feat(automation): support qualified single-user Windows operation

automation/tests/fake_codex.py

@@ -12,7 +12,10 @@ if args[0] == 'exec':
         sys.exit(17)
     if Path('simulate-timeout').exists():
         time.sleep(60)
-    if '--sandbox' not in args or args[args.index('--sandbox') + 1] != 'workspace-write':
+    legacy = '--sandbox' in args and args[args.index('--sandbox') + 1] == 'workspace-write'
+    local = ('default_permissions="jobjakt-local"' in args and 'windows.sandbox="mxc"' in args
+             and 'permissions.jobjakt-local.network.enabled=false' in args)
+    if not (legacy or local):
         sys.exit(18)
     checkpoint = 'work'
     Path('result.txt').write_text('subprocess worker output', encoding='utf-8')
@@ -24,8 +27,16 @@ if args[0] == 'exec':
 elif args[0] == 'sandbox':
     # Remove known sandbox switches; execute the real deterministic check in the disposable repo.
     index = 1
-    while args[index] in ('-C', '-c'):
-        index += 2
+    while index < len(args):
+        if args[index] in ('-C','-c','--permission-profile'):
+            index += 2
+        elif args[index] == '--include-managed-config':
+            index += 1
+        elif args[index] == '--':
+            index += 1
+            break
+        else:
+            break
     sys.exit(subprocess.run(args[index:], cwd=Path.cwd()).returncode)
 else:
     sys.exit(19)