permissions: support workspace roots in profiles

codex-rs/core/tests/suite/unified_exec.rs

@@ -906,9 +906,11 @@ allow_local_binding = true
                 .enable(Feature::UnifiedExec)
                 .expect("test config should allow feature update");
             config.permissions.approval_policy = Constrained::allow_any(AskForApproval::Never);
-            config.permissions.permission_profile = Constrained::allow_any(
-                PermissionProfile::from_legacy_sandbox_policy(&sandbox_policy_for_config),
-            );
+            config
+                .permissions
+                .replace_permission_profile_constraint(Constrained::allow_any(
+                    PermissionProfile::from_legacy_sandbox_policy(&sandbox_policy_for_config),
+                ));
         });
     let test = builder.build_remote_aware(server).await?;
     assert!(
@@ -2752,10 +2754,13 @@ async fn unified_exec_enforces_glob_deny_read_policy() -> Result<()> {
                 },
                 access: FileSystemAccessMode::None,
             });
-        config.permissions.permission_profile =
-            Constrained::allow_any(PermissionProfile::from_runtime_permissions(
-                &file_system_sandbox_policy,
-                NetworkSandboxPolicy::Restricted,
+        config
+            .permissions
+            .replace_permission_profile_constraint(Constrained::allow_any(
+                PermissionProfile::from_runtime_permissions(
+                    &file_system_sandbox_policy,
+                    NetworkSandboxPolicy::Restricted,
+                ),
             ));
     });
     let TestCodex {

codex-rs/core/tests/suite/user_shell_cmd.rs

@@ -344,11 +344,12 @@ async fn user_shell_command_does_not_set_network_sandbox_env_var() -> anyhow::Re
     let server = responses::start_mock_server().await;
     let mut builder = core_test_support::test_codex::test_codex().with_config(|config| {
         let file_system_sandbox_policy = config.permissions.file_system_sandbox_policy();
-        config.permissions.permission_profile =
+        config.permissions.replace_permission_profile_constraint(
             codex_config::Constrained::allow_any(PermissionProfile::from_runtime_permissions(
                 &file_system_sandbox_policy,
                 NetworkSandboxPolicy::Restricted,
-            ));
+            )),
+        );
     });
     let test = builder.build(&server).await?;