Codex CLI on Windows update fails

They may be working on this and may have fixed it.

github.com/openai/codex

windows-sandbox: add resolved permissions helper (#22896)

committed 05:30PM - 20 May 26 UTC

      bolinfest
    

+194 -65

Why The Windows sandbox migration away from the legacy SandboxPolicy abstr…action needs a small local bridge before IPC and core wiring can move to PermissionProfile. Leaf helpers currently branch directly on WorkspaceWrite, which spreads legacy assumptions through path planning and token setup code. This PR introduces a Windows-local resolved permissions view so those helpers can ask Windows-specific questions about runtime filesystem/network permissions without matching on the legacy policy enum everywhere. ## What changed - Added ResolvedWindowsSandboxPermissions in windows-sandbox-rs/src/resolved_permissions.rs, with legacy SandboxPolicy constructors for the current call sites. - Moved allow.rs writable-root and read-only-subpath planning onto the resolved permissions type. - Preserved Windows TEMP/TMP writable-root behavior when the effective policy includes writable tmpdir access. - Avoided resolving Unix :slash_tmp or parent-process TMPDIR while computing Windows writable roots. - Reused the shared allow-path result for setup write-root gathering and routed network-block selection through the resolved abstraction. ## Verification - cargo test -p codex-windows-sandbox - just fix -p codex-windows-sandbox - GitHub CI restarted on the amended commit; Windows Bazel is the required signal for the Windows-only code paths. --- [//]: # (BEGIN SAPLING FOOTER) Stack created with Sapling. Best reviewed with ReviewStack. * #23715 * #23714 * #23167 * #22923 * #22918 * -> #22896