viyatb-oai ccde2fc8b7 Protect ripgrep lookup during Linux sandbox construction (#51407) ...

## Why

Deny-read glob expansion runs before sandbox confinement. Resolving `rg` directly from `PATH` could execute a writable workspace binary at that stage.

## What changed

Use the existing protected executable lookup to select a canonical `rg` path under the filesystem policy. Fall back to the native glob walker when no suitable executable is found, preserving masks for matching denied paths.

## Testing

Extend denied-file integration tests to verify that a writable workspace `rg` never runs, a protected `rg` is used when available, and denied files remain blocked with the native fallback.

GitOrigin-RevId: f06674f3535c8a72a4656871762e45fa13c732f2

2026-10-06 16:30:34 +00:00

..

suite

Protect ripgrep lookup during Linux sandbox construction (#51407)

2026-10-06 16:30:34 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00