viyatb-oai d87330d91e Add managed CA defaults for Deno and Google Cloud SDK (#61349) ...

## What changed

Set `DENO_CERT` and `CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE` to the managed proxy CA bundle when unset, preserving explicit values, including empty strings. Keep these client settings separate from the CA roots imported into the proxy trust bundle.

Preserve shell startup overrides when replaying snapshots, regenerate managed CA defaults instead of capturing them, and allow sandboxed processes to read the managed bundle referenced by these variables.

## Testing

Extend regression coverage for default CA settings, explicit overrides, trust-root selection, shell snapshots, and restricted sandbox access to the generated CA bundle.

GitOrigin-RevId: 2761706b54e0bb230c37bd4c515204c6eba0c650

2026-11-13 18:48:18 +00:00

..

capability_discovery

Cache empty remote skill discovery with filesystem watches (#57598)

2026-10-27 23:53:09 +00:00

common

Propagate authentication header failures before sending requests (#55607)

2026-10-20 15:43:19 +00:00

exec_process

Centralize managed proxy preparation and sandbox routing (#59792)

2026-11-06 02:21:14 +00:00

file_system

Consolidate Windows filesystem helper sandbox preparation (#61276)

2026-11-13 06:39:52 +00:00

relay

Stop Noise relay recovery on rejected executor credentials (#59750)

2026-11-05 22:03:55 +00:00

support

Move relay helpers into exec-server test support (#40712)

2026-08-25 21:31:40 +00:00

unit

Recover deferred environments after provisioning failure (#42388)

2026-09-02 23:49:29 +00:00

accepted_websocket.rs

Propagate authentication header failures before sending requests (#55607)

2026-10-20 15:43:19 +00:00

capabilities_v2.rs

Remove the legacy sandbox policy constructor (#59772)

2026-11-06 00:37:27 +00:00

capability_discovery.rs

Cache empty remote skill discovery with filesystem watches (#57598)

2026-10-27 23:53:09 +00:00

chatgpt_cloudflare_affinity.rs

Enable credential masking for remote exec-server commands (#54309)

2026-10-15 14:41:16 +00:00

deferred_environment.rs

Expose the last accepted environment ready report (#42403)

2026-09-03 01:12:36 +00:00

environment_config.rs

Preserve the CLI MXC preference in executor config reads (#51525)

2026-10-07 00:29:04 +00:00

environment.rs

Preserve remote read compatibility with older executors (#58195)

2026-10-29 23:56:17 +00:00

exec_process.rs

Add managed CA defaults for Deno and Google Cloud SDK (#61349)

2026-11-13 18:48:18 +00:00

file_stream.rs

Add streaming file replacement to filesystem abstractions (#54505)

2026-10-16 04:42:32 +00:00

file_system_unix.rs

Bind final-message output before running sandboxed tools (#58974)

2026-11-02 20:36:39 +00:00

file_system_windows.rs

Remove the legacy sandbox policy constructor (#59772)

2026-11-06 00:37:27 +00:00

forward.rs

Share byte buffers across exec-server output chunks (#49972)

2026-10-01 12:41:39 +00:00

health.rs

Expose a stable executor build identity in environment metadata (#43513)

2026-09-07 16:55:06 +00:00

http_client.rs

Cache executor metadata from initialization (#40343)

2026-08-24 06:43:07 +00:00

http_request_logging.rs

Decouple exec-server HTTP from reqwest types (#35059)

2026-07-24 00:53:05 +00:00

http_request.rs

Protect the guardian decisions API key from environment forwarding (#50019)

2026-10-01 15:57:53 +00:00

initialize.rs

Wire V2 capability discovery through exec-server RPC (#53723)

2026-10-13 17:22:34 +00:00

macos_fs_spawn.rs

Avoid fork when spawning macOS filesystem helpers (#46661)

2026-09-19 15:15:25 +00:00

process.rs

Expose a stable executor build identity in environment metadata (#43513)

2026-09-07 16:55:06 +00:00

relay.rs

Defer environment disconnect notifications until recovery fails (#55401)

2026-10-19 22:55:42 +00:00

selected_capability_roots.rs

Initialize execution environments with the final HTTP policy (#34995)

2026-07-23 19:24:41 +00:00

websocket.rs

Cache empty remote skill discovery with filesystem watches (#57598)

2026-10-27 23:53:09 +00:00