diff --git a/codex-rs/tui/src/app/tests.rs b/codex-rs/tui/src/app/tests.rs
index 457adc3f6b..690813312a 100644
--- a/codex-rs/tui/src/app/tests.rs
+++ b/codex-rs/tui/src/app/tests.rs
@@ -3001,7 +3001,7 @@ async fn side_fork_config_is_ephemeral_and_appends_developer_guardrails() {
     let mut app = make_test_app().await;
     app.config.developer_instructions = Some("Existing developer policy.".to_string());
     let original_approval_policy = app.config.permissions.approval_policy.value();
-    let original_sandbox_policy = app.config.legacy_sandbox_policy();
+    let original_permission_profile = app.config.permissions.permission_profile();
 
     let fork_config = app.side_fork_config();
 
@@ -3010,7 +3010,10 @@ async fn side_fork_config_is_ephemeral_and_appends_developer_guardrails() {
         fork_config.permissions.approval_policy.value(),
         original_approval_policy
     );
-    assert_eq!(fork_config.legacy_sandbox_policy(), original_sandbox_policy);
+    assert_eq!(
+        fork_config.permissions.permission_profile(),
+        original_permission_profile
+    );
     let developer_instructions = fork_config
         .developer_instructions
         .as_deref()
diff --git a/codex-rs/tui/src/app_server_session.rs b/codex-rs/tui/src/app_server_session.rs
index 0fa30f5248..46cafb8a96 100644
--- a/codex-rs/tui/src/app_server_session.rs
+++ b/codex-rs/tui/src/app_server_session.rs
@@ -1893,10 +1893,9 @@ mod tests {
             instruction_sources: vec![test_path_buf("/tmp/project/AGENTS.md").abs()],
             approval_policy: codex_protocol::protocol::AskForApproval::Never.into(),
             approvals_reviewer: codex_app_server_protocol::ApprovalsReviewer::User,
-            sandbox: read_only_profile
-                .to_legacy_sandbox_policy(test_path_buf("/tmp/project").as_path())
-                .expect("read-only profile must be legacy-compatible")
-                .into(),
+            sandbox: codex_app_server_protocol::SandboxPolicy::ReadOnly {
+                network_access: false,
+            },
             permission_profile: Some(read_only_profile.clone().into()),
             active_permission_profile: None,
             reasoning_effort: None,
diff --git a/codex-rs/tui/src/chatwidget/tests/history_replay.rs b/codex-rs/tui/src/chatwidget/tests/history_replay.rs
index 5fdb615b97..b9e36842be 100644
--- a/codex-rs/tui/src/chatwidget/tests/history_replay.rs
+++ b/codex-rs/tui/src/chatwidget/tests/history_replay.rs
@@ -276,9 +276,6 @@ async fn session_configured_syncs_widget_config_permissions_and_cwd() {
             &expected_file_system_policy,
             NetworkSandboxPolicy::Restricted,
         );
-    let expected_sandbox = expected_permission_profile
-        .to_legacy_sandbox_policy(expected_cwd.as_path())
-        .expect("permission profile should project to legacy sandbox policy");
     let configured = codex_protocol::protocol::SessionConfiguredEvent {
         session_id: ThreadId::new(),
         forked_from_id: None,
@@ -308,10 +305,6 @@ async fn session_configured_syncs_widget_config_permissions_and_cwd() {
         chat.config_ref().permissions.approval_policy.value(),
         AskForApproval::Never
     );
-    assert_eq!(
-        &chat.config_ref().legacy_sandbox_policy(),
-        &expected_sandbox
-    );
     assert_eq!(
         chat.config_ref().permissions.permission_profile(),
         expected_permission_profile
@@ -335,9 +328,6 @@ async fn session_configured_external_sandbox_keeps_external_runtime_policy() {
     let expected_permission_profile = PermissionProfile::External {
         network: NetworkSandboxPolicy::Restricted,
     };
-    let expected_sandbox = expected_permission_profile
-        .to_legacy_sandbox_policy(test_path_buf("/home/user/external").as_path())
-        .expect("external profile should project to legacy sandbox policy");
     let configured = codex_protocol::protocol::SessionConfiguredEvent {
         session_id: ThreadId::new(),
         forked_from_id: None,
@@ -347,7 +337,7 @@ async fn session_configured_external_sandbox_keeps_external_runtime_policy() {
         service_tier: None,
         approval_policy: AskForApproval::Never,
         approvals_reviewer: ApprovalsReviewer::User,
-        permission_profile: expected_permission_profile,
+        permission_profile: expected_permission_profile.clone(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/external").abs(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
@@ -364,8 +354,8 @@ async fn session_configured_external_sandbox_keeps_external_runtime_policy() {
     });
 
     assert_eq!(
-        &chat.config_ref().legacy_sandbox_policy(),
-        &expected_sandbox
+        chat.config_ref().permissions.permission_profile(),
+        expected_permission_profile
     );
     assert_eq!(
         chat.config_ref()