zm-oai fd59b42a09 Preserve Windows package identity for sandboxed descendants (#46575) ...

## Why

Package context propagation was limited to verified `codex-command-runner.exe` processes, preventing other packaged callers from passing their OS-assigned identity to sandboxed children.

## What changed

Use the current process's OS package identity to decide whether to preserve desktop app context in both regular and ConPTY sandbox launches. Remove executable-name and staged-runner verification from this decision.

Reject callers without package identity when `CODEX_WINDOWS_REGISTERED_CORE=1`; otherwise, unpackaged callers continue without preserving app context.

GitOrigin-RevId: 52eb2fe33c8746d898b5d7ebf53bd001a55b5506

2026-09-19 02:09:46 +00:00

..

src

Preserve Windows package identity for sandboxed descendants (#46575)

2026-09-19 02:09:46 +00:00

tests

Embed the Windows sandbox setup manifest in Bazel builds (#38450)

2026-08-13 23:04:38 +00:00

BUILD.bazel

Run Windows sandbox tests exclusively when local (#46507)

2026-09-18 23:25:49 +00:00

build.rs

[codex] Fix Windows sandbox build script lint (#26445)

2026-06-04 13:03:47 -07:00

Cargo.toml

Harden and share Windows sandbox identity helpers (#45533)

2026-09-14 22:40:01 +00:00

codex-windows-sandbox-setup.manifest

[codex] Restore setup helper UAC manifest (#25949)

2026-06-03 09:21:24 -07:00

sandbox_smoketests.py

Format Python scripts across the repository (#42109)

2026-09-01 17:47:29 +00:00