Add telemetry for the Windows system config namespace (#44284)

## What changed

Probe the default Windows system config namespace at session start and record `codex.windows_system_config.namespace_squatting_probe` once per process when metrics are available.

When `config.toml` or `requirements.toml` exists, check the containing directories for expected ownership and broad standard-user mutation allow ACEs, including permissions inherited by child files. Report coarse results for missing files, expected directories, unexpected types or owners, mutation permissions, and check errors.

The probe is observational: it does not change configuration loading or enforce a trust decision.

GitOrigin-RevId: e1c79dca5548e16e83c7b84b44ab0de4e2643d0d

codex-rs/core/src/config/metrics.rs

@@ -0,0 +1,10 @@
+//! Metrics derived from loaded configuration at session start.
+
+use super::Config;
+use codex_otel::SessionTelemetry;
+
+pub(crate) fn emit_session_start_metrics(config: &Config, telemetry: &SessionTelemetry) {
+    config.features.emit_metrics(telemetry);
+    #[cfg(windows)]
+    crate::windows_system_config::emit_namespace_squatting_probe();
+}

codex-rs/core/src/config/mod.rs

@@ -164,6 +164,7 @@ use toml_edit::DocumentMut;
 mod auth_keyring;
 pub mod edit;
 mod managed_features;
+mod metrics;
 mod network_proxy_spec;
 mod otel;
 mod permission_profile_catalog;
@@ -186,6 +187,7 @@ pub use codex_network_proxy::NetworkProxyAuditMetadata;
 use codex_sandboxing::compatibility_sandbox_policy_for_permission_profile;
 pub use codex_sandboxing::system_bwrap_warning;
 pub use managed_features::ManagedFeatures;
+pub(crate) use metrics::emit_session_start_metrics;
 pub use network_proxy_spec::NetworkProxySpec;
 pub use network_proxy_spec::StartedNetworkProxy;
 pub use permission_profile_catalog::PermissionProfileCatalogEntry;

codex-rs/core/src/lib.rs

@@ -111,6 +111,8 @@ mod stream_events_utils;
 pub mod test_support;
 mod unified_exec;
 pub mod windows_sandbox;
+#[cfg(windows)]
+mod windows_system_config;
 pub use client::X_RESPONSESAPI_INCLUDE_TIMING_METRICS_HEADER;
 pub use codex_protocol::config_types::ModelProviderAuthInfo;
 mod event_mapping;

codex-rs/core/src/session/session.rs

@@ -1143,7 +1143,7 @@ impl Session {
                 model: Some(session_model.clone()),
                 slug: Some(session_model),
             };
-            config.features.emit_metrics(&session_telemetry);
+            crate::config::emit_session_start_metrics(config.as_ref(), &session_telemetry);
             let is_worktree = session_configuration.cwd().canonicalize().ok().and_then(|cwd| {
                 codex_git_utils::repository_identity(&cwd).and_then(|_| {
                     get_git_repo_root(&cwd).map(|root| root.join(".git").is_file())

codex-rs/core/src/windows_system_config.rs

@@ -0,0 +1,35 @@
+//! Telemetry for the default Windows system-config namespace.
+
+use codex_config::loader::WindowsSystemConfigNamespaceProbe as Probe;
+use std::sync::atomic::AtomicBool;
+use std::sync::atomic::Ordering;
+
+const NAMESPACE_SQUATTING_PROBE_METRIC: &str =
+    "codex.windows_system_config.namespace_squatting_probe";
+static NAMESPACE_SQUATTING_PROBE_RECORDED: AtomicBool = AtomicBool::new(false);
+
+/// Records the coarse system-config namespace probe once after metrics exist.
+pub(crate) fn emit_namespace_squatting_probe() {
+    let Some(metrics) = codex_otel::global() else {
+        return;
+    };
+    if NAMESPACE_SQUATTING_PROBE_RECORDED
+        .compare_exchange(false, true, Ordering::Relaxed, Ordering::Relaxed)
+        .is_err()
+    {
+        return;
+    }
+    let result = match codex_config::loader::probe_windows_system_config_namespace() {
+        Probe::Missing => "missing",
+        Probe::Expected => "expected",
+        Probe::UnexpectedType => "unexpected_type",
+        Probe::UnexpectedOwner => "unexpected_owner",
+        Probe::StandardUserMutationAcl => "standard_user_acl",
+        Probe::CheckError => "check_error",
+    };
+    let _ = metrics.counter(
+        NAMESPACE_SQUATTING_PROBE_METRIC,
+        /*inc*/ 1,
+        &[("result", result)],
+    );
+}