diff --git a/cmd/sbox/sbox_proto/sbox.pb.go b/cmd/sbox/sbox_proto/sbox.pb.go
index b996481..7c84f2c 100644
--- a/cmd/sbox/sbox_proto/sbox.pb.go
+++ b/cmd/sbox/sbox_proto/sbox.pb.go
@@ -1,78 +1,104 @@
+// Copyright 2020 Google Inc. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 // Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.9.1
 // source: sbox.proto
 
 package sbox_proto
 
 import (
-	fmt "fmt"
-	proto "github.com/golang/protobuf/proto"
-	math "math"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
 )
 
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the proto package it is being compiled against.
-// A compilation error at this line likely means your copy of the
-// proto package needs to be updated.
-const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
 
 // A set of commands to run in a sandbox.
 type Manifest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
 	// A list of commands to run in the sandbox.
 	Commands []*Command `protobuf:"bytes,1,rep,name=commands" json:"commands,omitempty"`
 	// If set, GCC-style dependency files from any command that references __SBOX_DEPFILE__ will be
 	// merged into the given output file relative to the $PWD when sbox was started.
-	OutputDepfile        *string  `protobuf:"bytes,2,opt,name=output_depfile,json=outputDepfile" json:"output_depfile,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	OutputDepfile *string `protobuf:"bytes,2,opt,name=output_depfile,json=outputDepfile" json:"output_depfile,omitempty"`
 }
 
-func (m *Manifest) Reset()         { *m = Manifest{} }
-func (m *Manifest) String() string { return proto.CompactTextString(m) }
-func (*Manifest) ProtoMessage()    {}
+func (x *Manifest) Reset() {
+	*x = Manifest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_sbox_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Manifest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Manifest) ProtoMessage() {}
+
+func (x *Manifest) ProtoReflect() protoreflect.Message {
+	mi := &file_sbox_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Manifest.ProtoReflect.Descriptor instead.
 func (*Manifest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9d0425bf0de86ed1, []int{0}
+	return file_sbox_proto_rawDescGZIP(), []int{0}
 }
 
-func (m *Manifest) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_Manifest.Unmarshal(m, b)
-}
-func (m *Manifest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_Manifest.Marshal(b, m, deterministic)
-}
-func (m *Manifest) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Manifest.Merge(m, src)
-}
-func (m *Manifest) XXX_Size() int {
-	return xxx_messageInfo_Manifest.Size(m)
-}
-func (m *Manifest) XXX_DiscardUnknown() {
-	xxx_messageInfo_Manifest.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Manifest proto.InternalMessageInfo
-
-func (m *Manifest) GetCommands() []*Command {
-	if m != nil {
-		return m.Commands
+func (x *Manifest) GetCommands() []*Command {
+	if x != nil {
+		return x.Commands
 	}
 	return nil
 }
 
-func (m *Manifest) GetOutputDepfile() string {
-	if m != nil && m.OutputDepfile != nil {
-		return *m.OutputDepfile
+func (x *Manifest) GetOutputDepfile() string {
+	if x != nil && x.OutputDepfile != nil {
+		return *x.OutputDepfile
 	}
 	return ""
 }
 
 // SandboxManifest describes a command to run in the sandbox.
 type Command struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
 	// A list of copy rules to run before the sandboxed command.  The from field is relative to the
 	// $PWD when sbox was run, the to field is relative to the top of the temporary sandbox directory.
 	CopyBefore []*Copy `protobuf:"bytes,1,rep,name=copy_before,json=copyBefore" json:"copy_before,omitempty"`
@@ -89,75 +115,79 @@
 	InputHash *string `protobuf:"bytes,5,opt,name=input_hash,json=inputHash" json:"input_hash,omitempty"`
 	// A list of files that will be copied before the sandboxed command, and whose contents should be
 	// copied as if they were listed in copy_before.
-	RspFiles             []*RspFile `protobuf:"bytes,6,rep,name=rsp_files,json=rspFiles" json:"rsp_files,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}   `json:"-"`
-	XXX_unrecognized     []byte     `json:"-"`
-	XXX_sizecache        int32      `json:"-"`
+	RspFiles []*RspFile `protobuf:"bytes,6,rep,name=rsp_files,json=rspFiles" json:"rsp_files,omitempty"`
 }
 
