viyatb-oai a6ed292aa3 Centralize managed proxy preparation and sandbox routing (#59792) ...

## What changed

Move proxy configuration and routing selection into `prepare_managed_network`. Keep native Windows launches direct by stripping managed proxy variables before credential brokering, and select dedicated listeners only for Windows MXC launches.

Consolidate managed network context filtering in `SandboxManager` and simplify proxy preparation for Linux and MXC while preserving the macOS Seatbelt context.

## Testing

Add Windows regression coverage for native launches with both disabled and enabled proxy configurations, verifying that managed proxy variables are removed while caller environment values and API credentials are preserved.

GitOrigin-RevId: 29fe1fb02afb574b4108032b7e8028d19d8270b4

2026-11-06 02:21:14 +00:00

..

sandbox_integrity

Add policy-based file contents integrity checks (#51828)

2026-10-07 20:54:13 +00:00

bwrap_tests.rs

Reject replaceable symlinks in pre-sandbox executable lookup (#55384)

2026-10-19 21:26:58 +00:00

bwrap.rs

Reject replaceable symlinks in pre-sandbox executable lookup (#55384)

2026-10-19 21:26:58 +00:00

denial.rs

Sandbox remote apply_patch operations (#38043)

2026-08-11 17:47:22 +00:00

landlock_tests.rs

Honor explicit Unix socket grants in the Linux managed sandbox (#45534)

2026-09-14 22:40:20 +00:00

landlock.rs

Honor explicit Unix socket grants in the Linux managed sandbox (#45534)

2026-09-14 22:40:20 +00:00

launch.rs

Resolve workspace permissions at the sandbox launch boundary (#59530)

2026-11-05 00:30:20 +00:00

lib.rs

Resolve workspace permissions at the sandbox launch boundary (#59530)

2026-11-05 00:30:20 +00:00

linux_pid_namespace.rs

Add startup-only PID namespace inheritance to exec-server (#47989)

2026-09-25 03:12:10 +00:00

manager_tests.rs

Resolve workspace permissions at the sandbox launch boundary (#59530)

2026-11-05 00:30:20 +00:00

manager.rs

Centralize managed proxy preparation and sandbox routing (#59792)

2026-11-06 02:21:14 +00:00

policy_transforms_tests.rs

Preserve target-native paths in command approvals (#42577)

2026-09-03 16:21:10 +00:00

policy_transforms.rs

Preserve target-native paths in command approvals (#42577)

2026-09-03 16:21:10 +00:00

seatbelt_base_policy.sbpl

Allow semaphore limit queries in the macOS sandbox (#39976)

2026-08-21 17:16:51 +00:00

seatbelt_daemon_socket_tests.rs

Isolate app-server Unix sockets from filesystem-restricted commands (#45984)

2026-09-16 16:56:41 +00:00

seatbelt_daemon.rs

Preserve macOS Seatbelt exclusions in scratch directories (#46571)

2026-09-19 01:59:07 +00:00

seatbelt_fcntl_tests.rs

Block mutating fcntls in restricted macOS Seatbelt policies (#46500)

2026-09-18 23:07:12 +00:00

seatbelt_network_policy.sbpl

…

seatbelt_network_tests.rs

Require hostname authorization before proxy DNS lookups (#51650)

2026-10-07 11:10:20 +00:00

seatbelt_preferences_policy.sbpl

Restrict macOS preference reads to full-disk policies (#39811)

2026-08-20 23:18:55 +00:00

seatbelt_read_only_platform_defaults.sbpl

Remove com.apple.runningboard from Seatbelt platform defaults (#46532)

2026-09-19 00:20:02 +00:00

seatbelt_scratch.rs

Centralize filesystem permission resolution for sandbox enforcement (#59009)

2026-11-02 23:19:47 +00:00

seatbelt_tests.rs

Remove the legacy Seatbelt command wrapper (#59774)

2026-11-06 00:59:18 +00:00

seatbelt_tls_tests.rs

Allow macOS TLS trust evaluation in network-enabled Seatbelt profiles (#48565)

2026-09-26 23:08:50 +00:00

seatbelt.rs

Remove the legacy Seatbelt command wrapper (#59774)

2026-11-06 00:59:18 +00:00

spawn.rs

Support close-on-exec attachments without changing PTY semantics (#47797)

2026-09-24 09:25:19 +00:00

terminal_queries_tests.rs

Support close-on-exec attachments without changing PTY semantics (#47797)

2026-09-24 09:25:19 +00:00

terminal_queries.rs

Respond to terminal queries from TTY subprocesses (#41436)

2026-08-28 23:34:37 +00:00

violation_tests.rs

Record normalized sandbox violation events (#36207)

2026-07-30 19:23:33 +00:00

violation.rs

Wire the Windows MXC sandbox into command execution (#45176)

2026-09-13 06:07:03 +00:00

windows_mxc.rs

Migrate the Windows MXC sandbox to split MXC crates (#52707)

2026-10-09 22:11:30 +00:00

windows_tests.rs

Align Windows sandbox temp permissions with the child environment (#51512)

2026-10-06 23:21:06 +00:00

windows.rs

Use resolved filesystem permissions in Windows sandbox policies (#59233)

2026-11-03 21:23:50 +00:00