fix(permissions): fix symlinked writable roots in sandbox permissions

codex-rs/core/src/exec_tests.rs

@@ -604,14 +604,8 @@ fn windows_restricted_token_supports_full_read_split_write_read_carveouts() {
         },
     ]);
 
-    #[cfg(windows)]
-    let expected_deny_write_paths = vec![
-        codex_utils_absolute_path::AbsolutePathBuf::from_absolute_path(cwd.join(".codex"))
-            .expect("absolute .codex"),
-        codex_utils_absolute_path::AbsolutePathBuf::from_absolute_path(&docs)
-            .expect("absolute docs"),
-    ];
-    #[cfg(not(windows))]
+    // The legacy workspace-write root already protects top-level `.codex`, so
+    // the restricted-token overlay only needs the extra read-only docs carveout.
     let expected_deny_write_paths = vec![
         codex_utils_absolute_path::AbsolutePathBuf::from_absolute_path(&docs)
             .expect("absolute docs"),

codex-rs/exec/src/lib.rs

@@ -83,6 +83,7 @@ use codex_protocol::protocol::SessionConfiguredEvent;
 use codex_protocol::protocol::SessionSource;
 use codex_protocol::user_input::UserInput;
 use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_absolute_path::canonicalize_existing_preserving_symlinks;
 use codex_utils_oss::ensure_oss_provider_ready;
 use codex_utils_oss::get_default_model_for_oss_provider;
 use event_processor_with_human_output::EventProcessorWithHumanOutput;
@@ -277,7 +278,9 @@ pub async fn run_main(cli: Cli, arg0_paths: Arg0DispatchPaths) -> anyhow::Result
 
     let resolved_cwd = cwd.clone();
     let config_cwd = match resolved_cwd.as_deref() {
-        Some(path) => AbsolutePathBuf::from_absolute_path(path.canonicalize()?)?,
+        Some(path) => {
+            AbsolutePathBuf::from_absolute_path(canonicalize_existing_preserving_symlinks(path)?)?
+        }
         None => AbsolutePathBuf::current_dir()?,
     };