feat(tui): clarify Windows auto mode requirements

[joshka-oai]

Summary

• Coerce Windows workspace-write configs back to read-only, surface the forced downgrade in the approvals popup,
  and funnel users toward WSL or Full Access.
• Add WSL installation instructions to the Auto preset on Windows while keeping the preset available for other
  platforms.
• Skip the trust-on-first-run prompt on native Windows so new folders remain read-only without additional
  confirmation.
• Expose a structured sandbox policy resolution from config to flag Windows downgrades and adjust tests (core,
  exec, TUI) to reflect the new behavior; provide a Windows-only approvals snapshot.

Testing

• cargo fmt
• cargo test -p codex-core config::tests::add_dir_override_extends_workspace_writable_roots
• cargo test -p codex-exec suite::resume::exec_resume_preserves_cli_configuration_overrides
• cargo test -p codex-tui chatwidget::tests::approvals_selection_popup_snapshot
• cargo test -p codex-tui approvals_popup_includes_wsl_note_for_auto_mode
• cargo test -p codex-tui windows_skips_trust_prompt
• just fix -p codex-core
• just fix -p codex-tui

[dylan-hurd-oai]

Want to clarify the default approval mode!

[dylan-hurd-oai]

CI failures seem unrelated? I restarted the failed jobs

[joshka-oai]

Updated flow including the proper read-only downgrade:

Screen.Recording.2025-10-23.at.7.56.35.PM.mov

[joshka-oai]

Fixes:

1. codex-core

Failing test: config::tests::add_dir_override_extends_workspace_writable_roots
What happened: The test still expects a WorkspaceWrite policy after adding extra writable directories. Our loader
now coerces every Windows workspace-write request back to ReadOnly, so the assertion sees ReadOnly and panics
(“expected workspace-write policy, got ReadOnly”).
How to fix: Make the test Windows-aware: on Windows, assert that the policy was downgraded to ReadOnly and that
the forced_auto_mode_downgraded_on_windows flag is true (or simply skip the workspace-write branch). That keeps the
behavior documented without reintroducing workspace write.

———

2. codex-exec

Failing test: suite::resume::exec_resume_preserves_cli_configuration_overrides
What happened: The test checks the resumed CLI output for a “sandbox override” string. Because we now force Windows
sessions back to read-only, the resume path no longer echoes a sandbox override, causing the panic: stderr missing
sandbox override.
How to fix: Update the test to allow the absence of the override on Windows (or change the resume code so it emits
a different message when the sandbox is forced back to read-only). Either way, the test needs to acknowledge the
new forced downgrade behavior.

———

3. codex-tui

Failing test: chatwidget::tests::approvals_selection_popup_snapshot
What happened: The snapshot on Windows now includes the extra WSL guidance line (“Requires WSL. Show installation
instructions…”), so the stored snapshot no longer matches.
How to fix: Regenerate/adjust the Windows snapshot (or gate the test so Windows uses a different snapshot) to
reflect the new instructions line.

[dylan-hurd-oai]

Some small copy stuff but code LGTM

[dylan-hurd-oai]

The no-period + newline combo here feels a bit weird. Should we just switch the defaults to sentence-case?