core: remove SandboxPolicy from production core

codex-rs/protocol/src/models.rs

@@ -544,6 +544,42 @@ impl PermissionProfile {
         }
     }
 
+    pub fn compatibility_sandbox_policy(
+        &self,
+        file_system_policy: &FileSystemSandboxPolicy,
+        network_policy: NetworkSandboxPolicy,
+        cwd: &Path,
+    ) -> SandboxPolicy {
+        self.to_legacy_sandbox_policy(cwd).unwrap_or_else(|_| {
+            let cwd_abs = AbsolutePathBuf::from_absolute_path(cwd).ok();
+            let writable_roots = file_system_policy
+                .get_writable_roots_with_cwd(cwd)
+                .into_iter()
+                .map(|root| root.root)
+                .filter(|root| cwd_abs.as_ref() != Some(root))
+                .collect();
+            let tmpdir_writable = std::env::var_os("TMPDIR")
+                .filter(|tmpdir| !tmpdir.is_empty())
+                .and_then(|tmpdir| {
+                    AbsolutePathBuf::from_absolute_path(std::path::PathBuf::from(tmpdir)).ok()
+                })
+                .is_some_and(|tmpdir| {
+                    file_system_policy.can_write_path_with_cwd(tmpdir.as_path(), cwd)
+                });
+            let slash_tmp = Path::new("/tmp");
+            let slash_tmp_writable = slash_tmp.is_absolute()
+                && slash_tmp.is_dir()
+                && file_system_policy.can_write_path_with_cwd(slash_tmp, cwd);
+
+            SandboxPolicy::WorkspaceWrite {
+                writable_roots,
+                network_access: network_policy.is_enabled(),
+                exclude_tmpdir_env_var: !tmpdir_writable,
+                exclude_slash_tmp: !slash_tmp_writable,
+            }
+        })
+    }
+
     pub fn to_runtime_permissions(&self) -> (FileSystemSandboxPolicy, NetworkSandboxPolicy) {
         (
             self.file_system_sandbox_policy(),

codex-rs/protocol/src/protocol.rs

@@ -475,6 +475,37 @@ pub struct ThreadSettingsOverrides {
     pub personality: Option<Personality>,
 }
 
+impl ThreadSettingsOverrides {
+    pub fn permission_profile_update_for_cwd(
+        &self,
+        cwd: &Path,
+        current_file_system_sandbox_policy: Option<&FileSystemSandboxPolicy>,
+    ) -> Option<PermissionProfile> {
+        if let Some(permission_profile) = self.permission_profile.clone() {
+            return Some(permission_profile);
+        }
+
+        self.sandbox_policy.as_ref().map(|sandbox_policy| {
+            let file_system_sandbox_policy = if let Some(current_file_system_sandbox_policy) =
+                current_file_system_sandbox_policy
+            {
+                FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_deny_entries(
+                    sandbox_policy,
+                    cwd,
+                    current_file_system_sandbox_policy,
+                )
+            } else {
+                FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(sandbox_policy, cwd)
+            };
+            PermissionProfile::from_runtime_permissions_with_enforcement(
+                SandboxEnforcement::from_legacy_sandbox_policy(sandbox_policy),
+                &file_system_sandbox_policy,
+                NetworkSandboxPolicy::from(sandbox_policy),
+            )
+        })
+    }
+}
+
 /// Source classification for client-supplied context.
 #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq, JsonSchema)]
 #[serde(rename_all = "snake_case")]