sandboxing: plumb split sandbox policies through runtime

codex-rs/app-server/src/codex_message_processor.rs

@@ -1506,9 +1506,19 @@ impl CodexMessageProcessor {
         };
 
         let requested_policy = params.sandbox_policy.map(|policy| policy.to_core());
-        let effective_policy = match requested_policy {
+        let (
+            effective_policy,
+            effective_file_system_sandbox_policy,
+            effective_network_sandbox_policy,
+        ) = match requested_policy {
             Some(policy) => match self.config.permissions.sandbox_policy.can_set(&policy) {
-                Ok(()) => policy,
+                Ok(()) => {
+                    let file_system_sandbox_policy =
+                        codex_protocol::protocol::FileSystemSandboxPolicy::from(&policy);
+                    let network_sandbox_policy =
+                        codex_protocol::protocol::NetworkSandboxPolicy::from(&policy);
+                    (policy, file_system_sandbox_policy, network_sandbox_policy)
+                }
                 Err(err) => {
                     let error = JSONRPCErrorError {
                         code: INVALID_REQUEST_ERROR_CODE,
@@ -1519,7 +1529,11 @@ impl CodexMessageProcessor {
                     return;
                 }
             },
-            None => self.config.permissions.sandbox_policy.get().clone(),
+            None => (
+                self.config.permissions.sandbox_policy.get().clone(),
+                self.config.permissions.file_system_sandbox_policy.clone(),
+                self.config.permissions.network_sandbox_policy,
+            ),
         };
 
         let codex_linux_sandbox_exe = self.arg0_paths.codex_linux_sandbox_exe.clone();
@@ -1534,6 +1548,8 @@ impl CodexMessageProcessor {
             match codex_core::exec::process_exec_tool_call(
                 exec_params,
                 &effective_policy,
+                &effective_file_system_sandbox_policy,
+                effective_network_sandbox_policy,
                 sandbox_cwd.as_path(),
                 &codex_linux_sandbox_exe,
                 use_linux_sandbox_bwrap,

codex-rs/core/config.schema.json

@@ -562,6 +562,30 @@
       },
       "type": "object"
     },
+    "FileSystemAccessMode": {
+      "enum": [
+        "none",
+        "read",
+        "write"
+      ],
+      "type": "string"
+    },
+    "FilesystemPermissionToml": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/FileSystemAccessMode"
+        },
+        {
+          "additionalProperties": {
+            "$ref": "#/definitions/FileSystemAccessMode"
+          },
+          "type": "object"
+        }
+      ]
+    },
+    "FilesystemPermissionsToml": {
+      "type": "object"
+    },
     "ForcedLoginMethod": {
       "enum": [
         "chatgpt",
@@ -1089,20 +1113,30 @@
       },
       "type": "object"
     },
-    "PermissionsToml": {
+    "PermissionProfileNetworkToml": {
       "additionalProperties": false,
       "properties": {
-        "network": {
-          "allOf": [
-            {
-              "$ref": "#/definitions/NetworkToml"
-            }
-          ],
-          "description": "Network proxy settings from `[permissions.network]`. User config can enable the proxy; managed requirements may still constrain values."
+        "enabled": {
+          "type": "boolean"
         }
       },
       "type": "object"
     },
+    "PermissionProfileToml": {
+      "additionalProperties": false,
+      "properties": {
+        "filesystem": {
+          "$ref": "#/definitions/FilesystemPermissionsToml"
+        },
+        "network": {
+          "$ref": "#/definitions/PermissionProfileNetworkToml"
+        }
+      },
+      "type": "object"
+    },
+    "PermissionsToml": {
+      "type": "object"
+    },
     "Personality": {
       "enum": [
         "none",
@@ -1663,6 +1697,10 @@
       "description": "Compact prompt used for history compaction.",
       "type": "string"
     },
+    "default_permissions": {
+      "description": "Default named permissions profile to apply from the `[permissions]` table.",
+      "type": "string"
+    },
     "developer_instructions": {
       "default": null,
       "description": "Developer instructions inserted as a `developer` role message.",
@@ -2025,6 +2063,15 @@
       ],
       "description": "Optional verbosity control for GPT-5 models (Responses API `text.verbosity`)."
     },
+    "network": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/NetworkToml"
+        }
+      ],
+      "default": null,
+      "description": "Top-level network proxy settings."
+    },
     "notice": {
       "allOf": [
         {
@@ -2060,7 +2107,7 @@
         }
       ],
       "default": null,
-      "description": "Nested permissions settings."
+      "description": "Named permissions profiles."
     },
     "personality": {
       "allOf": [

codex-rs/core/src/codex.rs

@@ -222,10 +222,12 @@ use crate::protocol::ErrorEvent;
 use crate::protocol::Event;
 use crate::protocol::EventMsg;
 use crate::protocol::ExecApprovalRequestEvent;
+use crate::protocol::FileSystemSandboxPolicy;
 use crate::protocol::McpServerRefreshConfig;
 use crate::protocol::ModelRerouteEvent;
 use crate::protocol::ModelRerouteReason;
 use crate::protocol::NetworkApprovalContext;
+use crate::protocol::NetworkSandboxPolicy;
 use crate::protocol::Op;
 use crate::protocol::PlanDeltaEvent;
 use crate::protocol::RateLimitSnapshot;
@@ -482,6 +484,8 @@ impl Codex {
             compact_prompt: config.compact_prompt.clone(),
             approval_policy: config.permissions.approval_policy.clone(),
             sandbox_policy: config.permissions.sandbox_policy.clone(),
+            file_system_sandbox_policy: config.permissions.file_system_sandbox_policy.clone(),
+            network_sandbox_policy: config.permissions.network_sandbox_policy,
             windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
             cwd: config.cwd.clone(),
             codex_home: config.codex_home.clone(),
@@ -676,6 +680,8 @@ pub(crate) struct TurnContext {
     pub(crate) personality: Option<Personality>,
     pub(crate) approval_policy: Constrained<AskForApproval>,
     pub(crate) sandbox_policy: Constrained<SandboxPolicy>,
+    pub(crate) file_system_sandbox_policy: FileSystemSandboxPolicy,
+    pub(crate) network_sandbox_policy: NetworkSandboxPolicy,
     pub(crate) network: Option<NetworkProxy>,
     pub(crate) windows_sandbox_level: WindowsSandboxLevel,
     pub(crate) shell_environment_policy: ShellEnvironmentPolicy,
@@ -764,6 +770,8 @@ impl TurnContext {
             personality: self.personality,
             approval_policy: self.approval_policy.clone(),
             sandbox_policy: self.sandbox_policy.clone(),
+            file_system_sandbox_policy: self.file_system_sandbox_policy.clone(),
+            network_sandbox_policy: self.network_sandbox_policy,
             network: self.network.clone(),
             windows_sandbox_level: self.windows_sandbox_level,
             shell_environment_policy: self.shell_environment_policy.clone(),
@@ -867,6 +875,8 @@ pub(crate) struct SessionConfiguration {
     approval_policy: Constrained<AskForApproval>,
     /// How to sandbox commands executed in the system
     sandbox_policy: Constrained<SandboxPolicy>,
+    file_system_sandbox_policy: FileSystemSandboxPolicy,
+    network_sandbox_policy: NetworkSandboxPolicy,
     windows_sandbox_level: WindowsSandboxLevel,
 
     /// Working directory that should be treated as the *root* of the
@@ -933,6 +943,10 @@ impl SessionConfiguration {
         }
         if let Some(sandbox_policy) = updates.sandbox_policy.clone() {
             next_configuration.sandbox_policy.set(sandbox_policy)?;
+            next_configuration.file_system_sandbox_policy =
+                FileSystemSandboxPolicy::from(next_configuration.sandbox_policy.get());
+            next_configuration.network_sandbox_policy =
+                NetworkSandboxPolicy::from(next_configuration.sandbox_policy.get());
         }
         if let Some(windows_sandbox_level) = updates.windows_sandbox_level {
             next_configuration.windows_sandbox_level = windows_sandbox_level;
@@ -1145,6 +1159,8 @@ impl Session {
             personality: session_configuration.personality,
             approval_policy: session_configuration.approval_policy.clone(),
             sandbox_policy: session_configuration.sandbox_policy.clone(),
+            file_system_sandbox_policy: session_configuration.file_system_sandbox_policy.clone(),
+            network_sandbox_policy: session_configuration.network_sandbox_policy,
             network,
             windows_sandbox_level: session_configuration.windows_sandbox_level,
             shell_environment_policy: per_turn_config.permissions.shell_environment_policy.clone(),
@@ -4805,6 +4821,8 @@ async fn spawn_review_thread(
         personality: parent_turn_context.personality,
         approval_policy: parent_turn_context.approval_policy.clone(),
         sandbox_policy: parent_turn_context.sandbox_policy.clone(),
+        file_system_sandbox_policy: parent_turn_context.file_system_sandbox_policy.clone(),
+        network_sandbox_policy: parent_turn_context.network_sandbox_policy,
         network: parent_turn_context.network.clone(),
         windows_sandbox_level: parent_turn_context.windows_sandbox_level,
         shell_environment_policy: parent_turn_context.shell_environment_policy.clone(),
@@ -7832,6 +7850,8 @@ mod tests {
             compact_prompt: config.compact_prompt.clone(),
             approval_policy: config.permissions.approval_policy.clone(),
             sandbox_policy: config.permissions.sandbox_policy.clone(),
+            file_system_sandbox_policy: config.permissions.file_system_sandbox_policy.clone(),
+            network_sandbox_policy: config.permissions.network_sandbox_policy,
             windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
             cwd: config.cwd.clone(),
             codex_home: config.codex_home.clone(),
@@ -7927,6 +7947,8 @@ mod tests {
             compact_prompt: config.compact_prompt.clone(),
             approval_policy: config.permissions.approval_policy.clone(),
             sandbox_policy: config.permissions.sandbox_policy.clone(),
+            file_system_sandbox_policy: config.permissions.file_system_sandbox_policy.clone(),
+            network_sandbox_policy: config.permissions.network_sandbox_policy,
             windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
             cwd: config.cwd.clone(),
             codex_home: config.codex_home.clone(),
@@ -8247,6 +8269,8 @@ mod tests {
             compact_prompt: config.compact_prompt.clone(),
             approval_policy: config.permissions.approval_policy.clone(),
             sandbox_policy: config.permissions.sandbox_policy.clone(),
+            file_system_sandbox_policy: config.permissions.file_system_sandbox_policy.clone(),
+            network_sandbox_policy: config.permissions.network_sandbox_policy,
             windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
             cwd: config.cwd.clone(),
             codex_home: config.codex_home.clone(),
@@ -8306,6 +8330,8 @@ mod tests {
             compact_prompt: config.compact_prompt.clone(),
             approval_policy: config.permissions.approval_policy.clone(),
             sandbox_policy: config.permissions.sandbox_policy.clone(),
+            file_system_sandbox_policy: config.permissions.file_system_sandbox_policy.clone(),
+            network_sandbox_policy: config.permissions.network_sandbox_policy,
             windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
             cwd: config.cwd.clone(),
             codex_home: config.codex_home.clone(),
@@ -8398,6 +8424,8 @@ mod tests {
             compact_prompt: config.compact_prompt.clone(),
             approval_policy: config.permissions.approval_policy.clone(),
             sandbox_policy: config.permissions.sandbox_policy.clone(),
+            file_system_sandbox_policy: config.permissions.file_system_sandbox_policy.clone(),
+            network_sandbox_policy: config.permissions.network_sandbox_policy,
             windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
             cwd: config.cwd.clone(),
             codex_home: config.codex_home.clone(),
@@ -8647,6 +8675,8 @@ mod tests {
             compact_prompt: config.compact_prompt.clone(),
             approval_policy: config.permissions.approval_policy.clone(),
             sandbox_policy: config.permissions.sandbox_policy.clone(),
+            file_system_sandbox_policy: config.permissions.file_system_sandbox_policy.clone(),
+            network_sandbox_policy: config.permissions.network_sandbox_policy,
             windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
             cwd: config.cwd.clone(),
             codex_home: config.codex_home.clone(),
@@ -10072,11 +10102,15 @@ mod tests {
 
