Extract Windows deny-read glob scan planning into protocol (#43903)

Move lexical scan-bound calculation into `codex_protocol::permissions` and
expose `windows_deny_read_glob_scan` with its `WindowsDenyReadGlobScan` result.
Have the Windows sandbox resolver use the shared helper, preserving literal
scan roots, glob suffixes, and traversal depth limits without filesystem access
in the planner.

GitOrigin-RevId: 748a12b45f89c6e045e9123c055453ec39c202b1

codex-rs/protocol/src/permissions.rs

@@ -24,6 +24,11 @@ use crate::protocol::NetworkAccess;
 use crate::protocol::SandboxPolicy;
 use crate::protocol::WritableRoot;
 
+mod windows_glob;
+
+pub use windows_glob::WindowsDenyReadGlobScan;
+pub use windows_glob::windows_deny_read_glob_scan;
+
 const PROTECTED_METADATA_GIT_PATH_NAME: &str = ".git";
 const PROTECTED_METADATA_AGENTS_PATH_NAME: &str = ".agents";
 const PROTECTED_METADATA_CODEX_PATH_NAME: &str = ".codex";

codex-rs/protocol/src/permissions/windows_glob.rs

@@ -0,0 +1,43 @@
+//! Windows deny-glob scan bounds shared by policy validation and native ACL expansion.
+
+/// Literal scan root and maximum traversal depth for a Windows deny glob.
+pub struct WindowsDenyReadGlobScan<'a> {
+    pub root: &'a str,
+    pub pattern_suffix: &'a str,
+    pub max_depth: Option<usize>,
+}
+
+/// Plans lexical scan bounds without accessing the controller's filesystem.
+pub fn windows_deny_read_glob_scan(
+    pattern: &str,
+    configured_max_depth: Option<usize>,
+) -> WindowsDenyReadGlobScan<'_> {
+    let first_glob = pattern.find(['*', '?', '[']).unwrap_or(pattern.len());
+    let literal_prefix = &pattern[..first_glob];
+    let (root, pattern_suffix) = match literal_prefix.rfind(['/', '\\']) {
+        Some(index) => {
+            let drive_root = index > 0 && literal_prefix.as_bytes()[index - 1] == b':';
+            let end = if index == 0 || drive_root {
+                index + 1
+            } else {
+                index
+            };
+            (&literal_prefix[..end], &pattern[index + 1..])
+        }
+        None => (".", pattern),
+    };
+    let components = pattern_suffix
+        .split(['/', '\\'])
+        .filter(|component| !component.is_empty())
+        .collect::<Vec<_>>();
+    let max_depth = if components.contains(&"**") {
+        configured_max_depth
+    } else {
+        Some(configured_max_depth.map_or(components.len(), |depth| depth.min(components.len())))
+    };
+    WindowsDenyReadGlobScan {
+        root,
+        pattern_suffix,
+        max_depth,
+    }
+}