codex-rs/linux-sandbox/src/linux_run_main.rs (181 lines):
	- line 23: use crate::bwrap::BwrapNetworkMode;
	- line 24: use crate::bwrap::BwrapOptions;
	- line 25: use crate::bwrap::create_bwrap_command_args;
	- line 26: use crate::landlock::apply_permission_profile_to_current_thread;
	- line 27: use crate::launcher::exec_bwrap;
	- line 28: use crate::launcher::preferred_bwrap_supports_argv0;
	- line 32: use codex_protocol::models::PermissionProfile;
	- line 36: use codex_protocol::protocol::FileSystemSandboxPolicy;
	- line 38: use codex_protocol::protocol::NetworkSandboxPolicy;
	- line 39: use codex_sandboxing::landlock::CODEX_LINUX_SANDBOX_ARG0;
	- line 53: target: crate::bwrap::SyntheticMountTarget,
	- line 60: target: crate::bwrap::ProtectedCreateTarget,
	- line 85: /// The type name remains `LandlockCommand` for compatibility with existing
	- line 86: /// wiring, but bubblewrap is now the default filesystem sandbox and Landlock
	- line 88: pub struct LandlockCommand {
	- line 98: /// explicit so bubblewrap can preserve the caller's logical cwd when that
	- line 109: pub permission_profile: Option<PermissionProfile>,
	- line 111: /// Opt-in: use the legacy Landlock Linux sandbox fallback.
	- line 113: /// When not set, the helper uses the default bubblewrap pipeline.
	- line 114: #[arg(long = "use-legacy-landlock", hide = true, default_value_t = false)]
	- line 115: pub use_legacy_landlock: bool,
	- line 117: /// Internal: apply seccomp and `no_new_privs` in the already-sandboxed
	- line 120: /// This exists so we can run bubblewrap first (which may rely on setuid)
	- line 121: /// and only tighten with seccomp after the filesystem view is established.
	- line 122: #[arg(long = "apply-seccomp-then-exec", hide = true, default_value_t = false)]
	- line 123: pub apply_seccomp_then_exec: bool,
	- line 133: /// Internal route spec used for managed proxy routing in bwrap mode.
	- line 155: /// 1. When needed, wrap the command with bubblewrap to construct the
	- line 157: /// 2. Apply in-process restrictions (no_new_privs + seccomp).
	- line 160: let LandlockCommand {
	- line 164: use_legacy_landlock,
	- line 165: apply_seccomp_then_exec,
	- line 171: } = LandlockCommand::parse();
	- line 176: if !apply_seccomp_then_exec && !verify_fd_mounts.is_empty() {
	- line 179: ensure_inner_stage_mode_is_valid(apply_seccomp_then_exec, use_legacy_landlock);
	- line 185: ensure_legacy_landlock_mode_supports_policy(
	- line 186: use_legacy_landlock,
	- line 192: // Inner stage: apply seccomp/no_new_privs after bubblewrap has already
	- line 194: if apply_seccomp_then_exec {
	- line 196: panic!("failed to verify descriptor-backed bubblewrap mount: {err}");
	- line 235: /*apply_landlock_fs*/ false,
	- line 255: let signal_forwarders = install_bwrap_signal_forwarders(command_pid);
	- line 281: /*apply_landlock_fs*/ false,
	- line 290: if !use_legacy_landlock {
	- line 291: // Outer stage: bubblewrap first, then re-enter this binary in the
	- line 292: // sandboxed environment to apply seccomp. This path never falls back
	- line 293: // to legacy Landlock on failure.
	- line 301: let inner = build_inner_seccomp_command(InnerSeccompCommandArgs {
	- line 309: run_bwrap_with_proc_fallback(
	- line 313: bwrap_network_mode(network_sandbox_policy, allow_network_for_proxy),
	- line 320: // Legacy path: Landlock enforcement only, when bwrap sandboxing is not enabled.
	- line 324: /*apply_landlock_fs*/ true,
	- line 335: permission_profile: PermissionProfile,
	- line 336: file_system_sandbox_policy: FileSystemSandboxPolicy,
	- line 337: network_sandbox_policy: NetworkSandboxPolicy,
	- line 341: enum ResolvePermissionProfileError {
	- line 345: impl fmt::Display for ResolvePermissionProfileError {
	- line 353: fn parse_permission_profile(value: &str) -> std::result::Result<PermissionProfile, String> {
	- line 358: permission_profile: Option<PermissionProfile>,
	- line 359: ) -> Result<EffectivePermissions, ResolvePermissionProfileError> {
	- line 361: permission_profile.ok_or(ResolvePermissionProfileError::MissingConfiguration)?;
	- line 371: fn ensure_inner_stage_mode_is_valid(apply_seccomp_then_exec: bool, use_legacy_landlock: bool) {
	- line 372: if apply_seccomp_then_exec && use_legacy_landlock {
	- line 373: panic!("--apply-seccomp-then-exec is incompatible with --use-legacy-landlock");
	- line 377: fn ensure_legacy_landlock_mode_supports_policy(
	- line 378: use_legacy_landlock: bool,
	- line 379: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 380: network_sandbox_policy: NetworkSandboxPolicy,
	- line 383: if use_legacy_landlock
	- line 388: "permission profiles requiring direct runtime enforcement are incompatible with --use-legacy-landlock"
	- line 393: fn run_bwrap_with_proc_fallback(
	- line 396: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 407: .unwrap_or_else(|err| exit_with_bwrap_build_error(err))
	- line 419: let mut bwrap_args = build_bwrap_argv(
	- line 426: .unwrap_or_else(|err| exit_with_bwrap_build_error(err));
	- line 427: bwrap_args.preserved_files.extend(proxy_controls);
	- line 428: apply_inner_command_argv0(&mut bwrap_args.args);
	- line 429: run_or_exec_bwrap(bwrap_args);
	- line 432: fn bwrap_network_mode(
	- line 433: network_sandbox_policy: NetworkSandboxPolicy,
	- line 445: fn build_bwrap_argv(
	- line 447: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 451: ) -> CodexResult<crate::bwrap::BwrapArgs> {
	- line 452: let bwrap_args = create_bwrap_command_args(
	- line 460: let mut argv = vec!["bwrap".to_string()];
	- line 461: argv.extend(bwrap_args.args);
	- line 462: Ok(crate::bwrap::BwrapArgs {
	- line 464: preserved_files: bwrap_args.preserved_files,
	- line 465: synthetic_mount_targets: bwrap_args.synthetic_mount_targets,
	- line 466: protected_create_targets: bwrap_args.protected_create_targets,
	- line 470: fn exit_with_bwrap_build_error(err: codex_protocol::error::CodexErr) -> ! {
	- line 471: eprintln!("error building bubblewrap command: {err}");
	- line 478: preferred_bwrap_supports_argv0(),
	- line 491: .unwrap_or_else(|| panic!("bubblewrap argv is missing command separator '--'"));
	- line 503: panic!("bubblewrap argv is missing inner command after '--'");
	- line 516: let preflight_argv = build_preflight_bwrap_argv(network_mode)?;
	- line 517: let stderr = run_bwrap_in_child_capture_stderr(preflight_argv);
	- line 521: fn build_preflight_bwrap_argv(
	- line 523: ) -> CodexResult<crate::bwrap::BwrapArgs> {
	- line 525: FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 533: build_bwrap_argv(
	- line 555: fn run_or_exec_bwrap(bwrap_args: crate::bwrap::BwrapArgs) -> ! {
	- line 556: if bwrap_args.synthetic_mount_targets.is_empty()
	- line 557: && bwrap_args.protected_create_targets.is_empty()
	- line 559: exec_bwrap(bwrap_args.args, bwrap_args.preserved_files);
	- line 561: run_bwrap_in_child_with_synthetic_mount_cleanup(bwrap_args);
	- line 564: fn run_bwrap_in_child_with_synthetic_mount_cleanup(bwrap_args: crate::bwrap::BwrapArgs) -> ! {
	- line 565: let crate::bwrap::BwrapArgs {
	- line 570: } = bwrap_args;
	- line 580: panic!("failed to fork for bubblewrap: {err}");
	- line 589: panic!("failed to place bubblewrap child in its own process group: {err}");
	- line 593: exec_bwrap(args, preserved_files);
	- line 599: let signal_forwarders = install_bwrap_signal_forwarders(pid);
	- line 602: let status = wait_for_bwrap_child(pid);
	- line 617: fn start(targets: &[crate::bwrap::ProtectedCreateTarget]) -> Option<Self> {
	- line 660: fn new(targets: &[crate::bwrap::ProtectedCreateTarget]) -> Option<Self> {
	- line 757: panic!("failed to create bubblewrap exec start pipe: {err}");
	- line 826: panic!("failed to block bubblewrap forwarded signals: {err}");
	- line 840: panic!("failed to restore bubblewrap forwarded signals: {err}");
	- line 850: panic!("failed to set bubblewrap child parent-death signal: {err}");
	- line 867: panic!("failed to restore bubblewrap signal handler for {signal}: {err}");
	- line 874: fn install_bwrap_signal_forwarders(pid: libc::pid_t) -> ForwardedSignalHandlers {
	- line 880: action.sa_sigaction = forward_signal_to_bwrap_child as *const () as libc::sighandler_t;
	- line 885: panic!("failed to install bubblewrap signal forwarder for {signal}: {err}");
	- line 894: extern "C" fn forward_signal_to_bwrap_child(signal: libc::c_int) {
	- line 898: send_signal_to_bwrap_child(pid, signal);
	- line 905: send_signal_to_bwrap_child(pid, signal);
	- line 909: fn send_signal_to_bwrap_child(pid: libc::pid_t, signal: libc::c_int) {
	- line 921: panic!("failed to reset bubblewrap signal handler for {signal}: {err}");
	- line 927: fn wait_for_bwrap_child(pid: libc::pid_t) -> libc::c_int {
	- line 938: panic!("waitpid failed for bubblewrap child: {err}");
	- line 943: targets: &[crate::bwrap::SyntheticMountTarget],
	- line 952: "failed to create synthetic bubblewrap mount marker directory {}: {err}",
	- line 960: crate::bwrap::SyntheticMountTargetKind::EmptyFile => {
	- line 961: crate::bwrap::SyntheticMountTarget::missing(target.path())
	- line 963: crate::bwrap::SyntheticMountTargetKind::EmptyDirectory => {
	- line 964: crate::bwrap::SyntheticMountTarget::missing_empty_directory(
	- line 976: "failed to register synthetic bubblewrap mount target {}: {err}",
	- line 992: targets: &[crate::bwrap::ProtectedCreateTarget],
	- line 1022: fn synthetic_mount_marker_contents(target: &crate::bwrap::SyntheticMountTarget) -> &'static [u8] {
	- line 1036: "failed to read synthetic bubblewrap mount marker {}: {err}",
	- line 1055: "failed to read synthetic bubblewrap mount marker directory {}: {err}",
	- line 1062: "failed to read synthetic bubblewrap mount marker in {}: {err}",
	- line 1079: "failed to remove stale synthetic bubblewrap mount marker {}: {err}",
	- line 1100: "failed to unregister synthetic bubblewrap mount target {}: {err}",
	- line 1116: "failed to remove synthetic bubblewrap mount marker directory {}: {err}",
	- line 1154: fn remove_protected_create_target(target: &crate::bwrap::ProtectedCreateTarget) -> bool {
	- line 1173: target: &crate::bwrap::ProtectedCreateTarget,
	- line 1188: target: &crate::bwrap::ProtectedCreateTarget,
	- line 1247: fn remove_synthetic_mount_target(target: &crate::bwrap::SyntheticMountTarget) {
	- line 1253: "failed to inspect synthetic bubblewrap mount target {}: {err}",
	- line 1257: if !target.should_remove_after_bwrap(&metadata) {
	- line 1261: crate::bwrap::SyntheticMountTargetKind::EmptyFile => match fs::remove_file(path) {
	- line 1265: "failed to remove synthetic bubblewrap mount target {}: {err}",
	- line 1269: crate::bwrap::SyntheticMountTargetKind::EmptyDirectory => match fs::remove_dir(path) {
	- line 1274: "failed to remove synthetic bubblewrap mount target {}: {err}",
	- line 1294: "failed to create synthetic bubblewrap mount registry {}: {err}",
	- line 1307: "failed to open synthetic bubblewrap mount registry lock {}: {err}",
	- line 1314: "failed to lock synthetic bubblewrap mount registry {}: {err}",
	- line 1322: "failed to unlock synthetic bubblewrap mount registry {}: {err}",
	- line 1347: "codex-bwrap-synthetic-mount-targets-{effective_uid}"
	- line 1398: /// Run a short-lived bubblewrap preflight in a child process and capture stderr.
	- line 1402: ///   under bubblewrap with `--proc /proc`.
	- line 1409: fn run_bwrap_in_child_capture_stderr(bwrap_args: crate::bwrap::BwrapArgs) -> String {
	- line 1411: let crate::bwrap::BwrapArgs {
	- line 1416: } = bwrap_args;
	- line 1426: panic!("failed to create stderr pipe for bubblewrap: {err}");
	- line 1434: panic!("failed to fork for bubblewrap: {err}");
	- line 1440: // Child: redirect stderr to the pipe, then run bubblewrap.
	- line 1442: close_fd_or_panic(read_fd, "close read end in bubblewrap child");
	- line 1445: panic!("failed to redirect stderr for bubblewrap: {err}");
	- line 1447: close_fd_or_panic(write_fd, "close write end in bubblewrap child");
	- line 1450: exec_bwrap(args, preserved_files);
	- line 1453: let signal_forwarders = install_bwrap_signal_forwarders(pid);
	- line 1456: close_fd_or_panic(write_fd, "close write end in bubblewrap parent");
	- line 1463: panic!("failed to read bubblewrap stderr: {err}");
	- line 1466: let status = wait_for_bwrap_child(pid);
	- line 1504: permission_profile: &'a PermissionProfile,
	- line 1510: /// Build the inner command that applies seccomp after bubblewrap.
	- line 1511: fn build_inner_seccomp_command(args: InnerSeccompCommandArgs<'_>) -> Vec<String> {
	- line 1541: "--apply-seccomp-then-exec".to_string(),


codex-rs/protocol/src/permissions.rs (179 lines):
	- line 24: use crate::protocol::SandboxPolicy;
	- line 25: use crate::protocol::WritableRoot;
	- line 50: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 71: pub enum NetworkSandboxPolicy {
	- line 77: impl NetworkSandboxPolicy {
	- line 79: matches!(self, NetworkSandboxPolicy::Enabled)
	- line 226: pub struct FileSystemSandboxPolicy {
	- line 233: enum WritableRootPathResolution {
	- line 238: impl WritableRootPathResolution {
	- line 249: #[schemars(rename = "FileSystemSandboxPolicy")]
	- line 250: #[ts(rename = "FileSystemSandboxPolicy")]
	- line 251: pub struct RawFileSystemSandboxPolicy {
	- line 265: pub struct FileSystemSandboxPolicyContext<'a> {
	- line 284: writable_roots: Vec<WritableRoot>,
	- line 305: pub fn new(file_system_sandbox_policy: &FileSystemSandboxPolicy, cwd: &Path) -> Option<Self> {
	- line 322: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 333: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 345: let context = FileSystemSandboxPolicyContext {
	- line 370: let context = FileSystemSandboxPolicyContext {
	- line 376: FileSystemSandboxPolicy::matches_prepared_read_deny(
	- line 522: impl TryFrom<RawFileSystemSandboxPolicy> for FileSystemSandboxPolicy {
	- line 525: fn try_from(policy: RawFileSystemSandboxPolicy) -> Result<Self, Self::Error> {
	- line 538: impl TryFrom<FileSystemSandboxPolicy> for RawFileSystemSandboxPolicy {
	- line 541: fn try_from(policy: FileSystemSandboxPolicy) -> Result<Self, Self::Error> {
	- line 569: impl Default for FileSystemSandboxPolicy {
	- line 575: impl FileSystemSandboxPolicy {
	- line 649: sandbox_policy: &SandboxPolicy,
	- line 747: /// callers to construct a legacy [`SandboxPolicy`] first.
	- line 801: FileSystemSandboxPolicy::restricted(entries)
	- line 811: pub fn from_legacy_sandbox_policy_for_cwd(sandbox_policy: &SandboxPolicy, cwd: &Path) -> Self {
	- line 813: if let SandboxPolicy::WorkspaceWrite { writable_roots, .. } = sandbox_policy {
	- line 897: context: &FileSystemSandboxPolicyContext<'_>,
	- line 938: fn can_write_path(&self, path: &PathUri, context: &FileSystemSandboxPolicyContext<'_>) -> bool {
	- line 948: context: &FileSystemSandboxPolicyContext<'_>,
	- line 974: context: &FileSystemSandboxPolicyContext<'_>,
	- line 1019: context: &FileSystemSandboxPolicyContext<'_>,
	- line 1052: context: &FileSystemSandboxPolicyContext<'_>,
	- line 1344: network_policy: NetworkSandboxPolicy,
	- line 1389: pub fn get_writable_roots_with_cwd(&self, cwd: &Path) -> Vec<WritableRoot> {
	- line 1390: self.get_writable_roots_with_cwd_impl(cwd, WritableRootPathResolution::Effective)
	- line 1414: ) -> Vec<WritableRoot> {
	- line 1417: WritableRootPathResolution::PreserveMutableComponents,
	- line 1424: path_resolution: WritableRootPathResolution,
	- line 1425: ) -> Vec<WritableRoot> {
	- line 1472: // as separate WritableRoot values and are checked independently.
	- line 1475: // Example: if `<root>/.codex -> <root>/decoy`, bwrap must still see
	- line 1528: WritableRoot {
	- line 1593: network_policy: NetworkSandboxPolicy,
	- line 1595: ) -> io::Result<SandboxPolicy> {
	- line 1597: FileSystemSandboxKind::ExternalSandbox => SandboxPolicy::ExternalSandbox {
	- line 1606: SandboxPolicy::DangerFullAccess
	- line 1608: SandboxPolicy::ExternalSandbox {
	- line 1671: SandboxPolicy::DangerFullAccess
	- line 1673: SandboxPolicy::ExternalSandbox {
	- line 1680: SandboxPolicy::WorkspaceWrite {
	- line 1696: "permissions profile requests filesystem writes outside the workspace root, which is not supported until the runtime enforces FileSystemSandboxPolicy directly",
	- line 1699: SandboxPolicy::ReadOnly {
	- line 1724: context: &FileSystemSandboxPolicyContext<'_>,
	- line 1779: impl From<&SandboxPolicy> for NetworkSandboxPolicy {
	- line 1780: fn from(value: &SandboxPolicy) -> Self {
	- line 1782: NetworkSandboxPolicy::Enabled
	- line 1784: NetworkSandboxPolicy::Restricted
	- line 1789: impl From<&SandboxPolicy> for FileSystemSandboxPolicy {
	- line 1790: fn from(value: &SandboxPolicy) -> Self {
	- line 1792: SandboxPolicy::DangerFullAccess => FileSystemSandboxPolicy::unrestricted(),
	- line 1793: SandboxPolicy::ExternalSandbox { .. } => FileSystemSandboxPolicy::external_sandbox(),
	- line 1794: SandboxPolicy::ReadOnly { .. } => {
	- line 1795: FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry::new(
	- line 1802: SandboxPolicy::WorkspaceWrite {
	- line 1807: } => FileSystemSandboxPolicy::workspace_write(
	- line 1884: evaluate: impl FnOnce(&PathUri, &FileSystemSandboxPolicyContext<'_>) -> T,
	- line 1891: let context = FileSystemSandboxPolicyContext {
	- line 1900: fn file_system_root(context: &FileSystemSandboxPolicyContext<'_>) -> Option<PathUri> {
	- line 2077: fn sorted_writable_roots(mut roots: Vec<WritableRoot>) -> Vec<WritableRoot> {
	- line 2172: /// Unlike [`FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd`], this
	- line 2177: sandbox_policy: &SandboxPolicy,
	- line 2179: ) -> FileSystemSandboxPolicy {
	- line 2180: let SandboxPolicy::WorkspaceWrite {
	- line 2187: return FileSystemSandboxPolicy::from(sandbox_policy);
	- line 2244: FileSystemSandboxPolicy::restricted(entries)
	- line 2291: policy: &FileSystemSandboxPolicy,
	- line 2316: policy: &FileSystemSandboxPolicy,
	- line 2317: legacy_policy: &SandboxPolicy,
	- line 2449: FileSystemSandboxPolicy::read_only(),
	- line 2450: FileSystemSandboxPolicy::unrestricted(),
	- line 2451: FileSystemSandboxPolicy::external_sandbox(),
	- line 2452: FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry::new(
	- line 2456: FileSystemSandboxPolicy::restricted(vec![
	- line 2463: FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry::new(
	- line 2508: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2535: let context = FileSystemSandboxPolicyContext {
	- line 2541: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2595: let scoped = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry::new(
	- line 2615: let context = FileSystemSandboxPolicyContext {
	- line 2644: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2661: let context = FileSystemSandboxPolicyContext {
	- line 2667: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2692: let opaque_context = FileSystemSandboxPolicyContext {
	- line 2698: let opaque_policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry::new(
	- line 2713: let context = FileSystemSandboxPolicyContext {
	- line 2719: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2733: assert!(FileSystemSandboxPolicy::matches_prepared_read_deny(
	- line 2741: assert!(FileSystemSandboxPolicy::matches_prepared_read_deny(
	- line 2787: let context = FileSystemSandboxPolicyContext {
	- line 2793: let policy = FileSystemSandboxPolicy::restricted(vec![unreadable_glob_entry(
	- line 2800: assert!(FileSystemSandboxPolicy::matches_prepared_read_deny(
	- line 2804: let without_home = FileSystemSandboxPolicyContext {
	- line 2825: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2846: NetworkSandboxPolicy::Restricted,
	- line 2852: SandboxPolicy::ReadOnly {
	- line 2864: let slash_tmp_only_policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2880: .to_legacy_sandbox_policy(NetworkSandboxPolicy::Restricted, cwd.path())
	- line 2882: SandboxPolicy::ReadOnly {
	- line 2888: .needs_direct_runtime_enforcement(NetworkSandboxPolicy::Restricted, cwd.path())
	- line 2892: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2910: let legacy_policy = SandboxPolicy::new_workspace_write_policy();
	- line 2912: FileSystemSandboxPolicy::from(&legacy_policy)
	- line 2913: .to_legacy_sandbox_policy(NetworkSandboxPolicy::Restricted, cwd.path())
	- line 2918: FileSystemSandboxPolicy::from(&legacy_policy)
	- line 2930: FileSystemSandboxPolicy::workspace_write(
	- line 2949: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 2979: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 3014: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry::new(
	- line 3057: let policy = SandboxPolicy::WorkspaceWrite {
	- line 3065: FileSystemSandboxPolicy::from(&policy),
	- line 3066: FileSystemSandboxPolicy::restricted(vec![
	- line 3134: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 3184: FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 3218: let policy = SandboxPolicy::WorkspaceWrite {
	- line 3226: FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(&policy, relative_cwd);
	- line 3265: FileSystemSandboxPolicy::restricted(expected_entries)
	- line 3310: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 3366: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 3439: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 3479: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 3528: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 3572: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 3632: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 3674: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 3725: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 3741: policy.needs_direct_runtime_enforcement(NetworkSandboxPolicy::Restricted, cwd.path(),)
	- line 3745: &SandboxPolicy::new_workspace_write_policy(),
	- line 3750: .needs_direct_runtime_enforcement(NetworkSandboxPolicy::Restricted, cwd.path(),),
	- line 3758: let legacy_policy = SandboxPolicy::WorkspaceWrite {
	- line 3767: let reordered = FileSystemSandboxPolicy::restricted(reordered_entries);
	- line 3775: .needs_direct_runtime_enforcement(NetworkSandboxPolicy::Restricted, cwd.path()),
	- line 3777: .needs_direct_runtime_enforcement(NetworkSandboxPolicy::Restricted, cwd.path()),
	- line 3785: let legacy_policy = SandboxPolicy::WorkspaceWrite {
	- line 3793: FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(&legacy_policy, cwd.path());
	- line 3796: .needs_direct_runtime_enforcement(NetworkSandboxPolicy::Restricted, cwd.path()),
	- line 3804: .needs_direct_runtime_enforcement(NetworkSandboxPolicy::Restricted, cwd.path()),
	- line 3805: "metadata-name protections are outside the legacy SandboxPolicy writable-root contract"
	- line 3813: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 3834: policy.needs_direct_runtime_enforcement(NetworkSandboxPolicy::Restricted, cwd.path(),)
	- line 3838: .to_legacy_sandbox_policy(NetworkSandboxPolicy::Restricted, cwd.path())
	- line 3853: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 3885: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 3913: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 3944: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 3963: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 3984: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 3996: FileSystemSandboxPolicy::restricted(vec![
	- line 4020: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 4049: FileSystemSandboxPolicy::restricted(vec![
	- line 4109: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 4121: FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 4139: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 4152: FileSystemSandboxPolicy::restricted(vec![
	- line 4186: let existing = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 4194: let rebuilt = FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_deny_entries(
	- line 4195: &SandboxPolicy::new_workspace_write_policy(),
	- line 4215: let mut existing = FileSystemSandboxPolicy::restricted(vec![deny_entry.clone()]);
	- line 4217: let mut replacement = FileSystemSandboxPolicy::unrestricted();
	- line 4221: let mut expected = FileSystemSandboxPolicy::restricted(vec![
	- line 4235: fn deny_policy(path: &Path) -> FileSystemSandboxPolicy {
	- line 4236: FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 4255: fn default_policy_with_unreadable_glob(pattern: String) -> FileSystemSandboxPolicy {
	- line 4256: let mut policy = FileSystemSandboxPolicy::default();
	- line 4263: file_system_sandbox_policy: &FileSystemSandboxPolicy,