         // Now retry the same command WITHOUT escalated permissions; should succeed.
         // Force DangerFullAccess to avoid platform sandbox dependencies in tests.
-        Arc::get_mut(&mut turn_context)
-            .expect("unique turn context Arc")
+        let turn_context_mut = Arc::get_mut(&mut turn_context).expect("unique turn context Arc");
+        turn_context_mut
             .sandbox_policy
             .set(SandboxPolicy::DangerFullAccess)
             .expect("test setup should allow updating sandbox policy");
+        turn_context_mut.file_system_sandbox_policy =
+            FileSystemSandboxPolicy::from(turn_context_mut.sandbox_policy.get());
+        turn_context_mut.network_sandbox_policy =
+            NetworkSandboxPolicy::from(turn_context_mut.sandbox_policy.get());
 
         let resp2 = handler
             .handle(ToolInvocation {

codex-rs/core/src/config/mod.rs

@@ -27,6 +27,7 @@ use crate::config::types::WindowsSandboxModeToml;
 use crate::config::types::WindowsToml;
 use crate::config_loader::CloudRequirementsLoader;
 use crate::config_loader::ConfigLayerStack;
+use crate::config_loader::ConfigLayerStackOrdering;
 use crate::config_loader::ConfigRequirements;
 use crate::config_loader::ConstrainedWithSource;
 use crate::config_loader::LoaderOverrides;
@@ -49,6 +50,10 @@ use crate::model_provider_info::built_in_model_providers;
 use crate::project_doc::DEFAULT_PROJECT_DOC_FILENAME;
 use crate::project_doc::LOCAL_PROJECT_DOC_FILENAME;
 use crate::protocol::AskForApproval;
+#[cfg(test)]
+use crate::protocol::FileSystemAccessMode;
+use crate::protocol::FileSystemSandboxPolicy;
+use crate::protocol::NetworkSandboxPolicy;
 use crate::protocol::ReadOnlyAccess;
 use crate::protocol::SandboxPolicy;
 use crate::unified_exec::DEFAULT_MAX_BACKGROUND_TERMINAL_TIMEOUT_MS;
@@ -86,7 +91,8 @@ use std::path::PathBuf;
 #[cfg(test)]
 use tempfile::tempdir;
 
-use crate::config::permissions::network_proxy_config_from_permissions;
+use crate::config::permissions::compile_permission_profile;
+use crate::config::permissions::network_proxy_config_from_network;
 use crate::config::profile::ConfigProfile;
 use toml::Value as TomlValue;
 use toml_edit::DocumentMut;
@@ -107,7 +113,11 @@ pub use codex_network_proxy::NetworkProxyAuditMetadata;
 pub use managed_features::ManagedFeatures;
 pub use network_proxy_spec::NetworkProxySpec;
 pub use network_proxy_spec::StartedNetworkProxy;
+pub use permissions::FilesystemPermissionToml;
+pub use permissions::FilesystemPermissionsToml;
 pub use permissions::NetworkToml;
+pub use permissions::PermissionProfileNetworkToml;
+pub use permissions::PermissionProfileToml;
 pub use permissions::PermissionsToml;
 pub use service::ConfigService;
 pub use service::ConfigServiceError;
@@ -155,6 +165,12 @@ pub struct Permissions {
     pub approval_policy: Constrained<AskForApproval>,
     /// Effective sandbox policy used for shell/unified exec.
     pub sandbox_policy: Constrained<SandboxPolicy>,
+    /// Effective filesystem sandbox policy, including entries that cannot yet
+    /// be fully represented by the legacy [`SandboxPolicy`] projection.
+    pub file_system_sandbox_policy: FileSystemSandboxPolicy,
+    /// Effective network sandbox policy split out from the legacy
+    /// [`SandboxPolicy`] projection.
+    pub network_sandbox_policy: NetworkSandboxPolicy,
     /// Effective network configuration applied to all spawned processes.
     pub network: Option<NetworkProxySpec>,
     /// Whether the model may request a login shell for shell-based tools.
@@ -1047,10 +1063,18 @@ pub struct ConfigToml {
     /// Sandbox configuration to apply if `sandbox` is `WorkspaceWrite`.
     pub sandbox_workspace_write: Option<SandboxWorkspaceWrite>,
 
-    /// Nested permissions settings.
+    /// Default named permissions profile to apply from the `[permissions]`
+    /// table.
+    pub default_permissions: Option<String>,
+
+    /// Named permissions profiles.
     #[serde(default)]
     pub permissions: Option<PermissionsToml>,
 
+    /// Top-level network proxy settings.
+    #[serde(default)]
+    pub network: Option<NetworkToml>,
+
     /// Optional external command to spawn for end-user notifications.
     #[serde(default)]
     pub notify: Option<Vec<String>>,
@@ -1565,6 +1589,78 @@ impl ConfigToml {
     }
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum PermissionConfigSyntax {
+    Legacy,
+    Profiles,
+}
+
+#[derive(Debug, Deserialize, Default)]
+struct PermissionSelectionToml {
+    default_permissions: Option<String>,
+    sandbox_mode: Option<SandboxMode>,
+}
+
+fn resolve_permission_config_syntax(
+    config_layer_stack: &ConfigLayerStack,
+    cfg: &ConfigToml,
+    sandbox_mode_override: Option<SandboxMode>,
+    profile_sandbox_mode: Option<SandboxMode>,
+) -> Option<PermissionConfigSyntax> {
+    if sandbox_mode_override.is_some() || profile_sandbox_mode.is_some() {
+        return Some(PermissionConfigSyntax::Legacy);
+    }
+
+    let mut selection = None;
+    for layer in
+        config_layer_stack.get_layers(ConfigLayerStackOrdering::LowestPrecedenceFirst, false)
+    {
+        let Ok(layer_selection) = layer.config.clone().try_into::<PermissionSelectionToml>() else {
+            continue;
+        };
+
+        if layer_selection.sandbox_mode.is_some() {
+            selection = Some(PermissionConfigSyntax::Legacy);
+        }
+        if layer_selection.default_permissions.is_some() {
+            selection = Some(PermissionConfigSyntax::Profiles);
+        }
+    }
+
+    selection.or_else(|| {
+        if cfg.default_permissions.is_some() {
+            Some(PermissionConfigSyntax::Profiles)
+        } else if cfg.sandbox_mode.is_some() {
+            Some(PermissionConfigSyntax::Legacy)
+        } else {
+            None
+        }
+    })
+}
+
+fn add_additional_file_system_writes(
+    file_system_sandbox_policy: &mut FileSystemSandboxPolicy,
+    additional_writable_roots: &[AbsolutePathBuf],
+) {
+    for path in additional_writable_roots {
+        let exists = file_system_sandbox_policy.entries.iter().any(|entry| {
+            matches!(
+                &entry.path,
+                crate::protocol::FileSystemPath::Path { path: existing }
+                    if existing == path && entry.access == crate::protocol::FileSystemAccessMode::Write
+            )
+        });
+        if !exists {
+            file_system_sandbox_policy
+                .entries
+                .push(crate::protocol::FileSystemSandboxEntry {
+                    path: crate::protocol::FileSystemPath::Path { path: path.clone() },
+                    access: crate::protocol::FileSystemAccessMode::Write,
+                });
+        }
+    }
+}
+
 /// Optional overrides for user configuration (e.g., from CLI flags).
 #[derive(Default, Debug, Clone)]
 pub struct ConfigOverrides {
@@ -1753,7 +1849,7 @@ impl Config {
             None => ConfigProfile::default(),
         };
         let configured_network_proxy_config =
-            network_proxy_config_from_permissions(cfg.permissions.as_ref());
+            network_proxy_config_from_network(cfg.network.as_ref());
 
         let feature_overrides = FeatureOverrides {
             include_apply_patch_tool: include_apply_patch_tool_override,
@@ -1788,29 +1884,112 @@ impl Config {
         let active_project = cfg
             .get_active_project(&resolved_cwd)
             .unwrap_or(ProjectConfig { trust_level: None });
+        let permission_config_syntax = resolve_permission_config_syntax(
+            &config_layer_stack,
+            &cfg,
+            sandbox_mode,
+            config_profile.sandbox_mode,
+        );
+        let has_permission_profiles = cfg
+            .permissions
+            .as_ref()
+            .is_some_and(|profiles| !profiles.is_empty());
+        let legacy_permissions_network_table =
+            cfg.permissions.as_ref().is_some_and(|permissions| {
+                permissions.entries.get("network").is_some_and(|profile| {
+                    profile.filesystem.is_none() && profile.network.is_none()
+                })
+            });
+        if legacy_permissions_network_table {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                "legacy `[permissions.network]` is no longer supported; move this config to the top-level `[network]` table",
+            ));
+        }
+        if has_permission_profiles
+            && !matches!(
+                permission_config_syntax,
+                Some(PermissionConfigSyntax::Legacy)
+            )
+            && cfg.default_permissions.is_none()
+        {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                "config defines `[permissions]` profiles but does not set `default_permissions`",
+            ));
+        }
         let sandbox_mode_was_explicit = sandbox_mode.is_some()
             || config_profile.sandbox_mode.is_some()
-            || cfg.sandbox_mode.is_some();
+            || cfg.sandbox_mode.is_some()
+            || matches!(
+                permission_config_syntax,
+                Some(PermissionConfigSyntax::Profiles)
+            );
 
         let windows_sandbox_level = match windows_sandbox_mode {
             Some(WindowsSandboxModeToml::Elevated) => WindowsSandboxLevel::Elevated,
             Some(WindowsSandboxModeToml::Unelevated) => WindowsSandboxLevel::RestrictedToken,
             None => WindowsSandboxLevel::from_features(&features),
         };
-        let mut sandbox_policy = cfg.derive_sandbox_policy(
-            sandbox_mode,
-            config_profile.sandbox_mode,
-            windows_sandbox_level,
-            &resolved_cwd,
-            Some(&constrained_sandbox_policy),
-        );
-        if let SandboxPolicy::WorkspaceWrite { writable_roots, .. } = &mut sandbox_policy {
-            for path in additional_writable_roots {
-                if !writable_roots.iter().any(|existing| existing == &path) {
-                    writable_roots.push(path);
+        let profiles_are_active = matches!(
+            permission_config_syntax,
+            Some(PermissionConfigSyntax::Profiles)
+        ) || (permission_config_syntax.is_none()
+            && has_permission_profiles);
+        let (sandbox_policy, file_system_sandbox_policy, network_sandbox_policy) =
+            if profiles_are_active {
+                let permissions = cfg.permissions.as_ref().ok_or_else(|| {
+                    std::io::Error::new(
+                        std::io::ErrorKind::InvalidInput,
+                        "default_permissions requires a `[permissions]` table",
+                    )
+                })?;
+                let default_permissions = cfg.default_permissions.as_deref().ok_or_else(|| {
+                    std::io::Error::new(
+                        std::io::ErrorKind::InvalidInput,
+                        "default_permissions requires a named permissions profile",
+                    )
+                })?;
+                let (mut file_system_sandbox_policy, network_sandbox_policy) =
+                    compile_permission_profile(permissions, default_permissions)?;
+                let mut sandbox_policy = file_system_sandbox_policy
+                    .to_legacy_sandbox_policy(network_sandbox_policy, &resolved_cwd)?;
+                if matches!(sandbox_policy, SandboxPolicy::WorkspaceWrite { .. }) {
+                    add_additional_file_system_writes(
+                        &mut file_system_sandbox_policy,
+                        &additional_writable_roots,
+                    );
+                    sandbox_policy = file_system_sandbox_policy
+                        .to_legacy_sandbox_policy(network_sandbox_policy, &resolved_cwd)?;
                 }
-            }
-        }
+                (
+                    sandbox_policy,
+                    file_system_sandbox_policy,
+                    network_sandbox_policy,
+                )
+            } else {
+                let mut sandbox_policy = cfg.derive_sandbox_policy(
+                    sandbox_mode,
+                    config_profile.sandbox_mode,
+                    windows_sandbox_level,
+                    &resolved_cwd,
+                    Some(&constrained_sandbox_policy),
+                );
+                if let SandboxPolicy::WorkspaceWrite { writable_roots, .. } = &mut sandbox_policy {
+                    for path in &additional_writable_roots {
+                        if !writable_roots.iter().any(|existing| existing == path) {
+                            writable_roots.push(path.clone());
+                        }
+                    }
+                }
+                let file_system_sandbox_policy = FileSystemSandboxPolicy::from(&sandbox_policy);
+                let network_sandbox_policy = NetworkSandboxPolicy::from(&sandbox_policy);
+                (
+                    sandbox_policy,
+                    file_system_sandbox_policy,
+                    network_sandbox_policy,
+                )
+            };
         let approval_policy_was_explicit = approval_policy_override.is_some()
             || config_profile.approval_policy.is_some()
             || cfg.approval_policy.is_some();
@@ -2078,6 +2257,7 @@ impl Config {
             .map(AbsolutePathBuf::to_path_buf)
             .or_else(|| resolve_sqlite_home_env(&resolved_cwd))
             .unwrap_or_else(|| codex_home.to_path_buf());
+        let original_sandbox_policy = sandbox_policy.clone();
 
