permissions: move workspace roots onto thread state

codex-rs/core/src/codex_thread.rs

@@ -59,6 +59,7 @@ pub struct ThreadConfigSnapshot {
     pub permission_profile: PermissionProfile,
     pub active_permission_profile: Option<ActivePermissionProfile>,
     pub cwd: AbsolutePathBuf,
+    pub workspace_roots: Vec<AbsolutePathBuf>,
     pub ephemeral: bool,
     pub reasoning_effort: Option<ReasoningEffort>,
     pub personality: Option<Personality>,
@@ -68,11 +69,15 @@ pub struct ThreadConfigSnapshot {
 
 impl ThreadConfigSnapshot {
     pub fn sandbox_policy(&self) -> SandboxPolicy {
-        let file_system_sandbox_policy = self.permission_profile.file_system_sandbox_policy();
+        let permission_profile = self
+            .permission_profile
+            .clone()
+            .materialize_project_roots_with_workspace_roots(&self.workspace_roots);
+        let file_system_sandbox_policy = permission_profile.file_system_sandbox_policy();
         codex_sandboxing::compatibility_sandbox_policy_for_permission_profile(
-            &self.permission_profile,
+            &permission_profile,
             &file_system_sandbox_policy,
-            self.permission_profile.network_sandbox_policy(),
+            permission_profile.network_sandbox_policy(),
             self.cwd.as_path(),
         )
     }
@@ -82,6 +87,7 @@ impl ThreadConfigSnapshot {
 #[derive(Clone, Default)]
 pub struct CodexThreadTurnContextOverrides {
     pub cwd: Option<PathBuf>,
+    pub workspace_roots: Option<Vec<PathBuf>>,
     pub approval_policy: Option<AskForApproval>,
     pub approvals_reviewer: Option<ApprovalsReviewer>,
     pub sandbox_policy: Option<SandboxPolicy>,
@@ -241,8 +247,26 @@ impl CodexThread {
         &self,
         overrides: CodexThreadTurnContextOverrides,
     ) -> ConstraintResult<()> {
+        let updates = self.turn_context_updates_from_overrides(overrides).await;
+        self.codex.session.validate_settings(&updates).await
+    }
+
+    /// Apply persistent thread context overrides immediately.
+    pub async fn update_turn_context_overrides(
+        &self,
+        overrides: CodexThreadTurnContextOverrides,
+    ) -> ConstraintResult<()> {
+        let updates = self.turn_context_updates_from_overrides(overrides).await;
+        self.codex.session.update_settings(updates).await
+    }
+
+    async fn turn_context_updates_from_overrides(
+        &self,
+        overrides: CodexThreadTurnContextOverrides,
+    ) -> SessionSettingsUpdate {
         let CodexThreadTurnContextOverrides {
             cwd,
+            workspace_roots,
             approval_policy,
             approvals_reviewer,
             sandbox_policy,
@@ -266,8 +290,9 @@ impl CodexThread {
                 .with_updates(model, effort, /*developer_instructions*/ None)
         };
 
-        let updates = SessionSettingsUpdate {
+        SessionSettingsUpdate {
             cwd,
+            workspace_roots,
             approval_policy,
             approvals_reviewer,
             sandbox_policy,
@@ -279,8 +304,7 @@ impl CodexThread {
             service_tier,
             personality,
             ..Default::default()
-        };
-        self.codex.session.validate_settings(&updates).await
+        }
     }
 
     /// Use sparingly: this is intended to be removed soon.

codex-rs/core/src/config/config_loader_tests.rs

@@ -527,9 +527,10 @@ writable_roots = ["~/code"]
 
     let expected_root = AbsolutePathBuf::from_absolute_path(home.join("code"))?;
     match &config.legacy_sandbox_policy() {
-        SandboxPolicy::WorkspaceWrite { writable_roots, .. } => {
+        SandboxPolicy::WorkspaceWrite { .. } => {
             assert_eq!(
-                writable_roots
+                config
+                    .workspace_roots
                     .iter()
                     .filter(|root| **root == expected_root)
                     .count(),
@@ -593,7 +594,6 @@ allowed_sandbox_modes = ["read-only"]
             .permission_profile
             .can_set(&PermissionProfile::from_legacy_sandbox_policy(
                 &SandboxPolicy::WorkspaceWrite {
-                    writable_roots: Vec::new(),
                     network_access: false,
                     exclude_tmpdir_env_var: false,
                     exclude_slash_tmp: false,

codex-rs/core/src/config/config_tests.rs

@@ -68,7 +68,6 @@ use codex_model_provider_info::WireApi;
 use codex_models_manager::bundled_models_response;
 use codex_protocol::config_types::ServiceTier;
 use codex_protocol::models::ActivePermissionProfile;
-use codex_protocol::models::ActivePermissionProfileModification;
 use codex_protocol::models::ManagedFileSystemPermissions;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::models::SandboxEnforcement;
@@ -100,6 +99,14 @@ use std::path::Path;
 use std::time::Duration;
 use tempfile::TempDir;
 
+fn materialized_file_system_sandbox_policy(config: &Config) -> FileSystemSandboxPolicy {
+    config
+        .permissions
+        .permission_profile()
+        .materialize_project_roots_with_workspace_roots(&config.workspace_roots)
+        .file_system_sandbox_policy()
+}
+
 fn stdio_mcp(command: &str) -> McpServerConfig {
     McpServerConfig {
         transport: McpServerTransportConfig::Stdio {
@@ -1364,7 +1371,7 @@ async fn default_permissions_profile_populates_runtime_sandbox_policy() -> std::
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path {
-                    path: memories_root.clone(),
+                    path: memories_root,
                 },
                 access: FileSystemAccessMode::Write,
             },
@@ -1373,7 +1380,6 @@ async fn default_permissions_profile_populates_runtime_sandbox_policy() -> std::
     assert_eq!(
         &config.legacy_sandbox_policy(),
         &SandboxPolicy::WorkspaceWrite {
-            writable_roots: vec![memories_root],
             network_access: false,
             exclude_tmpdir_env_var: true,
             exclude_slash_tmp: true,
@@ -1550,7 +1556,6 @@ async fn permission_profile_override_applies_runtime_roots_to_legacy_projection(
     assert_eq!(
         &config.legacy_sandbox_policy(),
         &SandboxPolicy::WorkspaceWrite {
-            writable_roots: vec![memories_root],
             network_access: false,
             exclude_tmpdir_env_var: true,
             exclude_slash_tmp: true,
@@ -1751,7 +1756,7 @@ async fn default_permissions_can_select_builtin_profile_without_permissions_tabl
     )
     .await?;
 
-    let policy = config.permissions.file_system_sandbox_policy();
+    let policy = materialized_file_system_sandbox_policy(&config);
     assert_eq!(
         config
             .permissions
@@ -1772,7 +1777,7 @@ async fn default_permissions_can_select_builtin_profile_without_permissions_tabl
 }
 
 #[tokio::test]
-async fn default_permissions_read_only_applies_additional_writable_roots_as_modifications()
+async fn default_permissions_read_only_records_additional_writable_roots_as_workspace_roots()
 -> std::io::Result<()> {
     let codex_home = TempDir::new()?;
     let cwd = TempDir::new()?;
@@ -1793,18 +1798,18 @@ async fn default_permissions_read_only_applies_additional_writable_roots_as_modi
     )
     .await?;
 
-    let policy = config.permissions.file_system_sandbox_policy();
-    assert!(
-        policy.can_write_path_with_cwd(extra_root.as_path(), cwd.path()),
-        "expected additional writable root to modify :read-only, policy: {policy:?}"
+    let policy = materialized_file_system_sandbox_policy(&config);
+    assert_eq!(
+        policy,
+        PermissionProfile::read_only().file_system_sandbox_policy()
+    );
+    assert_eq!(
+        config.workspace_roots,
+        vec![cwd.path().abs(), extra_root.clone()]
     );
     assert_eq!(
         config.permissions.active_permission_profile(),
-        Some(
-            ActivePermissionProfile::new(":read-only").with_modifications(vec![
-                ActivePermissionProfileModification::AdditionalWritableRoot { path: extra_root },
-            ])
-        )
+        Some(ActivePermissionProfile::new(":read-only"))
     );
     Ok(())
 }
@@ -1835,7 +1840,7 @@ async fn explicit_builtin_workspace_profile_ignores_legacy_workspace_write_setti
     )
     .await?;
 
-    let policy = config.permissions.file_system_sandbox_policy();
+    let policy = materialized_file_system_sandbox_policy(&config);
     assert_eq!(
         config.permissions.network_sandbox_policy(),
         NetworkSandboxPolicy::Restricted
@@ -1875,7 +1880,7 @@ async fn empty_config_defaults_to_builtin_profile_for_trusted_project() -> std::
     )
     .await?;
 
-    let policy = config.permissions.file_system_sandbox_policy();
+    let policy = materialized_file_system_sandbox_policy(&config);
     assert_eq!(
         config
             .permissions
@@ -1943,7 +1948,7 @@ async fn implicit_builtin_workspace_profile_preserves_sandbox_workspace_write_se
     )
     .await?;
 
-    let policy = config.permissions.file_system_sandbox_policy();
+    let policy = materialized_file_system_sandbox_policy(&config);
     assert!(
         policy.can_write_path_with_cwd(extra_root.as_path(), cwd.path()),
         "expected implicit :workspace to preserve sandbox_workspace_write.writable_roots, policy: {policy:?}"
@@ -1960,12 +1965,11 @@ async fn implicit_builtin_workspace_profile_preserves_sandbox_workspace_write_se
     );
     match config.legacy_sandbox_policy() {
         SandboxPolicy::WorkspaceWrite {
-            writable_roots,
             network_access,
             exclude_tmpdir_env_var,
             exclude_slash_tmp,
         } => {
-            assert!(writable_roots.contains(&extra_root));
+            assert!(config.workspace_roots.contains(&extra_root));
             assert!(network_access);
             assert!(exclude_tmpdir_env_var);
             assert!(!exclude_slash_tmp);
@@ -2009,7 +2013,7 @@ async fn implicit_builtin_workspace_profile_preserves_add_dir_metadata_carveouts
     )
     .await?;
 
-    let policy = config.permissions.file_system_sandbox_policy();
+    let policy = materialized_file_system_sandbox_policy(&config);
     let extra_root = extra_root.path().abs();
     assert!(
         policy.can_write_path_with_cwd(extra_root.as_path(), cwd.path()),
@@ -2184,9 +2188,6 @@ async fn permissions_profiles_allow_direct_write_roots_outside_workspace_root()
     )
     .await?;
 
-    let memories_root = AbsolutePathBuf::from_absolute_path(std::fs::canonicalize(
-        codex_home.path().join("memories"),
-    )?)?;
     assert!(
         config
             .permissions
@@ -2196,7 +2197,6 @@ async fn permissions_profiles_allow_direct_write_roots_outside_workspace_root()
     assert_eq!(
         &config.legacy_sandbox_policy(),
         &SandboxPolicy::WorkspaceWrite {
-            writable_roots: vec![external_write_path, memories_root],
             network_access: false,
             exclude_tmpdir_env_var: true,
             exclude_slash_tmp: true,
@@ -2871,7 +2871,6 @@ trust_level = "trusted"
         assert_eq!(
             resolution,
             SandboxPolicy::WorkspaceWrite {
-                writable_roots: vec![writable_root.clone()],
                 network_access: false,
                 exclude_tmpdir_env_var: true,
                 exclude_slash_tmp: true,
@@ -2911,7 +2910,6 @@ exclude_slash_tmp = true
         assert_eq!(
             resolution,
             SandboxPolicy::WorkspaceWrite {
-                writable_roots: vec![writable_root],
                 network_access: false,
                 exclude_tmpdir_env_var: true,
                 exclude_slash_tmp: true,
@@ -2975,13 +2973,21 @@ exclude_slash_tmp = true
             NetworkSandboxPolicy::from(&sandbox_policy),
             "case `{name}` should preserve network semantics from legacy config"
         );
-        assert_eq!(
-            file_system_policy
-                .to_legacy_sandbox_policy(network_policy, cwd.path())
-                .unwrap_or_else(|err| panic!("case `{name}` should round-trip: {err}")),
-            sandbox_policy,
-            "case `{name}` should preserve its legacy compatibility projection"
-        );
+        let direct_legacy_projection =
+            file_system_policy.to_legacy_sandbox_policy(network_policy, cwd.path());
+        if name == "workspace-write" && !cfg!(target_os = "windows") {
+            assert!(
+                direct_legacy_projection.is_err(),
+                "case `{name}` should require the compatibility projection for split workspace roots"
+            );
+        } else {
+            assert_eq!(
+                direct_legacy_projection
+                    .unwrap_or_else(|err| panic!("case `{name}` should round-trip: {err}")),
+                sandbox_policy,
+                "case `{name}` should preserve its legacy compatibility projection"
+            );
+        }
 
