zm-oai a482e65b86 Preserve Windows managed deny reads in the sandbox CLI (#42835) ...

## Why

Windows sandbox setup reconciles persistent deny ACLs against the paths supplied for a session. The `codex sandbox --permission-profile` path supplied an empty list, which could discard the profile's deny-read restrictions.

## What changed

Resolve deny-read paths from the selected permission profile and workspace roots before starting a Windows sandbox session, and pass them through to setup.

## Testing

Add a Windows CLI integration test that launches the same managed-deny profile twice and verifies that denied file reads and DLL loads remain blocked while allowed access still works.

GitOrigin-RevId: 6ec8b6a13a33b862d7b152eadbbdde3146de4b7d

2026-09-04 19:40:01 +00:00

..

bin

Preserve Windows managed deny reads in the sandbox CLI (#42835)

2026-09-04 19:40:01 +00:00

conpty

Reuse private desktops across Windows sandbox commands (#40672)

2026-08-25 18:41:03 +00:00

elevated

Keep the Windows sandbox command runner hidden (#42801)

2026-09-04 17:08:18 +00:00

unified_exec

Reuse private desktops across Windows sandbox commands (#40672)

2026-08-25 18:41:03 +00:00

uninstall_windows

Clean up Windows sandbox resources on app uninstall (#42375)

2026-09-02 22:19:51 +00:00

wfp

Enable --deny-warnings for cargo shear (#21616)

2026-05-08 20:29:00 +00:00

acl_tests.rs

Propagate Windows sandbox ACL update failures (#39279)

2026-08-18 20:56:10 +00:00

acl.rs

Propagate Windows sandbox ACL update failures (#39279)

2026-08-18 20:56:10 +00:00

allow.rs

windows-sandbox: pass workspace roots to runner (#24108)

2026-05-28 15:26:55 -07:00

audit.rs

Record Windows world-writable scan telemetry (#40983)

2026-08-26 21:52:56 +00:00

cap.rs

[codex] Scope Windows sandbox write-root capability SIDs (#21479)

2026-05-13 18:28:52 +00:00

deny_read_acl.rs

feat(sandbox): add Windows deny-read parity (#18202)

2026-05-11 23:04:28 -07:00

deny_read_resolver_access_tests.rs

Preserve target-native paths in command approvals (#42577)

2026-09-03 16:21:10 +00:00

deny_read_resolver.rs

Preserve target-native paths in command approvals (#42577)

2026-09-03 16:21:10 +00:00

deny_read_state.rs

feat(sandbox): add Windows deny-read parity (#18202)

2026-05-11 23:04:28 -07:00

deny_read_walker_tests.rs

Improve sandboxing, MCP errors, and cached approvals (#41196)

2026-08-27 20:05:08 +00:00

deny_read_walker.rs

Preserve target-native paths in command approvals (#42577)

2026-09-03 16:21:10 +00:00

desktop_tests.rs

Reuse private desktops across Windows sandbox commands (#40672)

2026-08-25 18:41:03 +00:00

desktop.rs

Reuse private desktops across Windows sandbox commands (#40672)

2026-08-25 18:41:03 +00:00

dpapi.rs

Enable --deny-warnings for cargo shear (#21616)

2026-05-08 20:29:00 +00:00

elevated_impl.rs

Reuse private desktops across Windows sandbox commands (#40672)

2026-08-25 18:41:03 +00:00

env.rs

Enable --deny-warnings for cargo shear (#21616)

2026-05-08 20:29:00 +00:00

file_write_tests.rs

Harden Windows sandbox provisioning file handling (#42342)

2026-09-02 20:03:43 +00:00

file_write.rs

Harden Windows sandbox provisioning file handling (#42342)

2026-09-02 20:03:43 +00:00

framed_io.rs

Add an authenticated Windows sandbox provisioning client (#42337)

2026-09-02 19:33:34 +00:00

helper_materialization.rs

Resolve bundled Windows helpers through bin junctions (#39649)

2026-08-20 07:42:18 +00:00

hide_users.rs

Clean up Windows sandbox resources on app uninstall (#42375)

2026-09-02 22:19:51 +00:00

identity.rs

Clean up Windows sandbox resources on app uninstall (#42375)

2026-09-02 22:19:51 +00:00

lib.rs

Clean up Windows sandbox resources on app uninstall (#42375)

2026-09-02 22:19:51 +00:00

logging.rs

Harden Windows sandbox provisioning file handling (#42342)

2026-09-02 20:03:43 +00:00

no_reparse_dir_tests.rs

Harden Windows sandbox provisioning file handling (#42342)

2026-09-02 20:03:43 +00:00

no_reparse_dir.rs

Harden Windows sandbox provisioning file handling (#42342)

2026-09-02 20:03:43 +00:00

path_normalization.rs

Enable --deny-warnings for cargo shear (#21616)

2026-05-08 20:29:00 +00:00

proc_thread_attr.rs

Terminate Windows process trees with job objects (#34624)

2026-07-21 22:07:09 +00:00

process.rs

Reuse private desktops across Windows sandbox commands (#40672)

2026-08-25 18:41:03 +00:00

provisioning_client.rs

Enable authenticated Windows sandbox provisioning (#42351)

2026-09-02 20:27:05 +00:00

provisioning_protocol.rs

Enable authenticated Windows sandbox provisioning (#42351)

2026-09-02 20:27:05 +00:00

resolved_permissions.rs

Preserve target-native paths in command approvals (#42577)

2026-09-03 16:21:10 +00:00

sandbox_utils.rs

Allow nested Git repositories in the Windows sandbox (#38080)

2026-08-11 22:22:18 +00:00

setup_error.rs

Improve Windows sandbox setup refresh diagnostics (#26471)

2026-06-04 16:52:10 -07:00

setup_launch_tests.rs

Enable authenticated Windows sandbox provisioning (#42351)

2026-09-02 20:27:05 +00:00

setup_launch.rs

Enable authenticated Windows sandbox provisioning (#42351)

2026-09-02 20:27:05 +00:00

setup_mutex.rs

Clean up Windows sandbox resources on app uninstall (#42375)

2026-09-02 22:19:51 +00:00

setup.rs

Enable authenticated Windows sandbox provisioning (#42351)

2026-09-02 20:27:05 +00:00

spawn_prep.rs

fix(windows-sandbox): allow deletion in writable roots (#31138)

2026-07-08 15:05:57 -03:00

ssh_config_dependencies.rs

Filter Windows sandbox roots from SSH config dependencies (#18493)

2026-04-19 14:58:33 -07:00

stdio_bridge_tests.rs

Extract shared Windows sandbox session runner (#28357)

2026-06-15 18:30:48 +00:00

stdio_bridge.rs

Extract shared Windows sandbox session runner (#28357)

2026-06-15 18:30:48 +00:00

token_tests.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00

token.rs

Reuse private desktops across Windows sandbox commands (#40672)

2026-08-25 18:41:03 +00:00

uninstall_windows.rs

Clean up Windows sandbox resources on app uninstall (#42375)

2026-09-02 22:19:51 +00:00

wfp_setup.rs

Clean up Windows sandbox resources on app uninstall (#42375)

2026-09-02 22:19:51 +00:00

wfp.rs

Clean up Windows sandbox resources on app uninstall (#42375)

2026-09-02 22:19:51 +00:00

winutil.rs

Clean up Windows sandbox resources on app uninstall (#42375)

2026-09-02 22:19:51 +00:00

workspace_acl.rs

Add Windows sandbox unified exec runtime support (#15578)

2026-04-21 10:44:49 -07:00

wrapper_tests.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00

wrapper.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00