sandboxing: plumb split sandbox policies through runtime (#13439)

## Why

`#13434` introduces split `FileSystemSandboxPolicy` and
`NetworkSandboxPolicy`, but the runtime still made most execution-time
sandbox decisions from the legacy `SandboxPolicy` projection.

That projection loses information about combinations like unrestricted
filesystem access with restricted network access. In practice, that
means the runtime can choose the wrong platform sandbox behavior or set
the wrong network-restriction environment for a command even when config
has already separated those concerns.

This PR carries the split policies through the runtime so sandbox
selection, process spawning, and exec handling can consult the policy
that actually matters.

## What changed

- threaded `FileSystemSandboxPolicy` and `NetworkSandboxPolicy` through
`TurnContext`, `ExecRequest`, sandbox attempts, shell escalation state,
unified exec, and app-server exec overrides
- updated sandbox selection in `core/src/sandboxing/mod.rs` and
`core/src/exec.rs` to key off `FileSystemSandboxPolicy.kind` plus
`NetworkSandboxPolicy`, rather than inferring behavior only from the
legacy `SandboxPolicy`
- updated process spawning in `core/src/spawn.rs` and the platform
wrappers to use `NetworkSandboxPolicy` when deciding whether to set
`CODEX_SANDBOX_NETWORK_DISABLED`
- kept additional-permissions handling and legacy `ExternalSandbox`
compatibility projections aligned with the split policies, including
explicit user-shell execution and Windows restricted-token routing
- updated callers across `core`, `app-server`, and `linux-sandbox` to
pass the split policies explicitly

## Verification

- added regression coverage in `core/tests/suite/user_shell_cmd.rs` to
verify `RunUserShellCommand` does not inherit
`CODEX_SANDBOX_NETWORK_DISABLED` from the active turn
- added coverage in `core/src/exec.rs` for Windows restricted-token
sandbox selection when the legacy projection is `ExternalSandbox`
- updated Linux sandbox coverage in
`linux-sandbox/tests/suite/landlock.rs` to exercise the split-policy
exec path
- verified the current PR state with `just clippy`




---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/13439).
* #13453
* #13452
* #13451
* #13449
* #13448
* #13445
* #13440
* __->__ #13439

---------

Co-authored-by: viyatb-oai <viyatb@openai.com>

codex-rs/core/src/sandboxing/mod.rs

@@ -30,6 +30,14 @@ use codex_protocol::models::FileSystemPermissions;
 use codex_protocol::models::MacOsSeatbeltProfileExtensions;
 use codex_protocol::models::PermissionProfile;
 pub use codex_protocol::models::SandboxPermissions;
+use codex_protocol::permissions::FileSystemAccessMode;
+use codex_protocol::permissions::FileSystemPath;
+use codex_protocol::permissions::FileSystemSandboxEntry;
+use codex_protocol::permissions::FileSystemSandboxKind;
+use codex_protocol::permissions::FileSystemSandboxPolicy;
+use codex_protocol::permissions::FileSystemSpecialPath;
+use codex_protocol::permissions::NetworkSandboxPolicy;
+use codex_protocol::protocol::NetworkAccess;
 use codex_protocol::protocol::ReadOnlyAccess;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use dunce::canonicalize;
@@ -62,6 +70,8 @@ pub struct ExecRequest {
     pub windows_sandbox_level: WindowsSandboxLevel,
     pub sandbox_permissions: SandboxPermissions,
     pub sandbox_policy: SandboxPolicy,
+    pub file_system_sandbox_policy: FileSystemSandboxPolicy,
+    pub network_sandbox_policy: NetworkSandboxPolicy,
     pub justification: Option<String>,
     pub arg0: Option<String>,
 }
@@ -72,6 +82,8 @@ pub struct ExecRequest {
 pub(crate) struct SandboxTransformRequest<'a> {
     pub spec: CommandSpec,
     pub policy: &'a SandboxPolicy,
+    pub file_system_policy: &'a FileSystemSandboxPolicy,
+    pub network_policy: NetworkSandboxPolicy,
     pub sandbox: SandboxType,
     pub enforce_managed_network: bool,
     // TODO(viyatb): Evaluate switching this to Option<Arc<NetworkProxy>>
@@ -203,6 +215,41 @@ fn additional_permission_roots(
     )
 }
 
