permissions: store only constrained permission profiles (#19735)

codex-rs/tui/src/app/tests.rs

@@ -1634,11 +1634,7 @@ async fn update_feature_flags_enabling_guardian_selects_auto_review() -> Result<
         auto_review.approval_policy
     );
     assert_eq!(
-        app.chat_widget
-            .config_ref()
-            .permissions
-            .sandbox_policy
-            .get(),
+        &app.chat_widget.config_ref().legacy_sandbox_policy(),
         &auto_review.sandbox_policy
     );
     assert_eq!(
@@ -1714,9 +1710,7 @@ async fn update_feature_flags_disabling_guardian_clears_review_policy_and_restor
         .approval_policy
         .set(AskForApproval::OnRequest)?;
     app.config
-        .permissions
-        .sandbox_policy
-        .set(SandboxPolicy::new_workspace_write_policy())?;
+        .set_legacy_sandbox_policy(SandboxPolicy::new_workspace_write_policy())?;
     app.chat_widget
         .set_approval_policy(AskForApproval::OnRequest);
     app.chat_widget
@@ -1815,11 +1809,7 @@ async fn update_feature_flags_enabling_guardian_overrides_explicit_manual_review
         auto_review.approval_policy
     );
     assert_eq!(
-        app.chat_widget
-            .config_ref()
-            .permissions
-            .sandbox_policy
-            .get(),
+        &app.chat_widget.config_ref().legacy_sandbox_policy(),
         &auto_review.sandbox_policy
     );
     assert_eq!(
@@ -2933,7 +2923,7 @@ async fn side_fork_config_is_ephemeral_and_appends_developer_guardrails() {
     let mut app = make_test_app().await;
     app.config.developer_instructions = Some("Existing developer policy.".to_string());
     let original_approval_policy = app.config.permissions.approval_policy.value();
-    let original_sandbox_policy = app.config.permissions.sandbox_policy.get().clone();
+    let original_sandbox_policy = app.config.legacy_sandbox_policy();
 
     let fork_config = app.side_fork_config();
 
@@ -2942,10 +2932,7 @@ async fn side_fork_config_is_ephemeral_and_appends_developer_guardrails() {
         fork_config.permissions.approval_policy.value(),
         original_approval_policy
     );
-    assert_eq!(
-        fork_config.permissions.sandbox_policy.get(),
-        &original_sandbox_policy
-    );
+    assert_eq!(fork_config.legacy_sandbox_policy(), original_sandbox_policy);
     let developer_instructions = fork_config
         .developer_instructions
         .as_deref()

codex-rs/tui/src/app/thread_session_state.rs

@@ -192,9 +192,8 @@ mod tests {
             .set_sandbox_policy(expected_sandbox_policy.clone())
             .expect("set widget sandbox policy");
         app.config
-            .permissions
-            .set_legacy_sandbox_policy(expected_sandbox_policy.clone(), app.config.cwd.as_path())
-            .expect("set app sandbox policy");
+            .set_legacy_sandbox_policy(expected_sandbox_policy.clone())
+            .expect("set sandbox policy");
 
         app.sync_active_thread_permission_settings_to_cached_session()
             .await;