feat(sandbox): Windows sandbox principals (foundation for #662, does not close it) - #808

Open

Vasanthdev2004 wants to merge 39 commits into

mainfrom

feat/windows-sandbox-identity

Commits on Aug 1, 2026

feat(sandbox): add Windows sandbox principals
Vasanthdev2004
committed
114fccc
feat(sandbox): use a sandbox principal for Windows command execution
Vasanthdev2004
committed
303724f
test(sandbox): name the per-shell env syntax in the provisioning skip
Vasanthdev2004
committed
4848980
test(sandbox): cover the logon-rights and token-minting half
Vasanthdev2004
committed
57eb9bc
feat(sandbox): provision a sandbox principal during elevated setup
Vasanthdev2004
committed
43bf81c
fix(sandbox): keep the restricted token when the network is denied
Vasanthdev2004
committed
1438f70
feat(sandbox): encrypt the stored principal password to the invoking user
Vasanthdev2004
committed
10b909d
fix(sandbox): surface a squatted principal name instead of falling back
Vasanthdev2004
committed
05633df
fix(sandbox): reset the password when the account already exists
Vasanthdev2004
committed
b36e3cd
fix(sandbox): revoke logon rights before deleting a principal
Vasanthdev2004
committed
bd02ba8
fix(sandbox): refuse a squatted account name and clean up partial provisioning
Vasanthdev2004
committed
78e5ec2
fix(sandbox): drop the stored secret whenever provisioning fails
Vasanthdev2004
committed
c8d36db
test(sandbox): check the ACE type before decoding its trustee
Vasanthdev2004
committed
760714d
fix(sandbox): grant delete to the principal and keep rollback able to find it
Vasanthdev2004
committed
c2cbb80
fix(sandbox): stop setup destroying a principal it did not create
Vasanthdev2004
committed
508e183
fix(sandbox): keep an adopted principal's logon rights on rollback
Vasanthdev2004
committed
2f9b31c
fix(sandbox): grant the principal the runtime tree commands write to
Vasanthdev2004
committed
ec9e131
fix(sandbox): refuse to adopt a principal in a privileged group
Vasanthdev2004
committed
1ecb460
fix(sandbox): materialize .git/config as a file, not a directory

Vasanthdev2004
and
claude
committed
7104a16
fix(sandbox): re-check principal privilege when minting a command token

Vasanthdev2004
and
claude
committed
3175939
fix(sandbox): revoke stale principal ACEs before re-applying the plan

Vasanthdev2004
and
claude
committed
bf303e2
fix(sandbox): revoke ACEs on teardown and key setup off the resolved root

Vasanthdev2004
and
claude
committed
91ae392
fix(sandbox): canonicalize the workspace root on both sides, not just setup

Vasanthdev2004
and
claude
committed
5ad6c65
fix(sandbox): normalize the cache root too, not just the workspace root

Vasanthdev2004
and
claude
committed
6e90d09
fix(sandbox): resolve through path segments that do not exist yet

Vasanthdev2004
and
claude
committed
f65ac36
test(sandbox): assert the ancestor walk, not the old all-or-nothing contract

Vasanthdev2004
and
claude
committed
7393239
fix(sandbox): close the delete-through-parent, junction-ancestor and rollback gaps

Vasanthdev2004
and
claude
committed
382792d
fix(sandbox): stop teardown creating a directory while naming one

Vasanthdev2004
and
claude
committed
e02272e
fix(sandbox): surface a failed stale-secret cleanup after rotation
Vasanthdev2004
committed
d84bc54
fix(sandbox): reject reparse ancestors before creating an ACL target
Vasanthdev2004
committed
dd3520a
fix(sandbox): keep the principal inside the Windows write jail
Vasanthdev2004
committed
331a265

Commits on Aug 3, 2026

Commits on Aug 7, 2026

Commits on Aug 8, 2026