Sandbox bug - blocking shell

Describe the bug

Bug:  sandbox.enabled: false  is not honored — shell backend still initializes  BaseContainer  and fails with a WRITE_DAC error, making all shell execution impossible on Windows.
Version: 1.0.81-2 (win32-x64), Windows_NT. Config:  ~/.copilot/settings.json  shows  "sandbox":{"enabled":false,...} .
Error on every shell/tool call:  backend_unavailable: BaseContainer is unavailable; DACL fallback requires write-DAC permission on 'C:' (ERROR_ACCESS_DENIED, WRITE_DAC not granted) .
Repro: Set  sandbox.enabled:false ,  /restart  → shell still fails identically. Persisted ~8h across many restarts. Launching elevated crashes on start.  icacls "C:\Program Files\nodejs" /reset  advanced the failing path from  C:\Program Files\nodejs  →  C:\  (the DACL fallback walks up the tree;  BaseContainer  never initializes).
Expected: With sandbox disabled, run commands directly with no container/DACL step. At minimum, fail with a clear, actionable message instead of attempting WRITE_DAC on  C:\ .

Affected version

No response

Steps to reproduce the behavior

No response

Expected behavior

No response

Additional context

No response

まず、~/.copilot/settings.json で sandbox.enabled を false に設定した状態で Windows 上で問題を再現し、その後、その設定が shell backend にどのように到達するかを追跡します。sandbox を無効にすると BaseContainer と DACL の初期化が回避され、shell コマンドが WRITE_DAC エラーなしで実行されるか、明確で対処可能なエラーが出力されることを確認します。