From 31fbc7a399de0278b74b9928e43ea43c4be7dd6b Mon Sep 17 00:00:00 2001
From: pakrym-oai <pakrym@openai.com>
Date: Thu, 9 Jul 2026 21:25:19 -0700
Subject: [PATCH] core: render workspace roots for foreign environments

---
 .../core/src/context/environment_context.rs   | 12 ++++++++----
 .../src/context/world_state/environment.rs    |  5 ++++-
 .../world_state/environment_render_tests.rs   | 19 ++++++++++++-------
 3 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/codex-rs/core/src/context/environment_context.rs b/codex-rs/core/src/context/environment_context.rs
index 2f795a8ea3..50efc8035d 100644
--- a/codex-rs/core/src/context/environment_context.rs
+++ b/codex-rs/core/src/context/environment_context.rs
@@ -4,7 +4,7 @@ use codex_protocol::permissions::FileSystemAccessMode;
 use codex_protocol::permissions::FileSystemPath;
 use codex_protocol::permissions::FileSystemSandboxEntry;
 use codex_protocol::permissions::FileSystemSpecialPath;
-use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_path_uri::PathUri;
 use std::collections::HashSet;
 use std::path::PathBuf;
 
@@ -33,14 +33,18 @@ enum ManagedFileSystemContext {
 impl FileSystemContext {
     pub(super) fn from_permission_profile(
         permission_profile: &PermissionProfile,
-        workspace_roots: &[AbsolutePathBuf],
+        workspace_roots: &[PathUri],
     ) -> Self {
+        let native_workspace_roots = workspace_roots
+            .iter()
+            .filter_map(|root| root.to_abs_path().ok())
+            .collect::<Vec<_>>();
         let permission_profile = permission_profile
             .clone()
-            .materialize_project_roots_with_workspace_roots(workspace_roots);
+            .materialize_project_roots_with_workspace_roots(&native_workspace_roots);
         let workspace_roots = workspace_roots
             .iter()
-            .map(|root| root.to_string_lossy().into_owned())
+            .map(PathUri::inferred_native_path_string)
             .collect();
         let permission_profile = match permission_profile {
             PermissionProfile::Managed { file_system, .. } => {
diff --git a/codex-rs/core/src/context/world_state/environment.rs b/codex-rs/core/src/context/world_state/environment.rs
index d34124ecf5..097a3e93ef 100644
--- a/codex-rs/core/src/context/world_state/environment.rs
+++ b/codex-rs/core/src/context/world_state/environment.rs
@@ -34,7 +34,10 @@ impl EnvironmentsState {
             network: network_from_turn_context(turn_context),
             filesystem: Some(FileSystemContext::from_permission_profile(
                 &turn_context.permission_profile,
-                &turn_context.config.effective_workspace_roots(),
+                environments
+                    .primary()
+                    .map(|environment| environment.workspace_roots())
+                    .unwrap_or_default(),
             )),
             subagents: None,
         }
diff --git a/codex-rs/core/src/context/world_state/environment_render_tests.rs b/codex-rs/core/src/context/world_state/environment_render_tests.rs
index 70122586ed..24ee9308b0 100644
--- a/codex-rs/core/src/context/world_state/environment_render_tests.rs
+++ b/codex-rs/core/src/context/world_state/environment_render_tests.rs
@@ -86,23 +86,25 @@ fn serialize_workspace_write_environment_context() {
 
 #[test]
 fn serialize_environment_context_with_foreign_windows_cwd() {
-    let context = environment_state(
-        [environment(
-            "remote",
-            PathUri::parse("file:///C:/windows").expect("Windows cwd URI"),
-            "powershell",
-        )],
+    let windows_root = PathUri::parse("file:///C:/windows").expect("Windows workspace root URI");
+    let mut context = environment_state(
+        [environment("remote", windows_root.clone(), "powershell")],
         /*current_date*/ None,
         /*timezone*/ None,
         /*network*/ None,
         /*subagents*/ None,
     );
+    context.filesystem = Some(FileSystemContext::from_permission_profile(
+        &PermissionProfile::Disabled,
+        &[windows_root],
+    ));
 
     assert_eq!(
         context.render(),
         r#"<environment_context>
   <cwd>C:\windows</cwd>
   <shell>powershell</shell>
+  <filesystem><workspace_roots><root>C:\windows</root></workspace_roots><permission_profile type="disabled"><file_system type="unrestricted" /></permission_profile></filesystem>
 </environment_context>"#
     );
 }
@@ -188,7 +190,10 @@ fn serialize_environment_context_with_full_filesystem_profile() {
     );
     context.filesystem = Some(FileSystemContext::from_permission_profile(
         &workspace_write_permission_profile_with_private_denials(),
-        &[repo.clone(), other_repo.clone()],
+        &[
+            PathUri::from_abs_path(&repo),
+            PathUri::from_abs_path(&other_repo),
+        ],
     ));
 
     let expected = format!(