From b08d404f4e412a40770d2a4bbe54e891c1727a36 Mon Sep 17 00:00:00 2001
From: Michael Bolin <mbolin@openai.com>
Date: Thu, 30 Apr 2026 08:54:43 -0700
Subject: [PATCH] session: stop exposing legacy sandbox policy

---
 codex-rs/core/src/session/session.rs | 23 +++++++----------------
 codex-rs/core/src/session/tests.rs   | 15 +++++++++++++--
 2 files changed, 20 insertions(+), 18 deletions(-)

diff --git a/codex-rs/core/src/session/session.rs b/codex-rs/core/src/session/session.rs
index 959fa46180..0a7bd92b00 100644
--- a/codex-rs/core/src/session/session.rs
+++ b/codex-rs/core/src/session/session.rs
@@ -2,7 +2,6 @@ use super::*;
 use crate::goals::GoalRuntimeState;
 use codex_protocol::permissions::FileSystemPath;
 use codex_protocol::permissions::FileSystemSpecialPath;
-use codex_protocol::protocol::SandboxPolicy;
 use tokio::sync::Semaphore;
 
 /// Context for an initialized model agent
@@ -105,20 +104,6 @@ impl SessionConfiguration {
         self.active_permission_profile.clone()
     }
 
-    pub(super) fn sandbox_policy(&self) -> SandboxPolicy {
-        self.permission_profile()
-            .to_legacy_sandbox_policy(&self.cwd)
-            .unwrap_or_else(|_| {
-                let file_system_sandbox_policy = self.file_system_sandbox_policy();
-                codex_sandboxing::compatibility_sandbox_policy_for_permission_profile(
-                    self.permission_profile.get(),
-                    &file_system_sandbox_policy,
-                    self.network_sandbox_policy(),
-                    &self.cwd,
-                )
-            })
-    }
-
     pub(super) fn file_system_sandbox_policy(&self) -> FileSystemSandboxPolicy {
         self.permission_profile.get().file_system_sandbox_policy()
     }
@@ -146,9 +131,15 @@ impl SessionConfiguration {
 
     pub(crate) fn apply(&self, updates: &SessionSettingsUpdate) -> ConstraintResult<Self> {
         let mut next_configuration = self.clone();
-        let current_sandbox_policy = self.sandbox_policy();
         let current_file_system_sandbox_policy = self.file_system_sandbox_policy();
         let current_network_sandbox_policy = self.network_sandbox_policy();
+        let current_sandbox_policy =
+            codex_sandboxing::compatibility_sandbox_policy_for_permission_profile(
+                self.permission_profile.get(),
+                &current_file_system_sandbox_policy,
+                current_network_sandbox_policy,
+                &self.cwd,
+            );
         let legacy_file_system_projection =
             FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_deny_entries(
                 &current_sandbox_policy,
diff --git a/codex-rs/core/src/session/tests.rs b/codex-rs/core/src/session/tests.rs
index 3448524c65..141fbe8eb0 100644
--- a/codex-rs/core/src/session/tests.rs
+++ b/codex-rs/core/src/session/tests.rs
@@ -3043,8 +3043,14 @@ async fn session_configuration_apply_permission_profile_accepts_direct_write_roo
         updated.file_system_sandbox_policy(),
         file_system_sandbox_policy
     );
+    let updated_file_system_policy = updated.file_system_sandbox_policy();
     assert_eq!(
-        updated.sandbox_policy(),
+        codex_sandboxing::compatibility_sandbox_policy_for_permission_profile(
+            &updated.permission_profile(),
+            &updated_file_system_policy,
+            updated.network_sandbox_policy(),
+            updated.cwd.as_path(),
+        ),
         codex_sandboxing::compatibility_sandbox_policy_for_permission_profile(
             &permission_profile,
             &file_system_sandbox_policy,
@@ -3176,7 +3182,12 @@ async fn session_configuration_apply_rederives_legacy_file_system_policy_on_cwd_
         .expect("cwd-only update should succeed");
 
     let expected_file_system_policy = FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
-        &updated.sandbox_policy(),
+        &codex_sandboxing::compatibility_sandbox_policy_for_permission_profile(
+            &updated.permission_profile(),
+            &updated.file_system_sandbox_policy(),
+            updated.network_sandbox_policy(),
+            updated.cwd.as_path(),
+        ),
         &project_root,
     );
     assert!(