fix(ci): restore deny_read_paths test fixtures

codex-rs/linux-sandbox/src/bwrap.rs

@@ -34,22 +34,6 @@ const LINUX_PLATFORM_DEFAULT_READ_ROOTS: &[&str] = &[
     "/run/current-system/sw",
 ];
 
-/// Linux "platform defaults" that keep common system binaries and dynamic
-/// libraries readable when `ReadOnlyAccess::Restricted` requests them.
-///
-/// These are intentionally system-level paths only (plus Nix store roots) so
-/// `include_platform_defaults` does not silently widen access to user data.
-const LINUX_PLATFORM_DEFAULT_READ_ROOTS: &[&str] = &[
-    "/bin",
-    "/sbin",
-    "/usr",
-    "/etc",
-    "/lib",
-    "/lib64",
-    "/nix/store",
-    "/run/current-system/sw",
-];
-
 /// Options that control how bubblewrap is invoked.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(crate) struct BwrapOptions {

codex-rs/windows-sandbox-rs/src/allow.rs

@@ -110,6 +110,7 @@ mod tests {
 
         let policy = SandboxPolicy::WorkspaceWrite {
             writable_roots: vec![AbsolutePathBuf::try_from(extra_root.as_path()).unwrap()],
+            deny_read_paths: vec![],
             read_only_access: Default::default(),
             network_access: false,
             exclude_tmpdir_env_var: false,
@@ -137,6 +138,7 @@ mod tests {
 
         let policy = SandboxPolicy::WorkspaceWrite {
             writable_roots: vec![],
+            deny_read_paths: vec![],
             read_only_access: Default::default(),
             network_access: false,
             exclude_tmpdir_env_var: true,
@@ -165,6 +167,7 @@ mod tests {
 
         let policy = SandboxPolicy::WorkspaceWrite {
             writable_roots: vec![],
+            deny_read_paths: vec![],
             read_only_access: Default::default(),
             network_access: false,
             exclude_tmpdir_env_var: true,
@@ -193,6 +196,7 @@ mod tests {
 
         let policy = SandboxPolicy::WorkspaceWrite {
             writable_roots: vec![],
+            deny_read_paths: vec![],
             read_only_access: Default::default(),
             network_access: false,
             exclude_tmpdir_env_var: true,
@@ -222,6 +226,7 @@ mod tests {
 
         let policy = SandboxPolicy::WorkspaceWrite {
             writable_roots: vec![],
+            deny_read_paths: vec![],
             read_only_access: Default::default(),
             network_access: false,
             exclude_tmpdir_env_var: true,
@@ -251,6 +256,7 @@ mod tests {
 
         let policy = SandboxPolicy::WorkspaceWrite {
             writable_roots: vec![],
+            deny_read_paths: vec![],
             read_only_access: Default::default(),
             network_access: false,
             exclude_tmpdir_env_var: true,

codex-rs/windows-sandbox-rs/src/elevated_impl.rs

@@ -474,6 +474,7 @@ mod windows_impl {
         fn workspace_policy(network_access: bool) -> SandboxPolicy {
             SandboxPolicy::WorkspaceWrite {
                 writable_roots: Vec::new(),
+                deny_read_paths: Vec::new(),
                 read_only_access: Default::default(),
                 network_access,
                 exclude_tmpdir_env_var: false,

codex-rs/windows-sandbox-rs/src/lib.rs

@@ -570,6 +570,7 @@ mod windows_impl {
         fn workspace_policy(network_access: bool) -> SandboxPolicy {
             SandboxPolicy::WorkspaceWrite {
                 writable_roots: Vec::new(),
+                deny_read_paths: Vec::new(),
                 read_only_access: Default::default(),
                 network_access,
                 exclude_tmpdir_env_var: false,