Move workspace roots onto thread/session state and stop using active permission profile modifications as an overlay for writable roots. Existing app-server threads now preserve their persisted PermissionProfile value across resume, fork, and turn updates; permissions requests on existing threads only update the active named profile after validating it exists. Workspace roots can be updated independently, and SandboxPolicy::WorkspaceWrite no longer stores its own writable_roots.

codex-rs/core/tests/common/test_codex.rs

@@ -517,6 +517,7 @@ impl TestCodexBuilder {
             load_default_config_for_test(home).await
         };
         config.cwd = cwd_override;
+        config.workspace_roots = vec![config.cwd.clone()];
         config.model_provider = model_provider;
         if let Ok(path) = codex_utils_cargo_bin::cargo_bin("codex") {
             config.codex_self_exe = Some(path);
@@ -541,6 +542,7 @@ impl TestCodexBuilder {
         for mutator in mutators {
             mutator(&mut config);
         }
+        config.workspace_roots = vec![config.cwd.clone()];
         ensure_test_model_catalog(&mut config)?;
 
         if config.include_apply_patch_tool {

codex-rs/core/tests/suite/approvals.rs

@@ -826,7 +826,6 @@ fn scenarios() -> Vec<ScenarioSpec> {
     use AskForApproval::*;
 
     let workspace_write = |network_access| SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access,
         exclude_tmpdir_env_var: false,
         exclude_slash_tmp: false,
@@ -2001,7 +2000,6 @@ async fn approving_apply_patch_for_session_skips_future_prompts_for_same_file()
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
     let sandbox_policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: false,
         exclude_slash_tmp: false,
@@ -2757,7 +2755,6 @@ allow_local_binding = true
     )?;
     let approval_policy = AskForApproval::OnFailure;
     let sandbox_policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: true,
         exclude_tmpdir_env_var: false,
         exclude_slash_tmp: false,
@@ -3037,7 +3034,6 @@ allow_local_binding = true
     )?;
     let approval_policy = AskForApproval::OnFailure;
     let turn_sandbox_policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: true,
         exclude_tmpdir_env_var: false,
         exclude_slash_tmp: false,

codex-rs/core/tests/suite/exec.rs

@@ -53,6 +53,7 @@ where
         params,
         &PermissionProfile::read_only(),
         &cwd,
+        &[],
         &None,
         /*use_legacy_landlock*/ false,
         /*stdout_stream*/ None,

codex-rs/core/tests/suite/permissions_messages.rs

@@ -574,9 +574,13 @@ async fn permissions_message_includes_writable_roots() -> Result<()> {
     let permissions = permissions_texts(&req.single_request());
     let normalize_line_endings = |s: &str| s.replace("\r\n", "\n");
     let exec_policy = load_exec_policy(&test.config.config_layer_stack).await?;
-    let sandbox_policy = test.config.legacy_sandbox_policy();
-    let expected = PermissionsInstructions::from_policy(
-        &sandbox_policy,
+    let permission_profile = test
+        .config
+        .permissions
+        .permission_profile()
+        .materialize_project_roots_with_workspace_roots(&test.config.workspace_roots);
+    let expected = PermissionsInstructions::from_permission_profile(
+        &permission_profile,
         AskForApproval::OnRequest,
         test.config.approvals_reviewer,
         &exec_policy,

codex-rs/core/tests/suite/personality_migration.rs

@@ -63,6 +63,7 @@ async fn write_rollout_with_user_event(dir: &Path, thread_id: ThreadId) -> io::R
             forked_from_id: None,
             timestamp: TEST_TIMESTAMP.to_string(),
             cwd: std::path::PathBuf::from("."),
+            workspace_roots: Vec::new(),
             originator: "test_originator".to_string(),
             cli_version: "test_version".to_string(),
             source: SessionSource::Cli,
@@ -108,6 +109,7 @@ async fn write_rollout_with_meta_only(dir: &Path, thread_id: ThreadId) -> io::Re
             forked_from_id: None,
             timestamp: TEST_TIMESTAMP.to_string(),
             cwd: std::path::PathBuf::from("."),
+            workspace_roots: Vec::new(),
             originator: "test_originator".to_string(),
             cli_version: "test_version".to_string(),
             source: SessionSource::Cli,

codex-rs/core/tests/suite/request_permissions.rs

@@ -285,7 +285,6 @@ async fn expect_request_permissions_event(
 
 fn workspace_write_excluding_tmp() -> SandboxPolicy {
     SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
         network_access: false,
         exclude_tmpdir_env_var: true,
         exclude_slash_tmp: true,

codex-rs/core/tests/suite/resume_warning.rs

@@ -29,6 +29,7 @@ fn resume_history(
         turn_id: Some(turn_id.clone()),
         trace_id: None,
         cwd: config.cwd.to_path_buf(),
+        workspace_roots: config.workspace_roots.clone(),
         current_date: None,
         timezone: None,
         approval_policy: config.permissions.approval_policy.value(),

codex-rs/core/tests/suite/sqlite_state.rs

@@ -141,6 +141,7 @@ async fn backfill_scans_existing_rollouts() -> Result<()> {
                     forked_from_id: None,
                     timestamp: "2026-01-27T12:00:00Z".to_string(),
                     cwd: codex_home.to_path_buf(),
+                    workspace_roots: Vec::new(),
                     originator: "test".to_string(),
                     cli_version: "test".to_string(),
                     source: SessionSource::default(),