zm-oai 5228d94a27 Canonicalize Windows sandbox homes and migrate saved junction paths (#60708) ...

## What changed

- Canonicalize home paths before sending sandbox provisioning and desktop registration requests.
- Resolve saved junction paths when restoring the sandbox owner, holding the setup lock and pinning target directories while validating existing sandbox accounts. Skip migration for retiring runtimes.
- Persist the resolved home and clear desktop home ownership so uninstall cannot delete a historical junction's target.

## Testing

Add a Windows junction test verifying that a saved alias resolves to its physical target and an already canonical path needs no migration.

GitOrigin-RevId: 9bac672273694e5a0353fec72a6bcba120e57255

2026-11-11 02:54:40 +00:00

..

bin

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

conpty

Preserve script quotes in Windows sandbox cmd invocations (#60624)

2026-11-10 16:58:06 +00:00

elevated

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

helper_materialization

Refactor Windows sandbox setup and service helpers (#45455)

2026-09-14 16:05:40 +00:00

provisioning_client

Resume Windows sandbox registration refresh after service restarts (#45559)

2026-09-15 00:42:31 +00:00

setup_provisioning

Repair legacy Windows sandbox bin permissions for SYSTEM (#59745)

2026-11-05 21:33:57 +00:00

unified_exec

Use hermetic LLVM for Windows MSVC Bazel builds (#60507)

2026-11-10 03:02:25 +00:00

uninstall_windows

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

wfp

…

acl_tests.rs

Preserve PowerShell relative paths in the elevated Windows sandbox (#49690)

2026-09-30 17:50:58 +00:00

acl.rs

Preserve native errors in Windows sandbox ACL diagnostics (#51896)

2026-10-08 01:12:16 +00:00

allow.rs

Protect .aws directories under sandbox writable roots (#48176)

2026-09-25 19:14:31 +00:00

app_package_tests.rs

Clarify registered Windows sandbox setup errors (#47673)

2026-09-23 21:43:01 +00:00

app_package.rs

Clarify registered Windows sandbox setup errors (#47673)

2026-09-23 21:43:01 +00:00

cap.rs

…

cmd_script_tests.rs

Preserve script quotes in Windows sandbox cmd invocations (#60624)

2026-11-10 16:58:06 +00:00

cmd_script.rs

Preserve script quotes in Windows sandbox cmd invocations (#60624)

2026-11-10 16:58:06 +00:00

deny_read_acl.rs

Register Windows desktop uninstall ownership before sandbox setup (#45224)

2026-09-13 13:06:40 +00:00

deny_read_resolver_access_tests.rs

Expand Windows deny-read globs without invoking ripgrep (#59250)

2026-11-03 23:00:54 +00:00

deny_read_resolver.rs

Expand Windows deny-read globs without invoking ripgrep (#59250)

2026-11-03 23:00:54 +00:00

deny_read_state_tests.rs

Recover malformed Windows deny-read ACL state safely (#50940)

2026-10-04 19:07:36 +00:00

deny_read_state.rs

Recover malformed Windows deny-read ACL state safely (#50940)

2026-10-04 19:07:36 +00:00

desktop_tests.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

desktop.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

dpapi.rs

…

elevated_impl.rs

Always use private desktops for legacy Windows sandboxes (#46554)

2026-09-19 01:21:32 +00:00

env.rs

…

environment_transport_tests.rs

Transport large Windows sandbox launch payloads through the environment (#47919)

2026-09-24 19:15:17 +00:00

environment_transport.rs

Transport large Windows sandbox launch payloads through the environment (#47919)

2026-09-24 19:15:17 +00:00

file_write_tests.rs

Harden Windows sandbox provisioning file handling (#42342)

2026-09-02 20:03:43 +00:00

file_write.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

framed_io.rs

Add an authenticated Windows sandbox provisioning client (#42337)

2026-09-02 19:33:34 +00:00

helper_materialization.rs

Add opt-in registered package execution to the Windows sandbox (#45550)

2026-09-14 23:55:04 +00:00

hide_users.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

identity_integration_tests.rs

Repair rejected Windows sandbox credentials during provisioning (#47695)

2026-09-23 23:33:19 +00:00

identity.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

installation_record.rs

Add service-managed package registration for Windows sandbox accounts (#45542)

2026-09-14 23:24:10 +00:00

launch_environment_tests.rs

Transport large Windows sandbox launch payloads through the environment (#47919)