-func (m *Command) Reset()         { *m = Command{} }
-func (m *Command) String() string { return proto.CompactTextString(m) }
-func (*Command) ProtoMessage()    {}
+func (x *Command) Reset() {
+	*x = Command{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_sbox_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Command) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Command) ProtoMessage() {}
+
+func (x *Command) ProtoReflect() protoreflect.Message {
+	mi := &file_sbox_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Command.ProtoReflect.Descriptor instead.
 func (*Command) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9d0425bf0de86ed1, []int{1}
+	return file_sbox_proto_rawDescGZIP(), []int{1}
 }
 
-func (m *Command) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_Command.Unmarshal(m, b)
-}
-func (m *Command) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_Command.Marshal(b, m, deterministic)
-}
-func (m *Command) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Command.Merge(m, src)
-}
-func (m *Command) XXX_Size() int {
-	return xxx_messageInfo_Command.Size(m)
-}
-func (m *Command) XXX_DiscardUnknown() {
-	xxx_messageInfo_Command.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Command proto.InternalMessageInfo
-
-func (m *Command) GetCopyBefore() []*Copy {
-	if m != nil {
-		return m.CopyBefore
+func (x *Command) GetCopyBefore() []*Copy {
+	if x != nil {
+		return x.CopyBefore
 	}
 	return nil
 }
 
-func (m *Command) GetChdir() bool {
-	if m != nil && m.Chdir != nil {
-		return *m.Chdir
+func (x *Command) GetChdir() bool {
+	if x != nil && x.Chdir != nil {
+		return *x.Chdir
 	}
 	return false
 }
 
-func (m *Command) GetCommand() string {
-	if m != nil && m.Command != nil {
-		return *m.Command
+func (x *Command) GetCommand() string {
+	if x != nil && x.Command != nil {
+		return *x.Command
 	}
 	return ""
 }
 
-func (m *Command) GetCopyAfter() []*Copy {
-	if m != nil {
-		return m.CopyAfter
+func (x *Command) GetCopyAfter() []*Copy {
+	if x != nil {
+		return x.CopyAfter
 	}
 	return nil
 }
 
-func (m *Command) GetInputHash() string {
-	if m != nil && m.InputHash != nil {
-		return *m.InputHash
+func (x *Command) GetInputHash() string {
+	if x != nil && x.InputHash != nil {
+		return *x.InputHash
 	}
 	return ""
 }
 
-func (m *Command) GetRspFiles() []*RspFile {
-	if m != nil {
-		return m.RspFiles
+func (x *Command) GetRspFiles() []*RspFile {
+	if x != nil {
+		return x.RspFiles
 	}
 	return nil
 }
@@ -166,193 +196,341 @@
 // are relative to is specific to the context the Copy is used in and will be different for
 // from and to.
 type Copy struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
 	From *string `protobuf:"bytes,1,req,name=from" json:"from,omitempty"`
 	To   *string `protobuf:"bytes,2,req,name=to" json:"to,omitempty"`
 	// If true, make the file executable after copying it.
-	Executable           *bool    `protobuf:"varint,3,opt,name=executable" json:"executable,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	Executable *bool `protobuf:"varint,3,opt,name=executable" json:"executable,omitempty"`
 }
 
-func (m *Copy) Reset()         { *m = Copy{} }
-func (m *Copy) String() string { return proto.CompactTextString(m) }
-func (*Copy) ProtoMessage()    {}
+func (x *Copy) Reset() {
+	*x = Copy{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_sbox_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Copy) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Copy) ProtoMessage() {}
+
+func (x *Copy) ProtoReflect() protoreflect.Message {
+	mi := &file_sbox_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Copy.ProtoReflect.Descriptor instead.
 func (*Copy) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9d0425bf0de86ed1, []int{2}
+	return file_sbox_proto_rawDescGZIP(), []int{2}
 }
 
-func (m *Copy) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_Copy.Unmarshal(m, b)
-}
-func (m *Copy) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_Copy.Marshal(b, m, deterministic)
-}
-func (m *Copy) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Copy.Merge(m, src)
-}
-func (m *Copy) XXX_Size() int {
-	return xxx_messageInfo_Copy.Size(m)
-}
-func (m *Copy) XXX_DiscardUnknown() {
-	xxx_messageInfo_Copy.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Copy proto.InternalMessageInfo
-
-func (m *Copy) GetFrom() string {
-	if m != nil && m.From != nil {
-		return *m.From
+func (x *Copy) GetFrom() string {
+	if x != nil && x.From != nil {
+		return *x.From
 	}
 	return ""
 }
 
