codex-rs/exec-server/src/fs_sandbox.rs
codex-rs/protocol/src/permissions.rs