viyatb-oai 5045589550 Consolidate Windows filesystem helper sandbox preparation (#61276) ...

## What changed

Remove `SandboxDirectSpawnTransformRequest` and `transform_for_direct_spawn` in favor of `SandboxManager::for_file_system_helpers().transform()`. Keep Windows wrapper preparation specific to filesystem helpers, and return `SandboxUnavailable` when a Windows token sandbox is requested for a filesystem helper on a non-Windows executor.

Record the helper permission entry count during launch policy preparation, before adding runtime read grants.

## Testing

Cover Windows helper executable read access and explicit workspace write grants, including empty workspace roots. Verify rejection of non-native policy working directories and Windows token helper sandboxes on Unix. Extend the helper isolation test to exercise sandboxed writes as well as reads.

GitOrigin-RevId: f95bb94e12d8d7c6e5c773644abb7b59b47ffc4a

2026-11-13 06:39:52 +00:00

..

shared.rs

Consolidate Windows filesystem helper sandbox preparation (#61276)

2026-11-13 06:39:52 +00:00

support.rs

Allow exec-server to proxy permitted private IPs upstream (#48568)

2026-09-26 23:17:41 +00:00