+#[cfg_attr(not(test), allow(dead_code))]
+fn merge_file_system_policy_with_additional_permissions(
+    file_system_policy: &FileSystemSandboxPolicy,
+    extra_reads: Vec<AbsolutePathBuf>,
+    extra_writes: Vec<AbsolutePathBuf>,
+) -> FileSystemSandboxPolicy {
+    match file_system_policy.kind {
+        FileSystemSandboxKind::Restricted => {
+            let mut merged_policy = file_system_policy.clone();
+            for path in extra_reads {
+                let entry = FileSystemSandboxEntry {
+                    path: FileSystemPath::Path { path },
+                    access: FileSystemAccessMode::Read,
+                };
+                if !merged_policy.entries.contains(&entry) {
+                    merged_policy.entries.push(entry);
+                }
+            }
+            for path in extra_writes {
+                let entry = FileSystemSandboxEntry {
+                    path: FileSystemPath::Path { path },
+                    access: FileSystemAccessMode::Write,
+                };
+                if !merged_policy.entries.contains(&entry) {
+                    merged_policy.entries.push(entry);
+                }
+            }
+            merged_policy
+        }
+        FileSystemSandboxKind::Unrestricted | FileSystemSandboxKind::ExternalSandbox => {
+            file_system_policy.clone()
+        }
+    }
+}
+
 fn merge_read_only_access_with_additional_reads(
     read_only_access: &ReadOnlyAccess,
     extra_reads: Vec<AbsolutePathBuf>,
@@ -246,9 +293,17 @@ fn sandbox_policy_with_additional_permissions(
     let (extra_reads, extra_writes) = additional_permission_roots(additional_permissions);
 
     match sandbox_policy {
-        SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. } => {
-            sandbox_policy.clone()
-        }
+        SandboxPolicy::DangerFullAccess => SandboxPolicy::DangerFullAccess,
+        SandboxPolicy::ExternalSandbox { network_access } => SandboxPolicy::ExternalSandbox {
+            network_access: if merge_network_access(
+                network_access.is_enabled(),
+                additional_permissions,
+            ) {
+                NetworkAccess::Enabled
+            } else {
+                NetworkAccess::Restricted
+            },
+        },
         SandboxPolicy::WorkspaceWrite {
             writable_roots,
             read_only_access,
@@ -297,6 +352,35 @@ fn sandbox_policy_with_additional_permissions(
     }
 }
 
+pub(crate) fn should_require_platform_sandbox(
+    file_system_policy: &FileSystemSandboxPolicy,
+    network_policy: NetworkSandboxPolicy,
+    has_managed_network_requirements: bool,
+) -> bool {
+    if has_managed_network_requirements {
+        return true;
+    }
+
+    if !network_policy.is_enabled() {
+        return !matches!(
+            file_system_policy.kind,
+            FileSystemSandboxKind::ExternalSandbox
+        );
+    }
+
+    match file_system_policy.kind {
+        FileSystemSandboxKind::Restricted => !file_system_policy.entries.iter().any(|entry| {
+            entry.access == FileSystemAccessMode::Write
+                && matches!(
+                    &entry.path,
+                    FileSystemPath::Special { value }
+                        if matches!(value, FileSystemSpecialPath::Root)
+                )
+        }),
+        FileSystemSandboxKind::Unrestricted | FileSystemSandboxKind::ExternalSandbox => false,
+    }
+}
+
 #[derive(Default)]
 pub struct SandboxManager;
 
