From 976d8bc18aa70bb06fa9876d64f3d3bbfa418ba4 Mon Sep 17 00:00:00 2001
From: Michael Bolin <mbolin@openai.com>
Date: Thu, 30 Apr 2026 07:42:42 -0700
Subject: [PATCH] rollout-trace: record permission profiles

---
 codex-rs/core/src/session/session.rs                 | 2 +-
 codex-rs/core/src/tools/tool_dispatch_trace_tests.rs | 2 +-
 codex-rs/rollout-trace/src/thread.rs                 | 2 +-
 codex-rs/rollout-trace/src/thread_tests.rs           | 6 +++---
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/codex-rs/core/src/session/session.rs b/codex-rs/core/src/session/session.rs
index b906856778..59a36ff68b 100644
--- a/codex-rs/core/src/session/session.rs
+++ b/codex-rs/core/src/session/session.rs
@@ -526,7 +526,7 @@ impl Session {
                 model: session_configuration.collaboration_mode.model().to_string(),
                 provider_name: config.model_provider_id.clone(),
                 approval_policy: session_configuration.approval_policy.value().to_string(),
-                sandbox_policy: format!("{:?}", session_configuration.sandbox_policy()),
+                permission_profile: format!("{:?}", session_configuration.permission_profile()),
             };
             let rollout_thread_trace = if matches!(
                 session_configuration.session_source,
diff --git a/codex-rs/core/src/tools/tool_dispatch_trace_tests.rs b/codex-rs/core/src/tools/tool_dispatch_trace_tests.rs
index 5f11816553..491d15fc1f 100644
--- a/codex-rs/core/src/tools/tool_dispatch_trace_tests.rs
+++ b/codex-rs/core/src/tools/tool_dispatch_trace_tests.rs
@@ -286,7 +286,7 @@ fn attach_test_trace(session: &mut Session, turn: &TurnContext, root: &Path) ->
                 model: "gpt-test".to_string(),
                 provider_name: "test-provider".to_string(),
                 approval_policy: "never".to_string(),
-                sandbox_policy: "danger-full-access".to_string(),
+                permission_profile: "Disabled".to_string(),
             },
         )?;
     rollout_thread_trace.record_codex_turn_started(turn.sub_id.as_str());
diff --git a/codex-rs/rollout-trace/src/thread.rs b/codex-rs/rollout-trace/src/thread.rs
index 47526807a1..b69d0a7014 100644
--- a/codex-rs/rollout-trace/src/thread.rs
+++ b/codex-rs/rollout-trace/src/thread.rs
@@ -58,7 +58,7 @@ pub struct ThreadStartedTraceMetadata {
     pub model: String,
     pub provider_name: String,
     pub approval_policy: String,
-    pub sandbox_policy: String,
+    pub permission_profile: String,
 }
 
 /// Trace-only payload for a child completion notification delivered to its parent.
diff --git a/codex-rs/rollout-trace/src/thread_tests.rs b/codex-rs/rollout-trace/src/thread_tests.rs
index b8fe0712eb..bca4fd6166 100644
--- a/codex-rs/rollout-trace/src/thread_tests.rs
+++ b/codex-rs/rollout-trace/src/thread_tests.rs
@@ -37,7 +37,7 @@ fn create_in_root_writes_replayable_lifecycle_events() -> anyhow::Result<()> {
             model: "gpt-test".to_string(),
             provider_name: "test-provider".to_string(),
             approval_policy: "never".to_string(),
-            sandbox_policy: "DangerFullAccess".to_string(),
+            permission_profile: "Disabled".to_string(),
         },
     )?;
 
@@ -84,7 +84,7 @@ fn spawned_thread_start_appends_to_root_bundle() -> anyhow::Result<()> {
         model: "gpt-test".to_string(),
         provider_name: "test-provider".to_string(),
         approval_policy: "never".to_string(),
-        sandbox_policy: "DangerFullAccess".to_string(),
+        permission_profile: "Disabled".to_string(),
     });
     child_trace.record_ended(RolloutStatus::Completed);
     let bundle_dir = single_bundle_dir(temp.path())?;
@@ -201,7 +201,7 @@ fn minimal_metadata(thread_id: ThreadId) -> ThreadStartedTraceMetadata {
         model: "gpt-test".to_string(),
         provider_name: "test-provider".to_string(),
         approval_policy: "never".to_string(),
-        sandbox_policy: "danger-full-access".to_string(),
+        permission_profile: "Disabled".to_string(),
     }
 }