iceweasel-oai 511262b984 Delegate remote process sandboxing to the executor (#37480) ...

## What changed

- Preserve executor-native working directories, workspace roots, and permission profiles when preparing remote `exec_command` requests instead of resolving them through the host platform.
- Send sandbox intent to the remote executor, including a restricted-token default for Windows executors and `-NoProfile` for elevated PowerShell commands.
- Reject intercepted cross-platform `apply_patch` commands when filesystem writes are restricted, while continuing to allow them for unsandboxed or full-disk-write profiles.

## Testing

Extended remote unified-exec coverage for foreign Windows workspaces, elevated PowerShell, sandbox metadata, and restricted and unrestricted intercepted patches.

GitOrigin-RevId: 9fd328879fa2c15594fd58e40b6b32e8ba0847e7

2026-08-07 18:05:17 +00:00

..

src

Delegate remote process sandboxing to the executor (#37480)

2026-08-07 18:05:17 +00:00

tests

[codex] Migrate apply_patch to executor filesystem (#17027)

2026-04-07 21:20:22 +00:00

BUILD.bazel

[codex] Consolidate shared prompts in codex-prompts (#25151)

2026-06-01 18:45:07 +00:00

Cargo.toml

[codex] migrate ExecutorFileSystem paths to PathUri (#27424)

2026-06-11 18:44:18 +00:00