@@ -307,7 +391,8 @@ impl SandboxManager {
 
     pub(crate) fn select_initial(
         &self,
-        policy: &SandboxPolicy,
+        file_system_policy: &FileSystemSandboxPolicy,
+        network_policy: NetworkSandboxPolicy,
         pref: SandboxablePreference,
         windows_sandbox_level: WindowsSandboxLevel,
         has_managed_network_requirements: bool,
@@ -322,22 +407,20 @@ impl SandboxManager {
                 )
                 .unwrap_or(SandboxType::None)
             }
-            SandboxablePreference::Auto => match policy {
-                SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. } => {
-                    if has_managed_network_requirements {
-                        crate::safety::get_platform_sandbox(
-                            windows_sandbox_level != WindowsSandboxLevel::Disabled,
-                        )
-                        .unwrap_or(SandboxType::None)
-                    } else {
-                        SandboxType::None
-                    }
+            SandboxablePreference::Auto => {
+                if should_require_platform_sandbox(
+                    file_system_policy,
+                    network_policy,
+                    has_managed_network_requirements,
+                ) {
+                    crate::safety::get_platform_sandbox(
+                        windows_sandbox_level != WindowsSandboxLevel::Disabled,
+                    )
+                    .unwrap_or(SandboxType::None)
+                } else {
+                    SandboxType::None
                 }
-                _ => crate::safety::get_platform_sandbox(
-                    windows_sandbox_level != WindowsSandboxLevel::Disabled,
-                )
-                .unwrap_or(SandboxType::None),
-            },
+            }
         }
     }
 
