viyatb-oai f7aad26f1d Defer exec-server sandbox preparation to the execution host (#60663) ...

## Why

Remote commands can use workspace paths from a different operating system. Preparing them on the client should preserve those paths and command arguments for the execution host.

## What changed

- Build exec-server requests directly, carrying the native command and sandbox context without applying the client's sandbox transform.
- Resolve workspace permissions and runtime read access in `SandboxManager` on the execution host, including helper binaries and validated managed-network CA bundles.
- Add explicit backend selection and required platform sandbox selection, rejecting launches when the required sandbox is unavailable.

## Testing

Extend request tests to cover foreign workspace paths, Unicode arguments, and empty arguments. Extend the remote process test on Unix to verify that restricted reads allow the sandbox helper and validated CA bundle while denying an untrusted certificate file.

GitOrigin-RevId: 5fc02ac4208912ecefb80a212742389afc14ac05

2026-11-10 21:26:11 +00:00

..

src

Defer exec-server sandbox preparation to the execution host (#60663)

2026-11-10 21:26:11 +00:00

BUILD.bazel

Rename the read-only Seatbelt platform defaults policy (#41449)

2026-08-29 02:49:33 +00:00

Cargo.toml

Use descriptor-safe helpers for executable test fixtures (#50018)

2026-10-01 15:57:03 +00:00