Ignore project instructions for untrusted projects (#39837)

## What changed

- Skip project-scoped `AGENTS.md` discovery when the active project is untrusted, while preserving user-level instructions.
- Include the active project trust level in the instruction cache key so runtime trust changes reload the applicable instructions.
- Preserve updated project trust metadata during runtime configuration refreshes.

## Testing

Add coverage for initially untrusted projects and for switching between trusted and untrusted states at runtime.

GitOrigin-RevId: 284bf7693943f585013fb5fe4b6aa3309bc50cf3

codex-rs/core/src/agents_md.rs

@@ -61,6 +61,10 @@ pub(crate) async fn load_project_instructions(
     windows_sandbox_level: WindowsSandboxLevel,
 ) -> io::Result<Option<LoadedAgentsMd>> {
     let mut loaded = LoadedAgentsMd::from_user_instructions(user_instructions);
+    if config.active_project.is_untrusted() {
+        return Ok((!loaded.is_empty()).then_some(loaded));
+    }
+
     let mut remaining = config.project_doc_max_bytes;
     for turn_environment in environments.turn_environments() {
         if remaining == 0 {

codex-rs/core/src/agents_md_manager.rs

@@ -3,6 +3,7 @@ use crate::agents_md::load_project_instructions;
 use crate::config::Config;
 use crate::environment_selection::TurnEnvironmentSnapshot;
 use codex_extension_api::UserInstructions;
+use codex_protocol::config_types::TrustLevel;
 use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::protocol::TurnEnvironmentSelection;
 use std::io;
@@ -18,6 +19,7 @@ pub(crate) struct AgentsMdManager {
 #[derive(Default)]
 struct AgentsMdCache {
     selections: Option<Vec<TurnEnvironmentSelection>>,
+    active_project_trust_level: Option<TrustLevel>,
     windows_sandbox_level: Option<WindowsSandboxLevel>,
     loaded: Option<Arc<LoadedAgentsMd>>,
 }
@@ -42,14 +44,17 @@ impl AgentsMdManager {
             .turn_environments()
             .map(|environment| environment.selection.clone())
             .collect::<Vec<_>>();
+        let active_project_trust_level = config.active_project.trust_level;
         {
             let mut cache = self.cache.lock().await;
             if cache.selections.as_ref() == Some(&selections)
+                && cache.active_project_trust_level == active_project_trust_level
                 && cache.windows_sandbox_level == Some(windows_sandbox_level)
             {
                 return Ok(());
             }
             cache.selections = None;
+            cache.active_project_trust_level = None;
             cache.windows_sandbox_level = None;
             cache.loaded = None;
         }
@@ -64,6 +69,7 @@ impl AgentsMdManager {
         .map(Arc::new);
         let mut cache = self.cache.lock().await;
         cache.selections = Some(selections);
+        cache.active_project_trust_level = active_project_trust_level;
         cache.windows_sandbox_level = Some(windows_sandbox_level);
         cache.loaded = loaded;
         Ok(())

codex-rs/core/src/session/mod.rs

@@ -1752,6 +1752,7 @@ impl Session {
             let previous_config = notify_config_contributors
                 .then(|| self.build_effective_session_config(&state.session_configuration));
             let mut config = (*state.session_configuration.original_config_do_not_use).clone();
+            config.active_project = next_config.active_project.clone();
             config.config_layer_stack = config
                 .config_layer_stack
                 .with_user_layer_from(&next_config.config_layer_stack);