permissions: move workspace roots onto thread state

codex-rs/rollout/src/config.rs

@@ -2,10 +2,13 @@ use std::path::Path;
 use std::path::PathBuf;
 use std::sync::Arc;
 
+use codex_utils_absolute_path::AbsolutePathBuf;
+
 pub trait RolloutConfigView {
     fn codex_home(&self) -> &Path;
     fn sqlite_home(&self) -> &Path;
     fn cwd(&self) -> &Path;
+    fn workspace_roots(&self) -> &[AbsolutePathBuf];
     fn model_provider_id(&self) -> &str;
     fn generate_memories(&self) -> bool;
 }
@@ -15,6 +18,7 @@ pub struct RolloutConfig {
     pub codex_home: PathBuf,
     pub sqlite_home: PathBuf,
     pub cwd: PathBuf,
+    pub workspace_roots: Vec<AbsolutePathBuf>,
     pub model_provider_id: String,
     pub generate_memories: bool,
 }
@@ -27,6 +31,7 @@ impl RolloutConfig {
             codex_home: view.codex_home().to_path_buf(),
             sqlite_home: view.sqlite_home().to_path_buf(),
             cwd: view.cwd().to_path_buf(),
+            workspace_roots: view.workspace_roots().to_vec(),
             model_provider_id: view.model_provider_id().to_string(),
             generate_memories: view.generate_memories(),
         }
@@ -46,6 +51,10 @@ impl RolloutConfigView for RolloutConfig {
         self.cwd.as_path()
     }
 
+    fn workspace_roots(&self) -> &[AbsolutePathBuf] {
+        &self.workspace_roots
+    }
+
     fn model_provider_id(&self) -> &str {
         self.model_provider_id.as_str()
     }
@@ -68,6 +77,10 @@ impl<T: RolloutConfigView + ?Sized> RolloutConfigView for &T {
         (*self).cwd()
     }
 
+    fn workspace_roots(&self) -> &[AbsolutePathBuf] {
+        (*self).workspace_roots()
+    }
+
     fn model_provider_id(&self) -> &str {
         (*self).model_provider_id()
     }
@@ -90,6 +103,10 @@ impl<T: RolloutConfigView + ?Sized> RolloutConfigView for Arc<T> {
         self.as_ref().cwd()
     }
 
+    fn workspace_roots(&self) -> &[AbsolutePathBuf] {
+        self.as_ref().workspace_roots()
+    }
+
     fn model_provider_id(&self) -> &str {
         self.as_ref().model_provider_id()
     }

codex-rs/rollout/src/metadata_tests.rs

@@ -44,6 +44,7 @@ async fn extract_metadata_from_rollout_uses_session_meta() {
         agent_path: None,
         agent_nickname: None,
         agent_role: None,
+        workspace_roots: vec![dir.path().to_path_buf().try_into().expect("absolute path")],
         model_provider: Some("openai".to_string()),
         base_instructions: None,
         dynamic_tools: None,
@@ -96,6 +97,7 @@ async fn extract_metadata_from_rollout_returns_latest_memory_mode() {
         agent_path: None,
         agent_nickname: None,
         agent_role: None,
+        workspace_roots: vec![dir.path().to_path_buf().try_into().expect("absolute path")],
         model_provider: Some("openai".to_string()),
         base_instructions: None,
         dynamic_tools: None,
@@ -348,7 +350,7 @@ fn write_rollout_in_sessions_with_cwd(
         id,
         forked_from_id: None,
         timestamp: event_ts.to_string(),
-        cwd,
+        cwd: cwd.clone(),
         originator: "cli".to_string(),
         cli_version: "0.0.0".to_string(),
         source: SessionSource::default(),
@@ -356,6 +358,7 @@ fn write_rollout_in_sessions_with_cwd(
         agent_path: None,
         agent_nickname: None,
         agent_role: None,
+        workspace_roots: vec![cwd.clone().try_into().expect("absolute path")],
         model_provider: Some("test-provider".to_string()),
         base_instructions: None,
         dynamic_tools: None,

codex-rs/rollout/src/recorder.rs

@@ -675,6 +675,7 @@ impl RolloutRecorder {
                     forked_from_id,
                     timestamp,
                     cwd: config.cwd().to_path_buf(),
+                    workspace_roots: config.workspace_roots().to_vec(),
                     originator: originator().value,
                     cli_version: env!("CARGO_PKG_VERSION").to_string(),
                     agent_nickname: source.get_nickname(),

codex-rs/rollout/src/recorder_tests.rs

@@ -32,6 +32,7 @@ fn test_config(codex_home: &Path) -> RolloutConfig {
         codex_home: codex_home.to_path_buf(),
         sqlite_home: codex_home.to_path_buf(),
         cwd: codex_home.to_path_buf(),
+        workspace_roots: vec![codex_home.to_path_buf().try_into().expect("absolute path")],
         model_provider_id: "test-provider".to_string(),
         generate_memories: true,
     }
@@ -95,6 +96,7 @@ async fn state_db_init_backfills_before_returning() -> anyhow::Result<()> {
             agent_path: None,
             agent_nickname: None,
             agent_role: None,
+            workspace_roots: vec![home.path().to_path_buf().try_into().expect("absolute path")],
             model_provider: None,
             base_instructions: None,
             dynamic_tools: None,
@@ -1132,6 +1134,8 @@ async fn resume_candidate_matches_cwd_reads_latest_turn_context() -> std::io::Re
             approval_policy: AskForApproval::Never,
             sandbox_policy: SandboxPolicy::new_read_only_policy(),
             permission_profile: None,
+            active_permission_profile: None,
+            workspace_roots: vec![latest_cwd.clone().try_into().expect("absolute path")],
             network: None,
             file_system_sandbox_policy: None,
             model: "test-model".to_string(),

codex-rs/rollout/src/session_index_tests.rs

@@ -36,6 +36,7 @@ fn write_rollout_with_metadata(path: &Path, thread_id: ThreadId) -> std::io::Res
                 agent_path: None,
                 agent_nickname: None,
                 agent_role: None,
+                workspace_roots: Vec::new(),
                 model_provider: Some("test-provider".into()),
                 base_instructions: None,
                 dynamic_tools: None,

codex-rs/rollout/src/tests.rs

@@ -1387,6 +1387,7 @@ async fn test_updated_at_uses_file_mtime() -> Result<()> {
                 agent_path: None,
                 agent_nickname: None,
                 agent_role: None,
+                workspace_roots: Vec::new(),
                 model_provider: Some("test-provider".into()),
                 base_instructions: None,
                 dynamic_tools: None,