iceweasel-oai cb79b3cdf9 Avoid creating metadata paths in the Windows sandbox (#33430) ...

## Why

Elevated Windows sandbox setup could turn the built-in read-only protections
for workspace metadata into deny-write paths, creating metadata directories
that did not already exist.

## What changed

- Track whether filesystem permission entries come from a built-in profile or
  were explicitly configured.
- Exclude generated metadata defaults from direct Windows deny-write overrides
  while continuing to enforce explicit read-only carveouts for the same paths.
- Preserve the distinction while materializing and normalizing permission
  paths, without exposing generated defaults as user configuration.

## Testing

Added Windows coverage confirming that elevated sandbox setup leaves missing
workspace metadata absent and still produces overrides for explicit metadata
carveouts.

GitOrigin-RevId: 701bcb229f631b18ab5ced22f3edf6f303d932f3

2026-07-15 21:19:14 +00:00

..

schema

Add Cursor support to setup import (#33426)

2026-07-15 21:03:49 +00:00

src

Avoid creating metadata paths in the Windows sandbox (#33430)

2026-07-15 21:19:14 +00:00

tests

chore: clean up argument-comment lint and roll out all-target CI on macOS (#16054)

2026-03-27 19:00:44 -07:00

BUILD.bazel

build: run buildifier from just fmt (#28125)

2026-06-13 21:43:39 -07:00

Cargo.toml

core: support extension-owned turn items (#31283)

2026-07-08 03:55:13 +00:00