         match name.as_str() {
             "danger-full-access" | "read-only" => {
@@ -3023,14 +3029,19 @@ exclude_slash_tmp = true
                         })
                 );
                 assert!(
-                    file_system_policy
+                    config.workspace_roots.contains(&extra_root),
+                    "case `{name}` should store legacy writable roots as thread workspace roots"
+                );
+                assert!(
+                    materialized_file_system_sandbox_policy(&config)
                         .entries
                         .contains(&FileSystemSandboxEntry {
                             path: FileSystemPath::Path {
                                 path: extra_root.clone(),
                             },
                             access: FileSystemAccessMode::Write,
-                        })
+                        }),
+                    "case `{name}` should materialize workspace roots into runtime write access"
                 );
                 for subpath in [".git", ".agents", ".codex"] {
                     assert!(
@@ -3773,14 +3784,15 @@ async fn add_dir_override_extends_workspace_writable_roots() -> std::io::Result<
         }
     } else {
         match &config.legacy_sandbox_policy() {
-            SandboxPolicy::WorkspaceWrite { writable_roots, .. } => {
+            SandboxPolicy::WorkspaceWrite { .. } => {
                 assert_eq!(
-                    writable_roots
+                    config
+                        .workspace_roots
                         .iter()
                         .filter(|root| **root == expected_backend)
                         .count(),
                     1,
-                    "expected single writable root entry for {}",
+                    "expected single workspace root entry for {}",
                     expected_backend.display()
                 );
             }
@@ -3840,13 +3852,16 @@ async fn workspace_write_always_includes_memories_root_once() -> std::io::Result
             "expected memories root directory to exist at {}",
             memories_root.display()
         );
-        let expected_memories_root = memories_root.abs();
+        let expected_memories_root =
+            AbsolutePathBuf::from_absolute_path(std::fs::canonicalize(&memories_root)?)?;
         match &config.legacy_sandbox_policy() {
-            SandboxPolicy::WorkspaceWrite { writable_roots, .. } => {
+            SandboxPolicy::WorkspaceWrite { .. } => {
+                let writable_roots = materialized_file_system_sandbox_policy(&config)
+                    .get_writable_roots_with_cwd(config.cwd.as_path());
                 assert_eq!(
                     writable_roots
                         .iter()
-                        .filter(|root| **root == expected_memories_root)
+                        .filter(|root| root.root == expected_memories_root)
                         .count(),
                     1,
                     "expected single writable root entry for {}",
@@ -7294,6 +7309,7 @@ async fn test_precedence_fixture_with_o3_profile() -> std::io::Result<()> {
             user_instructions: None,
             notify: None,
             cwd: fixture.cwd(),
+            workspace_roots: vec![fixture.cwd()],
             cli_auth_credentials_store_mode: Default::default(),
             mcp_servers: Constrained::allow_any(HashMap::new()),
             mcp_oauth_credentials_store_mode: resolve_mcp_oauth_credentials_store_mode(
@@ -7741,6 +7757,7 @@ async fn test_precedence_fixture_with_gpt3_profile() -> std::io::Result<()> {
         user_instructions: None,
         notify: None,
         cwd: fixture.cwd(),
+        workspace_roots: vec![fixture.cwd()],
         cli_auth_credentials_store_mode: Default::default(),
         mcp_servers: Constrained::allow_any(HashMap::new()),
         mcp_oauth_credentials_store_mode: resolve_mcp_oauth_credentials_store_mode(
@@ -7902,6 +7919,7 @@ async fn test_precedence_fixture_with_zdr_profile() -> std::io::Result<()> {
         user_instructions: None,
         notify: None,
         cwd: fixture.cwd(),
+        workspace_roots: vec![fixture.cwd()],
         cli_auth_credentials_store_mode: Default::default(),
         mcp_servers: Constrained::allow_any(HashMap::new()),
         mcp_oauth_credentials_store_mode: resolve_mcp_oauth_credentials_store_mode(
@@ -8048,6 +8066,7 @@ async fn test_precedence_fixture_with_gpt5_profile() -> std::io::Result<()> {
         user_instructions: None,
         notify: None,
         cwd: fixture.cwd(),
+        workspace_roots: vec![fixture.cwd()],
         cli_auth_credentials_store_mode: Default::default(),
         mcp_servers: Constrained::allow_any(HashMap::new()),
         mcp_oauth_credentials_store_mode: resolve_mcp_oauth_credentials_store_mode(
@@ -9056,7 +9075,7 @@ async fn requirements_web_search_mode_overrides_danger_full_access_default() ->
     assert_eq!(
         resolve_web_search_mode_for_turn(
             &config.web_search_mode,
-            &config.permissions.permission_profile(),
+            config.permissions.permission_profile_ref(),
         ),
         WebSearchMode::Cached,
     );

codex-rs/core/src/config/mod.rs

@@ -89,7 +89,6 @@ use codex_protocol::config_types::WebSearchConfig;
 use codex_protocol::config_types::WebSearchMode;
 use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::models::ActivePermissionProfile;
-use codex_protocol::models::ActivePermissionProfileModification;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::models::SandboxEnforcement;
 use codex_protocol::openai_models::ModelsResponse;
@@ -242,10 +241,10 @@ pub struct Permissions {
     pub approval_policy: Constrained<AskForApproval>,
     /// Canonical effective runtime permissions after config requirements and
     /// runtime readable-root additions have been applied.
-    pub permission_profile: Constrained<PermissionProfile>,
+    permission_profile: Constrained<PermissionProfile>,
     /// Named or implicit built-in profile selected by config, rather than an
     /// ad-hoc override.
-    pub active_permission_profile: Option<ActivePermissionProfile>,
+    active_permission_profile: Option<ActivePermissionProfile>,
     /// Effective network configuration applied to all spawned processes.
     pub network: Option<NetworkProxySpec>,
     /// Whether the model may request a login shell for shell-based tools.
@@ -267,6 +266,35 @@ pub struct Permissions {
 }
 
 impl Permissions {
+    /// Build permissions from the two constrained values that are required for
+    /// a minimal in-process configuration.
+    pub fn from_approval_and_profile(
+        approval_policy: Constrained<AskForApproval>,
+        permission_profile: Constrained<PermissionProfile>,
+    ) -> Self {
+        Self {
+            approval_policy,
+            permission_profile,
+            active_permission_profile: None,
+            network: None,
+            allow_login_shell: true,
+            shell_environment_policy: ShellEnvironmentPolicy::default(),
+            windows_sandbox_mode: None,
+            windows_sandbox_private_desktop: true,
+        }
+    }
+
+    /// Borrow the constrained canonical profile. This is for code that must
+    /// preserve or inspect the active requirements wrapper without mutating it.
+    pub fn permission_profile_constraint(&self) -> &Constrained<PermissionProfile> {
+        &self.permission_profile
+    }
+
+    /// Borrow the canonical effective runtime permissions without cloning.
+    pub fn permission_profile_ref(&self) -> &PermissionProfile {
+        self.permission_profile.get()
+    }
+
     /// Effective runtime permissions after config requirements and runtime
     /// readable-root additions have been applied.
     pub fn permission_profile(&self) -> PermissionProfile {
@@ -278,6 +306,45 @@ impl Permissions {
         self.active_permission_profile.clone()
     }
 
+    /// Replace the full constrained profile value and clear any profile-name
+    /// sidecar because the new constraint may no longer match that name.
+    pub fn replace_permission_profile_constraint(
+        &mut self,
+        permission_profile: Constrained<PermissionProfile>,
+    ) {
+        self.permission_profile = permission_profile;
+        self.active_permission_profile = None;
+    }
+
+    /// Replace the full constrained profile value and preserve the active
+    /// profile sidecar when the caller has already validated both together.
+    pub fn replace_permission_profile_constraint_with_active_profile(
+        &mut self,
+        permission_profile: Constrained<PermissionProfile>,
+        active_permission_profile: Option<ActivePermissionProfile>,
+    ) {
+        self.permission_profile = permission_profile;
+        self.active_permission_profile = active_permission_profile;
+    }
+
+    /// Record the active profile id only if it still describes the current
+    /// canonical profile.
+    pub fn set_active_permission_profile_for_current_profile(
+        &mut self,
+        active_permission_profile: Option<ActivePermissionProfile>,
+        expected_permission_profile: Option<&PermissionProfile>,
+    ) {
+        self.active_permission_profile =
+            match (active_permission_profile, expected_permission_profile) {
+                (Some(active_permission_profile), Some(expected_permission_profile))
+                    if self.permission_profile.get() == expected_permission_profile =>
+                {
+                    Some(active_permission_profile)
+                }
+                _ => None,
+            };
+    }
+
     /// Effective filesystem sandbox policy derived from the canonical profile.
     pub fn file_system_sandbox_policy(&self) -> FileSystemSandboxPolicy {
         self.permission_profile.get().file_system_sandbox_policy()
@@ -579,6 +646,10 @@ pub struct Config {
     /// layer are resolved against this path.
     pub cwd: AbsolutePathBuf,
 
+    /// Absolute roots that define the writable project/workspace set for
+    /// symbolic `:project_roots` permission entries.
+    pub workspace_roots: Vec<AbsolutePathBuf>,
+
     /// Preferred store for CLI auth credentials.
     /// file (default): Use a file in the Codex home directory.
     /// keyring: Use an OS-specific keyring service.
@@ -1860,6 +1931,11 @@ fn apply_managed_filesystem_constraints(
     }
 }
 
+fn dedupe_absolute_paths(paths: &mut Vec<AbsolutePathBuf>) {
+    let mut seen = HashSet::new();
+    paths.retain(|path| seen.insert(path.clone()));
+}
+
 /// Optional overrides for user configuration (e.g., from CLI flags).
 #[derive(Default, Debug, Clone)]
 pub struct ConfigOverrides {
@@ -1888,6 +1964,9 @@ pub struct ConfigOverrides {
     pub ephemeral: Option<bool>,
     /// Additional directories that should be treated as writable roots for this session.
     pub additional_writable_roots: Vec<PathBuf>,
+    /// Explicit workspace roots for this session. When set, this is the full
+    /// root list rather than an additive override.
+    pub workspace_roots: Option<Vec<PathBuf>>,
 }
 
 /// Resolves the OSS provider from CLI override, profile config, or global config.
@@ -2169,6 +2248,7 @@ impl Config {
             tools_web_search_request: override_tools_web_search_request,
             ephemeral,
             additional_writable_roots,
+            workspace_roots: workspace_roots_override,
         } = overrides;
 
         if sandbox_mode.is_some() && permission_profile.is_some() {
@@ -2257,11 +2337,10 @@ impl Config {
                 }
             }
         }))?;
-        let mut additional_writable_roots: Vec<AbsolutePathBuf> = additional_writable_roots
+        let requested_additional_writable_roots: Vec<AbsolutePathBuf> = additional_writable_roots
             .into_iter()
             .map(|path| AbsolutePathBuf::resolve_path_against_base(path, resolved_cwd.as_path()))
             .collect();
-        let requested_additional_writable_roots = additional_writable_roots.clone();
         let repo_root = resolve_root_git_project_for_trust(fs, &resolved_cwd).await;
         let active_project = cfg
             .get_active_project(
@@ -2303,12 +2382,7 @@ impl Config {
         };
         let memories_root = memory_root(&codex_home);
         std::fs::create_dir_all(&memories_root)?;
-        if !additional_writable_roots
-            .iter()
-            .any(|existing| existing == &memories_root)
-        {
-            additional_writable_roots.push(memories_root);
-        }
+        let internal_writable_roots = vec![memories_root];
 