         apply_requirement_constrained_value(
             "approval_policy",
@@ -2125,6 +2305,19 @@ impl Config {
         } else {
             network.enabled().then_some(network)
         };
+        let effective_sandbox_policy = constrained_sandbox_policy.value.get().clone();
+        let effective_file_system_sandbox_policy =
+            if effective_sandbox_policy == original_sandbox_policy {
+                file_system_sandbox_policy
+            } else {
+                FileSystemSandboxPolicy::from(&effective_sandbox_policy)
+            };
+        let effective_network_sandbox_policy =
+            if effective_sandbox_policy == original_sandbox_policy {
+                network_sandbox_policy
+            } else {
+                NetworkSandboxPolicy::from(&effective_sandbox_policy)
+            };
 
         let config = Self {
             model,
@@ -2139,6 +2332,8 @@ impl Config {
             permissions: Permissions {
                 approval_policy: constrained_approval_policy.value,
                 sandbox_policy: constrained_sandbox_policy.value,
+                file_system_sandbox_policy: effective_file_system_sandbox_policy,
+                network_sandbox_policy: effective_network_sandbox_policy,
                 network,
                 allow_login_shell,
                 shell_environment_policy,
@@ -2701,20 +2896,18 @@ consolidation_model = "gpt-5"
     #[test]
     fn config_toml_deserializes_permissions_network() {
         let toml = r#"
-[permissions.network]
+[network]
 enabled = true
 proxy_url = "http://127.0.0.1:43128"
 enable_socks5 = false
 allow_upstream_proxy = false
 allowed_domains = ["openai.com"]
 "#;
-        let cfg: ConfigToml = toml::from_str(toml)
-            .expect("TOML deserialization should succeed for permissions.network");
+        let cfg: ConfigToml =
+            toml::from_str(toml).expect("TOML deserialization should succeed for [network]");
 
         assert_eq!(
-            cfg.permissions
-                .and_then(|permissions| permissions.network)
-                .expect("permissions.network should deserialize"),
+            cfg.network.expect("[network] should deserialize"),
             NetworkToml {
                 enabled: Some(true),
                 proxy_url: Some("http://127.0.0.1:43128".to_string()),
@@ -2739,13 +2932,11 @@ allowed_domains = ["openai.com"]
     fn permissions_network_enabled_populates_runtime_network_proxy_spec() -> std::io::Result<()> {
         let codex_home = TempDir::new()?;
         let cfg = ConfigToml {
-            permissions: Some(PermissionsToml {
-                network: Some(NetworkToml {
-                    enabled: Some(true),
-                    proxy_url: Some("http://127.0.0.1:43128".to_string()),
-                    enable_socks5: Some(false),
-                    ..Default::default()
-                }),
+            network: Some(NetworkToml {
+                enabled: Some(true),
+                proxy_url: Some("http://127.0.0.1:43128".to_string()),
+                enable_socks5: Some(false),
+                ..Default::default()
             }),
             ..Default::default()
         };
@@ -2770,11 +2961,9 @@ allowed_domains = ["openai.com"]
     fn permissions_network_disabled_by_default_does_not_start_proxy() -> std::io::Result<()> {
         let codex_home = TempDir::new()?;
         let cfg = ConfigToml {
-            permissions: Some(PermissionsToml {
-                network: Some(NetworkToml {
-                    allowed_domains: Some(vec!["openai.com".to_string()]),
-                    ..Default::default()
-                }),
+            network: Some(NetworkToml {
+                allowed_domains: Some(vec!["openai.com".to_string()]),
+                ..Default::default()
             }),
             ..Default::default()
         };
@@ -2788,6 +2977,349 @@ allowed_domains = ["openai.com"]
         Ok(())
     }
 
+    #[test]
+    fn config_toml_deserializes_permission_profiles() {
+        let toml = r#"
+default_permissions = "workspace"
+
+[permissions.workspace.filesystem]
+":minimal" = "read"
+
+[permissions.workspace.filesystem.":project_roots"]
+"." = "write"
+"docs" = "read"
+"#;
+        let cfg: ConfigToml = toml::from_str(toml)
+            .expect("TOML deserialization should succeed for permissions profiles");
+
+        assert_eq!(cfg.default_permissions.as_deref(), Some("workspace"));
+        assert_eq!(
+            cfg.permissions.expect("[permissions] should deserialize"),
+            PermissionsToml {
+                entries: BTreeMap::from([(
+                    "workspace".to_string(),
+                    PermissionProfileToml {
+                        filesystem: Some(FilesystemPermissionsToml {
+                            entries: BTreeMap::from([
+                                (
+                                    ":minimal".to_string(),
+                                    FilesystemPermissionToml::Access(FileSystemAccessMode::Read),
+                                ),
+                                (
+                                    ":project_roots".to_string(),
+                                    FilesystemPermissionToml::Scoped(BTreeMap::from([
+                                        (".".to_string(), FileSystemAccessMode::Write),
+                                        ("docs".to_string(), FileSystemAccessMode::Read),
+                                    ])),
+                                ),
+                            ]),
+                        }),
+                        network: None,
+                    },
+                )]),
+            }
+        );
+    }
+
+    #[test]
+    fn default_permissions_profile_populates_runtime_sandbox_policy() -> std::io::Result<()> {
+        let codex_home = TempDir::new()?;
+        let cwd = TempDir::new()?;
+        std::fs::create_dir_all(cwd.path().join("docs"))?;
+        std::fs::write(cwd.path().join(".git"), "gitdir: nowhere")?;
+
+        let cfg = ConfigToml {
+            default_permissions: Some("workspace".to_string()),
+            permissions: Some(PermissionsToml {
+                entries: BTreeMap::from([(
+                    "workspace".to_string(),
+                    PermissionProfileToml {
+                        filesystem: Some(FilesystemPermissionsToml {
+                            entries: BTreeMap::from([
+                                (
+                                    ":minimal".to_string(),
+                                    FilesystemPermissionToml::Access(FileSystemAccessMode::Read),
+                                ),
+                                (
+                                    ":project_roots".to_string(),
+                                    FilesystemPermissionToml::Scoped(BTreeMap::from([
+                                        (".".to_string(), FileSystemAccessMode::Write),
+                                        ("docs".to_string(), FileSystemAccessMode::Read),
+                                    ])),
+                                ),
+                            ]),
+                        }),
+                        network: None,
+                    },
+                )]),
+            }),
+            ..Default::default()
+        };
+
+        let config = Config::load_from_base_config_with_overrides(
+            cfg,
+            ConfigOverrides {
+                cwd: Some(cwd.path().to_path_buf()),
+                ..Default::default()
+            },
+            codex_home.path().to_path_buf(),
+        )?;
+
+        assert_eq!(
+            config.permissions.file_system_sandbox_policy,
+            FileSystemSandboxPolicy::restricted(vec![
+                crate::protocol::FileSystemSandboxEntry {
+                    path: crate::protocol::FileSystemPath::Special {
+                        value: crate::protocol::FileSystemSpecialPath {
+                            kind: crate::protocol::FileSystemSpecialPathKind::Minimal,
+                            subpath: None,
+                        },
+                    },
+                    access: FileSystemAccessMode::Read,
+                },
+                crate::protocol::FileSystemSandboxEntry {
+                    path: crate::protocol::FileSystemPath::Special {
+                        value: crate::protocol::FileSystemSpecialPath {
+                            kind: crate::protocol::FileSystemSpecialPathKind::ProjectRoots,
+                            subpath: None,
+                        },
+                    },
+                    access: FileSystemAccessMode::Write,
+                },
+                crate::protocol::FileSystemSandboxEntry {
+                    path: crate::protocol::FileSystemPath::Special {
+                        value: crate::protocol::FileSystemSpecialPath {
+                            kind: crate::protocol::FileSystemSpecialPathKind::ProjectRoots,
+                            subpath: Some("docs".into()),
+                        },
+                    },
+                    access: FileSystemAccessMode::Read,
+                },
+            ]),
+        );
+        assert_eq!(
+            config.permissions.sandbox_policy.get(),
+            &SandboxPolicy::WorkspaceWrite {
+                writable_roots: Vec::new(),
+                read_only_access: ReadOnlyAccess::Restricted {
+                    include_platform_defaults: true,
+                    readable_roots: vec![
+                        AbsolutePathBuf::try_from(cwd.path().join("docs"))
+                            .expect("absolute docs path"),
+                    ],
+                },
+                network_access: false,
+                exclude_tmpdir_env_var: true,
+                exclude_slash_tmp: true,
+            }
+        );
+        assert_eq!(
+            config.permissions.network_sandbox_policy,
+            NetworkSandboxPolicy::Restricted
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn permissions_profiles_require_default_permissions() -> std::io::Result<()> {
+        let codex_home = TempDir::new()?;
+        let cwd = TempDir::new()?;
+        std::fs::write(cwd.path().join(".git"), "gitdir: nowhere")?;
+
+        let err = Config::load_from_base_config_with_overrides(
+            ConfigToml {
+                permissions: Some(PermissionsToml {
+                    entries: BTreeMap::from([(
+                        "workspace".to_string(),
+                        PermissionProfileToml {
+                            filesystem: Some(FilesystemPermissionsToml {
+                                entries: BTreeMap::from([(
+                                    ":minimal".to_string(),
+                                    FilesystemPermissionToml::Access(FileSystemAccessMode::Read),
+                                )]),
+                            }),
+                            network: None,
+                        },
+                    )]),
+                }),
+                ..Default::default()
+            },
+            ConfigOverrides {
+                cwd: Some(cwd.path().to_path_buf()),
+                ..Default::default()
+            },
+            codex_home.path().to_path_buf(),
+        )
+        .expect_err("missing default_permissions should be rejected");
+
+        assert_eq!(err.kind(), ErrorKind::InvalidInput);
+        assert_eq!(
+            err.to_string(),
+            "config defines `[permissions]` profiles but does not set `default_permissions`"
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn legacy_permissions_network_requires_migration_to_top_level_network() -> std::io::Result<()> {
+        let codex_home = TempDir::new()?;
+        let cwd = TempDir::new()?;
+        std::fs::write(cwd.path().join(".git"), "gitdir: nowhere")?;
+
+        let cfg: ConfigToml = toml::from_str(
+            r#"
+[permissions.network]
+enabled = true
+proxy_url = "http://127.0.0.1:43128"
+"#,
+        )
+        .expect("legacy permissions.network TOML should deserialize");
+
+        let err = Config::load_from_base_config_with_overrides(
+            cfg,
+            ConfigOverrides {
+                cwd: Some(cwd.path().to_path_buf()),
+                ..Default::default()
+            },
+            codex_home.path().to_path_buf(),
+        )
+        .expect_err("legacy permissions.network should require migration");
+
+        assert_eq!(err.kind(), ErrorKind::InvalidInput);
+        assert_eq!(
+            err.to_string(),
+            "legacy `[permissions.network]` is no longer supported; move this config to the top-level `[network]` table"
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn legacy_permissions_network_requires_migration_even_with_legacy_sandbox_mode()
+    -> std::io::Result<()> {
+        let codex_home = TempDir::new()?;
+        let cwd = TempDir::new()?;
+        std::fs::write(cwd.path().join(".git"), "gitdir: nowhere")?;
+
+        let cfg: ConfigToml = toml::from_str(
+            r#"
+sandbox_mode = "read-only"
+
+[permissions.network]
+enabled = true
+proxy_url = "http://127.0.0.1:43128"
+"#,
+        )
+        .expect("legacy permissions.network TOML should deserialize");
+
+        let err = Config::load_from_base_config_with_overrides(
+            cfg,
+            ConfigOverrides {
+                cwd: Some(cwd.path().to_path_buf()),
+                ..Default::default()
+            },
+            codex_home.path().to_path_buf(),
+        )
+        .expect_err("legacy permissions.network should require migration");
+
+        assert_eq!(err.kind(), ErrorKind::InvalidInput);
+        assert_eq!(
+            err.to_string(),
+            "legacy `[permissions.network]` is no longer supported; move this config to the top-level `[network]` table"
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn permissions_profiles_reject_writes_outside_workspace_root() -> std::io::Result<()> {
+        let codex_home = TempDir::new()?;
+        let cwd = TempDir::new()?;
+        std::fs::write(cwd.path().join(".git"), "gitdir: nowhere")?;
+        let external_write_path = if cfg!(windows) { r"C:\temp" } else { "/tmp" };
+
+        let err = Config::load_from_base_config_with_overrides(
+            ConfigToml {
+                default_permissions: Some("workspace".to_string()),
+                permissions: Some(PermissionsToml {
+                    entries: BTreeMap::from([(
+                        "workspace".to_string(),
+                        PermissionProfileToml {
+                            filesystem: Some(FilesystemPermissionsToml {
+                                entries: BTreeMap::from([(
+                                    external_write_path.to_string(),
+                                    FilesystemPermissionToml::Access(FileSystemAccessMode::Write),
+                                )]),
+                            }),
+                            network: None,
+                        },
+                    )]),
+                }),
+                ..Default::default()
+            },
+            ConfigOverrides {
+                cwd: Some(cwd.path().to_path_buf()),
+                ..Default::default()
+            },
+            codex_home.path().to_path_buf(),
+        )
+        .expect_err("writes outside the workspace root should be rejected");
+
+        assert_eq!(err.kind(), ErrorKind::InvalidInput);
+        assert!(
+            err.to_string()
+                .contains("filesystem writes outside the workspace root"),
+            "{err}"
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn permissions_profiles_allow_network_enablement() -> std::io::Result<()> {
+        let codex_home = TempDir::new()?;
+        let cwd = TempDir::new()?;
+        std::fs::write(cwd.path().join(".git"), "gitdir: nowhere")?;
+
+        let config = Config::load_from_base_config_with_overrides(
+            ConfigToml {
+                default_permissions: Some("workspace".to_string()),
+                permissions: Some(PermissionsToml {
+                    entries: BTreeMap::from([(
+                        "workspace".to_string(),
+                        PermissionProfileToml {
+                            filesystem: Some(FilesystemPermissionsToml {
+                                entries: BTreeMap::from([(
+                                    ":minimal".to_string(),
+                                    FilesystemPermissionToml::Access(FileSystemAccessMode::Read),
+                                )]),
+                            }),
+                            network: Some(PermissionProfileNetworkToml {
+                                enabled: Some(true),
+                            }),
+                        },
+                    )]),
+                }),
+                ..Default::default()
+            },
+            ConfigOverrides {
+                cwd: Some(cwd.path().to_path_buf()),
+                ..Default::default()
+            },
+            codex_home.path().to_path_buf(),
+        )?;
+
+        assert!(
+            config.permissions.network_sandbox_policy.is_enabled(),
+            "expected network sandbox policy to be enabled",
+        );
+        assert!(
+            config
+                .permissions
+                .sandbox_policy
+                .get()
+                .has_full_network_access()
+        );
+        Ok(())
+    }
+
     #[test]
     fn tui_theme_deserializes_from_toml() {
         let cfg = r#"
@@ -5129,6 +5661,10 @@ model_verbosity = "high"
                 permissions: Permissions {
                     approval_policy: Constrained::allow_any(AskForApproval::Never),
                     sandbox_policy: Constrained::allow_any(SandboxPolicy::new_read_only_policy()),
+                    file_system_sandbox_policy: FileSystemSandboxPolicy::from(
+                        &SandboxPolicy::new_read_only_policy(),
+                    ),
+                    network_sandbox_policy: NetworkSandboxPolicy::Restricted,
                     network: None,
                     allow_login_shell: true,
                     shell_environment_policy: ShellEnvironmentPolicy::default(),
@@ -5259,6 +5795,10 @@ model_verbosity = "high"
             permissions: Permissions {
                 approval_policy: Constrained::allow_any(AskForApproval::UnlessTrusted),
                 sandbox_policy: Constrained::allow_any(SandboxPolicy::new_read_only_policy()),
+                file_system_sandbox_policy: FileSystemSandboxPolicy::from(
+                    &SandboxPolicy::new_read_only_policy(),
+                ),
+                network_sandbox_policy: NetworkSandboxPolicy::Restricted,
                 network: None,
                 allow_login_shell: true,
                 shell_environment_policy: ShellEnvironmentPolicy::default(),
@@ -5387,6 +5927,10 @@ model_verbosity = "high"
             permissions: Permissions {
                 approval_policy: Constrained::allow_any(AskForApproval::OnFailure),
                 sandbox_policy: Constrained::allow_any(SandboxPolicy::new_read_only_policy()),
+                file_system_sandbox_policy: FileSystemSandboxPolicy::from(
+                    &SandboxPolicy::new_read_only_policy(),
+                ),
+                network_sandbox_policy: NetworkSandboxPolicy::Restricted,
                 network: None,
                 allow_login_shell: true,
                 shell_environment_policy: ShellEnvironmentPolicy::default(),
@@ -5501,6 +6045,10 @@ model_verbosity = "high"
             permissions: Permissions {
                 approval_policy: Constrained::allow_any(AskForApproval::OnFailure),
                 sandbox_policy: Constrained::allow_any(SandboxPolicy::new_read_only_policy()),
+                file_system_sandbox_policy: FileSystemSandboxPolicy::from(
+                    &SandboxPolicy::new_read_only_policy(),
+                ),
+                network_sandbox_policy: NetworkSandboxPolicy::Restricted,
                 network: None,
                 allow_login_shell: true,
                 shell_environment_policy: ShellEnvironmentPolicy::default(),

