Prompt to turn on windows sandbox when auto mode selected. (#6618)

- stop prompting users to install WSL 
- prompt users to turn on Windows sandbox when auto mode requested.

<img width="1660" height="195" alt="Screenshot 2025-11-17 110612"
src="https://github.com/user-attachments/assets/c67fc239-a227-417e-94bb-599a8ed8f11e"
/>
<img width="1684" height="168" alt="Screenshot 2025-11-17 110637"
src="https://github.com/user-attachments/assets/d18c3370-830d-4971-8746-04757ae2f709"
/>
<img width="1655" height="293" alt="Screenshot 2025-11-17 110719"
src="https://github.com/user-attachments/assets/d21f6ce9-c23e-4842-baf6-8938b77c16db"
/>

codex-rs/windows-sandbox-rs/src/audit.rs

@@ -1,6 +1,7 @@
 use crate::token::world_sid;
 use crate::winutil::to_wide;
 use anyhow::Result;
+use std::collections::HashMap;
 use std::collections::HashSet;
 use std::ffi::c_void;
 use std::path::Path;
@@ -275,6 +276,35 @@ pub fn audit_everyone_writable(
     );
     Ok(Vec::new())
 }
+
+fn normalize_windows_path_for_display(p: impl AsRef<Path>) -> String {
+    let canon = dunce::canonicalize(p.as_ref()).unwrap_or_else(|_| p.as_ref().to_path_buf());
+    canon.display().to_string().replace('/', "\\")
+}
+
+pub fn world_writable_warning_details(
+    codex_home: impl AsRef<Path>,
+) -> Option<(Vec<String>, usize, bool)> {
+    let cwd = match std::env::current_dir() {
+        Ok(cwd) => cwd,
+        Err(_) => return Some((Vec::new(), 0, true)),
+    };
+
+    let env_map: HashMap<String, String> = std::env::vars().collect();
+    match audit_everyone_writable(&cwd, &env_map, Some(codex_home.as_ref())) {
+        Ok(paths) if paths.is_empty() => None,
+        Ok(paths) => {
+            let as_strings: Vec<String> = paths
+                .iter()
+                .map(normalize_windows_path_for_display)
+                .collect();
+            let sample_paths: Vec<String> = as_strings.iter().take(3).cloned().collect();
+            let extra_count = as_strings.len().saturating_sub(sample_paths.len());
+            Some((sample_paths, extra_count, false))
+        }
+        Err(_) => Some((Vec::new(), 0, true)),
+    }
+}
 // Fast mask-based check: does the DACL contain any ACCESS_ALLOWED ACE for
 // Everyone that includes generic or specific write bits? Skips inherit-only
 // ACEs (do not apply to the current object).

codex-rs/windows-sandbox-rs/src/lib.rs

@@ -6,6 +6,8 @@ macro_rules! windows_modules {
 
 windows_modules!(acl, allow, audit, cap, env, logging, policy, token, winutil);
 
+#[cfg(target_os = "windows")]
+pub use audit::world_writable_warning_details;
 #[cfg(target_os = "windows")]
 pub use windows_impl::preflight_audit_everyone_writable;
 #[cfg(target_os = "windows")]
@@ -18,6 +20,8 @@ pub use stub::preflight_audit_everyone_writable;
 #[cfg(not(target_os = "windows"))]
 pub use stub::run_windows_sandbox_capture;
 #[cfg(not(target_os = "windows"))]
+pub use stub::world_writable_warning_details;
+#[cfg(not(target_os = "windows"))]
 pub use stub::CaptureResult;
 
 #[cfg(target_os = "windows")]
@@ -455,4 +459,10 @@ mod stub {
     ) -> Result<CaptureResult> {
         bail!("Windows sandbox is only available on Windows")
     }
+
+    pub fn world_writable_warning_details(
+        _codex_home: impl AsRef<Path>,
+    ) -> Option<(Vec<String>, usize, bool)> {
+        None
+    }
 }