Centralize Windows sandbox filesystem override resolution (#60042)

Add `WindowsSandboxFilesystemOverrides::resolve` to select the elevated or
restricted-token resolver, and use it in core, exec-server, and direct-spawn
sandbox preparation. Pass the child environment through to the elevated
resolver.

Replace the exported unsupported-sandbox reason helper with a test-local
wrapper around the shared resolver.

GitOrigin-RevId: f1d404356a4f680ce81123bc8284508f27d4d6ab

codex-rs/core/src/exec.rs

@@ -49,8 +49,6 @@ use codex_sandboxing::record_filesystem_sandbox_violation;
 use codex_sandboxing::resolve_windows_elevated_filesystem_overrides;
 #[cfg(test)]
 use codex_sandboxing::resolve_windows_restricted_token_filesystem_overrides;
-#[cfg(test)]
-use codex_sandboxing::unsupported_windows_restricted_token_sandbox_reason;
 #[cfg(any(test, target_os = "windows"))]
 use codex_sandboxing::windows_sandbox_uses_elevated_backend;
 use codex_utils_absolute_path::AbsolutePathBuf;

codex-rs/core/src/exec_tests.rs

@@ -556,6 +556,22 @@ fn windows_sandbox_backend_honors_unelevated_configuration() {
     ));
 }
 
+fn unsupported_windows_restricted_token_sandbox_reason(
+    sandbox: SandboxType,
+    permission_profile: &PermissionProfile,
+    sandbox_policy_cwd: &AbsolutePathBuf,
+    windows_sandbox_level: WindowsSandboxLevel,
+) -> Option<String> {
+    WindowsSandboxFilesystemOverrides::resolve(
+        sandbox,
+        permission_profile,
+        sandbox_policy_cwd,
+        windows_sandbox_level,
+        &HashMap::new(),
+    )
+    .err()
+}
+
 #[test]
 fn windows_restricted_token_rejects_network_only_restrictions() {
     let permission_profile = PermissionProfile::from_runtime_permissions(

codex-rs/core/src/sandboxing/mod.rs

@@ -26,9 +26,6 @@ pub use codex_protocol::models::SandboxPermissions;
 use codex_sandboxing::SandboxExecRequest;
 use codex_sandboxing::SandboxType;
 use codex_sandboxing::WindowsSandboxFilesystemOverrides;
-use codex_sandboxing::resolve_windows_elevated_filesystem_overrides;
-use codex_sandboxing::resolve_windows_restricted_token_filesystem_overrides;
-use codex_sandboxing::windows_sandbox_uses_elevated_backend;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_path_uri::PathUri;
 use codex_utils_string::truncate_middle_with_token_budget;
@@ -142,24 +139,13 @@ impl ExecRequest {
             let sandbox_policy_cwd = windows_sandbox_policy_cwd
                 .to_abs_path()
                 .map_err(|err| CodexErr::InvalidRequest(format!("invalid sandbox cwd: {err}")))?;
-            let use_windows_elevated_backend =
-                windows_sandbox_uses_elevated_backend(windows_sandbox_level);
-            if use_windows_elevated_backend {
-                resolve_windows_elevated_filesystem_overrides(
-                    sandbox,
-                    &permission_profile,
-                    &sandbox_policy_cwd,
-                    use_windows_elevated_backend,
-                    &env,
-                )
-            } else {
-                resolve_windows_restricted_token_filesystem_overrides(
-                    sandbox,
-                    &permission_profile,
-                    &sandbox_policy_cwd,
-                    windows_sandbox_level,
-                )
-            }
+            WindowsSandboxFilesystemOverrides::resolve(
+                sandbox,
+                &permission_profile,
+                &sandbox_policy_cwd,
+                windows_sandbox_level,
+                &env,
+            )
             .map_err(|error| {
                 CodexErr::UnsupportedOperation(
                     truncate_middle_with_token_budget(&error, /*max_tokens*/ 900).0,

codex-rs/exec-server/src/process_sandbox.rs

@@ -26,9 +26,6 @@ use codex_sandboxing::SandboxType;
 use codex_sandboxing::WindowsSandboxFilesystemOverrides;
 use codex_sandboxing::WindowsSandboxProxySettingsMode;
 use codex_sandboxing::WindowsSandboxSpawnRequest;
-use codex_sandboxing::resolve_windows_elevated_filesystem_overrides;
-use codex_sandboxing::resolve_windows_restricted_token_filesystem_overrides;
-use codex_sandboxing::windows_sandbox_uses_elevated_backend;
 use codex_sandboxing::with_managed_mitm_ca_readable_root;
 #[cfg(windows)]
 use codex_shell_command::shell_detect::fallback_powershell_shell_for_windows_sandbox;
@@ -313,23 +310,13 @@ pub(crate) async fn prepare_exec_request_with_telemetry(
         })?;
         request.arg0 = params.arg0.clone();
         let proxy_enforced = params.enforce_managed_network;
-        let use_elevated = windows_sandbox_uses_elevated_backend(windows_sandbox_level);
-        let filesystem_overrides = if use_elevated {
-            resolve_windows_elevated_filesystem_overrides(
-                sandbox,
-                &permissions,
-                &native_sandbox_policy_cwd,
-                use_elevated,
-                &request.env,
-            )
-        } else {
-            resolve_windows_restricted_token_filesystem_overrides(
-                sandbox,
-                &permissions,
-                &native_sandbox_policy_cwd,
-                windows_sandbox_level,
-            )
-        }
+        let filesystem_overrides = WindowsSandboxFilesystemOverrides::resolve(
+            sandbox,
+            &permissions,
+            &native_sandbox_policy_cwd,
+            windows_sandbox_level,
+            &request.env,
+        )
         .map_err(|err| invalid_params(format!("failed to prepare process sandbox: {err}")))?;
         Some(PreparedWindowsSandboxRequest {
             permission_profile: permissions,