         let profiles_are_active = default_permissions_override.is_some()
             || matches!(
@@ -2318,6 +2392,31 @@ impl Config {
             || permission_config_syntax.is_none();
         let using_implicit_builtin_profile =
             permission_config_syntax.is_none() && default_permissions.is_none();
+        let should_seed_legacy_workspace_roots =
+            default_permissions.is_none()
+                && matches!(
+                    permission_config_syntax,
+                    None | Some(PermissionConfigSyntax::Legacy)
+                );
+        let mut workspace_roots = match workspace_roots_override {
+            Some(workspace_roots) => workspace_roots
+                .into_iter()
+                .map(|path| {
+                    AbsolutePathBuf::resolve_path_against_base(path, resolved_cwd.as_path())
+                })
+                .collect(),
+            None => {
+                let mut workspace_roots = vec![resolved_cwd.clone()];
+                workspace_roots.extend(requested_additional_writable_roots.clone());
+                if should_seed_legacy_workspace_roots
+                    && let Some(sandbox_workspace_write) = cfg.sandbox_workspace_write.as_ref()
+                {
+                    workspace_roots.extend(sandbox_workspace_write.writable_roots.clone());
+                }
+                workspace_roots
+            }
+        };
+        dedupe_absolute_paths(&mut workspace_roots);
         let (
             mut configured_network_proxy_config,
             permission_profile,
@@ -2354,10 +2453,7 @@ impl Config {
             );
             if matches!(sandbox_policy, SandboxPolicy::WorkspaceWrite { .. }) {
                 file_system_sandbox_policy = file_system_sandbox_policy
-                    .with_additional_writable_roots(
-                        resolved_cwd.as_path(),
-                        &additional_writable_roots,
-                    );
+                    .with_additional_legacy_workspace_writable_roots(&internal_writable_roots);
                 permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
                     permission_profile.enforcement(),
                     &file_system_sandbox_policy,
@@ -2408,28 +2504,8 @@ impl Config {
                 resolved_cwd.as_path(),
             );
             if matches!(sandbox_policy, SandboxPolicy::WorkspaceWrite { .. }) {
-                file_system_sandbox_policy = if using_implicit_builtin_profile {
-                    file_system_sandbox_policy
-                        .with_additional_legacy_workspace_writable_roots(
-                            &additional_writable_roots,
-                        )
-                } else {
-                    file_system_sandbox_policy.with_additional_writable_roots(
-                        resolved_cwd.as_path(),
-                        &additional_writable_roots,
-                    )
-                };
-                permission_profile = PermissionProfile::from_runtime_permissions(
-                    &file_system_sandbox_policy,
-                    network_sandbox_policy,
-                );
-            } else if matches!(permission_profile, PermissionProfile::Managed { .. })
-                && !requested_additional_writable_roots.is_empty()
-            {
-                file_system_sandbox_policy = file_system_sandbox_policy.with_additional_writable_roots(
-                    resolved_cwd.as_path(),
-                    &requested_additional_writable_roots,
-                );
+                file_system_sandbox_policy = file_system_sandbox_policy
+                    .with_additional_legacy_workspace_writable_roots(&internal_writable_roots);
                 permission_profile = PermissionProfile::from_runtime_permissions(
                     &file_system_sandbox_policy,
                     network_sandbox_policy,
@@ -2446,22 +2522,7 @@ impl Config {
                 // when doing so would lose roots, network, or tmp settings.
                 None
             } else {
-                let active_permission_profile = if !requested_additional_writable_roots.is_empty()
-                    && matches!(permission_profile, PermissionProfile::Managed { .. })
-                {
-                    ActivePermissionProfile::new(default_permissions).with_modifications(
-                        requested_additional_writable_roots
-                            .iter()
-                            .cloned()
-                            .map(|path| {
-                                ActivePermissionProfileModification::AdditionalWritableRoot { path }
-                            })
-                            .collect(),
-                    )
-                } else {
-                    ActivePermissionProfile::new(default_permissions)
-                };
-                Some(active_permission_profile)
+                Some(ActivePermissionProfile::new(default_permissions))
             };
             (
                 configured_network_proxy_config,
@@ -2500,25 +2561,25 @@ impl Config {
             }
             let (mut file_system_sandbox_policy, network_sandbox_policy) =
                 permission_profile.to_runtime_permissions();
-            // `additional_writable_roots` is a legacy workspace-write knob. It
-            // only applies when the derived managed profile has workspace-style
-            // write access to the project roots; read-only, disabled, external,
-            // and future non-workspace profiles must not silently grow extra
-            // write access.
+            // Internal writable roots only apply when the derived managed
+            // profile has workspace-style write access to the project roots;
+            // read-only, disabled, external, and future non-workspace profiles
+            // must not silently grow extra write access.
+            let materialized_file_system_sandbox_policy = permission_profile
+                .materialize_project_roots_with_workspace_roots(&workspace_roots)
+                .file_system_sandbox_policy();
             if matches!(permission_profile.enforcement(), SandboxEnforcement::Managed)
-                && file_system_sandbox_policy.can_write_path_with_cwd(
+                && materialized_file_system_sandbox_policy.can_write_path_with_cwd(
                     resolved_cwd.as_path(),
                     resolved_cwd.as_path(),
                 )
-                && !file_system_sandbox_policy.has_full_disk_write_access()
+                && !materialized_file_system_sandbox_policy.has_full_disk_write_access()
             {
-                // Keep legacy behavior for extra writable roots while storing
-                // the result as the canonical permission profile. Explicit
-                // extra roots are concrete paths, so their metadata carveouts
-                // are also concrete rather than symbolic `:project_roots`
-                // entries.
+                // Keep Codex runtime write access while storing the result as
+                // the canonical permission profile. Workspace roots themselves
+                // are held separately on the thread.
                 file_system_sandbox_policy = file_system_sandbox_policy
-                    .with_additional_legacy_workspace_writable_roots(&additional_writable_roots);
+                    .with_additional_legacy_workspace_writable_roots(&internal_writable_roots);
                 permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
                     permission_profile.enforcement(),
                     &file_system_sandbox_policy,
@@ -3016,6 +3077,7 @@ impl Config {
             model_provider_id,
             model_provider,
             cwd: resolved_cwd,
+            workspace_roots,
             startup_warnings,
             permissions: Permissions {
                 approval_policy: constrained_approval_policy.value,
@@ -3306,7 +3368,7 @@ impl Config {
 
     pub fn managed_network_requirements_enabled(&self) -> bool {
         !matches!(
-            self.permissions.permission_profile.get(),
+            self.permissions.permission_profile_ref(),
             PermissionProfile::Disabled
         ) && self
             .config_layer_stack

codex-rs/core/src/config/permissions.rs

@@ -68,12 +68,12 @@ pub(crate) fn builtin_permission_profile(
         BUILT_IN_READ_ONLY_PROFILE => Some(PermissionProfile::read_only()),
         BUILT_IN_WORKSPACE_PROFILE => Some(match workspace_write {
             Some(SandboxWorkspaceWrite {
-                writable_roots,
+                writable_roots: _,
                 network_access,
                 exclude_tmpdir_env_var,
                 exclude_slash_tmp,
             }) => PermissionProfile::workspace_write_with(
-                writable_roots,
+                &[],
                 if *network_access {
                     NetworkSandboxPolicy::Enabled
                 } else {

codex-rs/core/src/context/permissions_instructions.rs

@@ -30,6 +30,8 @@ const SANDBOX_MODE_DANGER_FULL_ACCESS: &str =
 const SANDBOX_MODE_WORKSPACE_WRITE: &str =
     include_str!("prompts/permissions/sandbox_mode/workspace_write.md");
 const SANDBOX_MODE_READ_ONLY: &str = include_str!("prompts/permissions/sandbox_mode/read_only.md");
+const MAX_WRITABLE_ROOTS_IN_PROMPT: usize = 8;
+const MAX_WRITABLE_ROOT_LABEL_CHARS: usize = 160;
 
 static SANDBOX_MODE_DANGER_FULL_ACCESS_TEMPLATE: LazyLock<Template> = LazyLock::new(|| {
     Template::parse(SANDBOX_MODE_DANGER_FULL_ACCESS.trim_end())
@@ -256,17 +258,42 @@ fn writable_roots_text(writable_roots: Option<Vec<WritableRoot>>) -> Option<Stri
         return None;
     }
 
+    let total_roots = roots.len();
     let roots_list: Vec<String> = roots
         .iter()
-        .map(|r| format!("`{}`", r.root.to_string_lossy()))
+        .take(MAX_WRITABLE_ROOTS_IN_PROMPT)
+        .map(|r| {
+            format!(
+                "`{}`",
+                truncate_writable_root_label(&r.root.to_string_lossy())
+            )
+        })
         .collect();
-    Some(if roots_list.len() == 1 {
+    Some(if total_roots == 1 {
         format!(" The writable root is {}.", roots_list[0])
-    } else {
+    } else if total_roots == roots_list.len() {
         format!(" The writable roots are {}.", roots_list.join(", "))
+    } else {
+        format!(
+            " The writable roots include {}, and {} more.",
+            roots_list.join(", "),
+            total_roots - roots_list.len()
+        )
     })
 }
 
+fn truncate_writable_root_label(label: &str) -> String {
+    if label.chars().count() <= MAX_WRITABLE_ROOT_LABEL_CHARS {
+        return label.to_string();
+    }
+
+    label
+        .chars()
+        .take(MAX_WRITABLE_ROOT_LABEL_CHARS - 3)
+        .chain("...".chars())
+        .collect()
+}
+
 fn approved_command_prefixes_text(exec_policy: &Policy) -> Option<String> {
     format_allow_prefixes(exec_policy.get_allowed_prefixes())
         .filter(|prefixes| !prefixes.is_empty())

codex-rs/core/src/context/permissions_instructions_tests.rs

@@ -13,7 +13,7 @@ use std::path::PathBuf;
 fn renders_sandbox_mode_text() {
     assert_eq!(
         sandbox_text(SandboxMode::WorkspaceWrite, NetworkAccess::Restricted),
-        "Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `workspace-write`: The sandbox permits reading files, and editing files in `cwd` and `writable_roots`. Editing files in other directories requires approval. Network access is restricted."
+        "Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `workspace-write`: The sandbox permits reading files, and editing files in the configured writable roots. Editing files in other directories requires approval. Network access is restricted."
     );
 
     assert_eq!(
@@ -56,7 +56,6 @@ fn builds_permissions_with_network_access_override() {
 #[test]
 fn builds_permissions_from_policy() {
     let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: true,
         exclude_tmpdir_env_var: false,
         exclude_slash_tmp: false,
@@ -106,6 +105,45 @@ fn builds_permissions_from_profile() {
     assert!(text.contains(writable_root.to_string_lossy().as_ref()));
 }
 
+#[test]
+fn writable_roots_text_limits_long_root_lists() {
+    let roots = (0..MAX_WRITABLE_ROOTS_IN_PROMPT + 2)
+        .map(|index| WritableRoot {
+            root: AbsolutePathBuf::from_absolute_path(format!("/tmp/root-{index}"))
+                .expect("absolute path"),
+            read_only_subpaths: Vec::new(),
+            protected_metadata_names: Vec::new(),
+        })
+        .collect::<Vec<_>>();
+    let visible_root_labels = roots
+        .iter()
+        .map(|root| root.root.to_string_lossy().into_owned())
+        .collect::<Vec<_>>();
+
+    let text = writable_roots_text(Some(roots)).expect("writable roots text");
+
+    assert!(text.contains(&visible_root_labels[0]));
+    assert!(text.contains(&visible_root_labels[MAX_WRITABLE_ROOTS_IN_PROMPT - 1]));
+    assert!(!text.contains(&visible_root_labels[MAX_WRITABLE_ROOTS_IN_PROMPT]));
+    assert!(text.contains("and 2 more"));
+}
+
+#[test]
+fn writable_roots_text_truncates_long_root_labels() {
+    let long_segment = "a".repeat(MAX_WRITABLE_ROOT_LABEL_CHARS + 20);
+    let root = WritableRoot {
+        root: AbsolutePathBuf::from_absolute_path(format!("/tmp/{long_segment}"))
+            .expect("absolute path"),
+        read_only_subpaths: Vec::new(),
+        protected_metadata_names: Vec::new(),
+    };
+
+    let text = writable_roots_text(Some(vec![root])).expect("writable roots text");
+
+    assert!(!text.contains(&long_segment));
+    assert!(text.contains("..."));
+}
+
 #[test]
 fn includes_request_rule_instructions_for_on_request() {
     let mut exec_policy = Policy::empty();

codex-rs/core/src/context/prompts/permissions/sandbox_mode/workspace_write.md

@@ -1 +1 @@
-Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `workspace-write`: The sandbox permits reading files, and editing files in `cwd` and `writable_roots`. Editing files in other directories requires approval. Network access is {{network_access}}.
+Filesystem sandboxing defines which files can be read or written. `sandbox_mode` is `workspace-write`: The sandbox permits reading files, and editing files in the configured writable roots. Editing files in other directories requires approval. Network access is {{network_access}}.

codex-rs/core/src/context_manager/history_tests.rs

@@ -123,11 +123,13 @@ fn reference_context_item() -> TurnContextItem {
         turn_id: Some("reference-turn".to_string()),
         trace_id: None,
         cwd: PathBuf::from("/tmp/reference-cwd"),
+        workspace_roots: Vec::new(),
         current_date: Some("2026-03-23".to_string()),
         timezone: Some("America/Los_Angeles".to_string()),
         approval_policy: AskForApproval::OnRequest,
         sandbox_policy: SandboxPolicy::new_read_only_policy(),
         permission_profile: None,
+        active_permission_profile: None,
         network: None,
         file_system_sandbox_policy: None,
         model: "gpt-test".to_string(),

codex-rs/core/src/context_manager/updates.rs

@@ -49,7 +49,14 @@ fn build_permissions_update_item(
     }
 
     let prev = previous?;
-    if prev.permission_profile() == next.permission_profile()
+    let prev_permission_profile = prev
+        .permission_profile()
+        .materialize_project_roots_with_workspace_roots(&prev.workspace_roots);
+    let next_permission_profile = next
+        .permission_profile
+        .clone()
+        .materialize_project_roots_with_workspace_roots(&next.workspace_roots);
+    if prev_permission_profile == next_permission_profile
         && prev.approval_policy == next.approval_policy.value()
     {
         return None;
@@ -57,7 +64,7 @@ fn build_permissions_update_item(
 
