Suppress Windows sandbox NUX in yolo mode

codex-rs/tui/src/chatwidget.rs

@@ -8983,6 +8983,10 @@ impl ChatWidget {
     pub(crate) fn maybe_prompt_windows_sandbox_enable(&mut self, show_now: bool) {
         if show_now
             && WindowsSandboxLevel::from_config(&self.config) == WindowsSandboxLevel::Disabled
+            && !matches!(
+                self.config.permissions.permission_profile(),
+                PermissionProfile::Disabled
+            )
             && let Some(preset) = builtin_approval_presets()
                 .into_iter()
                 .find(|preset| preset.id == "auto")

codex-rs/tui/src/chatwidget/tests/permissions.rs

@@ -241,6 +241,26 @@ async fn startup_does_not_prompt_for_windows_sandbox_when_not_requested() {
     );
 }
 
+#[cfg(target_os = "windows")]
+#[tokio::test]
+async fn startup_does_not_prompt_for_windows_sandbox_in_full_access_mode() {
+    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+
+    chat.set_feature_enabled(Feature::WindowsSandbox, /*enabled*/ false);
+    chat.set_feature_enabled(Feature::WindowsSandboxElevated, /*enabled*/ false);
+    chat.config
+        .permissions
+        .set_permission_profile(PermissionProfile::Disabled)
+        .expect("set full access permission profile");
+
+    chat.maybe_prompt_windows_sandbox_enable(/*show_now*/ true);
+
+    assert!(
+        chat.bottom_pane.no_modal_or_popup_active(),
+        "expected no startup sandbox NUX popup in full-access mode"
+    );
+}
+
 #[tokio::test]
 async fn approvals_popup_shows_disabled_presets() {
     let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;

codex-rs/tui/src/lib.rs

@@ -1415,7 +1415,11 @@ async fn run_ratatui_app(
     let should_show_trust_screen = should_show_trust_screen(&config);
     let should_prompt_windows_sandbox_nux_at_startup = cfg!(target_os = "windows")
         && trust_decision_was_made
-        && WindowsSandboxLevel::from_config(&config) == WindowsSandboxLevel::Disabled;
+        && WindowsSandboxLevel::from_config(&config) == WindowsSandboxLevel::Disabled
+        && !matches!(
+            config.permissions.permission_profile(),
+            codex_protocol::models::PermissionProfile::Disabled
+        );
 
     let Cli {
         prompt,

codex-rs/tui/src/onboarding/onboarding_screen.rs

@@ -141,8 +141,12 @@ impl OnboardingScreen {
             }
         }
         #[cfg(target_os = "windows")]
-        let show_windows_create_sandbox_hint =
-            WindowsSandboxLevel::from_config(&config) == WindowsSandboxLevel::Disabled;
+        let show_windows_create_sandbox_hint = WindowsSandboxLevel::from_config(&config)
+            == WindowsSandboxLevel::Disabled
+            && !matches!(
+                config.permissions.permission_profile(),
+                codex_protocol::models::PermissionProfile::Disabled
+            );
         #[cfg(not(target_os = "windows"))]
         let show_windows_create_sandbox_hint = false;
         let highlighted = TrustDirectorySelection::Trust;