codex-rs/linux-sandbox/src/bwrap.rs (142 lines):
	- line 10: //! - seccomp + `PR_SET_NO_NEW_PRIVS` applied in-process, and
	- line 11: //! - bubblewrap used to construct the filesystem view before exec.
	- line 33: use codex_protocol::protocol::FileSystemSandboxPolicy;
	- line 35: use codex_protocol::protocol::WritableRoot;
	- line 59: /// Options that control how bubblewrap is invoked.
	- line 67: /// How networking should be configured inside the bubblewrap sandbox.
	- line 86: /// Network policy modes for bubblewrap.
	- line 207: pub(crate) fn should_remove_after_bwrap(&self, metadata: &Metadata) -> bool {
	- line 228: /// Wrap a command with bubblewrap so the filesystem is read-only by default,
	- line 233: /// If network isolation is requested, we still wrap with bubblewrap so network
	- line 235: pub(crate) fn create_bwrap_command_args(
	- line 237: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 244: // Full disk write normally skips bwrap, but unreadable glob patterns still
	- line 245: // need concrete bwrap masks for the matches expanded below.
	- line 255: Ok(create_bwrap_flags_full_filesystem(command, options))
	- line 259: create_bwrap_flags(
	- line 268: fn create_bwrap_flags_full_filesystem(command: Vec<String>, options: BwrapOptions) -> BwrapArgs {
	- line 307: /// Build the bubblewrap flags (everything after `argv[0]`).
	- line 308: fn create_bwrap_flags(
	- line 310: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 327: let normalized_command_cwd = normalize_command_cwd_for_bwrap(command_cwd);
	- line 332: // Request a user namespace explicitly rather than relying on bubblewrap's
	- line 365: /// Build the bubblewrap filesystem mounts for a given filesystem policy.
	- line 382: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 399: writable_roots.push(WritableRoot {
	- line 424: // rules should keep their normal bwrap behavior, which can mask
	- line 456: // In bubblewrap (`bubblewrap.c`, `SETUP_MOUNT_DEV`), `--dev /dev`
	- line 510: // paths inside bwrap, such as Bazel runfiles helper binaries.
	- line 527: let mut bwrap_args = BwrapArgs {
	- line 563: append_unreadable_root_args(&mut bwrap_args, unreadable_root, &allowed_write_paths)?;
	- line 577: append_mount_target_parent_dir_args(&mut bwrap_args.args, root, masking_root);
	- line 581: bwrap_args.args.push("--bind".to_string());
	- line 582: bwrap_args.args.push(path_to_string(mount_root));
	- line 583: bwrap_args.args.push(path_to_string(mount_root));
	- line 602: &mut bwrap_args,
	- line 610: append_read_only_subpath_args(&mut bwrap_args, &subpath, &allowed_write_paths)?;
	- line 625: bwrap_args.args.push("--ro-bind".to_string());
	- line 626: bwrap_args.args.push(path_to_string(registry_mount));
	- line 627: bwrap_args.args.push(path_to_string(registry_mount));
	- line 640: append_unreadable_root_args(&mut bwrap_args, &unreadable_root, &allowed_write_paths)?;
	- line 656: append_unreadable_root_args(&mut bwrap_args, &unreadable_root, &allowed_write_paths)?;
	- line 659: Ok(bwrap_args)
	- line 663: bwrap_args: &mut BwrapArgs,
	- line 679: bwrap_args
	- line 725: // Record both the logical match and any canonical symlink target. The bwrap
	- line 996: fn normalize_command_cwd_for_bwrap(command_cwd: &Path) -> PathBuf {
	- line 1023: bwrap_args: &mut BwrapArgs,
	- line 1030: * with bwrap path arguments. Binding the symlink's current target would
	- line 1044: // Another concurrent bwrap setup can leave an empty mount target at
	- line 1049: append_existing_empty_file_bind_data_args(bwrap_args, subpath, &metadata)?;
	- line 1052: append_existing_empty_directory_args(bwrap_args, subpath, &metadata);
	- line 1062: append_missing_read_only_subpath_args(bwrap_args, &first_missing_component)?;
	- line 1068: bwrap_args.args.push("--ro-bind".to_string());
	- line 1069: bwrap_args.args.push(path_to_string(subpath));
	- line 1070: bwrap_args.args.push(path_to_string(subpath));
	- line 1075: fn append_empty_file_bind_data_args(bwrap_args: &mut BwrapArgs, path: &Path) -> Result<()> {
	- line 1076: if bwrap_args.preserved_files.is_empty() {
	- line 1077: bwrap_args.preserved_files.push(File::open("/dev/null")?);
	- line 1079: let null_fd = bwrap_args.preserved_files[0].as_raw_fd().to_string();
	- line 1080: bwrap_args.args.push("--ro-bind-data".to_string());
	- line 1081: bwrap_args.args.push(null_fd);
	- line 1082: bwrap_args.args.push(path_to_string(path));
	- line 1086: fn append_empty_directory_args(bwrap_args: &mut BwrapArgs, path: &Path) {
	- line 1087: bwrap_args.args.push("--perms".to_string());
	- line 1088: bwrap_args.args.push("555".to_string());
	- line 1089: bwrap_args.args.push("--tmpfs".to_string());
	- line 1090: bwrap_args.args.push(path_to_string(path));
	- line 1091: bwrap_args.args.push("--remount-ro".to_string());
	- line 1092: bwrap_args.args.push(path_to_string(path));
	- line 1095: fn append_missing_read_only_subpath_args(bwrap_args: &mut BwrapArgs, path: &Path) -> Result<()> {
	- line 1097: append_empty_directory_args(bwrap_args, path);
	- line 1098: bwrap_args
	- line 1104: append_missing_empty_file_bind_data_args(bwrap_args, path)
	- line 1107: fn append_missing_empty_file_bind_data_args(bwrap_args: &mut BwrapArgs, path: &Path) -> Result<()> {
	- line 1108: append_empty_file_bind_data_args(bwrap_args, path)?;
	- line 1109: bwrap_args
	- line 1116: bwrap_args: &mut BwrapArgs,
	- line 1120: append_empty_file_bind_data_args(bwrap_args, path)?;
	- line 1121: bwrap_args
	- line 1128: bwrap_args: &mut BwrapArgs,
	- line 1132: append_empty_directory_args(bwrap_args, path);
	- line 1133: bwrap_args
	- line 1141: bwrap_args: &mut BwrapArgs,
	- line 1151: * masking the symlink's current target is a TOCTTOU snapshot: bwrap would
	- line 1166: append_missing_empty_file_bind_data_args(bwrap_args, &first_missing_component)?;
	- line 1171: append_existing_unreadable_path_args(bwrap_args, unreadable_root, allowed_write_paths)
	- line 1175: bwrap_args: &mut BwrapArgs,
	- line 1185: bwrap_args.args.push("--perms".to_string());
	- line 1190: bwrap_args.args.push(if writable_descendants.is_empty() {
	- line 1195: bwrap_args.args.push("--tmpfs".to_string());
	- line 1196: bwrap_args.args.push(path_to_string(unreadable_root));
	- line 1198: // the denied parent read-only. Otherwise bubblewrap cannot mkdir the
	- line 1203: &mut bwrap_args.args,
	- line 1208: bwrap_args.args.push("--remount-ro".to_string());
	- line 1209: bwrap_args.args.push(path_to_string(unreadable_root));
	- line 1213: bwrap_args.args.push("--perms".to_string());
	- line 1214: bwrap_args.args.push("000".to_string());
	- line 1215: append_empty_file_bind_data_args(bwrap_args, unreadable_root)
	- line 1335: use codex_protocol::protocol::FileSystemSandboxPolicy;
	- line 1356: fn default_policy_with_unreadable_glob(pattern: String) -> FileSystemSandboxPolicy {
	- line 1357: let mut policy = FileSystemSandboxPolicy::default();
	- line 1365: let args = create_bwrap_command_args(
	- line 1367: &FileSystemSandboxPolicy::unrestricted(),
	- line 1376: .expect("create bwrap args");
	- line 1384: let args = create_bwrap_command_args(
	- line 1386: &FileSystemSandboxPolicy::unrestricted(),
	- line 1395: .expect("create bwrap args");
	- line 1433: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 1445: let args = create_bwrap_command_args(
	- line 1452: .expect("create bwrap args");
	- line 1456: "full-write policy with unreadable globs must still use bwrap"
	- line 1478: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 1495: let args = create_bwrap_command_args(
	- line 1502: .expect("create bwrap args");
	- line 1556: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 1607: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 1647: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 1683: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 1712: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 1758: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 1805: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 1836: !args.synthetic_mount_targets[0].should_remove_after_bwrap(&metadata),
	- line 1853: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 1890: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 1919: let policy = FileSystemSandboxPolicy::workspace_write(
	- line 1949: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2012: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2055: let sandbox_policy = FileSystemSandboxPolicy::workspace_write(
	- line 2066: .expect("bwrap fs args");
	- line 2152: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 2180: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 2217: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2290: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2341: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2409: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2489: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2539: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2583: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2641: "max depth should keep deeper matches out of bwrap args: {:#?}",
	- line 2672: let error = create_bwrap_command_args(
	- line 2703: /// Assert that `path` is masked due to a bwrap arg sequence like:
	- line 2705: /// `bwrap ... --perms 000 --ro-bind-data FD PATH`


codex-rs/protocol/src/models.rs (126 lines):
	- line 21: use crate::permissions::FileSystemSandboxPolicy;
	- line 23: use crate::permissions::NetworkSandboxPolicy;
	- line 25: use crate::protocol::SandboxPolicy;
	- line 40: pub use crate::permission_profile_snapshot::PermissionProfileSnapshot;
	- line 253: pub struct AdditionalPermissionProfile {
	- line 258: impl AdditionalPermissionProfile {
	- line 279: pub fn from_legacy_sandbox_policy(sandbox_policy: &SandboxPolicy) -> Self {
	- line 281: SandboxPolicy::DangerFullAccess => Self::Disabled,
	- line 282: SandboxPolicy::ExternalSandbox { .. } => Self::External,
	- line 283: SandboxPolicy::ReadOnly { .. } | SandboxPolicy::WorkspaceWrite { .. } => Self::Managed,
	- line 371: fn from_sandbox_policy(file_system_sandbox_policy: &FileSystemSandboxPolicy) -> Self {
	- line 381: "external filesystem policies are represented by PermissionProfile::External"
	- line 386: pub fn to_sandbox_policy(&self) -> FileSystemSandboxPolicy {
	- line 391: } => FileSystemSandboxPolicy {
	- line 396: Self::Unrestricted => FileSystemSandboxPolicy::unrestricted(),
	- line 414: pub enum PermissionProfile {
	- line 420: network: NetworkSandboxPolicy,
	- line 427: External { network: NetworkSandboxPolicy },
	- line 431: /// produced the active `PermissionProfile`.
	- line 433: /// The runtime must honor `PermissionProfile`; this sidecar exists so clients
	- line 437: pub struct ActivePermissionProfile {
	- line 450: impl ActivePermissionProfile {
	- line 463: impl Default for PermissionProfile {
	- line 470: network: NetworkSandboxPolicy::Restricted,
	- line 475: impl PermissionProfile {
	- line 478: let file_system = FileSystemSandboxPolicy::read_only();
	- line 481: network: NetworkSandboxPolicy::Restricted,
	- line 502: file_system = FileSystemSandboxPolicy::read_only();
	- line 508: NetworkSandboxPolicy::Restricted,
	- line 520: NetworkSandboxPolicy::Restricted,
	- line 533: network: NetworkSandboxPolicy,
	- line 537: let file_system = FileSystemSandboxPolicy::workspace_write(
	- line 565: materialize: impl FnOnce(FileSystemSandboxPolicy) -> FileSystemSandboxPolicy,
	- line 584: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 585: network_sandbox_policy: NetworkSandboxPolicy,
	- line 602: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 603: network_sandbox_policy: NetworkSandboxPolicy,
	- line 623: pub fn from_legacy_sandbox_policy(sandbox_policy: &SandboxPolicy) -> Self {
	- line 626: &FileSystemSandboxPolicy::from(sandbox_policy),
	- line 627: NetworkSandboxPolicy::from(sandbox_policy),
	- line 631: pub fn from_legacy_sandbox_policy_for_cwd(sandbox_policy: &SandboxPolicy, cwd: &Path) -> Self {
	- line 634: &FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(sandbox_policy, cwd),
	- line 635: NetworkSandboxPolicy::from(sandbox_policy),
	- line 647: pub fn file_system_sandbox_policy(&self) -> FileSystemSandboxPolicy {
	- line 650: Self::Disabled => FileSystemSandboxPolicy::unrestricted(),
	- line 651: Self::External { .. } => FileSystemSandboxPolicy::external_sandbox(),
	- line 655: pub fn network_sandbox_policy(&self) -> NetworkSandboxPolicy {
	- line 658: Self::Disabled => NetworkSandboxPolicy::Enabled,
	- line 662: pub fn to_legacy_sandbox_policy(&self, cwd: &Path) -> io::Result<SandboxPolicy> {
	- line 670: Self::Disabled => Ok(SandboxPolicy::DangerFullAccess),
	- line 671: Self::External { network } => Ok(SandboxPolicy::ExternalSandbox {
	- line 681: pub fn to_runtime_permissions(&self) -> (FileSystemSandboxPolicy, NetworkSandboxPolicy) {
	- line 691: enum TaggedPermissionProfile {
	- line 695: network: NetworkSandboxPolicy,
	- line 700: network: NetworkSandboxPolicy,
	- line 704: impl From<TaggedPermissionProfile> for PermissionProfile {
	- line 705: fn from(value: TaggedPermissionProfile) -> Self {
	- line 707: TaggedPermissionProfile::Managed {
	- line 714: TaggedPermissionProfile::Disabled => Self::Disabled,
	- line 715: TaggedPermissionProfile::External { network } => Self::External { network },
	- line 720: /// Pre-tagged shape written to rollout files before `PermissionProfile`
	- line 724: struct LegacyPermissionProfile {
	- line 729: impl From<LegacyPermissionProfile> for PermissionProfile {
	- line 730: fn from(value: LegacyPermissionProfile) -> Self {
	- line 747: NetworkSandboxPolicy::Enabled
	- line 749: NetworkSandboxPolicy::Restricted
	- line 760: enum PermissionProfileDe {
	- line 761: Tagged(TaggedPermissionProfile),
	- line 762: Legacy(LegacyPermissionProfile),
	- line 765: impl<'de> Deserialize<'de> for PermissionProfile {
	- line 770: Ok(match PermissionProfileDe::deserialize(deserializer)? {
	- line 771: PermissionProfileDe::Tagged(tagged) => tagged.into(),
	- line 772: PermissionProfileDe::Legacy(legacy) => legacy.into(),
	- line 777: impl From<NetworkSandboxPolicy> for NetworkPermissions {
	- line 778: fn from(value: NetworkSandboxPolicy) -> Self {
	- line 785: impl From<&FileSystemSandboxPolicy> for FileSystemPermissions {
	- line 786: fn from(value: &FileSystemSandboxPolicy) -> Self {
	- line 805: impl From<&FileSystemPermissions> for FileSystemSandboxPolicy {
	- line 807: let mut policy = FileSystemSandboxPolicy::restricted(value.entries.clone());
	- line 2731: assert_eq!(AdditionalPermissionProfile::default().is_empty(), true);
	- line 2736: let permission_profile = AdditionalPermissionProfile {
	- line 2746: FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 2755: let permission_profile = PermissionProfile::from_runtime_permissions(
	- line 2757: NetworkSandboxPolicy::Restricted,
	- line 2770: let file_system_sandbox_policy = FileSystemSandboxPolicy::restricted(vec![
	- line 2779: let permission_profile = PermissionProfile::from_runtime_permissions(
	- line 2781: NetworkSandboxPolicy::Restricted,
	- line 2785: serde_json::from_value::<PermissionProfile>(serde_json::to_value(
	- line 2813: let permission_profile: PermissionProfile = serde_json::from_value(legacy)?;
	- line 2817: PermissionProfile::Managed {
	- line 2828: network: NetworkSandboxPolicy::Enabled,
	- line 2837: PermissionProfile::read_only(),
	- line 2838: PermissionProfile::from_legacy_sandbox_policy(&SandboxPolicy::new_read_only_policy())
	- line 2841: PermissionProfile::workspace_write(),
	- line 2842: PermissionProfile::from_legacy_sandbox_policy(
	- line 2843: &SandboxPolicy::new_workspace_write_policy()
	- line 2852: PermissionProfile::from_legacy_sandbox_policy(&SandboxPolicy::DangerFullAccess);
	- line 2854: assert_eq!(permission_profile, PermissionProfile::Disabled);
	- line 2857: SandboxPolicy::DangerFullAccess
	- line 2862: FileSystemSandboxPolicy::unrestricted(),
	- line 2863: NetworkSandboxPolicy::Enabled
	- line 2871: let permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 2873: &FileSystemSandboxPolicy::unrestricted(),
	- line 2874: NetworkSandboxPolicy::Restricted,
	- line 2877: assert_eq!(permission_profile, PermissionProfile::Disabled);
	- line 2882: let permission_profile = PermissionProfile::from_runtime_permissions(
	- line 2883: &FileSystemSandboxPolicy::external_sandbox(),
	- line 2884: NetworkSandboxPolicy::Restricted,
	- line 2889: PermissionProfile::External {
	- line 2890: network: NetworkSandboxPolicy::Restricted,
	- line 2894: PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 2896: &FileSystemSandboxPolicy::external_sandbox(),
	- line 2897: NetworkSandboxPolicy::Restricted,
	- line 2905: let permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 2907: &FileSystemSandboxPolicy::unrestricted(),
	- line 2908: NetworkSandboxPolicy::Restricted,
	- line 2913: PermissionProfile::Managed {
	- line 2915: network: NetworkSandboxPolicy::Restricted,
	- line 2922: FileSystemSandboxPolicy::unrestricted(),
	- line 2923: NetworkSandboxPolicy::Restricted,
	- line 2931: let sandbox_policy = SandboxPolicy::ExternalSandbox {
	- line 2934: let permission_profile = PermissionProfile::from_legacy_sandbox_policy(&sandbox_policy);
	- line 2938: PermissionProfile::External {
	- line 2939: network: NetworkSandboxPolicy::Restricted,
	- line 2949: FileSystemSandboxPolicy::external_sandbox(),
	- line 2950: NetworkSandboxPolicy::Restricted


codex-rs/linux-sandbox/src/launcher.rs (82 lines):
	- line 10: use crate::bundled_bwrap;
	- line 11: use crate::bundled_bwrap::BundledBwrapLauncher;
	- line 14: use codex_sandboxing::find_system_bwrap_in_path;
	- line 38: pub(crate) fn exec_bwrap(mut argv: Vec<String>, preserved_files: Vec<File>) -> ! {
	- line 41: match preferred_bwrap_launcher() {
	- line 44: translate_legacy_bwrap_fd_mounts(&mut argv)
	- line 45: .unwrap_or_else(|error| panic!("invalid legacy bubblewrap fd mount: {error}"));
	- line 47: exec_system_bwrap(&launcher.program, argv, preserved_files)
	- line 52: "bubblewrap is unavailable: no system bwrap was found on PATH and no bundled \
	- line 53: codex-resources/bwrap binary was found next to the Codex executable"
	- line 59: fn translate_legacy_bwrap_fd_mounts(argv: &mut Vec<String>) -> Result<(), String> {
	- line 63: .ok_or_else(|| "bubblewrap argv is missing the command separator '--'".to_string())?;
	- line 113: return Err("bubblewrap argv is missing the inner command after '--'".to_string());
	- line 118: .any(|argument| argument == "--apply-seccomp-then-exec")
	- line 126: fn preferred_bwrap_launcher() -> BubblewrapLauncher {
	- line 130: if let Some(path) = find_system_bwrap_in_path()
	- line 131: && let Some(launcher) = system_bwrap_launcher_for_path(&path)
	- line 136: match bundled_bwrap::launcher() {
	- line 144: fn system_bwrap_launcher_for_path(system_bwrap_path: &Path) -> Option<SystemBwrapLauncher> {
	- line 145: system_bwrap_launcher_for_path_with_probe(system_bwrap_path, system_bwrap_capabilities)
	- line 148: fn system_bwrap_launcher_for_path_with_probe(
	- line 149: system_bwrap_path: &Path,
	- line 150: system_bwrap_capabilities: impl FnOnce(&Path) -> Option<SystemBwrapCapabilities>,
	- line 152: if !system_bwrap_path.is_file() {
	- line 160: }) = system_bwrap_capabilities(system_bwrap_path)
	- line 164: let system_bwrap_path = match AbsolutePathBuf::from_absolute_path(system_bwrap_path) {
	- line 167: "failed to normalize system bubblewrap path {}: {err}",
	- line 168: system_bwrap_path.display()
	- line 172: program: system_bwrap_path,
	- line 178: pub(crate) fn preferred_bwrap_supports_argv0() -> bool {
	- line 179: match preferred_bwrap_launcher() {
	- line 185: fn system_bwrap_capabilities(system_bwrap_path: &Path) -> Option<SystemBwrapCapabilities> {
	- line 186: // bubblewrap added `--argv0` in v0.9.0:
	- line 187: // https://github.com/containers/bubblewrap/releases/tag/v0.9.0
	- line 191: let output = match Command::new(system_bwrap_path).arg("--help").output() {
	- line 207: fn exec_system_bwrap(
	- line 212: // System bwrap runs across an exec boundary, so preserved fds must survive exec.
	- line 217: .unwrap_or_else(|err| panic!("invalid system bubblewrap path: {err}"));
	- line 232: panic!("failed to exec system bubblewrap {program_path}: {err}");
	- line 243: fn prefers_system_bwrap_when_help_lists_argv0() {
	- line 244: let fake_bwrap = NamedTempFile::new().expect("temp file");
	- line 245: let fake_bwrap_path = fake_bwrap.path();
	- line 246: let expected = AbsolutePathBuf::from_absolute_path(fake_bwrap_path).expect("absolute");
	- line 249: system_bwrap_launcher_for_path_with_probe(fake_bwrap_path, |_| {
	- line 265: fn prefers_system_bwrap_when_system_bwrap_lacks_argv0() {
	- line 266: let fake_bwrap = NamedTempFile::new().expect("temp file");
	- line 267: let fake_bwrap_path = fake_bwrap.path();
	- line 270: system_bwrap_launcher_for_path_with_probe(fake_bwrap_path, |_| {
	- line 278: program: AbsolutePathBuf::from_absolute_path(fake_bwrap_path).expect("absolute"),
	- line 286: fn ignores_system_bwrap_when_system_bwrap_lacks_perms() {
	- line 287: let fake_bwrap = NamedTempFile::new().expect("temp file");
	- line 290: system_bwrap_launcher_for_path_with_probe(fake_bwrap.path(), |_| {
	- line 302: fn detects_fd_backed_read_only_mount_support_in_system_bwrap_help() {
	- line 304: let fake_bwrap_path = temp_dir.path().join("bwrap");
	- line 306: &fake_bwrap_path,
	- line 309: .expect("write fake bubblewrap");
	- line 310: std::fs::set_permissions(&fake_bwrap_path, std::fs::Permissions::from_mode(0o755))
	- line 311: .expect("make fake bubblewrap executable");
	- line 314: system_bwrap_capabilities(&fake_bwrap_path),
	- line 324: fn translates_fd_mounts_for_legacy_system_bubblewrap() {
	- line 326: "bwrap".to_string(),
	- line 332: "--apply-seccomp-then-exec".to_string(),
	- line 338: translate_legacy_bwrap_fd_mounts(&mut argv).expect("fd mount should translate");
	- line 343: "bwrap".to_string(),
	- line 351: "--apply-seccomp-then-exec".to_string(),
	- line 360: fn translates_multiple_fd_mounts_for_legacy_system_bubblewrap() {
	- line 362: "bwrap".to_string(),
	- line 371: "--apply-seccomp-then-exec".to_string(),
	- line 376: translate_legacy_bwrap_fd_mounts(&mut argv).expect("fd mounts should translate");
	- line 381: "bwrap".to_string(),
	- line 394: "--apply-seccomp-then-exec".to_string(),
	- line 402: fn rejects_malformed_legacy_bubblewrap_fd_mounts() {
	- line 409: "bwrap".to_string(),
	- line 417: assert!(translate_legacy_bwrap_fd_mounts(&mut argv).is_err());
	- line 424: "bwrap".to_string(),
	- line 431: "--apply-seccomp-then-exec".to_string(),
	- line 434: assert!(translate_legacy_bwrap_fd_mounts(&mut argv).is_err());
	- line 438: fn rejects_duplicate_legacy_bubblewrap_fd_mounts() {
	- line 440: "bwrap".to_string(),
	- line 451: assert!(translate_legacy_bwrap_fd_mounts(&mut argv).is_err());
	- line 455: fn ignores_system_bwrap_when_system_bwrap_is_missing() {
	- line 457: system_bwrap_launcher_for_path(Path::new("/definitely/not/a/bwrap")),


codex-rs/linux-sandbox/src/landlock.rs (80 lines):
	- line 1: //! In-process Linux sandbox primitives: `no_new_privs` and seccomp.
	- line 3: //! Filesystem restrictions are enforced by bubblewrap in `linux_run_main`.
	- line 4: //! Landlock helpers remain available here as legacy/backup utilities.
	- line 11: use codex_protocol::models::PermissionProfile;
	- line 12: use codex_protocol::protocol::NetworkSandboxPolicy;
	- line 15: use landlock::ABI;
	- line 17: use landlock::Access;
	- line 18: use landlock::AccessFs;
	- line 19: use landlock::CompatLevel;
	- line 20: use landlock::Compatible;
	- line 21: use landlock::Ruleset;
	- line 22: use landlock::RulesetAttr;
	- line 23: use landlock::RulesetCreatedAttr;
	- line 24: use seccompiler::BpfProgram;
	- line 25: use seccompiler::SeccompAction;
	- line 26: use seccompiler::SeccompCmpArgLen;
	- line 27: use seccompiler::SeccompCmpOp;
	- line 28: use seccompiler::SeccompCondition;
	- line 29: use seccompiler::SeccompFilter;
	- line 30: use seccompiler::SeccompRule;
	- line 31: use seccompiler::TargetArch;
	- line 32: use seccompiler::apply_filter;
	- line 39: /// - installing the network seccomp filter when network access is disabled.
	- line 41: /// Filesystem restrictions are intentionally handled by bubblewrap.
	- line 43: permission_profile: &PermissionProfile,
	- line 45: apply_landlock_fs: bool,
	- line 51: let network_seccomp_mode = network_seccomp_mode(
	- line 57: // `PR_SET_NO_NEW_PRIVS` is required for seccomp, but it also prevents
	- line 58: // setuid privilege elevation. Many `bwrap` deployments rely on setuid, so
	- line 59: // we avoid this unless we need seccomp or we are explicitly using the
	- line 60: // legacy Landlock filesystem pipeline.
	- line 61: if network_seccomp_mode.is_some()
	- line 62: || (apply_landlock_fs && !file_system_sandbox_policy.has_full_disk_write_access())
	- line 64: set_no_new_privs()?;
	- line 67: if let Some(mode) = network_seccomp_mode {
	- line 68: install_network_seccomp_filter_on_current_thread(mode)?;
	- line 71: if apply_landlock_fs && !file_system_sandbox_policy.has_full_disk_write_access() {
	- line 74: "Restricted read-only access is not supported by the legacy Linux Landlock filesystem backend."
	- line 84: install_filesystem_landlock_rules_on_current_thread(writable_roots)?;
	- line 96: fn should_install_network_seccomp(
	- line 97: network_sandbox_policy: NetworkSandboxPolicy,
	- line 105: fn network_seccomp_mode(
	- line 106: network_sandbox_policy: NetworkSandboxPolicy,
	- line 110: if !should_install_network_seccomp(network_sandbox_policy, allow_network_for_proxy) {
	- line 119: /// Enable `PR_SET_NO_NEW_PRIVS` so seccomp can be applied safely.
	- line 120: fn set_no_new_privs() -> Result<()> {
	- line 128: /// Installs Landlock file-system rules on the current thread allowing read
	- line 136: /// via bubblewrap. It is kept for reference and potential fallback use.
	- line 137: fn install_filesystem_landlock_rules_on_current_thread(
	- line 148: .add_rules(landlock::path_beneath_rules(&["/"], access_ro))?
	- line 149: .add_rules(landlock::path_beneath_rules(&["/dev/null"], access_rw))?
	- line 150: .set_no_new_privs(true);
	- line 153: ruleset = ruleset.add_rules(landlock::path_beneath_rules(&writable_roots, access_rw))?;
	- line 158: if status.ruleset == landlock::RulesetStatus::NotEnforced {
	- line 159: return Err(CodexErr::Sandbox(SandboxErr::LandlockRestrict));
	- line 165: /// Installs a seccomp filter for Linux network sandboxing.
	- line 169: fn install_network_seccomp_filter_on_current_thread(
	- line 259: unimplemented!("unsupported architecture for seccomp filter");
	- line 273: use super::network_seccomp_mode;
	- line 274: use super::should_install_network_seccomp;
	- line 275: use codex_protocol::protocol::NetworkSandboxPolicy;
	- line 279: fn managed_network_enforces_seccomp_even_for_full_network_policy() {
	- line 281: should_install_network_seccomp(
	- line 282: NetworkSandboxPolicy::Enabled,
	- line 290: fn full_network_policy_without_managed_network_skips_seccomp() {
	- line 292: should_install_network_seccomp(
	- line 293: NetworkSandboxPolicy::Enabled,
	- line 301: fn restricted_network_policy_always_installs_seccomp() {
	- line 302: assert!(should_install_network_seccomp(
	- line 303: NetworkSandboxPolicy::Restricted,
	- line 306: assert!(should_install_network_seccomp(
	- line 307: NetworkSandboxPolicy::Restricted,
	- line 313: fn managed_proxy_routes_use_proxy_routed_seccomp_mode() {
	- line 315: network_seccomp_mode(
	- line 316: NetworkSandboxPolicy::Enabled,
	- line 327: network_seccomp_mode(
	- line 328: NetworkSandboxPolicy::Restricted,
	- line 337: fn full_network_without_managed_proxy_skips_network_seccomp_mode() {
	- line 339: network_seccomp_mode(
	- line 340: NetworkSandboxPolicy::Enabled,


