Spread AbsolutePathBuf (#17792)

Mechanical change to promote absolute paths through code.

codex-rs/core/src/exec_tests.rs

@@ -1,6 +1,8 @@
 use super::*;
 use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_sandboxing::SandboxType;
+use core_test_support::PathBufExt;
+use core_test_support::PathExt;
 use pretty_assertions::assert_eq;
 use std::collections::HashMap;
 use std::time::Duration;
@@ -369,7 +371,7 @@ async fn process_exec_tool_call_preserves_full_buffer_capture_policy() -> Result
         &sandbox_policy,
         &FileSystemSandboxPolicy::from(&sandbox_policy),
         NetworkSandboxPolicy::Enabled,
-        cwd.as_path(),
+        &cwd,
         &None,
         /*use_legacy_landlock*/ false,
         /*stdout_stream*/ None,
@@ -436,7 +438,7 @@ fn windows_restricted_token_rejects_network_only_restrictions() {
         network_access: codex_protocol::protocol::NetworkAccess::Restricted,
     };
     let file_system_policy = FileSystemSandboxPolicy::unrestricted();
-    let sandbox_policy_cwd = std::env::current_dir().expect("cwd");
+    let sandbox_policy_cwd = AbsolutePathBuf::current_dir().expect("cwd");
 
     assert_eq!(
             unsupported_windows_restricted_token_sandbox_reason(
@@ -457,7 +459,7 @@ fn windows_restricted_token_rejects_network_only_restrictions() {
 fn windows_restricted_token_allows_legacy_restricted_policies() {
     let policy = SandboxPolicy::new_read_only_policy();
     let file_system_policy = FileSystemSandboxPolicy::from(&policy);
-    let sandbox_policy_cwd = std::env::current_dir().expect("cwd");
+    let sandbox_policy_cwd = AbsolutePathBuf::current_dir().expect("cwd");
 
     assert_eq!(
         unsupported_windows_restricted_token_sandbox_reason(
@@ -482,7 +484,7 @@ fn windows_restricted_token_allows_legacy_workspace_write_policies() {
         exclude_slash_tmp: true,
     };
     let file_system_policy = FileSystemSandboxPolicy::from(&policy);
-    let sandbox_policy_cwd = std::env::current_dir().expect("cwd");
+    let sandbox_policy_cwd = AbsolutePathBuf::current_dir().expect("cwd");
 
     assert_eq!(
         unsupported_windows_restricted_token_sandbox_reason(
@@ -520,7 +522,7 @@ fn windows_elevated_allows_legacy_restricted_read_policies() {
             &policy,
             &file_system_policy,
             NetworkSandboxPolicy::Restricted,
-            temp_dir.path(),
+            &temp_dir.path().abs(),
             WindowsSandboxLevel::Elevated,
         ),
         None
@@ -561,7 +563,7 @@ fn windows_restricted_token_rejects_split_only_filesystem_policies() {
             &policy,
             &file_system_policy,
             NetworkSandboxPolicy::Restricted,
-            temp_dir.path(),
+            &temp_dir.path().abs(),
             WindowsSandboxLevel::RestrictedToken,
         ),
         Some(
@@ -605,7 +607,7 @@ fn windows_restricted_token_rejects_root_write_read_only_carveouts() {
             &policy,
             &file_system_policy,
             NetworkSandboxPolicy::Restricted,
-            temp_dir.path(),
+            &temp_dir.path().abs(),
             WindowsSandboxLevel::RestrictedToken,
         ),
         Some(
@@ -618,9 +620,11 @@ fn windows_restricted_token_rejects_root_write_read_only_carveouts() {
 #[test]
 fn windows_restricted_token_supports_full_read_split_write_read_carveouts() {
     let temp_dir = tempfile::TempDir::new().expect("tempdir");
-    let cwd = dunce::canonicalize(temp_dir.path()).expect("canonicalize temp dir");
+    let cwd = dunce::canonicalize(temp_dir.path())
+        .expect("canonicalize temp dir")
+        .abs();
     let docs = cwd.join("docs");
-    std::fs::create_dir_all(&docs).expect("create docs");
+    std::fs::create_dir_all(docs.as_path()).expect("create docs");
     let policy = SandboxPolicy::WorkspaceWrite {
         writable_roots: vec![],
         read_only_access: codex_protocol::protocol::ReadOnlyAccess::FullAccess,
@@ -642,20 +646,14 @@ fn windows_restricted_token_supports_full_read_split_write_read_carveouts() {
             access: codex_protocol::permissions::FileSystemAccessMode::Write,
         },
         codex_protocol::permissions::FileSystemSandboxEntry {
-            path: codex_protocol::permissions::FileSystemPath::Path {
-                path: codex_utils_absolute_path::AbsolutePathBuf::from_absolute_path(&docs)
-                    .expect("absolute docs"),
-            },
+            path: codex_protocol::permissions::FileSystemPath::Path { path: docs.clone() },
             access: codex_protocol::permissions::FileSystemAccessMode::Read,
         },
     ]);
 
     // The legacy workspace-write root already protects top-level `.codex`, so
     // the restricted-token overlay only needs the extra read-only docs carveout.
-    let expected_deny_write_paths = vec![
-        codex_utils_absolute_path::AbsolutePathBuf::from_absolute_path(&docs)
-            .expect("absolute docs"),
-    ];
+    let expected_deny_write_paths = vec![docs];
 
     assert_eq!(
         resolve_windows_restricted_token_filesystem_overrides(
@@ -700,7 +698,7 @@ fn windows_elevated_supports_split_restricted_read_roots() {
             &policy,
             &file_system_policy,
             NetworkSandboxPolicy::Restricted,
-            temp_dir.path(),
+            &temp_dir.path().abs(),
             /*use_windows_elevated_backend*/ true,
         ),
         Ok(Some(WindowsSandboxFilesystemOverrides {
@@ -752,7 +750,7 @@ fn windows_elevated_supports_split_write_read_carveouts() {
             &policy,
             &file_system_policy,
             NetworkSandboxPolicy::Restricted,
-            temp_dir.path(),
+            &temp_dir.path().abs(),
             /*use_windows_elevated_backend*/ true,
         ),
         Ok(Some(WindowsSandboxFilesystemOverrides {
@@ -806,7 +804,7 @@ fn windows_elevated_rejects_unreadable_split_carveouts() {
             &policy,
             &file_system_policy,
             NetworkSandboxPolicy::Restricted,
-            temp_dir.path(),
+            &temp_dir.path().abs(),
             WindowsSandboxLevel::Elevated,
         ),
         Some(
@@ -864,7 +862,7 @@ fn windows_elevated_rejects_reopened_writable_descendants() {
             &policy,
             &file_system_policy,
             NetworkSandboxPolicy::Restricted,
-            temp_dir.path(),
+            &temp_dir.path().abs(),
             WindowsSandboxLevel::Elevated,
         ),
         Some(
@@ -998,7 +996,7 @@ async fn process_exec_tool_call_respects_cancellation_token() -> Result<()> {
         &SandboxPolicy::DangerFullAccess,
         &FileSystemSandboxPolicy::from(&SandboxPolicy::DangerFullAccess),
         NetworkSandboxPolicy::Enabled,
-        cwd.as_path(),
+        &cwd,
         &None,
         /*use_legacy_landlock*/ false,
         /*stdout_stream*/ None,