codex-rs/core/src/config/permissions.rs

@@ -1,15 +1,63 @@
+use std::collections::BTreeMap;
+use std::io;
+use std::path::Path;
+
 use codex_network_proxy::NetworkMode;
 use codex_network_proxy::NetworkProxyConfig;
+use codex_protocol::protocol::FileSystemAccessMode;
+use codex_protocol::protocol::FileSystemPath;
+use codex_protocol::protocol::FileSystemSandboxEntry;
+use codex_protocol::protocol::FileSystemSandboxPolicy;
+use codex_protocol::protocol::FileSystemSpecialPath;
+use codex_protocol::protocol::FileSystemSpecialPathKind;
+use codex_protocol::protocol::NetworkSandboxPolicy;
+use codex_utils_absolute_path::AbsolutePathBuf;
 use schemars::JsonSchema;
 use serde::Deserialize;
 use serde::Serialize;
 
 #[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
-#[schemars(deny_unknown_fields)]
 pub struct PermissionsToml {
-    /// Network proxy settings from `[permissions.network]`.
-    /// User config can enable the proxy; managed requirements may still constrain values.
-    pub network: Option<NetworkToml>,
+    #[serde(flatten)]
+    pub entries: BTreeMap<String, PermissionProfileToml>,
+}
+
+impl PermissionsToml {
+    pub fn is_empty(&self) -> bool {
+        self.entries.is_empty()
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
+#[schemars(deny_unknown_fields)]
+pub struct PermissionProfileToml {
+    pub filesystem: Option<FilesystemPermissionsToml>,
+    pub network: Option<PermissionProfileNetworkToml>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
+pub struct FilesystemPermissionsToml {
+    #[serde(flatten)]
+    pub entries: BTreeMap<String, FilesystemPermissionToml>,
+}
+
+impl FilesystemPermissionsToml {
+    pub fn is_empty(&self) -> bool {
+        self.entries.is_empty()
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema)]
+#[serde(untagged)]
+pub enum FilesystemPermissionToml {
+    Access(FileSystemAccessMode),
+    Scoped(BTreeMap<String, FileSystemAccessMode>),
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
+#[schemars(deny_unknown_fields)]
+pub struct PermissionProfileNetworkToml {
+    pub enabled: Option<bool>,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
@@ -102,13 +150,161 @@ impl NetworkToml {
     }
 }
 
-pub(crate) fn network_proxy_config_from_permissions(
-    permissions: Option<&PermissionsToml>,
+pub(crate) fn network_proxy_config_from_network(
+    network: Option<&NetworkToml>,
 ) -> NetworkProxyConfig {
-    permissions
-        .and_then(|permissions| permissions.network.as_ref())
-        .map_or_else(
-            NetworkProxyConfig::default,
-            NetworkToml::to_network_proxy_config,
-        )
+    network.map_or_else(
+        NetworkProxyConfig::default,
+        NetworkToml::to_network_proxy_config,
+    )
+}
+
+pub(crate) fn compile_permission_profile(
+    permissions: &PermissionsToml,
+    profile_name: &str,
+) -> io::Result<(FileSystemSandboxPolicy, NetworkSandboxPolicy)> {
+    let profile = permissions.entries.get(profile_name).ok_or_else(|| {
+        io::Error::new(
+            io::ErrorKind::InvalidInput,
+            format!("default_permissions refers to undefined profile `{profile_name}`"),
+        )
+    })?;
+
+    let filesystem = profile.filesystem.as_ref().ok_or_else(|| {
+        io::Error::new(
+            io::ErrorKind::InvalidInput,
+            format!(
+                "permissions profile `{profile_name}` must define a `[permissions.{profile_name}.filesystem]` table"
+            ),
+        )
+    })?;
+
+    if filesystem.is_empty() {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            format!(
+                "permissions profile `{profile_name}` must define at least one filesystem entry"
+            ),
+        ));
+    }
+
+    let mut entries = Vec::new();
+    for (path, permission) in &filesystem.entries {
+        compile_filesystem_permission(path, permission, &mut entries)?;
+    }
+
+    let network_sandbox_policy = compile_network_sandbox_policy(profile.network.as_ref());
+
+    Ok((
+        FileSystemSandboxPolicy::restricted(entries),
+        network_sandbox_policy,
+    ))
+}
+
+fn compile_network_sandbox_policy(
+    network: Option<&PermissionProfileNetworkToml>,
+) -> NetworkSandboxPolicy {
+    let Some(network) = network else {
+        return NetworkSandboxPolicy::Restricted;
+    };
+
+    match network.enabled {
+        Some(true) => NetworkSandboxPolicy::Enabled,
+        _ => NetworkSandboxPolicy::Restricted,
+    }
+}
+
+fn compile_filesystem_permission(
+    path: &str,
+    permission: &FilesystemPermissionToml,
+    entries: &mut Vec<FileSystemSandboxEntry>,
+) -> io::Result<()> {
+    match permission {
+        FilesystemPermissionToml::Access(access) => entries.push(FileSystemSandboxEntry {
+            path: compile_filesystem_path(path)?,
+            access: *access,
+        }),
+        FilesystemPermissionToml::Scoped(scoped_entries) => {
+            for (subpath, access) in scoped_entries {
+                entries.push(FileSystemSandboxEntry {
+                    path: compile_scoped_filesystem_path(path, subpath)?,
+                    access: *access,
+                });
+            }
+        }
+    }
+    Ok(())
+}
+
+fn compile_filesystem_path(path: &str) -> io::Result<FileSystemPath> {
+    if let Some(special) = parse_special_path(path)? {
+        return Ok(FileSystemPath::Special { value: special });
+    }
+
+    let path = parse_absolute_path(path)?;
+    Ok(FileSystemPath::Path { path })
+}
+
+fn compile_scoped_filesystem_path(path: &str, subpath: &str) -> io::Result<FileSystemPath> {
+    if subpath == "." {
+        return compile_filesystem_path(path);
+    }
+
+    let subpath = Path::new(subpath);
+    if subpath.is_absolute() {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            format!(
+                "filesystem subpath `{}` must be relative",
+                subpath.display()
+            ),
+        ));
+    }
+
+    if let Some(mut special) = parse_special_path(path)? {
+        if !matches!(special.kind, FileSystemSpecialPathKind::ProjectRoots) {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidInput,
+                format!("filesystem path `{path}` does not support nested entries"),
+            ));
+        }
+        special.subpath = Some(subpath.to_path_buf());
+        return Ok(FileSystemPath::Special { value: special });
+    }
+
+    let base = parse_absolute_path(path)?;
+    let path = AbsolutePathBuf::resolve_path_against_base(subpath, base.as_path())?;
+    Ok(FileSystemPath::Path { path })
+}
+
+fn parse_special_path(path: &str) -> io::Result<Option<FileSystemSpecialPath>> {
+    let kind = match path {
+        ":root" => Some(FileSystemSpecialPathKind::Root),
+        ":minimal" => Some(FileSystemSpecialPathKind::Minimal),
+        ":project_roots" => Some(FileSystemSpecialPathKind::ProjectRoots),
+        ":tmpdir" => Some(FileSystemSpecialPathKind::Tmpdir),
+        _ if path.starts_with(':') => {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidInput,
+                format!("unknown filesystem special path `{path}`"),
+            ));
+        }
+        _ => None,
+    };
+
+    Ok(kind.map(|kind| FileSystemSpecialPath {
+        kind,
+        subpath: None,
+    }))
+}
+
+fn parse_absolute_path(path: &str) -> io::Result<AbsolutePathBuf> {
+    let path_ref = Path::new(path);
+    if !path_ref.is_absolute() && path != "~" && !path.starts_with("~/") {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            format!("filesystem path `{path}` must be absolute, use `~/...`, or start with `:`"),
+        ));
+    }
+    AbsolutePathBuf::from_absolute_path(path_ref)
 }

