permissions: migrate approval and sandbox consumers to profiles (#19393)

## Why

Runtime decisions should not infer permissions from the lossy legacy
sandbox projection once `PermissionProfile` is available. In particular,
`Disabled` and `External` need to remain distinct, and managed profiles
with split filesystem or deny-read rules should not be collapsed before
approval, network, safety, or analytics code makes decisions.

## What Changed

- Changes managed network proxy setup and network approval logic to use
`PermissionProfile` when deciding whether a managed sandbox is active.
- Migrates patch safety, Guardian/user-shell approval paths, Landlock
helper setup, analytics sandbox classification, and selected
turn/session code to profile-backed permissions.
- Validates command-level profile overrides against the constrained
`PermissionProfile` rather than a strict `SandboxPolicy` round trip.
- Preserves configured deny-read restrictions when command profiles are
narrowed.
- Adds coverage for profile-backed trust, network proxy/approval
behavior, patch safety, analytics classification, and command-profile
narrowing.

## Verification

- `cargo test -p codex-core direct_write_roots`
- `cargo test -p codex-core runtime_roots_to_legacy_projection`
- `cargo test -p codex-app-server
requested_permissions_trust_project_uses_permission_profile_intent`




































































---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/19393).
* #19395
* #19394
* __->__ #19393

codex-rs/analytics/src/analytics_client_tests.rs

@@ -315,7 +315,10 @@ fn sample_turn_resolved_config(turn_id: &str) -> TurnResolvedConfigFact {
         session_source: SessionSource::Exec,
         model: "gpt-5".to_string(),
         model_provider: "openai".to_string(),
-        sandbox_policy: SandboxPolicy::new_read_only_policy(),
+        permission_profile: CorePermissionProfile::from_legacy_sandbox_policy(
+            &SandboxPolicy::new_read_only_policy(),
+        ),
+        permission_profile_cwd: PathBuf::from("/tmp"),
         reasoning_effort: None,
         reasoning_summary: None,
         service_tier: None,

codex-rs/analytics/src/facts.rs

@@ -13,12 +13,12 @@ use codex_protocol::config_types::ModeKind;
 use codex_protocol::config_types::Personality;
 use codex_protocol::config_types::ReasoningSummary;
 use codex_protocol::config_types::ServiceTier;
+use codex_protocol::models::PermissionProfile;
 use codex_protocol::openai_models::ReasoningEffort;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::HookEventName;
 use codex_protocol::protocol::HookRunStatus;
 use codex_protocol::protocol::HookSource;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_protocol::protocol::SessionSource;
 use codex_protocol::protocol::SkillScope;
 use codex_protocol::protocol::SubAgentSource;
@@ -62,7 +62,8 @@ pub struct TurnResolvedConfigFact {
     pub session_source: SessionSource,
     pub model: String,
     pub model_provider: String,
-    pub sandbox_policy: SandboxPolicy,
+    pub permission_profile: PermissionProfile,
+    pub permission_profile_cwd: PathBuf,
     pub reasoning_effort: Option<ReasoningEffort>,
     pub reasoning_summary: Option<ReasoningSummary>,
     pub service_tier: Option<ServiceTier>,

codex-rs/analytics/src/reducer.rs

@@ -61,6 +61,7 @@ use codex_login::default_client::originator;
 use codex_protocol::config_types::ModeKind;
 use codex_protocol::config_types::Personality;
 use codex_protocol::config_types::ReasoningSummary;
+use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::SandboxPolicy;
 use codex_protocol::protocol::SessionSource;
 use codex_protocol::protocol::SkillScope;
@@ -884,7 +885,8 @@ fn codex_turn_event_params(
         session_source: _session_source,
         model,
         model_provider,
-        sandbox_policy,
+        permission_profile,
+        permission_profile_cwd,
         reasoning_effort,
         reasoning_summary,
         service_tier,
@@ -909,7 +911,10 @@ fn codex_turn_event_params(
         parent_thread_id: thread_metadata.parent_thread_id.clone(),
         model: Some(model),
         model_provider,
-        sandbox_policy: Some(sandbox_policy_mode(&sandbox_policy)),
+        sandbox_policy: Some(sandbox_policy_mode(
+            &permission_profile,
+            permission_profile_cwd.as_path(),
+        )),
         reasoning_effort: reasoning_effort.map(|value| value.to_string()),
         reasoning_summary: reasoning_summary_mode(reasoning_summary),
         service_tier: service_tier
@@ -954,12 +959,19 @@ fn codex_turn_event_params(
     }
 }
 
-fn sandbox_policy_mode(sandbox_policy: &SandboxPolicy) -> &'static str {
-    match sandbox_policy {
-        SandboxPolicy::DangerFullAccess => "full_access",
-        SandboxPolicy::ReadOnly { .. } => "read_only",
-        SandboxPolicy::WorkspaceWrite { .. } => "workspace_write",
-        SandboxPolicy::ExternalSandbox { .. } => "external_sandbox",
+fn sandbox_policy_mode(permission_profile: &PermissionProfile, cwd: &Path) -> &'static str {
+    match permission_profile {
+        PermissionProfile::Disabled => "full_access",
+        PermissionProfile::External { .. } => "external_sandbox",
+        PermissionProfile::Managed { .. } => {
+            match permission_profile.to_legacy_sandbox_policy(cwd) {
+                Ok(SandboxPolicy::DangerFullAccess) => "full_access",
+                Ok(SandboxPolicy::ReadOnly { .. }) => "read_only",
+                Ok(SandboxPolicy::WorkspaceWrite { .. }) => "workspace_write",
+                Ok(SandboxPolicy::ExternalSandbox { .. }) => "external_sandbox",
+                Err(_) => "workspace_write",
+            }
+        }
     }
 }