permissions: finish profile-backed app surfaces (#19395)

codex-rs/app-server/src/codex_message_processor.rs

@@ -359,7 +359,6 @@ use codex_rmcp_client::perform_oauth_login_return_url;
 use codex_rollout::state_db::StateDbHandle;
 use codex_rollout::state_db::get_state_db;
 use codex_rollout::state_db::reconcile_rollout;
-use codex_sandboxing::compatibility_sandbox_policy_for_permission_profile;
 use codex_state::StateRuntime;
 use codex_state::ThreadMetadata;
 use codex_state::ThreadMetadataBuilder;
@@ -2655,16 +2654,14 @@ impl CodexMessageProcessor {
         // should still be considered "trusted" in this case.
         let requested_permissions_trust_project =
             requested_permissions_trust_project(&typesafe_overrides, config.cwd.as_path());
+        let effective_permissions_trust_project = permission_profile_trusts_project(
+            &config.permissions.permission_profile(),
+            config.cwd.as_path(),
+        );
 
         if requested_cwd.is_some()
             && config.active_project.trust_level.is_none()
-            && (requested_permissions_trust_project
-                || matches!(
-                    config.permissions.sandbox_policy.get(),
-                    codex_protocol::protocol::SandboxPolicy::WorkspaceWrite { .. }
-                        | codex_protocol::protocol::SandboxPolicy::DangerFullAccess
-                        | codex_protocol::protocol::SandboxPolicy::ExternalSandbox { .. }
-                ))
+            && (requested_permissions_trust_project || effective_permissions_trust_project)
         {
             let trust_target = resolve_root_git_project_for_trust(LOCAL_FS.as_ref(), &config.cwd)
                 .await
@@ -10163,22 +10160,20 @@ fn requested_permissions_trust_project(overrides: &ConfigOverrides, cwd: &Path)
     overrides
         .permission_profile
         .as_ref()
-        .is_some_and(|profile| {
-            let (file_system_sandbox_policy, network_sandbox_policy) =
-                profile.to_runtime_permissions();
-            let sandbox_policy = compatibility_sandbox_policy_for_permission_profile(
-                profile,
-                &file_system_sandbox_policy,
-                network_sandbox_policy,
-                cwd,
-            );
-            matches!(
-                sandbox_policy,
-                codex_protocol::protocol::SandboxPolicy::WorkspaceWrite { .. }
-                    | codex_protocol::protocol::SandboxPolicy::DangerFullAccess
-                    | codex_protocol::protocol::SandboxPolicy::ExternalSandbox { .. }
-            )
-        })
+        .is_some_and(|profile| permission_profile_trusts_project(profile, cwd))
+}
+
+fn permission_profile_trusts_project(
+    profile: &codex_protocol::models::PermissionProfile,
+    cwd: &Path,
+) -> bool {
+    match profile {
+        codex_protocol::models::PermissionProfile::Disabled
+        | codex_protocol::models::PermissionProfile::External { .. } => true,
+        codex_protocol::models::PermissionProfile::Managed { .. } => profile
+            .file_system_sandbox_policy()
+            .can_write_path_with_cwd(cwd, cwd),
+    }
 }
 
 fn parse_datetime(timestamp: Option<&str>) -> Option<DateTime<Utc>> {
@@ -10475,6 +10470,7 @@ mod tests {
     use codex_protocol::permissions::FileSystemAccessMode;
     use codex_protocol::permissions::FileSystemPath;
     use codex_protocol::permissions::FileSystemSandboxEntry;
+    use codex_protocol::permissions::NetworkSandboxPolicy;
     use codex_protocol::protocol::AskForApproval;
     use codex_protocol::protocol::SandboxPolicy;
     use codex_protocol::protocol::SessionSource;
@@ -10700,17 +10696,21 @@ mod tests {
         let full_access_profile = codex_protocol::models::PermissionProfile::Disabled;
         let workspace_write_profile = codex_protocol::models::PermissionProfile::workspace_write();
         let read_only_profile = codex_protocol::models::PermissionProfile::read_only();
-        let direct_write_profile =
+        let split_write_profile =
             codex_protocol::models::PermissionProfile::from_runtime_permissions(
-                &codex_protocol::permissions::FileSystemSandboxPolicy::restricted(vec![
+                &FileSystemSandboxPolicy::restricted(vec![
                     FileSystemSandboxEntry {
-                        path: FileSystemPath::Path {
-                            path: test_path_buf("/tmp/other").abs(),
-                        },
+                        path: FileSystemPath::Path { path: cwd.clone() },
                         access: FileSystemAccessMode::Write,
                     },
+                    FileSystemSandboxEntry {
+                        path: FileSystemPath::GlobPattern {
+                            pattern: "/tmp/project/**/*.env".to_string(),
+                        },
+                        access: FileSystemAccessMode::None,
+                    },
                 ]),
-                codex_protocol::permissions::NetworkSandboxPolicy::Restricted,
+                NetworkSandboxPolicy::Restricted,
             );
 
         assert!(requested_permissions_trust_project(
@@ -10729,7 +10729,7 @@ mod tests {
         ));
         assert!(requested_permissions_trust_project(
             &ConfigOverrides {
-                permission_profile: Some(direct_write_profile),
+                permission_profile: Some(split_write_profile),
                 ..Default::default()
             },
             cwd.as_path()