codex-rs/protocol/src/protocol.rs (80 lines):
	- line 41: use crate::models::ActivePermissionProfile;
	- line 48: use crate::models::PermissionProfile;
	- line 105: pub use crate::permissions::FileSystemSandboxPolicy;
	- line 107: pub use crate::permissions::NetworkSandboxPolicy;
	- line 108: pub use crate::permissions::RawFileSystemSandboxPolicy;
	- line 517: pub sandbox_policy: Option<SandboxPolicy>,
	- line 520: pub permission_profile: Option<PermissionProfile>,
	- line 524: pub active_permission_profile: Option<ActivePermissionProfile>,
	- line 1051: pub enum SandboxPolicy {
	- line 1107: pub struct WritableRoot {
	- line 1119: impl WritableRoot {
	- line 1155: impl FromStr for SandboxPolicy {
	- line 1163: impl FromStr for FileSystemSandboxPolicy {
	- line 1167: serde_json::from_str::<RawFileSystemSandboxPolicy>(s)?
	- line 1173: impl FromStr for NetworkSandboxPolicy {
	- line 1181: impl SandboxPolicy {
	- line 1184: SandboxPolicy::ReadOnly {
	- line 1193: SandboxPolicy::WorkspaceWrite {
	- line 1207: SandboxPolicy::DangerFullAccess => true,
	- line 1208: SandboxPolicy::ExternalSandbox { .. } => true,
	- line 1209: SandboxPolicy::ReadOnly { .. } => false,
	- line 1210: SandboxPolicy::WorkspaceWrite { .. } => false,
	- line 1216: SandboxPolicy::DangerFullAccess => true,
	- line 1217: SandboxPolicy::ExternalSandbox { network_access } => network_access.is_enabled(),
	- line 1218: SandboxPolicy::ReadOnly { network_access, .. } => *network_access,
	- line 1219: SandboxPolicy::WorkspaceWrite { network_access, .. } => *network_access,
	- line 1226: pub fn get_writable_roots_with_cwd(&self, cwd: &Path) -> Vec<WritableRoot> {
	- line 1228: SandboxPolicy::DangerFullAccess => Vec::new(),
	- line 1229: SandboxPolicy::ExternalSandbox { .. } => Vec::new(),
	- line 1230: SandboxPolicy::ReadOnly { .. } => Vec::new(),
	- line 1231: SandboxPolicy::WorkspaceWrite {
	- line 1302: WritableRoot {
	- line 2177: pub permission_profile: PermissionProfile,
	- line 2180: pub active_permission_profile: Option<ActivePermissionProfile>,
	- line 3173: pub sandbox_policy: SandboxPolicy,
	- line 3175: pub permission_profile: Option<PermissionProfile>,
	- line 3179: pub active_permission_profile: Option<ActivePermissionProfile>,
	- line 3183: pub file_system_sandbox_policy: Option<RawFileSystemSandboxPolicy>,
	- line 3210: pub fn permission_profile(&self) -> PermissionProfile {
	- line 3217: .unwrap_or_else(|_| Some(FileSystemSandboxPolicy::restricted(Vec::new())))
	- line 3219: FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
	- line 3224: PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 3227: NetworkSandboxPolicy::from(&self.sandbox_policy),
	- line 3843: pub permission_profile: PermissionProfile,
	- line 3849: pub active_permission_profile: Option<ActivePermissionProfile>,
	- line 3899: sandbox_policy: Option<SandboxPolicy>,
	- line 3900: permission_profile: Option<PermissionProfile>,
	- line 3902: active_permission_profile: Option<ActivePermissionProfile>,
	- line 3913: (None, Some(sandbox_policy)) => PermissionProfile::from_legacy_sandbox_policy_for_cwd(
	- line 4381: use crate::permissions::FileSystemSandboxPolicy;
	- line 4383: use crate::permissions::NetworkSandboxPolicy;
	- line 4471: fn sorted_writable_roots(roots: Vec<WritableRoot>) -> Vec<(PathBuf, Vec<PathBuf>)> {
	- line 4488: fn sandbox_policy_allows_read(policy: &SandboxPolicy, _path: &Path, _cwd: &Path) -> bool {
	- line 4492: fn sandbox_policy_allows_write(policy: &SandboxPolicy, path: &Path, cwd: &Path) -> bool {
	- line 4662: fn sandbox_policy_probe_paths(policy: &SandboxPolicy, cwd: &Path) -> Vec<PathBuf> {
	- line 4678: expected: &SandboxPolicy,
	- line 4679: actual: &SandboxPolicy,
	- line 4717: let restricted = SandboxPolicy::ExternalSandbox {
	- line 4723: let enabled = SandboxPolicy::ExternalSandbox {
	- line 4732: let restricted = SandboxPolicy::new_read_only_policy();
	- line 4735: let enabled = SandboxPolicy::ReadOnly {
	- line 4836: let read_only = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 4847: let writable = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 4877: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 4930: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 5001: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 5049: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 5058: .to_legacy_sandbox_policy(NetworkSandboxPolicy::Restricted, cwd)
	- line 5073: SandboxPolicy::DangerFullAccess,
	- line 5074: SandboxPolicy::ExternalSandbox {
	- line 5077: SandboxPolicy::ExternalSandbox {
	- line 5080: SandboxPolicy::ReadOnly {
	- line 5083: SandboxPolicy::WorkspaceWrite {
	- line 5089: SandboxPolicy::WorkspaceWrite {
	- line 5099: FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(&expected, cwd.path())
	- line 5100: .to_legacy_sandbox_policy(NetworkSandboxPolicy::from(&expected), cwd.path())
	- line 5966: sandbox_policy: SandboxPolicy::DangerFullAccess,
	- line 5974: FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 6028: let permission_profile = PermissionProfile::read_only();
	- line 6089: assert_eq!(event.permission_profile, PermissionProfile::read_only());


codex-rs/core/src/config/mod.rs (72 lines):
	- line 36: use codex_config::permissions_toml::PermissionProfileToml;
	- line 112: use codex_protocol::models::ActivePermissionProfile;
	- line 114: use codex_protocol::models::PermissionProfile;
	- line 115: pub use codex_protocol::models::PermissionProfileSnapshot;
	- line 121: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 122: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 126: use codex_protocol::protocol::SandboxPolicy;
	- line 184: pub use codex_sandboxing::system_bwrap_warning;
	- line 188: pub use permission_profile_catalog::PermissionProfileCatalogEntry;
	- line 193: pub use permission_profile_selection::ResolvedPermissionProfileSelection;
	- line 198: pub(crate) use resolved_permission_profile::PermissionProfileState;
	- line 307: permission_profile_state: PermissionProfileState,
	- line 309: managed_deny_read_policy: Option<Arc<FileSystemSandboxPolicy>>,
	- line 338: permission_profile: Constrained<PermissionProfile>,
	- line 342: permission_profile_state: PermissionProfileState::from_constrained_legacy(
	- line 355: pub(crate) fn permission_profile_state(&self) -> &PermissionProfileState {
	- line 361: permission_profile_state: PermissionProfileState,
	- line 373: snapshot: PermissionProfileSnapshot,
	- line 384: snapshot: PermissionProfileSnapshot,
	- line 388: PermissionProfileState::from_constrained_snapshot(permission_profile, snapshot)?;
	- line 394: pub fn permission_profile(&self) -> &PermissionProfile {
	- line 400: permission_profile: &PermissionProfile,
	- line 428: pub fn effective_permission_profile(&self) -> PermissionProfile {
	- line 435: pub fn active_permission_profile(&self) -> Option<ActivePermissionProfile> {
	- line 440: pub fn file_system_sandbox_policy(&self) -> FileSystemSandboxPolicy {
	- line 446: pub fn network_sandbox_policy(&self) -> NetworkSandboxPolicy {
	- line 451: pub fn legacy_sandbox_policy(&self, cwd: &Path) -> SandboxPolicy {
	- line 460: sandbox_policy: &SandboxPolicy,
	- line 464: FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(sandbox_policy, cwd);
	- line 465: let network_sandbox_policy = NetworkSandboxPolicy::from(sandbox_policy);
	- line 466: let permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 478: sandbox_policy: SandboxPolicy,
	- line 483: FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(&sandbox_policy, cwd);
	- line 484: let network_sandbox_policy = NetworkSandboxPolicy::from(&sandbox_policy);
	- line 485: let permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 491: SandboxPolicy::WorkspaceWrite { writable_roots, .. } => {
	- line 503: SandboxPolicy::DangerFullAccess
	- line 504: | SandboxPolicy::ExternalSandbox { .. }
	- line 505: | SandboxPolicy::ReadOnly { .. } => vec![
	- line 517: permission_profile: PermissionProfile,
	- line 527: permission_profile: PermissionProfile,
	- line 528: ) -> PermissionProfile {
	- line 541: PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 552: fn profile_allows_configured_network_proxy(permission_profile: &PermissionProfile) -> bool {
	- line 554: PermissionProfile::Managed { network, .. } | PermissionProfile::External { network } => {
	- line 557: PermissionProfile::Disabled => false,
	- line 564: permission_profile: &PermissionProfile,
	- line 651: pub custom_permission_profiles: Vec<PermissionProfileCatalogEntry>,
	- line 1574: pub fn legacy_sandbox_policy(&self) -> SandboxPolicy {
	- line 1580: sandbox_policy: SandboxPolicy,
	- line 1584: SandboxPolicy::WorkspaceWrite { writable_roots, .. } if !writable_roots.is_empty()
	- line 1753: use_legacy_landlock: self.features.use_legacy_landlock(),
	- line 2439: // concrete `PermissionProfile`.
	- line 2521: file_system_sandbox_policy: &mut FileSystemSandboxPolicy,
	- line 2562: pub permission_profile: Option<PermissionProfile>,
	- line 2992: permission_profile: &PermissionProfile,
	- line 3007: if matches!(permission_profile, PermissionProfile::Disabled)
	- line 3475: // PermissionProfile carries the active network sandbox bit, not the configured
	- line 3541: PermissionProfile::from_runtime_permissions(
	- line 3562: Some(ActivePermissionProfile {
	- line 3580: // paths that still speak `SandboxPolicy`.
	- line 3590: // representable as `SandboxPolicy`. This guard keeps the old safe
	- line 3600: permission_profile = PermissionProfile::read_only();
	- line 3996: && constrained_permission_profile.get() == &PermissionProfile::read_only()
	- line 4045: let mut policy = FileSystemSandboxPolicy::restricted(Vec::new());
	- line 4055: let effective_permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 4116: let permission_profile_state = PermissionProfileState::from_constrained_active_profile(
	- line 4436: PermissionProfile::Disabled
	- line 4448: ) -> std::io::Result<PermissionProfileToml> {
	- line 4472: active_permission_profile: &ActivePermissionProfile,
	- line 4473: permission_profile: &PermissionProfile,
	- line 4531: permission_profile: &PermissionProfile,


codex-rs/app-server-protocol/src/protocol/v2/permissions.rs (60 lines):
	- line 9: use codex_protocol::models::ActivePermissionProfile as CoreActivePermissionProfile;
	- line 10: use codex_protocol::models::AdditionalPermissionProfile as CoreAdditionalPermissionProfile;
	- line 20: use codex_protocol::request_permissions::RequestPermissionProfile as CoreRequestPermissionProfile;
	- line 219: pub struct RequestPermissionProfile {
	- line 225: impl From<CoreRequestPermissionProfile> for RequestPermissionProfile {
	- line 226: fn from(value: CoreRequestPermissionProfile) -> Self {
	- line 234: impl TryFrom<RequestPermissionProfile> for CoreRequestPermissionProfile {
	- line 237: fn try_from(value: RequestPermissionProfile) -> Result<Self, Self::Error> {
	- line 391: pub struct PermissionProfileListParams {
	- line 406: pub struct PermissionProfileSummary {
	- line 418: pub struct PermissionProfileListResponse {
	- line 419: pub data: Vec<PermissionProfileSummary>,
	- line 428: pub struct ActivePermissionProfile {
	- line 438: impl ActivePermissionProfile {
	- line 447: CoreActivePermissionProfile::read_only().into()
	- line 451: impl From<CoreActivePermissionProfile> for ActivePermissionProfile {
	- line 452: fn from(value: CoreActivePermissionProfile) -> Self {
	- line 460: impl From<ActivePermissionProfile> for CoreActivePermissionProfile {
	- line 461: fn from(value: ActivePermissionProfile) -> Self {
	- line 472: pub struct AdditionalPermissionProfile {
	- line 479: impl From<CoreAdditionalPermissionProfile> for AdditionalPermissionProfile {
	- line 480: fn from(value: CoreAdditionalPermissionProfile) -> Self {
	- line 488: impl TryFrom<AdditionalPermissionProfile> for CoreAdditionalPermissionProfile {
	- line 491: fn try_from(value: AdditionalPermissionProfile) -> Result<Self, Self::Error> {
	- line 505: pub struct GrantedPermissionProfile {
	- line 514: impl TryFrom<GrantedPermissionProfile> for CoreAdditionalPermissionProfile {
	- line 517: fn try_from(value: GrantedPermissionProfile) -> Result<Self, Self::Error> {
	- line 541: pub enum SandboxPolicy {
	- line 571: enum SandboxPolicyDeserialize {
	- line 607: impl<'de> Deserialize<'de> for SandboxPolicy {
	- line 612: match SandboxPolicyDeserialize::deserialize(deserializer)? {
	- line 613: SandboxPolicyDeserialize::DangerFullAccess => Ok(SandboxPolicy::DangerFullAccess),
	- line 614: SandboxPolicyDeserialize::ReadOnly {
	- line 623: Ok(SandboxPolicy::ReadOnly { network_access })
	- line 625: SandboxPolicyDeserialize::ExternalSandbox { network_access } => {
	- line 626: Ok(SandboxPolicy::ExternalSandbox { network_access })
	- line 628: SandboxPolicyDeserialize::WorkspaceWrite {
	- line 640: Ok(SandboxPolicy::WorkspaceWrite {
	- line 651: impl SandboxPolicy {
	- line 652: pub fn to_core(&self) -> codex_protocol::protocol::SandboxPolicy {
	- line 654: SandboxPolicy::DangerFullAccess => {
	- line 655: codex_protocol::protocol::SandboxPolicy::DangerFullAccess
	- line 657: SandboxPolicy::ReadOnly { network_access } => {
	- line 658: codex_protocol::protocol::SandboxPolicy::ReadOnly {
	- line 662: SandboxPolicy::ExternalSandbox { network_access } => {
	- line 663: codex_protocol::protocol::SandboxPolicy::ExternalSandbox {
	- line 670: SandboxPolicy::WorkspaceWrite {
	- line 675: } => codex_protocol::protocol::SandboxPolicy::WorkspaceWrite {
	- line 685: impl From<codex_protocol::protocol::SandboxPolicy> for SandboxPolicy {
	- line 686: fn from(value: codex_protocol::protocol::SandboxPolicy) -> Self {
	- line 688: codex_protocol::protocol::SandboxPolicy::DangerFullAccess => {
	- line 689: SandboxPolicy::DangerFullAccess
	- line 691: codex_protocol::protocol::SandboxPolicy::ReadOnly { network_access } => {
	- line 692: SandboxPolicy::ReadOnly { network_access }
	- line 694: codex_protocol::protocol::SandboxPolicy::ExternalSandbox { network_access } => {
	- line 695: SandboxPolicy::ExternalSandbox {
	- line 702: codex_protocol::protocol::SandboxPolicy::WorkspaceWrite {
	- line 707: } => SandboxPolicy::WorkspaceWrite {
	- line 784: pub permissions: RequestPermissionProfile,
	- line 800: pub permissions: GrantedPermissionProfile,


codex-rs/sandboxing/src/manager.rs (56 lines):
	- line 2: use crate::bwrap::WSL1_BWRAP_WARNING;
	- line 4: use crate::bwrap::is_wsl1;
	- line 5: use crate::landlock::CODEX_LINUX_SANDBOX_ARG0;
	- line 6: use crate::landlock::allow_network_for_proxy;
	- line 7: use crate::landlock::create_linux_sandbox_command_args_for_permission_profile;
	- line 13: use crate::resolve_windows_restricted_token_filesystem_overrides;
	- line 15: use crate::seatbelt::MacosSeatbeltProfile;
	- line 21: use codex_protocol::models::AdditionalPermissionProfile;
	- line 22: use codex_protocol::models::PermissionProfile;
	- line 23: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 24: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 25: use codex_protocol::protocol::SandboxPolicy;
	- line 48: SandboxType::MacosSeatbelt => "seatbelt",
	- line 49: SandboxType::LinuxSeccomp => "seccomp",
	- line 79: permission_profile: PermissionProfile,
	- line 82: ) -> PermissionProfile {
	- line 92: PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 106: pub additional_permissions: Option<AdditionalPermissionProfile>,
	- line 126: pub permission_profile: PermissionProfile,
	- line 135: pub permissions: &'a PermissionProfile,
	- line 146: pub use_legacy_landlock: bool,
	- line 166: effective_permission_profile: PermissionProfile,
	- line 173: effective_permission_profile: PermissionProfile,
	- line 184: SandboxTransformError::InvalidSandboxPolicyCwd {
	- line 208: InvalidSandboxPolicyCwd {
	- line 233: Self::InvalidSandboxPolicyCwd { cwd, source } => write!(
	- line 250: Self::SeatbeltUnavailable => write!(f, "seatbelt sandbox is only available on macOS"),
	- line 263: | Self::InvalidSandboxPolicyCwd { source, .. } => Some(source),
	- line 281: seatbelt_profile: MacosSeatbeltProfile,
	- line 293: seatbelt_profile: MacosSeatbeltProfile::FileSystemHelper,
	- line 299: permission_profile: &PermissionProfile,
	- line 316: permission_profile: &PermissionProfile,
	- line 348: use_legacy_landlock,
	- line 373: use crate::seatbelt::CreateSeatbeltCommandArgsParams;
	- line 374: use crate::seatbelt::MACOS_PATH_TO_SEATBELT_EXECUTABLE;
	- line 375: use crate::seatbelt::SeatbeltPreparationError;
	- line 376: use crate::seatbelt::create_seatbelt_command_args_with_profile;
	- line 382: let mut args = create_seatbelt_command_args_with_profile(
	- line 394: self.seatbelt_profile,
	- line 417: ensure_linux_bubblewrap_is_supported(
	- line 421: use_legacy_landlock,
	- line 430: use_legacy_landlock,
	- line 543: SandboxTransformError::InvalidSandboxPolicyCwd {
	- line 581: resolve_windows_restricted_token_filesystem_overrides(
	- line 658: permissions: &PermissionProfile,
	- line 660: ) -> SandboxPolicy {
	- line 670: file_system_policy: FileSystemSandboxPolicy,
	- line 671: network_policy: NetworkSandboxPolicy,
	- line 673: ) -> SandboxPolicy {
	- line 692: SandboxPolicy::WorkspaceWrite {
	- line 701: fn ensure_linux_bubblewrap_is_supported(
	- line 702: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 703: use_legacy_landlock: bool,
	- line 707: let requires_bubblewrap = allow_network_for_proxy
	- line 708: || (!use_legacy_landlock && !file_system_sandbox_policy.has_full_disk_write_access());
	- line 709: if is_wsl1 && requires_bubblewrap {


codex-rs/tui/src/app_server_session.rs (53 lines):
	- line 128: use codex_protocol::models::ActivePermissionProfile;
	- line 130: use codex_protocol::models::PermissionProfile;
	- line 368: ActiveProfile(ActivePermissionProfile),
	- line 370: LegacySandbox(PermissionProfile),
	- line 377: pub(crate) struct UnsupportedLegacyPermissionProfile;
	- line 1770: permission_profile: &PermissionProfile,
	- line 1774: PermissionProfile::Disabled => {
	- line 1777: PermissionProfile::External { .. } => None,
	- line 1778: PermissionProfile::Managed { .. } => {
	- line 1795: permission_profile: &PermissionProfile,
	- line 1802: codex_app_server_protocol::SandboxMode::ReadOnly => PermissionProfile::read_only(),
	- line 1804: PermissionProfile::from_legacy_sandbox_policy_for_cwd(
	- line 1805: &codex_protocol::protocol::SandboxPolicy::new_workspace_write_policy(),
	- line 1809: codex_app_server_protocol::SandboxMode::DangerFullAccess => PermissionProfile::Disabled,
	- line 1817: fn permission_profile_id_from_active_profile(active: ActivePermissionProfile) -> String {
	- line 1825: Option<codex_app_server_protocol::SandboxPolicy>,
	- line 1839: .map_err(|_| UnsupportedLegacyPermissionProfile)?;
	- line 1841: PermissionProfile::from_legacy_sandbox_policy_for_cwd(&policy, cwd);
	- line 1846: return Err(UnsupportedLegacyPermissionProfile.into());
	- line 2116: PermissionProfile::from_legacy_sandbox_policy_for_cwd(
	- line 2182: sandbox: &codex_app_server_protocol::SandboxPolicy,
	- line 2186: ) -> PermissionProfile {
	- line 2191: PermissionProfile::Disabled
	- line 2194: codex_app_server_protocol::SandboxPolicy::DangerFullAccess
	- line 2197: PermissionProfile::from_legacy_sandbox_policy_for_cwd(&sandbox.to_core(), cwd)
	- line 2201: PermissionProfile::from_legacy_sandbox_policy_for_cwd(&sandbox.to_core(), cwd)
	- line 2220: permission_profile: PermissionProfile,
	- line 2221: active_permission_profile: Option<ActivePermissionProfile>,
	- line 2310: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 2656: NetworkSandboxPolicy::Restricted,
	- line 2724: ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE);
	- line 2742: ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE);
	- line 2774: TurnPermissionsOverride::LegacySandbox(PermissionProfile::read_only()),
	- line 2781: Some(codex_app_server_protocol::SandboxPolicy::ReadOnly {
	- line 2793: TurnPermissionsOverride::LegacySandbox(PermissionProfile::workspace_write()),
	- line 2800: Some(codex_app_server_protocol::SandboxPolicy::WorkspaceWrite {
	- line 2814: let permission_profile = PermissionProfile::Managed {
	- line 2815: network: NetworkSandboxPolicy::Restricted,
	- line 2872: let mut permission_profile = PermissionProfile::workspace_write();
	- line 2873: let PermissionProfile::Managed {
	- line 2894: .downcast_ref::<UnsupportedLegacyPermissionProfile>()
	- line 2903: let active_permission_profile = ActivePermissionProfile::new("strict");
	- line 3006: let permission_profile: PermissionProfile = PermissionProfile::Managed {
	- line 3007: network: NetworkSandboxPolicy::Restricted,
	- line 3040: let permission_profile: PermissionProfile = PermissionProfile::Managed {
	- line 3041: network: NetworkSandboxPolicy::Restricted,
	- line 3615: let read_only_profile = PermissionProfile::read_only();
	- line 3752: let sandbox = PermissionProfile::read_only()
	- line 3764: PermissionProfile::read_only()
	- line 3784: &codex_app_server_protocol::SandboxPolicy::DangerFullAccess,
	- line 3789: PermissionProfile::read_only()
	- line 3819: PermissionProfile::read_only(),
	- line 3854: PermissionProfile::read_only(),


codex-rs/tui/src/status/tests.rs (51 lines):
	- line 15: use crate::legacy_core::config::PermissionProfileSnapshot;
	- line 44: use codex_protocol::models::ActivePermissionProfile;
	- line 47: use codex_protocol::models::PermissionProfile;
	- line 53: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 90: fn app_server_workspace_write_profile(network_enabled: bool) -> PermissionProfile {
	- line 91: PermissionProfile::Managed {
	- line 93: NetworkSandboxPolicy::Enabled
	- line 95: NetworkSandboxPolicy::Restricted
	- line 290: .set_permission_profile(PermissionProfile::workspace_write())
	- line 453: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
	- line 454: PermissionProfile::read_only(),
	- line 455: ActivePermissionProfile::read_only(),
	- line 475: let file_system_policy = PermissionProfile::read_only()
	- line 480: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
	- line 481: PermissionProfile::from_runtime_permissions(
	- line 483: NetworkSandboxPolicy::Restricted,
	- line 485: ActivePermissionProfile::read_only(),
	- line 506: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
	- line 507: PermissionProfile::workspace_write(),
	- line 508: ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE),
	- line 530: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
	- line 531: PermissionProfile::workspace_write(),
	- line 532: ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE),
	- line 554: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
	- line 555: PermissionProfile::workspace_write_with(
	- line 557: NetworkSandboxPolicy::Restricted,
	- line 561: ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE),
	- line 588: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
	- line 589: PermissionProfile::workspace_write(),
	- line 590: ActivePermissionProfile::new(":workspace"),
	- line 617: PermissionProfileSnapshot::active_with_profile_workspace_roots(
	- line 618: PermissionProfile::workspace_write_with(
	- line 620: NetworkSandboxPolicy::Restricted,
	- line 624: ActivePermissionProfile::new(":workspace"),
	- line 650: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
	- line 651: PermissionProfile::workspace_write_with(
	- line 653: NetworkSandboxPolicy::Enabled,
	- line 657: ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE),
	- line 673: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
	- line 674: PermissionProfile::read_only(),
	- line 675: ActivePermissionProfile::new("locked"),
	- line 693: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
	- line 694: PermissionProfile::read_only(),
	- line 695: ActivePermissionProfile::new("locked"),
	- line 849: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
	- line 850: PermissionProfile::workspace_write(),
	- line 851: ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE),
	- line 899: .set_permission_profile(PermissionProfile::Managed {
	- line 900: network: NetworkSandboxPolicy::Enabled,
	- line 922: .set_permission_profile(PermissionProfile::Managed {
	- line 923: network: NetworkSandboxPolicy::Restricted,


