viyatb-oai 5667598c8d Use resolved filesystem permissions in Windows sandbox policies (#59233) ...

## What changed

Use `resolve_for_enforcement` when preparing Windows restricted-token and elevated sandbox overrides, preserving read-only carveouts at volume roots. Expand deny-read ACL targets from the resolved permissions.

Use the same resolution in MXC policy preparation when volume roots do not require materialization, while retaining special handling for symbolic root denies.

## Testing

Add regression coverage for read-only carveouts in a volume-root workspace. Extend the Windows package smoke test to verify that a helper-created log matching a deny glob cannot be read while a neighboring allowed file remains readable.

GitOrigin-RevId: cee0834444464b3a7b0c8dbeecb8abcd5828b4b0

2026-11-03 21:23:50 +00:00

..

availability.rs

Migrate the Windows MXC sandbox to mxc-sdk (#55378)

2026-10-19 20:54:41 +00:00

lib.rs

Migrate the Windows MXC sandbox to mxc-sdk (#55378)

2026-10-19 20:54:41 +00:00

native.rs

Migrate the Windows MXC sandbox to mxc-sdk (#55378)

2026-10-19 20:54:41 +00:00

policy_tests.rs

Create missing parent directories for MXC deny paths on Windows (#58168)

2026-10-29 20:17:58 +00:00

policy.rs

Use resolved filesystem permissions in Windows sandbox policies (#59233)

2026-11-03 21:23:50 +00:00

transport_tests.rs

Preserve Windows startup variables and MXC child environment defaults (#54027)

2026-10-14 16:31:06 +00:00

transport.rs

Preserve Windows startup variables and MXC child environment defaults (#54027)

2026-10-14 16:31:06 +00:00

windows.rs

Exclude unrelated network shares from MXC default reads (#57783)

2026-10-28 16:48:02 +00:00