2026-09-24 19:15:17 +00:00

launch_environment.rs

Transport large Windows sandbox launch payloads through the environment (#47919)

2026-09-24 19:15:17 +00:00

lib.rs

Preserve script quotes in Windows sandbox cmd invocations (#60624)

2026-11-10 16:58:06 +00:00

logging.rs

Add service-managed package registration for Windows sandbox accounts (#45542)

2026-09-14 23:24:10 +00:00

no_reparse_dir_tests.rs

Fix no-reparse directory opens on Windows 10 (#47672)

2026-09-23 21:35:22 +00:00

no_reparse_dir.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

package_identity.rs

Harden and share Windows sandbox identity helpers (#45533)

2026-09-14 22:40:01 +00:00

path_normalization.rs

…

proc_thread_attr.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

process.rs

Align Windows sandbox temp permissions with the child environment (#51512)

2026-10-06 23:21:06 +00:00

provisioning_client_tests.rs

Prefer the provisioning service for automatic Windows sandbox setup (#46239)

2026-09-17 15:35:39 +00:00

provisioning_client.rs

Canonicalize Windows sandbox homes and migrate saved junction paths (#60708)

2026-11-11 02:54:40 +00:00

provisioning_protocol.rs

Add service-managed package registration for Windows sandbox accounts (#45542)

2026-09-14 23:24:10 +00:00

resolved_permissions.rs

Align Windows sandbox temp permissions with the child environment (#51512)

2026-10-06 23:21:06 +00:00

runtime_ownership_tests.rs

Handle disabled Windows sandbox accounts during cleanup (#46333)

2026-09-18 00:36:07 +00:00

runtime_ownership.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

sandbox_utils.rs

Allow nested Git repositories in the Windows sandbox (#38080)

2026-08-11 22:22:18 +00:00

service_diagnostics.rs

Record Windows sandbox service stop diagnostics (#50507)

2026-10-03 03:20:37 +00:00

service_identity_tests.rs

Add service-managed package registration for Windows sandbox accounts (#45542)

2026-09-14 23:24:10 +00:00

service_identity.rs

Add service-managed package registration for Windows sandbox accounts (#45542)

2026-09-14 23:24:10 +00:00

setup_acl_error_tests.rs

Preserve native errors in Windows sandbox ACL diagnostics (#51896)

2026-10-08 01:12:16 +00:00

setup_acl_error.rs

Preserve native errors in Windows sandbox ACL diagnostics (#51896)

2026-10-08 01:12:16 +00:00

setup_error.rs

…

setup_launch_tests.rs

Enable authenticated Windows sandbox provisioning (#42351)

2026-09-02 20:27:05 +00:00

setup_launch.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

setup_mutex.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

setup_provisioning.rs

Repair legacy Windows sandbox bin permissions for SYSTEM (#59745)

2026-11-05 21:33:57 +00:00

setup_refresh_tests.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

setup.rs

Add a CLI command to uninstall the legacy Windows sandbox (#50437)

2026-10-02 21:51:46 +00:00

spawn_prep.rs

Keep Windows sandbox private desktops alive across helper exits (#44658)

2026-09-10 22:17:03 +00:00

ssh_config_dependencies.rs

…

stdio_bridge_tests.rs

Extract shared Windows sandbox session runner (#28357)

2026-06-15 18:30:48 +00:00

stdio_bridge.rs

Extract shared Windows sandbox session runner (#28357)

2026-06-15 18:30:48 +00:00

token_groups_tests.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

token_tests.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

token_user_tests.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

token_user.rs

Harden and share Windows sandbox identity helpers (#45533)

2026-09-14 22:40:01 +00:00

token.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

uninstall_windows.rs

Add a CLI command to uninstall the legacy Windows sandbox (#50437)

2026-10-02 21:51:46 +00:00

wfp_setup.rs

Support managed OpenTelemetry metadata and PEM client identities (#57658)

2026-10-28 06:24:24 +00:00

wfp.rs

Clean up Windows sandbox resources on app uninstall (#42375)

2026-09-02 22:19:51 +00:00

winutil.rs

Preserve script quotes in Windows sandbox cmd invocations (#60624)

2026-11-10 16:58:06 +00:00

workspace_acl.rs

…

wrapper_tests.rs

Transport large Windows sandbox launch payloads through the environment (#47919)

2026-09-24 19:15:17 +00:00

wrapper.rs

Transport large Windows sandbox launch payloads through the environment (#47919)

2026-09-24 19:15:17 +00:00