-func (m *Copy) GetTo() string {
-	if m != nil && m.To != nil {
-		return *m.To
+func (x *Copy) GetTo() string {
+	if x != nil && x.To != nil {
+		return *x.To
 	}
 	return ""
 }
 
-func (m *Copy) GetExecutable() bool {
-	if m != nil && m.Executable != nil {
-		return *m.Executable
+func (x *Copy) GetExecutable() bool {
+	if x != nil && x.Executable != nil {
+		return *x.Executable
 	}
 	return false
 }
 
 // RspFile describes an rspfile that should be copied into the sandbox directory.
 type RspFile struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
 	// The path to the rsp file.
 	File *string `protobuf:"bytes,1,req,name=file" json:"file,omitempty"`
 	// A list of path mappings that should be applied to each file listed in the rsp file.
-	PathMappings         []*PathMapping `protobuf:"bytes,2,rep,name=path_mappings,json=pathMappings" json:"path_mappings,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}       `json:"-"`
-	XXX_unrecognized     []byte         `json:"-"`
-	XXX_sizecache        int32          `json:"-"`
+	PathMappings []*PathMapping `protobuf:"bytes,2,rep,name=path_mappings,json=pathMappings" json:"path_mappings,omitempty"`
 }
 
-func (m *RspFile) Reset()         { *m = RspFile{} }
-func (m *RspFile) String() string { return proto.CompactTextString(m) }
-func (*RspFile) ProtoMessage()    {}
+func (x *RspFile) Reset() {
+	*x = RspFile{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_sbox_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RspFile) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RspFile) ProtoMessage() {}
+
+func (x *RspFile) ProtoReflect() protoreflect.Message {
+	mi := &file_sbox_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RspFile.ProtoReflect.Descriptor instead.
 func (*RspFile) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9d0425bf0de86ed1, []int{3}
+	return file_sbox_proto_rawDescGZIP(), []int{3}
 }
 
-func (m *RspFile) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_RspFile.Unmarshal(m, b)
-}
-func (m *RspFile) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_RspFile.Marshal(b, m, deterministic)
-}
-func (m *RspFile) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_RspFile.Merge(m, src)
-}
-func (m *RspFile) XXX_Size() int {
-	return xxx_messageInfo_RspFile.Size(m)
-}
-func (m *RspFile) XXX_DiscardUnknown() {
-	xxx_messageInfo_RspFile.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_RspFile proto.InternalMessageInfo
-
-func (m *RspFile) GetFile() string {
-	if m != nil && m.File != nil {
-		return *m.File
+func (x *RspFile) GetFile() string {
+	if x != nil && x.File != nil {
+		return *x.File
 	}
 	return ""
 }
 
-func (m *RspFile) GetPathMappings() []*PathMapping {
-	if m != nil {
-		return m.PathMappings
+func (x *RspFile) GetPathMappings() []*PathMapping {
+	if x != nil {
+		return x.PathMappings
 	}
 	return nil
 }
 
 // PathMapping describes a mapping from a path outside the sandbox to the path inside the sandbox.
 type PathMapping struct {
-	From                 *string  `protobuf:"bytes,1,req,name=from" json:"from,omitempty"`
-	To                   *string  `protobuf:"bytes,2,req,name=to" json:"to,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	From *string `protobuf:"bytes,1,req,name=from" json:"from,omitempty"`
+	To   *string `protobuf:"bytes,2,req,name=to" json:"to,omitempty"`
 }
 
-func (m *PathMapping) Reset()         { *m = PathMapping{} }
-func (m *PathMapping) String() string { return proto.CompactTextString(m) }
-func (*PathMapping) ProtoMessage()    {}
+func (x *PathMapping) Reset() {
+	*x = PathMapping{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_sbox_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PathMapping) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PathMapping) ProtoMessage() {}
+
+func (x *PathMapping) ProtoReflect() protoreflect.Message {
+	mi := &file_sbox_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PathMapping.ProtoReflect.Descriptor instead.
 func (*PathMapping) Descriptor() ([]byte, []int) {
-	return fileDescriptor_9d0425bf0de86ed1, []int{4}
+	return file_sbox_proto_rawDescGZIP(), []int{4}
 }
 
