Remove generated-default filesystem path variants

codex-rs/app-server-protocol/src/protocol/v2/permissions.rs

@@ -312,13 +312,11 @@ pub enum FileSystemPath {
 impl From<CoreFileSystemPath> for FileSystemPath {
     fn from(value: CoreFileSystemPath) -> Self {
         match value {
-            CoreFileSystemPath::Path { path }
-            | CoreFileSystemPath::GeneratedDefaultPath { path } => Self::Path {
+            CoreFileSystemPath::Path { path } => Self::Path {
                 path: LegacyAppPathString::from_abs_path(&path),
             },
             CoreFileSystemPath::GlobPattern { pattern } => Self::GlobPattern { pattern },
-            CoreFileSystemPath::Special { value }
-            | CoreFileSystemPath::GeneratedDefaultSpecial { value } => Self::Special {
+            CoreFileSystemPath::Special { value } => Self::Special {
                 value: value.into(),
             },
         }

codex-rs/core/src/config/config_tests.rs

@@ -4167,7 +4167,7 @@ exclude_slash_tmp = true
                         file_system_policy
                             .entries
                             .contains(&FileSystemSandboxEntry {
-                                path: FileSystemPath::GeneratedDefaultPath {
+                                path: FileSystemPath::Path {
                                     path: AbsolutePathBuf::resolve_path_against_base(
                                         subpath,
                                         cwd.path()

codex-rs/core/src/config/permissions.rs

@@ -249,8 +249,6 @@ fn insert_filesystem_permission_toml(
         FileSystemPath::Special { value } => {
             insert_special_filesystem_permission_toml(entries, value, entry.access);
         }
-        FileSystemPath::GeneratedDefaultPath { .. }
-        | FileSystemPath::GeneratedDefaultSpecial { .. } => {}
     }
 }
 

codex-rs/core/src/context/environment_context.rs

@@ -153,13 +153,13 @@ fn render_file_system_entry(rendered: &mut String, entry: &FileSystemSandboxEntr
     }
     rendered.push_str("\">");
     match &entry.path {
-        FileSystemPath::Path { path } | FileSystemPath::GeneratedDefaultPath { path } => {
+        FileSystemPath::Path { path } => {
             push_text_element(rendered, "path", path.to_string_lossy().as_ref());
         }
         FileSystemPath::GlobPattern { pattern } => {
             push_text_element(rendered, "glob", pattern);
         }
-        FileSystemPath::Special { value } | FileSystemPath::GeneratedDefaultSpecial { value } => {
+        FileSystemPath::Special { value } => {
             let value = render_special_path(value);
             push_text_element(rendered, "special", &value);
         }

codex-rs/core/src/exec_tests.rs

@@ -803,51 +803,6 @@ fn windows_elevated_supports_split_write_read_carveouts() {
     );
 }
 
-#[cfg(target_os = "windows")]
-#[test]
-fn windows_workspace_defaults_do_not_hide_explicit_metadata_carveouts() {
-    let temp_dir = tempfile::TempDir::new().expect("tempdir");
-    let cwd = temp_dir.path().canonicalize().expect("canonical cwd").abs();
-
-    let default_profile = PermissionProfile::workspace_write();
-    let default_overrides = resolve_windows_elevated_filesystem_overrides(
-        SandboxType::WindowsRestrictedToken,
-        &default_profile,
-        &cwd,
-        /*use_windows_elevated_backend*/ true,
-    )
-    .expect("resolve workspace defaults");
-    assert!(
-        default_overrides.is_none_or(|overrides| overrides.additional_deny_write_paths.is_empty())
-    );
-
-    for name in codex_protocol::permissions::PROTECTED_METADATA_PATH_NAMES {
-        let (mut explicit_policy, network_policy) = default_profile.to_runtime_permissions();
-        explicit_policy
-            .entries
-            .push(codex_protocol::permissions::FileSystemSandboxEntry {
-                path: codex_protocol::permissions::FileSystemPath::Special {
-                    value: codex_protocol::permissions::FileSystemSpecialPath::project_roots(Some(
-                        (*name).into(),
-                    )),
-                },
-                access: codex_protocol::permissions::FileSystemAccessMode::Read,
-            });
-        let explicit_profile =
-            PermissionProfile::from_runtime_permissions(&explicit_policy, network_policy);
-
-        let overrides = resolve_windows_elevated_filesystem_overrides(
-            SandboxType::WindowsRestrictedToken,
-            &explicit_profile,
-            &cwd,
-            /*use_windows_elevated_backend*/ true,
-        )
-        .expect("resolve explicit metadata carveout")
-        .expect("explicit metadata carveout needs an override");
-        assert_eq!(overrides.additional_deny_write_paths, vec![cwd.join(name)]);
-    }
-}
-
 #[test]
 fn windows_elevated_supports_unreadable_split_carveouts() {
     let temp_dir = tempfile::TempDir::new().expect("tempdir");

codex-rs/core/tests/suite/windows_sandbox.rs

@@ -197,59 +197,6 @@ async fn windows_restricted_token_rejects_exact_and_glob_deny_read_policy() -> a
     Ok(())
 }
 
