Abhinav 51e3f94b2b Load cloud config for sandbox and remote exec-server commands (#57270) ...

## Why

Sandbox invocations without an explicit permissions profile and remote `exec-server` connections using ChatGPT auth need access to cloud-defined model providers and managed requirements. Cloud bootstrap requests must also respect local application network policy.

## What changed

- Bootstrap sandbox cloud config whenever managed config is included, even without an explicit profile. Skip bootstrap when `--sandbox-state-json` supplies the sandbox state.
- Load cloud config for remote executors beyond workload identity, while skipping forwarders and executors using stdin credentials, AWS SigV4, or agent identity auth. Honor `CODEX_API_KEY` selection so API key connections skip ChatGPT cloud config.
- Apply local application network policy during cloud bootstrap and activate effective application network policy before exec-server clients are created.

## Testing

Add coverage for cloud-defined providers in sandbox and remote exec-server invocations, API key bypass, local policy blocking bundle requests, cloud policy blocking remote registration, and bootstrap exclusions.

GitOrigin-RevId: e8bd6210751e96161f575ade309ebf41bf10f8b5

2026-10-26 21:31:28 +00:00

..

auth_refresh_tests.rs

Load cloud config for sandbox and remote exec-server commands (#57270)

2026-10-26 21:31:28 +00:00

pid_namespace_tests.rs

Reject sandbox-writable bubblewrap executables from PATH (#51211)

2026-10-06 00:58:19 +00:00