     Some(
         PermissionsInstructions::from_permission_profile(
-            &next.permission_profile,
+            &next_permission_profile,
             next.approval_policy.value(),
             next.config.approvals_reviewer,
             exec_policy,

codex-rs/core/src/exec.rs

@@ -99,11 +99,11 @@ pub struct ExecParams {
 ///
 /// The elevated Windows backend consumes extra deny-read paths plus explicit
 /// read and write roots during setup/refresh. The unelevated restricted-token
-/// backend only consumes extra deny-write carveouts on top of the legacy
-/// `WorkspaceWrite` allow set. Read-root overrides are layered on top of the
-/// baseline helper roots that the elevated setup path needs to launch the
-/// sandboxed command; split policies that opt into platform defaults carry
-/// that explicitly with the override.
+/// backend consumes explicit write roots and extra deny-write carveouts on top
+/// of the legacy `WorkspaceWrite` shape.
+/// Read-root overrides are layered on top of the baseline helper roots that the
+/// elevated setup path needs to launch the sandboxed command. Split policies
+/// that opt into platform defaults carry that explicitly with the override.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub(crate) struct WindowsSandboxFilesystemOverrides {
     pub(crate) read_roots_override: Option<Vec<PathBuf>>,
@@ -296,6 +296,7 @@ pub async fn process_exec_tool_call(
     params: ExecParams,
     permission_profile: &PermissionProfile,
     sandbox_cwd: &AbsolutePathBuf,
+    workspace_roots: &[AbsolutePathBuf],
     codex_linux_sandbox_exe: &Option<PathBuf>,
     use_legacy_landlock: bool,
     stdout_stream: Option<StdoutStream>,
@@ -304,6 +305,7 @@ pub async fn process_exec_tool_call(
         params,
         permission_profile,
         sandbox_cwd,
+        workspace_roots,
         codex_linux_sandbox_exe,
         use_legacy_landlock,
     )?;
@@ -318,6 +320,7 @@ pub fn build_exec_request(
     params: ExecParams,
     permission_profile: &PermissionProfile,
     sandbox_cwd: &AbsolutePathBuf,
+    workspace_roots: &[AbsolutePathBuf],
     codex_linux_sandbox_exe: &Option<PathBuf>,
     use_legacy_landlock: bool,
 ) -> Result<ExecRequest> {
@@ -379,6 +382,7 @@ pub fn build_exec_request(
             enforce_managed_network,
             network: network.as_ref(),
             sandbox_policy_cwd: sandbox_cwd,
+            workspace_roots,
             codex_linux_sandbox_exe: codex_linux_sandbox_exe.as_deref(),
             use_legacy_landlock,
             windows_sandbox_level,
@@ -612,11 +616,11 @@ async fn exec_windows_sandbox(
     let additional_deny_read_paths = windows_sandbox_filesystem_overrides
         .map(|overrides| overrides.additional_deny_read_paths.clone())
         .unwrap_or_default();
-    let elevated_read_roots_override = windows_sandbox_filesystem_overrides
+    let read_roots_override = windows_sandbox_filesystem_overrides
         .and_then(|overrides| overrides.read_roots_override.clone());
-    let elevated_read_roots_include_platform_defaults = windows_sandbox_filesystem_overrides
+    let read_roots_include_platform_defaults = windows_sandbox_filesystem_overrides
         .is_some_and(|overrides| overrides.read_roots_include_platform_defaults);
-    let elevated_write_roots_override = windows_sandbox_filesystem_overrides
+    let write_roots_override = windows_sandbox_filesystem_overrides
         .and_then(|overrides| overrides.write_roots_override.clone());
     let spawn_res = tokio::task::spawn_blocking(move || {
         if use_elevated {
@@ -631,10 +635,9 @@ async fn exec_windows_sandbox(
                     timeout_ms,
                     use_private_desktop: windows_sandbox_private_desktop,
                     proxy_enforced,
-                    read_roots_override: elevated_read_roots_override.as_deref(),
-                    read_roots_include_platform_defaults:
-                        elevated_read_roots_include_platform_defaults,
-                    write_roots_override: elevated_write_roots_override.as_deref(),
+                    read_roots_override: read_roots_override.as_deref(),
+                    read_roots_include_platform_defaults,
+                    write_roots_override: write_roots_override.as_deref(),
                     deny_read_paths_override: &additional_deny_read_paths,
                     deny_write_paths_override: &additional_deny_write_paths,
                 },
@@ -648,6 +651,7 @@ async fn exec_windows_sandbox(
                 &cwd,
                 env,
                 timeout_ms,
+                write_roots_override.as_deref(),
                 &additional_deny_read_paths,
                 &additional_deny_write_paths,
                 windows_sandbox_private_desktop,
@@ -1075,12 +1079,18 @@ pub(crate) fn resolve_windows_restricted_token_filesystem_overrides(
         .map(|root| normalize_windows_override_path(root.root.as_path()))
         .collect::<std::result::Result<_, _>>()?;
 
-    if legacy_root_paths != split_root_paths {
+    let write_roots_override = if legacy_root_paths == split_root_paths {
+        None
+    } else if matches!(sandbox_policy, SandboxPolicy::WorkspaceWrite { .. })
+        && !split_root_paths.iter().any(|path| path.parent().is_none())
+    {
+        Some(split_root_paths.iter().cloned().collect::<Vec<_>>())
+    } else {
         return Err(
             "windows unelevated restricted-token sandbox cannot enforce split writable root sets directly; refusing to run unsandboxed"
                 .to_string(),
         );
-    }
+    };
 
     for writable_root in &split_writable_roots {
         for read_only_subpath in &writable_root.read_only_subpaths {
@@ -1102,22 +1112,18 @@ pub(crate) fn resolve_windows_restricted_token_filesystem_overrides(
     let mut additional_deny_write_paths = BTreeSet::new();
     for split_root in &split_writable_roots {
         let split_root_path = normalize_windows_override_path(split_root.root.as_path())?;
-        let Some(legacy_root) = legacy_writable_roots.iter().find(|candidate| {
+        let legacy_root = legacy_writable_roots.iter().find(|candidate| {
             normalize_windows_override_path(candidate.root.as_path())
                 .is_ok_and(|candidate_path| candidate_path == split_root_path)
-        }) else {
-            return Err(
-                "windows unelevated restricted-token sandbox cannot enforce split writable root sets directly; refusing to run unsandboxed"
-                    .to_string(),
-            );
-        };
+        });
 
         for read_only_subpath in &split_root.read_only_subpaths {
-            if !legacy_root
-                .read_only_subpaths
-                .iter()
-                .any(|candidate| candidate == read_only_subpath)
-            {
+            if !legacy_root.is_some_and(|legacy_root| {
+                legacy_root
+                    .read_only_subpaths
+                    .iter()
+                    .any(|candidate| candidate == read_only_subpath)
+            }) {
                 additional_deny_write_paths.insert(normalize_windows_override_path(
                     read_only_subpath.as_path(),
                 )?);
@@ -1125,15 +1131,15 @@ pub(crate) fn resolve_windows_restricted_token_filesystem_overrides(
         }
     }
 
-    if additional_deny_read_paths.is_empty() && additional_deny_write_paths.is_empty() {
+    if write_roots_override.is_none() && additional_deny_write_paths.is_empty() {
         return Ok(None);
     }
 
     Ok(Some(WindowsSandboxFilesystemOverrides {
         read_roots_override: None,
         read_roots_include_platform_defaults: false,
-        write_roots_override: None,
         additional_deny_read_paths,
+        write_roots_override,
         additional_deny_write_paths: additional_deny_write_paths
             .into_iter()
             .map(|path| AbsolutePathBuf::from_absolute_path(path).map_err(|err| err.to_string()))

codex-rs/core/src/exec_tests.rs

@@ -365,6 +365,7 @@ async fn process_exec_tool_call_preserves_full_buffer_capture_policy() -> Result
         },
         &permission_profile,
         &cwd,
+        &[],
         &None,
         /*use_legacy_landlock*/ false,
         /*stdout_stream*/ None,
@@ -470,7 +471,6 @@ fn windows_restricted_token_allows_legacy_restricted_policies() {
 #[test]
 fn windows_restricted_token_allows_legacy_workspace_write_policies() {
     let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,
@@ -528,7 +528,6 @@ fn windows_restricted_token_rejects_split_only_filesystem_policies() {
     let docs = temp_dir.path().join("docs");
     std::fs::create_dir_all(&docs).expect("create docs");
     let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,
@@ -573,7 +572,6 @@ fn windows_restricted_token_rejects_root_write_read_only_carveouts() {
     let docs = temp_dir.path().join("docs");
     std::fs::create_dir_all(&docs).expect("create docs");
     let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,
@@ -619,7 +617,6 @@ fn windows_restricted_token_supports_full_read_split_write_read_carveouts() {
     let docs = cwd.join("docs");
     std::fs::create_dir_all(docs.as_path()).expect("create docs");
     let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,
@@ -677,7 +674,6 @@ fn windows_restricted_token_rejects_unreadable_split_carveouts() {
     let blocked = cwd.join("blocked");
     std::fs::create_dir_all(blocked.as_path()).expect("create blocked");
     let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,
@@ -719,6 +715,57 @@ fn windows_restricted_token_rejects_unreadable_split_carveouts() {
     );
 }
 
+#[test]
+fn windows_restricted_token_supports_extra_split_writable_root_override() {
+    let temp_dir = tempfile::TempDir::new().expect("tempdir");
+    let cwd = dunce::canonicalize(temp_dir.path())
+        .expect("canonicalize temp dir")
+        .abs();
+    let extra_root = cwd.join("extra-root");
+    std::fs::create_dir_all(extra_root.as_path()).expect("create extra root");
+    let policy = SandboxPolicy::WorkspaceWrite {
+        network_access: false,
+        exclude_tmpdir_env_var: true,
+        exclude_slash_tmp: true,
+    };
+    let file_system_policy = FileSystemSandboxPolicy::restricted(vec![
+        codex_protocol::permissions::FileSystemSandboxEntry {
+            path: codex_protocol::permissions::FileSystemPath::Special {
+                value: codex_protocol::permissions::FileSystemSpecialPath::Root,
+            },
+            access: codex_protocol::permissions::FileSystemAccessMode::Read,
+        },
+        codex_protocol::permissions::FileSystemSandboxEntry {
+            path: codex_protocol::permissions::FileSystemPath::Path { path: cwd.clone() },
+            access: codex_protocol::permissions::FileSystemAccessMode::Write,
+        },
+        codex_protocol::permissions::FileSystemSandboxEntry {
+            path: codex_protocol::permissions::FileSystemPath::Path {
+                path: extra_root.clone(),
+            },
+            access: codex_protocol::permissions::FileSystemAccessMode::Write,
+        },
+    ]);
+
+    assert_eq!(
+        resolve_windows_restricted_token_filesystem_overrides(
+            SandboxType::WindowsRestrictedToken,
+            &policy,
+            &file_system_policy,
+            NetworkSandboxPolicy::Restricted,
+            &cwd,
+            WindowsSandboxLevel::RestrictedToken,
+        ),
+        Ok(Some(WindowsSandboxFilesystemOverrides {
+            read_roots_override: None,
+            read_roots_include_platform_defaults: false,
+            write_roots_override: Some(vec![cwd.to_path_buf(), extra_root.to_path_buf()]),
+            additional_deny_read_paths: vec![],
+            additional_deny_write_paths: vec![],
+        }))
+    );
+}
+
 #[test]
 fn windows_elevated_supports_split_restricted_read_roots() {
     let temp_dir = tempfile::TempDir::new().expect("tempdir");
@@ -764,7 +811,6 @@ fn windows_elevated_supports_split_write_read_carveouts() {
     std::fs::create_dir_all(&docs).expect("create docs");
     let expected_docs = dunce::canonicalize(&docs).expect("canonical docs");
     let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,
@@ -822,7 +868,6 @@ fn windows_elevated_supports_unreadable_split_carveouts() {
     std::fs::create_dir_all(&blocked).expect("create blocked");
     let expected_blocked = dunce::canonicalize(&blocked).expect("canonical blocked");
     let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,
@@ -885,7 +930,6 @@ fn windows_elevated_supports_unreadable_globs() {
     std::fs::create_dir_all(secret.parent().expect("parent")).expect("create parent");
     std::fs::write(&secret, "secret").expect("write secret");
     let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,
@@ -942,7 +986,6 @@ fn windows_elevated_rejects_reopened_writable_descendants() {
     let nested = docs.join("nested");
     std::fs::create_dir_all(&nested).expect("create nested");
     let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,
@@ -1115,6 +1158,7 @@ async fn process_exec_tool_call_respects_cancellation_token() -> Result<()> {
             params,
             &PermissionProfile::Disabled,
             &cwd,
+            &[],
             &None,
             /*use_legacy_landlock*/ false,
             /*stdout_stream*/ None,

codex-rs/core/src/guardian/review_session.rs

@@ -895,9 +895,11 @@ pub(crate) fn build_guardian_review_session_config(
     guardian_config.developer_instructions = None;
     guardian_config.permissions.approval_policy = Constrained::allow_only(AskForApproval::Never);
     let sandbox_policy = SandboxPolicy::new_read_only_policy();
-    guardian_config.permissions.permission_profile = Constrained::allow_only(
-        PermissionProfile::from_legacy_sandbox_policy(&sandbox_policy),
-    );
+    guardian_config
+        .permissions
+        .replace_permission_profile_constraint(Constrained::allow_only(
+            PermissionProfile::from_legacy_sandbox_policy(&sandbox_policy),
+        ));
     guardian_config
         .permissions
         .set_legacy_sandbox_policy(sandbox_policy, guardian_config.cwd.as_path())
@@ -923,7 +925,7 @@ pub(crate) fn build_guardian_review_session_config(
         guardian_config.permissions.network = Some(NetworkProxySpec::from_config_and_constraints(
             live_network_config,
             network_constraints,
-            guardian_config.permissions.permission_profile.get(),
+            guardian_config.permissions.permission_profile_ref(),
         )?);
     }
     for feature in [

codex-rs/core/src/guardian/tests.rs

@@ -2159,7 +2159,7 @@ async fn guardian_review_session_config_preserves_parent_network_proxy() {
             }),
             ..Default::default()
         }),
-        parent_config.permissions.permission_profile.get(),
+        parent_config.permissions.permission_profile_ref(),
     )
     .expect("network proxy spec");
     parent_config.permissions.network = Some(network.clone());
@@ -2186,8 +2186,8 @@ async fn guardian_review_session_config_preserves_parent_network_proxy() {
         Constrained::allow_only(AskForApproval::Never)
     );
     assert_eq!(
-        guardian_config.permissions.permission_profile,
-        Constrained::allow_only(PermissionProfile::from_legacy_sandbox_policy(
+        guardian_config.permissions.permission_profile_constraint(),
+        &Constrained::allow_only(PermissionProfile::from_legacy_sandbox_policy(
             &SandboxPolicy::new_read_only_policy(),
         ))
     );
@@ -2226,7 +2226,7 @@ async fn guardian_review_session_config_uses_live_network_proxy_state() {
         NetworkProxySpec::from_config_and_constraints(
             parent_network,
             /*requirements*/ None,
-            parent_config.permissions.permission_profile.get(),
+            parent_config.permissions.permission_profile_ref(),
         )
         .expect("parent network proxy spec"),
     );

codex-rs/core/src/personality_migration_tests.rs

@@ -47,6 +47,7 @@ async fn write_rollout_with_user_event(dir: &Path, thread_id: ThreadId) -> io::R
             forked_from_id: None,
             timestamp: TEST_TIMESTAMP.to_string(),
             cwd: std::path::PathBuf::from("."),
+            workspace_roots: Vec::new(),
             originator: "test_originator".to_string(),
             cli_version: "test_version".to_string(),
             source: SessionSource::Cli,

codex-rs/core/src/rollout.rs

@@ -37,6 +37,10 @@ impl codex_rollout::RolloutConfigView for Config {
         self.cwd.as_path()
     }
 
