zm-oai 17cd2834e3 Repair rejected Windows sandbox credentials during provisioning (#47695) ...

## Why

Registered Windows sandbox setup could appear complete even when Windows rejected the stored account passwords. Checking account flags alone did not detect these failures before runtime logon.

## What changed

- Check stored credentials for both offline and online accounts before reusing completed setup during non-refresh provisioning.
- Classify logon failure, expired-password, and password-change-required errors as `SandboxAccountCredentialMismatch`, preserving the underlying Windows error.
- Trigger full setup to rotate credentials only after verifying that recorded account SIDs still match. Propagate credential-file and policy errors without triggering password repair, and skip credential checks for refresh-only requests.

## Testing

Add tests for native error classification, missing credential files, healthy credentials, password failures on either account, policy failures, and rejection of repair when account ownership validation fails.

GitOrigin-RevId: b3aa02f82841dd2605b0c3585ec93144727721e6

2026-09-23 23:33:19 +00:00

..

src

Repair rejected Windows sandbox credentials during provisioning (#47695)

2026-09-23 23:33:19 +00:00

tests

Embed the Windows sandbox setup manifest in Bazel builds (#38450)

2026-08-13 23:04:38 +00:00

BUILD.bazel

Run Windows sandbox tests exclusively when local (#46507)

2026-09-18 23:25:49 +00:00

build.rs

[codex] Fix Windows sandbox build script lint (#26445)

2026-06-04 13:03:47 -07:00

Cargo.toml

Enforce application network policy for AWS auth and telemetry (#47408)

2026-09-23 00:47:34 +00:00

codex-windows-sandbox-setup.manifest

[codex] Restore setup helper UAC manifest (#25949)

2026-06-03 09:21:24 -07:00

sandbox_smoketests.py

Format Python scripts across the repository (#42109)

2026-09-01 17:47:29 +00:00