jif 5decb399ae
Respect filesystem permissions during capability discovery ( #36124 ) ...
## Why
Executor capability discovery can traverse plugin and skill roots, including
symlinks. Under restricted filesystem permissions, discovery must not expose
files outside the permitted paths.
## What changed
- Pass each environment's filesystem sandbox context through capability root
discovery and apply it to metadata, directory walks, and file reads.
- Enable discovery for restricted sessions so permitted executor skills remain
available while inaccessible roots and symlink targets are omitted.
- Key discovery caches by sandbox context and reject sandboxed discovery on
executors that do not advertise support for it.
- Split requests with more than 128 roots into supported-size batches.
## Testing
- Cover permitted and denied external symlink targets.
- Verify restricted skill listing excludes inaccessible skills.
- Verify cache separation across permission contexts and discovery of 129 roots.
GitOrigin-RevId: 44d16468ca003403bdb8b71a04ae8c9ff94ed494
2026-07-30 10:01:06 +00:00
2026-07-29 13:53:15 +00:00
2026-06-09 12:48:04 -07:00
2026-07-23 19:19:35 +00:00
2026-07-21 22:44:43 +00:00
2026-07-30 05:53:21 +00:00
2026-07-29 13:53:15 +00:00
2026-07-30 10:01:06 +00:00
2026-07-29 00:30:11 +00:00
2026-07-21 08:50:21 +00:00
2026-07-30 01:37:41 +00:00
2026-07-28 05:26:16 +00:00
2026-07-29 18:29:26 +00:00
2026-07-22 02:19:45 +00:00
2026-07-21 08:59:41 +00:00
2026-06-11 18:16:39 -07:00
2026-05-08 04:07:59 +00:00
2026-07-28 15:50:45 +00:00
2026-06-13 21:43:39 -07:00
2026-07-23 01:00:35 +00:00
2026-07-30 01:20:28 +00:00
2026-07-28 15:50:45 +00:00
2026-07-29 14:01:31 +00:00
2026-07-21 08:28:51 +00:00
2026-06-11 18:16:39 -07:00
2026-07-25 00:01:43 +00:00
2026-07-24 04:37:01 +00:00
2026-07-24 04:37:01 +00:00
2026-07-28 21:16:06 +00:00
2026-07-28 15:50:45 +00:00
2026-07-07 01:12:24 +00:00
2026-05-07 15:44:17 -07:00
2026-06-15 20:10:53 -07:00
2026-07-29 23:46:54 +00:00
2026-06-21 13:35:25 -07:00
2026-07-27 18:41:09 +00:00
2026-07-23 01:00:35 +00:00
2026-07-26 23:36:33 +00:00
2026-07-30 10:01:06 +00:00
2026-07-24 06:03:36 +00:00
2026-07-29 01:16:29 +00:00
2026-07-30 10:01:06 +00:00
2026-06-05 15:41:13 -07:00
2026-07-30 01:37:41 +00:00
2026-07-30 10:01:06 +00:00
2026-07-30 10:01:06 +00:00
2026-07-20 06:13:29 +00:00
2026-07-30 10:01:06 +00:00
2026-07-30 00:50:02 +00:00
2026-07-28 22:53:33 +00:00
2026-07-28 17:51:37 +00:00
2026-05-07 15:44:17 -07:00
2026-07-23 23:35:29 +00:00
2026-05-28 23:09:55 -07:00
2026-07-22 02:19:45 +00:00
2026-07-27 18:07:31 +00:00
2026-07-28 19:58:25 +00:00
2026-07-08 12:17:58 -04:00
2026-06-12 19:52:49 +00:00
2026-07-27 18:07:31 +00:00
2026-07-22 04:17:34 +00:00
2026-07-28 15:50:45 +00:00
2026-07-28 21:58:33 +00:00
2026-07-23 19:19:35 +00:00
2026-07-17 20:52:42 +00:00
2026-07-23 19:32:26 +00:00
2026-07-23 00:02:15 +00:00
2026-07-28 13:31:41 +00:00
2026-07-27 18:07:31 +00:00
2026-07-30 04:26:36 +00:00
2026-07-29 23:58:10 +00:00
2026-07-24 23:36:11 +00:00
2026-05-25 17:26:10 -03:00
2026-07-22 19:14:11 +00:00
2026-07-30 01:37:41 +00:00
2026-05-07 15:44:17 -07:00
2026-07-29 23:24:43 +00:00
2026-07-29 18:29:26 +00:00
2026-07-23 23:13:59 +00:00
2026-07-21 21:06:04 +00:00
2026-05-26 20:59:47 -07:00
2026-06-12 19:52:49 +00:00
2026-07-23 21:50:17 +00:00
2026-06-25 13:56:08 -07:00
2026-07-29 19:49:01 +00:00
2026-07-29 18:37:22 +00:00
2026-05-07 15:44:17 -07:00
2026-05-13 21:23:19 +00:00
2026-05-07 15:44:17 -07:00
2026-07-24 00:10:22 +00:00
2026-07-30 04:55:09 +00:00
2026-07-30 09:19:14 +00:00
2026-07-30 01:37:41 +00:00
2026-05-07 15:44:17 -07:00
2026-07-30 04:26:36 +00:00
2026-07-22 16:18:08 +00:00
2026-06-13 21:43:39 -07:00
2026-07-24 00:16:42 +00:00
2026-07-27 18:37:11 +00:00
2026-07-09 17:31:44 -07:00
2026-07-30 04:26:36 +00:00
2026-07-29 17:38:20 +00:00
2026-07-28 20:49:22 +00:00
2026-07-11 03:27:51 +00:00
2026-07-29 13:53:15 +00:00
2026-07-30 04:26:36 +00:00
2026-06-04 09:16:03 -07:00
2026-05-26 20:59:47 -07:00
jif
5decb399ae