codex-rs/core/src/exec.rs

@@ -24,6 +24,9 @@ use crate::protocol::Event;
 use crate::protocol::EventMsg;
 use crate::protocol::ExecCommandOutputDeltaEvent;
 use crate::protocol::ExecOutputStream;
+use crate::protocol::FileSystemSandboxKind;
+use crate::protocol::FileSystemSandboxPolicy;
+use crate::protocol::NetworkSandboxPolicy;
 use crate::protocol::SandboxPolicy;
 use crate::sandboxing::CommandSpec;
 use crate::sandboxing::ExecRequest;
@@ -149,9 +152,12 @@ pub struct StdoutStream {
     pub tx_event: Sender<Event>,
 }
 
+#[allow(clippy::too_many_arguments)]
 pub async fn process_exec_tool_call(
     params: ExecParams,
     sandbox_policy: &SandboxPolicy,
+    file_system_sandbox_policy: &FileSystemSandboxPolicy,
+    network_sandbox_policy: NetworkSandboxPolicy,
     sandbox_cwd: &Path,
     codex_linux_sandbox_exe: &Option<PathBuf>,
     use_linux_sandbox_bwrap: bool,
@@ -159,8 +165,8 @@ pub async fn process_exec_tool_call(
 ) -> Result<ExecToolCallOutput> {
     let windows_sandbox_level = params.windows_sandbox_level;
     let enforce_managed_network = params.network.is_some();
-    let sandbox_type = match &sandbox_policy {
-        SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. } => {
+    let sandbox_type = match file_system_sandbox_policy.kind {
+        FileSystemSandboxKind::Unrestricted | FileSystemSandboxKind::ExternalSandbox => {
             if enforce_managed_network {
                 get_platform_sandbox(
                     windows_sandbox_level
@@ -215,6 +221,8 @@ pub async fn process_exec_tool_call(
         .transform(crate::sandboxing::SandboxTransformRequest {
             spec,
             policy: sandbox_policy,
+            file_system_policy: file_system_sandbox_policy,
+            network_policy: network_sandbox_policy,
             sandbox: sandbox_type,
             enforce_managed_network,
             network: network.as_ref(),
@@ -233,7 +241,6 @@ pub async fn process_exec_tool_call(
 
 pub(crate) async fn execute_exec_env(
     env: ExecRequest,
-    sandbox_policy: &SandboxPolicy,
     stdout_stream: Option<StdoutStream>,
 ) -> Result<ExecToolCallOutput> {
     let ExecRequest {
@@ -245,7 +252,9 @@ pub(crate) async fn execute_exec_env(
         sandbox,
         windows_sandbox_level,
         sandbox_permissions,
-        sandbox_policy: _sandbox_policy_from_env,
+        sandbox_policy,
+        file_system_sandbox_policy,
+        network_sandbox_policy,
         justification,
         arg0,
     } = env;
@@ -263,7 +272,15 @@ pub(crate) async fn execute_exec_env(
     };
 
     let start = Instant::now();
-    let raw_output_result = exec(params, sandbox, sandbox_policy, stdout_stream).await;
+    let raw_output_result = exec(
+        params,
+        sandbox,
+        &sandbox_policy,
+        &file_system_sandbox_policy,
+        network_sandbox_policy,
+        stdout_stream,
+    )
+    .await;
     let duration = start.elapsed();
     finalize_exec_result(raw_output_result, sandbox, duration)
 }
@@ -692,15 +709,16 @@ async fn exec(
     params: ExecParams,
     sandbox: SandboxType,
     sandbox_policy: &SandboxPolicy,
+    file_system_sandbox_policy: &FileSystemSandboxPolicy,
+    network_sandbox_policy: NetworkSandboxPolicy,
     stdout_stream: Option<StdoutStream>,
 ) -> Result<RawExecToolCallOutput> {
     #[cfg(target_os = "windows")]
-    if sandbox == SandboxType::WindowsRestrictedToken
-        && !matches!(
-            sandbox_policy,
-            SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. }
-        )
-    {
+    if should_use_windows_restricted_token_sandbox(
+        sandbox,
+        sandbox_policy,
+        file_system_sandbox_policy,
+    ) {
         return exec_windows_sandbox(params, sandbox_policy).await;
     }
     let ExecParams {
@@ -729,7 +747,7 @@ async fn exec(
         args: args.into(),
         arg0: arg0_ref,
         cwd,
-        sandbox_policy,
+        network_sandbox_policy,
         // The environment already has attempt-scoped proxy settings from
         // apply_to_env_for_attempt above. Passing network here would reapply
         // non-attempt proxy vars and drop attempt correlation metadata.
@@ -741,6 +759,20 @@ async fn exec(
     consume_truncated_output(child, expiration, stdout_stream).await
 }
 
+#[cfg_attr(not(target_os = "windows"), allow(dead_code))]
+fn should_use_windows_restricted_token_sandbox(
+    sandbox: SandboxType,
+    sandbox_policy: &SandboxPolicy,
+    file_system_sandbox_policy: &FileSystemSandboxPolicy,
+) -> bool {
+    sandbox == SandboxType::WindowsRestrictedToken
+        && file_system_sandbox_policy.kind == FileSystemSandboxKind::Restricted
+        && !matches!(
+            sandbox_policy,
+            SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. }
+        )
+}
+
 /// Consumes the output of a child process, truncating it so it is suitable for
 /// use as the output of a `shell` tool call. Also enforces specified timeout.
 async fn consume_truncated_output(
@@ -1093,6 +1125,38 @@ mod tests {
         assert_eq!(aggregated.truncated_after_lines, None);
     }
 
+    #[test]
+    fn windows_restricted_token_skips_external_sandbox_policies() {
+        let policy = SandboxPolicy::ExternalSandbox {
+            network_access: codex_protocol::protocol::NetworkAccess::Restricted,
+        };
+        let file_system_policy = FileSystemSandboxPolicy::restricted(vec![]);
+
+        assert_eq!(
+            should_use_windows_restricted_token_sandbox(
+                SandboxType::WindowsRestrictedToken,
+                &policy,
+                &file_system_policy,
+            ),
+            false
+        );
+    }
+
+    #[test]
+    fn windows_restricted_token_runs_for_legacy_restricted_policies() {
+        let policy = SandboxPolicy::new_read_only_policy();
+        let file_system_policy = FileSystemSandboxPolicy::restricted(vec![]);
+
+        assert_eq!(
+            should_use_windows_restricted_token_sandbox(
+                SandboxType::WindowsRestrictedToken,
+                &policy,
+                &file_system_policy,
+            ),
+            true
+        );
+    }
+
     #[cfg(unix)]
     #[test]
     fn sandbox_detection_flags_sigsys_exit_code() {
@@ -1135,6 +1199,8 @@ mod tests {
             params,
             SandboxType::None,
             &SandboxPolicy::new_read_only_policy(),
+            &FileSystemSandboxPolicy::from(&SandboxPolicy::new_read_only_policy()),
+            NetworkSandboxPolicy::Restricted,
             None,
         )
         .await?;
@@ -1190,6 +1256,8 @@ mod tests {
         let result = process_exec_tool_call(
             params,
             &SandboxPolicy::DangerFullAccess,
+            &FileSystemSandboxPolicy::from(&SandboxPolicy::DangerFullAccess),
+            NetworkSandboxPolicy::Enabled,
             cwd.as_path(),
             &None,
             false,

codex-rs/core/src/landlock.rs

@@ -1,3 +1,4 @@
+use crate::protocol::NetworkSandboxPolicy;
 use crate::protocol::SandboxPolicy;
 use crate::spawn::SpawnChildRequest;
 use crate::spawn::StdioPolicy;
@@ -44,7 +45,7 @@ where
         args,
         arg0,
         cwd: command_cwd,
-        sandbox_policy,
+        network_sandbox_policy: NetworkSandboxPolicy::from(sandbox_policy),
         network,
         stdio_policy,
         env,

codex-rs/core/src/network_proxy_loader.rs

@@ -1,5 +1,4 @@
 use crate::config::NetworkToml;
-use crate::config::PermissionsToml;
 use crate::config::find_codex_home;
 use crate::config_loader::CloudRequirementsLoader;
 use crate::config_loader::ConfigLayerStack;
@@ -121,12 +120,6 @@ fn network_constraints_from_trusted_layers(
         if let Some(network) = parsed.network {
             apply_network_constraints(network, &mut constraints);
         }
-        if let Some(network) = parsed
-            .permissions
-            .and_then(|permissions| permissions.network)
-        {
-            apply_network_constraints(network, &mut constraints);
-        }
     }
     Ok(constraints)
 }
@@ -171,7 +164,6 @@ fn apply_network_constraints(network: NetworkToml, constraints: &mut NetworkProx
 #[derive(Debug, Clone, Default, Deserialize)]
 struct NetworkTablesToml {
     network: Option<NetworkToml>,
-    permissions: Option<PermissionsToml>,
 }
 
 fn network_tables_from_toml(value: &toml::Value) -> Result<NetworkTablesToml> {
@@ -185,12 +177,6 @@ fn apply_network_tables(config: &mut NetworkProxyConfig, parsed: NetworkTablesTo
     if let Some(network) = parsed.network {
         network.apply_to_network_proxy_config(config);
     }
-    if let Some(network) = parsed
-        .permissions
-        .and_then(|permissions| permissions.network)
-    {
-        network.apply_to_network_proxy_config(config);
-    }
 }
 
 fn config_from_layers(
@@ -315,10 +301,10 @@ mod tests {
     use pretty_assertions::assert_eq;
 
