iceweasel-oai 1bc8fb16ae Separate Windows sandbox provisioning from ACL refresh (#42309) ...

## What changed

- Limit elevated interactive setup to provisioning sandbox identities and proxy settings; do not include caller workspace or ACL roots in its payload.
- Always run the non-elevated setup refresh during sandbox activation so the current permission profile supplies read, write, and deny paths, including when provisioning was completed previously.
- Add an `interactive-provision` setup mode that performs provisioning without the full ACL setup path.

## Testing

- Verify elevated provisioning payloads contain no caller ACL roots and use the new mode.
- Verify the setup helper accepts `interactive-provision` payloads.

GitOrigin-RevId: 081b1b43abd2388773c230fb35da82896e7be2ea

2026-09-02 16:49:45 +00:00

..

src

Separate Windows sandbox provisioning from ACL refresh (#42309)

2026-09-02 16:49:45 +00:00

tests

Embed the Windows sandbox setup manifest in Bazel builds (#38450)

2026-08-13 23:04:38 +00:00

BUILD.bazel

Embed the Windows sandbox setup manifest in Bazel builds (#38450)

2026-08-13 23:04:38 +00:00

build.rs

[codex] Fix Windows sandbox build script lint (#26445)

2026-06-04 13:03:47 -07:00

Cargo.toml

Extract shared Windows sandbox session runner (#28357)

2026-06-15 18:30:48 +00:00

codex-windows-sandbox-setup.manifest

[codex] Restore setup helper UAC manifest (#25949)

2026-06-03 09:21:24 -07:00

sandbox_smoketests.py

Format Python scripts across the repository (#42109)

2026-09-01 17:47:29 +00:00