@@ -348,6 +431,8 @@ impl SandboxManager {
         let SandboxTransformRequest {
             mut spec,
             policy,
+            file_system_policy,
+            network_policy,
             sandbox,
             enforce_managed_network,
             network,
@@ -360,16 +445,41 @@ impl SandboxManager {
         } = request;
         #[cfg(not(target_os = "macos"))]
         let macos_seatbelt_profile_extensions = None;
-        let effective_permissions = EffectiveSandboxPermissions::new(
+        let additional_permissions = spec.additional_permissions.take();
+        let EffectiveSandboxPermissions {
+            sandbox_policy: effective_policy,
+            macos_seatbelt_profile_extensions: _effective_macos_seatbelt_profile_extensions,
+        } = EffectiveSandboxPermissions::new(
             policy,
             macos_seatbelt_profile_extensions,
-            spec.additional_permissions.as_ref(),
+            additional_permissions.as_ref(),
         );
+        let (effective_file_system_policy, effective_network_policy) =
+            if let Some(additional_permissions) = additional_permissions {
+                let (extra_reads, extra_writes) =
+                    additional_permission_roots(&additional_permissions);
+                let file_system_sandbox_policy =
+                    if extra_reads.is_empty() && extra_writes.is_empty() {
+                        file_system_policy.clone()
+                    } else {
+                        merge_file_system_policy_with_additional_permissions(
+                            file_system_policy,
+                            extra_reads,
+                            extra_writes,
+                        )
+                    };
+                let network_sandbox_policy =
+                    if merge_network_access(network_policy.is_enabled(), &additional_permissions) {
+                        NetworkSandboxPolicy::Enabled
+                    } else {
+                        NetworkSandboxPolicy::Restricted
+                    };
+                (file_system_sandbox_policy, network_sandbox_policy)
+            } else {
+                (file_system_policy.clone(), network_policy)
+            };
         let mut env = spec.env;
-        if !effective_permissions
-            .sandbox_policy
-            .has_full_network_access()
-        {
+        if !effective_network_policy.is_enabled() {
             env.insert(
                 CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR.to_string(),
                 "1".to_string(),
@@ -388,13 +498,11 @@ impl SandboxManager {
                 seatbelt_env.insert(CODEX_SANDBOX_ENV_VAR.to_string(), "seatbelt".to_string());
                 let mut args = create_seatbelt_command_args_with_extensions(
                     command.clone(),
-                    &effective_permissions.sandbox_policy,
+                    &effective_policy,
                     sandbox_policy_cwd,
                     enforce_managed_network,
                     network,
-                    effective_permissions
-                        .macos_seatbelt_profile_extensions
-                        .as_ref(),
+                    _effective_macos_seatbelt_profile_extensions.as_ref(),
                 );
                 let mut full_command = Vec::with_capacity(1 + args.len());
                 full_command.push(MACOS_PATH_TO_SEATBELT_EXECUTABLE.to_string());
@@ -409,7 +517,7 @@ impl SandboxManager {
                 let allow_proxy_network = allow_network_for_proxy(enforce_managed_network);
                 let mut args = create_linux_sandbox_command_args(
                     command.clone(),
-                    &effective_permissions.sandbox_policy,
+                    &effective_policy,
                     sandbox_policy_cwd,
                     use_linux_sandbox_bwrap,
                     allow_proxy_network,
@@ -444,7 +552,9 @@ impl SandboxManager {
             sandbox,
             windows_sandbox_level,
             sandbox_permissions: spec.sandbox_permissions,
-            sandbox_policy: effective_permissions.sandbox_policy,
+            sandbox_policy: effective_policy,
+            file_system_sandbox_policy: effective_file_system_policy,
+            network_sandbox_policy: effective_network_policy,
             justification: spec.justification,
             arg0: arg0_override,
         })
@@ -477,9 +587,12 @@ mod tests {
     #[cfg(target_os = "macos")]
     use super::EffectiveSandboxPermissions;
     use super::SandboxManager;
+    use super::merge_file_system_policy_with_additional_permissions;
     use super::normalize_additional_permissions;
     use super::sandbox_policy_with_additional_permissions;
+    use super::should_require_platform_sandbox;
     use crate::exec::SandboxType;
+    use crate::protocol::NetworkAccess;
     use crate::protocol::ReadOnlyAccess;
     use crate::protocol::SandboxPolicy;
     use crate::tools::sandboxing::SandboxablePreference;
@@ -493,16 +606,24 @@ mod tests {
     use codex_protocol::models::MacOsSeatbeltProfileExtensions;
     use codex_protocol::models::NetworkPermissions;
     use codex_protocol::models::PermissionProfile;
+    use codex_protocol::permissions::FileSystemAccessMode;
+    use codex_protocol::permissions::FileSystemPath;
+    use codex_protocol::permissions::FileSystemSandboxEntry;
+    use codex_protocol::permissions::FileSystemSandboxPolicy;
+    use codex_protocol::permissions::FileSystemSpecialPath;
+    use codex_protocol::permissions::NetworkSandboxPolicy;
     use codex_utils_absolute_path::AbsolutePathBuf;
     use dunce::canonicalize;
     use pretty_assertions::assert_eq;
+    use std::collections::HashMap;
     use tempfile::TempDir;
 
     #[test]
     fn danger_full_access_defaults_to_no_sandbox_without_network_requirements() {
         let manager = SandboxManager::new();
         let sandbox = manager.select_initial(
-            &SandboxPolicy::DangerFullAccess,
+            &FileSystemSandboxPolicy::unrestricted(),
+            NetworkSandboxPolicy::Enabled,
             SandboxablePreference::Auto,
             WindowsSandboxLevel::Disabled,
             false,
@@ -515,7 +636,8 @@ mod tests {
         let manager = SandboxManager::new();
         let expected = crate::safety::get_platform_sandbox(false).unwrap_or(SandboxType::None);
         let sandbox = manager.select_initial(
-            &SandboxPolicy::DangerFullAccess,
+            &FileSystemSandboxPolicy::unrestricted(),
+            NetworkSandboxPolicy::Enabled,
             SandboxablePreference::Auto,
             WindowsSandboxLevel::Disabled,
             true,
@@ -523,6 +645,98 @@ mod tests {
         assert_eq!(sandbox, expected);
     }
 