codex-rs/sandboxing/src/seatbelt.rs (51 lines):
	- line 6: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 7: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 9: use codex_protocol::protocol::SandboxPolicy;
	- line 10: use codex_protocol::protocol::WritableRoot;
	- line 21: const MACOS_SEATBELT_BASE_POLICY: &str = include_str!("seatbelt_base_policy.sbpl");
	- line 22: const MACOS_SEATBELT_NETWORK_POLICY: &str = include_str!("seatbelt_network_policy.sbpl");
	- line 23: const MACOS_SEATBELT_PREFERENCES_POLICY: &str = include_str!("seatbelt_preferences_policy.sbpl");
	- line 25: include_str!("seatbelt_read_only_platform_defaults.sbpl");
	- line 296: sandbox_policy: &SandboxPolicy,
	- line 301: NetworkSandboxPolicy::from(sandbox_policy),
	- line 308: network_policy: NetworkSandboxPolicy,
	- line 398: enum NormalizedWritableRoot {
	- line 450: ) -> Result<NormalizedWritableRoot, SeatbeltPreparationError> {
	- line 467: return Ok(NormalizedWritableRoot::Subpath(normalized));
	- line 477: return Ok(NormalizedWritableRoot::Subpath(normalized));
	- line 480: Ok(NormalizedWritableRoot::Literal(normalized))
	- line 483: fn build_seatbelt_access_policy(
	- line 504: NormalizedWritableRoot::Subpath(root) => (root, SeatbeltPathMatch::Subpath),
	- line 505: NormalizedWritableRoot::Literal(root) => (root, SeatbeltPathMatch::Literal),
	- line 567: seatbelt_protected_metadata_name_regex(&root, &metadata_name).replace('"', "\\\"");
	- line 585: fn seatbelt_protected_metadata_name_regex(root: &AbsolutePathBuf, name: &str) -> String {
	- line 600: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 601: writable_root: &WritableRoot,
	- line 617: fn build_seatbelt_unreadable_glob_policy(
	- line 618: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 636: let Some(regex) = seatbelt_regex_for_unreadable_glob(&pattern) else {
	- line 645: .and_then(|path| seatbelt_regex_for_glob(path, GlobMatch::Exact))
	- line 692: fn seatbelt_regex_for_unreadable_glob(pattern: &str) -> Option<String> {
	- line 693: seatbelt_regex_for_glob(pattern, GlobMatch::Subtree)
	- line 696: fn seatbelt_regex_for_glob(pattern: &str, glob_match: GlobMatch) -> Option<String> {
	- line 807: fn create_seatbelt_command_args_for_legacy_policy(
	- line 809: sandbox_policy: &SandboxPolicy,
	- line 814: let file_system_sandbox_policy = FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
	- line 818: create_seatbelt_command_args(CreateSeatbeltCommandArgsParams {
	- line 821: network_sandbox_policy: NetworkSandboxPolicy::from(sandbox_policy),
	- line 834: pub file_system_sandbox_policy: &'a FileSystemSandboxPolicy,
	- line 835: pub network_sandbox_policy: NetworkSandboxPolicy,
	- line 844: pub fn create_seatbelt_command_args(
	- line 847: create_seatbelt_command_args_with_profile(args, MacosSeatbeltProfile::Process)
	- line 851: pub(crate) fn create_seatbelt_command_args_with_profile(
	- line 904: build_seatbelt_access_policy(
	- line 914: build_seatbelt_access_policy(
	- line 939: let (policy, params) = build_seatbelt_access_policy(
	- line 953: let (policy, params) = build_seatbelt_access_policy(
	- line 991: build_seatbelt_unreadable_glob_policy(file_system_sandbox_policy, sandbox_policy_cwd);
	- line 1029: let mut seatbelt_args: Vec<String> = vec!["-p".to_string(), full_policy];
	- line 1035: seatbelt_args.extend(definition_args);
	- line 1036: seatbelt_args.push("--".to_string());
	- line 1037: seatbelt_args.extend(command);
	- line 1038: Ok(seatbelt_args)
	- line 1042: #[path = "seatbelt_tests.rs"]


codex-rs/tui/src/app/tests.rs (38 lines):
	- line 71: use crate::legacy_core::config::PermissionProfileSnapshot;
	- line 76: use codex_app_server_protocol::AdditionalPermissionProfile;
	- line 129: use codex_protocol::models::ActivePermissionProfile;
	- line 132: use codex_protocol::models::PermissionProfile;
	- line 143: use codex_protocol::request_permissions::RequestPermissionProfile;
	- line 357: let permission_profile = PermissionProfile::workspace_write_with(
	- line 359: codex_protocol::permissions::NetworkSandboxPolicy::Restricted,
	- line 364: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::legacy(
	- line 2788: app.harness_overrides.permission_profile = Some(PermissionProfile::workspace_write());
	- line 2791: app.apply_permission_profile_selection(PermissionProfileSelection {
	- line 2819: Some(RuntimePermissionProfileOverride::from_config(&app.config))
	- line 2917: Some(RuntimePermissionProfileOverride::from_config(&app.config))
	- line 2985: .set_permission_profile(PermissionProfile::workspace_write())?;
	- line 2989: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::legacy(
	- line 2990: PermissionProfile::workspace_write(),
	- line 3268: permission_profile: PermissionProfile::workspace_write(),
	- line 3429: permission_profile: PermissionProfile::workspace_write(),
	- line 3504: params.additional_permissions = Some(AdditionalPermissionProfile {
	- line 3537: Some(AdditionalPermissionProfile {
	- line 3803: permissions: codex_app_server_protocol::RequestPermissionProfile {
	- line 3828: RequestPermissionProfile {
	- line 3938: permission_profile: PermissionProfile::workspace_write(),
	- line 3993: permission_profile: PermissionProfile::workspace_write(),
	- line 4105: permission_profile: PermissionProfile::workspace_write(),
	- line 4173: /// server-authored `PermissionProfile`, so it must not reuse the cached primary
	- line 4185: permission_profile: PermissionProfile::workspace_write(),
	- line 4349: let parent_permission_profile = PermissionProfile::workspace_write();
	- line 4358: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::legacy(
	- line 5293: permission_profile: PermissionProfile::read_only(),
	- line 5802: permission_profile: PermissionProfile::read_only(),
	- line 6639: permission_profile: PermissionProfile::read_only(),
	- line 6710: permission_profile: PermissionProfile::read_only(),
	- line 7784: permission_profile: PermissionProfile::read_only(),
	- line 7927: Some(ActivePermissionProfile::new(
	- line 8117: app.apply_permission_profile_selection(PermissionProfileSelection {
	- line 8410: sandbox_policy: codex_app_server_protocol::SandboxPolicy::ReadOnly {
	- line 8414: codex_app_server_protocol::ActivePermissionProfile::read_only(),
	- line 8485: permission_profile: PermissionProfile::read_only(),


codex-rs/sandboxing/src/policy_transforms.rs (36 lines):
	- line 1: use codex_protocol::models::AdditionalPermissionProfile;
	- line 4: use codex_protocol::models::PermissionProfile;
	- line 9: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 11: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 21: additional_permissions: AdditionalPermissionProfile,
	- line 22: ) -> Result<AdditionalPermissionProfile, String> {
	- line 70: Ok(AdditionalPermissionProfile {
	- line 80: mut additional_permissions: AdditionalPermissionProfile,
	- line 82: ) -> Result<AdditionalPermissionProfile, String> {
	- line 92: base: Option<&AdditionalPermissionProfile>,
	- line 93: permissions: Option<&AdditionalPermissionProfile>,
	- line 94: ) -> Option<AdditionalPermissionProfile> {
	- line 135: Some(AdditionalPermissionProfile {
	- line 146: requested: AdditionalPermissionProfile,
	- line 147: granted: AdditionalPermissionProfile,
	- line 149: ) -> AdditionalPermissionProfile {
	- line 155: FileSystemSandboxPolicy::restricted(requested_file_system.entries.clone());
	- line 211: AdditionalPermissionProfile {
	- line 261: requested_policy: &FileSystemSandboxPolicy,
	- line 454: file_system_policy: &FileSystemSandboxPolicy,
	- line 456: ) -> FileSystemSandboxPolicy {
	- line 480: file_system_policy: &FileSystemSandboxPolicy,
	- line 481: additional_permissions: Option<&AdditionalPermissionProfile>,
	- line 482: ) -> FileSystemSandboxPolicy {
	- line 502: additional_permissions: &AdditionalPermissionProfile,
	- line 513: network_policy: NetworkSandboxPolicy,
	- line 514: additional_permissions: Option<&AdditionalPermissionProfile>,
	- line 515: ) -> NetworkSandboxPolicy {
	- line 519: NetworkSandboxPolicy::Enabled
	- line 521: NetworkSandboxPolicy::Restricted
	- line 528: permission_profile: &PermissionProfile,
	- line 529: additional_permissions: Option<&AdditionalPermissionProfile>,
	- line 530: ) -> PermissionProfile {
	- line 536: PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 544: file_system_policy: &FileSystemSandboxPolicy,
	- line 545: network_policy: NetworkSandboxPolicy,


codex-rs/cli/src/debug_sandbox.rs (35 lines):
	- line 5: mod seatbelt;
	- line 23: use codex_protocol::models::PermissionProfile;
	- line 25: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 26: use codex_sandboxing::landlock::allow_network_for_proxy;
	- line 27: use codex_sandboxing::landlock::create_linux_sandbox_command_args_for_permission_profile;
	- line 29: use codex_sandboxing::seatbelt::CreateSeatbeltCommandArgsParams;
	- line 31: use codex_sandboxing::seatbelt::create_seatbelt_command_args;
	- line 39: use crate::LandlockCommand;
	- line 45: use seatbelt::DenialLogger;
	- line 48: pub async fn run_command_under_seatbelt(
	- line 87: pub async fn run_command_under_seatbelt(
	- line 95: pub async fn run_command_under_landlock(
	- line 96: command: LandlockCommand,
	- line 100: let LandlockCommand {
	- line 124: SandboxType::Landlock,
	- line 170: Landlock,
	- line 266: PermissionProfile::External { .. } => {
	- line 271: PermissionProfile::read_only()
	- line 277: if matches!(permission_profile, PermissionProfile::Disabled) && sandbox_state_disable_network {
	- line 282: if !matches!(permission_profile, PermissionProfile::Disabled)
	- line 289: NetworkSandboxPolicy::Restricted
	- line 293: permission_profile = PermissionProfile::from_runtime_permissions(&file_system, network);
	- line 295: let use_legacy_landlock = sandbox_state.as_ref().map_or_else(
	- line 296: || config.features.use_legacy_landlock(),
	- line 297: |state| state.use_legacy_landlock,
	- line 383: let args = create_seatbelt_command_args(CreateSeatbeltCommandArgsParams {
	- line 403: env_map.insert(CODEX_SANDBOX_ENV_VAR.to_string(), "seatbelt".to_string());
	- line 411: SandboxType::Landlock => {
	- line 422: use_legacy_landlock,
	- line 459: for seatbelt::SandboxDenial { name, capability } in denials {
	- line 471: permission_profile: &PermissionProfile,
	- line 524: network_sandbox_policy: NetworkSandboxPolicy,
	- line 1025: let expected = codex_protocol::models::PermissionProfile::workspace_write()
	- line 1070: NetworkSandboxPolicy::Enabled,
	- line 1114: NetworkSandboxPolicy::Restricted,


codex-rs/file-system/src/lib.rs (35 lines):
	- line 7: use codex_protocol::models::PermissionProfile;
	- line 14: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 15: use codex_protocol::permissions::FileSystemSandboxPolicyContext;
	- line 17: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 18: use codex_protocol::protocol::SandboxPolicy;
	- line 283: pub enum ExecPermissionProfile {
	- line 286: network: NetworkSandboxPolicy,
	- line 290: network: NetworkSandboxPolicy,
	- line 294: impl From<PermissionProfile> for ExecPermissionProfile {
	- line 295: fn from(value: PermissionProfile) -> Self {
	- line 297: PermissionProfile::Managed {
	- line 304: PermissionProfile::Disabled => Self::Disabled,
	- line 305: PermissionProfile::External { network } => Self::External { network },
	- line 310: impl TryFrom<ExecPermissionProfile> for PermissionProfile {
	- line 313: fn try_from(value: ExecPermissionProfile) -> Result<Self, Self::Error> {
	- line 315: ExecPermissionProfile::Managed {
	- line 322: ExecPermissionProfile::Disabled => Self::Disabled,
	- line 323: ExecPermissionProfile::External { network } => Self::External { network },
	- line 331: pub permissions: ExecPermissionProfile,
	- line 348: pub use_legacy_landlock: bool,
	- line 353: sandbox_policy: SandboxPolicy,
	- line 360: FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
	- line 364: let permissions = PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 367: NetworkSandboxPolicy::from(&sandbox_policy),
	- line 372: pub fn from_permission_profile(permissions: PermissionProfile) -> Self {
	- line 376: pub fn from_permission_profile_with_cwd(permissions: PermissionProfile, cwd: PathUri) -> Self {
	- line 380: fn from_permissions_and_cwd(permissions: PermissionProfile, cwd: Option<PathUri>) -> Self {
	- line 391: use_legacy_landlock: false,
	- line 396: let Ok(permissions) = PermissionProfile::try_from(self.permissions.clone()) else {
	- line 408: pub fn policy_context(&self) -> Option<FileSystemSandboxPolicyContext<'_>> {
	- line 409: Some(FileSystemSandboxPolicyContext {
	- line 419: ExecPermissionProfile::Managed {
	- line 429: ExecPermissionProfile::Managed {
	- line 433: | ExecPermissionProfile::Disabled
	- line 434: | ExecPermissionProfile::External { .. } => false,


codex-rs/linux-sandbox/src/bundled_bwrap.rs (33 lines):
	- line 12: use crate::bazel_bwrap;
	- line 37: let bwrap_file = File::open(self.program.as_path()).unwrap_or_else(|err| {
	- line 39: "failed to open bundled bubblewrap {}: {err}",
	- line 43: if let Err(err) = verify_digest(&bwrap_file, expected_sha256(), self.program.as_path()) {
	- line 50: let fd_path = format!("/proc/self/fd/{}", bwrap_file.as_raw_fd());
	- line 52: .unwrap_or_else(|err| panic!("invalid bundled bubblewrap fd path: {err}"));
	- line 68: "failed to exec bundled bubblewrap {} via {fd_path}: {err}",
	- line 76: .bundled_resource("bwrap")
	- line 87: "failed to normalize bundled bubblewrap path {}: {err}",
	- line 100: candidates.push(exe_dir.join("codex-resources").join("bwrap"));
	- line 102: candidates.push(package_target_dir.join("codex-resources").join("bwrap"));
	- line 104: candidates.push(exe_dir.join("bwrap"));
	- line 105: if let Some(path) = bazel_bwrap::candidate() {
	- line 135: .map_err(|err| format!("failed to clone bundled bubblewrap fd: {err}"))?;
	- line 141: "failed to read bundled bubblewrap {} for digest verification: {err}",
	- line 157: "bundled bubblewrap digest mismatch for {}: expected sha256:{}, got sha256:{}",
	- line 203: fn finds_package_layout_bwrap_from_install_context() {
	- line 208: let expected_bwrap = resources_dir.join("bwrap");
	- line 210: write_executable(&expected_bwrap);
	- line 226: Some(AbsolutePathBuf::from_absolute_path(&expected_bwrap).expect("absolute"))
	- line 231: fn finds_legacy_standalone_bundled_bwrap_next_to_exe_resources() {
	- line 234: let expected_bwrap = temp_dir.path().join("codex-resources").join("bwrap");
	- line 236: write_executable(&expected_bwrap);
	- line 240: Some(AbsolutePathBuf::from_absolute_path(&expected_bwrap).expect("absolute"))
	- line 245: fn finds_npm_bundled_bwrap_next_to_target_vendor_dir() {
	- line 249: let expected_bwrap = target_dir.join("codex-resources").join("bwrap");
	- line 251: write_executable(&expected_bwrap);
	- line 255: Some(AbsolutePathBuf::from_absolute_path(&expected_bwrap).expect("absolute"))
	- line 260: fn finds_adjacent_dev_bwrap() {
	- line 263: let expected_bwrap = temp_dir.path().join("bwrap");
	- line 265: write_executable(&expected_bwrap);
	- line 269: Some(AbsolutePathBuf::from_absolute_path(&expected_bwrap).expect("absolute"))
	- line 299: assert!(err.contains("bundled bubblewrap digest mismatch"));


codex-rs/app-server/src/bespoke_event_handling.rs (32 lines):
	- line 16: use codex_app_server_protocol::AdditionalPermissionProfile as V2AdditionalPermissionProfile;
	- line 34: use codex_app_server_protocol::GrantedPermissionProfile as V2GrantedPermissionProfile;
	- line 100: use codex_protocol::models::AdditionalPermissionProfile as CoreAdditionalPermissionProfile;
	- line 115: use codex_protocol::request_permissions::RequestPermissionProfile as CoreRequestPermissionProfile;
	- line 746: additional_permissions.map(V2AdditionalPermissionProfile::from);
	- line 1911: requested_permissions: CoreRequestPermissionProfile,
	- line 1920: requested_permissions: CoreRequestPermissionProfile,
	- line 1949: permissions: V2GrantedPermissionProfile::default(),
	- line 1968: let granted_permissions: CoreAdditionalPermissionProfile = response.permissions.try_into()?;
	- line 1970: CoreRequestPermissionProfile::default()
	- line 2195: use codex_protocol::models::PermissionProfile;
	- line 2309: permission_profile: PermissionProfile::read_only(),
	- line 3026: CoreRequestPermissionProfile::default(),
	- line 3055: let requested_permissions = CoreRequestPermissionProfile {
	- line 3067: CoreRequestPermissionProfile::default(),
	- line 3075: CoreRequestPermissionProfile {
	- line 3079: ..CoreRequestPermissionProfile::default()
	- line 3088: CoreRequestPermissionProfile {
	- line 3093: ..CoreRequestPermissionProfile::default()
	- line 3106: CoreRequestPermissionProfile {
	- line 3111: ..CoreRequestPermissionProfile::default()
	- line 3142: CoreRequestPermissionProfile::default(),
	- line 3155: permissions: CoreRequestPermissionProfile::default(),
	- line 3165: CoreRequestPermissionProfile::default(),
	- line 3183: permissions: CoreRequestPermissionProfile::default(),
	- line 3193: CoreRequestPermissionProfile {
	- line 3221: let requested_permissions = CoreRequestPermissionProfile {
	- line 3251: CoreRequestPermissionProfile {
	- line 3269: let requested_permissions = CoreRequestPermissionProfile {
	- line 3299: CoreRequestPermissionProfile::default()
	- line 3308: let requested_permissions = CoreRequestPermissionProfile {
	- line 3341: CoreRequestPermissionProfile::default()


codex-rs/windows-sandbox-rs/src/resolved_permissions.rs (31 lines):
	- line 2: use codex_protocol::models::PermissionProfile;
	- line 6: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 8: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 18: /// `PermissionProfile` enum itself.
	- line 21: file_system: FileSystemSandboxPolicy,
	- line 22: network: NetworkSandboxPolicy,
	- line 26: pub(crate) struct WindowsWritableRoot {
	- line 35: WritableRootsCapability,
	- line 40: permission_profile: &PermissionProfile,
	- line 58: Ok(WindowsSandboxTokenMode::WritableRootsCapability)
	- line 63: pub fn try_from_permission_profile(permission_profile: &PermissionProfile) -> Result<Self> {
	- line 64: if !matches!(permission_profile, PermissionProfile::Managed { .. }) {
	- line 84: permission_profile: &PermissionProfile,
	- line 98: pub(crate) fn network_policy(&self) -> NetworkSandboxPolicy {
	- line 144: ) -> Vec<WindowsWritableRoot> {
	- line 161: .map(|root| WindowsWritableRoot {
	- line 173: WindowsWritableRoot {
	- line 239: &PermissionProfile::workspace_write(),
	- line 265: let permission_profile = PermissionProfile::Managed {
	- line 276: network: NetworkSandboxPolicy::Restricted,
	- line 305: let permission_profile = PermissionProfile::Managed {
	- line 332: network: NetworkSandboxPolicy::Restricted,
	- line 344: FileSystemSandboxPolicy::restricted(vec![
	- line 409: &PermissionProfile::read_only(),
	- line 427: &PermissionProfile::workspace_write(),
	- line 434: assert_eq!(WindowsSandboxTokenMode::WritableRootsCapability, token_mode);
	- line 440: &PermissionProfile::Disabled,
	- line 452: let permission_profile = PermissionProfile::Managed {
	- line 454: network: NetworkSandboxPolicy::Restricted,
	- line 472: let permission_profile = PermissionProfile::Managed {
	- line 483: network: NetworkSandboxPolicy::Restricted,


codex-rs/core/src/session/mod.rs (28 lines):
	- line 110: use codex_protocol::models::ActivePermissionProfile;
	- line 111: use codex_protocol::models::AdditionalPermissionProfile;
	- line 117: use codex_protocol::models::PermissionProfile;
	- line 121: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 122: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 146: use codex_protocol::request_permissions::RequestPermissionProfile;
	- line 199: use crate::config::PermissionProfileSnapshot;
	- line 200: use crate::config::PermissionProfileState;
	- line 354: use codex_protocol::protocol::SandboxPolicy;
	- line 635: SandboxPolicy::DangerFullAccess
	- line 637: let permission_profile = PermissionProfile::workspace_write();
	- line 739: use_legacy_landlock: config.features.use_legacy_landlock(),
	- line 989: ) -> CodexResult<PermissionProfileState> {
	- line 1050: permission_profile: &PermissionProfile,
	- line 1052: !matches!(permission_profile, PermissionProfile::Disabled)
	- line 1086: permission_profile: &PermissionProfile,
	- line 2554: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 2691: permissions: RequestPermissionProfile::default(),
	- line 2700: permissions: RequestPermissionProfile::default(),
	- line 2718: permissions: RequestPermissionProfile::default(),
	- line 2776: permissions: RequestPermissionProfile::default(),
	- line 2785: permissions: RequestPermissionProfile::default(),
	- line 2959: permissions: RequestPermissionProfile::default(),
	- line 2980: requested_permissions: RequestPermissionProfile,
	- line 2986: permissions: RequestPermissionProfile::default(),
	- line 3021: let permissions: AdditionalPermissionProfile =
	- line 3046: ) -> Option<AdditionalPermissionProfile> {
	- line 3072: ) -> Option<AdditionalPermissionProfile> {


codex-rs/exec-server/src/fs_sandbox.rs (28 lines):
	- line 6: use codex_protocol::models::PermissionProfile;
	- line 10: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 12: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 47: "CARGO_BIN_EXE_bwrap",
	- line 96: let native_permissions: PermissionProfile =
	- line 103: let helper_read_roots = if sandbox.use_legacy_landlock {
	- line 114: let network_policy = NetworkSandboxPolicy::Restricted;
	- line 115: let permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 125: permission_profile: &PermissionProfile,
	- line 165: use_legacy_landlock: sandbox_context.use_legacy_landlock,
	- line 219: file_system_policy: &mut FileSystemSandboxPolicy,
	- line 247: fn normalize_file_system_policy_root_aliases(file_system_policy: &mut FileSystemSandboxPolicy) {
	- line 303: || bazel_bwrap_env_key_is_allowed(key)
	- line 308: fn bazel_bwrap_env_key_is_allowed(key: &str) -> bool {
	- line 313: fn bazel_bwrap_env_key_is_allowed(_key: &str) -> bool {
	- line 506: use codex_protocol::models::PermissionProfile;
	- line 510: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 512: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 594: fn helper_env_preserves_path_for_system_bwrap_discovery_without_leaking_secrets() {
	- line 641: fn helper_env_preserves_windows_path_key_for_system_bwrap_discovery() {
	- line 679: let network_policy = NetworkSandboxPolicy::Restricted;
	- line 681: PermissionProfile::from_runtime_permissions(&file_system_policy, network_policy);
	- line 762: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 770: PermissionProfile::from_runtime_permissions(&policy, NetworkSandboxPolicy::Restricted),
	- line 841: fn restricted_policy(entries: Vec<FileSystemSandboxEntry>) -> FileSystemSandboxPolicy {
	- line 842: FileSystemSandboxPolicy::restricted(entries)
	- line 846: policy: &FileSystemSandboxPolicy,
	- line 850: PermissionProfile::from_runtime_permissions(policy, NetworkSandboxPolicy::Restricted),


codex-rs/core/src/config/permissions.rs (27 lines):
	- line 15: use codex_config::permissions_toml::PermissionProfileToml;
	- line 31: use codex_protocol::models::PermissionProfile;
	- line 35: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 37: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 73: ) -> Option<PermissionProfile> {
	- line 75: BUILT_IN_READ_ONLY_PROFILE => Some(PermissionProfile::read_only()),
	- line 82: }) => PermissionProfile::workspace_write_with(
	- line 85: NetworkSandboxPolicy::Enabled
	- line 87: NetworkSandboxPolicy::Restricted
	- line 92: None => PermissionProfile::workspace_write(),
	- line 94: BUILT_IN_DANGER_FULL_ACCESS_PROFILE => Some(PermissionProfile::Disabled),
	- line 201: ) -> io::Result<PermissionProfileToml> {
	- line 207: fn extensible_builtin_parent_profile(profile_name: &str) -> Option<PermissionProfileToml> {
	- line 209: BUILT_IN_READ_ONLY_PROFILE => FileSystemSandboxPolicy::read_only(),
	- line 210: BUILT_IN_WORKSPACE_PROFILE => FileSystemSandboxPolicy::workspace_write(
	- line 221: file_system: FileSystemSandboxPolicy,
	- line 222: ) -> PermissionProfileToml {
	- line 230: PermissionProfileToml {
	- line 356: ) -> io::Result<(FileSystemSandboxPolicy, NetworkSandboxPolicy)> {
	- line 358: let mut file_system_sandbox_policy = FileSystemSandboxPolicy::restricted(Vec::new());
	- line 359: let base_network_sandbox_policy = NetworkSandboxPolicy::Restricted;
	- line 420: ) -> io::Result<(FileSystemSandboxPolicy, NetworkSandboxPolicy)> {
	- line 483: /// `FileSystemSandboxPolicy` for a thread.
	- line 514: base_network_sandbox_policy: NetworkSandboxPolicy,
	- line 515: ) -> NetworkSandboxPolicy {
	- line 521: Some(true) => NetworkSandboxPolicy::Enabled,
	- line 522: Some(false) => NetworkSandboxPolicy::Restricted,


