Dylan Hurd d68b85a097 Require fresh approval beneath denied permission paths (#39266) ...

## Why

A stored permission grant may allow access to a parent while explicitly denying
a child path. A later request for that child must not be treated as already
approved by the broader parent grant.

## What changed

- Compare materialized permission profiles without intersecting away denied or
  reopened paths before deciding that a request is preapproved.
- Execute preapproved commands with the stored grant itself so its denied paths
  remain enforced.
- Fail closed when permission profiles cannot be materialized.

## Testing

Added unit and integration coverage for turn and session grants across
`exec_command`, `shell_command`, and `apply_patch`, including approval-disabled
and `Never` approval modes.

GitOrigin-RevId: 5455880328a89c7958f859c7ce87805dff9704fb

2026-08-18 19:17:09 +00:00

..

src

Require fresh approval beneath denied permission paths (#39266)

2026-08-18 19:17:09 +00:00

BUILD.bazel

build: run buildifier from just fmt (#28125)

2026-06-13 21:43:39 -07:00

Cargo.toml

Support Windows sandboxing in the exec server (#34423)

2026-07-20 22:35:14 +00:00