     #[test]
-    fn higher_precedence_network_table_beats_lower_permissions_network_table() {
-        let lower_permissions: toml::Value = toml::from_str(
+    fn higher_precedence_network_table_beats_lower_network_table() {
+        let lower_network: toml::Value = toml::from_str(
             r#"
-[permissions.network]
+[network]
 allowed_domains = ["lower.example.com"]
 "#,
         )
@@ -334,7 +320,7 @@ allowed_domains = ["higher.example.com"]
         let mut config = NetworkProxyConfig::default();
         apply_network_tables(
             &mut config,
-            network_tables_from_toml(&lower_permissions).expect("lower layer should deserialize"),
+            network_tables_from_toml(&lower_network).expect("lower layer should deserialize"),
         );
         apply_network_tables(
             &mut config,

codex-rs/core/src/sandboxing/mod.rs

@@ -13,6 +13,9 @@ use crate::exec::StdoutStream;
 use crate::exec::execute_exec_env;
 use crate::landlock::allow_network_for_proxy;
 use crate::landlock::create_linux_sandbox_command_args;
+use crate::protocol::FileSystemSandboxKind;
+use crate::protocol::FileSystemSandboxPolicy;
+use crate::protocol::NetworkSandboxPolicy;
 use crate::protocol::SandboxPolicy;
 #[cfg(target_os = "macos")]
 use crate::seatbelt::MACOS_PATH_TO_SEATBELT_EXECUTABLE;
@@ -29,6 +32,7 @@ use codex_protocol::models::FileSystemPermissions;
 use codex_protocol::models::MacOsSeatbeltProfileExtensions;
 use codex_protocol::models::PermissionProfile;
 pub use codex_protocol::models::SandboxPermissions;
+use codex_protocol::protocol::NetworkAccess;
 use codex_protocol::protocol::ReadOnlyAccess;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use dunce::canonicalize;
@@ -60,6 +64,8 @@ pub struct ExecRequest {
     pub windows_sandbox_level: WindowsSandboxLevel,
     pub sandbox_permissions: SandboxPermissions,
     pub sandbox_policy: SandboxPolicy,
+    pub file_system_sandbox_policy: FileSystemSandboxPolicy,
+    pub network_sandbox_policy: NetworkSandboxPolicy,
     pub justification: Option<String>,
     pub arg0: Option<String>,
 }
@@ -70,6 +76,8 @@ pub struct ExecRequest {
 pub(crate) struct SandboxTransformRequest<'a> {
     pub spec: CommandSpec,
     pub policy: &'a SandboxPolicy,
+    pub file_system_policy: &'a FileSystemSandboxPolicy,
+    pub network_policy: NetworkSandboxPolicy,
     pub sandbox: SandboxType,
     pub enforce_managed_network: bool,
     // TODO(viyatb): Evaluate switching this to Option<Arc<NetworkProxy>>
@@ -212,9 +220,17 @@ fn sandbox_policy_with_additional_permissions(
     let (extra_reads, extra_writes) = additional_permission_roots(additional_permissions);
 
     let policy = match sandbox_policy {
-        SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. } => {
-            sandbox_policy.clone()
-        }
+        SandboxPolicy::DangerFullAccess => SandboxPolicy::DangerFullAccess,
+        SandboxPolicy::ExternalSandbox { network_access } => SandboxPolicy::ExternalSandbox {
+            network_access: if merge_network_access(
+                network_access.is_enabled(),
+                additional_permissions,
+            ) {
+                NetworkAccess::Enabled
+            } else {
+                NetworkAccess::Restricted
+            },
+        },
         SandboxPolicy::WorkspaceWrite {
             writable_roots,
             read_only_access,
@@ -275,7 +291,8 @@ impl SandboxManager {
 
     pub(crate) fn select_initial(
         &self,
-        policy: &SandboxPolicy,
+        file_system_policy: &FileSystemSandboxPolicy,
+        network_policy: NetworkSandboxPolicy,
         pref: SandboxablePreference,
         windows_sandbox_level: WindowsSandboxLevel,
         has_managed_network_requirements: bool,
@@ -290,8 +307,8 @@ impl SandboxManager {
                 )
                 .unwrap_or(SandboxType::None)
             }
-            SandboxablePreference::Auto => match policy {
-                SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. } => {
+            SandboxablePreference::Auto => match file_system_policy.kind {
+                FileSystemSandboxKind::Unrestricted | FileSystemSandboxKind::ExternalSandbox => {
                     if has_managed_network_requirements {
                         crate::safety::get_platform_sandbox(
                             windows_sandbox_level != WindowsSandboxLevel::Disabled,
@@ -316,6 +333,8 @@ impl SandboxManager {
         let SandboxTransformRequest {
             mut spec,
             policy,
+            file_system_policy,
+            network_policy,
             sandbox,
             enforce_managed_network,
             network,
@@ -326,14 +345,36 @@ impl SandboxManager {
             use_linux_sandbox_bwrap,
             windows_sandbox_level,
         } = request;
-        let effective_policy =
-            if let Some(additional_permissions) = spec.additional_permissions.take() {
-                sandbox_policy_with_additional_permissions(policy, &additional_permissions)?
+        let effective_policy = if let Some(additional_permissions) =
+            spec.additional_permissions.take()
+        {
+            let (extra_reads, extra_writes) = additional_permission_roots(&additional_permissions);
+            let effective_policy =
+                sandbox_policy_with_additional_permissions(policy, &additional_permissions)?;
+            let file_system_sandbox_policy = if extra_reads.is_empty() && extra_writes.is_empty() {
+                file_system_policy.clone()
             } else {
-                policy.clone()
+                match file_system_policy.kind {
+                    FileSystemSandboxKind::Restricted => {
+                        FileSystemSandboxPolicy::from(&effective_policy)
+                    }
+                    FileSystemSandboxKind::Unrestricted
+                    | FileSystemSandboxKind::ExternalSandbox => file_system_policy.clone(),
+                }
             };
+            let network_sandbox_policy = NetworkSandboxPolicy::from(&effective_policy);
+            (
+                effective_policy,
+                file_system_sandbox_policy,
+                network_sandbox_policy,
+            )
+        } else {
+            (policy.clone(), file_system_policy.clone(), network_policy)
+        };
+        let (effective_policy, effective_file_system_policy, effective_network_policy) =
+            effective_policy;
         let mut env = spec.env;
-        if !effective_policy.has_full_network_access() {
+        if !effective_network_policy.is_enabled() {
             env.insert(
                 CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR.to_string(),
                 "1".to_string(),
@@ -407,6 +448,8 @@ impl SandboxManager {
             windows_sandbox_level,
             sandbox_permissions: spec.sandbox_permissions,
             sandbox_policy: effective_policy,
+            file_system_sandbox_policy: effective_file_system_policy,
+            network_sandbox_policy: effective_network_policy,
             justification: spec.justification,
             arg0: arg0_override,
         })
@@ -421,8 +464,7 @@ pub async fn execute_env(
     env: ExecRequest,
     stdout_stream: Option<StdoutStream>,
 ) -> crate::error::Result<ExecToolCallOutput> {
-    let effective_policy = env.sandbox_policy.clone();
-    execute_exec_env(env, &effective_policy, stdout_stream).await
+    execute_exec_env(env, stdout_stream).await
 }
 
 #[cfg(test)]
@@ -431,6 +473,14 @@ mod tests {
     use super::normalize_additional_permissions;
     use super::sandbox_policy_with_additional_permissions;
     use crate::exec::SandboxType;
+    use crate::protocol::FileSystemAccessMode;
+    use crate::protocol::FileSystemPath;
+    use crate::protocol::FileSystemSandboxEntry;
+    use crate::protocol::FileSystemSandboxPolicy;
+    use crate::protocol::FileSystemSpecialPath;
+    use crate::protocol::FileSystemSpecialPathKind;
+    use crate::protocol::NetworkAccess;
+    use crate::protocol::NetworkSandboxPolicy;
     use crate::protocol::ReadOnlyAccess;
     use crate::protocol::SandboxPolicy;
     use crate::tools::sandboxing::SandboxablePreference;
@@ -441,13 +491,15 @@ mod tests {
     use codex_utils_absolute_path::AbsolutePathBuf;
     use dunce::canonicalize;
     use pretty_assertions::assert_eq;
+    use std::collections::HashMap;
     use tempfile::TempDir;
 
     #[test]
     fn danger_full_access_defaults_to_no_sandbox_without_network_requirements() {
         let manager = SandboxManager::new();
         let sandbox = manager.select_initial(
-            &SandboxPolicy::DangerFullAccess,
+            &FileSystemSandboxPolicy::unrestricted(),
+            NetworkSandboxPolicy::Enabled,
             SandboxablePreference::Auto,
             WindowsSandboxLevel::Disabled,
             false,
@@ -460,7 +512,8 @@ mod tests {
         let manager = SandboxManager::new();
         let expected = crate::safety::get_platform_sandbox(false).unwrap_or(SandboxType::None);
         let sandbox = manager.select_initial(
-            &SandboxPolicy::DangerFullAccess,
+            &FileSystemSandboxPolicy::unrestricted(),
+            NetworkSandboxPolicy::Enabled,
             SandboxablePreference::Auto,
             WindowsSandboxLevel::Disabled,
             true,
@@ -468,6 +521,107 @@ mod tests {
         assert_eq!(sandbox, expected);
     }
 
