Files
codex/codex-rs
Charlie Marsh a62ff9a5d4 Report configured sandbox policy consistently (#41933)
## Why

Sandbox diagnostics could report `read-only` when a configured writable root did not yet exist, because policy labeling used filesystem-aware runtime root resolution.

## What changed

- Derive diagnostic policy labels from configured writable roots without inspecting the filesystem. Runtime sandbox authorization continues to use filesystem-aware resolution.
- Capture sandbox labels once per turn and reuse them for response metadata and tool-result metrics.

## Testing

Add coverage for missing project roots, denied roots, and deny rules on project subpaths.

GitOrigin-RevId: ccbdb8c32a1f44bfa63ae4d2ae1f9cc408e66b9c
2026-08-31 23:29:20 +00:00
..
…
…
…