Adam Perry @ OpenAI a4ee536f01
Route filesystem reads and writes by their own sandbox permissions ( #46122 ) ...
## Why
Filesystem reads previously required a sandbox whenever writes were restricted, even with full-disk read permission. This made permitted reads depend on sandbox availability.
## What changed
- Select sandboxing independently for reads and writes, allowing full-disk reads directly while keeping restricted operations sandboxed.
- Use the executor's path convention when evaluating full-disk access, including `:slash_tmp` denials.
- Apply read-specific checks to capability discovery and skill resource reads, allowing unrestricted reads on executors without sandboxed discovery support.
## Testing
Add regression tests for direct read APIs, restricted writes and reads, executor-specific permission rules, and capability discovery without sandbox support. Update Windows tests to verify sandbox enforcement through writes.
GitOrigin-RevId: a03844bd1f0ea583bb54326683cddbfdd050119f
2026-09-17 05:09:03 +00:00
2026-09-15 02:35:59 +00:00
2026-08-24 22:40:35 +00:00
2026-09-16 23:33:00 +00:00
2026-09-17 04:23:45 +00:00
2026-09-14 22:31:32 +00:00
2026-09-15 19:51:06 +00:00
2026-09-16 21:50:07 +00:00
2026-09-03 06:02:25 +00:00
2026-09-16 16:56:41 +00:00
2026-08-20 08:10:08 +00:00
2026-09-11 20:10:02 +00:00
2026-08-31 13:44:12 +00:00
2026-09-17 00:49:12 +00:00
2026-09-09 03:17:48 +00:00
2026-09-15 19:13:08 +00:00
2026-09-07 16:55:06 +00:00
2026-08-14 05:03:39 +00:00
2026-08-17 22:37:14 +00:00
2026-09-17 04:53:51 +00:00
2026-09-10 21:41:39 +00:00
2026-09-03 01:46:37 +00:00
2026-08-28 19:44:50 +00:00
2026-09-11 17:00:07 +00:00
2026-09-11 17:00:07 +00:00
2026-09-11 17:00:07 +00:00
2026-09-15 18:52:15 +00:00
2026-09-16 11:46:37 +00:00
2026-09-15 17:32:33 +00:00
2026-09-16 01:01:57 +00:00
2026-09-14 19:12:59 +00:00
2026-09-17 01:18:37 +00:00
2026-09-05 01:25:06 +00:00
2026-09-17 01:31:14 +00:00
2026-08-31 21:27:51 +00:00
2026-09-15 18:23:08 +00:00
2026-09-12 18:16:17 +00:00
2026-09-17 05:09:03 +00:00
2026-09-11 01:57:54 +00:00
2026-09-17 04:23:45 +00:00
2026-08-07 11:30:17 +00:00
2026-09-05 12:17:32 +00:00
2026-09-16 04:23:46 +00:00
2026-09-17 05:09:03 +00:00
2026-09-17 04:37:54 +00:00
2026-08-17 04:37:50 +00:00
2026-09-17 05:09:03 +00:00
2026-09-17 04:23:45 +00:00
2026-09-17 04:53:51 +00:00
2026-09-10 18:10:26 +00:00
2026-09-17 05:09:03 +00:00
2026-09-06 20:52:29 +00:00
2026-09-17 01:38:13 +00:00
2026-09-16 19:25:50 +00:00
2026-09-10 00:26:30 +00:00
2026-09-16 18:13:23 +00:00
2026-09-11 21:59:24 +00:00
2026-09-16 18:21:22 +00:00
2026-09-16 19:46:52 +00:00
2026-09-16 15:17:41 +00:00
2026-09-16 23:26:00 +00:00
2026-09-16 19:46:52 +00:00
2026-09-16 19:46:52 +00:00
2026-09-16 21:01:13 +00:00
2026-09-14 22:40:20 +00:00
2026-09-16 21:08:43 +00:00
2026-09-16 22:43:57 +00:00
2026-09-01 17:17:45 +00:00
2026-09-16 21:15:09 +00:00
2026-09-16 21:01:13 +00:00
2026-09-17 05:09:03 +00:00
2026-09-11 03:16:01 +00:00
2026-09-16 01:01:57 +00:00
2026-08-21 16:45:05 +00:00
2026-09-16 22:25:54 +00:00
2026-09-16 22:33:15 +00:00
2026-08-28 01:14:02 +00:00
2026-09-16 18:21:22 +00:00
2026-08-10 15:43:10 +00:00
2026-09-15 18:06:03 +00:00
2026-09-09 04:00:10 +00:00
2026-09-05 05:21:42 +00:00
2026-09-15 02:33:27 +00:00
2026-09-16 09:03:41 +00:00
2026-09-02 18:34:27 +00:00
2026-09-14 21:06:36 +00:00
2026-09-16 22:33:15 +00:00
2026-09-15 21:19:08 +00:00
2026-09-17 04:53:51 +00:00
2026-09-16 16:56:41 +00:00
2026-09-08 00:13:28 +00:00
2026-09-16 03:40:53 +00:00
2026-09-11 22:09:02 +00:00
2026-09-03 20:01:07 +00:00
2026-09-16 22:26:17 +00:00
2026-09-16 22:26:17 +00:00
2026-08-15 14:31:04 +00:00
2026-09-13 18:53:06 +00:00
2026-09-08 21:19:02 +00:00
2026-09-17 04:53:51 +00:00
2026-09-16 23:26:00 +00:00
2026-09-11 06:45:09 +00:00
Adam Perry @ OpenAI
a4ee536f01