+    #[test]
+    fn restricted_file_system_uses_platform_sandbox_without_managed_network() {
+        let manager = SandboxManager::new();
+        let expected = crate::safety::get_platform_sandbox(false).unwrap_or(SandboxType::None);
+        let sandbox = manager.select_initial(
+            &FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
+                path: FileSystemPath::Special {
+                    value: FileSystemSpecialPath {
+                        kind: FileSystemSpecialPathKind::Root,
+                        subpath: None,
+                    },
+                },
+                access: FileSystemAccessMode::Read,
+            }]),
+            NetworkSandboxPolicy::Enabled,
+            SandboxablePreference::Auto,
+            WindowsSandboxLevel::Disabled,
+            false,
+        );
+        assert_eq!(sandbox, expected);
+    }
+
+    #[test]
+    fn full_access_restricted_policy_skips_platform_sandbox_when_network_is_enabled() {
+        let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
+            path: FileSystemPath::Special {
+                value: FileSystemSpecialPath {
+                    kind: FileSystemSpecialPathKind::Root,
+                    subpath: None,
+                },
+            },
+            access: FileSystemAccessMode::Write,
+        }]);
+
+        assert_eq!(
+            should_require_platform_sandbox(&policy, NetworkSandboxPolicy::Enabled, false),
+            false
+        );
+    }
+
+    #[test]
+    fn full_access_restricted_policy_still_uses_platform_sandbox_for_restricted_network() {
+        let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
+            path: FileSystemPath::Special {
+                value: FileSystemSpecialPath {
+                    kind: FileSystemSpecialPathKind::Root,
+                    subpath: None,
+                },
+            },
+            access: FileSystemAccessMode::Write,
+        }]);
+
+        assert_eq!(
+            should_require_platform_sandbox(&policy, NetworkSandboxPolicy::Restricted, false),
+            true
+        );
+    }
+
+    #[test]
+    fn transform_preserves_unrestricted_file_system_policy_for_restricted_network() {
+        let manager = SandboxManager::new();
+        let cwd = std::env::current_dir().expect("current dir");
+        let exec_request = manager
+            .transform(super::SandboxTransformRequest {
+                spec: super::CommandSpec {
+                    program: "true".to_string(),
+                    args: Vec::new(),
+                    cwd: cwd.clone(),
+                    env: HashMap::new(),
+                    expiration: crate::exec::ExecExpiration::DefaultTimeout,
+                    sandbox_permissions: super::SandboxPermissions::UseDefault,
+                    additional_permissions: None,
+                    justification: None,
+                },
+                policy: &SandboxPolicy::ExternalSandbox {
+                    network_access: crate::protocol::NetworkAccess::Restricted,
+                },
+                file_system_policy: &FileSystemSandboxPolicy::unrestricted(),
+                network_policy: NetworkSandboxPolicy::Restricted,
+                sandbox: SandboxType::None,
+                enforce_managed_network: false,
+                network: None,
+                sandbox_policy_cwd: cwd.as_path(),
+                #[cfg(target_os = "macos")]
+                macos_seatbelt_profile_extensions: None,
+                codex_linux_sandbox_exe: None,
+                use_linux_sandbox_bwrap: false,
+                windows_sandbox_level: WindowsSandboxLevel::Disabled,
+            })
+            .expect("transform");
+
+        assert_eq!(
+            exec_request.file_system_sandbox_policy,
+            FileSystemSandboxPolicy::unrestricted()
+        );
+        assert_eq!(
+            exec_request.network_sandbox_policy,
+            NetworkSandboxPolicy::Restricted
+        );
+    }
+
     #[test]
     fn normalize_additional_permissions_preserves_network() {
         let temp_dir = TempDir::new().expect("create temp dir");
@@ -541,4 +695,139 @@ mod tests {
             }
         );
     }
+
+    #[test]
+    fn external_sandbox_additional_permissions_can_enable_network() {
+        let temp_dir = TempDir::new().expect("create temp dir");
+        let path = AbsolutePathBuf::from_absolute_path(
+            canonicalize(temp_dir.path()).expect("canonicalize temp dir"),
+        )
+        .expect("absolute temp dir");
+        let policy = sandbox_policy_with_additional_permissions(
+            &SandboxPolicy::ExternalSandbox {
+                network_access: NetworkAccess::Restricted,
+            },
+            &PermissionProfile {
+                network: Some(NetworkPermissions {
+                    enabled: Some(true),
+                }),
+                file_system: Some(FileSystemPermissions {
+                    read: Some(vec![path]),
+                    write: Some(Vec::new()),
+                }),
+                ..Default::default()
+            },
+        )
+        .expect("policy");
+
+        assert_eq!(
+            policy,
+            SandboxPolicy::ExternalSandbox {
+                network_access: NetworkAccess::Enabled,
+            }
+        );
+    }
+
+    #[test]
+    fn transform_additional_permissions_enable_network_for_external_sandbox() {
+        let manager = SandboxManager::new();
+        let cwd = std::env::current_dir().expect("current dir");
+        let temp_dir = TempDir::new().expect("create temp dir");
+        let path = AbsolutePathBuf::from_absolute_path(
+            canonicalize(temp_dir.path()).expect("canonicalize temp dir"),
+        )
+        .expect("absolute temp dir");
+        let exec_request = manager
+            .transform(super::SandboxTransformRequest {
+                spec: super::CommandSpec {
+                    program: "true".to_string(),
+                    args: Vec::new(),
+                    cwd: cwd.clone(),
+                    env: HashMap::new(),
+                    expiration: crate::exec::ExecExpiration::DefaultTimeout,
+                    sandbox_permissions: super::SandboxPermissions::WithAdditionalPermissions,
+                    additional_permissions: Some(PermissionProfile {
+                        network: Some(NetworkPermissions {
+                            enabled: Some(true),
+                        }),
+                        file_system: Some(FileSystemPermissions {
+                            read: Some(vec![path]),
+                            write: Some(Vec::new()),
+                        }),
+                        ..Default::default()
+                    }),
+                    justification: None,
+                },
+                policy: &SandboxPolicy::ExternalSandbox {
+                    network_access: NetworkAccess::Restricted,
+                },
+                file_system_policy: &FileSystemSandboxPolicy::unrestricted(),
+                network_policy: NetworkSandboxPolicy::Restricted,
+                sandbox: SandboxType::None,
+                enforce_managed_network: false,
+                network: None,
+                sandbox_policy_cwd: cwd.as_path(),
+                #[cfg(target_os = "macos")]
+                macos_seatbelt_profile_extensions: None,
+                codex_linux_sandbox_exe: None,
+                use_linux_sandbox_bwrap: false,
+                windows_sandbox_level: WindowsSandboxLevel::Disabled,
+            })
+            .expect("transform");
+
+        assert_eq!(
+            exec_request.sandbox_policy,
+            SandboxPolicy::ExternalSandbox {
+                network_access: NetworkAccess::Enabled,
+            }
+        );
+        assert_eq!(
+            exec_request.network_sandbox_policy,
+            NetworkSandboxPolicy::Enabled
+        );
+    }
+
+    #[test]
+    fn merge_file_system_policy_with_additional_permissions_preserves_unreadable_roots() {
+        let temp_dir = TempDir::new().expect("create temp dir");
+        let cwd = AbsolutePathBuf::from_absolute_path(
+            canonicalize(temp_dir.path()).expect("canonicalize temp dir"),
+        )
+        .expect("absolute temp dir");
+        let allowed_path = cwd.join("allowed").expect("allowed path");
+        let denied_path = cwd.join("denied").expect("denied path");
+        let merged_policy = merge_file_system_policy_with_additional_permissions(
+            &FileSystemSandboxPolicy::restricted(vec![
+                FileSystemSandboxEntry {
+                    path: FileSystemPath::Special {
+                        value: FileSystemSpecialPath {
+                            kind: FileSystemSpecialPathKind::Root,
+                            subpath: None,
+                        },
+                    },
+                    access: FileSystemAccessMode::Read,
+                },
+                FileSystemSandboxEntry {
+                    path: FileSystemPath::Path {
+                        path: denied_path.clone(),
+                    },
+                    access: FileSystemAccessMode::None,
+                },
+            ]),
+            vec![allowed_path.clone()],
+            Vec::new(),
+        );
+
+        assert_eq!(
+            merged_policy.get_unreadable_roots_with_cwd(cwd.as_path()),
+            vec![denied_path]
+        );
+        assert_eq!(
+            merged_policy.entries.contains(&FileSystemSandboxEntry {
+                path: FileSystemPath::Path { path: allowed_path },
+                access: FileSystemAccessMode::Read,
+            }),
+            true
+        );
+    }
 }

codex-rs/core/src/seatbelt.rs

@@ -15,6 +15,7 @@ use tokio::process::Child;
 use tracing::warn;
 use url::Url;
 
+use crate::protocol::NetworkSandboxPolicy;
 use crate::protocol::SandboxPolicy;
 use crate::seatbelt_permissions::MacOsSeatbeltProfileExtensions;
 use crate::seatbelt_permissions::build_seatbelt_extensions;
@@ -51,7 +52,7 @@ pub async fn spawn_command_under_seatbelt(
         args,
         arg0,
         cwd: command_cwd,
-        sandbox_policy,
+        network_sandbox_policy: NetworkSandboxPolicy::from(sandbox_policy),
         network,
         stdio_policy,
         env,

codex-rs/core/src/skills/permissions.rs

@@ -12,6 +12,10 @@ use codex_protocol::models::MacOsSeatbeltProfileExtensions;
 #[cfg(any(unix, test))]
 use codex_protocol::models::PermissionProfile;
 #[cfg(any(unix, test))]
+use codex_protocol::protocol::FileSystemSandboxPolicy;
+#[cfg(any(unix, test))]
+use codex_protocol::protocol::NetworkSandboxPolicy;
+#[cfg(any(unix, test))]
 use codex_utils_absolute_path::AbsolutePathBuf;
 #[cfg(any(unix, test))]
 use dunce::canonicalize as canonicalize_path;
@@ -89,10 +93,14 @@ pub(crate) fn compile_permission_profile(
     let macos_permissions = macos.unwrap_or_default();
     let macos_seatbelt_profile_extensions =
         build_macos_seatbelt_profile_extensions(&macos_permissions);
+    let file_system_sandbox_policy = FileSystemSandboxPolicy::from(&sandbox_policy);
+    let network_sandbox_policy = NetworkSandboxPolicy::from(&sandbox_policy);
 
     Some(Permissions {
         approval_policy: Constrained::allow_any(AskForApproval::Never),
         sandbox_policy: Constrained::allow_any(sandbox_policy),
+        file_system_sandbox_policy,
+        network_sandbox_policy,
         network: None,
         allow_login_shell: true,
         shell_environment_policy: ShellEnvironmentPolicy::default(),
@@ -234,6 +242,8 @@ mod tests {
     use codex_protocol::models::MacOsPreferencesValue;
     use codex_protocol::models::NetworkPermissions;
     use codex_protocol::models::PermissionProfile;
+    use codex_protocol::protocol::FileSystemSandboxPolicy;
+    use codex_protocol::protocol::NetworkSandboxPolicy;
     use codex_utils_absolute_path::AbsolutePathBuf;
     use pretty_assertions::assert_eq;
     use std::fs;
@@ -243,6 +253,25 @@ mod tests {
         AbsolutePathBuf::try_from(path).expect("absolute path")
     }
 
+    fn expected_permissions(sandbox_policy: SandboxPolicy) -> Permissions {
+        Permissions {
+            approval_policy: Constrained::allow_any(AskForApproval::Never),
+            sandbox_policy: Constrained::allow_any(sandbox_policy.clone()),
+            file_system_sandbox_policy: FileSystemSandboxPolicy::from(&sandbox_policy),
+            network_sandbox_policy: NetworkSandboxPolicy::from(&sandbox_policy),
+            network: None,
+            allow_login_shell: true,
+            shell_environment_policy: ShellEnvironmentPolicy::default(),
+            windows_sandbox_mode: None,
+            #[cfg(target_os = "macos")]
+            macos_seatbelt_profile_extensions: Some(
+                crate::seatbelt_permissions::MacOsSeatbeltProfileExtensions::default(),
+            ),
+            #[cfg(not(target_os = "macos"))]
+            macos_seatbelt_profile_extensions: None,
+        }
+    }
+
     #[test]
     fn compile_permission_profile_normalizes_paths() {
         let tempdir = tempfile::tempdir().expect("tempdir");
@@ -269,37 +298,24 @@ mod tests {
 
         assert_eq!(
             profile,
-            Permissions {
-                approval_policy: Constrained::allow_any(AskForApproval::Never),
-                sandbox_policy: Constrained::allow_any(SandboxPolicy::WorkspaceWrite {
-                    writable_roots: vec![
-                        AbsolutePathBuf::try_from(skill_dir.join("output"))
-                            .expect("absolute output path")
+            expected_permissions(SandboxPolicy::WorkspaceWrite {
+                writable_roots: vec![
+                    AbsolutePathBuf::try_from(skill_dir.join("output"))
+                        .expect("absolute output path")
+                ],
+                read_only_access: ReadOnlyAccess::Restricted {
+                    include_platform_defaults: true,
+                    readable_roots: vec![
+                        AbsolutePathBuf::try_from(
+                            dunce::canonicalize(&read_dir).unwrap_or(read_dir)
+                        )
+                        .expect("absolute read path")
                     ],
-                    read_only_access: ReadOnlyAccess::Restricted {
-                        include_platform_defaults: true,
-                        readable_roots: vec![
-                            AbsolutePathBuf::try_from(
-                                dunce::canonicalize(&read_dir).unwrap_or(read_dir)
-                            )
-                            .expect("absolute read path")
-                        ],
-                    },
-                    network_access: true,
-                    exclude_tmpdir_env_var: false,
-                    exclude_slash_tmp: false,
-                }),
-                network: None,
-                allow_login_shell: true,
-                shell_environment_policy: ShellEnvironmentPolicy::default(),
-                windows_sandbox_mode: None,
-                #[cfg(target_os = "macos")]
-                macos_seatbelt_profile_extensions: Some(
-                    crate::seatbelt_permissions::MacOsSeatbeltProfileExtensions::default(),
-                ),
-                #[cfg(not(target_os = "macos"))]
-                macos_seatbelt_profile_extensions: None,
-            }
+                },
+                network_access: true,
+                exclude_tmpdir_env_var: false,
+                exclude_slash_tmp: false,
+            })
         );
     }
 
@@ -330,23 +346,10 @@ mod tests {
 
         assert_eq!(
             profile,
-            Permissions {
-                approval_policy: Constrained::allow_any(AskForApproval::Never),
-                sandbox_policy: Constrained::allow_any(SandboxPolicy::ReadOnly {
-                    access: ReadOnlyAccess::FullAccess,
-                    network_access: true,
-                }),
-                network: None,
-                allow_login_shell: true,
-                shell_environment_policy: ShellEnvironmentPolicy::default(),
-                windows_sandbox_mode: None,
-                #[cfg(target_os = "macos")]
-                macos_seatbelt_profile_extensions: Some(
-                    crate::seatbelt_permissions::MacOsSeatbeltProfileExtensions::default(),
-                ),
-                #[cfg(not(target_os = "macos"))]
-                macos_seatbelt_profile_extensions: None,
-            }
+            expected_permissions(SandboxPolicy::ReadOnly {
+                access: ReadOnlyAccess::FullAccess,
+                network_access: true,
+            })
         );
     }
 
