jif a7e9fb5480
Constrain Guardian reviews to parent filesystem permissions ( #38377 ) ...
## Why
Guardian review sessions must not gain access to paths that the parent turn is
not allowed to read.
## What changed
- Derive Guardian permissions by intersecting managed parent filesystem rules
with read-only access, preserving denied paths and restricting network access.
- Offer Guardian execution tools only when a managed sandbox can enforce those
rules.
- Include the selected environment IDs in the review-session reuse key so a
session is not reused across different environment sets.
## Testing
Update the Guardian reuse integration test to verify that a review cannot read
a parent-denied file or write a local file while consecutive reviews still
reuse the same session.
GitOrigin-RevId: 20f17a6c379f1eda651e8508459d642a51e4ce94
2026-08-13 13:41:08 +00:00
2026-07-29 13:53:15 +00:00
2026-06-09 12:48:04 -07:00
2026-07-23 19:19:35 +00:00
2026-07-21 22:44:43 +00:00
2026-08-13 00:04:57 +00:00
2026-07-29 13:53:15 +00:00
2026-08-13 01:32:42 +00:00
2026-08-04 15:23:43 +00:00
2026-07-21 08:50:21 +00:00
2026-08-13 12:04:29 +00:00
2026-07-30 19:47:30 +00:00
2026-08-10 03:28:19 +00:00
2026-07-29 18:29:26 +00:00
2026-08-10 18:44:58 +00:00
2026-08-10 01:39:55 +00:00
2026-06-11 18:16:39 -07:00
2026-08-12 22:58:46 +00:00
2026-08-11 03:39:02 +00:00
2026-06-13 21:43:39 -07:00
2026-08-11 19:16:15 +00:00
2026-08-13 01:32:42 +00:00
2026-08-11 01:05:48 +00:00
2026-08-05 18:09:26 +00:00
2026-07-21 08:28:51 +00:00
2026-06-11 18:16:39 -07:00
2026-08-13 01:32:42 +00:00
2026-08-13 07:26:27 +00:00
2026-08-13 00:26:06 +00:00
2026-08-05 16:09:01 +00:00
2026-08-12 21:18:15 +00:00
2026-07-30 21:49:53 +00:00
2026-08-07 18:33:46 +00:00
2026-06-15 20:10:53 -07:00
2026-08-12 20:36:32 +00:00
2026-08-04 22:58:02 +00:00
2026-08-12 20:36:32 +00:00
2026-08-07 00:23:38 +00:00
2026-08-03 11:39:51 +00:00
2026-08-13 13:41:08 +00:00
2026-08-13 03:27:19 +00:00
2026-08-13 00:39:04 +00:00
2026-08-07 11:30:17 +00:00
2026-08-13 00:00:16 +00:00
2026-08-11 19:16:15 +00:00
2026-08-13 12:00:19 +00:00
2026-08-13 11:11:26 +00:00
2026-07-20 06:13:29 +00:00
2026-08-13 12:35:56 +00:00
2026-08-13 12:04:29 +00:00
2026-08-12 17:49:36 +00:00
2026-08-07 19:56:29 +00:00
2026-07-31 21:37:56 +00:00
2026-07-23 23:35:29 +00:00
2026-05-28 23:09:55 -07:00
2026-08-10 15:50:53 +00:00
2026-08-13 12:04:29 +00:00
2026-08-10 11:22:55 +00:00
2026-08-07 18:33:46 +00:00
2026-08-10 22:12:14 +00:00
2026-06-12 19:52:49 +00:00
2026-08-11 15:52:59 +00:00
2026-07-22 04:17:34 +00:00
2026-08-12 22:04:27 +00:00
2026-08-13 00:00:16 +00:00
2026-08-13 12:04:29 +00:00
2026-07-17 20:52:42 +00:00
2026-08-05 14:20:59 +00:00
2026-08-04 22:07:56 +00:00
2026-08-12 19:37:51 +00:00
2026-08-12 22:33:18 +00:00
2026-07-30 04:26:36 +00:00
2026-08-13 02:40:49 +00:00
2026-08-10 14:25:13 +00:00
2026-05-25 17:26:10 -03:00
2026-08-13 01:52:02 +00:00
2026-08-13 13:41:08 +00:00
2026-08-07 18:33:46 +00:00
2026-08-12 20:36:32 +00:00
2026-08-13 12:04:29 +00:00
2026-08-06 03:11:42 +00:00
2026-08-11 17:47:22 +00:00
2026-05-26 20:59:47 -07:00
2026-08-10 15:43:10 +00:00
2026-08-08 16:58:26 +00:00
2026-08-08 16:58:26 +00:00
2026-08-12 18:04:20 +00:00
2026-08-13 12:04:29 +00:00
2026-08-04 03:49:53 +00:00
2026-08-13 00:00:16 +00:00
2026-08-13 12:04:29 +00:00
2026-08-12 19:37:51 +00:00
2026-08-13 04:08:23 +00:00
2026-08-13 11:11:26 +00:00
2026-07-22 16:18:08 +00:00
2026-06-13 21:43:39 -07:00
2026-07-24 00:16:42 +00:00
2026-08-11 22:22:18 +00:00
2026-08-12 13:27:57 +00:00
2026-07-09 17:31:44 -07:00
2026-08-13 12:35:56 +00:00
2026-08-13 11:11:26 +00:00
2026-07-28 20:49:22 +00:00
2026-07-11 03:27:51 +00:00
2026-07-29 13:53:15 +00:00
2026-08-11 23:40:07 +00:00
2026-06-04 09:16:03 -07:00
2026-05-26 20:59:47 -07:00
jif
a7e9fb5480