+    #[test]
+    fn restricted_file_system_uses_platform_sandbox_without_managed_network() {
+        let manager = SandboxManager::new();
+        let expected = crate::safety::get_platform_sandbox(false).unwrap_or(SandboxType::None);
+        let sandbox = manager.select_initial(
+            &FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
+                path: FileSystemPath::Special {
+                    value: FileSystemSpecialPath::Root,
+                },
+                access: FileSystemAccessMode::Read,
+            }]),
+            NetworkSandboxPolicy::Enabled,
+            SandboxablePreference::Auto,
+            WindowsSandboxLevel::Disabled,
+            false,
+        );
+        assert_eq!(sandbox, expected);
+    }
+
+    #[test]
+    fn full_access_restricted_policy_skips_platform_sandbox_when_network_is_enabled() {
+        let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
+            path: FileSystemPath::Special {
+                value: FileSystemSpecialPath::Root,
+            },
+            access: FileSystemAccessMode::Write,
+        }]);
+
+        assert_eq!(
+            should_require_platform_sandbox(&policy, NetworkSandboxPolicy::Enabled, false),
+            false
+        );
+    }
+
+    #[test]
+    fn full_access_restricted_policy_still_uses_platform_sandbox_for_restricted_network() {
+        let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
+            path: FileSystemPath::Special {
+                value: FileSystemSpecialPath::Root,
+            },
+            access: FileSystemAccessMode::Write,
+        }]);
+
+        assert_eq!(
+            should_require_platform_sandbox(&policy, NetworkSandboxPolicy::Restricted, false),
+            true
+        );
+    }
+
+    #[test]
+    fn transform_preserves_unrestricted_file_system_policy_for_restricted_network() {
+        let manager = SandboxManager::new();
+        let cwd = std::env::current_dir().expect("current dir");
+        let exec_request = manager
+            .transform(super::SandboxTransformRequest {
+                spec: super::CommandSpec {
+                    program: "true".to_string(),
+                    args: Vec::new(),
+                    cwd: cwd.clone(),
+                    env: HashMap::new(),
+                    expiration: crate::exec::ExecExpiration::DefaultTimeout,
+                    sandbox_permissions: super::SandboxPermissions::UseDefault,
+                    additional_permissions: None,
+                    justification: None,
+                },
+                policy: &SandboxPolicy::ExternalSandbox {
+                    network_access: crate::protocol::NetworkAccess::Restricted,
+                },
+                file_system_policy: &FileSystemSandboxPolicy::unrestricted(),
+                network_policy: NetworkSandboxPolicy::Restricted,
+                sandbox: SandboxType::None,
+                enforce_managed_network: false,
+                network: None,
+                sandbox_policy_cwd: cwd.as_path(),
+                #[cfg(target_os = "macos")]
+                macos_seatbelt_profile_extensions: None,
+                codex_linux_sandbox_exe: None,
+                use_linux_sandbox_bwrap: false,
+                windows_sandbox_level: WindowsSandboxLevel::Disabled,
+            })
+            .expect("transform");
+
+        assert_eq!(
+            exec_request.file_system_sandbox_policy,
+            FileSystemSandboxPolicy::unrestricted()
+        );
+        assert_eq!(
+            exec_request.network_sandbox_policy,
+            NetworkSandboxPolicy::Restricted
+        );
+    }
+
     #[test]
     fn normalize_additional_permissions_preserves_network() {
         let temp_dir = TempDir::new().expect("create temp dir");
@@ -624,7 +838,6 @@ mod tests {
             }
         );
     }
-
     #[cfg(target_os = "macos")]
     #[test]
     fn effective_permissions_merge_macos_extensions_with_additional_permissions() {
@@ -679,4 +892,223 @@ mod tests {
             })
         );
     }
+
+    #[test]
+    fn external_sandbox_additional_permissions_can_enable_network() {
+        let temp_dir = TempDir::new().expect("create temp dir");
+        let path = AbsolutePathBuf::from_absolute_path(
+            canonicalize(temp_dir.path()).expect("canonicalize temp dir"),
+        )
+        .expect("absolute temp dir");
+        let policy = sandbox_policy_with_additional_permissions(