codex-rs/sandboxing/src/lib.rs

@@ -59,7 +59,6 @@ pub use windows::WindowsSandboxFilesystemOverrides;
 pub use windows::permission_profile_supports_windows_restricted_token_sandbox;
 pub use windows::resolve_windows_elevated_filesystem_overrides;
 pub use windows::resolve_windows_restricted_token_filesystem_overrides;
-pub use windows::unsupported_windows_restricted_token_sandbox_reason;
 pub use windows::windows_sandbox_uses_elevated_backend;
 
 use codex_protocol::error::CodexErr;

codex-rs/sandboxing/src/manager.rs

@@ -1,18 +1,14 @@
 use self::launch::PreparedLaunchPolicy;
 use crate::LinuxSandboxPidNamespace;
+#[cfg(windows)]
+use crate::WindowsSandboxFilesystemOverrides;
 #[cfg(target_os = "linux")]
 use crate::bwrap::WSL1_BWRAP_WARNING;
 use crate::landlock::CODEX_LINUX_SANDBOX_ARG0;
 use crate::policy_transforms::effective_permission_profile;
 use crate::policy_transforms::should_require_platform_sandbox;
-#[cfg(windows)]
-use crate::resolve_windows_elevated_filesystem_overrides;
-#[cfg(windows)]
-use crate::resolve_windows_restricted_token_filesystem_overrides;
 #[cfg(target_os = "macos")]
 use crate::seatbelt::MacosSeatbeltProfile;
-#[cfg(windows)]
-use crate::windows_sandbox_uses_elevated_backend;
 use codex_network_proxy::ManagedNetworkSandboxContext;
 use codex_network_proxy::NetworkProxy;
 use codex_protocol::config_types::WindowsSandboxLevel;
@@ -687,23 +683,13 @@ fn wrap_windows_sandbox_exec_request_for_direct_spawn(
                 })
         })
         .transpose()?;
-    let use_elevated = windows_sandbox_uses_elevated_backend(request.windows_sandbox_level);
-    let overrides = if use_elevated {
-        resolve_windows_elevated_filesystem_overrides(
-            request.sandbox,
-            &request.permission_profile,
-            &native_sandbox_policy_cwd,
-            use_elevated,
-            &request.env,
-        )
-    } else {
-        resolve_windows_restricted_token_filesystem_overrides(
-            request.sandbox,
-            &request.permission_profile,
-            &native_sandbox_policy_cwd,
-            request.windows_sandbox_level,
-        )
-    }
+    let overrides = WindowsSandboxFilesystemOverrides::resolve(
+        request.sandbox,
+        &request.permission_profile,
+        &native_sandbox_policy_cwd,
+        request.windows_sandbox_level,
+        &request.env,
+    )
     .map_err(SandboxTransformError::WindowsSandboxPreparation)?;
     let empty_paths: &[AbsolutePathBuf] = &[];
     let read_roots_override = overrides

codex-rs/sandboxing/src/windows.rs

@@ -31,6 +31,35 @@ pub struct WindowsSandboxFilesystemOverrides {
     pub additional_deny_write_paths: Vec<AbsolutePathBuf>,
 }
 
+impl WindowsSandboxFilesystemOverrides {
+    /// Resolve filesystem overrides for the selected Windows sandbox using the child's environment.
+    pub fn resolve(
+        sandbox: SandboxType,
+        permission_profile: &PermissionProfile,
+        sandbox_policy_cwd: &AbsolutePathBuf,
+        windows_sandbox_level: WindowsSandboxLevel,
+        workload_env: &HashMap<String, String>,
+    ) -> Result<Option<Self>, String> {
+        let use_elevated = windows_sandbox_uses_elevated_backend(windows_sandbox_level);
+        if use_elevated {
+            resolve_windows_elevated_filesystem_overrides(
+                sandbox,
+                permission_profile,
+                sandbox_policy_cwd,
+                use_elevated,
+                workload_env,
+            )
+        } else {
+            resolve_windows_restricted_token_filesystem_overrides(
+                sandbox,
+                permission_profile,
+                sandbox_policy_cwd,
+                windows_sandbox_level,
+            )
+        }
+    }
+}
+
 pub fn windows_sandbox_uses_elevated_backend(sandbox_level: WindowsSandboxLevel) -> bool {
     matches!(sandbox_level, WindowsSandboxLevel::Elevated)
 }
@@ -46,32 +75,6 @@ pub fn permission_profile_supports_windows_restricted_token_sandbox(
     }
 }
 
-pub fn unsupported_windows_restricted_token_sandbox_reason(
-    sandbox: SandboxType,
-    permission_profile: &PermissionProfile,
-    sandbox_policy_cwd: &AbsolutePathBuf,
-    windows_sandbox_level: WindowsSandboxLevel,
-) -> Option<String> {
-    if windows_sandbox_level == WindowsSandboxLevel::Elevated {
-        resolve_windows_elevated_filesystem_overrides(
-            sandbox,
-            permission_profile,
-            sandbox_policy_cwd,
-            windows_sandbox_level == WindowsSandboxLevel::Elevated,
-            &HashMap::new(),
-        )
-        .err()
-    } else {
-        resolve_windows_restricted_token_filesystem_overrides(
-            sandbox,
-            permission_profile,
-            sandbox_policy_cwd,
-            windows_sandbox_level,
-        )
-        .err()
-    }
-}
-
 pub fn resolve_windows_restricted_token_filesystem_overrides(
     sandbox: SandboxType,
     permission_profile: &PermissionProfile,