+    fn workspace_roots(&self) -> &[codex_utils_absolute_path::AbsolutePathBuf] {
+        &self.workspace_roots
+    }
+
     fn model_provider_id(&self) -> &str {
         self.model_provider_id.as_str()
     }

codex-rs/core/src/safety_tests.rs

@@ -33,7 +33,6 @@ fn test_writable_roots_constraint() {
     // Policy limited to the workspace only; exclude system temp roots so
     // only `cwd` is writable by default.
     let policy_workspace_only = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,
@@ -51,17 +50,16 @@ fn test_writable_roots_constraint() {
         &cwd,
     ));
 
-    // With the parent dir explicitly added as a writable root, the
-    // outside write should be permitted.
-    let policy_with_parent = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![parent],
-        network_access: false,
-        exclude_tmpdir_env_var: true,
-        exclude_slash_tmp: true,
-    };
+    // With the parent dir explicitly added as a workspace root, the outside
+    // write should be permitted.
+    let file_system_policy_with_parent =
+        FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
+            path: FileSystemPath::Path { path: parent },
+            access: FileSystemAccessMode::Write,
+        }]);
     assert!(is_write_patch_constrained_to_writable_paths(
         &add_outside,
-        &FileSystemSandboxPolicy::from(&policy_with_parent),
+        &file_system_policy_with_parent,
         &cwd,
     ));
 }
@@ -101,7 +99,6 @@ fn granular_with_all_flags_true_matches_on_request_for_out_of_root_patch() {
     let outside_path = parent.join("outside.txt");
     let add_outside = ApplyPatchAction::new_add_for_test(&outside_path, "".to_string());
     let policy_workspace_only = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,
@@ -145,7 +142,6 @@ fn granular_sandbox_approval_false_rejects_out_of_root_patch() {
     let outside_path = parent.join("outside.txt");
     let add_outside = ApplyPatchAction::new_add_for_test(&outside_path, "".to_string());
     let policy_workspace_only = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,
@@ -295,7 +291,6 @@ fn missing_project_dot_codex_config_requires_approval() {
     let config_path = cwd.join(".codex").join("config.toml");
     let action = ApplyPatchAction::new_add_for_test(&config_path, "".to_string());
     let sandbox_policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,

codex-rs/core/src/session/handlers.rs

@@ -143,6 +143,7 @@ pub(super) async fn user_input_or_turn_inner(
                 items,
                 SessionSettingsUpdate {
                     cwd: Some(cwd),
+                    workspace_roots: None,
                     approval_policy: Some(approval_policy),
                     approvals_reviewer,
                     sandbox_policy: Some(sandbox_policy),
@@ -163,6 +164,7 @@ pub(super) async fn user_input_or_turn_inner(
         }
         Op::UserInputWithTurnContext {
             cwd,
+            workspace_roots,
             approval_policy,
             approvals_reviewer,
             sandbox_policy,
@@ -195,6 +197,8 @@ pub(super) async fn user_input_or_turn_inner(
                 items,
                 SessionSettingsUpdate {
                     cwd,
+                    workspace_roots: workspace_roots
+                        .map(|roots| roots.into_iter().map(|root| root.to_path_buf()).collect()),
                     approval_policy,
                     approvals_reviewer,
                     sandbox_policy,

codex-rs/core/src/session/mod.rs

@@ -615,10 +615,11 @@ impl Codex {
             compact_prompt: config.compact_prompt.clone(),
             approval_policy: config.permissions.approval_policy.clone(),
             approvals_reviewer: config.approvals_reviewer,
-            permission_profile: config.permissions.permission_profile.clone(),
+            permission_profile: config.permissions.permission_profile_constraint().clone(),
             active_permission_profile: config.permissions.active_permission_profile(),
             windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
             cwd: config.cwd.clone(),
+            workspace_roots: config.workspace_roots.clone(),
             codex_home: config.codex_home.clone(),
             thread_name: None,
             environments: environment_selections.to_selections(),
@@ -2581,9 +2582,13 @@ impl Session {
             developer_sections.push(model_switch_message);
         }
         if turn_context.config.include_permissions_instructions {
+            let permission_profile = turn_context
+                .permission_profile
+                .clone()
+                .materialize_project_roots_with_workspace_roots(&turn_context.workspace_roots);
             developer_sections.push(
                 PermissionsInstructions::from_permission_profile(
-                    &turn_context.permission_profile,
+                    &permission_profile,
                     turn_context.approval_policy.value(),
                     turn_context.config.approvals_reviewer,
                     self.services.exec_policy.current().as_ref(),

codex-rs/core/src/session/review.rs

@@ -143,6 +143,7 @@ pub(super) async fn spawn_review_thread(
         windows_sandbox_level: parent_turn_context.windows_sandbox_level,
         shell_environment_policy: parent_turn_context.shell_environment_policy.clone(),
         cwd: parent_turn_context.cwd.clone(),
+        workspace_roots: parent_turn_context.workspace_roots.clone(),
         final_output_json_schema: None,
         codex_self_exe: parent_turn_context.codex_self_exe.clone(),
         codex_linux_sandbox_exe: parent_turn_context.codex_linux_sandbox_exe.clone(),

codex-rs/core/src/session/rollout_reconstruction_tests.rs

@@ -61,11 +61,13 @@ async fn record_initial_history_resumed_bare_turn_context_does_not_hydrate_previ
         turn_id: Some(turn_context.sub_id.clone()),
         trace_id: turn_context.trace_id.clone(),
         cwd: turn_context.cwd.to_path_buf(),
+        workspace_roots: turn_context.workspace_roots.clone(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
         approval_policy: turn_context.approval_policy.value(),
         sandbox_policy: turn_context.sandbox_policy(),
         permission_profile: None,
+        active_permission_profile: None,
         network: None,
         file_system_sandbox_policy: None,
         model: previous_model.to_string(),
@@ -102,11 +104,13 @@ async fn record_initial_history_resumed_hydrates_previous_turn_settings_from_lif
         turn_id: Some(turn_context.sub_id.clone()),
         trace_id: turn_context.trace_id.clone(),
         cwd: turn_context.cwd.to_path_buf(),
+        workspace_roots: turn_context.workspace_roots.clone(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
         approval_policy: turn_context.approval_policy.value(),
         sandbox_policy: turn_context.sandbox_policy(),
         permission_profile: None,
+        active_permission_profile: None,
         network: None,
         file_system_sandbox_policy: None,
         model: previous_model.to_string(),
@@ -912,11 +916,13 @@ async fn record_initial_history_resumed_turn_context_after_compaction_reestablis
         turn_id: Some(turn_context.sub_id.clone()),
         trace_id: turn_context.trace_id.clone(),
         cwd: turn_context.cwd.to_path_buf(),
+        workspace_roots: turn_context.workspace_roots.clone(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
         approval_policy: turn_context.approval_policy.value(),
         sandbox_policy: turn_context.sandbox_policy(),
         permission_profile: None,
+        active_permission_profile: None,
         network: None,
         file_system_sandbox_policy: None,
         model: previous_model.to_string(),
@@ -990,11 +996,13 @@ async fn record_initial_history_resumed_turn_context_after_compaction_reestablis
             turn_id: Some(turn_context.sub_id.clone()),
             trace_id: turn_context.trace_id.clone(),
             cwd: turn_context.cwd.to_path_buf(),
+            workspace_roots: turn_context.workspace_roots.clone(),
             current_date: turn_context.current_date.clone(),
             timezone: turn_context.timezone.clone(),
             approval_policy: turn_context.approval_policy.value(),
             sandbox_policy: turn_context.sandbox_policy(),
             permission_profile: None,
+            active_permission_profile: None,
             network: None,
             file_system_sandbox_policy: None,
             model: previous_model.to_string(),
@@ -1021,11 +1029,13 @@ async fn record_initial_history_resumed_aborted_turn_without_id_clears_active_tu
         turn_id: Some(turn_context.sub_id.clone()),
         trace_id: turn_context.trace_id.clone(),
         cwd: turn_context.cwd.to_path_buf(),
+        workspace_roots: turn_context.workspace_roots.clone(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
         approval_policy: turn_context.approval_policy.value(),
         sandbox_policy: turn_context.sandbox_policy(),
         permission_profile: None,
+        active_permission_profile: None,
         network: None,
         file_system_sandbox_policy: None,
         model: previous_model.to_string(),
@@ -1136,11 +1146,13 @@ async fn record_initial_history_resumed_unmatched_abort_preserves_active_turn_fo
         turn_id: Some(current_turn_id.clone()),
         trace_id: turn_context.trace_id.clone(),
         cwd: turn_context.cwd.to_path_buf(),
+        workspace_roots: turn_context.workspace_roots.clone(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
         approval_policy: turn_context.approval_policy.value(),
         sandbox_policy: turn_context.sandbox_policy(),
         permission_profile: None,
+        active_permission_profile: None,
         network: None,
         file_system_sandbox_policy: None,
         model: current_model.to_string(),
@@ -1250,11 +1262,13 @@ async fn record_initial_history_resumed_trailing_incomplete_turn_compaction_clea
         turn_id: Some(turn_context.sub_id.clone()),
         trace_id: turn_context.trace_id.clone(),
         cwd: turn_context.cwd.to_path_buf(),
+        workspace_roots: turn_context.workspace_roots.clone(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
         approval_policy: turn_context.approval_policy.value(),
         sandbox_policy: turn_context.sandbox_policy(),
         permission_profile: None,
+        active_permission_profile: None,
         network: None,
         file_system_sandbox_policy: None,
         model: previous_model.to_string(),
@@ -1402,11 +1416,13 @@ async fn record_initial_history_resumed_replaced_incomplete_compacted_turn_clear
         turn_id: Some(turn_context.sub_id.clone()),
         trace_id: turn_context.trace_id.clone(),
         cwd: turn_context.cwd.to_path_buf(),
+        workspace_roots: turn_context.workspace_roots.clone(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
         approval_policy: turn_context.approval_policy.value(),
         sandbox_policy: turn_context.sandbox_policy(),
         permission_profile: None,
+        active_permission_profile: None,
         network: None,
         file_system_sandbox_policy: None,
         model: previous_model.to_string(),

codex-rs/core/src/session/session.rs

@@ -75,6 +75,9 @@ pub(crate) struct SessionConfiguration {
     /// execution sandbox are resolved against this directory **instead** of
     /// the process-wide current working directory.
     pub(super) cwd: AbsolutePathBuf,
+    /// Workspace roots used to materialize symbolic `:project_roots`
+    /// permission entries for this thread.
+    pub(super) workspace_roots: Vec<AbsolutePathBuf>,
     /// Directory containing all Codex state for this session.
     pub(super) codex_home: AbsolutePathBuf,
     /// Optional user-facing name for the thread, updated during the session.
@@ -112,12 +115,13 @@ impl SessionConfiguration {
     }
 
     pub(super) fn sandbox_policy(&self) -> SandboxPolicy {
-        self.permission_profile()
+        let permission_profile = self.materialized_permission_profile();
+        permission_profile
             .to_legacy_sandbox_policy(&self.cwd)
             .unwrap_or_else(|_| {
                 let file_system_sandbox_policy = self.file_system_sandbox_policy();
                 codex_sandboxing::compatibility_sandbox_policy_for_permission_profile(
-                    self.permission_profile.get(),
+                    &permission_profile,
                     &file_system_sandbox_policy,
                     self.network_sandbox_policy(),
                     &self.cwd,
@@ -126,13 +130,21 @@ impl SessionConfiguration {
     }
 
     pub(super) fn file_system_sandbox_policy(&self) -> FileSystemSandboxPolicy {
-        self.permission_profile.get().file_system_sandbox_policy()
+        self.materialized_permission_profile()
+            .file_system_sandbox_policy()
     }
 
     pub(super) fn network_sandbox_policy(&self) -> NetworkSandboxPolicy {
         self.permission_profile.get().network_sandbox_policy()
     }
 
