fix: canonicalize symlinked Linux sandbox cwd (#14849)

## Problem
On Linux, Codex can be launched from a workspace path that is a symlink
(for example, a symlinked checkout or a symlinked parent directory).

Our sandbox policy intentionally canonicalizes writable/readable roots
to the real filesystem path before building the bubblewrap mounts. That
part is correct and needed for safety.

The remaining bug was that bubblewrap could still inherit the helper
process's logical cwd, which might be the symlinked alias instead of the
mounted canonical path. In that case, the sandbox starts in a cwd that
does not exist inside the sandbox namespace even though the real
workspace is mounted. This can cause sandboxed commands to fail in
symlinked workspaces.

## Fix
This PR keeps the sandbox policy behavior the same, but separates two
concepts that were previously conflated:

- the canonical cwd used to define sandbox mounts and permissions
- the caller's logical cwd used when launching the command

On the Linux bubblewrap path, we now thread the logical command cwd
through the helper explicitly and only add `--chdir <canonical path>`
when the logical cwd differs from the mounted canonical path.

That means:
- permissions are still computed from canonical paths
- bubblewrap starts the command from a cwd that definitely exists inside
the sandbox
- we do not widen filesystem access or undo the earlier symlink
hardening

## Why This Is Safe
This is a narrow Linux-only launch fix, not a policy change.

- Writable/readable root canonicalization stays intact.
- Protected metadata carveouts still operate on canonical roots.
- We only override bubblewrap's inherited cwd when the logical path
would otherwise point at a symlink alias that is not mounted in the
sandbox.

## Tests
- kept the existing protocol/core regression coverage for symlink
canonicalization
- added regression coverage for symlinked cwd handling in the Linux
bubblewrap builder/helper path

Local validation:
- `just fmt`
- `cargo test -p codex-protocol`
- `cargo test -p codex-core
normalize_additional_permissions_canonicalizes_symlinked_write_paths`
- `cargo clippy -p codex-linux-sandbox -p codex-protocol -p codex-core
--tests -- -D warnings`
- `cargo build --bin codex`

## Context
This is related to #14694. The earlier writable-root symlink fix
addressed the mount/permission side; this PR fixes the remaining
symlinked-cwd launch mismatch in the Linux sandbox path.

codex-rs/core/src/landlock.rs

@@ -38,6 +38,7 @@ where
     let network_sandbox_policy = NetworkSandboxPolicy::from(sandbox_policy);
     let args = create_linux_sandbox_command_args_for_policies(
         command,
+        command_cwd.as_path(),
         sandbox_policy,
         &file_system_sandbox_policy,
         network_sandbox_policy,
@@ -76,6 +77,7 @@ pub(crate) fn allow_network_for_proxy(enforce_managed_network: bool) -> bool {
 #[allow(clippy::too_many_arguments)]
 pub(crate) fn create_linux_sandbox_command_args_for_policies(
     command: Vec<String>,
+    command_cwd: &Path,
     sandbox_policy: &SandboxPolicy,
     file_system_sandbox_policy: &FileSystemSandboxPolicy,
     network_sandbox_policy: NetworkSandboxPolicy,
@@ -93,10 +95,16 @@ pub(crate) fn create_linux_sandbox_command_args_for_policies(
         .to_str()
         .unwrap_or_else(|| panic!("cwd must be valid UTF-8"))
         .to_string();
+    let command_cwd = command_cwd
+        .to_str()
+        .unwrap_or_else(|| panic!("command cwd must be valid UTF-8"))
+        .to_string();
 
     let mut linux_cmd: Vec<String> = vec![
         "--sandbox-policy-cwd".to_string(),
         sandbox_policy_cwd,
+        "--command-cwd".to_string(),
+        command_cwd,
         "--sandbox-policy".to_string(),
         sandbox_policy_json,
         "--file-system-sandbox-policy".to_string(),
@@ -120,16 +128,26 @@ pub(crate) fn create_linux_sandbox_command_args_for_policies(
 #[cfg(test)]
 pub(crate) fn create_linux_sandbox_command_args(
     command: Vec<String>,
+    command_cwd: &Path,
     sandbox_policy_cwd: &Path,
     use_legacy_landlock: bool,
     allow_network_for_proxy: bool,
 ) -> Vec<String> {
+    let command_cwd = command_cwd
+        .to_str()
+        .unwrap_or_else(|| panic!("command cwd must be valid UTF-8"))
+        .to_string();
     let sandbox_policy_cwd = sandbox_policy_cwd
         .to_str()
         .unwrap_or_else(|| panic!("cwd must be valid UTF-8"))
         .to_string();
 
-    let mut linux_cmd: Vec<String> = vec!["--sandbox-policy-cwd".to_string(), sandbox_policy_cwd];
+    let mut linux_cmd: Vec<String> = vec![
+        "--sandbox-policy-cwd".to_string(),
+        sandbox_policy_cwd,
+        "--command-cwd".to_string(),
+        command_cwd,
+    ];
     if use_legacy_landlock {
         linux_cmd.push("--use-legacy-landlock".to_string());
     }

codex-rs/core/src/landlock_tests.rs

@@ -4,15 +4,17 @@ use pretty_assertions::assert_eq;
 #[test]
 fn legacy_landlock_flag_is_included_when_requested() {
     let command = vec!["/bin/true".to_string()];
+    let command_cwd = Path::new("/tmp/link");
     let cwd = Path::new("/tmp");
 
