Avoid creating metadata paths in the Windows sandbox - #33430
Merged
copyberry[bot] merged 1 commit intoJul 15, 2026
Merged
Conversation
## Why Elevated Windows sandbox setup could turn the built-in read-only protections for workspace metadata into deny-write paths, creating metadata directories that did not already exist. ## What changed - Track whether filesystem permission entries come from a built-in profile or were explicitly configured. - Exclude generated metadata defaults from direct Windows deny-write overrides while continuing to enforce explicit read-only carveouts for the same paths. - Preserve the distinction while materializing and normalizing permission paths, without exposing generated defaults as user configuration. ## Testing Added Windows coverage confirming that elevated sandbox setup leaves missing workspace metadata absent and still produces overrides for explicit metadata carveouts. GitOrigin-RevId: 701bcb229f631b18ab5ced22f3edf6f303d932f3
copyberry
Bot
force-pushed
the
copyberry/codex-internal-to-codex-oss/701bcb229f631b18ab5ced22f3edf6f303d932f3
branch
from
July 15, 2026 21:20
841c350 to
cb79b3c
Compare
copyberry
Bot
deleted the
copyberry/codex-internal-to-codex-oss/701bcb229f631b18ab5ced22f3edf6f303d932f3
branch
July 15, 2026 21:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Avoid creating metadata paths in the Windows sandbox
Why
Elevated Windows sandbox setup could turn the built-in read-only protections
for workspace metadata into deny-write paths, creating metadata directories
that did not already exist.
What changed
were explicitly configured.
while continuing to enforce explicit read-only carveouts for the same paths.
paths, without exposing generated defaults as user configuration.
Testing
Added Windows coverage confirming that elevated sandbox setup leaves missing
workspace metadata absent and still produces overrides for explicit metadata
carveouts.