POC - Configurable ReadAcess in WorkspaceWrite SandboxPolicy

codex-rs/tui/src/chatwidget/tests.rs

@@ -3490,6 +3490,7 @@ async fn preset_matching_ignores_extra_writable_roots() {
         network_access: false,
         exclude_tmpdir_env_var: false,
         exclude_slash_tmp: false,
+        read_access: Default::default(),
     };
 
     assert!(

codex-rs/tui/src/status/tests.rs

@@ -103,6 +103,7 @@ async fn status_snapshot_includes_reasoning_details() {
             network_access: false,
             exclude_tmpdir_env_var: false,
             exclude_slash_tmp: false,
+            read_access: Default::default(),
         })
         .expect("set sandbox policy");