zm-oai a482e65b86 Preserve Windows managed deny reads in the sandbox CLI (#42835) ...

## Why

Windows sandbox setup reconciles persistent deny ACLs against the paths supplied for a session. The `codex sandbox --permission-profile` path supplied an empty list, which could discard the profile's deny-read restrictions.

## What changed

Resolve deny-read paths from the selected permission profile and workspace roots before starting a Windows sandbox session, and pass them through to setup.

## Testing

Add a Windows CLI integration test that launches the same managed-deny profile twice and verifies that denied file reads and DLL loads remain blocked while allowed access still works.

GitOrigin-RevId: 6ec8b6a13a33b862d7b152eadbbdde3146de4b7d

2026-09-04 19:40:01 +00:00

..

e2e_benches

bench: add codex help e2e macrobenchmark (#31295)

2026-07-09 17:23:44 -07:00

src

Preserve Windows managed deny reads in the sandbox CLI (#42835)

2026-09-04 19:40:01 +00:00

tests

Report managed filesystem policy in codex doctor (#42821)

2026-09-04 18:23:10 +00:00

BUILD.bazel

Fix Bazel test configuration for platform-specific data (#35067)

2026-07-24 01:34:56 +00:00

build.rs

Add WebRTC media transport to realtime TUI (#17058)

2026-04-08 10:26:55 -07:00

Cargo.toml

Add direct SigV4 transport to exec-server (#42781)

2026-09-04 14:49:46 +00:00