-    let default_bwrap = create_linux_sandbox_command_args(command.clone(), cwd, false, false);
+    let default_bwrap =
+        create_linux_sandbox_command_args(command.clone(), command_cwd, cwd, false, false);
     assert_eq!(
         default_bwrap.contains(&"--use-legacy-landlock".to_string()),
         false
     );
 
-    let legacy_landlock = create_linux_sandbox_command_args(command, cwd, true, false);
+    let legacy_landlock = create_linux_sandbox_command_args(command, command_cwd, cwd, true, false);
     assert_eq!(
         legacy_landlock.contains(&"--use-legacy-landlock".to_string()),
         true
@@ -22,9 +24,10 @@ fn legacy_landlock_flag_is_included_when_requested() {
 #[test]
 fn proxy_flag_is_included_when_requested() {
     let command = vec!["/bin/true".to_string()];
+    let command_cwd = Path::new("/tmp/link");
     let cwd = Path::new("/tmp");
 
-    let args = create_linux_sandbox_command_args(command, cwd, true, true);
+    let args = create_linux_sandbox_command_args(command, command_cwd, cwd, true, true);
     assert_eq!(
         args.contains(&"--allow-network-for-proxy".to_string()),
         true
@@ -34,6 +37,7 @@ fn proxy_flag_is_included_when_requested() {
 #[test]
 fn split_policy_flags_are_included() {
     let command = vec!["/bin/true".to_string()];
+    let command_cwd = Path::new("/tmp/link");
     let cwd = Path::new("/tmp");
     let sandbox_policy = SandboxPolicy::new_read_only_policy();
     let file_system_sandbox_policy = FileSystemSandboxPolicy::from(&sandbox_policy);
@@ -41,6 +45,7 @@ fn split_policy_flags_are_included() {
 
     let args = create_linux_sandbox_command_args_for_policies(
         command,
+        command_cwd,
         &sandbox_policy,
         &file_system_sandbox_policy,
         network_sandbox_policy,
@@ -59,6 +64,11 @@ fn split_policy_flags_are_included() {
             .any(|window| window[0] == "--network-sandbox-policy" && window[1] == "\"restricted\""),
         true
     );
+    assert_eq!(
+        args.windows(2)
+            .any(|window| window[0] == "--command-cwd" && window[1] == "/tmp/link"),
+        true
+    );
 }
 
 #[test]

codex-rs/core/src/sandboxing/mod.rs

@@ -672,6 +672,7 @@ impl SandboxManager {
                 let allow_proxy_network = allow_network_for_proxy(enforce_managed_network);
                 let mut args = create_linux_sandbox_command_args_for_policies(
                     command.clone(),
+                    spec.cwd.as_path(),
                     &effective_policy,
                     &effective_file_system_policy,
                     effective_network_policy,

codex-rs/core/src/sandboxing/mod_tests.rs

@@ -35,8 +35,15 @@ use codex_utils_absolute_path::AbsolutePathBuf;
 use dunce::canonicalize;
 use pretty_assertions::assert_eq;
 use std::collections::HashMap;
+#[cfg(unix)]
+use std::path::Path;
 use tempfile::TempDir;
 
+#[cfg(unix)]
+fn symlink_dir(original: &Path, link: &Path) -> std::io::Result<()> {
+    std::os::unix::fs::symlink(original, link)
+}
+
 #[test]
 fn danger_full_access_defaults_to_no_sandbox_without_network_requirements() {
     let manager = SandboxManager::new();
@@ -217,6 +224,41 @@ fn normalize_additional_permissions_preserves_network() {
     );
 }
 
+#[cfg(unix)]
+#[test]
+fn normalize_additional_permissions_canonicalizes_symlinked_write_paths() {
+    let temp_dir = TempDir::new().expect("create temp dir");
+    let real_root = temp_dir.path().join("real");
+    let link_root = temp_dir.path().join("link");
+    let write_dir = real_root.join("write");
+    std::fs::create_dir_all(&write_dir).expect("create write dir");
+    symlink_dir(&real_root, &link_root).expect("create symlinked root");
+
+    let link_write_dir =
+        AbsolutePathBuf::from_absolute_path(link_root.join("write")).expect("link write dir");
+    let expected_write_dir = AbsolutePathBuf::from_absolute_path(
+        write_dir.canonicalize().expect("canonicalize write dir"),
+    )
+    .expect("absolute canonical write dir");
+
+    let permissions = normalize_additional_permissions(PermissionProfile {
+        file_system: Some(FileSystemPermissions {
+            read: Some(vec![]),
+            write: Some(vec![link_write_dir]),
+        }),
+        ..Default::default()
+    })
+    .expect("permissions");
+
+    assert_eq!(
+        permissions.file_system,
+        Some(FileSystemPermissions {
+            read: Some(vec![]),
+            write: Some(vec![expected_write_dir]),
+        })
+    );
+}
+
 #[test]
 fn normalize_additional_permissions_drops_empty_nested_profiles() {
     let permissions = normalize_additional_permissions(PermissionProfile {