+    fn materialized_permission_profile(&self) -> PermissionProfile {
+        self.permission_profile
+            .get()
+            .clone()
+            .materialize_project_roots_with_workspace_roots(&self.workspace_roots)
+    }
+
     pub(super) fn thread_config_snapshot(&self) -> ThreadConfigSnapshot {
         ThreadConfigSnapshot {
             model: self.collaboration_mode.model().to_string(),
@@ -143,6 +155,7 @@ impl SessionConfiguration {
             permission_profile: self.permission_profile(),
             active_permission_profile: self.active_permission_profile(),
             cwd: self.cwd.clone(),
+            workspace_roots: self.workspace_roots.clone(),
             ephemeral: self.original_config_do_not_use.ephemeral,
             reasoning_effort: self.collaboration_mode.reasoning_effort(),
             personality: self.personality,
@@ -223,6 +236,20 @@ impl SessionConfiguration {
         let cwd_changed = absolute_cwd.as_path() != self.cwd.as_path();
         next_configuration.cwd = absolute_cwd;
 
+        if let Some(workspace_roots) = updates.workspace_roots.clone() {
+            let mut workspace_roots: Vec<AbsolutePathBuf> = workspace_roots
+                .into_iter()
+                .map(|path| {
+                    AbsolutePathBuf::resolve_path_against_base(
+                        normalize_for_native_workdir(path.as_path()),
+                        next_configuration.cwd.as_path(),
+                    )
+                })
+                .collect();
+            dedupe_absolute_paths(&mut workspace_roots);
+            next_configuration.workspace_roots = workspace_roots;
+        }
+
         if let Some(permission_profile) = updates.permission_profile.clone() {
             let active_permission_profile =
                 updates.active_permission_profile.clone().or_else(|| {
@@ -253,26 +280,31 @@ impl SessionConfiguration {
                 ),
             )?;
             next_configuration.active_permission_profile = None;
-        } else if cwd_changed
-            && file_system_policy_matches_legacy
-            && file_system_policy_has_rebindable_project_root_write
-        {
-            // Preserve richer split policies across cwd-only updates; only
-            // rederive when the session is already using a structurally
-            // cwd-bound legacy bridge.
-            let file_system_sandbox_policy =
-                FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_deny_entries(
-                    &current_sandbox_policy,
-                    &next_configuration.cwd,
-                    &current_file_system_sandbox_policy,
-                );
-            next_configuration.permission_profile.set(
-                PermissionProfile::from_runtime_permissions_with_enforcement(
-                    SandboxEnforcement::from_legacy_sandbox_policy(&current_sandbox_policy),
-                    &file_system_sandbox_policy,
-                    current_network_sandbox_policy,
-                ),
-            )?;
+        } else {
+            if cwd_changed
+                && file_system_policy_matches_legacy
+                && file_system_policy_has_rebindable_project_root_write
+            {
+                // Preserve richer split policies across cwd-only updates; only
+                // rederive when the session is already using a structurally
+                // cwd-bound legacy bridge.
+                let file_system_sandbox_policy =
+                    FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_deny_entries(
+                        &current_sandbox_policy,
+                        &next_configuration.cwd,
+                        &current_file_system_sandbox_policy,
+                    );
+                next_configuration.permission_profile.set(
+                    PermissionProfile::from_runtime_permissions_with_enforcement(
+                        SandboxEnforcement::from_legacy_sandbox_policy(&current_sandbox_policy),
+                        &file_system_sandbox_policy,
+                        current_network_sandbox_policy,
+                    ),
+                )?;
+            }
+            if let Some(active_permission_profile) = updates.active_permission_profile.clone() {
+                next_configuration.active_permission_profile = Some(active_permission_profile);
+            }
         }
         if let Some(app_server_client_name) = updates.app_server_client_name.clone() {
             next_configuration.app_server_client_name = Some(app_server_client_name);
@@ -306,9 +338,15 @@ impl SessionConfiguration {
     }
 }
 
+fn dedupe_absolute_paths(paths: &mut Vec<AbsolutePathBuf>) {
+    let mut seen = std::collections::HashSet::new();
+    paths.retain(|path| seen.insert(path.clone()));
+}
+
 #[derive(Default, Clone)]
 pub(crate) struct SessionSettingsUpdate {
     pub(crate) cwd: Option<PathBuf>,
+    pub(crate) workspace_roots: Option<Vec<PathBuf>>,
     pub(crate) approval_policy: Option<AskForApproval>,
     pub(crate) approvals_reviewer: Option<ApprovalsReviewer>,
     pub(crate) sandbox_policy: Option<SandboxPolicy>,
@@ -425,6 +463,7 @@ impl Session {
                                 dynamic_tools: session_configuration.dynamic_tools.clone(),
                                 metadata: ThreadPersistenceMetadata {
                                     cwd: Some(config.cwd.to_path_buf()),
+                                    workspace_roots: config.workspace_roots.clone(),
                                     model_provider: config.model_provider_id.clone(),
                                     memory_mode: if config.memories.generate_memories {
                                         ThreadMemoryMode::Enabled
@@ -447,6 +486,7 @@ impl Session {
                                 include_archived: true,
                                 metadata: ThreadPersistenceMetadata {
                                     cwd: Some(config.cwd.to_path_buf()),
+                                    workspace_roots: config.workspace_roots.clone(),
                                     model_provider: config.model_provider_id.clone(),
                                     memory_mode: if config.memories.generate_memories {
                                         ThreadMemoryMode::Enabled
@@ -769,7 +809,7 @@ impl Session {
                     let (network_proxy, session_network_proxy) = Self::start_managed_network_proxy(
                         spec,
                         current_exec_policy.as_ref(),
-                        config.permissions.permission_profile.get(),
+                        config.permissions.permission_profile_ref(),
                         network_policy_decider.as_ref().map(Arc::clone),
                         blocked_request_observer.as_ref().map(Arc::clone),
                         managed_network_requirements_configured,
@@ -832,7 +872,7 @@ impl Session {
                 // setup is straightforward enough and performs well.
                 mcp_connection_manager: Arc::new(RwLock::new(McpConnectionManager::new_uninitialized(
                     &config.permissions.approval_policy,
-                    &config.permissions.permission_profile,
+                    config.permissions.permission_profile_constraint(),
                 ))),
                 mcp_startup_cancellation_token: Mutex::new(CancellationToken::new()),
                 unified_exec_manager: UnifiedExecProcessManager::new(
@@ -934,6 +974,7 @@ impl Session {
                     permission_profile: session_configuration.permission_profile(),
                     active_permission_profile: session_configuration.active_permission_profile(),
                     cwd: session_configuration.cwd.clone(),
+                    workspace_roots: session_configuration.workspace_roots.clone(),
                     reasoning_effort: session_configuration.collaboration_mode.reasoning_effort(),
                     initial_messages,
                     network_proxy: session_network_proxy.filter(|_| {

codex-rs/core/src/session/tests.rs

@@ -1823,8 +1823,10 @@ async fn session_configured_reports_permission_profile_for_external_sandbox() ->
     };
     let expected_sandbox_policy = sandbox_policy.clone();
     let mut builder = test_codex().with_config(move |config| {
-        config.permissions.permission_profile = codex_config::Constrained::allow_any(
-            PermissionProfile::from_legacy_sandbox_policy(&sandbox_policy),
+        config.permissions.replace_permission_profile_constraint(
+            codex_config::Constrained::allow_any(PermissionProfile::from_legacy_sandbox_policy(
+                &sandbox_policy,
+            )),
         );
         config
             .set_legacy_sandbox_policy(sandbox_policy)
@@ -1977,11 +1979,13 @@ async fn record_initial_history_forked_hydrates_previous_turn_settings() {
         turn_id: Some(turn_context.sub_id.clone()),
         trace_id: turn_context.trace_id.clone(),
         cwd: turn_context.cwd.to_path_buf(),
+        workspace_roots: turn_context.workspace_roots.clone(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
         approval_policy: turn_context.approval_policy.value(),
         sandbox_policy: turn_context.sandbox_policy(),
         permission_profile: None,
+        active_permission_profile: None,
         network: None,
         file_system_sandbox_policy: None,
         model: previous_model.to_string(),
@@ -2578,10 +2582,11 @@ async fn set_rate_limits_retains_previous_credits() {
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
+        permission_profile: config.permissions.permission_profile_constraint().clone(),
         active_permission_profile: config.permissions.active_permission_profile(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: Vec::new(),
@@ -2682,10 +2687,11 @@ async fn set_rate_limits_updates_plan_type_when_present() {
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
+        permission_profile: config.permissions.permission_profile_constraint().clone(),
         active_permission_profile: config.permissions.active_permission_profile(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: Vec::new(),
@@ -2948,6 +2954,7 @@ async fn attach_thread_persistence(session: &mut Session) -> PathBuf {
             dynamic_tools: Vec::new(),
             metadata: ThreadPersistenceMetadata {
                 cwd: Some(config.cwd.to_path_buf()),
+                workspace_roots: config.workspace_roots.clone(),
                 model_provider: config.model_provider_id.clone(),
                 memory_mode: if config.memories.generate_memories {
                     ThreadMemoryMode::Enabled
@@ -3155,10 +3162,11 @@ pub(crate) async fn make_session_configuration_for_tests() -> SessionConfigurati
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
+        permission_profile: config.permissions.permission_profile_constraint().clone(),
         active_permission_profile: config.permissions.active_permission_profile(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: Vec::new(),
@@ -3201,7 +3209,6 @@ async fn session_configuration_apply_preserves_profile_file_system_policy_on_cwd
 
     session_configuration.cwd = original_cwd.abs();
     let sandbox_policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: Vec::new(),
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,
@@ -3235,9 +3242,15 @@ async fn session_configuration_apply_preserves_profile_file_system_policy_on_cwd
         .expect("cwd-only update should succeed");
 
     assert_eq!(
-        updated.file_system_sandbox_policy(),
+        updated.permission_profile().file_system_sandbox_policy(),
         file_system_sandbox_policy
     );
+    let expected_materialized_file_system_policy = file_system_sandbox_policy
+        .materialize_project_roots_with_workspace_roots(&updated.workspace_roots);
+    assert_eq!(
+        updated.file_system_sandbox_policy(),
+        expected_materialized_file_system_policy
+    );
 }
 
 #[tokio::test]
@@ -3287,9 +3300,16 @@ async fn session_configuration_apply_permission_profile_preserves_existing_deny_
     expected_file_system_policy.glob_scan_max_depth = Some(2);
     expected_file_system_policy.entries.push(deny_entry);
     assert_eq!(
-        updated.file_system_sandbox_policy(),
+        updated.permission_profile().file_system_sandbox_policy(),
         expected_file_system_policy
     );
+    let expected_materialized_file_system_policy = expected_file_system_policy
+        .clone()
+        .materialize_project_roots_with_workspace_roots(&updated.workspace_roots);
+    assert_eq!(
+        updated.file_system_sandbox_policy(),
+        expected_materialized_file_system_policy
+    );
 }
 
 #[tokio::test]
@@ -3306,7 +3326,7 @@ async fn session_configuration_apply_permission_profile_accepts_direct_write_roo
     let file_system_sandbox_policy =
         FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
             path: FileSystemPath::Path {
-                path: external_write_path.clone(),
+                path: external_write_path,
             },
             access: FileSystemAccessMode::Write,
         }]);
@@ -3330,7 +3350,6 @@ async fn session_configuration_apply_permission_profile_accepts_direct_write_roo
     assert_eq!(
         updated.sandbox_policy(),
         SandboxPolicy::WorkspaceWrite {
-            writable_roots: vec![external_write_path],
             network_access: false,
             exclude_tmpdir_env_var: true,
             exclude_slash_tmp: true,
@@ -3425,14 +3444,15 @@ enabled = false
 }
 
 #[tokio::test]
-async fn session_configuration_apply_rederives_legacy_file_system_policy_on_cwd_update() {
+async fn session_configuration_apply_preserves_legacy_workspace_roots_on_cwd_update() {
     let mut session_configuration = make_session_configuration_for_tests().await;
     let workspace = tempfile::tempdir().expect("create temp dir");
     let project_root = workspace.path().join("project");
     let original_cwd = project_root.join("subdir");
-    session_configuration.cwd = original_cwd.abs();
+    let original_cwd = original_cwd.abs();
+    session_configuration.cwd = original_cwd.clone();
+    session_configuration.workspace_roots = vec![original_cwd.clone()];
     let sandbox_policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: Vec::new(),
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,
@@ -3451,20 +3471,61 @@ async fn session_configuration_apply_rederives_legacy_file_system_policy_on_cwd_
 
     let updated = session_configuration
         .apply(&SessionSettingsUpdate {
-            cwd: Some(project_root.clone()),
+            cwd: Some(project_root),
             ..Default::default()
         })
         .expect("cwd-only update should succeed");
 
