viyatb-oai 902bd9e06b Protect inline visualization viewers from sandbox writes (#38306) ...

## Why

Inline visualization viewer documents must remain outside locations that a
sandboxed session can modify before they are opened in a browser.

## What changed

- Materialize viewer documents in a dedicated cache under `CODEX_HOME`, keyed
  by the source and artifact thread IDs, instead of alongside visualization
  artifacts.
- Create visualization links only when the active filesystem policy cannot
  write to the viewer cache. This also disables links for full-disk-write
  sessions and applies the policy consistently when loading transcript history.
- Reject viewer cache paths containing symbolic links and track materialized
  documents in memory so unchanged viewers are reused without trusting existing
  file contents.

## Testing

- Verify that rendering an unchanged visualization reuses the existing viewer
  file, while an updated fragment refreshes it.

GitOrigin-RevId: 12b7fbe522a68076e5d683a987b7801940d131c2

2026-08-13 04:08:23 +00:00

..

assets

Support content references for inline visualizations (#37341)

2026-08-07 00:37:50 +00:00

viewer.rs

Protect inline visualization viewers from sandbox writes (#38306)

2026-08-13 04:08:23 +00:00