iceweasel-oai ce254df05a Add canonical permission translation for MXC execution requests (#43853) ...

## What changed

Add `policy::build_request` to `codex-rs/mxc-sandbox` to translate `MxcCommand` permissions into native MXC execution requests. Preserve filesystem denies, read-only carveouts, and protected metadata paths, and resolve overlapping grants using canonical path identities.

Map network permissions to ingress, egress, and loopback policies; quote arguments for Windows process creation; and disable DACL mutation fallback. Reject unsupported symbolic roots and deny globs, empty commands, relative working directories, and non-Unicode request paths.

## Testing

Enable unit tests and add coverage for filesystem grants and carveouts, disabled DACL mutation, deny-glob rejection, relative working directories, and non-Unicode paths.

GitOrigin-RevId: 3e647ed5fa932ab9d528eb44a49dd9283ef50481

2026-09-08 16:38:25 +00:00

..

src

Add canonical permission translation for MXC execution requests (#43853)

2026-09-08 16:38:25 +00:00

BUILD.bazel

…

Cargo.toml

Add canonical permission translation for MXC execution requests (#43853)

2026-09-08 16:38:25 +00:00