jif c30a3e49c9 Support sandboxed file streaming in exec-server (#38356) ...

## Why

Streaming reads previously rejected requests that used a platform filesystem
sandbox.

## What changed

- Open streamed files in the sandbox helper and return the open file to the
  exec-server by passing a file descriptor on Unix or duplicating a file handle
  on Windows.
- Advertise support through the `sandboxedFileStreaming` environment capability.
- Preserve close-on-exec behavior for transferred descriptors, including the
  required inherited-descriptor cleanup on macOS.

## Testing

- Cover bounded sandboxed streams, continued reads after path replacement, and
  rejection of symlink escapes outside readable roots.

GitOrigin-RevId: 677b2444b74e834b78b87a8554bc119c1c6e08b2

2026-08-13 11:11:26 +00:00

..

src

Support sandboxed file streaming in exec-server (#38356)

2026-08-13 11:11:26 +00:00

BUILD.bazel

protocol: separate app and exec RPC ownership (#29714)

2026-06-23 22:37:31 +00:00

Cargo.toml

Preserve JSON number precision in exec-server RPC messages (#33031)

2026-07-14 10:26:52 +00:00