+            &SandboxPolicy::ExternalSandbox {
+                network_access: NetworkAccess::Restricted,
+            },
+            &PermissionProfile {
+                network: Some(NetworkPermissions {
+                    enabled: Some(true),
+                }),
+                file_system: Some(FileSystemPermissions {
+                    read: Some(vec![path]),
+                    write: Some(Vec::new()),
+                }),
+                ..Default::default()
+            },
+        );
+
+        assert_eq!(
+            policy,
+            SandboxPolicy::ExternalSandbox {
+                network_access: NetworkAccess::Enabled,
+            }
+        );
+    }
+
+    #[test]
+    fn transform_additional_permissions_enable_network_for_external_sandbox() {
+        let manager = SandboxManager::new();
+        let cwd = std::env::current_dir().expect("current dir");
+        let temp_dir = TempDir::new().expect("create temp dir");
+        let path = AbsolutePathBuf::from_absolute_path(
+            canonicalize(temp_dir.path()).expect("canonicalize temp dir"),
+        )
+        .expect("absolute temp dir");
+        let exec_request = manager
+            .transform(super::SandboxTransformRequest {
+                spec: super::CommandSpec {
+                    program: "true".to_string(),
+                    args: Vec::new(),
+                    cwd: cwd.clone(),
+                    env: HashMap::new(),
+                    expiration: crate::exec::ExecExpiration::DefaultTimeout,
+                    sandbox_permissions: super::SandboxPermissions::WithAdditionalPermissions,
+                    additional_permissions: Some(PermissionProfile {
+                        network: Some(NetworkPermissions {
+                            enabled: Some(true),
+                        }),
+                        file_system: Some(FileSystemPermissions {
+                            read: Some(vec![path]),
+                            write: Some(Vec::new()),
+                        }),
+                        ..Default::default()
+                    }),
+                    justification: None,
+                },
+                policy: &SandboxPolicy::ExternalSandbox {
+                    network_access: NetworkAccess::Restricted,
+                },
+                file_system_policy: &FileSystemSandboxPolicy::unrestricted(),
+                network_policy: NetworkSandboxPolicy::Restricted,
+                sandbox: SandboxType::None,
+                enforce_managed_network: false,
+                network: None,
+                sandbox_policy_cwd: cwd.as_path(),
+                #[cfg(target_os = "macos")]
+                macos_seatbelt_profile_extensions: None,
+                codex_linux_sandbox_exe: None,
+                use_linux_sandbox_bwrap: false,
+                windows_sandbox_level: WindowsSandboxLevel::Disabled,
+            })
+            .expect("transform");
+
+        assert_eq!(
+            exec_request.sandbox_policy,
+            SandboxPolicy::ExternalSandbox {
+                network_access: NetworkAccess::Enabled,
+            }
+        );
+        assert_eq!(
+            exec_request.network_sandbox_policy,
+            NetworkSandboxPolicy::Enabled
+        );
+    }
+
+    #[test]
+    fn transform_additional_permissions_preserves_denied_entries() {
+        let manager = SandboxManager::new();
+        let cwd = std::env::current_dir().expect("current dir");
+        let temp_dir = TempDir::new().expect("create temp dir");
+        let workspace_root = AbsolutePathBuf::from_absolute_path(
+            canonicalize(temp_dir.path()).expect("canonicalize temp dir"),
+        )
+        .expect("absolute temp dir");
+        let allowed_path = workspace_root.join("allowed").expect("allowed path");
+        let denied_path = workspace_root.join("denied").expect("denied path");
+        let exec_request = manager
+            .transform(super::SandboxTransformRequest {
+                spec: super::CommandSpec {
+                    program: "true".to_string(),
+                    args: Vec::new(),
+                    cwd: cwd.clone(),
+                    env: HashMap::new(),
+                    expiration: crate::exec::ExecExpiration::DefaultTimeout,
+                    sandbox_permissions: super::SandboxPermissions::WithAdditionalPermissions,
+                    additional_permissions: Some(PermissionProfile {
