exec-server: require explicit filesystem sandbox cwd

codex-rs/exec-server/src/environment.rs

@@ -443,8 +443,11 @@ mod tests {
             std::env::current_exe().expect("current exe").as_path(),
         )
         .expect("absolute current exe");
-        let sandbox = crate::FileSystemSandboxContext::new(
+        let sandbox_cwd =
+            codex_utils_absolute_path::AbsolutePathBuf::current_dir().expect("current dir");
+        let sandbox = crate::FileSystemSandboxContext::from_legacy_sandbox_policy(
             codex_protocol::protocol::SandboxPolicy::new_read_only_policy(),
+            sandbox_cwd,
         );
 
         let err = environment

codex-rs/exec-server/src/file_system.rs

@@ -57,18 +57,6 @@ pub struct FileSystemSandboxContext {
 }
 
 impl FileSystemSandboxContext {
-    pub fn new(sandbox_policy: SandboxPolicy) -> Self {
-        if let Ok(cwd) = AbsolutePathBuf::current_dir() {
-            Self::from_legacy_sandbox_policy(sandbox_policy, cwd)
-        } else {
-            let permissions = PermissionProfile::from_runtime_permissions(
-                &FileSystemSandboxPolicy::from(&sandbox_policy),
-                NetworkSandboxPolicy::from(&sandbox_policy),
-            );
-            Self::from_permission_profile(permissions)
-        }
-    }
-
     pub fn from_legacy_sandbox_policy(sandbox_policy: SandboxPolicy, cwd: AbsolutePathBuf) -> Self {
         let permissions = PermissionProfile::from_runtime_permissions(
             &FileSystemSandboxPolicy::from_legacy_sandbox_policy(&sandbox_policy, cwd.as_path()),

codex-rs/exec-server/src/fs_sandbox.rs

@@ -526,7 +526,10 @@ mod tests {
         let sandbox_policy = SandboxPolicy::new_workspace_write_policy();
         let file_system_policy =
             FileSystemSandboxPolicy::from_legacy_sandbox_policy(&sandbox_policy, cwd.as_path());
-        let sandbox_context = crate::FileSystemSandboxContext::new(sandbox_policy.clone());
+        let sandbox_context = crate::FileSystemSandboxContext::from_legacy_sandbox_policy(
+            sandbox_policy.clone(),
+            cwd.clone(),
+        );
 
         let request = runner
             .sandbox_exec_request(

codex-rs/exec-server/src/server/file_system_handler.rs

@@ -192,6 +192,8 @@ mod tests {
         )
         .expect("runtime paths");
         let handler = FileSystemHandler::new(runtime_paths);
+        let sandbox_cwd =
+            AbsolutePathBuf::from_absolute_path(temp_dir.path()).expect("absolute tempdir");
 
         for (file_name, sandbox_policy) in [
             ("danger.txt", SandboxPolicy::DangerFullAccess),
@@ -210,7 +212,10 @@ mod tests {
                 .write_file(FsWriteFileParams {
                     path: path.clone(),
                     data_base64: STANDARD.encode("ok"),
-                    sandbox: Some(FileSystemSandboxContext::new(sandbox_policy.clone())),
+                    sandbox: Some(FileSystemSandboxContext::from_legacy_sandbox_policy(
+                        sandbox_policy.clone(),
+                        sandbox_cwd.clone(),
+                    )),
                 })
                 .await
                 .expect("write file");
@@ -218,7 +223,10 @@ mod tests {
             let response = handler
                 .read_file(FsReadFileParams {
                     path,
-                    sandbox: Some(FileSystemSandboxContext::new(sandbox_policy)),
+                    sandbox: Some(FileSystemSandboxContext::from_legacy_sandbox_policy(
+                        sandbox_policy,
+                        sandbox_cwd.clone(),
+                    )),
                 })
                 .await
                 .expect("read file");

codex-rs/exec-server/tests/file_system.rs

@@ -80,30 +80,38 @@ fn absolute_path(path: std::path::PathBuf) -> AbsolutePathBuf {
 }
 
 fn read_only_sandbox(readable_root: std::path::PathBuf) -> FileSystemSandboxContext {
-    FileSystemSandboxContext::new(SandboxPolicy::ReadOnly {
-        access: ReadOnlyAccess::Restricted {
-            include_platform_defaults: false,
-            readable_roots: vec![absolute_path(readable_root)],
+    let readable_root = absolute_path(readable_root);
+    FileSystemSandboxContext::from_legacy_sandbox_policy(
+        SandboxPolicy::ReadOnly {
+            access: ReadOnlyAccess::Restricted {
+                include_platform_defaults: false,
+                readable_roots: vec![readable_root.clone()],
+            },
+            network_access: false,
         },
-        network_access: false,
-    })
+        readable_root,
+    )
 }
 
 fn workspace_write_sandbox(writable_root: std::path::PathBuf) -> FileSystemSandboxContext {
-    FileSystemSandboxContext::new(SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![absolute_path(writable_root)],
-        read_only_access: ReadOnlyAccess::Restricted {
-            include_platform_defaults: false,
-            readable_roots: vec![],
+    let writable_root = absolute_path(writable_root);
+    FileSystemSandboxContext::from_legacy_sandbox_policy(
+        SandboxPolicy::WorkspaceWrite {
+            writable_roots: vec![writable_root.clone()],
+            read_only_access: ReadOnlyAccess::Restricted {
+                include_platform_defaults: false,
+                readable_roots: vec![],
+            },
+            network_access: false,
+            exclude_tmpdir_env_var: true,
+            exclude_slash_tmp: true,
         },
-        network_access: false,
-        exclude_tmpdir_env_var: true,
-        exclude_slash_tmp: true,
-    })
+        writable_root,
+    )
 }
 
 #[test]
-fn sandbox_context_new_preserves_legacy_workspace_write_read_only_subpaths() -> Result<()> {
+fn sandbox_context_from_legacy_policy_preserves_workspace_write_read_only_subpaths() -> Result<()> {
     let tmp = TempDir::new()?;
     let writable_dir = tmp.path().join("writable");
     let git_dir = writable_dir.join(".git");