-func (m *PathMapping) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_PathMapping.Unmarshal(m, b)
-}
-func (m *PathMapping) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_PathMapping.Marshal(b, m, deterministic)
-}
-func (m *PathMapping) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_PathMapping.Merge(m, src)
-}
-func (m *PathMapping) XXX_Size() int {
-	return xxx_messageInfo_PathMapping.Size(m)
-}
-func (m *PathMapping) XXX_DiscardUnknown() {
-	xxx_messageInfo_PathMapping.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_PathMapping proto.InternalMessageInfo
-
-func (m *PathMapping) GetFrom() string {
-	if m != nil && m.From != nil {
-		return *m.From
+func (x *PathMapping) GetFrom() string {
+	if x != nil && x.From != nil {
+		return *x.From
 	}
 	return ""
 }
 
-func (m *PathMapping) GetTo() string {
-	if m != nil && m.To != nil {
-		return *m.To
+func (x *PathMapping) GetTo() string {
+	if x != nil && x.To != nil {
+		return *x.To
 	}
 	return ""
 }
 
-func init() {
-	proto.RegisterType((*Manifest)(nil), "sbox.Manifest")
-	proto.RegisterType((*Command)(nil), "sbox.Command")
-	proto.RegisterType((*Copy)(nil), "sbox.Copy")
-	proto.RegisterType((*RspFile)(nil), "sbox.RspFile")
-	proto.RegisterType((*PathMapping)(nil), "sbox.PathMapping")
+var File_sbox_proto protoreflect.FileDescriptor
+
+var file_sbox_proto_rawDesc = []byte{
+	0x0a, 0x0a, 0x73, 0x62, 0x6f, 0x78, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x04, 0x73, 0x62,
+	0x6f, 0x78, 0x22, 0x5c, 0x0a, 0x08, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x12, 0x29,
+	0x0a, 0x08, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x0d, 0x2e, 0x73, 0x62, 0x6f, 0x78, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x52,
+	0x08, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x6f, 0x75, 0x74,
+	0x70, 0x75, 0x74, 0x5f, 0x64, 0x65, 0x70, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0d, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x44, 0x65, 0x70, 0x66, 0x69, 0x6c, 0x65,
+	0x22, 0xdc, 0x01, 0x0a, 0x07, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x2b, 0x0a, 0x0b,
+	0x63, 0x6f, 0x70, 0x79, 0x5f, 0x62, 0x65, 0x66, 0x6f, 0x72, 0x65, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x0a, 0x2e, 0x73, 0x62, 0x6f, 0x78, 0x2e, 0x43, 0x6f, 0x70, 0x79, 0x52, 0x0a, 0x63,
+	0x6f, 0x70, 0x79, 0x42, 0x65, 0x66, 0x6f, 0x72, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x63, 0x68, 0x64,
+	0x69, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x63, 0x68, 0x64, 0x69, 0x72, 0x12,
+	0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x18, 0x03, 0x20, 0x02, 0x28, 0x09,
+	0x52, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x29, 0x0a, 0x0a, 0x63, 0x6f, 0x70,
+	0x79, 0x5f, 0x61, 0x66, 0x74, 0x65, 0x72, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0a, 0x2e,
+	0x73, 0x62, 0x6f, 0x78, 0x2e, 0x43, 0x6f, 0x70, 0x79, 0x52, 0x09, 0x63, 0x6f, 0x70, 0x79, 0x41,
+	0x66, 0x74, 0x65, 0x72, 0x12, 0x1d, 0x0a, 0x0a, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x5f, 0x68, 0x61,
+	0x73, 0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x48,
+	0x61, 0x73, 0x68, 0x12, 0x2a, 0x0a, 0x09, 0x72, 0x73, 0x70, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x73,
+	0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x73, 0x62, 0x6f, 0x78, 0x2e, 0x52, 0x73,
+	0x70, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x08, 0x72, 0x73, 0x70, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x22,
+	0x4a, 0x0a, 0x04, 0x43, 0x6f, 0x70, 0x79, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x72, 0x6f, 0x6d, 0x18,
+	0x01, 0x20, 0x02, 0x28, 0x09, 0x52, 0x04, 0x66, 0x72, 0x6f, 0x6d, 0x12, 0x0e, 0x0a, 0x02, 0x74,
+	0x6f, 0x18, 0x02, 0x20, 0x02, 0x28, 0x09, 0x52, 0x02, 0x74, 0x6f, 0x12, 0x1e, 0x0a, 0x0a, 0x65,
+	0x78, 0x65, 0x63, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x0a, 0x65, 0x78, 0x65, 0x63, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x22, 0x55, 0x0a, 0x07, 0x52,
+	0x73, 0x70, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x01,
+	0x20, 0x02, 0x28, 0x09, 0x52, 0x04, 0x66, 0x69, 0x6c, 0x65, 0x12, 0x36, 0x0a, 0x0d, 0x70, 0x61,
+	0x74, 0x68, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x11, 0x2e, 0x73, 0x62, 0x6f, 0x78, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70,
+	0x70, 0x69, 0x6e, 0x67, 0x52, 0x0c, 0x70, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0x73, 0x22, 0x31, 0x0a, 0x0b, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x72, 0x6f, 0x6d, 0x18, 0x01, 0x20, 0x02, 0x28, 0x09, 0x52,
+	0x04, 0x66, 0x72, 0x6f, 0x6d, 0x12, 0x0e, 0x0a, 0x02, 0x74, 0x6f, 0x18, 0x02, 0x20, 0x02, 0x28,
+	0x09, 0x52, 0x02, 0x74, 0x6f, 0x42, 0x23, 0x5a, 0x21, 0x61, 0x6e, 0x64, 0x72, 0x6f, 0x69, 0x64,
+	0x2f, 0x73, 0x6f, 0x6f, 0x6e, 0x67, 0x2f, 0x63, 0x6d, 0x64, 0x2f, 0x73, 0x62, 0x6f, 0x78, 0x2f,
+	0x73, 0x62, 0x6f, 0x78, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
 }
 
