permissions: derive compatibility policies from profiles

codex-rs/core/src/apply_patch.rs

@@ -35,10 +35,11 @@ pub(crate) async fn apply_patch(
     file_system_sandbox_policy: &FileSystemSandboxPolicy,
     action: ApplyPatchAction,
 ) -> InternalApplyPatchInvocation {
+    let sandbox_policy = turn_context.sandbox_policy();
     match assess_patch_safety(
         &action,
         turn_context.approval_policy.value(),
-        turn_context.sandbox_policy.get(),
+        &sandbox_policy,
         file_system_sandbox_policy,
         &turn_context.cwd,
         turn_context.windows_sandbox_level,