codex-rs/core/src/environment_selection.rs (27 lines):
	- line 18: use codex_protocol::models::PermissionProfile;
	- line 846: fallback: impl FnOnce() -> PermissionProfile,
	- line 847: ) -> PermissionProfile {
	- line 919: use crate::config::PermissionProfileSnapshot;
	- line 928: use codex_protocol::models::ActivePermissionProfile;
	- line 929: use codex_protocol::models::PermissionProfile;
	- line 930: use codex_protocol::permissions::FileSystemSandboxPolicyContext;
	- line 956: use_legacy_landlock: false,
	- line 957: permission_profile: PermissionProfileSnapshot::legacy(PermissionProfile::read_only()),
	- line 1136: use_legacy_landlock: false,
	- line 1137: permission_profile: PermissionProfileSnapshot::active_with_profile_workspace_roots(
	- line 1138: PermissionProfile::read_only(),
	- line 1139: ActivePermissionProfile::read_only(),
	- line 1178: FileSystemSandboxPolicyContext {
	- line 1390: use_legacy_landlock: false,
	- line 1391: permission_profile: PermissionProfileSnapshot::active_with_profile_workspace_roots(
	- line 1392: PermissionProfile::read_only(),
	- line 1393: ActivePermissionProfile::read_only(),
	- line 1512: FileSystemSandboxPolicyContext {
	- line 1759: use_legacy_landlock: false,
	- line 1760: permission_profile: PermissionProfileSnapshot::active_with_profile_workspace_roots(
	- line 1761: PermissionProfile::read_only(),
	- line 1762: ActivePermissionProfile::read_only(),
	- line 1829: use_legacy_landlock: false,
	- line 1830: permission_profile: PermissionProfileSnapshot::legacy(PermissionProfile::read_only()),
	- line 1845: permission_profile: PermissionProfileSnapshot::legacy(
	- line 1846: PermissionProfile::workspace_write(),


codex-rs/core/src/session/session.rs (27 lines):
	- line 97: pub(super) permission_profile_state: PermissionProfileState,
	- line 104: pub(super) use_legacy_landlock: bool,
	- line 154: use_legacy_landlock: self.use_legacy_landlock,
	- line 162: pub(super) fn permission_profile(&self) -> PermissionProfile {
	- line 169: ) -> PermissionProfile {
	- line 178: ) -> PermissionProfile {
	- line 190: pub(super) fn active_permission_profile(&self) -> Option<ActivePermissionProfile> {
	- line 204: permission_profile: PermissionProfile,
	- line 213: ) -> SandboxPolicy {
	- line 224: ) -> FileSystemSandboxPolicy {
	- line 229: pub(super) fn network_sandbox_policy(&self) -> NetworkSandboxPolicy {
	- line 417: PermissionProfileSnapshot::active(
	- line 426: FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_deny_entries(
	- line 431: let network_sandbox_policy = NetworkSandboxPolicy::from(&sandbox_policy);
	- line 435: PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 446: &FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_deny_entries(
	- line 457: FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_deny_entries(
	- line 465: PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 497: permission_profile: PermissionProfile,
	- line 498: active_permission_profile: Option<ActivePermissionProfile>,
	- line 500: preserve_deny_reads_from: Option<&FileSystemSandboxPolicy>,
	- line 510: PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 518: PermissionProfileSnapshot::active_with_profile_workspace_roots(
	- line 524: None => PermissionProfileSnapshot::legacy(effective_permission_profile),
	- line 543: pub(crate) sandbox_policy: Option<SandboxPolicy>,
	- line 544: pub(crate) permission_profile: Option<PermissionProfile>,
	- line 545: pub(crate) active_permission_profile: Option<ActivePermissionProfile>,


codex-rs/config/src/config_requirements.rs (25 lines):
	- line 6: use codex_protocol::models::PermissionProfile;
	- line 35: use crate::permissions_toml::PermissionProfileToml;
	- line 173: pub permission_profile: ConstrainedWithSource<PermissionProfile>,
	- line 221: Constrained::allow_any(PermissionProfile::read_only()),
	- line 643: pub profiles: BTreeMap<String, PermissionProfileToml>,
	- line 1719: let default_permission_profile = PermissionProfile::read_only();
	- line 1729: allowed: "must include 'read-only' to allow any PermissionProfile"
	- line 1973: permission_profile: &PermissionProfile,
	- line 1976: PermissionProfile::Disabled => SandboxModeRequirement::DangerFullAccess,
	- line 1977: PermissionProfile::External { .. } => SandboxModeRequirement::ExternalSandbox,
	- line 1978: PermissionProfile::Managed { .. } => {
	- line 2012: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 3358: .can_set(&PermissionProfile::Disabled),
	- line 3494: .can_set(&PermissionProfile::read_only())
	- line 3642: .can_set(&PermissionProfile::read_only())
	- line 3645: let workspace_write_profile = PermissionProfile::workspace_write_with(
	- line 3647: NetworkSandboxPolicy::Restricted,
	- line 3660: .can_set(&PermissionProfile::Disabled),
	- line 3671: .can_set(&PermissionProfile::External {
	- line 3672: network: NetworkSandboxPolicy::Restricted,
	- line 3754: let workspace_write_profile = PermissionProfile::workspace_write_with(
	- line 3756: NetworkSandboxPolicy::Restricted,
	- line 3769: .can_set(&PermissionProfile::Disabled),
	- line 3800: .can_set(&PermissionProfile::Disabled),
	- line 3839: .can_set(&PermissionProfile::workspace_write()),


codex-rs/app-server-protocol/src/protocol/v2/tests.rs (25 lines):
	- line 28: use codex_protocol::models::AdditionalPermissionProfile as CoreAdditionalPermissionProfile;
	- line 47: use codex_protocol::request_permissions::RequestPermissionProfile as CoreRequestPermissionProfile;
	- line 315: sandbox: SandboxPolicy::DangerFullAccess,
	- line 707: let err = CoreAdditionalPermissionProfile::try_from(additional_permissions)
	- line 748: RequestPermissionProfile {
	- line 768: CoreRequestPermissionProfile::try_from(params.permissions)
	- line 770: CoreRequestPermissionProfile {
	- line 1017: GrantedPermissionProfile {
	- line 1037: CoreAdditionalPermissionProfile::try_from(response.permissions)
	- line 1039: CoreAdditionalPermissionProfile {
	- line 1914: let v2_policy = SandboxPolicy::ExternalSandbox {
	- line 1921: codex_protocol::protocol::SandboxPolicy::ExternalSandbox {
	- line 1926: let back_to_v2 = SandboxPolicy::from(core_policy);
	- line 1932: let v2_policy = SandboxPolicy::ReadOnly {
	- line 1939: codex_protocol::protocol::SandboxPolicy::ReadOnly {
	- line 1944: let back_to_v2 = SandboxPolicy::from(core_policy);
	- line 2718: let v2_policy = SandboxPolicy::WorkspaceWrite {
	- line 2728: codex_protocol::protocol::SandboxPolicy::WorkspaceWrite {
	- line 2736: let back_to_v2 = SandboxPolicy::from(core_policy);
	- line 2742: let policy = serde_json::from_value::<SandboxPolicy>(json!({
	- line 2752: SandboxPolicy::ReadOnly {
	- line 2761: let policy = serde_json::from_value::<SandboxPolicy>(json!({
	- line 2774: SandboxPolicy::WorkspaceWrite {
	- line 2785: let err = serde_json::from_value::<SandboxPolicy>(json!({
	- line 2799: let err = serde_json::from_value::<SandboxPolicy>(json!({


codex-rs/core/src/config/resolved_permission_profile.rs (22 lines):
	- line 3: use codex_protocol::models::ActivePermissionProfile;
	- line 4: use codex_protocol::models::PermissionProfile;
	- line 5: use codex_protocol::models::PermissionProfileSnapshot;
	- line 9: pub(crate) struct PermissionProfileState {
	- line 10: permission_profile: Constrained<PermissionProfileSnapshot>,
	- line 13: impl PermissionProfileState {
	- line 15: constrained_permission_profile: Constrained<PermissionProfile>,
	- line 18: PermissionProfileSnapshot::legacy(constrained_permission_profile.get().clone());
	- line 23: constrained_permission_profile: Constrained<PermissionProfile>,
	- line 24: active_permission_profile: Option<ActivePermissionProfile>,
	- line 30: PermissionProfileSnapshot::active_with_profile_workspace_roots(
	- line 36: None => PermissionProfileSnapshot::legacy(permission_profile),
	- line 42: constrained_permission_profile: Constrained<PermissionProfile>,
	- line 43: permission_profile: PermissionProfileSnapshot,
	- line 51: pub(crate) fn permission_profile(&self) -> &PermissionProfile {
	- line 55: pub(crate) fn snapshot(&self) -> PermissionProfileSnapshot {
	- line 59: pub(crate) fn active_permission_profile(&self) -> Option<ActivePermissionProfile> {
	- line 69: permission_profile: &PermissionProfile,
	- line 71: let candidate = PermissionProfileSnapshot::legacy(permission_profile.clone());
	- line 77: permission_profile: PermissionProfile,
	- line 80: .set(PermissionProfileSnapshot::legacy(permission_profile))
	- line 85: snapshot: PermissionProfileSnapshot,


codex-rs/sandboxing/src/windows.rs (22 lines):
	- line 6: use codex_protocol::models::PermissionProfile;
	- line 7: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 8: use codex_protocol::protocol::WritableRoot;
	- line 36: pub fn permission_profile_supports_windows_restricted_token_sandbox(
	- line 37: permission_profile: &PermissionProfile,
	- line 40: PermissionProfile::Managed { file_system, .. } => {
	- line 43: PermissionProfile::Disabled | PermissionProfile::External { .. } => false,
	- line 47: pub fn unsupported_windows_restricted_token_sandbox_reason(
	- line 49: permission_profile: &PermissionProfile,
	- line 62: resolve_windows_restricted_token_filesystem_overrides(
	- line 72: pub fn resolve_windows_restricted_token_filesystem_overrides(
	- line 74: permission_profile: &PermissionProfile,
	- line 90: if permission_profile_supports_windows_restricted_token_sandbox(permission_profile)
	- line 96: if !permission_profile_supports_windows_restricted_token_sandbox(permission_profile) {
	- line 215: permission_profile: &PermissionProfile,
	- line 226: if !permission_profile_supports_windows_restricted_token_sandbox(permission_profile) {
	- line 367: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 376: fn permission_profile_display_name(permission_profile: &PermissionProfile) -> &'static str {
	- line 378: PermissionProfile::Managed { .. } => "Managed",
	- line 379: PermissionProfile::Disabled => "Disabled",
	- line 380: PermissionProfile::External { .. } => "External",
	- line 384: fn has_reopened_writable_descendant(writable_roots: &[WritableRoot]) -> bool {


codex-rs/windows-sandbox-rs/src/setup.rs (22 lines):
	- line 39: use codex_protocol::models::PermissionProfile;
	- line 222: permission_profile: &PermissionProfile,
	- line 264: permission_profile: &PermissionProfile,
	- line 304: permission_profile: &PermissionProfile,
	- line 1374: use codex_protocol::models::PermissionProfile;
	- line 1379: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 1484: permission_profile: &PermissionProfile,
	- line 1502: ) -> PermissionProfile {
	- line 1503: PermissionProfile::workspace_write_with(
	- line 1505: NetworkSandboxPolicy::Restricted,
	- line 1517: &PermissionProfile::read_only(),
	- line 1609: PermissionProfile::Disabled,
	- line 1610: PermissionProfile::External {
	- line 1611: network: NetworkSandboxPolicy::Restricted,
	- line 1647: let permission_profile = PermissionProfile::Managed {
	- line 1673: network: NetworkSandboxPolicy::Restricted,
	- line 1701: let permission_profile = PermissionProfile::Managed {
	- line 1711: network: NetworkSandboxPolicy::Restricted,
	- line 2045: let permission_profile = PermissionProfile::read_only();
	- line 2092: let permission_profile = PermissionProfile::read_only();
	- line 2139: let permission_profile = PermissionProfile::read_only();
	- line 2316: let permission_profile = PermissionProfile::read_only();


codex-rs/core/src/tools/runtimes/zsh_fork/unix_escalation.rs (21 lines):
	- line 21: use codex_protocol::models::AdditionalPermissionProfile;
	- line 22: use codex_protocol::models::PermissionProfile;
	- line 42: use codex_shell_escalation::ResolvedPermissionProfile;
	- line 143: use_legacy_landlock: req.turn_environment.config().use_legacy_landlock,
	- line 189: permission_profile: PermissionProfile,
	- line 192: prompt_permissions: Option<AdditionalPermissionProfile>,
	- line 233: permission_profile: &PermissionProfile,
	- line 234: additional_permissions: Option<&AdditionalPermissionProfile>,
	- line 250: EscalationPermissions::ResolvedPermissionProfile(
	- line 251: ResolvedPermissionProfile {
	- line 267: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 325: prompt_permissions: Option<AdditionalPermissionProfile>,
	- line 537: permission_profile: PermissionProfile,
	- line 565: // TODO(anp): Capture these Windows and Landlock settings from
	- line 570: permission_profile: PermissionProfile,
	- line 580: use_legacy_landlock: bool,
	- line 587: permission_profile: &'a PermissionProfile,
	- line 588: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 717: EscalationPermissions::AdditionalPermissionProfile(permission_profile),
	- line 728: EscalationExecution::Permissions(EscalationPermissions::ResolvedPermissionProfile(
	- line 790: use_legacy_landlock: self.use_legacy_landlock,


codex-rs/sandboxing/src/bwrap.rs (21 lines):
	- line 2: use codex_protocol::models::PermissionProfile;
	- line 15: const SYSTEM_BWRAP_PROGRAM: &str = "bwrap";
	- line 17: "Codex could not find bubblewrap on PATH. ",
	- line 18: "Install bubblewrap with your OS package manager. ",
	- line 21: "Codex will use the bundled bubblewrap in the meantime.",
	- line 24: "Codex's Linux sandbox uses bubblewrap and needs access to create user namespaces.";
	- line 26: "Codex's Linux sandbox uses bubblewrap, which is not supported on WSL1 ",
	- line 40: pub fn system_bwrap_warning(permission_profile: &PermissionProfile) -> Option<String> {
	- line 41: if !should_warn_about_system_bwrap(permission_profile) {
	- line 45: let system_bwrap_path = find_system_bwrap_in_path();
	- line 46: system_bwrap_warning_for_path(system_bwrap_path.as_deref())
	- line 49: fn should_warn_about_system_bwrap(permission_profile: &PermissionProfile) -> bool {
	- line 58: fn system_bwrap_warning_for_path(system_bwrap_path: Option<&Path>) -> Option<String> {
	- line 63: let Some(system_bwrap_path) = system_bwrap_path else {
	- line 67: if !system_bwrap_has_user_namespace_access(system_bwrap_path, SYSTEM_BWRAP_PROBE_TIMEOUT) {
	- line 74: fn system_bwrap_has_user_namespace_access(system_bwrap_path: &Path, timeout: Duration) -> bool {
	- line 75: let mut child = match Command::new(system_bwrap_path)
	- line 168: pub fn find_system_bwrap_in_path() -> Option<PathBuf> {
	- line 171: find_system_bwrap_in_search_paths(std::env::split_paths(&search_path), &cwd)
	- line 174: fn find_system_bwrap_in_search_paths(
	- line 194: #[path = "bwrap_tests.rs"]


codex-rs/protocol/src/error.rs (21 lines):
	- line 48: /// Error from linux seccomp filter setup
	- line 50: #[error("seccomp setup error")]
	- line 51: SeccompInstall(#[from] seccompiler::Error),
	- line 53: /// Error from linux seccomp backend
	- line 55: #[error("seccomp backend error")]
	- line 56: SeccompBackend(#[from] seccompiler::BackendError),
	- line 66: /// Error from linux landlock
	- line 67: #[error("Landlock was not able to fully enforce all sandbox rules")]
	- line 68: LandlockRestrict,
	- line 166: LandlockSandboxExecutableNotProvided,
	- line 182: LandlockRuleset(#[from] landlock::RulesetError),
	- line 185: LandlockPathFd(#[from] landlock::PathFdError),
	- line 263: impl From<landlock::RulesetError> for CodexErr {
	- line 264: fn from(error: landlock::RulesetError) -> Self {
	- line 270: impl From<landlock::PathFdError> for CodexErr {
	- line 271: fn from(error: landlock::PathFdError) -> Self {
	- line 327: LandlockSandboxExecutableNotProvided,
	- line 346: LandlockRuleset(error: landlock::RulesetError),
	- line 348: LandlockPathFd(error: landlock::PathFdError),
	- line 386: | CodexErrorDetails::LandlockSandboxExecutableNotProvided
	- line 410: CodexErrorDetails::LandlockRuleset(_) | CodexErrorDetails::LandlockPathFd(_) => false,


codex-rs/protocol/src/permission_profile_intersection.rs (20 lines):
	- line 7: use crate::models::PermissionProfile;
	- line 12: use crate::permissions::FileSystemSandboxPolicy;
	- line 14: use crate::permissions::NetworkSandboxPolicy;
	- line 38: authority: &PermissionProfile,
	- line 39: requested: &PermissionProfile,
	- line 41: ) -> Result<PermissionProfile, PermissionIntersectionError> {
	- line 42: if matches!(authority, PermissionProfile::External { .. })
	- line 43: || matches!(requested, PermissionProfile::External { .. })
	- line 82: NetworkSandboxPolicy::Enabled
	- line 84: NetworkSandboxPolicy::Restricted
	- line 86: if matches!(authority, PermissionProfile::Disabled)
	- line 87: && matches!(requested, PermissionProfile::Disabled)
	- line 89: return Ok(PermissionProfile::Disabled);
	- line 92: return Ok(PermissionProfile::from_runtime_permissions(
	- line 98: return Ok(PermissionProfile::from_runtime_permissions(
	- line 104: return Ok(PermissionProfile::from_runtime_permissions(
	- line 215: let mut intersection = FileSystemSandboxPolicy::restricted(denies);
	- line 268: Ok(PermissionProfile::from_runtime_permissions(
	- line 275: policy: &mut FileSystemSandboxPolicy,
	- line 393: policy: &FileSystemSandboxPolicy,


codex-rs/tui/src/app.rs (20 lines):
	- line 13: use crate::app_event::PermissionProfileSelection;
	- line 58: use crate::legacy_core::config::PermissionProfileSnapshot;
	- line 158: use codex_protocol::models::ActivePermissionProfile;
	- line 160: use codex_protocol::models::PermissionProfile;
	- line 334: additional_permissions: Option<&codex_app_server_protocol::AdditionalPermissionProfile>,
	- line 382: active_permission_profile: ActivePermissionProfile,
	- line 393: active_permission_profile: ActivePermissionProfile::new(
	- line 401: fn permission_profile(&self) -> PermissionProfile {
	- line 408: fn managed_filesystem_sandbox_is_restricted(permission_profile: &PermissionProfile) -> bool {
	- line 552: runtime_permission_profile_override: Option<RuntimePermissionProfileOverride>,
	- line 644: struct RuntimePermissionProfileOverride {
	- line 645: permission_profile: PermissionProfile,
	- line 646: active_permission_profile: Option<ActivePermissionProfile>,
	- line 648: turn_override: RuntimePermissionProfileTurnOverride,
	- line 652: enum RuntimePermissionProfileTurnOverride {
	- line 657: impl RuntimePermissionProfileOverride {
	- line 663: turn_override: RuntimePermissionProfileTurnOverride::LegacySandbox,
	- line 669: turn_override: RuntimePermissionProfileTurnOverride::Preserve,
	- line 680: fn turn_permission_profile(&self) -> Option<&PermissionProfile> {
	- line 683: RuntimePermissionProfileTurnOverride::LegacySandbox


codex-rs/bwrap/build.rs (19 lines):
	- line 6: println!("cargo:rustc-check-cfg=cfg(bwrap_available)");
	- line 14: let vendor_dir = manifest_dir.join("../vendor/bubblewrap");
	- line 15: for source in ["bubblewrap.c", "bind-mount.c", "network.c", "utils.c"] {
	- line 27: if let Err(err) = try_build_bwrap() {
	- line 28: panic!("failed to compile bubblewrap for Linux target: {err}");
	- line 32: fn try_build_bwrap() -> Result<(), String> {
	- line 36: let src_dir = resolve_bwrap_source_dir(&manifest_dir)?;
	- line 46: #define PACKAGE_STRING "bubblewrap built for Codex"
	- line 53: .file(src_dir.join("bubblewrap.c"))
	- line 61: .define("main", Some("bwrap_main"));
	- line 68: build.compile("standalone_bwrap");
	- line 75: println!("cargo:rustc-cfg=bwrap_available");
	- line 79: /// Resolve the bubblewrap source directory used for build-time compilation.
	- line 82: /// 1. `CODEX_BWRAP_SOURCE_DIR` points at an existing bubblewrap checkout.
	- line 83: /// 2. The vendored bubblewrap tree under `codex-rs/vendor/bubblewrap`.
	- line 84: fn resolve_bwrap_source_dir(manifest_dir: &Path) -> Result<PathBuf, String> {
	- line 96: let vendor_dir = manifest_dir.join("../vendor/bubblewrap");
	- line 102: "expected vendored bubblewrap at {}, but it was not found.\n\
	- line 103: Set CODEX_BWRAP_SOURCE_DIR to an existing checkout or vendor bubblewrap under codex-rs/vendor.",


codex-rs/windows-sandbox-rs/src/deny_read_resolver.rs (18 lines):
	- line 4: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 32: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 47: let glob_policy = FileSystemSandboxPolicy::restricted(
	- line 316: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 464: let policy = FileSystemSandboxPolicy::restricted(vec![unreadable_glob_entry(pattern)]);
	- line 479: let policy = FileSystemSandboxPolicy::restricted(vec![unreadable_glob_entry(
	- line 497: FileSystemSandboxPolicy::restricted(vec![unreadable_glob_entry(pattern.clone())]);
	- line 524: let policy = FileSystemSandboxPolicy::restricted(vec![unreadable_path_entry(missing)]);
	- line 552: let policy = FileSystemSandboxPolicy::restricted(vec![unreadable_glob_entry(format!(
	- line 590: let policy = FileSystemSandboxPolicy::restricted(vec![unreadable_glob_entry(
	- line 614: let policy = FileSystemSandboxPolicy::restricted(vec![unreadable_glob_entry(
	- line 637: let mut policy = FileSystemSandboxPolicy::restricted(vec![unreadable_glob_entry(
	- line 653: let policy = FileSystemSandboxPolicy::restricted(vec![unreadable_glob_entry(
	- line 685: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 704: let policy = FileSystemSandboxPolicy::restricted(vec![unreadable_glob_entry(format!(
	- line 726: let policy = FileSystemSandboxPolicy::restricted(vec![unreadable_glob_entry(format!(
	- line 750: let policy = FileSystemSandboxPolicy::restricted(vec![
	- line 776: let policy = FileSystemSandboxPolicy::restricted(vec![unreadable_glob_entry(


codex-rs/windows-sandbox-rs/src/lib.rs (18 lines):
	- line 380: use codex_protocol::models::PermissionProfile;
	- line 482: permission_profile: &PermissionProfile,
	- line 509: permission_profile: &PermissionProfile,
	- line 740: permission_profile: &PermissionProfile,
	- line 781: use codex_protocol::models::PermissionProfile;
	- line 782: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 786: fn workspace_profile(network_policy: NetworkSandboxPolicy) -> PermissionProfile {
	- line 787: PermissionProfile::workspace_write_with(
	- line 795: fn should_apply_network_block(permission_profile: &PermissionProfile) -> bool {
	- line 807: NetworkSandboxPolicy::Restricted
	- line 814: NetworkSandboxPolicy::Enabled
	- line 820: assert!(should_apply_network_block(&PermissionProfile::read_only()));
	- line 826: PermissionProfile::Disabled,
	- line 827: PermissionProfile::External {
	- line 828: network: NetworkSandboxPolicy::Restricted,
	- line 849: use codex_protocol::models::PermissionProfile;
	- line 864: _permission_profile: &PermissionProfile,
	- line 878: _permission_profile: &PermissionProfile,


codex-rs/app-server-protocol/src/protocol/v2/thread.rs (17 lines):
	- line 1: use super::ActivePermissionProfile;
	- line 5: use super::SandboxPolicy;
	- line 200: /// should prefer `activePermissionProfile` for profile provenance.
	- line 201: pub sandbox: SandboxPolicy,
	- line 204: #[experimental("thread/start.activePermissionProfile")]
	- line 206: pub active_permission_profile: Option<ActivePermissionProfile>,
	- line 240: pub sandbox_policy: Option<SandboxPolicy>,
	- line 293: pub sandbox_policy: SandboxPolicy,
	- line 294: pub active_permission_profile: Option<ActivePermissionProfile>,
	- line 434: /// should prefer `activePermissionProfile` for profile provenance.
	- line 435: pub sandbox: SandboxPolicy,
	- line 438: #[experimental("thread/resume.activePermissionProfile")]
	- line 440: pub active_permission_profile: Option<ActivePermissionProfile>,
	- line 625: /// should prefer `activePermissionProfile` for profile provenance.
	- line 626: pub sandbox: SandboxPolicy,
	- line 629: #[experimental("thread/fork.activePermissionProfile")]
	- line 631: pub active_permission_profile: Option<ActivePermissionProfile>,


codex-rs/core/src/tools/handlers/mod.rs (16 lines):
	- line 56: use codex_protocol::models::AdditionalPermissionProfile;
	- line 182: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 185: ) -> Result<Option<AdditionalPermissionProfile>, String> {
	- line 235: pub additional_permissions: Option<AdditionalPermissionProfile>,
	- line 241: additional_permissions: Option<&AdditionalPermissionProfile>,
	- line 243: ) -> Option<AdditionalPermissionProfile> {
	- line 261: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 310: effective_permissions: &AdditionalPermissionProfile,
	- line 311: granted_permissions: &AdditionalPermissionProfile,
	- line 313: ) -> Option<AdditionalPermissionProfile> {
	- line 349: use codex_protocol::models::AdditionalPermissionProfile;
	- line 364: fn network_permissions() -> AdditionalPermissionProfile {
	- line 365: AdditionalPermissionProfile {
	- line 373: fn file_system_permissions(path: &std::path::Path) -> AdditionalPermissionProfile {
	- line 374: AdditionalPermissionProfile {
	- line 466: let requested_permissions = AdditionalPermissionProfile {


codex-rs/features/src/lib.rs (16 lines):
	- line 155: /// Use the legacy Landlock Linux sandbox fallback instead of the default
	- line 156: /// bubblewrap pipeline.
	- line 157: UseLegacyLandlock,
	- line 355: /// Removed legacy Linux bubblewrap opt-in flag retained as a no-op so old
	- line 360: /// Enable Windows sandbox (restricted token) on Windows.
	- line 485: pub fn use_legacy_landlock(&self) -> bool {
	- line 486: self.enabled(Feature::UseLegacyLandlock)
	- line 595: "use_legacy_landlock" => {
	- line 597: "features.use_legacy_landlock",
	- line 598: Feature::UseLegacyLandlock,
	- line 681: Feature::UseLegacyLandlock => {
	- line 683: "features.use_legacy_landlock" | "use_legacy_landlock" => {
	- line 684: "[features].use_legacy_landlock"
	- line 1143: key: "use_linux_sandbox_bwrap",
	- line 1148: id: Feature::UseLegacyLandlock,
	- line 1149: key: "use_legacy_landlock",