-func init() {
-	proto.RegisterFile("sbox.proto", fileDescriptor_9d0425bf0de86ed1)
+var (
+	file_sbox_proto_rawDescOnce sync.Once
+	file_sbox_proto_rawDescData = file_sbox_proto_rawDesc
+)
+
+func file_sbox_proto_rawDescGZIP() []byte {
+	file_sbox_proto_rawDescOnce.Do(func() {
+		file_sbox_proto_rawDescData = protoimpl.X.CompressGZIP(file_sbox_proto_rawDescData)
+	})
+	return file_sbox_proto_rawDescData
 }
 
-var fileDescriptor_9d0425bf0de86ed1 = []byte{
-	// 342 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x92, 0x5f, 0x4b, 0xc3, 0x30,
-	0x14, 0xc5, 0x69, 0xd7, 0xb9, 0xf6, 0xee, 0x0f, 0x18, 0x7c, 0xc8, 0x8b, 0x32, 0x0a, 0xc2, 0xa6,
-	0x30, 0xd0, 0x07, 0xdf, 0x9d, 0x22, 0x22, 0x0c, 0x24, 0xe0, 0x8b, 0x08, 0x25, 0xeb, 0x52, 0x5b,
-	0x58, 0x9b, 0x90, 0x64, 0xb0, 0x7d, 0x57, 0x3f, 0x8c, 0xe4, 0xa6, 0xd3, 0x82, 0x2f, 0xbe, 0xdd,
-	0x7b, 0x0e, 0xf7, 0xdc, 0x5f, 0xc2, 0x05, 0x30, 0x6b, 0xb9, 0x5f, 0x28, 0x2d, 0xad, 0x24, 0x91,
-	0xab, 0xd3, 0x0f, 0x88, 0x57, 0xbc, 0xa9, 0x0a, 0x61, 0x2c, 0x99, 0x43, 0x9c, 0xcb, 0xba, 0xe6,
-	0xcd, 0xc6, 0xd0, 0x60, 0xda, 0x9b, 0x0d, 0x6f, 0xc7, 0x0b, 0x1c, 0x78, 0xf0, 0x2a, 0xfb, 0xb1,
-	0xc9, 0x25, 0x4c, 0xe4, 0xce, 0xaa, 0x9d, 0xcd, 0x36, 0x42, 0x15, 0xd5, 0x56, 0xd0, 0x70, 0x1a,
-	0xcc, 0x12, 0x36, 0xf6, 0xea, 0xa3, 0x17, 0xd3, 0xaf, 0x00, 0x06, 0xed, 0x30, 0xb9, 0x86, 0x61,
-	0x2e, 0xd5, 0x21, 0x5b, 0x8b, 0x42, 0x6a, 0xd1, 0x2e, 0x80, 0xe3, 0x02, 0x75, 0x60, 0xe0, 0xec,
-	0x25, 0xba, 0xe4, 0x0c, 0xfa, 0x79, 0xb9, 0xa9, 0x34, 0xc6, 0xc6, 0xcc, 0x37, 0x84, 0xc2, 0xa0,
-	0x25, 0xa0, 0xbd, 0x69, 0x38, 0x4b, 0xd8, 0xb1, 0x25, 0x73, 0xc0, 0xe9, 0x8c, 0x17, 0x56, 0x68,
-	0x1a, 0xfd, 0xc9, 0x4e, 0x9c, 0x7b, 0xef, 0x4c, 0x72, 0x0e, 0x50, 0x35, 0x8e, 0xbc, 0xe4, 0xa6,
-	0xa4, 0x7d, 0xc4, 0x4e, 0x50, 0x79, 0xe6, 0xa6, 0x24, 0x57, 0x90, 0x68, 0xa3, 0x32, 0x87, 0x6f,
-	0xe8, 0x49, 0xf7, 0x17, 0x98, 0x51, 0x4f, 0xd5, 0x56, 0xb0, 0x58, 0xfb, 0xc2, 0xa4, 0x2f, 0x10,
-	0xb9, 0x74, 0x42, 0x20, 0x2a, 0xb4, 0xac, 0x69, 0x80, 0x50, 0x58, 0x93, 0x09, 0x84, 0x56, 0xd2,
-	0x10, 0x95, 0xd0, 0x4a, 0x72, 0x01, 0x20, 0xf6, 0x22, 0xdf, 0x59, 0xbe, 0xde, 0x0a, 0xda, 0xc3,
-	0x67, 0x75, 0x94, 0xf4, 0x0d, 0x06, 0xed, 0x02, 0x8c, 0x73, 0x5f, 0x7a, 0x8c, 0x73, 0xda, 0x1d,
-	0x8c, 0x15, 0xb7, 0x65, 0x56, 0x73, 0xa5, 0xaa, 0xe6, 0xd3, 0xd0, 0x10, 0xd1, 0x4e, 0x3d, 0xda,
-	0x2b, 0xb7, 0xe5, 0xca, 0x3b, 0x6c, 0xa4, 0x7e, 0x1b, 0x93, 0xde, 0xc0, 0xb0, 0x63, 0xfe, 0x87,
