jackz 1d804e91b7 Protect .aws directories under sandbox writable roots (#48176) ...

## Why

AWS profiles can select credential helpers that the application executes. Granting write access to a containing directory should therefore keep `.aws` protected by default.

## What changed

Add `.aws` to the protected metadata paths alongside `.git`, `.agents`, and `.codex`, including workspace roots and additional writable roots. Preserve explicit user rules that override the default protection.

## Testing

Extend policy and sandbox tests to cover `.aws` protection. Add macOS coverage for existing and absent `.aws` directories, deletion and replacement attempts, and symlink targets. Verify that Linux sandbox writes to protected configuration files fail while sibling files remain writable.

GitOrigin-RevId: 31ea287bd0dd9b13aff893783fba9ca3aed0c89d

2026-09-25 19:14:31 +00:00

..

lib.rs

Wire the Windows MXC sandbox into command execution (#45176)

2026-09-13 06:07:03 +00:00

native.rs

Wire up the native Windows MXC helper entry point (#44903)

2026-09-11 20:10:02 +00:00

policy_tests.rs

Protect .aws directories under sandbox writable roots (#48176)

2026-09-25 19:14:31 +00:00

policy.rs

Wire up the native Windows MXC helper entry point (#44903)

2026-09-11 20:10:02 +00:00

transport_tests.rs

Transport large Windows sandbox launch payloads through the environment (#47919)

2026-09-24 19:15:17 +00:00

transport.rs

Transport large Windows sandbox launch payloads through the environment (#47919)

2026-09-24 19:15:17 +00:00

windows.rs

Wire the Windows MXC sandbox into command execution (#45176)

2026-09-13 06:07:03 +00:00