+                        file_system: Some(FileSystemPermissions {
+                            read: None,
+                            write: Some(vec![allowed_path.clone()]),
+                        }),
+                        ..Default::default()
+                    }),
+                    justification: None,
+                },
+                policy: &SandboxPolicy::ReadOnly {
+                    access: ReadOnlyAccess::FullAccess,
+                    network_access: false,
+                },
+                file_system_policy: &FileSystemSandboxPolicy::restricted(vec![
+                    FileSystemSandboxEntry {
+                        path: FileSystemPath::Special {
+                            value: FileSystemSpecialPath::Root,
+                        },
+                        access: FileSystemAccessMode::Read,
+                    },
+                    FileSystemSandboxEntry {
+                        path: FileSystemPath::Path {
+                            path: denied_path.clone(),
+                        },
+                        access: FileSystemAccessMode::None,
+                    },
+                ]),
+                network_policy: NetworkSandboxPolicy::Restricted,
+                sandbox: SandboxType::None,
+                enforce_managed_network: false,
+                network: None,
+                sandbox_policy_cwd: cwd.as_path(),
+                #[cfg(target_os = "macos")]
+                macos_seatbelt_profile_extensions: None,
+                codex_linux_sandbox_exe: None,
+                use_linux_sandbox_bwrap: false,
+                windows_sandbox_level: WindowsSandboxLevel::Disabled,
+            })
+            .expect("transform");
+
+        assert_eq!(
+            exec_request.file_system_sandbox_policy,
+            FileSystemSandboxPolicy::restricted(vec![
+                FileSystemSandboxEntry {
+                    path: FileSystemPath::Special {
+                        value: FileSystemSpecialPath::Root,
+                    },
+                    access: FileSystemAccessMode::Read,
+                },
+                FileSystemSandboxEntry {
+                    path: FileSystemPath::Path { path: denied_path },
+                    access: FileSystemAccessMode::None,
+                },
+                FileSystemSandboxEntry {
+                    path: FileSystemPath::Path { path: allowed_path },
+                    access: FileSystemAccessMode::Write,
+                },
+            ])
+        );
+        assert_eq!(
+            exec_request.network_sandbox_policy,
+            NetworkSandboxPolicy::Restricted
+        );
+    }
+
+    #[test]
+    fn merge_file_system_policy_with_additional_permissions_preserves_unreadable_roots() {
+        let temp_dir = TempDir::new().expect("create temp dir");
+        let cwd = AbsolutePathBuf::from_absolute_path(
+            canonicalize(temp_dir.path()).expect("canonicalize temp dir"),
+        )
+        .expect("absolute temp dir");
+        let allowed_path = cwd.join("allowed").expect("allowed path");
+        let denied_path = cwd.join("denied").expect("denied path");
+        let merged_policy = merge_file_system_policy_with_additional_permissions(
+            &FileSystemSandboxPolicy::restricted(vec![
+                FileSystemSandboxEntry {
+                    path: FileSystemPath::Special {
+                        value: FileSystemSpecialPath::Root,
+                    },
+                    access: FileSystemAccessMode::Read,
+                },
+                FileSystemSandboxEntry {
+                    path: FileSystemPath::Path {
+                        path: denied_path.clone(),
+                    },
+                    access: FileSystemAccessMode::None,
+                },
+            ]),
+            vec![allowed_path.clone()],
+            Vec::new(),
+        );
+
+        assert_eq!(
+            merged_policy.entries.contains(&FileSystemSandboxEntry {
+                path: FileSystemPath::Path { path: denied_path },
+                access: FileSystemAccessMode::None,
+            }),
+            true
+        );
+        assert_eq!(
+            merged_policy.entries.contains(&FileSystemSandboxEntry {
+                path: FileSystemPath::Path { path: allowed_path },
+                access: FileSystemAccessMode::Read,
+            }),
+            true
+        );
+    }
 }