core: expose workspace roots to tool sandboxing

codex-rs/core/src/tools/orchestrator.rs

@@ -13,7 +13,6 @@ use crate::guardian::review_approval_request;
 use crate::guardian::routes_approval_to_guardian;
 use crate::hook_runtime::run_permission_request_hooks;
 use crate::network_policy_decision::network_approval_context_from_payload;
-use crate::session::turn_context::TurnEnvironment;
 use crate::tools::flat_tool_name;
 use crate::tools::network_approval::ActiveNetworkApproval;
 use crate::tools::network_approval::DeferredNetworkApproval;
@@ -267,9 +266,13 @@ impl ToolOrchestrator {
             .cloned()
             .unwrap_or_else(|| PathUri::from_abs_path(&turn_ctx.cwd));
         let workspace_roots = tool
-            .turn_environment(req)
-            .or_else(|| turn_ctx.environments.primary())
-            .map(TurnEnvironment::workspace_roots)
+            .workspace_roots(req)
+            .or_else(|| {
+                turn_ctx
+                    .environments
+                    .primary()
+                    .map(|environment| environment.workspace_roots())
+            })
             .unwrap_or_default();
         let permissions = workspace_roots
             .iter()

codex-rs/core/src/tools/runtimes/apply_patch.rs

@@ -219,8 +219,8 @@ impl Approvable<ApplyPatchRequest> for ApplyPatchRuntime {
 }
 
 impl ToolRuntime<ApplyPatchRequest, ApplyPatchRuntimeOutput> for ApplyPatchRuntime {
-    fn turn_environment<'a>(&self, req: &'a ApplyPatchRequest) -> Option<&'a TurnEnvironment> {
-        Some(&req.turn_environment)
+    fn workspace_roots<'a>(&self, req: &'a ApplyPatchRequest) -> Option<&'a [PathUri]> {
+        Some(req.turn_environment.workspace_roots())
     }
 
     fn sandbox_cwd<'a>(&self, req: &'a ApplyPatchRequest) -> Option<&'a PathUri> {

codex-rs/core/src/tools/runtimes/shell.rs

@@ -46,6 +46,7 @@ use codex_protocol::protocol::ReviewDecision;
 use codex_sandboxing::SandboxablePreference;
 use codex_shell_command::powershell::prefix_powershell_script_with_utf8;
 use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_path_uri::PathUri;
 use futures::future::BoxFuture;
 use std::collections::HashMap;
 use tokio_util::sync::CancellationToken;
@@ -208,8 +209,8 @@ impl Approvable<ShellRequest> for ShellRuntime {
 }
 
 impl ToolRuntime<ShellRequest, ExecToolCallOutput> for ShellRuntime {
-    fn turn_environment<'a>(&self, req: &'a ShellRequest) -> Option<&'a TurnEnvironment> {
-        Some(&req.turn_environment)
+    fn workspace_roots<'a>(&self, req: &'a ShellRequest) -> Option<&'a [PathUri]> {
+        Some(req.turn_environment.workspace_roots())
     }
 
     fn network_approval_spec(

codex-rs/core/src/tools/runtimes/unified_exec.rs

@@ -255,8 +255,8 @@ impl Approvable<UnifiedExecRequest> for UnifiedExecRuntime<'_> {
 }
 
 impl<'a> ToolRuntime<UnifiedExecRequest, UnifiedExecProcess> for UnifiedExecRuntime<'a> {
-    fn turn_environment<'b>(&self, req: &'b UnifiedExecRequest) -> Option<&'b TurnEnvironment> {
-        Some(&req.turn_environment)
+    fn workspace_roots<'b>(&self, req: &'b UnifiedExecRequest) -> Option<&'b [PathUri]> {
+        Some(req.turn_environment.workspace_roots())
     }
 
     fn sandbox_cwd<'b>(&self, req: &'b UnifiedExecRequest) -> Option<&'b PathUri> {

codex-rs/core/src/tools/sandboxing.rs

@@ -8,7 +8,6 @@ use crate::sandboxing::ExecOptions;
 use crate::sandboxing::SandboxPermissions;
 use crate::session::session::Session;
 use crate::session::turn_context::TurnContext;
-use crate::session::turn_context::TurnEnvironment;
 use crate::state::SessionServices;
 use crate::tools::hook_names::HookToolName;
 use crate::tools::network_approval::NetworkApprovalSpec;
@@ -395,7 +394,7 @@ pub(crate) enum ToolError {
 }
 
 pub(crate) trait ToolRuntime<Req, Out>: Approvable<Req> + Sandboxable {
-    fn turn_environment<'a>(&self, _req: &'a Req) -> Option<&'a TurnEnvironment> {
+    fn workspace_roots<'a>(&self, _req: &'a Req) -> Option<&'a [PathUri]> {
         None
     }