jif 4f7032173e Honor filesystem permissions for app file uploads (#38416) ...

## Why

App tool file arguments could read and upload files without applying the active
filesystem sandbox policy.

## What changed

- Apply the effective filesystem policy, including session and turn grants, when
  reading metadata and streaming files for upload.
- Reject uploads before contacting the files endpoint when the selected path is
  denied.
- Report an error when the executor cannot provide sandboxed file streaming for
  a restricted policy.

## Testing

Added integration coverage showing that restricted policies allow permitted
files and reject denied files before upload.

GitOrigin-RevId: 63b239c5066dcb9d18b5050089c659fb2a784909

2026-08-13 18:36:12 +00:00

..

common

Unify turn input submission and routing (#38275)

2026-08-13 00:00:16 +00:00

remote_env_windows

Unify turn input submission and routing (#38275)

2026-08-13 00:00:16 +00:00

suite

Honor filesystem permissions for app file uploads (#38416)

2026-08-13 18:36:12 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

responses_headers.rs

Include sandbox mode in response metadata (#37507)

2026-08-07 22:41:20 +00:00