codex-rs/tui/src/app/config_persistence.rs (16 lines):
	- line 14: pub(super) permission_profile: PermissionProfile,
	- line 99: profile_selection: Option<&PermissionProfileSelection>,
	- line 120: selection: PermissionProfileSelection,
	- line 122: let PermissionProfileSelection {
	- line 163: PermissionProfileSnapshot::from_session_snapshot(
	- line 208: Some(RuntimePermissionProfileOverride::from_config(&self.config));
	- line 313: PermissionProfileSnapshot::from_session_snapshot(
	- line 356: active_permission_profile: ActivePermissionProfile,
	- line 359: ) -> Option<PermissionProfile> {
	- line 376: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
	- line 581: PermissionProfileSnapshot::from_session_snapshot(
	- line 596: Some(RuntimePermissionProfileOverride::from_config(&self.config));
	- line 975: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
	- line 991: Some(RuntimePermissionProfileOverride::from_config(&self.config));
	- line 1177: use codex_protocol::models::PermissionProfile;
	- line 1578: permission_profile: PermissionProfile::read_only(),


codex-rs/utils/sandbox-summary/src/sandbox_summary.rs (16 lines):
	- line 1: use codex_protocol::models::PermissionProfile;
	- line 3: use codex_protocol::protocol::SandboxPolicy;
	- line 6: pub fn summarize_sandbox_policy(sandbox_policy: &SandboxPolicy) -> String {
	- line 8: SandboxPolicy::DangerFullAccess => "danger-full-access".to_string(),
	- line 9: SandboxPolicy::ReadOnly { network_access, .. } => {
	- line 16: SandboxPolicy::ExternalSandbox { network_access } => {
	- line 23: SandboxPolicy::WorkspaceWrite {
	- line 55: permission_profile: &PermissionProfile,
	- line 60: Ok(SandboxPolicy::WorkspaceWrite {
	- line 101: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 107: let summary = summarize_sandbox_policy(&SandboxPolicy::ExternalSandbox {
	- line 115: let summary = summarize_sandbox_policy(&SandboxPolicy::ExternalSandbox {
	- line 123: let summary = summarize_sandbox_policy(&SandboxPolicy::ReadOnly {
	- line 133: let summary = summarize_sandbox_policy(&SandboxPolicy::WorkspaceWrite {
	- line 164: let profile = PermissionProfile::workspace_write_with(
	- line 166: NetworkSandboxPolicy::Restricted,


codex-rs/core/src/exec.rs (16 lines):
	- line 32: use codex_protocol::models::PermissionProfile;
	- line 33: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 46: use codex_sandboxing::permission_profile_supports_windows_restricted_token_sandbox;
	- line 51: use codex_sandboxing::resolve_windows_restricted_token_filesystem_overrides;
	- line 53: use codex_sandboxing::unsupported_windows_restricted_token_sandbox_reason;
	- line 123: permission_profile: &PermissionProfile,
	- line 295: permission_profile: &PermissionProfile,
	- line 299: use_legacy_landlock: bool,
	- line 308: use_legacy_landlock,
	- line 319: permission_profile: &PermissionProfile,
	- line 323: use_legacy_landlock: bool,
	- line 390: use_legacy_landlock,
	- line 477: network_sandbox_policy: NetworkSandboxPolicy,
	- line 481: #[cfg_attr(not(windows), allow(unused_variables))] permission_profile: &PermissionProfile,
	- line 573: permission_profile: &PermissionProfile,
	- line 883: network_sandbox_policy: NetworkSandboxPolicy,


codex-rs/config/src/permissions_toml.rs (16 lines):
	- line 25: pub entries: BTreeMap<String, PermissionProfileToml>,
	- line 44: ) -> Result<PermissionProfileToml, PermissionProfileResolutionError>
	- line 46: F: FnMut(&str) -> Option<PermissionProfileToml>,
	- line 63: return Err(PermissionProfileResolutionError::Cycle { cycle });
	- line 73: || PermissionProfileResolutionError::UndefinedProfile {
	- line 78: PermissionProfileResolutionError::UnsupportedBuiltInParent {
	- line 83: PermissionProfileResolutionError::UndefinedParent {
	- line 113: pub struct PermissionProfileToml {
	- line 122: pub enum PermissionProfileResolutionError {
	- line 159: mut parent: PermissionProfileToml,
	- line 160: mut child: PermissionProfileToml,
	- line 161: ) -> Result<PermissionProfileToml, PermissionProfileResolutionError> {
	- line 184: .map_err(|source| PermissionProfileResolutionError::SerializeProfileToml { source })?;
	- line 186: .map_err(|source| PermissionProfileResolutionError::SerializeProfileToml { source })?;
	- line 190: .map_err(|source| PermissionProfileResolutionError::DeserializeProfileToml { source })
	- line 193: fn normalize_profile_network_domains(profile: &mut PermissionProfileToml) {


codex-rs/tui/src/app/thread_session_state.rs (15 lines):
	- line 7: use codex_protocol::models::ActivePermissionProfile;
	- line 8: use codex_protocol::models::PermissionProfile;
	- line 134: fn current_permission_profile(&self) -> PermissionProfile {
	- line 142: fn current_active_permission_profile(&self) -> Option<ActivePermissionProfile> {
	- line 156: use crate::legacy_core::config::PermissionProfileSnapshot;
	- line 164: use codex_protocol::models::PermissionProfile;
	- line 169: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 184: permission_profile: PermissionProfile::read_only(),
	- line 208: permission_profile: PermissionProfile::workspace_write(),
	- line 236: let expected_permission_profile = PermissionProfile::workspace_write();
	- line 238: ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE);
	- line 241: .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
	- line 294: let profile: PermissionProfile = PermissionProfile::Managed {
	- line 295: network: NetworkSandboxPolicy::Restricted,
	- line 409: permission_profile: PermissionProfile::workspace_write(),


codex-rs/windows-sandbox-rs/src/spawn_prep.rs (15 lines):
	- line 35: use codex_protocol::models::PermissionProfile;
	- line 84: permission_profile: &PermissionProfile,
	- line 124: permission_profile: &PermissionProfile,
	- line 459: use codex_protocol::models::PermissionProfile;
	- line 460: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 468: network_policy: NetworkSandboxPolicy,
	- line 472: ) -> PermissionProfile {
	- line 473: PermissionProfile::workspace_write_with(
	- line 485: fn should_apply_network_block(permission_profile: &PermissionProfile) -> bool {
	- line 497: &PermissionProfile::workspace_write()
	- line 504: NetworkSandboxPolicy::Enabled,
	- line 519: &PermissionProfile::workspace_write(),
	- line 550: &PermissionProfile::workspace_write(),
	- line 581: NetworkSandboxPolicy::Restricted,
	- line 698: NetworkSandboxPolicy::Restricted,


codex-rs/tui/src/bottom_pane/approval_overlay.rs (15 lines):
	- line 41: use codex_app_server_protocol::AdditionalPermissionProfile;
	- line 57: use codex_protocol::request_permissions::RequestPermissionProfile;
	- line 92: pub additional_permissions: Option<AdditionalPermissionProfile>,
	- line 102: pub permissions: RequestPermissionProfile,
	- line 409: permissions: &RequestPermissionProfile,
	- line 832: additional_permissions: Option<&AdditionalPermissionProfile>,
	- line 918: additional_permissions: &AdditionalPermissionProfile,
	- line 969: permissions: &RequestPermissionProfile,
	- line 975: format_additional_permissions_rule(&AdditionalPermissionProfile {
	- line 1232: permissions: RequestPermissionProfile {
	- line 1836: let additional_permissions = AdditionalPermissionProfile {
	- line 1886: let additional_permissions = AdditionalPermissionProfile {
	- line 1917: let additional_permissions = AdditionalPermissionProfile {
	- line 2049: additional_permissions: Some(AdditionalPermissionProfile {
	- line 2107: additional_permissions: Some(AdditionalPermissionProfile {


codex-rs/protocol/src/permission_profile_snapshot.rs (15 lines):
	- line 3: use crate::models::ActivePermissionProfile;
	- line 4: use crate::models::PermissionProfile;
	- line 13: pub struct PermissionProfileSnapshot {
	- line 14: permission_profile: PermissionProfile,
	- line 15: active_permission_profile: Option<ActivePermissionProfile>,
	- line 19: impl PermissionProfileSnapshot {
	- line 24: pub fn legacy(permission_profile: PermissionProfile) -> Self {
	- line 34: permission_profile: PermissionProfile,
	- line 35: active_permission_profile: ActivePermissionProfile,
	- line 48: permission_profile: PermissionProfile,
	- line 49: active_permission_profile: ActivePermissionProfile,
	- line 61: permission_profile: PermissionProfile,
	- line 62: active_permission_profile: Option<ActivePermissionProfile>,
	- line 73: pub fn permission_profile(&self) -> &PermissionProfile {
	- line 78: pub fn active_permission_profile(&self) -> Option<ActivePermissionProfile> {


codex-rs/utils/approval-presets/src/lib.rs (15 lines):
	- line 1: use codex_protocol::models::ActivePermissionProfile;
	- line 5: use codex_protocol::models::PermissionProfile;
	- line 20: pub active_permission_profile: ActivePermissionProfile,
	- line 22: pub permission_profile: PermissionProfile,
	- line 35: active_permission_profile: ActivePermissionProfile::new(
	- line 38: permission_profile: PermissionProfile::read_only(),
	- line 45: active_permission_profile: ActivePermissionProfile::new(
	- line 48: permission_profile: PermissionProfile::workspace_write(),
	- line 55: active_permission_profile: ActivePermissionProfile::new(
	- line 58: permission_profile: PermissionProfile::Disabled,
	- line 65: active_permission_profile: &ActivePermissionProfile,
	- line 66: ) -> Option<PermissionProfile> {
	- line 72: BUILT_IN_PERMISSION_PROFILE_READ_ONLY => Some(PermissionProfile::read_only()),
	- line 73: BUILT_IN_PERMISSION_PROFILE_WORKSPACE => Some(PermissionProfile::workspace_write()),
	- line 74: BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS => Some(PermissionProfile::Disabled),


codex-rs/sandboxing/src/lib.rs (14 lines):
	- line 2: mod bwrap;
	- line 4: pub mod landlock;
	- line 8: pub mod seatbelt;
	- line 15: pub use bwrap::find_system_bwrap_in_path;
	- line 17: pub use bwrap::system_bwrap_warning;
	- line 44: pub use windows::permission_profile_supports_windows_restricted_token_sandbox;
	- line 46: pub use windows::resolve_windows_restricted_token_filesystem_overrides;
	- line 47: pub use windows::unsupported_windows_restricted_token_sandbox_reason;
	- line 53: pub fn system_bwrap_warning(
	- line 54: _permission_profile: &codex_protocol::models::PermissionProfile,
	- line 63: | error @ SandboxTransformError::InvalidSandboxPolicyCwd { .. } => {
	- line 67: CodexErr::LandlockSandboxExecutableNotProvided
	- line 78: CodexErr::UnsupportedOperation(crate::bwrap::WSL1_BWRAP_WARNING.to_string())
	- line 82: "seatbelt sandbox is only available on macOS".to_string(),


codex-rs/tui/src/app_server_approval_conversions.rs (14 lines):
	- line 11: use codex_app_server_protocol::GrantedPermissionProfile;
	- line 13: use codex_protocol::request_permissions::RequestPermissionProfile as CoreRequestPermissionProfile;
	- line 18: value: CoreRequestPermissionProfile,
	- line 19: ) -> GrantedPermissionProfile {
	- line 20: GrantedPermissionProfile {
	- line 64: use codex_app_server_protocol::GrantedPermissionProfile;
	- line 66: use codex_app_server_protocol::RequestPermissionProfile;
	- line 67: use codex_protocol::request_permissions::RequestPermissionProfile as CoreRequestPermissionProfile;
	- line 96: let request = RequestPermissionProfile {
	- line 107: let request = CoreRequestPermissionProfile::try_from(request)
	- line 112: GrantedPermissionProfile {
	- line 141: let request = RequestPermissionProfile {
	- line 155: let request = CoreRequestPermissionProfile::try_from(request)
	- line 160: GrantedPermissionProfile {


scripts/codex_package/cargo.py (14 lines):
	- line 21: bwrap_bin: Path | None
	- line 34: bwrap_bin: Path | None,
	- line 40: bwrap_bin=bwrap_bin,
	- line 49: build_bwrap=spec.is_linux and bwrap_bin is None,
	- line 91: bwrap_bin=resolve_output_path(
	- line 92: bwrap_bin,
	- line 93: output_dir / "bwrap" if spec.is_linux else None,
	- line 114: build_bwrap: bool,
	- line 123: if build_bwrap:
	- line 124: binaries.append("bwrap")
	- line 135: bwrap_bin: Path | None,
	- line 139: if bwrap_bin is not None and not spec.is_linux:
	- line 140: raise RuntimeError("--bwrap-bin is only supported for Linux targets.")
	- line 189: outputs.bwrap_bin,


codex-rs/windows-sandbox-rs/src/unified_exec/tests.rs (14 lines):
	- line 15: use codex_protocol::models::PermissionProfile;
	- line 228: fn restricted_token_rejects_managed_network_before_spawn() {
	- line 232: let permission_profile = PermissionProfile::workspace_write();
	- line 272: let permission_profile = PermissionProfile::workspace_write();
	- line 310: let permission_profile = PermissionProfile::workspace_write();
	- line 359: let permission_profile = PermissionProfile::workspace_write();
	- line 399: let permission_profile = PermissionProfile::workspace_write();
	- line 633: let permission_profile = PermissionProfile::workspace_write();
	- line 745: let permission_profile = PermissionProfile::workspace_write();
	- line 830: let permission_profile = PermissionProfile::workspace_write();
	- line 910: let permission_profile = PermissionProfile::workspace_write();
	- line 992: let permission_profile = PermissionProfile::workspace_write();
	- line 1046: let permission_profile = PermissionProfile::workspace_write();
	- line 1100: let permission_profile = PermissionProfile::workspace_write();


codex-rs/tui/src/additional_dirs.rs (13 lines):
	- line 1: use codex_protocol::models::PermissionProfile;
	- line 9: permission_profile: &PermissionProfile,
	- line 18: PermissionProfile::Disabled | PermissionProfile::External { .. }
	- line 50: use codex_protocol::models::PermissionProfile;
	- line 55: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 62: let profile = PermissionProfile::workspace_write();
	- line 72: let profile = PermissionProfile::Disabled;
	- line 82: let profile: PermissionProfile = PermissionProfile::External {
	- line 83: network: NetworkSandboxPolicy::Enabled,
	- line 94: let profile = PermissionProfile::read_only();
	- line 106: let profile: PermissionProfile = PermissionProfile::Managed {
	- line 107: network: NetworkSandboxPolicy::Restricted,
	- line 142: let profile = PermissionProfile::read_only();


codex-rs/thread-store/src/local/helpers.rs (13 lines):
	- line 15: use codex_protocol::models::PermissionProfile;
	- line 19: use codex_protocol::protocol::SandboxPolicy;
	- line 187: permission_profile: PermissionProfile::read_only(),
	- line 194: pub(super) fn permission_profile_from_metadata_value(value: &str, cwd: &Path) -> PermissionProfile {
	- line 195: serde_json::from_str::<PermissionProfile>(value)
	- line 198: .map(|policy| PermissionProfile::from_legacy_sandbox_policy_for_cwd(&policy, cwd))
	- line 200: .unwrap_or_else(|_| PermissionProfile::read_only())
	- line 204: permission_profile: &PermissionProfile,
	- line 296: fn parse_legacy_sandbox_policy(value: &str) -> serde_json::Result<SandboxPolicy> {
	- line 300: "danger-full-access" => Ok(SandboxPolicy::DangerFullAccess),
	- line 301: "read-only" => Ok(SandboxPolicy::new_read_only_policy()),
	- line 302: "workspace-write" => Ok(SandboxPolicy::new_workspace_write_policy()),
	- line 303: "external-sandbox" => Ok(SandboxPolicy::ExternalSandbox {


codex-rs/core/src/unified_exec/stdin_approval.rs (13 lines):
	- line 15: use codex_file_system::ExecPermissionProfile;
	- line 18: use codex_protocol::models::AdditionalPermissionProfile;
	- line 19: use codex_protocol::models::PermissionProfile;
	- line 21: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 35: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 36: internal_permissions: Option<AdditionalPermissionProfile>,
	- line 53: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 72: if let ExecPermissionProfile::Managed { network, .. } = &mut context.permissions {
	- line 73: *network = NetworkSandboxPolicy::Restricted;
	- line 85: additional_permissions: Option<&AdditionalPermissionProfile>,
	- line 86: internal_permissions: Option<&AdditionalPermissionProfile>,
	- line 109: baseline: &PermissionProfile,
	- line 148: } else if self.policy.sandbox.permissions == ExecPermissionProfile::Disabled {


codex-rs/core/src/session/turn_context.rs (13 lines):
	- line 21: use codex_protocol::models::AdditionalPermissionProfile;
	- line 25: use codex_protocol::permissions::RawFileSystemSandboxPolicy;
	- line 120: pub(crate) fn permission_profile(&self) -> &PermissionProfile {
	- line 127: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 148: use_legacy_landlock: config.use_legacy_landlock,
	- line 152: pub(crate) fn active_permission_profile(&self) -> Option<ActivePermissionProfile> {
	- line 156: pub(crate) fn permission_profile_with_workspace_roots(&self) -> PermissionProfile {
	- line 383: pub(crate) fn permission_profile(&self) -> PermissionProfile {
	- line 388: pub(crate) fn file_system_sandbox_policy(&self) -> FileSystemSandboxPolicy {
	- line 392: pub(crate) fn network_sandbox_policy(&self) -> NetworkSandboxPolicy {
	- line 396: pub(crate) fn sandbox_policy(&self) -> SandboxPolicy {
	- line 556: fn non_legacy_file_system_sandbox_policy(&self) -> Option<RawFileSystemSandboxPolicy> {
	- line 562: FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(


codex-rs/sandboxing/src/landlock.rs (12 lines):
	- line 1: use codex_protocol::models::PermissionProfile;
	- line 18: /// The helper performs the actual sandboxing (bubblewrap by default + seccomp)
	- line 26: permission_profile: &PermissionProfile,
	- line 28: use_legacy_landlock: bool,
	- line 50: // Proxy-only networking requires bubblewrap's isolated network namespace.
	- line 51: if use_legacy_landlock && !allow_network_for_proxy {
	- line 52: linux_cmd.push("--use-legacy-landlock".to_string());
	- line 69: use_legacy_landlock: bool,
	- line 87: // Proxy-only networking requires bubblewrap's isolated network namespace.
	- line 88: if use_legacy_landlock && !allow_network_for_proxy {
	- line 89: linux_cmd.push("--use-legacy-landlock".to_string());
	- line 106: #[path = "landlock_tests.rs"]


codex-rs/core/src/guardian/approval_request.rs (12 lines):
	- line 7: use codex_protocol::models::AdditionalPermissionProfile;
	- line 8: use codex_protocol::request_permissions::RequestPermissionProfile;
	- line 25: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 38: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 47: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 81: permissions: RequestPermissionProfile,
	- line 94: pub(crate) additional_permissions: Option<AdditionalPermissionProfile>,
	- line 118: additional_permissions: Option<&'a AdditionalPermissionProfile>,
	- line 134: additional_permissions: Option<&'a AdditionalPermissionProfile>,
	- line 146: additional_permissions: Option<&'a AdditionalPermissionProfile>,
	- line 190: permissions: &'a RequestPermissionProfile,
	- line 202: additional_permissions: Option<&AdditionalPermissionProfile>,


codex-rs/tui/src/app_event.rs (12 lines):
	- line 64: use codex_protocol::models::ActivePermissionProfile;
	- line 1027: profile_selection: Option<PermissionProfileSelection>,
	- line 1033: selection: PermissionProfileSelection,
	- line 1043: profile_selection: Option<PermissionProfileSelection>,
	- line 1060: profile_selection: Option<PermissionProfileSelection>,
	- line 1067: profile_selection: Option<PermissionProfileSelection>,
	- line 1074: profile_selection: Option<PermissionProfileSelection>,
	- line 1081: profile_selection: Option<PermissionProfileSelection>,
	- line 1102: profile_selection: Option<PermissionProfileSelection>,
	- line 1112: UpdateActivePermissionProfile(ActivePermissionProfile),
	- line 1115: SelectPermissionProfile(PermissionProfileSelection),
	- line 1382: pub(crate) struct PermissionProfileSelection {


codex-rs/analytics/src/reducer.rs (12 lines):
	- line 143: use codex_app_server_protocol::RequestPermissionProfile;
	- line 160: use codex_protocol::models::PermissionProfile;
	- line 3132: permissions: &RequestPermissionProfile,
	- line 3504: fn sandbox_policy_mode(permission_profile: &PermissionProfile, cwd: &Path) -> &'static str {
	- line 3506: PermissionProfile::Disabled => "full_access",
	- line 3507: PermissionProfile::External { .. } => "external_sandbox",
	- line 3508: PermissionProfile::Managed { .. } => {
	- line 3621: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 3622: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 3669: let permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 3671: &FileSystemSandboxPolicy::unrestricted(),
	- line 3672: NetworkSandboxPolicy::Restricted,


codex-rs/core/src/safety.rs (12 lines):
	- line 8: use codex_protocol::models::PermissionProfile;
	- line 9: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 29: permission_profile: &PermissionProfile,
	- line 30: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 63: PermissionProfile::Disabled | PermissionProfile::External { .. }
	- line 101: permission_profile: &PermissionProfile,
	- line 102: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 109: PermissionProfile::Managed { .. }
	- line 115: PermissionProfile::Managed { .. }
	- line 116: | PermissionProfile::Disabled
	- line 117: | PermissionProfile::External { .. } => PATCH_REJECTED_OUTSIDE_PROJECT_REASON,
	- line 123: file_system_sandbox_policy: &FileSystemSandboxPolicy,


codex-rs/prompts/src/permissions_instructions.rs (12 lines):
	- line 6: use codex_protocol::models::PermissionProfile;
	- line 10: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 11: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 15: use codex_protocol::protocol::WritableRoot;
	- line 91: permission_profile: &PermissionProfile,
	- line 129: writable_roots: Option<Vec<WritableRoot>>,
	- line 144: writable_roots: Option<Vec<WritableRoot>>,
	- line 199: file_system_policy: &FileSystemSandboxPolicy,
	- line 201: ) -> (SandboxMode, Option<Vec<WritableRoot>>) {
	- line 214: fn network_access_from_policy(network_policy: NetworkSandboxPolicy) -> NetworkAccess {
	- line 328: fn writable_roots_text(writable_roots: Option<Vec<WritableRoot>>) -> Option<String> {
	- line 346: fn denied_reads_text(file_system_policy: &FileSystemSandboxPolicy, cwd: &Path) -> Option<String> {


codex-rs/codex-mcp/src/mcp/mod.rs (12 lines):
	- line 41: use codex_protocol::models::PermissionProfile;
	- line 91: permission_profile: &PermissionProfile,
	- line 103: PermissionProfile::Disabled | PermissionProfile::External { .. } => true,
	- line 104: PermissionProfile::Managed { file_system, .. } => {
	- line 147: pub permission_profile: PermissionProfile,
	- line 155: pub server_permission_profiles: HashMap<String, PermissionProfile>,
	- line 158: /// Whether to use legacy Landlock behavior in the MCP sandbox state.
	- line 161: pub use_legacy_landlock: bool,
	- line 191: environment_profiles: impl IntoIterator<Item = (String, PermissionProfile)>,
	- line 221: pub fn permission_profile_for_server(&self, server_name: &str) -> Option<&PermissionProfile> {
	- line 228: config.permission_profile = PermissionProfile::default();
	- line 232: .map(|(name, _)| (name.clone(), PermissionProfile::default()))


codex-rs/core/src/config/permission_profile_catalog.rs (12 lines):
	- line 7: use codex_protocol::models::PermissionProfile;
	- line 22: pub struct PermissionProfileCatalogEntry {
	- line 31: ) -> std::io::Result<Vec<PermissionProfileCatalogEntry>> {
	- line 48: ) -> std::io::Result<Vec<PermissionProfileCatalogEntry>> {
	- line 54: (BUILT_IN_READ_ONLY_PROFILE, PermissionProfile::read_only()),
	- line 57: PermissionProfile::workspace_write(),
	- line 61: PermissionProfile::Disabled,
	- line 65: .map(|(id, permission_profile)| PermissionProfileCatalogEntry {
	- line 82: PermissionProfile::from_runtime_permissions(&file_system, network)
	- line 87: PermissionProfileCatalogEntry {
	- line 101: permission_profile: &PermissionProfile,
	- line 125: permission_profile: &PermissionProfile,


codex-rs/core/src/config/network_proxy_spec.rs (11 lines):
	- line 22: use codex_protocol::models::PermissionProfile;
	- line 104: permission_profile: &PermissionProfile,
	- line 137: permission_profile: &PermissionProfile,
	- line 168: permission_profile: &PermissionProfile,
	- line 185: permission_profile: &PermissionProfile,
	- line 188: if matches!(permission_profile, PermissionProfile::Disabled) {
	- line 302: permission_profile: &PermissionProfile,
	- line 403: permission_profile: &PermissionProfile,
	- line 413: fn denylist_expansion_enabled(permission_profile: &PermissionProfile) -> bool {
	- line 417: fn managed_sandbox_active(permission_profile: &PermissionProfile) -> bool {
	- line 418: matches!(permission_profile, PermissionProfile::Managed { .. })


codex-rs/tui/src/chatwidget/permission_popups.rs (11 lines):
	- line 249: permission_profile: PermissionProfile,
	- line 250: active_permission_profile: ActivePermissionProfile,
	- line 270: tx.send(AppEvent::UpdateActivePermissionProfile(
	- line 284: selection: PermissionProfileSelection,
	- line 287: tx.send(AppEvent::SelectPermissionProfile(selection.clone()));
	- line 296: profile_selection: Option<PermissionProfileSelection>,
	- line 371: current_permission_profile: &PermissionProfile,
	- line 381: "full-access" => matches!(current_permission_profile, PermissionProfile::Disabled),
	- line 386: PermissionProfile::Managed { .. }
	- line 398: PermissionProfile::Managed { .. }
	- line 410: profile_selection: Option<PermissionProfileSelection>,


sdk/python/src/openai_codex/_sandbox.py (11 lines):
	- line 7: DangerFullAccessSandboxPolicy,
	- line 8: ReadOnlySandboxPolicy,
	- line 10: SandboxPolicy,
	- line 11: WorkspaceWriteSandboxPolicy,
	- line 53: def _sandbox_policy(sandbox: Sandbox | None) -> SandboxPolicy | None:
	- line 61: return SandboxPolicy(
	- line 62: root=ReadOnlySandboxPolicy(type="readOnly"),
	- line 65: return SandboxPolicy(
	- line 66: root=WorkspaceWriteSandboxPolicy(type="workspaceWrite"),
	- line 69: return SandboxPolicy(
	- line 70: root=DangerFullAccessSandboxPolicy(type="dangerFullAccess"),


