iceweasel-oai 34db7e5563 Sandbox remote apply_patch operations (#38043) ...

## Why

Cross-platform remote `apply_patch` calls were rejected when filesystem writes
were restricted because patch verification and writes could not be safely
performed against executor files.

## What changed

- Route intercepted and direct remote patches through the executor-managed
  filesystem sandbox, including the configured workspace roots.
- Select the restricted-token sandbox for Windows executor paths when no
  Windows sandbox level was configured.
- Fail closed when an executor cannot enforce the requested sandbox, and treat
  executor-managed access failures as sandbox denials so approval can retry the
  patch without sandboxing.

## Testing

- Cover sandboxed remote patches, denied writes, approval retries, Windows
  sandbox selection, and executor filesystem enforcement.

GitOrigin-RevId: caddeed0b266c456a689080a14a3a58e2bd7887c

2026-08-11 17:47:22 +00:00

..

common

Add executor-local config reads to the exec server (#37408)

2026-08-07 08:32:30 +00:00

file_system

Sandbox remote apply_patch operations (#38043)

2026-08-11 17:47:22 +00:00

relay

Test exec-server compatibility across Codex versions (#35990)

2026-07-29 16:30:23 +00:00

support

Initialize execution environments with the final HTTP policy (#34995)

2026-07-23 19:24:41 +00:00

capability_discovery.rs

Respect filesystem permissions during capability discovery (#36124)

2026-07-30 10:01:06 +00:00

chatgpt_cloudflare_affinity.rs

Add opt-in concurrent exec-server request dispatch (#36987)

2026-08-04 22:28:15 +00:00

deferred_environment.rs

Consolidate deferred environment provisioning APIs (#37340)

2026-08-07 00:32:59 +00:00

environment_config.rs

Advertise environment config read support (#37654)

2026-08-09 03:05:10 +00:00

environment.rs

Route exec-server WebSockets through configured proxies (#35056)

2026-07-24 00:16:42 +00:00

exec_process.rs

Terminate Windows non-TTY processes on interrupt (#35655)

2026-07-27 18:37:11 +00:00

file_stream.rs

Route exec-server WebSockets through configured proxies (#35056)

2026-07-24 00:16:42 +00:00

file_system_unix.rs

Add opt-in concurrent exec-server request dispatch (#36987)

2026-08-04 22:28:15 +00:00

file_system_windows.rs

path-uri: clarify host-native path conversion (#29501)

2026-06-23 00:02:33 +00:00

health.rs

Decouple exec-server HTTP from reqwest types (#35059)

2026-07-24 00:53:05 +00:00

http_client.rs

Route exec-server WebSockets through configured proxies (#35056)

2026-07-24 00:16:42 +00:00

http_request_logging.rs

Decouple exec-server HTTP from reqwest types (#35059)

2026-07-24 00:53:05 +00:00

http_request.rs

Add opt-in concurrent exec-server request dispatch (#36987)

2026-08-04 22:28:15 +00:00

initialize.rs

Add opt-in concurrent exec-server request dispatch (#36987)

2026-08-04 22:28:15 +00:00

process.rs

Report temporary directories in exec-server environment info (#37479)

2026-08-07 17:54:41 +00:00

relay.rs

Test remote environments reported ready before selection (#37156)

2026-08-05 20:39:11 +00:00

selected_capability_roots.rs

Initialize execution environments with the final HTTP policy (#34995)

2026-07-23 19:24:41 +00:00

websocket.rs

[codex] Trace exec-server JSON-RPC requests (#27466)

2026-06-24 12:50:18 -07:00