johnl-oai 4fdf4c1113 Add Windows sandbox client authentication (#42348) ...

## Why

Sandbox provisioning IPC must authenticate callers before request handling can be enabled.

## What changed

- Authorize named-pipe clients against the Codex package identity and keep the client process open through authentication.
- Impersonate the caller and require its token to match the client process user, belong to an interactive named user, and not belong to the sandbox group.
- Prepare and pin the requested Codex home, then validate machine policy with the impersonated token.
- Allow known Codex package families when running an unpackaged debug service in foreground mode.

Provisioning IPC remains disabled until this authentication is connected to the transport.

## Testing

- Add a Windows test that verifies an unpackaged pipe client is rejected before it sends a provisioning request.

GitOrigin-RevId: b0e87450c06f8de3eca6cb77daa9b11ef80699a9

2026-09-02 20:14:42 +00:00

..

src

Add Windows sandbox client authentication (#42348)

2026-09-02 20:14:42 +00:00

BUILD.bazel

Add Windows sandbox service lifecycle scaffolding (#42341)

2026-09-02 19:49:58 +00:00

Cargo.toml

Prepare managed policy validation for Windows sandbox provisioning (#42344)

2026-09-02 20:07:11 +00:00