-	0x74, 0x39, 0x7a, 0xc7, 0x33, 0xc9, 0xf0, 0x4c, 0xbe, 0x03, 0x00, 0x00, 0xff, 0xff, 0x83, 0x82,
-	0xb0, 0xc3, 0x33, 0x02, 0x00, 0x00,
+var file_sbox_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_sbox_proto_goTypes = []interface{}{
+	(*Manifest)(nil),    // 0: sbox.Manifest
+	(*Command)(nil),     // 1: sbox.Command
+	(*Copy)(nil),        // 2: sbox.Copy
+	(*RspFile)(nil),     // 3: sbox.RspFile
+	(*PathMapping)(nil), // 4: sbox.PathMapping
+}
+var file_sbox_proto_depIdxs = []int32{
+	1, // 0: sbox.Manifest.commands:type_name -> sbox.Command
+	2, // 1: sbox.Command.copy_before:type_name -> sbox.Copy
+	2, // 2: sbox.Command.copy_after:type_name -> sbox.Copy
+	3, // 3: sbox.Command.rsp_files:type_name -> sbox.RspFile
+	4, // 4: sbox.RspFile.path_mappings:type_name -> sbox.PathMapping
+	5, // [5:5] is the sub-list for method output_type
+	5, // [5:5] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_sbox_proto_init() }
+func file_sbox_proto_init() {
+	if File_sbox_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_sbox_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Manifest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_sbox_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Command); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_sbox_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Copy); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_sbox_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RspFile); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_sbox_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PathMapping); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_sbox_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   5,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_sbox_proto_goTypes,
+		DependencyIndexes: file_sbox_proto_depIdxs,
+		MessageInfos:      file_sbox_proto_msgTypes,
+	}.Build()
+	File_sbox_proto = out.File
+	file_sbox_proto_rawDesc = nil
+	file_sbox_proto_goTypes = nil
+	file_sbox_proto_depIdxs = nil
 }
diff --git a/cmd/sbox/sbox_proto/sbox.proto b/cmd/sbox/sbox_proto/sbox.proto
index bdf92c6..2f0dcf0 100644
--- a/cmd/sbox/sbox_proto/sbox.proto
+++ b/cmd/sbox/sbox_proto/sbox.proto
@@ -15,7 +15,7 @@
 syntax = "proto2";
 
 package sbox;
-option go_package = "sbox_proto";
+option go_package = "android/soong/cmd/sbox/sbox_proto";
 
 // A set of commands to run in a sandbox.
 message Manifest {