jif 683716cee9 Use effective permissions when trusting app-server projects (#38390) ...

## Why

Project-local configuration can launch host processes. Requested write access may be reduced to read-only by managed constraints or platform support, so the request alone must not cause the app server to trust a project and load its configuration.

## What changed

- Base automatic project trust on the effective permission profile after configuration is loaded.
- Trust managed profiles only when their effective filesystem policy allows writes to the working directory.
- Continue resolving trusted nested working directories to the repository root.

## Testing

- Verify that managed read-only permissions neither persist project trust nor load a project-local MCP server when workspace-write access was requested.
- Cover effective read-only fallback for workspace-write requests and nested repository working directories.

GitOrigin-RevId: e548fd9c4552c328f779cc0365fe86f37d4a9b71

2026-08-13 14:55:00 +00:00

..

common

Include Node REPL policy in turn metadata (#38241)

2026-08-12 19:37:51 +00:00

suite

Use effective permissions when trusting app-server projects (#38390)

2026-08-13 14:55:00 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00