viyatb-oai 9a7213ca37 Resolve workspace permissions at the sandbox launch boundary (#59530) ...

## What changed

Add optional executor workspace roots to `SandboxTransformRequest` and resolve symbolic workspace rules after merging additional permissions. Preserve explicit deny rules and treat an empty root list as granting no workspace access.

Route Windows restricted-token preparation through the shared transform path and use explicit roots when building its direct-spawn wrapper. Update Windows MXC debug launches to bind configured roots before adding the managed CA read grant.

## Testing

Extend sandbox manager tests to cover workspace and subpath expansion, empty root lists, deny preservation, and the roots and write permissions serialized into the Windows wrapper.

GitOrigin-RevId: 0bebdb08b67cbbc182c18b031b9d13a21a799682

2026-11-05 00:30:20 +00:00

..

code_mode

Support negotiated server-side truncation in Code Mode clients (#58125)

2026-10-29 16:57:12 +00:00

executed_tool_calls

Route response item IDs through a shared generator (#59312)

2026-11-04 04:02:00 +00:00

handlers

Allow per-turn overrides for direct-only tool namespaces (#59481)

2026-11-04 19:58:49 +00:00

runtimes

Tie executor attachments to environment selection lifetimes (#59043)

2026-11-03 02:37:20 +00:00

approvals_tests.rs

Use prepared MCP owner permissions in Guardian reviews (#59028)

2026-11-03 01:41:16 +00:00

approvals.rs

Use prepared MCP owner permissions in Guardian reviews (#59028)

2026-11-03 01:41:16 +00:00

call_trace.rs

Add turn, tool, and skill attribution to traces (#56524)

2026-10-23 16:55:32 +00:00

context_tests.rs

Preserve command cwd in permission and post-tool hooks (#57203)

2026-10-26 19:21:08 +00:00

context.rs

Preserve native tool-call evidence through Guardian review (#58040)

2026-10-29 11:15:52 +00:00

control_tool_analytics.rs

Track history, notes, and async messages as control tools (#40496)

2026-08-24 23:19:03 +00:00

events.rs

Consolidate command execution output into aggregated_output (#50402)

2026-10-02 18:48:49 +00:00

executed_tool_calls_direct_tests.rs

Route response item IDs through a shared generator (#59312)

2026-11-04 04:02:00 +00:00

executed_tool_calls.rs

Route response item IDs through a shared generator (#59312)

2026-11-04 04:02:00 +00:00

hook_names.rs

Default function tools into tool hooks (#23757)

2026-05-23 00:56:58 +00:00

hosted_spec_tests.rs

Use the image generation extension by default (#31596)

2026-07-09 12:25:19 +09:00

hosted_spec.rs

Use the image generation extension by default (#31596)

2026-07-09 12:25:19 +09:00

lifecycle.rs

Use serving assessments for adaptive Guardian review (#58075)

2026-10-29 12:54:39 +00:00

metadata_metrics_tests.rs

Preserve live tool-call metadata across request windows (#49401)

2026-09-29 23:24:37 +00:00

metadata_metrics.rs

Preserve live tool-call metadata across request windows (#49401)

2026-09-29 23:24:37 +00:00

mod.rs

Move agent message board host integration to app-server (#59162)

2026-11-03 13:38:59 +00:00

multi_agent_tool.rs

Move agent message board host integration to app-server (#59162)

2026-11-03 13:38:59 +00:00

native_tool_review.rs

Preserve native tool-call evidence through Guardian review (#58040)

2026-10-29 11:15:52 +00:00

network_approval_tests.rs

Verify queued network approval wakeups before polling again (#58937)

2026-11-02 17:54:31 +00:00

network_approval.rs

Tie executor attachments to environment selection lifetimes (#59043)

2026-11-03 02:37:20 +00:00

orchestrator.rs

Tie executor attachments to environment selection lifetimes (#59043)

2026-11-03 02:37:20 +00:00

parallel_observation_tests.rs

Preserve native tool-call evidence through Guardian review (#58040)

2026-10-29 11:15:52 +00:00

parallel_trace_tests.rs

Stabilize cancellation and tracing tests (#58171)

2026-10-29 20:39:04 +00:00

parallel.rs

Route response item IDs through a shared generator (#59312)

2026-11-04 04:02:00 +00:00

registry_tests.rs

Preserve native tool-call evidence through Guardian review (#58040)

2026-10-29 11:15:52 +00:00

registry.rs

Enforce strict third-party tool deferral in Code Mode Only (#59071)

2026-11-03 06:05:55 +00:00

router_tests.rs

Preserve native tool-call evidence through Guardian review (#58040)

2026-10-29 11:15:52 +00:00

router.rs

Preserve native tool-call evidence through Guardian review (#58040)

2026-10-29 11:15:52 +00:00

sandboxing_tests.rs

Preserve command cwd in permission and post-tool hooks (#57203)

2026-10-26 19:21:08 +00:00

sandboxing.rs

Resolve workspace permissions at the sandbox launch boundary (#59530)

2026-11-05 00:30:20 +00:00

spec_plan_strict_third_party_tests.rs

Enforce strict third-party tool deferral in Code Mode Only (#59071)

2026-11-03 06:05:55 +00:00

spec_plan_tests.rs

Enforce strict third-party tool deferral in Code Mode Only (#59071)

2026-11-03 06:05:55 +00:00

spec_plan.rs

Enforce strict third-party tool deferral in Code Mode Only (#59071)

2026-11-03 06:05:55 +00:00

tool_dispatch_trace_tests.rs

Preserve native tool-call evidence through Guardian review (#58040)

2026-10-29 11:15:52 +00:00

tool_dispatch_trace.rs

Canonicalize default tools under the functions namespace (#37022)

2026-08-05 04:07:59 +00:00

tool_namespaces_info.rs

Include tool namespace inventory in turn metadata (#37492)

2026-08-07 19:32:15 +00:00

user_messaging_tests.rs

Preserve command cwd in permission and post-tool hooks (#57203)

2026-10-26 19:21:08 +00:00

user_messaging.rs

Retain confirmed Code Mode messages for Guardian reviews (#48725)

2026-09-27 15:03:38 +00:00