#53723)

2026-10-13 17:22:34 +00:00

macos_fs_spawn.rs

Avoid fork when spawning macOS filesystem helpers (#46661)

2026-09-19 15:15:25 +00:00

process.rs

Expose a stable executor build identity in environment metadata (#43513)

2026-09-07 16:55:06 +00:00

relay.rs

Defer environment disconnect notifications until recovery fails (#55401)

2026-10-19 22:55:42 +00:00

selected_capability_roots.rs

Initialize execution environments with the final HTTP policy (#34995)

2026-07-23 19:24:41 +00:00

websocket.rs

Cache empty remote skill discovery with filesystem watches (#57598)

2026-10-27 23:53:09 +00:00