refactoring with_escalated_permissions to use SandboxPermissions instead (#7750)

helpful in the future if we want more granularity for requesting
escalated permissions:
e.g when running in readonly sandbox, model can request to escalate to a
sandbox that allows writes

codex-rs/core/src/unified_exec/mod.rs

@@ -33,6 +33,7 @@ use tokio::sync::Mutex;
 
 use crate::codex::Session;
 use crate::codex::TurnContext;
+use crate::sandboxing::SandboxPermissions;
 
 mod async_watcher;
 mod errors;
@@ -93,7 +94,7 @@ pub(crate) struct ExecCommandRequest {
     pub yield_time_ms: u64,
     pub max_output_tokens: Option<usize>,
     pub workdir: Option<PathBuf>,
-    pub with_escalated_permissions: Option<bool>,
+    pub sandbox_permissions: SandboxPermissions,
     pub justification: Option<String>,
 }
 
@@ -217,7 +218,7 @@ mod tests {
                     yield_time_ms,
                     max_output_tokens: None,
                     workdir: None,
-                    with_escalated_permissions: None,
+                    sandbox_permissions: SandboxPermissions::UseDefault,
                     justification: None,
                 },
                 &context,

codex-rs/core/src/unified_exec/session_manager.rs

@@ -126,7 +126,7 @@ impl UnifiedExecSessionManager {
             .open_session_with_sandbox(
                 &request.command,
                 cwd.clone(),
-                request.with_escalated_permissions,
+                request.sandbox_permissions,
                 request.justification,
                 context,
             )
@@ -476,7 +476,7 @@ impl UnifiedExecSessionManager {
         &self,
         command: &[String],
         cwd: PathBuf,
-        with_escalated_permissions: Option<bool>,
+        sandbox_permissions: SandboxPermissions,
         justification: Option<String>,
         context: &UnifiedExecContext,
     ) -> Result<UnifiedExecSession, UnifiedExecError> {
@@ -490,14 +490,14 @@ impl UnifiedExecSessionManager {
             command,
             context.turn.approval_policy,
             &context.turn.sandbox_policy,
-            SandboxPermissions::from(with_escalated_permissions.unwrap_or(false)),
+            sandbox_permissions,
         )
         .await;
         let req = UnifiedExecToolRequest::new(
             command.to_vec(),
             cwd,
             env,
-            with_escalated_permissions,
+            sandbox_permissions,
             justification,
             exec_approval_requirement,
         );