From 73d8c18fd51dc524bc25f305ceb62afee8edc457 Mon Sep 17 00:00:00 2001 From: David Wiesen Date: Sat, 25 Apr 2026 20:43:50 -0700 Subject: [PATCH] Normalize mapped-drive cwd in legacy sandbox entrypoints --- codex-rs/windows-sandbox-rs/src/lib.rs | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/codex-rs/windows-sandbox-rs/src/lib.rs b/codex-rs/windows-sandbox-rs/src/lib.rs index b807ded589..b1742b211b 100644 --- a/codex-rs/windows-sandbox-rs/src/lib.rs +++ b/codex-rs/windows-sandbox-rs/src/lib.rs @@ -378,7 +378,8 @@ mod windows_impl { #[allow(clippy::expect_used)] let psid_generic = convert_string_sid_to_sid(&caps.workspace).expect("valid workspace SID"); - let ws_sid = workspace_cap_sid_for_cwd(codex_home, cwd)?; + let normalized_cwd = super::path_normalization::normalize_command_cwd(cwd); + let ws_sid = workspace_cap_sid_for_cwd(codex_home, &normalized_cwd)?; #[allow(clippy::expect_used)] let psid_workspace = convert_string_sid_to_sid(&ws_sid).expect("valid workspace SID"); @@ -607,11 +608,11 @@ mod windows_impl { #[allow(clippy::expect_used)] let psid_generic = unsafe { convert_string_sid_to_sid(&caps.workspace) }.expect("valid workspace SID"); - let ws_sid = workspace_cap_sid_for_cwd(codex_home, cwd)?; + let current_dir = super::path_normalization::normalize_command_cwd(cwd); + let ws_sid = workspace_cap_sid_for_cwd(codex_home, ¤t_dir)?; #[allow(clippy::expect_used)] let psid_workspace = unsafe { convert_string_sid_to_sid(&ws_sid) }.expect("valid workspace SID"); - let current_dir = cwd.to_path_buf(); let AllowDenyPaths { allow, deny } = compute_allow_paths(sandbox_policy, sandbox_policy_cwd, ¤t_dir, env_map); let canonical_cwd = canonicalize_path(¤t_dir);