viyatb-oai 9a7213ca37 Resolve workspace permissions at the sandbox launch boundary (#59530) ...

## What changed

Add optional executor workspace roots to `SandboxTransformRequest` and resolve symbolic workspace rules after merging additional permissions. Preserve explicit deny rules and treat an empty root list as granting no workspace access.

Route Windows restricted-token preparation through the shared transform path and use explicit roots when building its direct-spawn wrapper. Update Windows MXC debug launches to bind configured roots before adding the managed CA read grant.

## Testing

Extend sandbox manager tests to cover workspace and subpath expansion, empty root lists, deny preservation, and the roots and write permissions serialized into the Windows wrapper.

GitOrigin-RevId: 0bebdb08b67cbbc182c18b031b9d13a21a799682

2026-11-05 00:30:20 +00:00

..

common

Extract agent message board hosting into a dedicated crate (#59473)

2026-11-04 19:10:59 +00:00

remote_env_windows

Bind capability roots to environment selections (#51493)

2026-10-06 22:39:32 +00:00

suite

Preserve project agent opt-ins across enabled legacy feature flags (#59496)

2026-11-04 21:23:11 +00:00

windows_sandbox

Respect filesystem permissions when discovering repository skills (#59280)

2026-11-04 01:15:38 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

code_mode_tracing.rs

Add code-mode output truncation protocol contracts (#57272)

2026-10-26 21:36:35 +00:00

mcp_trace_propagation.rs

Add negotiated network policy metadata support for MCP calls (#56278)

2026-10-22 22:33:07 +00:00

responses_headers.rs

Route response item IDs through a shared generator (#59312)

2026-11-04 04:02:00 +00:00

windows_sandbox.rs

Resolve workspace permissions at the sandbox launch boundary (#59530)

2026-11-05 00:30:20 +00:00