viyatb-oai 804d6306e8 Allow approved filesystem escalation while preserving denied reads (#49353) ...

## Why

Denied-read policies previously kept explicitly approved commands within their original filesystem restrictions, preventing operations that need broader write access, such as updating Git metadata.

## What changed

- Apply broader filesystem permissions after approval of explicit escalation while retaining the sandbox, denied reads, and network policy. Command allow rules alone do not widen filesystem access.
- Reject escalation when the required local sandbox is unavailable or a remote exec server lacks support for preserving the restrictions.
- Track escalated terminal access so subsequent `write_stdin` calls still require review when stdin approval is enabled.

## Testing

Add coverage for approved and denied escalation, allow rules, remote server compatibility, and stdin approval before input delivery. Add a Windows integration test verifying that an approved `git pull` updates Git metadata while exact-path and glob-based read denials remain enforced. Serialize Windows sandbox integration tests across processes to protect shared test account credentials.

GitOrigin-RevId: 5dce6d41487ee4d39bd795c8d086398ab9794d5b

2026-09-29 19:50:50 +00:00

..

common

Retain confirmed Code Mode messages for Guardian reviews (#48725)

2026-09-27 15:03:38 +00:00

remote_env_windows

Apply remote platform semantics to exec safety checks (#42113)

2026-09-01 18:24:56 +00:00

suite

Allow approved filesystem escalation while preserving denied reads (#49353)

2026-09-29 19:50:50 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

mcp_trace_propagation.rs

Preserve MCP request trace context across transport workers (#47212)

2026-09-22 06:47:07 +00:00

responses_headers.rs

Preserve tool metadata for OpenAI provider endpoint overrides (#48344)

2026-09-26 03:49:14 +00:00