-#[tokio::test]
-#[serial(codex_home)]
-async fn windows_elevated_does_not_create_missing_workspace_metadata() -> anyhow::Result<()> {
-    let codex_home =
-        codex_home_for_windows_sandbox_test("windows-elevated-missing-metadata-codex-home")?;
-    let _codex_home_guard = EnvVarGuard::set("CODEX_HOME", codex_home.path().as_os_str());
-    stage_windows_sandbox_helpers()?;
-    let workspace = TempDir::new()?;
-    let cwd = dunce::canonicalize(workspace.path())?.abs();
-    let permission_profile = PermissionProfile::workspace_write()
-        .materialize_project_roots_with_workspace_roots(std::slice::from_ref(&cwd));
-
-    let output = process_exec_tool_call(
-        ExecParams {
-            command: vec![
-                "cmd.exe".to_string(),
-                "/D".to_string(),
-                "/C".to_string(),
-                "echo sandbox-ok".to_string(),
-            ],
-            cwd: cwd.clone(),
-            expiration: 10_000.into(),
-            capture_policy: ExecCapturePolicy::ShellTool,
-            env: HashMap::new(),
-            network: None,
-            network_environment_id: None,
-            sandbox_permissions: SandboxPermissions::UseDefault,
-            windows_sandbox_level: WindowsSandboxLevel::Elevated,
-            windows_sandbox_private_desktop: false,
-            justification: None,
-            arg0: None,
-        },
-        &permission_profile,
-        &cwd,
-        std::slice::from_ref(&cwd),
-        &None,
-        /*use_legacy_landlock*/ false,
-        /*stdout_stream*/ None,
-    )
-    .await?;
-
-    assert_eq!(output.exit_code, 0, "sandboxed command should complete");
-    for name in codex_protocol::permissions::PROTECTED_METADATA_PATH_NAMES {
-        let path = cwd.join(name);
-        assert!(
-            !path.exists(),
-            "elevated setup should not create missing workspace metadata: {}",
-            path.display()
-        );
-    }
-    Ok(())
-}
-
 #[tokio::test]
 #[serial(codex_home)]
 async fn windows_elevated_enforces_deny_read_and_protects_setup_marker() -> anyhow::Result<()> {

codex-rs/file-system/src/lib.rs

@@ -126,10 +126,8 @@ pub struct WalkOutcome {
 #[serde(tag = "type", rename_all = "snake_case")]
 pub enum ExecFileSystemPath {
     Path { path: PathUri },
-    GeneratedDefaultPath { path: PathUri },
     GlobPattern { pattern: String },
     Special { value: FileSystemSpecialPath },
-    GeneratedDefaultSpecial { value: FileSystemSpecialPath },
 }
 
 impl From<FileSystemPath> for ExecFileSystemPath {
@@ -138,14 +136,8 @@ impl From<FileSystemPath> for ExecFileSystemPath {
             FileSystemPath::Path { path } => Self::Path {
                 path: PathUri::from_abs_path(&path),
             },
-            FileSystemPath::GeneratedDefaultPath { path } => Self::GeneratedDefaultPath {
-                path: PathUri::from_abs_path(&path),
-            },
             FileSystemPath::GlobPattern { pattern } => Self::GlobPattern { pattern },
             FileSystemPath::Special { value } => Self::Special { value },
-            FileSystemPath::GeneratedDefaultSpecial { value } => {
-                Self::GeneratedDefaultSpecial { value }
-            }
         }
     }
 }
@@ -158,14 +150,8 @@ impl TryFrom<ExecFileSystemPath> for FileSystemPath {
             ExecFileSystemPath::Path { path } => Self::Path {
                 path: path.to_abs_path()?,
             },
-            ExecFileSystemPath::GeneratedDefaultPath { path } => Self::GeneratedDefaultPath {
-                path: path.to_abs_path()?,
-            },
             ExecFileSystemPath::GlobPattern { pattern } => Self::GlobPattern { pattern },
             ExecFileSystemPath::Special { value } => Self::Special { value },
-            ExecFileSystemPath::GeneratedDefaultSpecial { value } => {
-                Self::GeneratedDefaultSpecial { value }
-            }
         })
     }
 }
@@ -364,14 +350,8 @@ impl FileSystemSandboxContext {
                 ExecFileSystemPath::GlobPattern { pattern } => !Path::new(pattern).is_absolute(),
                 ExecFileSystemPath::Special {
                     value: FileSystemSpecialPath::ProjectRoots { .. },
-                }
-                | ExecFileSystemPath::GeneratedDefaultSpecial {
-                    value: FileSystemSpecialPath::ProjectRoots { .. },
                 } => true,
-                ExecFileSystemPath::Path { .. }
-                | ExecFileSystemPath::GeneratedDefaultPath { .. }
-                | ExecFileSystemPath::Special { .. }
-                | ExecFileSystemPath::GeneratedDefaultSpecial { .. } => false,
+                ExecFileSystemPath::Path { .. } | ExecFileSystemPath::Special { .. } => false,
             }),
             ExecPermissionProfile::Managed {
                 file_system: ExecManagedFileSystemPermissions::Unrestricted,

codex-rs/protocol/src/models.rs

@@ -111,10 +111,7 @@ impl FileSystemPermissions {
     ) -> impl Iterator<Item = (&AbsolutePathBuf, FileSystemAccessMode)> {
         self.entries.iter().filter_map(|entry| match &entry.path {
             FileSystemPath::Path { path } => Some((path, entry.access)),
-            FileSystemPath::GeneratedDefaultPath { .. }
-            | FileSystemPath::GlobPattern { .. }
-            | FileSystemPath::Special { .. }
-            | FileSystemPath::GeneratedDefaultSpecial { .. } => None,
+            FileSystemPath::GlobPattern { .. } | FileSystemPath::Special { .. } => None,
         })
     }