zm-oai 5a529c2909 Preserve file permissions during repeated Windows sandbox setup (#60943) ...

## Why

Reapplying directory ACLs during registered sandbox setup can change permissions on existing files moved into the sandbox directory.

## What changed

During `ProvisionOnly` setup for a registered runtime, verify both persistent sandbox directories' ACLs before writing them. Skip both writes when the explicit permissions match the expected policy, allowing additional inherited entries. If verification fails or either policy differs, apply the directory policies as before.

## Testing

Add a regression test that repeats registered setup and verifies that a moved file remains unwritable by the sandbox group while a newly created file inherits write access.

GitOrigin-RevId: fb199001fc554903064618b86562b2ff0d0384c5

2026-11-12 00:28:23 +00:00

..

src

Preserve file permissions during repeated Windows sandbox setup (#60943)

2026-11-12 00:28:23 +00:00

tests

Use cargo_bin in the Windows sandbox manifest test (#56220)

2026-10-22 17:02:32 +00:00

BUILD.bazel

Add Bazel release staging archives (#51850)

2026-10-07 22:11:14 +00:00

build.rs

[codex] Fix Windows sandbox build script lint (#26445)

2026-06-04 13:03:47 -07:00

Cargo.toml

Expand Windows deny-read globs without invoking ripgrep (#59250)

2026-11-03 23:00:54 +00:00

codex-windows-sandbox-setup.manifest

[codex] Restore setup helper UAC manifest (#25949)

2026-06-03 09:21:24 -07:00

sandbox_smoketests.py

Format Python scripts across the repository (#42109)

2026-09-01 17:47:29 +00:00