-    let expected_file_system_policy = FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
-        &updated.sandbox_policy(),
-        &project_root,
-    );
+    let expected_file_system_policy = file_system_sandbox_policy
+        .materialize_project_roots_with_workspace_roots(std::slice::from_ref(&original_cwd));
+    assert_eq!(updated.workspace_roots, vec![original_cwd.clone()]);
     assert!(
         updated
             .file_system_sandbox_policy()
-            .is_semantically_equivalent_to(&expected_file_system_policy, &project_root),
-        "cwd-only update should rederive the legacy filesystem policy for the new cwd"
+            .is_semantically_equivalent_to(&expected_file_system_policy, original_cwd.as_path()),
+        "cwd-only update should preserve the existing workspace roots"
+    );
+}
+
+#[tokio::test]
+async fn session_configuration_apply_preserves_active_permission_profile_on_legacy_cwd_update() {
+    let mut session_configuration = make_session_configuration_for_tests().await;
+    let workspace = tempfile::tempdir().expect("create temp dir");
+    let project_root = workspace.path().join("project");
+    let original_cwd = project_root.join("subdir");
+    let original_cwd = original_cwd.abs();
+    session_configuration.cwd = original_cwd.clone();
+    session_configuration.workspace_roots = vec![original_cwd];
+    let sandbox_policy = SandboxPolicy::WorkspaceWrite {
+        network_access: false,
+        exclude_tmpdir_env_var: true,
+        exclude_slash_tmp: true,
+    };
+    let file_system_sandbox_policy = FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
+        &sandbox_policy,
+        &session_configuration.cwd,
+    );
+    session_configuration.permission_profile = codex_config::Constrained::allow_any(
+        PermissionProfile::from_runtime_permissions_with_enforcement(
+            SandboxEnforcement::from_legacy_sandbox_policy(&sandbox_policy),
+            &file_system_sandbox_policy,
+            NetworkSandboxPolicy::from(&sandbox_policy),
+        ),
+    );
+
+    let active_permission_profile =
+        codex_protocol::models::ActivePermissionProfile::new(":workspace");
+    let updated = session_configuration
+        .apply(&SessionSettingsUpdate {
+            cwd: Some(project_root),
+            active_permission_profile: Some(active_permission_profile.clone()),
+            ..Default::default()
+        })
+        .expect("cwd and active permission profile update should succeed");
+
+    assert_eq!(
+        updated.active_permission_profile(),
+        Some(active_permission_profile)
     );
 }
 
@@ -3681,10 +3742,11 @@ async fn session_new_fails_when_zsh_fork_enabled_without_zsh_path() {
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
+        permission_profile: config.permissions.permission_profile_constraint().clone(),
         active_permission_profile: config.permissions.active_permission_profile(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: Vec::new(),
@@ -3790,10 +3852,11 @@ pub(crate) async fn make_session_and_context() -> (Session, TurnContext) {
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
+        permission_profile: config.permissions.permission_profile_constraint().clone(),
         active_permission_profile: config.permissions.active_permission_profile(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: default_environments,
@@ -3837,7 +3900,7 @@ pub(crate) async fn make_session_and_context() -> (Session, TurnContext) {
     let services = SessionServices {
         mcp_connection_manager: Arc::new(RwLock::new(McpConnectionManager::new_uninitialized(
             &config.permissions.approval_policy,
-            &config.permissions.permission_profile,
+            config.permissions.permission_profile_constraint(),
         ))),
         mcp_startup_cancellation_token: Mutex::new(CancellationToken::new()),
         unified_exec_manager: UnifiedExecProcessManager::new(
@@ -4020,10 +4083,11 @@ async fn make_session_with_config_and_rx(
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
+        permission_profile: config.permissions.permission_profile_constraint().clone(),
         active_permission_profile: config.permissions.active_permission_profile(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: default_environments,
@@ -4123,10 +4187,11 @@ async fn make_session_with_history_source_and_agent_control_and_rx(
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
+        permission_profile: config.permissions.permission_profile_constraint().clone(),
         active_permission_profile: config.permissions.active_permission_profile(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: default_environments,
@@ -4774,6 +4839,7 @@ fn op_kind_distinguishes_turn_ops() {
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
             cwd: None,
+            workspace_roots: None,
             approval_policy: None,
             approvals_reviewer: None,
             sandbox_policy: None,
@@ -5169,6 +5235,7 @@ async fn shutdown_complete_does_not_append_to_thread_store_after_shutdown() {
             dynamic_tools: Vec::new(),
             metadata: ThreadPersistenceMetadata {
                 cwd: Some(config.cwd.to_path_buf()),
+                workspace_roots: config.workspace_roots.clone(),
                 model_provider: config.model_provider_id.clone(),
                 memory_mode: if config.memories.generate_memories {
                     ThreadMemoryMode::Enabled
@@ -5510,10 +5577,11 @@ where
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
+        permission_profile: config.permissions.permission_profile_constraint().clone(),
         active_permission_profile: config.permissions.active_permission_profile(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: default_environments,
@@ -5557,7 +5625,7 @@ where
     let services = SessionServices {
         mcp_connection_manager: Arc::new(RwLock::new(McpConnectionManager::new_uninitialized(
             &config.permissions.approval_policy,
-            &config.permissions.permission_profile,
+            config.permissions.permission_profile_constraint(),
         ))),
         mcp_startup_cancellation_token: Mutex::new(CancellationToken::new()),
         unified_exec_manager: UnifiedExecProcessManager::new(

codex-rs/core/src/session/turn_context.rs

@@ -70,6 +70,7 @@ pub struct TurnContext {
     /// by the model as well as sandbox policies are resolved against this path
     /// instead of `std::env::current_dir()`.
     pub(crate) cwd: AbsolutePathBuf,
+    pub(crate) workspace_roots: Vec<AbsolutePathBuf>,
     pub(crate) current_date: Option<String>,
     pub(crate) timezone: Option<String>,
     pub(crate) app_server_client_name: Option<String>,
@@ -103,7 +104,10 @@ impl TurnContext {
     }
 
     pub(crate) fn file_system_sandbox_policy(&self) -> FileSystemSandboxPolicy {
-        self.permission_profile.file_system_sandbox_policy()
+        self.permission_profile
+            .clone()
+            .materialize_project_roots_with_workspace_roots(&self.workspace_roots)
+            .file_system_sandbox_policy()
     }
 
     pub(crate) fn network_sandbox_policy(&self) -> NetworkSandboxPolicy {
@@ -252,6 +256,7 @@ impl TurnContext {
             thread_source: self.thread_source,
             environments: self.environments.clone(),
             cwd: self.cwd.clone(),
+            workspace_roots: self.workspace_roots.clone(),
             current_date: self.current_date.clone(),
             timezone: self.timezone.clone(),
             app_server_client_name: self.app_server_client_name.clone(),
@@ -312,6 +317,7 @@ impl TurnContext {
         FileSystemSandboxContext {
             permissions,
             cwd: Some(self.cwd.clone()),
+            workspace_roots: self.workspace_roots.clone(),
             windows_sandbox_level: self.windows_sandbox_level,
             windows_sandbox_private_desktop: self
                 .config
@@ -347,11 +353,13 @@ impl TurnContext {
             turn_id: Some(self.sub_id.clone()),
             trace_id: self.trace_id.clone(),
             cwd: self.cwd.to_path_buf(),
+            workspace_roots: self.workspace_roots.clone(),
             current_date: self.current_date.clone(),
             timezone: self.timezone.clone(),
             approval_policy: self.approval_policy.value(),
             sandbox_policy: self.sandbox_policy(),
             permission_profile: Some(self.permission_profile()),
+            active_permission_profile: self.config.permissions.active_permission_profile(),
             network: self.turn_context_network_item(),
             file_system_sandbox_policy: self.non_legacy_file_system_sandbox_policy(),
             model: self.model_info.slug.clone(),
@@ -409,14 +417,19 @@ impl Session {
         let config = session_configuration.original_config_do_not_use.clone();
         let mut per_turn_config = (*config).clone();
         per_turn_config.cwd = cwd;
+        per_turn_config.workspace_roots = session_configuration.workspace_roots.clone();
         per_turn_config.model_reasoning_effort =
             session_configuration.collaboration_mode.reasoning_effort();
         per_turn_config.model_reasoning_summary = session_configuration.model_reasoning_summary;
         per_turn_config.service_tier = session_configuration.service_tier.clone();
         per_turn_config.personality = session_configuration.personality;
         per_turn_config.approvals_reviewer = session_configuration.approvals_reviewer;
-        per_turn_config.permissions.permission_profile =
-            session_configuration.permission_profile.clone();
+        per_turn_config
+            .permissions
+            .replace_permission_profile_constraint_with_active_profile(
+                session_configuration.permission_profile.clone(),
+                session_configuration.active_permission_profile(),
+            );
         let permission_profile = session_configuration.permission_profile();
         let resolved_web_search_mode =
             resolve_web_search_mode_for_turn(&per_turn_config.web_search_mode, &permission_profile);
@@ -550,6 +563,7 @@ impl Session {
             thread_source: session_configuration.thread_source,
             environments,
             cwd,
+            workspace_roots: session_configuration.workspace_roots.clone(),
             current_date: Some(current_date),
             timezone: Some(timezone),
             app_server_client_name: session_configuration.app_server_client_name.clone(),

codex-rs/core/src/tools/handlers/apply_patch_tests.rs

@@ -252,7 +252,6 @@ fn write_permissions_for_paths_skip_dirs_already_writable_under_workspace_root()
     let file_path = AbsolutePathBuf::try_from(nested.join("file.txt"))
         .expect("nested file path should be absolute");
     let sandbox_policy = FileSystemSandboxPolicy::from(&SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: false,
@@ -274,7 +273,6 @@ fn write_permissions_for_paths_keep_dirs_outside_workspace_root() {
         .expect("outside file path should be absolute");
     let cwd_abs = cwd.abs();
     let sandbox_policy = FileSystemSandboxPolicy::from(&SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,

codex-rs/core/src/tools/handlers/multi_agents_common.rs

@@ -269,6 +269,7 @@ pub(crate) fn apply_spawn_agent_runtime_overrides(
     config.permissions.shell_environment_policy = turn.shell_environment_policy.clone();
     config.codex_linux_sandbox_exe = turn.codex_linux_sandbox_exe.clone();
     config.cwd = turn.cwd.clone();
+    config.workspace_roots = turn.workspace_roots.clone();
     config
         .permissions
         .set_permission_profile(turn.permission_profile())

codex-rs/core/src/tools/handlers/multi_agents_tests.rs

@@ -3402,7 +3402,7 @@ async fn build_agent_spawn_config_uses_turn_context_values() {
     turn.cwd = temp_dir.abs();
     turn.codex_linux_sandbox_exe = Some(PathBuf::from("/bin/echo"));
     let sandbox_policy = pick_allowed_sandbox_policy(
-        &turn.config.permissions.permission_profile,
+        turn.config.permissions.permission_profile_constraint(),
         turn.config.legacy_sandbox_policy(),
         turn.cwd.as_path(),
     );

codex-rs/core/src/tools/orchestrator.rs

@@ -85,6 +85,7 @@ impl ToolOrchestrator {
             enforce_managed_network: attempt.enforce_managed_network,
             manager: attempt.manager,
             sandbox_cwd: attempt.sandbox_cwd,
+            workspace_roots: attempt.workspace_roots,
             codex_linux_sandbox_exe: attempt.codex_linux_sandbox_exe,
             use_legacy_landlock: attempt.use_legacy_landlock,
             windows_sandbox_level: attempt.windows_sandbox_level,
@@ -241,6 +242,7 @@ impl ToolOrchestrator {
             enforce_managed_network: managed_network_active,
             manager: &self.sandbox,
             sandbox_cwd,
+            workspace_roots: &turn_ctx.workspace_roots,
             codex_linux_sandbox_exe: turn_ctx.codex_linux_sandbox_exe.as_ref(),
             use_legacy_landlock,
             windows_sandbox_level: turn_ctx.windows_sandbox_level,
@@ -359,6 +361,7 @@ impl ToolOrchestrator {
                     enforce_managed_network: managed_network_active,
                     manager: &self.sandbox,
                     sandbox_cwd,
+                    workspace_roots: &turn_ctx.workspace_roots,
                     codex_linux_sandbox_exe: None,
                     use_legacy_landlock,
                     windows_sandbox_level: turn_ctx.windows_sandbox_level,

codex-rs/core/src/tools/runtimes/apply_patch.rs

@@ -99,6 +99,7 @@ impl ApplyPatchRuntime {
         Some(FileSystemSandboxContext {
             permissions,
             cwd: Some(attempt.sandbox_cwd.clone()),
+            workspace_roots: attempt.workspace_roots.to_vec(),
             windows_sandbox_level: attempt.windows_sandbox_level,
             windows_sandbox_private_desktop: attempt.windows_sandbox_private_desktop,
             use_legacy_landlock: attempt.use_legacy_landlock,

