permissions: derive compatibility policies from profiles

This commit is contained in:
Michael Bolin
2026-04-25 19:44:07 -07:00
parent d9ecfe9083
commit aa9068df50
40 changed files with 570 additions and 439 deletions
@@ -2278,9 +2278,11 @@ impl CodexMessageProcessor {
codex_protocol::models::PermissionProfile::from(permission_profile);
let (mut file_system_sandbox_policy, network_sandbox_policy) =
permission_profile.to_runtime_permissions();
let configured_file_system_sandbox_policy =
self.config.permissions.file_system_sandbox_policy();
Self::preserve_configured_deny_read_restrictions(
&mut file_system_sandbox_policy,
&self.config.permissions.file_system_sandbox_policy,
&configured_file_system_sandbox_policy,
);
let effective_permission_profile =
codex_protocol::models::PermissionProfile::from_runtime_permissions_with_enforcement(