core: remove SandboxPolicy from production core

codex-rs/app-server/src/request_processors/command_exec_processor.rs

@@ -234,10 +234,6 @@ impl CommandExecRequestProcessor {
                 config.effective_workspace_roots(),
             )
         } else if let Some(policy) = sandbox_policy.map(|policy| policy.to_core()) {
-            self.config
-                .permissions
-                .can_set_legacy_sandbox_policy(&policy, &sandbox_cwd)
-                .map_err(|err| invalid_request(format!("invalid sandbox policy: {err}")))?;
             let file_system_sandbox_policy =
                 codex_protocol::permissions::FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(&policy, &sandbox_cwd);
             let network_sandbox_policy =

codex-rs/app-server/src/request_processors/thread_processor.rs

@@ -96,21 +96,24 @@ fn collect_resume_override_mismatches(
         }
     }
     if let Some(requested_sandbox) = request.sandbox.as_ref() {
-        let active_sandbox = config_snapshot.sandbox_policy();
+        let active_sandbox = thread_response_sandbox_policy(
+            &config_snapshot.permission_profile,
+            config_snapshot.cwd.as_path(),
+        );
         let sandbox_matches = matches!(
             (requested_sandbox, &active_sandbox),
             (
                 SandboxMode::ReadOnly,
-                codex_protocol::protocol::SandboxPolicy::ReadOnly { .. }
+                codex_app_server_protocol::SandboxPolicy::ReadOnly { .. }
             ) | (
                 SandboxMode::WorkspaceWrite,
-                codex_protocol::protocol::SandboxPolicy::WorkspaceWrite { .. }
+                codex_app_server_protocol::SandboxPolicy::WorkspaceWrite { .. }
             ) | (
                 SandboxMode::DangerFullAccess,
-                codex_protocol::protocol::SandboxPolicy::DangerFullAccess
+                codex_app_server_protocol::SandboxPolicy::DangerFullAccess
             ) | (
                 SandboxMode::DangerFullAccess,
-                codex_protocol::protocol::SandboxPolicy::ExternalSandbox { .. }
+                codex_app_server_protocol::SandboxPolicy::ExternalSandbox { .. }
             )
         );
         if !sandbox_matches {

codex-rs/app-server/src/request_processors/turn_processor.rs

@@ -32,6 +32,26 @@ fn resolve_runtime_workspace_roots(
     resolved_roots
 }
 
+fn permission_profile_from_legacy_sandbox_policy(
+    sandbox_policy: &codex_protocol::protocol::SandboxPolicy,
+    cwd: &AbsolutePathBuf,
+    current_permission_profile: &codex_protocol::models::PermissionProfile,
+) -> codex_protocol::models::PermissionProfile {
+    let current_file_system_sandbox_policy =
+        current_permission_profile.file_system_sandbox_policy();
+    let file_system_sandbox_policy =
+        codex_protocol::permissions::FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_deny_entries(
+            sandbox_policy,
+            cwd.as_path(),
+            &current_file_system_sandbox_policy,
+        );
+    codex_protocol::models::PermissionProfile::from_runtime_permissions_with_enforcement(
+        codex_protocol::models::SandboxEnforcement::from_legacy_sandbox_policy(sandbox_policy),
+        &file_system_sandbox_policy,
+        codex_protocol::permissions::NetworkSandboxPolicy::from(sandbox_policy),
+    )
+}
+
 fn map_additional_context(
     additional_context: Option<HashMap<String, AdditionalContextEntry>>,
 ) -> BTreeMap<String, CoreAdditionalContextEntry> {
@@ -524,7 +544,10 @@ impl TurnRequestProcessor {
         // `thread/settings/update` only acknowledges that the update was queued.
         // Clients that send dependent partial updates should wait for
         // `thread/settings/updated` or combine the fields in one request.
-        let snapshot = if permissions.is_some() || runtime_workspace_roots_request.is_some() {
+        let snapshot = if permissions.is_some()
+            || runtime_workspace_roots_request.is_some()
+            || sandbox_policy.is_some()
+        {
             Some(thread.config_snapshot().await)
         } else {
             None
@@ -564,6 +587,26 @@ impl TurnRequestProcessor {
         let approvals_reviewer =
             approvals_reviewer.map(codex_app_server_protocol::ApprovalsReviewer::to_core);
         let sandbox_policy = sandbox_policy.map(|policy| policy.to_core());
+        let sandbox_policy_permission_profile = if let Some(sandbox_policy) =
+            sandbox_policy.as_ref()
+        {
+            let Some(snapshot) = snapshot.as_ref() else {
+                return Err(internal_error(format!(
+                    "{method} sandbox policy selection missing thread snapshot"
+                )));
+            };
+            let sandbox_policy_cwd = cwd
+                .as_ref()
+                .map(|cwd| AbsolutePathBuf::resolve_path_against_base(cwd, snapshot.cwd.as_path()))
+                .unwrap_or_else(|| snapshot.cwd.clone());
+            Some(permission_profile_from_legacy_sandbox_policy(
+                sandbox_policy,
+                &sandbox_policy_cwd,
+                &snapshot.permission_profile,
+            ))
+        } else {
+            None
+        };
         let (permission_profile, active_permission_profile, profile_workspace_roots) =
             if let Some(permissions) = permissions {
                 let Some(snapshot) = snapshot.as_ref() else {
@@ -623,8 +666,9 @@ impl TurnRequestProcessor {
                     workspace_roots: runtime_workspace_roots.clone(),
                     approval_policy,
                     approvals_reviewer,
-                    sandbox_policy: sandbox_policy.clone(),
-                    permission_profile: permission_profile.clone(),
+                    permission_profile: permission_profile
+                        .clone()
+                        .or_else(|| sandbox_policy_permission_profile.clone()),
                     active_permission_profile: active_permission_profile.clone(),
                     profile_workspace_roots: profile_workspace_roots.clone(),
                     windows_sandbox_level: None,