zm-oai a12c4f4c01 Preserve Windows root reads with deny-read rules (#40441) ...

## What changed

- Detect readable symbolic `:root` entries separately from effective full-disk access so narrower deny-read rules do not disable the Windows sandbox's broad-read setup.
- Add explicit readable roots to that setup while omitting the filesystem root itself, and prevent read roots at or below denied paths from being granted access.

## Testing

- Extend the elevated Windows sandbox integration test to verify that an allowed bundled skill under the user profile remains readable while exact and glob-based secrets stay denied.

GitOrigin-RevId: 8f6f267b78718b9e8609a9205c489f253f478491

2026-08-24 17:29:21 +00:00

..

common

Annotate user input and contextual fragments with content kinds (#40196)

2026-08-23 06:10:44 +00:00

remote_env_windows

Standardize shell execution on unified exec (#39772)

2026-08-20 18:29:35 +00:00

suite

Preserve Windows root reads with deny-read rules (#40441)

2026-08-24 17:29:21 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

responses_headers.rs

Standardize shell execution on unified exec (#39757)

2026-08-20 17:46:05 +00:00