permissions: expose active profile metadata (#20095)

codex-rs/exec/src/lib_tests.rs

@@ -363,8 +363,8 @@ async fn thread_start_params_include_review_policy_when_review_policy_is_manual_
     );
     assert_eq!(params.sandbox, None);
     assert_eq!(
-        params.permission_profile,
-        Some(config.permissions.permission_profile().into())
+        params.permissions,
+        permissions_selection_from_config(&config)
     );
 }
 
@@ -391,9 +391,76 @@ async fn thread_start_params_include_review_policy_when_auto_review_is_enabled()
     );
 }
 
-#[test]
-fn session_configured_from_thread_response_uses_review_policy_from_response() {
-    let response = ThreadStartResponse {
+#[tokio::test]
+async fn thread_lifecycle_params_include_legacy_sandbox_when_no_active_profile() {
+    let codex_home = tempdir().expect("create temp codex home");
+    let cwd = tempdir().expect("create temp cwd");
+    let config = ConfigBuilder::default()
+        .codex_home(codex_home.path().to_path_buf())
+        .harness_overrides(ConfigOverrides {
+            sandbox_mode: Some(SandboxMode::DangerFullAccess),
+            ..Default::default()
+        })
+        .fallback_cwd(Some(cwd.path().to_path_buf()))
+        .build()
+        .await
+        .expect("build config with legacy sandbox override");
+
+    let start_params = thread_start_params_from_config(&config);
+    let resume_params = thread_resume_params_from_config(&config, "thread-id".to_string());
+
+    assert_eq!(config.permissions.active_permission_profile(), None);
+    assert_eq!(
+        start_params.sandbox,
+        Some(codex_app_server_protocol::SandboxMode::DangerFullAccess)
+    );
+    assert_eq!(start_params.permissions, None);
+    assert_eq!(
+        resume_params.sandbox,
+        Some(codex_app_server_protocol::SandboxMode::DangerFullAccess)
+    );
+    assert_eq!(resume_params.permissions, None);
+}
+
+#[tokio::test]
+async fn session_configured_from_thread_response_uses_review_policy_from_response() {
+    let codex_home = tempdir().expect("create temp codex home");
+    let cwd = tempdir().expect("create temp cwd");
+    let config = ConfigBuilder::default()
+        .codex_home(codex_home.path().to_path_buf())
+        .fallback_cwd(Some(cwd.path().to_path_buf()))
+        .build()
+        .await
+        .expect("build config");
+    let response = sample_thread_start_response();
+
+    let event = session_configured_from_thread_start_response(&response, &config)
+        .expect("build bootstrap session configured event");
+
+    assert_eq!(event.approvals_reviewer, ApprovalsReviewer::AutoReview);
+}
+
+#[tokio::test]
+async fn session_configured_from_thread_response_uses_permission_profile_from_response() {
+    let codex_home = tempdir().expect("create temp codex home");
+    let cwd = tempdir().expect("create temp cwd");
+    let config = ConfigBuilder::default()
+        .codex_home(codex_home.path().to_path_buf())
+        .fallback_cwd(Some(cwd.path().to_path_buf()))
+        .build()
+        .await
+        .expect("build config");
+    let mut response = sample_thread_start_response();
+    response.permission_profile = Some(PermissionProfile::Disabled.into());
+
+    let event = session_configured_from_thread_start_response(&response, &config)
+        .expect("build bootstrap session configured event");
+
+    assert_eq!(event.permission_profile, PermissionProfile::Disabled);
+}
+
+fn sample_thread_start_response() -> ThreadStartResponse {
+    ThreadStartResponse {
         thread: codex_app_server_protocol::Thread {
             id: "67e55044-10b1-426f-9247-bb680e5fe0c8".to_string(),
             forked_from_id: None,
@@ -426,17 +493,8 @@ fn session_configured_from_thread_response_uses_review_policy_from_response() {
             exclude_tmpdir_env_var: false,
             exclude_slash_tmp: false,
         },
-        permission_profile: Some(
-            codex_protocol::models::PermissionProfile::from_legacy_sandbox_policy(
-                &codex_protocol::protocol::SandboxPolicy::new_workspace_write_policy(),
-            )
-            .into(),
-        ),
+        permission_profile: None,
+        active_permission_profile: None,
         reasoning_effort: None,
-    };
-
-    let event = session_configured_from_thread_start_response(&response)
-        .expect("build bootstrap session configured event");
-
-    assert_eq!(event.approvals_reviewer, ApprovalsReviewer::AutoReview);
+    }
 }