codex-rs/core/src/tools/sandboxing.rs (11 lines):
	- line 21: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 196: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 241: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 276: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 283: file_system_sandbox_policy: &FileSystemSandboxPolicy,
	- line 390: pub permissions: &'a codex_protocol::models::PermissionProfile,
	- line 392: pub exec_server_permissions: &'a codex_protocol::models::PermissionProfile,
	- line 400: pub use_legacy_landlock: bool,
	- line 465: use_legacy_landlock: self.use_legacy_landlock,
	- line 500: use_legacy_landlock: self.use_legacy_landlock,
	- line 524: use_legacy_landlock: self.use_legacy_landlock,


codex-rs/config/src/config_toml.rs (11 lines):
	- line 52: use codex_protocol::models::PermissionProfile;
	- line 54: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 747: permission_profile_constraint: Option<&crate::Constrained<PermissionProfile>>,
	- line 748: ) -> PermissionProfile {
	- line 779: SandboxMode::ReadOnly => PermissionProfile::read_only(),
	- line 788: NetworkSandboxPolicy::Enabled
	- line 790: NetworkSandboxPolicy::Restricted
	- line 792: PermissionProfile::workspace_write_with(
	- line 799: None => PermissionProfile::workspace_write(),
	- line 801: SandboxMode::DangerFullAccess => PermissionProfile::Disabled,
	- line 811: PermissionProfile::read_only()


codex-rs/tui/src/debug_config.rs (11 lines):
	- line 18: use codex_protocol::models::PermissionProfile;
	- line 19: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 101: SandboxModeRequirement::ReadOnly => PermissionProfile::read_only(),
	- line 102: SandboxModeRequirement::WorkspaceWrite => PermissionProfile::workspace_write(),
	- line 103: SandboxModeRequirement::DangerFullAccess => PermissionProfile::Disabled,
	- line 104: SandboxModeRequirement::ExternalSandbox => PermissionProfile::External {
	- line 105: network: NetworkSandboxPolicy::Restricted,
	- line 690: use codex_protocol::models::PermissionProfile;
	- line 866: Constrained::allow_any(PermissionProfile::read_only()),
	- line 1079: Constrained::allow_any(PermissionProfile::read_only()),
	- line 1106: Constrained::new(PermissionProfile::read_only(), |candidate| {


codex-rs/exec/src/lib.rs (10 lines):
	- line 95: use codex_protocol::models::ActivePermissionProfile;
	- line 96: use codex_protocol::models::PermissionProfile;
	- line 939: codex_core::config::system_bwrap_warning(config.permissions.permission_profile())
	- line 1246: fn permission_profile_id_from_active_profile(active: ActivePermissionProfile) -> String {
	- line 1251: permission_profile: &PermissionProfile,
	- line 1255: PermissionProfile::Disabled => {
	- line 1258: PermissionProfile::External { .. } => None,
	- line 1259: PermissionProfile::Managed { .. } => {
	- line 1366: permission_profile: PermissionProfile,
	- line 1367: active_permission_profile: Option<codex_protocol::models::ActivePermissionProfile>,


codex-rs/core/src/guardian/tests.rs (10 lines):
	- line 7: use crate::config::PermissionProfileSnapshot;
	- line 46: use codex_protocol::models::PermissionProfile;
	- line 54: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 55: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 622: let environment_permission_profile = PermissionProfile::from_runtime_permissions(
	- line 623: &FileSystemSandboxPolicy::restricted(vec![
	- line 648: NetworkSandboxPolicy::Restricted,
	- line 654: PermissionProfileSnapshot::legacy(environment_permission_profile);
	- line 3558: &PermissionProfile::read_only()
	- line 3708: &PermissionProfile::read_only(),


codex-rs/memories/write/src/phase2.rs (10 lines):
	- line 23: use codex_protocol::models::PermissionProfile;
	- line 26: use codex_protocol::protocol::SandboxPolicy;
	- line 52: parent_permission_profile: PermissionProfile,
	- line 314: parent_permission_profile: PermissionProfile,
	- line 342: PermissionProfile::Disabled => agent_config
	- line 344: .set_permission_profile(PermissionProfile::Disabled),
	- line 345: PermissionProfile::External { network } => agent_config
	- line 347: .set_permission_profile(PermissionProfile::External { network }),
	- line 348: PermissionProfile::Managed { .. } => {
	- line 350: agent_config.set_legacy_sandbox_policy(SandboxPolicy::WorkspaceWrite {


codex-rs/protocol/src/approvals.rs (10 lines):
	- line 2: use crate::models::AdditionalPermissionProfile;
	- line 3: use crate::models::PermissionProfile;
	- line 7: use crate::request_permissions::RequestPermissionProfile;
	- line 21: pub struct ResolvedPermissionProfile {
	- line 22: pub permission_profile: PermissionProfile,
	- line 29: AdditionalPermissionProfile(AdditionalPermissionProfile),
	- line 31: ResolvedPermissionProfile(ResolvedPermissionProfile),
	- line 178: permissions: RequestPermissionProfile,
	- line 304: pub additional_permissions: Option<AdditionalPermissionProfile>,
	- line 340: additional_permissions: Option<&AdditionalPermissionProfile>,


codex-rs/protocol/src/request_permissions.rs (10 lines):
	- line 1: use crate::models::AdditionalPermissionProfile;
	- line 20: pub struct RequestPermissionProfile {
	- line 25: impl RequestPermissionProfile {
	- line 31: impl From<RequestPermissionProfile> for AdditionalPermissionProfile {
	- line 32: fn from(value: RequestPermissionProfile) -> Self {
	- line 40: impl From<AdditionalPermissionProfile> for RequestPermissionProfile {
	- line 41: fn from(value: AdditionalPermissionProfile) -> Self {
	- line 61: pub permissions: RequestPermissionProfile,
	- line 66: pub permissions: RequestPermissionProfile,
	- line 95: pub permissions: RequestPermissionProfile,


codex-rs/core/src/codex_thread.rs (9 lines):
	- line 30: use codex_protocol::models::ActivePermissionProfile;
	- line 31: use codex_protocol::models::PermissionProfile;
	- line 40: use codex_protocol::protocol::SandboxPolicy;
	- line 88: pub permission_profile: PermissionProfile,
	- line 89: pub active_permission_profile: Option<ActivePermissionProfile>,
	- line 127: pub fn sandbox_policy(&self) -> SandboxPolicy {
	- line 142: pub sandbox_policy: Option<SandboxPolicy>,
	- line 143: pub permission_profile: Option<PermissionProfile>,
	- line 144: pub active_permission_profile: Option<ActivePermissionProfile>,


codex-rs/core/src/tools/runtimes/unified_exec.rs (9 lines):
	- line 48: use codex_protocol::models::AdditionalPermissionProfile;
	- line 81: pub additional_permissions: Option<AdditionalPermissionProfile>,
	- line 98: pub additional_permissions: Option<AdditionalPermissionProfile>,
	- line 132: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 551: use crate::config::PermissionProfileSnapshot;
	- line 558: use codex_protocol::models::PermissionProfile;
	- line 581: use_legacy_landlock: false,
	- line 582: permission_profile: PermissionProfileSnapshot::legacy(
	- line 583: PermissionProfile::read_only(),


codex-rs/exec-server-protocol/src/protocol.rs (9 lines):
	- line 890: use codex_protocol::models::PermissionProfile;
	- line 894: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 896: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 1112: PermissionProfile::default(),
	- line 1157: let permissions = PermissionProfile::Managed {
	- line 1159: network: NetworkSandboxPolicy::Restricted,
	- line 1216: FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 1222: let permissions = PermissionProfile::from_runtime_permissions(
	- line 1224: NetworkSandboxPolicy::Restricted,


codex-rs/core/src/sandbox_tags.rs (9 lines):
	- line 2: use codex_protocol::models::PermissionProfile;
	- line 9: profile: &PermissionProfile,
	- line 14: PermissionProfile::Disabled => return "none",
	- line 15: PermissionProfile::External { .. } => return "external",
	- line 16: PermissionProfile::Managed {
	- line 41: profile: &PermissionProfile,
	- line 45: PermissionProfile::Disabled => "danger-full-access",
	- line 46: PermissionProfile::External { .. } => "external-sandbox",
	- line 47: PermissionProfile::Managed { .. } => {


codex-rs/state/src/extract.rs (9 lines):
	- line 185: use codex_protocol::models::PermissionProfile;
	- line 191: use codex_protocol::protocol::SandboxPolicy;
	- line 438: sandbox_policy: SandboxPolicy::DangerFullAccess,
	- line 458: let permission_profile: PermissionProfile = PermissionProfile::Disabled;
	- line 469: let permission_profile = PermissionProfile::workspace_write();
	- line 486: sandbox_policy: SandboxPolicy::DangerFullAccess,
	- line 530: sandbox_policy: SandboxPolicy::new_read_only_policy(),
	- line 571: sandbox_policy: SandboxPolicy::new_read_only_policy(),
	- line 597: let permission_profile = PermissionProfile::workspace_write();


codex-rs/core/src/context/environment_context.rs (9 lines):
	- line 2: use codex_protocol::models::PermissionProfile;
	- line 13: permission_profile: FileSystemPermissionProfileContext,
	- line 17: enum FileSystemPermissionProfileContext {
	- line 34: permission_profile: &PermissionProfile,
	- line 45: PermissionProfile::Managed { file_system, .. } => {
	- line 46: FileSystemPermissionProfileContext::Managed(ManagedFileSystemContext::from(
	- line 50: PermissionProfile::Disabled => FileSystemPermissionProfileContext::Disabled,
	- line 51: PermissionProfile::External { .. } => FileSystemPermissionProfileContext::External,
	- line 92: impl FileSystemPermissionProfileContext {


codex-rs/tui/src/chatwidget/windows_sandbox_prompts.rs (8 lines):
	- line 75: profile_selection: Option<PermissionProfileSelection>,
	- line 89: let describe_profile = |profile: &PermissionProfile| {
	- line 90: if matches!(profile, PermissionProfile::Disabled) {
	- line 215: _profile_selection: Option<PermissionProfileSelection>,
	- line 226: profile_selection: Option<PermissionProfileSelection>,
	- line 335: _profile_selection: Option<PermissionProfileSelection>,
	- line 343: profile_selection: Option<PermissionProfileSelection>,
	- line 460: _profile_selection: Option<PermissionProfileSelection>,


codex-rs/tui/src/app/thread_routing.rs (8 lines):
	- line 743: .and_then(RuntimePermissionProfileOverride::turn_permission_profile),
	- line 836: active_permission_profile: Option<&ActivePermissionProfile>,
	- line 837: runtime_permission_profile_override: Option<&PermissionProfile>,
	- line 1292: PermissionProfileSnapshot::from_session_snapshot(
	- line 1902: use codex_protocol::models::ActivePermissionProfile;
	- line 1929: TurnPermissionsOverride::ActiveProfile(ActivePermissionProfile::new(
	- line 1940: .set_permission_profile(PermissionProfile::read_only())
	- line 1955: let permission_profile = PermissionProfile::workspace_write();


codex-rs/thread-store/src/local/read_thread.rs (8 lines):
	- line 3: use codex_protocol::models::PermissionProfile;
	- line 495: permission_profile: PermissionProfile::read_only(),
	- line 534: use codex_protocol::protocol::SandboxPolicy;
	- line 938: let permission_profile: PermissionProfile = PermissionProfile::Disabled;
	- line 956: assert_eq!(thread.permission_profile, PermissionProfile::Disabled);
	- line 994: assert_eq!(thread.permission_profile, PermissionProfile::Disabled);
	- line 1074: let legacy_policy = SandboxPolicy::WorkspaceWrite {
	- line 1082: PermissionProfile::from_legacy_sandbox_policy_for_cwd(


codex-rs/tui/src/app/event_dispatch.rs (8 lines):
	- line 14: use crate::app_server_session::UnsupportedLegacyPermissionProfile;
	- line 726: .downcast_ref::<UnsupportedLegacyPermissionProfile>()
	- line 1554: .and_then(RuntimePermissionProfileOverride::turn_permission_profile),
	- line 2115: .send(AppEvent::UpdateActivePermissionProfile(
	- line 2284: AppEvent::UpdateActivePermissionProfile(active_permission_profile) => {
	- line 2305: PermissionProfileSnapshot::active(
	- line 2317: Some(RuntimePermissionProfileOverride::from_config(&self.config));
	- line 2358: AppEvent::SelectPermissionProfile(selection) => {


codex-rs/exec-server/src/process_sandbox.rs (8 lines):
	- line 16: use codex_protocol::models::PermissionProfile;
	- line 27: use codex_sandboxing::resolve_windows_restricted_token_filesystem_overrides;
	- line 51: permission_profile: PermissionProfile,
	- line 128: let permissions: PermissionProfile = sandbox_context
	- line 165: // seccomp, so the outer filesystem sandbox must expose both paths.
	- line 179: let permissions = PermissionProfile::from_runtime_permissions_with_enforcement(
	- line 239: use_legacy_landlock: sandbox_context.use_legacy_landlock,
	- line 264: resolve_windows_restricted_token_filesystem_overrides(


codex-rs/core/src/windows_sandbox.rs (8 lines):
	- line 11: use codex_protocol::models::PermissionProfile;
	- line 103: permission_profile: &PermissionProfile,
	- line 154: _permission_profile: &PermissionProfile,
	- line 174: permission_profile: &PermissionProfile,
	- line 191: permission_profile: &PermissionProfile,
	- line 211: _permission_profile: &PermissionProfile,
	- line 222: _permission_profile: &PermissionProfile,
	- line 241: pub permission_profile: PermissionProfile,


codex-rs/app-server-protocol/schema/typescript/v2/index.ts (8 lines):
	- line 9: export type { ActivePermissionProfile } from "./ActivePermissionProfile";
	- line 16: export type { AdditionalPermissionProfile } from "./AdditionalPermissionProfile";
	- line 199: export type { GrantedPermissionProfile } from "./GrantedPermissionProfile";
	- line 332: export type { PermissionProfileListParams } from "./PermissionProfileListParams";
	- line 333: export type { PermissionProfileListResponse } from "./PermissionProfileListResponse";
	- line 334: export type { PermissionProfileSummary } from "./PermissionProfileSummary";
	- line 411: export type { RequestPermissionProfile } from "./RequestPermissionProfile";
	- line 419: export type { SandboxPolicy } from "./SandboxPolicy";


codex-rs/tui/src/app/app_server_requests.rs (8 lines):
	- line 15: use codex_protocol::request_permissions::RequestPermissionProfile as CoreRequestPermissionProfile;
	- line 129: if let Err(err) = CoreRequestPermissionProfile::try_from(params.permissions.clone())
	- line 467: use codex_protocol::request_permissions::RequestPermissionProfile;
	- line 541: permissions: RequestPermissionProfile::default(),
	- line 599: let permissions = codex_app_server_protocol::RequestPermissionProfile {
	- line 612: RequestPermissionProfile::try_from(permissions.clone()).expect_err("relative path");
	- line 700: permissions: RequestPermissionProfile {
	- line 721: permissions: codex_app_server_protocol::GrantedPermissionProfile {


scripts/codex_package/cli.py (8 lines):
	- line 125: "--bwrap-bin",
	- line 128: "Optional prebuilt Linux bwrap executable. If omitted for Linux "
	- line 129: "targets, bwrap is built with Cargo."
	- line 201: bwrap_bin=resolve_optional_input_path(
	- line 202: args.bwrap_bin,
	- line 203: "prebuilt Linux bwrap executable",
	- line 204: "--bwrap-bin",
	- line 222: bwrap_bin=source_outputs.bwrap_bin,


codex-rs/tui/src/app_command.rs (8 lines):
	- line 17: use codex_protocol::models::ActivePermissionProfile;
	- line 18: use codex_protocol::models::PermissionProfile;
	- line 37: active_permission_profile: Option<ActivePermissionProfile>,
	- line 50: permission_profile: Option<PermissionProfile>,
	- line 51: active_permission_profile: Option<ActivePermissionProfile>,
	- line 119: active_permission_profile: Option<ActivePermissionProfile>,
	- line 149: permission_profile: Option<PermissionProfile>,
	- line 150: active_permission_profile: Option<ActivePermissionProfile>,


codex-rs/exec-server/src/remote_file_system.rs (7 lines):
	- line 440: use codex_protocol::models::PermissionProfile;
	- line 444: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 446: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 455: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 463: PermissionProfile::from_runtime_permissions(&policy, NetworkSandboxPolicy::Restricted);
	- line 477: let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
	- line 485: PermissionProfile::from_runtime_permissions(&policy, NetworkSandboxPolicy::Restricted);


codex-rs/app-server/src/request_processors/thread_processor.rs (7 lines):
	- line 166: codex_protocol::protocol::SandboxPolicy::ReadOnly { .. }
	- line 169: codex_protocol::protocol::SandboxPolicy::WorkspaceWrite { .. }
	- line 172: codex_protocol::protocol::SandboxPolicy::DangerFullAccess
	- line 175: codex_protocol::protocol::SandboxPolicy::ExternalSandbox { .. }
	- line 1325: codex_protocol::models::PermissionProfile::Disabled
	- line 1326: | codex_protocol::models::PermissionProfile::External { .. } => true,
	- line 1327: codex_protocol::models::PermissionProfile::Managed { .. } => {


codex-rs/app-server-protocol/src/protocol/common.rs (7 lines):
	- line 1053: PermissionProfileList => "permissionProfile/list" {
	- line 1054: params: v2::PermissionProfileListParams,
	- line 1056: response: v2::PermissionProfileListResponse,
	- line 3156: sandbox: v2::SandboxPolicy::DangerFullAccess,
	- line 3212: "activePermissionProfile": null,
	- line 4401: sandbox_policy: v2::SandboxPolicy::DangerFullAccess,
	- line 4487: additional_permissions: Some(v2::AdditionalPermissionProfile {


codex-rs/core/src/tools/handlers/apply_patch.rs (7 lines):
	- line 46: use codex_protocol::models::AdditionalPermissionProfile;
	- line 238: file_system_sandbox_policy: &codex_protocol::permissions::FileSystemSandboxPolicy,
	- line 240: ) -> Option<AdditionalPermissionProfile> {
	- line 262: let permissions = (!write_paths.is_empty()).then_some(AdditionalPermissionProfile {
	- line 289: codex_protocol::permissions::FileSystemSandboxPolicy,
	- line 336: codex_protocol::permissions::FileSystemSandboxPolicy,
	- line 347: codex_protocol::permissions::FileSystemSandboxPolicy::unrestricted(),


codex-rs/bwrap/src/main.rs (7 lines):
	- line 1: #[cfg(all(target_os = "linux", bwrap_available))]
	- line 9: fn bwrap_main(argc: libc::c_int, argv: *const *const c_char) -> libc::c_int;
	- line 27: let exit_code = unsafe { bwrap_main(cstrings.len() as libc::c_int, argv_ptrs.as_ptr()) };
	- line 31: #[cfg(all(target_os = "linux", not(bwrap_available)))]
	- line 34: r#"bubblewrap is not available in this build.
	- line 38: - bubblewrap sources expected at codex-rs/vendor/bubblewrap (default)"#
	- line 44: panic!("bwrap is only supported on Linux");


codex-rs/ext/guardian-v2/src/sync_reviewer/reviewer_config.rs (7 lines):
	- line 14: use codex_protocol::models::PermissionProfile;
	- line 15: use codex_protocol::models::PermissionProfileSnapshot;
	- line 19: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 53: PermissionProfileSnapshot::legacy(read_only_permission_profile(
	- line 272: fn read_only_permission_profile(permission_profile: &PermissionProfile) -> PermissionProfile {
	- line 275: .unwrap_or(PermissionProfile::External {
	- line 276: network: NetworkSandboxPolicy::Restricted,


codex-rs/linux-sandbox/src/lib.rs (7 lines):
	- line 4: //! - in-process restrictions (`no_new_privs` + seccomp), and
	- line 5: //! - bubblewrap for filesystem isolation.
	- line 7: mod bazel_bwrap;
	- line 9: mod bundled_bwrap;
	- line 11: mod bwrap;
	- line 17: mod landlock;
	- line 27: /// Exit status returned when bundled bubblewrap fails digest verification.


codex-rs/tui/src/status/card.rs (7 lines):
	- line 19: use codex_protocol::models::ActivePermissionProfile;
	- line 23: use codex_protocol::models::PermissionProfile;
	- line 597: permission_profile: &PermissionProfile,
	- line 637: active_permission_profile: Option<&ActivePermissionProfile>,
	- line 638: permission_profile: &PermissionProfile,
	- line 670: if permission_profile == &PermissionProfile::Disabled =>
	- line 695: && permission_profile == &PermissionProfile::Disabled


codex-rs/core/src/guardian/review_session.rs (7 lines):
	- line 24: use codex_protocol::models::PermissionProfile;
	- line 25: use codex_protocol::models::PermissionProfileSnapshot;
	- line 1176: PermissionProfileSnapshot::legacy(read_only_guardian_permission_profile(
	- line 1493: permission_profile: &PermissionProfile,
	- line 1494: ) -> PermissionProfile {
	- line 1497: .unwrap_or(PermissionProfile::External {
	- line 1498: network: codex_protocol::permissions::NetworkSandboxPolicy::Restricted,


codex-rs/exec-server/src/local_file_system.rs (6 lines):
	- line 1328: use codex_protocol::models::PermissionProfile;
	- line 1329: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 1330: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 1338: PermissionProfile::from_runtime_permissions(
	- line 1339: &FileSystemSandboxPolicy::restricted(Vec::new()),
	- line 1340: NetworkSandboxPolicy::Restricted,


codex-rs/tui/src/chatwidget/settings.rs (6 lines):
	- line 25: snapshot: PermissionProfileSnapshot,
	- line 36: profile: PermissionProfile,
	- line 37: active_permission_profile: Option<ActivePermissionProfile>,
	- line 42: PermissionProfileSnapshot::from_session_snapshot(
	- line 466: let permission_profile = PermissionProfile::from_legacy_sandbox_policy_for_cwd(
	- line 470: let permission_snapshot = PermissionProfileSnapshot::from_session_snapshot(


codex-rs/core/src/state/turn.rs (6 lines):
	- line 13: use codex_protocol::request_permissions::RequestPermissionProfile;
	- line 27: use codex_protocol::models::AdditionalPermissionProfile;
	- line 99: granted_permissions_by_environment_id: HashMap<String, AdditionalPermissionProfile>,
	- line 111: pub(crate) requested_permissions: RequestPermissionProfile,
	- line 237: permissions: AdditionalPermissionProfile,
	- line 253: ) -> Option<AdditionalPermissionProfile> {


codex-rs/tui/src/dynamic_tools.rs (6 lines):
	- line 17: use codex_app_server_protocol::SandboxPolicy;
	- line 620: SandboxPolicy::DangerFullAccess => SandboxMode::DangerFullAccess,
	- line 621: SandboxPolicy::ReadOnly { .. } => SandboxMode::ReadOnly,
	- line 622: SandboxPolicy::WorkspaceWrite { .. } => SandboxMode::WorkspaceWrite,
	- line 623: SandboxPolicy::ExternalSandbox { .. } => {
	- line 1280: sandbox_policy: Option<SandboxPolicy>,


codex-rs/app-server/src/request_processors/catalog_processor.rs (6 lines):
	- line 192: params: PermissionProfileListParams,
	- line 412: params: PermissionProfileListParams,
	- line 413: ) -> Result<PermissionProfileListResponse, JSONRPCErrorError> {
	- line 414: let PermissionProfileListParams { cursor, limit, cwd } = params;
	- line 433: .map(|profile| PermissionProfileSummary {
	- line 459: Ok(PermissionProfileListResponse { data, next_cursor })


codex-rs/core/src/sandboxing/mod.rs (6 lines):
	- line 24: use codex_protocol::models::PermissionProfile;
	- line 30: use codex_sandboxing::resolve_windows_restricted_token_filesystem_overrides;
	- line 67: pub permission_profile: PermissionProfile,
	- line 90: permission_profile: PermissionProfile,
	- line 158: resolve_windows_restricted_token_filesystem_overrides(
	- line 182: env.insert(CODEX_SANDBOX_ENV_VAR.to_string(), "seatbelt".to_string());


codex-rs/windows-sandbox-rs/src/allow.rs (6 lines):
	- line 47: use codex_protocol::models::PermissionProfile;
	- line 48: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 57: ) -> PermissionProfile {
	- line 58: PermissionProfile::workspace_write_with(
	- line 60: NetworkSandboxPolicy::Restricted,
	- line 71: permission_profile: &PermissionProfile,


codex-rs/core/src/tools/handlers/view_image.rs (6 lines):
	- line 268: use crate::config::PermissionProfileSnapshot;
	- line 276: use codex_protocol::models::PermissionProfile;
	- line 364: .set_permission_profile(PermissionProfile::Disabled)
	- line 371: PermissionProfileSnapshot::legacy(PermissionProfile::read_only());
	- line 443: PermissionProfileSnapshot::legacy(PermissionProfile::Disabled);
	- line 480: PermissionProfileSnapshot::legacy(PermissionProfile::Disabled);


codex-rs/core/src/tools/approvals.rs (6 lines):
	- line 37: use codex_protocol::models::AdditionalPermissionProfile;
	- line 43: use codex_protocol::request_permissions::RequestPermissionProfile;
	- line 75: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 89: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 101: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 149: permissions: RequestPermissionProfile,


codex-rs/app-server-protocol/src/protocol/v2/item.rs (5 lines):
	- line 1: use super::AdditionalPermissionProfile;
	- line 8: use super::RequestPermissionProfile;
	- line 626: pub permissions: RequestPermissionProfile,
	- line 685: permissions: RequestPermissionProfile,
	- line 1577: pub additional_permissions: Option<AdditionalPermissionProfile>,


codex-rs/codex-mcp/src/runtime.rs (5 lines):
	- line 32: use codex_protocol::models::PermissionProfile;
	- line 598: pub permission_profile: PermissionProfile,
	- line 602: pub use_legacy_landlock: bool,
	- line 863: permission_profile: PermissionProfile::workspace_write(),
	- line 866: use_legacy_landlock: false,


codex-rs/cli/src/main.rs (5 lines):
	- line 455: type HostSandboxArgs = codex_cli::LandlockCommand;
	- line 1644: codex_cli::run_command_under_seatbelt(
	- line 1651: codex_cli::run_command_under_landlock(
	- line 4846: enable: vec!["use_linux_sandbox_bwrap".to_string()],
	- line 4852: vec!["features.use_linux_sandbox_bwrap=true".to_string(),]


codex-rs/protocol/src/environment.rs (5 lines):
	- line 5: use crate::models::PermissionProfileSnapshot;
	- line 32: pub permission_profile: PermissionProfileSnapshot,
	- line 39: /// Whether Linux sandbox processes use the legacy Landlock backend.
	- line 40: pub use_legacy_landlock: bool,
	- line 64: .field("use_legacy_landlock", &self.use_legacy_landlock)


codex-rs/tui/src/history_cell/tests.rs (5 lines):
	- line 790: permission_profile: PermissionProfile::read_only(),
	- line 2054: let permission_profile: PermissionProfile = PermissionProfile::Managed {
	- line 2055: network: NetworkSandboxPolicy::Enabled,
	- line 2067: let permission_profile: PermissionProfile = PermissionProfile::External {
	- line 2068: network: NetworkSandboxPolicy::Enabled,


codex-rs/utils/cli/src/config_override.rs (5 lines):
	- line 88: if key == "use_legacy_landlock" {
	- line 89: "features.use_legacy_landlock".to_string()
	- line 136: fn canonicalizes_use_legacy_landlock_alias() {
	- line 138: raw_overrides: vec!["use_legacy_landlock=true".to_string()],
	- line 141: assert_eq!(parsed[0].0.as_str(), "features.use_legacy_landlock");


codex-rs/cli/src/lib.rs (5 lines):
	- line 12: pub use debug_sandbox::run_command_under_landlock;
	- line 13: pub use debug_sandbox::run_command_under_seatbelt;
	- line 96: /// Full command args to run under seatbelt.
	- line 107: pub struct LandlockCommand {
	- line 187: /// Full command args to run under Windows restricted token sandbox.


