iceweasel-oai 2a32e7c963 Expand Linux sandbox deny globs in process (#59711) ...

## What changed

Replace external `rg` scans and the fallback walker with an in-process `ignore` walker for bubblewrap deny-glob expansion. Remove scanner lookup and dependency tracking from sandbox integrity checks.

Include hidden and ignored files, respect scan depth limits, and fail closed on traversal errors. Anchor patterns to their static search roots and preserve literal leading `#`, leading `!`, trailing spaces, and unclosed character classes. Follow explicit symlink roots while skipping child symlinks, and mask canonical targets of matched paths.

## Testing

Extend unit and sandbox integration coverage for glob syntax, depth limits, traversal failures, symlink handling, commands launched from `/`, and operation without executing `rg`.

GitOrigin-RevId: 1767d7f37acb149457642bf24ee5971a28696438

2026-11-05 17:56:59 +00:00

..

suite

Expand Linux sandbox deny globs in process (#59711)

2026-11-05 17:56:59 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00