viyatb-oai 6aa83e5eee Centralize filesystem helper sandbox preparation (#61138) ...

## What changed

- Route filesystem helpers through `SandboxManager::transform`, moving helper policy preparation and Windows direct-spawn wrapping into the sandboxing crate.
- Require explicit workspace roots and an available sandbox for helper launches, restrict networking, and reject managed networking configuration.
- Share command preparation and integrity checks between helper requests and sandboxed file opens.

## Testing

Extend coverage for helper executable reads, workspace write boundaries, restricted networking, and Windows wrapper policy serialization. Verify that sandboxed writes to helper siblings leave host files unchanged.

GitOrigin-RevId: e57bfdabf47f79f2194b35df8a75051daf933465

2026-11-12 14:47:48 +00:00

..

shared.rs

Centralize filesystem helper sandbox preparation (#61138)

2026-11-12 14:47:48 +00:00

support.rs

Allow exec-server to proxy permitted private IPs upstream (#48568)

2026-09-26 23:17:41 +00:00