fix(core): adapt workspace tools to path uris

codex-rs/core/src/tools/handlers/extension_tools.rs

@@ -112,6 +112,7 @@ impl TurnItemEmitter for CoreTurnItemEmitter {
 async fn to_extension_call(invocation: &ToolInvocation) -> ExtensionToolCall {
     let conversation_history =
         ConversationHistory::new(invocation.session.clone_history().await.into_raw_items());
+    let permission_profile = invocation.turn.permission_profile();
     let mut environments = Vec::with_capacity(invocation.turn.environments.turn_environments.len());
     for environment in &invocation.turn.environments.turn_environments {
         let additional_permissions = apply_granted_turn_permissions(
@@ -129,7 +130,11 @@ async fn to_extension_call(invocation: &ToolInvocation) -> ExtensionToolCall {
             file_system: environment.environment.get_filesystem(),
             file_system_sandbox_context: invocation
                 .turn
-                .file_system_sandbox_context(additional_permissions, &environment.cwd),
+                .file_system_sandbox_context_for_permission_profile(
+                    &permission_profile,
+                    additional_permissions,
+                    &environment.cwd,
+                ),
         });
     }
     ExtensionToolCall {

codex-rs/core/src/tools/handlers/workspace_mutation.rs

@@ -28,6 +28,7 @@ use codex_sandboxing::policy_transforms::intersect_permission_profiles;
 use codex_tools::ToolName;
 use codex_tools::ToolSpec;
 use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_path_uri::PathUri;
 use serde::Deserialize;
 use serde::Serialize;
 use std::io;
@@ -596,8 +597,10 @@ async fn resolve_workspace_directory(
     requested: &AbsolutePathBuf,
     sandbox: &FileSystemSandboxContext,
 ) -> io::Result<AbsolutePathBuf> {
-    let canonical = fs.canonicalize(requested, Some(sandbox)).await?;
+    let requested = PathUri::from_abs_path(requested)?;
+    let canonical = fs.canonicalize(&requested, Some(sandbox)).await?;
     let metadata = fs.get_metadata(&canonical, Some(sandbox)).await?;
+    let canonical = canonical.to_abs_path()?;
     if metadata.is_directory {
         Ok(canonical)
     } else {