permissions: move workspace roots onto thread state

codex-rs/config/src/config_requirements.rs

@@ -2144,7 +2144,6 @@ allowed_approvals_reviewers = ["user"]
         let config: ConfigRequirementsToml = from_str(toml_str)?;
         let requirements: ConfigRequirements = with_unknown_source(config).try_into()?;
 
-        let root = if cfg!(windows) { "C:\\repo" } else { "/repo" };
         assert!(
             requirements
                 .permission_profile
@@ -2154,7 +2153,6 @@ allowed_approvals_reviewers = ["user"]
                 .is_ok()
         );
         let workspace_write_policy = SandboxPolicy::WorkspaceWrite {
-            writable_roots: vec![AbsolutePathBuf::from_absolute_path(root)?],
             network_access: false,
             exclude_tmpdir_env_var: false,
             exclude_slash_tmp: false,
@@ -2265,9 +2263,7 @@ allowed_approvals_reviewers = ["user"]
         );
 
         let requirements = ConfigRequirements::try_from(requirements_with_sources)?;
-        let root = if cfg!(windows) { "C:\\repo" } else { "/repo" };
         let workspace_write_policy = SandboxPolicy::WorkspaceWrite {
-            writable_roots: vec![AbsolutePathBuf::from_absolute_path(root)?],
             network_access: false,
             exclude_tmpdir_env_var: false,
             exclude_slash_tmp: false,

codex-rs/config/src/config_toml.rs

@@ -760,7 +760,7 @@ impl ConfigToml {
             SandboxMode::ReadOnly => PermissionProfile::read_only(),
             SandboxMode::WorkspaceWrite => match self.sandbox_workspace_write.as_ref() {
                 Some(SandboxWorkspaceWrite {
-                    writable_roots,
+                    writable_roots: _,
                     network_access,
                     exclude_tmpdir_env_var,
                     exclude_slash_tmp,
@@ -771,7 +771,7 @@ impl ConfigToml {
                         NetworkSandboxPolicy::Restricted
                     };
                     PermissionProfile::workspace_write_with(
-                        writable_roots,
+                        &[],
                         network_policy,
                         *exclude_tmpdir_env_var,
                         *exclude_slash_tmp,