tui: use permission profiles for sandbox state

codex-rs/utils/approval-presets/src/lib.rs

@@ -1,7 +1,7 @@
+use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::AskForApproval;
-use codex_protocol::protocol::SandboxPolicy;
 
-/// A simple preset pairing an approval policy with a sandbox policy.
+/// A simple preset pairing an approval policy with a permission profile.
 #[derive(Debug, Clone)]
 pub struct ApprovalPreset {
     /// Stable identifier for the preset.
@@ -12,11 +12,11 @@ pub struct ApprovalPreset {
     pub description: &'static str,
     /// Approval policy to apply.
     pub approval: AskForApproval,
-    /// Sandbox policy to apply.
-    pub sandbox: SandboxPolicy,
+    /// Permission profile to apply.
+    pub permission_profile: PermissionProfile,
 }
 
-/// Built-in list of approval presets that pair approval and sandbox policy.
+/// Built-in list of approval presets that pair approval and permissions.
 ///
 /// Keep this UI-agnostic so it can be reused by both TUI and MCP server.
 pub fn builtin_approval_presets() -> Vec<ApprovalPreset> {
@@ -26,21 +26,21 @@ pub fn builtin_approval_presets() -> Vec<ApprovalPreset> {
             label: "Read Only",
             description: "Codex can read files in the current workspace. Approval is required to edit files or access the internet.",
             approval: AskForApproval::OnRequest,
-            sandbox: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
         },
         ApprovalPreset {
             id: "auto",
             label: "Default",
             description: "Codex can read and edit files in the current workspace, and run commands. Approval is required to access the internet or edit other files. (Identical to Agent mode)",
             approval: AskForApproval::OnRequest,
-            sandbox: SandboxPolicy::new_workspace_write_policy(),
+            permission_profile: PermissionProfile::workspace_write(),
         },
         ApprovalPreset {
             id: "full-access",
             label: "Full Access",
             description: "Codex can edit files outside this workspace and access the internet without asking for approval. Exercise caution when using.",
             approval: AskForApproval::Never,
-            sandbox: SandboxPolicy::DangerFullAccess,
+            permission_profile: PermissionProfile::Disabled,
         },
     ]
 }

codex-rs/utils/sandbox-summary/src/lib.rs

@@ -2,4 +2,5 @@ mod config_summary;
 mod sandbox_summary;
 
 pub use config_summary::create_config_summary_entries;
+pub use sandbox_summary::summarize_permission_profile;
 pub use sandbox_summary::summarize_sandbox_policy;

codex-rs/utils/sandbox-summary/src/sandbox_summary.rs

@@ -1,5 +1,7 @@
+use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::NetworkAccess;
 use codex_protocol::protocol::SandboxPolicy;
+use std::path::Path;
 
 pub fn summarize_sandbox_policy(sandbox_policy: &SandboxPolicy) -> String {
     match sandbox_policy {
@@ -49,6 +51,19 @@ pub fn summarize_sandbox_policy(sandbox_policy: &SandboxPolicy) -> String {
     }
 }
 
+pub fn summarize_permission_profile(permission_profile: &PermissionProfile, cwd: &Path) -> String {
+    match permission_profile.to_legacy_sandbox_policy(cwd) {
+        Ok(policy) => summarize_sandbox_policy(&policy),
+        Err(_) => {
+            if permission_profile.network_sandbox_policy().is_enabled() {
+                "custom permissions (network access enabled)".to_string()
+            } else {
+                "custom permissions".to_string()
+            }
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;