codex-rs/core/src/tools/network_approval.rs (5 lines):
	- line 24: use codex_protocol::models::PermissionProfile;
	- line 59: pub permission_profile: PermissionProfile,
	- line 191: fn permission_profile_allows_network_approval_flow(permission_profile: &PermissionProfile) -> bool {
	- line 192: matches!(permission_profile, PermissionProfile::Managed { .. })
	- line 241: permission_profile: PermissionProfile,


codex-rs/core/src/spawn.rs (5 lines):
	- line 10: use codex_protocol::permissions::NetworkSandboxPolicy;
	- line 17: /// 2. NetworkSandboxPolicy is restricted for the tool call.
	- line 24: /// value is "seatbelt" for macOS, but it may change in the future to
	- line 38: /// For now, we take `NetworkSandboxPolicy` as a parameter to spawn_child()
	- line 46: pub network_sandbox_policy: NetworkSandboxPolicy,


codex-rs/features/src/tests.rs (5 lines):
	- line 384: fn use_legacy_landlock_config_records_deprecation_notice() {
	- line 386: entries.insert("use_legacy_landlock".to_string(), true);
	- line 393: assert_eq!(usages[0].alias, "features.use_legacy_landlock");
	- line 394: assert_eq!(usages[0].feature, Feature::UseLegacyLandlock);
	- line 397: "`[features].use_legacy_landlock` is deprecated and will be removed soon."


codex-rs/core/src/exec_policy.rs (5 lines):
	- line 24: use codex_protocol::models::PermissionProfile;
	- line 169: pub(crate) permission_profile: &'a PermissionProfile,
	- line 284: pub(crate) permission_profile: PermissionProfile,
	- line 821: fn profile_has_managed_filesystem_restrictions(permission_profile: &PermissionProfile) -> bool {
	- line 823: matches!(permission_profile, PermissionProfile::Managed { .. })


codex-rs/core/src/agent/control/spawn.rs (4 lines):
	- line 5: use crate::config::PermissionProfileSnapshot;
	- line 388: PermissionProfileSnapshot::active_with_profile_workspace_roots(
	- line 394: None => PermissionProfileSnapshot::legacy(
	- line 523: PermissionProfileSnapshot::legacy(permissions);


codex-rs/tui/src/history_cell/session.rs (4 lines):
	- line 213: permission_profile: &PermissionProfile,
	- line 218: PermissionProfile::Disabled
	- line 219: | PermissionProfile::Managed {
	- line 221: network: NetworkSandboxPolicy::Enabled,


codex-rs/tui/src/external_editor.rs (4 lines):
	- line 9: use codex_protocol::permissions::FileSystemSandboxPolicy;
	- line 62: file_system_policy: &FileSystemSandboxPolicy,
	- line 177: file_system_policy: &FileSystemSandboxPolicy,
	- line 306: let policy = FileSystemSandboxPolicy::read_only();


codex-rs/app-server-protocol/src/export.rs (4 lines):
	- line 2823: import type { SandboxPolicy } from "./SandboxPolicy";
	- line 2843: sandboxPolicy?: SandboxPolicy | null,
	- line 2864: assert_eq!(filtered.contains("sandboxPolicy?: SandboxPolicy"), true);
	- line 2866: filtered.contains(r#"import type { SandboxPolicy } from "./SandboxPolicy";"#),


codex-rs/thread-store/src/local/update_thread_metadata.rs (4 lines):
	- line 857: use codex_protocol::models::PermissionProfile;
	- line 1483: permission_profile: Some(PermissionProfile::Disabled),
	- line 1493: assert_eq!(thread.permission_profile, PermissionProfile::Disabled);
	- line 1513: let permission_profile: PermissionProfile = PermissionProfile::Disabled;


codex-rs/core/src/mcp_tool_call.rs (4 lines):
	- line 67: use codex_protocol::models::PermissionProfile;
	- line 803: // TurnEnvironment::sandbox_context instead of the runtime-wide Landlock value.
	- line 808: use_legacy_landlock: prepared_call.config().use_legacy_landlock,
	- line 1371: permission_profile: &PermissionProfile,


codex-rs/tui/src/chatwidget/tests.rs (4 lines):
	- line 34: pub(super) use codex_app_server_protocol::AdditionalPermissionProfile as AppServerAdditionalPermissionProfile;
	- line 146: pub(super) use codex_protocol::models::ActivePermissionProfile;
	- line 151: pub(super) use codex_protocol::models::PermissionProfile;
	- line 161: pub(super) use codex_protocol::request_permissions::RequestPermissionProfile;


scripts/codex_package/layout.py (4 lines):
	- line 68: if inputs.bwrap_bin is not None:
	- line 69: copy_executable(inputs.bwrap_bin, resources_dir / "bwrap", is_windows=False)
	- line 149: required_files.append(Path("codex-resources") / "bwrap")
	- line 150: executable_files.append(Path("codex-resources") / "bwrap")


codex-rs/mcp-server/src/outgoing_message.rs (4 lines):
	- line 242: use codex_protocol::models::PermissionProfile;
	- line 335: permission_profile: PermissionProfile::read_only(),
	- line 379: permission_profile: PermissionProfile::read_only(),
	- line 445: permission_profile: PermissionProfile::read_only(),


codex-rs/windows-sandbox-rs/src/token.rs (4 lines):
	- line 373: /// Create a restricted token that includes all provided capability SIDs.
	- line 384: /// Create a restricted token that includes all provided capability SIDs, the token user SID, and
	- line 404: /// Create a restricted token that includes all provided capability SIDs.
	- line 415: /// Create a restricted token that includes all provided capability SIDs, the token user SID, and


codex-rs/tui/src/session_state.rs (4 lines):
	- line 12: use codex_protocol::models::ActivePermissionProfile;
	- line 13: use codex_protocol::models::PermissionProfile;
	- line 45: pub(crate) permission_profile: PermissionProfile,
	- line 48: pub(crate) active_permission_profile: Option<ActivePermissionProfile>,


codex-rs/windows-sandbox-rs/src/wrapper.rs (4 lines):
	- line 4: //! analogous to the macOS seatbelt and Linux sandbox wrapper paths. The wrapper
	- line 17: use codex_protocol::models::PermissionProfile;
	- line 44: permission_profile: &PermissionProfile,
	- line 164: permission_profile: PermissionProfile,


codex-rs/app-server/src/command_exec.rs (4 lines):
	- line 693: use codex_protocol::models::PermissionProfile;
	- line 723: PermissionProfile::read_only(),
	- line 841: PermissionProfile::read_only(),
	- line 935: PermissionProfile::read_only(),


codex-rs/shell-escalation/src/unix/escalate_server.rs (4 lines):
	- line 388: use codex_protocol::models::AdditionalPermissionProfile as PermissionProfile;
	- line 978: EscalationPermissions::AdditionalPermissionProfile(PermissionProfile {
	- line 987: expected_permissions: EscalationPermissions::AdditionalPermissionProfile(
	- line 988: PermissionProfile {


codex-rs/core/src/state/session.rs (4 lines):
	- line 3: use codex_protocol::models::AdditionalPermissionProfile;
	- line 49: granted_permissions_by_environment_id: HashMap<String, AdditionalPermissionProfile>,
	- line 317: permissions: AdditionalPermissionProfile,
	- line 333: ) -> Option<AdditionalPermissionProfile> {


codex-rs/windows-sandbox-rs/src/unified_exec/mod.rs (4 lines):
	- line 15: use codex_protocol::models::PermissionProfile;
	- line 29: pub permission_profile: &'a PermissionProfile,
	- line 102: permission_profile: &PermissionProfile,
	- line 134: permission_profile: &PermissionProfile,


codex-rs/tui/src/app/permission_shortcuts.rs (4 lines):
	- line 12: selection: PermissionProfileSelection,
	- line 21: let active_profile = ActivePermissionProfile::new(selection.profile_id.clone());
	- line 33: PermissionProfileSnapshot::active(profile, active_profile),
	- line 55: self.runtime_permission_profile_override = Some(RuntimePermissionProfileOverride::from_config(&config));


codex-rs/analytics/src/events.rs (4 lines):
	- line 35: use codex_protocol::models::AdditionalPermissionProfile;
	- line 340: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 344: additional_permissions: Option<AdditionalPermissionProfile>,
	- line 353: additional_permissions: Option<AdditionalPermissionProfile>,


codex-rs/windows-sandbox-rs/src/elevated/ipc_framed.rs (4 lines):
	- line 13: use codex_protocol::models::PermissionProfile;
	- line 63: pub permission_profile: PermissionProfile,
	- line 227: permission_profile: PermissionProfile::read_only(),
	- line 253: assert_eq!(PermissionProfile::read_only(), payload.permission_profile);


codex-rs/tui/src/chatwidget.rs (4 lines):
	- line 59: use crate::legacy_core::config::PermissionProfileSnapshot;
	- line 266: use crate::app_event::PermissionProfileSelection;
	- line 483: use codex_protocol::models::ActivePermissionProfile;
	- line 484: use codex_protocol::models::PermissionProfile;


codex-rs/exec-server/src/environment.rs (4 lines):
	- line 1835: codex_protocol::models::PermissionProfile::workspace_write(),
	- line 1881: codex_protocol::models::PermissionProfile::from_runtime_permissions(
	- line 1882: &codex_protocol::permissions::FileSystemSandboxPolicy::restricted(Vec::new()),
	- line 1883: codex_protocol::permissions::NetworkSandboxPolicy::Restricted,


codex-rs/core/src/config/permission_profile_selection.rs (3 lines):
	- line 6: pub struct ResolvedPermissionProfileSelection<'a> {
	- line 21: ) -> std::io::Result<ResolvedPermissionProfileSelection<'a>> {
	- line 31: Ok(ResolvedPermissionProfileSelection {


codex-rs/ext/guardian-v2/src/sync_reviewer/prompt.rs (3 lines):
	- line 14: use codex_protocol::models::PermissionProfile;
	- line 36: parent_permission_profile: &PermissionProfile,
	- line 234: parent_permission_profile: &PermissionProfile,


codex-rs/state/src/model/thread_metadata.rs (3 lines):
	- line 8: use codex_protocol::protocol::SandboxPolicy;
	- line 222: pub sandbox_policy: SandboxPolicy,
	- line 258: sandbox_policy: SandboxPolicy::new_read_only_policy(),


codex-rs/core/src/tools/spec_plan.rs (3 lines):
	- line 74: use codex_protocol::models::PermissionProfile;
	- line 993: PermissionProfile::Managed { .. }
	- line 997: PermissionProfile::Managed { .. }


codex-rs/app-server/src/request_processors.rs (3 lines):
	- line 132: use codex_app_server_protocol::PermissionProfileListParams;
	- line 133: use codex_app_server_protocol::PermissionProfileListResponse;
	- line 134: use codex_app_server_protocol::PermissionProfileSummary;


codex-rs/core/src/tools/orchestrator.rs (3 lines):
	- line 95: use_legacy_landlock: attempt.use_legacy_landlock,
	- line 298: use_legacy_landlock: sandbox_config.use_legacy_landlock,
	- line 472: use_legacy_landlock: sandbox_config.use_legacy_landlock,


codex-rs/tui/src/windows_sandbox.rs (3 lines):
	- line 16: use codex_protocol::models::PermissionProfile;
	- line 65: permission_profile: &PermissionProfile,
	- line 112: permission_profile: &PermissionProfile,


codex-rs/thread-store/src/types.rs (3 lines):
	- line 14: use codex_protocol::models::PermissionProfile;
	- line 632: pub permission_profile: PermissionProfile,
	- line 762: pub permission_profile: Option<PermissionProfile>,


codex-rs/core-plugins/src/plugin_metrics_sidecar.rs (3 lines):
	- line 9: use codex_protocol::models::AdditionalPermissionProfile;
	- line 202: pub fn additional_permissions(&self) -> AdditionalPermissionProfile {
	- line 203: AdditionalPermissionProfile {


codex-rs/core/src/tools/runtimes/apply_patch.rs (3 lines):
	- line 25: use codex_protocol::models::AdditionalPermissionProfile;
	- line 51: pub additional_permissions: Option<AdditionalPermissionProfile>,
	- line 111: use_legacy_landlock: attempt.use_legacy_landlock,


codex-rs/core/src/turn_metadata.rs (3 lines):
	- line 36: use codex_protocol::models::PermissionProfile;
	- line 87: permission_profile: &PermissionProfile,
	- line 155: permission_profile: &PermissionProfile,


codex-rs/sandboxing/src/violation.rs (3 lines):
	- line 24: (FileSystemSandboxViolationReason::PolicyDenied, "seccomp"),
	- line 26: (FileSystemSandboxViolationReason::PolicyDenied, "landlock"),
	- line 60: Self::Seatbelt => "seatbelt",


codex-rs/tui/src/approval_events.rs (3 lines):
	- line 12: use codex_app_server_protocol::AdditionalPermissionProfile;
	- line 46: pub(crate) additional_permissions: Option<AdditionalPermissionProfile>,
	- line 72: additional_permissions: Option<&AdditionalPermissionProfile>,


codex-rs/exec-server/src/server/file_system_handler.rs (3 lines):
	- line 359: use codex_protocol::protocol::SandboxPolicy;
	- line 387: ("danger.txt", SandboxPolicy::DangerFullAccess),
	- line 390: SandboxPolicy::ExternalSandbox {


codex-rs/tui/src/app/thread_settings.rs (3 lines):
	- line 17: use codex_protocol::models::PermissionProfile;
	- line 67: let workspace_profile = PermissionProfile::workspace_write();
	- line 237: session.permission_profile = PermissionProfile::from_legacy_sandbox_policy_for_cwd(


codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs (2 lines):
	- line 23: use codex_protocol::models::PermissionProfile;
	- line 316: permission_profile: &PermissionProfile,


codex-rs/app-server-protocol/src/protocol/v2/turn.rs (2 lines):
	- line 3: use super::SandboxPolicy;
	- line 203: pub sandbox_policy: Option<SandboxPolicy>,


codex-rs/core/src/unified_exec/mod.rs (2 lines):
	- line 32: use codex_protocol::models::AdditionalPermissionProfile;
	- line 122: pub additional_permissions: Option<AdditionalPermissionProfile>,


codex-rs/core/src/context/world_state/permissions.rs (2 lines):
	- line 9: use codex_protocol::models::PermissionProfile;
	- line 36: permission_profile: &PermissionProfile,


codex-rs/core/src/tools/handlers/unified_exec.rs (2 lines):
	- line 11: use codex_protocol::models::AdditionalPermissionProfile;
	- line 45: additional_permissions: Option<AdditionalPermissionProfile>,


codex-rs/core/src/exec_env.rs (2 lines):
	- line 9: use codex_protocol::models::ActivePermissionProfile;
	- line 49: active_permission_profile: Option<&ActivePermissionProfile>,


codex-rs/linux-sandbox/src/exec_util.rs (2 lines):
	- line 27: panic!("failed to read fd flags for preserved bubblewrap file descriptor {fd}: {err}");
	- line 38: panic!("failed to clear CLOEXEC for preserved bubblewrap file descriptor {fd}: {err}");


codex-rs/tui/src/app/agents_overview.rs (2 lines):
	- line 404: RuntimePermissionProfileOverride::from_config(&resume_config);
	- line 487: RuntimePermissionProfileOverride::from_restored_config(&self.config),


codex-rs/app-server/src/thread_state.rs (2 lines):
	- line 250: use codex_app_server_protocol::SandboxPolicy;
	- line 278: sandbox_policy: SandboxPolicy::ReadOnly {


codex-rs/tui/src/app/startup_prompts.rs (2 lines):
	- line 105: pub(super) fn emit_system_bwrap_warning(app_event_tx: &AppEventSender, config: &Config) {
	- line 107: codex_sandboxing::system_bwrap_warning(config.permissions.permission_profile())


codex-rs/thread-manager-sample/src/main.rs (2 lines):
	- line 40: use codex_core_api::PermissionProfile;
	- line 202: Constrained::allow_any(PermissionProfile::read_only()),


codex-rs/core/src/windows_sandbox_read_grants.rs (2 lines):
	- line 3: use codex_protocol::models::PermissionProfile;
	- line 10: permission_profile: &PermissionProfile,


codex-rs/core-api/src/lib.rs (2 lines):
	- line 122: pub use codex_protocol::models::PermissionProfile;
	- line 123: pub use codex_protocol::models::PermissionProfileSnapshot;


codex-rs/thread-store/src/local/mod.rs (2 lines):
	- line 695: use codex_protocol::protocol::SandboxPolicy;
	- line 942: sandbox_policy: SandboxPolicy::DangerFullAccess,


codex-rs/sandboxing/src/denial.rs (2 lines):
	- line 54: "seccomp",
	- line 56: "landlock",


codex-rs/core/src/tasks/user_shell.rs (2 lines):
	- line 47: use codex_protocol::models::PermissionProfile;
	- line 210: let permission_profile = PermissionProfile::Disabled;


codex-rs/rollout-trace/src/tool_dispatch.rs (2 lines):
	- line 10: use codex_protocol::models::AdditionalPermissionProfile;
	- line 93: additional_permissions: Option<AdditionalPermissionProfile>,


codex-rs/windows-sandbox-rs/src/unified_exec/backends/elevated.rs (2 lines):
	- line 20: use codex_protocol::models::PermissionProfile;
	- line 150: permission_profile: &PermissionProfile,


codex-rs/rollout/src/metadata.rs (2 lines):
	- line 14: use codex_protocol::protocol::SandboxPolicy;
	- line 57: builder.sandbox_policy = SandboxPolicy::new_read_only_policy();


codex-rs/tui/src/chatwidget/status_surfaces.rs (2 lines):
	- line 20: use codex_protocol::models::PermissionProfile;
	- line 1163: if permission_profile == PermissionProfile::Disabled {


sdk/python/src/openai_codex/types.py (2 lines):
	- line 19: SandboxPolicy,
	- line 60: "SandboxPolicy",


codex-rs/thread-store/src/in_memory.rs (2 lines):
	- line 14: use codex_protocol::models::PermissionProfile;
	- line 1102: .unwrap_or_else(PermissionProfile::read_only),


codex-rs/thread-store/src/thread_metadata_sync.rs (2 lines):
	- line 414: use codex_protocol::models::PermissionProfile;
	- line 634: let permission_profile = PermissionProfile::workspace_write();


codex-rs/app-server/src/request_processors/persisted_resume_settings.rs (2 lines):
	- line 2: use codex_protocol::models::ActivePermissionProfile;
	- line 11: pub(super) active_permission_profile: Option<ActivePermissionProfile>,


codex-rs/tui/src/chatwidget/permissions_menu.rs (2 lines):
	- line 169: let selection = PermissionProfileSelection {
	- line 202: let selection = PermissionProfileSelection {


codex-rs/app-server-protocol/src/protocol/v1.rs (2 lines):
	- line 17: use codex_protocol::protocol::SandboxPolicy;
	- line 197: pub sandbox_policy: Option<SandboxPolicy>,


codex-rs/http-client/src/custom_ca.rs (2 lines):
	- line 25: //! - on macOS seatbelt runs, `reqwest::Client::builder().build()` can panic inside
	- line 28: //!   because Codex itself commonly runs spawned test processes under seatbelt, so this is not just


codex-rs/app-server/src/request_processors/thread_summary.rs (2 lines):
	- line 170: active_permission_profile: Option<codex_protocol::models::ActivePermissionProfile>,
	- line 171: ) -> Option<codex_app_server_protocol::ActivePermissionProfile> {


codex-rs/analytics/src/facts.rs (2 lines):
	- line 20: use codex_protocol::models::PermissionProfile;
	- line 195: pub permission_profile: PermissionProfile,


codex-rs/core/src/apply_patch.rs (2 lines):
	- line 10: use codex_protocol::protocol::FileSystemSandboxPolicy;
	- line 25: file_system_sandbox_policy: &FileSystemSandboxPolicy,


codex-rs/sandboxing/src/spawn.rs (2 lines):
	- line 7: use codex_protocol::models::PermissionProfile;
	- line 21: pub permission_profile: &'a PermissionProfile,


codex-rs/app-server/src/request_processors/command_exec_processor.rs (2 lines):
	- line 305: let use_legacy_landlock = self.config.features.use_legacy_landlock();
	- line 318: use_legacy_landlock,


codex-rs/memories/write/src/start.rs (2 lines):
	- line 15: use codex_protocol::models::PermissionProfile;
	- line 30: parent_permission_profile: PermissionProfile,


codex-rs/tui/src/app/thread_events.rs (2 lines):
	- line 399: use codex_protocol::models::PermissionProfile;
	- line 414: permission_profile: PermissionProfile::read_only(),


codex-rs/otel/src/events/session_telemetry.rs (2 lines):
	- line 50: use codex_protocol::protocol::SandboxPolicy;
	- line 567: sandbox_policy: SandboxPolicy,


codex-rs/codex-mcp/src/binding.rs (2 lines):
	- line 13: use codex_protocol::models::PermissionProfile;
	- line 227: pub fn permission_profile(&self) -> &PermissionProfile {


codex-rs/tui/src/history_cell/mod.rs (2 lines):
	- line 73: use codex_protocol::models::PermissionProfile;
	- line 76: use codex_protocol::permissions::NetworkSandboxPolicy;


codex-rs/arg0/src/lib.rs (2 lines):
	- line 13: use codex_sandboxing::landlock::CODEX_LINUX_SANDBOX_ARG0;
	- line 284: // bubblewrap builds that do not support `--argv0`.


codex-rs/app-server-protocol/src/protocol/v2/command_exec.rs (2 lines):
	- line 1: use super::SandboxPolicy;
	- line 101: pub sandbox_policy: Option<SandboxPolicy>,


codex-rs/tui/src/temporary_structured_request.rs (2 lines):
	- line 11: use codex_app_server_protocol::SandboxPolicy;
	- line 166: } else if !matches!(response.sandbox, SandboxPolicy::ReadOnly { .. }) {


codex-rs/windows-sandbox-rs/src/elevated_impl.rs (2 lines):
	- line 1: use codex_protocol::models::PermissionProfile;
	- line 8: pub permission_profile: &'a PermissionProfile,


codex-rs/responses-api-proxy/src/main.rs (1 line):
	- line 6: codex_process_hardening::pre_main_hardening();


codex-rs/linux-sandbox/src/proxy_routing.rs (1 line):
	- line 363: // The outer helper must launch bubblewrap before this listener can arrive.


codex-rs/tui/src/app/platform_actions.rs (1 line):
	- line 25: permission_profile: PermissionProfile,


codex-rs/linux-sandbox/src/bazel_bwrap.rs (1 line):
	- line 8: const BAZEL_BWRAP_ENV_VAR: &str = "CARGO_BIN_EXE_bwrap";


codex-rs/app-server/src/request_processors/turn_processor.rs (1 line):
	- line 120: sandbox_policy: Option<codex_app_server_protocol::SandboxPolicy>,


codex-rs/app-server/src/message_processor.rs (1 line):
	- line 1429: ClientRequest::PermissionProfileList { params, .. } => {


codex-rs/exec/src/main.rs (1 line):
	- line 8: //! Landlock + seccomp.


codex-rs/app-server/src/request_processors/feedback_processor.rs (1 line):
	- line 714: sandbox_policy: codex_protocol::protocol::SandboxPolicy::new_read_only_policy(),


codex-rs/login/src/auth/default_client.rs (1 line):
	- line 354: std::env::var("CODEX_SANDBOX").as_deref() == Ok("seatbelt")


codex-rs/tui/src/app/working_directory.rs (1 line):
	- line 67: && profile.turn_override == RuntimePermissionProfileTurnOverride::Preserve


codex-rs/tui/src/app/startup.rs (1 line):
	- line 131: emit_system_bwrap_warning(&app_event_tx, &config);


codex-rs/utils/cli/src/sandbox_mode_cli_arg.rs (1 line):
	- line 3: //! This mirrors the variants of [`codex_protocol::protocol::SandboxPolicy`], but


codex-rs/cli/src/doctor/network.rs (1 line):
	- line 124: let response = if env::var("CODEX_SANDBOX").as_deref() == Ok("seatbelt") {


codex-rs/linux-sandbox/src/proxy_lifecycle.rs (1 line):
	- line 119: codex_process_hardening::disable_process_dumping()


codex-rs/core/src/tools/handlers/request_permissions.rs (1 line):
	- line 89: .map(codex_protocol::request_permissions::RequestPermissionProfile::from)


codex-rs/tui/src/app/safety_buffering.rs (1 line):
	- line 74: .and_then(RuntimePermissionProfileOverride::turn_permission_profile),


codex-rs/tui/src/chatwidget/permission_shortcuts.rs (1 line):
	- line 88: PermissionProfileSelection {


codex-rs/shell-escalation/src/lib.rs (1 line):
	- line 29: pub use unix::ResolvedPermissionProfile;


codex-rs/tui/src/app/app_server_event_targets.rs (1 line):
	- line 249: sandbox_policy: codex_app_server_protocol::SandboxPolicy::ReadOnly {


codex-rs/windows-sandbox-rs/src/process.rs (1 line):
	- line 122: // if lpDesktop is not set when launching with a restricted token.


scripts/codex_package/targets.py (1 line):
	- line 50: bwrap_bin: Path | None


codex-rs/linux-sandbox/src/fd_mount.rs (1 line):
	- line 42: // bubblewrap, so first confirm it is live before assuming ownership.


codex-rs/bwrap/config.h (1 line):
	- line 1: #define PACKAGE_STRING "bubblewrap built for Codex"


codex-rs/shell-escalation/src/unix/mod.rs (1 line):
	- line 81: pub use codex_protocol::approvals::ResolvedPermissionProfile;


codex-rs/core/src/tools/runtimes/mod.rs (1 line):
	- line 503: fn leaves_legacy_restricted_token_backend_alone() {


codex-rs/tui/src/chatwidget/session_flow.rs (1 line):
	- line 62: let permission_snapshot = PermissionProfileSnapshot::from_session_snapshot(


codex-rs/app-server/src/lib.rs (1 line):
	- line 642: codex_core::config::system_bwrap_warning(config.permissions.permission_profile())