codex-rs/core/src/tools/runtimes/apply_patch_tests.rs

@@ -214,6 +214,7 @@ async fn file_system_sandbox_context_uses_active_attempt() {
         enforce_managed_network: false,
         manager: &manager,
         sandbox_cwd: &path,
+        workspace_roots: std::slice::from_ref(&path),
         codex_linux_sandbox_exe: None,
         use_legacy_landlock: true,
         windows_sandbox_level: WindowsSandboxLevel::RestrictedToken,
@@ -267,6 +268,7 @@ async fn no_sandbox_attempt_has_no_file_system_context() {
         enforce_managed_network: false,
         manager: &manager,
         sandbox_cwd: &path,
+        workspace_roots: std::slice::from_ref(&path),
         codex_linux_sandbox_exe: None,
         use_legacy_landlock: false,
         windows_sandbox_level: WindowsSandboxLevel::Disabled,

codex-rs/core/src/tools/runtimes/mod_tests.rs

@@ -111,6 +111,7 @@ async fn explicit_escalation_prepares_exec_without_managed_network() -> anyhow::
         enforce_managed_network: false,
         manager: &manager,
         sandbox_cwd: &cwd,
+        workspace_roots: std::slice::from_ref(&cwd),
         codex_linux_sandbox_exe: None,
         use_legacy_landlock: false,
         windows_sandbox_level: WindowsSandboxLevel::Disabled,

codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs

@@ -168,6 +168,7 @@ pub(super) async fn try_run_zsh_fork(
         windows_sandbox_level,
         arg0,
         sandbox_policy_cwd,
+        workspace_roots: attempt.workspace_roots.to_vec(),
         codex_linux_sandbox_exe: ctx.turn.codex_linux_sandbox_exe.clone(),
         use_legacy_landlock: ctx.turn.features.use_legacy_landlock(),
     };
@@ -232,7 +233,7 @@ pub(super) async fn try_run_zsh_fork(
 
 pub(crate) async fn prepare_unified_exec_zsh_fork(
     req: &crate::tools::runtimes::unified_exec::UnifiedExecRequest,
-    _attempt: &SandboxAttempt<'_>,
+    attempt: &SandboxAttempt<'_>,
     ctx: &ToolCtx,
     exec_request: ExecRequest,
     shell_zsh_path: &std::path::Path,
@@ -269,6 +270,7 @@ pub(crate) async fn prepare_unified_exec_zsh_fork(
         windows_sandbox_level: exec_request.windows_sandbox_level,
         arg0: exec_request.arg0.clone(),
         sandbox_policy_cwd: exec_request.windows_sandbox_policy_cwd.clone(),
+        workspace_roots: attempt.workspace_roots.to_vec(),
         codex_linux_sandbox_exe: ctx.turn.codex_linux_sandbox_exe.clone(),
         use_legacy_landlock: ctx.turn.features.use_legacy_landlock(),
     };
@@ -753,6 +755,7 @@ struct CoreShellCommandExecutor {
     windows_sandbox_level: WindowsSandboxLevel,
     arg0: Option<String>,
     sandbox_policy_cwd: AbsolutePathBuf,
+    workspace_roots: Vec<AbsolutePathBuf>,
     codex_linux_sandbox_exe: Option<PathBuf>,
     use_legacy_landlock: bool,
 }
@@ -923,6 +926,7 @@ impl CoreShellCommandExecutor {
             enforce_managed_network: self.network.is_some(),
             network: self.network.as_ref(),
             sandbox_policy_cwd: &self.sandbox_policy_cwd,
+            workspace_roots: &self.workspace_roots,
             codex_linux_sandbox_exe: self.codex_linux_sandbox_exe.as_deref(),
             use_legacy_landlock: self.use_legacy_landlock,
             windows_sandbox_level: self.windows_sandbox_level,

codex-rs/core/src/tools/sandboxing.rs

@@ -385,6 +385,7 @@ pub(crate) struct SandboxAttempt<'a> {
     pub enforce_managed_network: bool,
     pub(crate) manager: &'a SandboxManager,
     pub(crate) sandbox_cwd: &'a AbsolutePathBuf,
+    pub(crate) workspace_roots: &'a [AbsolutePathBuf],
     pub codex_linux_sandbox_exe: Option<&'a std::path::PathBuf>,
     pub use_legacy_landlock: bool,
     pub windows_sandbox_level: codex_protocol::config_types::WindowsSandboxLevel,
@@ -407,6 +408,7 @@ impl<'a> SandboxAttempt<'a> {
                 enforce_managed_network: self.enforce_managed_network,
                 network,
                 sandbox_policy_cwd: self.sandbox_cwd,
+                workspace_roots: self.workspace_roots,
                 codex_linux_sandbox_exe: self
                     .codex_linux_sandbox_exe
                     .map(std::path::PathBuf::as_path),

codex-rs/core/tests/common/test_codex.rs

@@ -519,6 +519,7 @@ impl TestCodexBuilder {
             load_default_config_for_test(home).await
         };
         config.cwd = cwd_override;
+        config.workspace_roots = vec![config.cwd.clone()];
         config.model_provider = model_provider;
         if let Ok(path) = codex_utils_cargo_bin::cargo_bin("codex") {
             config.codex_self_exe = Some(path);
@@ -543,6 +544,7 @@ impl TestCodexBuilder {
         for mutator in mutators {
             mutator(&mut config);
         }
+        config.workspace_roots = vec![config.cwd.clone()];
         ensure_test_model_catalog(&mut config)?;
 
         if config.include_apply_patch_tool {

codex-rs/core/tests/suite/approvals.rs

@@ -827,7 +827,6 @@ fn scenarios() -> Vec<ScenarioSpec> {
     use AskForApproval::*;
 
     let workspace_write = |network_access| SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access,
         exclude_tmpdir_env_var: false,
         exclude_slash_tmp: false,
@@ -2047,7 +2046,6 @@ async fn approving_apply_patch_for_session_skips_future_prompts_for_same_file()
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
     let sandbox_policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: false,
         exclude_slash_tmp: false,
@@ -2803,7 +2801,6 @@ allow_local_binding = true
     )?;
     let approval_policy = AskForApproval::OnFailure;
     let sandbox_policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: true,
         exclude_tmpdir_env_var: false,
         exclude_slash_tmp: false,
@@ -3083,7 +3080,6 @@ allow_local_binding = true
     )?;
     let approval_policy = AskForApproval::OnFailure;
     let turn_sandbox_policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: true,
         exclude_tmpdir_env_var: false,
         exclude_slash_tmp: false,

codex-rs/core/tests/suite/exec.rs

@@ -53,6 +53,7 @@ where
         params,
         &PermissionProfile::read_only(),
         &cwd,
+        &[],
         &None,
         /*use_legacy_landlock*/ false,
         /*stdout_stream*/ None,

codex-rs/core/tests/suite/permissions_messages.rs

@@ -575,9 +575,13 @@ async fn permissions_message_includes_writable_roots() -> Result<()> {
     let permissions = permissions_texts(&req.single_request());
     let normalize_line_endings = |s: &str| s.replace("\r\n", "\n");
     let exec_policy = load_exec_policy(&test.config.config_layer_stack).await?;
-    let sandbox_policy = test.config.legacy_sandbox_policy();
-    let expected = PermissionsInstructions::from_policy(
-        &sandbox_policy,
+    let permission_profile = test
+        .config
+        .permissions
+        .permission_profile()
+        .materialize_project_roots_with_workspace_roots(&test.config.workspace_roots);
+    let expected = PermissionsInstructions::from_permission_profile(
+        &permission_profile,
         AskForApproval::OnRequest,
         test.config.approvals_reviewer,
         &exec_policy,

codex-rs/core/tests/suite/personality_migration.rs

@@ -63,6 +63,7 @@ async fn write_rollout_with_user_event(dir: &Path, thread_id: ThreadId) -> io::R
             forked_from_id: None,
             timestamp: TEST_TIMESTAMP.to_string(),
             cwd: std::path::PathBuf::from("."),
+            workspace_roots: Vec::new(),
             originator: "test_originator".to_string(),
             cli_version: "test_version".to_string(),
             source: SessionSource::Cli,
@@ -109,6 +110,7 @@ async fn write_rollout_with_meta_only(dir: &Path, thread_id: ThreadId) -> io::Re
             forked_from_id: None,
             timestamp: TEST_TIMESTAMP.to_string(),
             cwd: std::path::PathBuf::from("."),
+            workspace_roots: Vec::new(),
             originator: "test_originator".to_string(),
             cli_version: "test_version".to_string(),
             source: SessionSource::Cli,

codex-rs/core/tests/suite/prompt_caching.rs

@@ -436,9 +436,12 @@ async fn overrides_turn_context_but_keeps_cached_prefix_and_key_constant() -> an
         /*exclude_tmpdir_env_var*/ true,
         /*exclude_slash_tmp*/ true,
     );
-    let sandbox_policy = permission_profile
-        .to_legacy_sandbox_policy(config.cwd.as_path())
-        .expect("workspace profile should have legacy projection");
+    let sandbox_policy = codex_sandboxing::compatibility_sandbox_policy_for_permission_profile(
+        &permission_profile,
+        &permission_profile.file_system_sandbox_policy(),
+        permission_profile.network_sandbox_policy(),
+        config.cwd.as_path(),
+    );
     codex
         .submit(Op::OverrideTurnContext {
             cwd: None,

codex-rs/core/tests/suite/request_permissions.rs

@@ -285,7 +285,6 @@ async fn expect_request_permissions_event(
 
 fn workspace_write_excluding_tmp() -> SandboxPolicy {
     SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,

codex-rs/core/tests/suite/resume_warning.rs

@@ -29,11 +29,13 @@ fn resume_history(
         turn_id: Some(turn_id.clone()),
         trace_id: None,
         cwd: config.cwd.to_path_buf(),
+        workspace_roots: config.workspace_roots.clone(),
         current_date: None,
         timezone: None,
         approval_policy: config.permissions.approval_policy.value(),
         sandbox_policy: config.legacy_sandbox_policy(),
         permission_profile: None,
+        active_permission_profile: None,
         network: None,
         file_system_sandbox_policy: None,
         model: previous_model.to_string(),

codex-rs/core/tests/suite/sqlite_state.rs

@@ -141,6 +141,7 @@ async fn backfill_scans_existing_rollouts() -> Result<()> {
                     forked_from_id: None,
                     timestamp: "2026-01-27T12:00:00Z".to_string(),
                     cwd: codex_home.to_path_buf(),
+                    workspace_roots: Vec::new(),
                     originator: "test".to_string(),
                     cli_version: "test".to_string(),
                     source: SessionSource::default(),

codex-rs/core/tests/suite/unified_exec.rs

@@ -906,9 +906,11 @@ allow_local_binding = true
                 .enable(Feature::UnifiedExec)
                 .expect("test config should allow feature update");
             config.permissions.approval_policy = Constrained::allow_any(AskForApproval::Never);
-            config.permissions.permission_profile = Constrained::allow_any(
-                PermissionProfile::from_legacy_sandbox_policy(&sandbox_policy_for_config),
-            );
+            config
+                .permissions
+                .replace_permission_profile_constraint(Constrained::allow_any(
+                    PermissionProfile::from_legacy_sandbox_policy(&sandbox_policy_for_config),
+                ));
         });
     let test = builder.build_remote_aware(server).await?;
     assert!(
@@ -2752,10 +2754,13 @@ async fn unified_exec_enforces_glob_deny_read_policy() -> Result<()> {
                 },
                 access: FileSystemAccessMode::None,
             });
-        config.permissions.permission_profile =
-            Constrained::allow_any(PermissionProfile::from_runtime_permissions(
-                &file_system_sandbox_policy,
-                NetworkSandboxPolicy::Restricted,
+        config
+            .permissions
+            .replace_permission_profile_constraint(Constrained::allow_any(
+                PermissionProfile::from_runtime_permissions(
+                    &file_system_sandbox_policy,
+                    NetworkSandboxPolicy::Restricted,
+                ),
             ));
     });
     let TestCodex {

codex-rs/core/tests/suite/user_shell_cmd.rs

@@ -344,11 +344,12 @@ async fn user_shell_command_does_not_set_network_sandbox_env_var() -> anyhow::Re
     let server = responses::start_mock_server().await;
     let mut builder = core_test_support::test_codex::test_codex().with_config(|config| {
         let file_system_sandbox_policy = config.permissions.file_system_sandbox_policy();
-        config.permissions.permission_profile =
+        config.permissions.replace_permission_profile_constraint(
             codex_config::Constrained::allow_any(PermissionProfile::from_runtime_permissions(
                 &file_system_sandbox_policy,
                 NetworkSandboxPolicy::Restricted,
-            ));
+            )),
+        );
     });
     let test = builder.build(&server).await?;
 

codex-rs/core/tests/suite/windows_sandbox.rs

@@ -127,6 +127,7 @@ async fn windows_restricted_token_rejects_exact_and_glob_deny_read_policy() -> a
         },
         &permission_profile,
         &cwd,
+        std::slice::from_ref(&cwd),
         &None,
         /*use_legacy_landlock*/ false,
         /*stdout_stream*/ None,
@@ -211,6 +212,7 @@ async fn windows_elevated_enforces_exact_and_glob_deny_read_policy() -> anyhow::
         },
         &permission_profile,
         &cwd,
+        std::slice::from_ref(&cwd),
         &None,
         /*use_legacy_landlock*/ false,
         /*stdout_stream*/ None,