Route Windows sandbox proxy traffic by restricting SID (#34613)

## Why

Elevated Windows sandboxes need stable managed-proxy ports while preserving the network policy and environment attribution of each sandboxed process.

## What changed

- Keep shared HTTP and SOCKS5 loopback ingress listeners alive across managed-proxy instances.
- Add a per-route restricting SID to elevated sandbox tokens and dispatch incoming connections to the matching proxy policy after attributing the client process.
- Reject connections without exactly one registered route, remove routes when their proxy handle is dropped, and keep unsandboxed Windows launches off the managed ingress.
- Provision the elevated sandbox with the configured proxy ports and local-binding setting, honoring the selected profile and CLI overrides.

## Testing

- Add Windows unit tests for TCP ownership attribution, route selection, restricting-token propagation, and setup settings.
- Add an end-to-end Windows test covering stable ports, isolated environment policies, HTTP and SOCKS5 routing, and route teardown.

GitOrigin-RevId: 783fac6e0f904dc9bb1955b75d4a5895e8bb9690

codex-rs/windows-sandbox-rs/src/unified_exec/backends/elevated.rs

@@ -116,6 +116,7 @@ pub(crate) async fn spawn_windows_sandbox_session_elevated_for_permission_profil
     cwd: &Path,
     mut env_map: HashMap<String, String>,
     proxy_enforced: bool,
+    network_proxy_restricting_sid: Option<String>,
     proxy_settings_mode: crate::WindowsSandboxProxySettingsMode,
     timeout_ms: Option<u64>,
     read_roots_override: Option<&[PathBuf]>,
@@ -171,6 +172,7 @@ pub(crate) async fn spawn_windows_sandbox_session_elevated_for_permission_profil
             codex_home: elevated.sandbox_base,
             real_codex_home: codex_home.to_path_buf(),
             cap_sids: elevated.cap_sids,
+            network_proxy_restricting_sid,
             timeout_ms,
             tty,
             stdin_open,

codex-rs/windows-sandbox-rs/src/unified_exec/backends/elevated_tests.rs

@@ -76,6 +76,7 @@ fn retry_uses_original_unified_exec_request_and_stops_after_second_failure() {
             codex_home: PathBuf::from(r"C:\Users\codex\.sandbox"),
             real_codex_home: PathBuf::from(r"C:\Users\codex"),
             cap_sids: vec!["S-1-15-3-1024-1".to_string()],
+            network_proxy_restricting_sid: Some("S-1-5-21-100-200-300-400".to_string()),
             timeout_ms: Some(5_000),
             tty: true,
             stdin_open: true,

codex-rs/windows-sandbox-rs/src/unified_exec/mod.rs

@@ -10,6 +10,7 @@
 mod backends;
 
 use anyhow::Result;
+use anyhow::bail;
 use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::models::PermissionProfile;
 use codex_utils_absolute_path::AbsolutePathBuf;
@@ -31,6 +32,7 @@ pub struct WindowsSandboxSessionRequest<'a> {
     pub env_map: HashMap<String, String>,
     pub windows_sandbox_level: WindowsSandboxLevel,
     pub proxy_enforced: bool,
+    pub network_proxy_restricting_sid: Option<String>,
     pub proxy_settings_mode: crate::WindowsSandboxProxySettingsMode,
     pub timeout_ms: Option<u64>,
     pub read_roots_override: Option<&'a [PathBuf]>,
@@ -57,6 +59,7 @@ pub async fn spawn_windows_sandbox_session_for_level(
             request.cwd,
             request.env_map,
             request.proxy_enforced,
+            request.network_proxy_restricting_sid,
             request.proxy_settings_mode,
             request.timeout_ms,
             request.read_roots_override,
@@ -70,6 +73,9 @@ pub async fn spawn_windows_sandbox_session_for_level(
         )
         .await
     } else {
+        if request.network_proxy_restricting_sid.is_some() {
+            bail!("network proxy restricting SID requires the elevated Windows sandbox backend");
+        }
         spawn_windows_sandbox_session_legacy(
             request.permission_profile,
             request.workspace_roots,
@@ -129,6 +135,7 @@ pub async fn spawn_windows_sandbox_session_elevated_for_permission_profile(
     cwd: &Path,
     env_map: HashMap<String, String>,
     proxy_enforced: bool,
+    network_proxy_restricting_sid: Option<String>,
     timeout_ms: Option<u64>,
     read_roots_override: Option<&[PathBuf]>,
     read_roots_include_platform_defaults: bool,
@@ -147,6 +154,7 @@ pub async fn spawn_windows_sandbox_session_elevated_for_permission_profile(
         cwd,
         env_map,
         proxy_enforced,
+        network_proxy_restricting_sid,
         crate::WindowsSandboxProxySettingsMode::Reconcile,
         timeout_ms,
         read_roots_override,