Separate Windows sandbox provisioning from ACL refresh - #42309
Merged
copyberry[bot] merged 1 commit intoSep 2, 2026
Merged
copyberry[bot] merged 1 commit into
copyberry[bot] merged 1 commit into
Conversation
## What changed - Limit elevated interactive setup to provisioning sandbox identities and proxy settings; do not include caller workspace or ACL roots in its payload. - Always run the non-elevated setup refresh during sandbox activation so the current permission profile supplies read, write, and deny paths, including when provisioning was completed previously. - Add an `interactive-provision` setup mode that performs provisioning without the full ACL setup path. ## Testing - Verify elevated provisioning payloads contain no caller ACL roots and use the new mode. - Verify the setup helper accepts `interactive-provision` payloads. GitOrigin-RevId: 081b1b43abd2388773c230fb35da82896e7be2ea
copyberry
Bot
force-pushed
the
copyberry/codex-internal-to-codex-oss/081b1b43abd2388773c230fb35da82896e7be2ea
branch
from
September 2, 2026 16:51
d1a821b to
1bc8fb1
Compare
copyberry
Bot
deleted the
copyberry/codex-internal-to-codex-oss/081b1b43abd2388773c230fb35da82896e7be2ea
branch
September 2, 2026 16:52
Ruuben80
temporarily deployed
to
issue-triage
September 2, 2026 16:56 — with 
GitHub Actions
Inactive
Ruuben80
temporarily deployed
to
issue-triage
September 2, 2026 16:56 — with
GitHub Actions
Inactive
Ruuben80
temporarily deployed
to
issue-triage
September 2, 2026 16:56 — with
GitHub Actions
Inactive
kevingb24
temporarily deployed
to
issue-triage
September 2, 2026 17:00 — with
GitHub Actions
Inactive
kevingb24
temporarily deployed
to
issue-triage
September 2, 2026 17:00 — with
GitHub Actions
Inactive
kevingb24
temporarily deployed
to
issue-triage
September 2, 2026 17:00 — with
GitHub Actions
Inactive
figmccurdy
temporarily deployed
to
issue-triage
September 2, 2026 17:07 — with
GitHub Actions
Inactive
figmccurdy
temporarily deployed
to
issue-triage
September 2, 2026 17:07 — with
GitHub Actions
Inactive
figmccurdy
temporarily deployed
to
issue-triage
September 2, 2026 17:07 — with
GitHub Actions
Inactive
Trafalgar-Du
temporarily deployed
to
issue-triage
September 2, 2026 17:15 — with
GitHub Actions
Inactive
Trafalgar-Du
temporarily deployed
to
issue-triage
September 2, 2026 17:15 — with
GitHub Actions
Inactive
Trafalgar-Du
temporarily deployed
to
issue-triage
September 2, 2026 17:15 — with
GitHub Actions
Inactive
Trafalgar-Du
temporarily deployed
to
issue-triage
September 2, 2026 17:16 — with
GitHub Actions
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Separate Windows sandbox provisioning from ACL refresh
What changed
interactive-provisionsetup mode that performs provisioning without the full ACL setup path.Testing
interactive-provisionpayloads.