From e1cb296253dba39008c1f12fe6aa3521b808e16c Mon Sep 17 00:00:00 2001
From: pakrym-oai <pakrym@openai.com>
Date: Thu, 9 Jul 2026 11:49:36 -0700
Subject: [PATCH] core: expose workspace roots to tool sandboxing

---
 codex-rs/core/src/tools/orchestrator.rs          | 11 +++++++----
 codex-rs/core/src/tools/runtimes/apply_patch.rs  |  4 ++--
 codex-rs/core/src/tools/runtimes/shell.rs        |  5 +++--
 codex-rs/core/src/tools/runtimes/unified_exec.rs |  4 ++--
 codex-rs/core/src/tools/sandboxing.rs            |  3 +--
 5 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/codex-rs/core/src/tools/orchestrator.rs b/codex-rs/core/src/tools/orchestrator.rs
index 475bc170a0..06b6095d48 100644
--- a/codex-rs/core/src/tools/orchestrator.rs
+++ b/codex-rs/core/src/tools/orchestrator.rs
@@ -13,7 +13,6 @@ use crate::guardian::review_approval_request;
 use crate::guardian::routes_approval_to_guardian;
 use crate::hook_runtime::run_permission_request_hooks;
 use crate::network_policy_decision::network_approval_context_from_payload;
-use crate::session::turn_context::TurnEnvironment;
 use crate::tools::flat_tool_name;
 use crate::tools::network_approval::ActiveNetworkApproval;
 use crate::tools::network_approval::DeferredNetworkApproval;
@@ -267,9 +266,13 @@ impl ToolOrchestrator {
             .cloned()
             .unwrap_or_else(|| PathUri::from_abs_path(&turn_ctx.cwd));
         let workspace_roots = tool
-            .turn_environment(req)
-            .or_else(|| turn_ctx.environments.primary())
-            .map(TurnEnvironment::workspace_roots)
+            .workspace_roots(req)
+            .or_else(|| {
+                turn_ctx
+                    .environments
+                    .primary()
+                    .map(|environment| environment.workspace_roots())
+            })
             .unwrap_or_default();
         let permissions = workspace_roots
             .iter()
diff --git a/codex-rs/core/src/tools/runtimes/apply_patch.rs b/codex-rs/core/src/tools/runtimes/apply_patch.rs
index 9617f9140a..f5023bd6e0 100644
--- a/codex-rs/core/src/tools/runtimes/apply_patch.rs
+++ b/codex-rs/core/src/tools/runtimes/apply_patch.rs
@@ -219,8 +219,8 @@ impl Approvable<ApplyPatchRequest> for ApplyPatchRuntime {
 }
 
 impl ToolRuntime<ApplyPatchRequest, ApplyPatchRuntimeOutput> for ApplyPatchRuntime {
-    fn turn_environment<'a>(&self, req: &'a ApplyPatchRequest) -> Option<&'a TurnEnvironment> {
-        Some(&req.turn_environment)
+    fn workspace_roots<'a>(&self, req: &'a ApplyPatchRequest) -> Option<&'a [PathUri]> {
+        Some(req.turn_environment.workspace_roots())
     }
 
     fn sandbox_cwd<'a>(&self, req: &'a ApplyPatchRequest) -> Option<&'a PathUri> {
diff --git a/codex-rs/core/src/tools/runtimes/shell.rs b/codex-rs/core/src/tools/runtimes/shell.rs
index 6562faa66e..a7b085bf8e 100644
--- a/codex-rs/core/src/tools/runtimes/shell.rs
+++ b/codex-rs/core/src/tools/runtimes/shell.rs
@@ -46,6 +46,7 @@ use codex_protocol::protocol::ReviewDecision;
 use codex_sandboxing::SandboxablePreference;
 use codex_shell_command::powershell::prefix_powershell_script_with_utf8;
 use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_path_uri::PathUri;
 use futures::future::BoxFuture;
 use std::collections::HashMap;
 use tokio_util::sync::CancellationToken;
@@ -208,8 +209,8 @@ impl Approvable<ShellRequest> for ShellRuntime {
 }
 
 impl ToolRuntime<ShellRequest, ExecToolCallOutput> for ShellRuntime {
-    fn turn_environment<'a>(&self, req: &'a ShellRequest) -> Option<&'a TurnEnvironment> {
-        Some(&req.turn_environment)
+    fn workspace_roots<'a>(&self, req: &'a ShellRequest) -> Option<&'a [PathUri]> {
+        Some(req.turn_environment.workspace_roots())
     }
 
     fn network_approval_spec(
diff --git a/codex-rs/core/src/tools/runtimes/unified_exec.rs b/codex-rs/core/src/tools/runtimes/unified_exec.rs
index b5af707d67..ee5c0deddc 100644
--- a/codex-rs/core/src/tools/runtimes/unified_exec.rs
+++ b/codex-rs/core/src/tools/runtimes/unified_exec.rs
@@ -255,8 +255,8 @@ impl Approvable<UnifiedExecRequest> for UnifiedExecRuntime<'_> {
 }
 
 impl<'a> ToolRuntime<UnifiedExecRequest, UnifiedExecProcess> for UnifiedExecRuntime<'a> {
-    fn turn_environment<'b>(&self, req: &'b UnifiedExecRequest) -> Option<&'b TurnEnvironment> {
-        Some(&req.turn_environment)
+    fn workspace_roots<'b>(&self, req: &'b UnifiedExecRequest) -> Option<&'b [PathUri]> {
+        Some(req.turn_environment.workspace_roots())
     }
 
     fn sandbox_cwd<'b>(&self, req: &'b UnifiedExecRequest) -> Option<&'b PathUri> {
diff --git a/codex-rs/core/src/tools/sandboxing.rs b/codex-rs/core/src/tools/sandboxing.rs
index cd3fb16af9..91a33d0029 100644
--- a/codex-rs/core/src/tools/sandboxing.rs
+++ b/codex-rs/core/src/tools/sandboxing.rs
@@ -8,7 +8,6 @@ use crate::sandboxing::ExecOptions;
 use crate::sandboxing::SandboxPermissions;
 use crate::session::session::Session;
 use crate::session::turn_context::TurnContext;
-use crate::session::turn_context::TurnEnvironment;
 use crate::state::SessionServices;
 use crate::tools::hook_names::HookToolName;
 use crate::tools::network_approval::NetworkApprovalSpec;
@@ -395,7 +394,7 @@ pub(crate) enum ToolError {
 }
 
 pub(crate) trait ToolRuntime<Req, Out>: Approvable<Req> + Sandboxable {
-    fn turn_environment<'a>(&self, _req: &'a Req) -> Option<&'a TurnEnvironment> {
+    fn workspace_roots<'a>(&self, _req: &'a Req) -> Option<&'a [PathUri]> {
         None
     }