Reject elevated workspace-write sandbox

codex-rs/core/src/exec.rs

@@ -1101,6 +1101,13 @@ pub(crate) fn resolve_windows_elevated_filesystem_overrides(
         ));
     }
 
+    if matches!(sandbox_policy, SandboxPolicy::WorkspaceWrite { .. }) {
+        return Err(
+            "windows elevated sandbox cannot enforce workspace-write filesystem boundaries directly; refusing to widen sandbox semantics"
+                .to_string(),
+        );
+    }
+
     if !file_system_sandbox_policy
         .get_unreadable_roots_with_cwd(sandbox_policy_cwd)
         .is_empty()

codex-rs/core/src/exec_tests.rs

@@ -702,11 +702,10 @@ fn windows_elevated_supports_split_restricted_read_roots() {
 }
 
 #[test]
-fn windows_elevated_supports_split_write_read_carveouts() {
+fn windows_elevated_rejects_workspace_write_policies() {
     let temp_dir = tempfile::TempDir::new().expect("tempdir");
     let docs = temp_dir.path().join("docs");
     std::fs::create_dir_all(&docs).expect("create docs");
-    let expected_docs = dunce::canonicalize(&docs).expect("canonical docs");
     let policy = SandboxPolicy::WorkspaceWrite {
         writable_roots: vec![],
         read_only_access: codex_protocol::protocol::ReadOnlyAccess::FullAccess,
@@ -745,14 +744,10 @@ fn windows_elevated_supports_split_write_read_carveouts() {
             &temp_dir.path().abs(),
             /*use_windows_elevated_backend*/ true,
         ),
-        Ok(Some(WindowsSandboxFilesystemOverrides {
-            read_roots_override: None,
-            write_roots_override: None,
-            additional_deny_write_paths: vec![
-                codex_utils_absolute_path::AbsolutePathBuf::from_absolute_path(expected_docs)
-                    .expect("absolute docs"),
-            ],
-        }))
+        Err(
+            "windows elevated sandbox cannot enforce workspace-write filesystem boundaries directly; refusing to widen sandbox semantics"
+                .to_string()
+        )
     );
 }
 
@@ -800,7 +795,7 @@ fn windows_elevated_rejects_unreadable_split_carveouts() {
             WindowsSandboxLevel::Elevated,
         ),
         Some(
-            "windows elevated sandbox cannot enforce unreadable split filesystem carveouts directly; refusing to run unsandboxed"
+            "windows elevated sandbox cannot enforce workspace-write filesystem boundaries directly; refusing to widen sandbox semantics"
                 .to_string()
         )
     );
@@ -847,7 +842,7 @@ fn windows_elevated_rejects_unreadable_globs() {
             WindowsSandboxLevel::Elevated,
         ),
         Some(
-            "windows elevated sandbox cannot enforce unreadable split filesystem carveouts directly; refusing to run unsandboxed"
+            "windows elevated sandbox cannot enforce workspace-write filesystem boundaries directly; refusing to widen sandbox semantics"
                 .to_string()
         )
     );
@@ -905,7 +900,7 @@ fn windows_elevated_rejects_reopened_writable_descendants() {
             WindowsSandboxLevel::Elevated,
         ),
         Some(
-            "windows elevated sandbox cannot reopen writable descendants under read-only carveouts directly; refusing to run unsandboxed"
+            "windows elevated sandbox cannot enforce workspace-write filesystem boundaries directly; refusing to widen sandbox semantics"
                 .to_string()
         )
     );