@@ -371,31 +374,18 @@ mod tests {
 
         assert_eq!(
             profile,
-            Permissions {
-                approval_policy: Constrained::allow_any(AskForApproval::Never),
-                sandbox_policy: Constrained::allow_any(SandboxPolicy::ReadOnly {
-                    access: ReadOnlyAccess::Restricted {
-                        include_platform_defaults: true,
-                        readable_roots: vec![
-                            AbsolutePathBuf::try_from(
-                                dunce::canonicalize(&read_dir).unwrap_or(read_dir)
-                            )
-                            .expect("absolute read path")
-                        ],
-                    },
-                    network_access: true,
-                }),
-                network: None,
-                allow_login_shell: true,
-                shell_environment_policy: ShellEnvironmentPolicy::default(),
-                windows_sandbox_mode: None,
-                #[cfg(target_os = "macos")]
-                macos_seatbelt_profile_extensions: Some(
-                    crate::seatbelt_permissions::MacOsSeatbeltProfileExtensions::default(),
-                ),
-                #[cfg(not(target_os = "macos"))]
-                macos_seatbelt_profile_extensions: None,
-            }
+            expected_permissions(SandboxPolicy::ReadOnly {
+                access: ReadOnlyAccess::Restricted {
+                    include_platform_defaults: true,
+                    readable_roots: vec![
+                        AbsolutePathBuf::try_from(
+                            dunce::canonicalize(&read_dir).unwrap_or(read_dir)
+                        )
+                        .expect("absolute read path")
+                    ],
+                },
+                network_access: true,
+            })
         );
     }
 

codex-rs/core/src/spawn.rs

@@ -6,13 +6,13 @@ use tokio::process::Child;
 use tokio::process::Command;
 use tracing::trace;
 
-use crate::protocol::SandboxPolicy;
+use crate::protocol::NetworkSandboxPolicy;
 
 /// Experimental environment variable that will be set to some non-empty value
 /// if both of the following are true:
 ///
 /// 1. The process was spawned by Codex as part of a shell tool call.
-/// 2. SandboxPolicy.has_full_network_access() was false for the tool call.
+/// 2. NetworkSandboxPolicy is restricted for the tool call.
 ///
 /// We may try to have just one environment variable for all sandboxing
 /// attributes, so this may change in the future.
@@ -33,15 +33,15 @@ pub enum StdioPolicy {
 /// ensuring the args and environment variables used to create the `Command`
 /// (and `Child`) honor the configuration.
 ///
-/// For now, we take `SandboxPolicy` as a parameter to spawn_child() because
-/// we need to determine whether to set the
+/// For now, we take `NetworkSandboxPolicy` as a parameter to spawn_child()
+/// because we need to determine whether to set the
 /// `CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR` environment variable.
 pub(crate) struct SpawnChildRequest<'a> {
     pub program: PathBuf,
     pub args: Vec<String>,
     pub arg0: Option<&'a str>,
     pub cwd: PathBuf,
-    pub sandbox_policy: &'a SandboxPolicy,
+    pub network_sandbox_policy: NetworkSandboxPolicy,
     pub network: Option<&'a NetworkProxy>,
     pub stdio_policy: StdioPolicy,
     pub env: HashMap<String, String>,
@@ -53,14 +53,14 @@ pub(crate) async fn spawn_child_async(request: SpawnChildRequest<'_>) -> std::io
         args,
         arg0,
         cwd,
-        sandbox_policy,
+        network_sandbox_policy,
         network,
         stdio_policy,
         mut env,
     } = request;
 
     trace!(
-        "spawn_child_async: {program:?} {args:?} {arg0:?} {cwd:?} {sandbox_policy:?} {stdio_policy:?} {env:?}"
+        "spawn_child_async: {program:?} {args:?} {arg0:?} {cwd:?} {network_sandbox_policy:?} {stdio_policy:?} {env:?}"
     );
 
     let mut cmd = Command::new(&program);
@@ -74,7 +74,7 @@ pub(crate) async fn spawn_child_async(request: SpawnChildRequest<'_>) -> std::io
     cmd.env_clear();
     cmd.envs(env);
 
-    if !sandbox_policy.has_full_network_access() {
+    if !network_sandbox_policy.is_enabled() {
         cmd.env(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR, "1");
     }
 

codex-rs/core/src/tasks/user_shell.rs

@@ -22,6 +22,8 @@ use crate::protocol::ExecCommandBeginEvent;
 use crate::protocol::ExecCommandEndEvent;
 use crate::protocol::ExecCommandSource;
 use crate::protocol::ExecCommandStatus;
+use crate::protocol::FileSystemSandboxPolicy;
+use crate::protocol::NetworkSandboxPolicy;
 use crate::protocol::SandboxPolicy;
 use crate::protocol::TurnStartedEvent;
 use crate::sandboxing::ExecRequest;
@@ -163,6 +165,8 @@ pub(crate) async fn execute_user_shell_command(
         windows_sandbox_level: turn_context.windows_sandbox_level,
         sandbox_permissions: SandboxPermissions::UseDefault,
         sandbox_policy: sandbox_policy.clone(),
+        file_system_sandbox_policy: FileSystemSandboxPolicy::from(&sandbox_policy),
+        network_sandbox_policy: NetworkSandboxPolicy::from(&sandbox_policy),
         justification: None,
         arg0: None,
     };
@@ -173,7 +177,7 @@ pub(crate) async fn execute_user_shell_command(
         tx_event: session.get_tx_event(),
     });
 
-    let exec_result = execute_exec_env(exec_env, &sandbox_policy, stdout_stream)
+    let exec_result = execute_exec_env(exec_env, stdout_stream)
         .or_cancel(&cancellation_token)
         .await;
 

codex-rs/core/src/tools/js_repl/mod.rs

@@ -852,7 +852,8 @@ impl JsReplManager {
             .network
             .is_some();
         let sandbox_type = sandbox.select_initial(
-            &turn.sandbox_policy,
+            &turn.file_system_sandbox_policy,
+            turn.network_sandbox_policy,
             SandboxablePreference::Auto,
             turn.windows_sandbox_level,
             has_managed_network_requirements,
@@ -861,6 +862,8 @@ impl JsReplManager {
             .transform(crate::sandboxing::SandboxTransformRequest {
                 spec,
                 policy: &turn.sandbox_policy,
+                file_system_policy: &turn.file_system_sandbox_policy,
+                network_policy: turn.network_sandbox_policy,
                 sandbox: sandbox_type,
                 enforce_managed_network: has_managed_network_requirements,
                 network: None,

codex-rs/core/src/tools/orchestrator.rs

@@ -169,7 +169,8 @@ impl ToolOrchestrator {
         let initial_sandbox = match tool.sandbox_mode_for_first_attempt(req) {
             SandboxOverride::BypassSandboxFirstAttempt => crate::exec::SandboxType::None,
             SandboxOverride::NoOverride => self.sandbox.select_initial(
-                &turn_ctx.sandbox_policy,
+                &turn_ctx.file_system_sandbox_policy,
+                turn_ctx.network_sandbox_policy,
                 tool.sandbox_preference(),
                 turn_ctx.windows_sandbox_level,
                 has_managed_network_requirements,
@@ -182,6 +183,8 @@ impl ToolOrchestrator {
         let initial_attempt = SandboxAttempt {
             sandbox: initial_sandbox,
             policy: &turn_ctx.sandbox_policy,
+            file_system_policy: &turn_ctx.file_system_sandbox_policy,
+            network_policy: turn_ctx.network_sandbox_policy,
             enforce_managed_network: has_managed_network_requirements,
             manager: &self.sandbox,
             sandbox_cwd: &turn_ctx.cwd,
@@ -296,6 +299,8 @@ impl ToolOrchestrator {
                 let escalated_attempt = SandboxAttempt {
                     sandbox: crate::exec::SandboxType::None,
                     policy: &turn_ctx.sandbox_policy,
+                    file_system_policy: &turn_ctx.file_system_sandbox_policy,
+                    network_policy: turn_ctx.network_sandbox_policy,
                     enforce_managed_network: has_managed_network_requirements,
                     manager: &self.sandbox,
                     sandbox_cwd: &turn_ctx.cwd,

codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs

@@ -25,7 +25,9 @@ use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::models::MacOsSeatbeltProfileExtensions;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::AskForApproval;
+use codex_protocol::protocol::FileSystemSandboxPolicy;
 use codex_protocol::protocol::NetworkPolicyRuleAction;
+use codex_protocol::protocol::NetworkSandboxPolicy;
 use codex_protocol::protocol::RejectConfig;
 use codex_protocol::protocol::ReviewDecision;
 use codex_protocol::protocol::SandboxPolicy;
@@ -92,6 +94,8 @@ pub(super) async fn try_run_zsh_fork(
         windows_sandbox_level,
         sandbox_permissions,
         sandbox_policy,
+        file_system_sandbox_policy,
+        network_sandbox_policy,
         justification,
         arg0,
     } = sandbox_exec_request;
@@ -107,6 +111,8 @@ pub(super) async fn try_run_zsh_fork(
         command,
         cwd: sandbox_cwd,
         sandbox_policy,
+        file_system_sandbox_policy,
+        network_sandbox_policy,
         sandbox,
         env: sandbox_env,
         network: sandbox_network,
@@ -629,6 +635,8 @@ struct CoreShellCommandExecutor {
     command: Vec<String>,
     cwd: PathBuf,
     sandbox_policy: SandboxPolicy,
+    file_system_sandbox_policy: FileSystemSandboxPolicy,
+    network_sandbox_policy: NetworkSandboxPolicy,
     sandbox: SandboxType,
     env: HashMap<String, String>,
     network: Option<codex_network_proxy::NetworkProxy>,
@@ -669,6 +677,8 @@ impl ShellCommandExecutor for CoreShellCommandExecutor {
                 windows_sandbox_level: self.windows_sandbox_level,
                 sandbox_permissions: self.sandbox_permissions,
                 sandbox_policy: self.sandbox_policy.clone(),
+                file_system_sandbox_policy: self.file_system_sandbox_policy.clone(),
+                network_sandbox_policy: self.network_sandbox_policy,
                 justification: self.justification.clone(),
                 arg0: self.arg0.clone(),
             },
@@ -713,6 +723,8 @@ impl ShellCommandExecutor for CoreShellCommandExecutor {
                 workdir,
                 env,
                 &self.sandbox_policy,
+                &self.file_system_sandbox_policy,
+                self.network_sandbox_policy,
                 None,
                 self.macos_seatbelt_profile_extensions.as_ref(),
             )?,
@@ -723,15 +735,23 @@ impl ShellCommandExecutor for CoreShellCommandExecutor {
                 workdir,
                 env,
                 &self.sandbox_policy,
+                &self.file_system_sandbox_policy,
+                self.network_sandbox_policy,
                 Some(permission_profile),
                 None,
             )?,
             EscalationExecution::Permissions(EscalationPermissions::Permissions(permissions)) => {
+                let file_system_sandbox_policy =
+                    FileSystemSandboxPolicy::from(&permissions.sandbox_policy);
+                let network_sandbox_policy =
+                    NetworkSandboxPolicy::from(&permissions.sandbox_policy);
                 self.prepare_sandboxed_exec(
                     command,
                     workdir,
                     env,
                     &permissions.sandbox_policy,
+                    &file_system_sandbox_policy,
+                    network_sandbox_policy,
                     None,
                     permissions.macos_seatbelt_profile_extensions.as_ref(),
                 )?
@@ -743,12 +763,15 @@ impl ShellCommandExecutor for CoreShellCommandExecutor {
 }
 
 impl CoreShellCommandExecutor {
+    #[allow(clippy::too_many_arguments)]
     fn prepare_sandboxed_exec(
         &self,
         command: Vec<String>,
         workdir: &AbsolutePathBuf,
         env: HashMap<String, String>,
         sandbox_policy: &SandboxPolicy,
+        file_system_sandbox_policy: &FileSystemSandboxPolicy,
+        network_sandbox_policy: NetworkSandboxPolicy,
         additional_permissions: Option<PermissionProfile>,
         #[cfg(target_os = "macos")] macos_seatbelt_profile_extensions: Option<
             &MacOsSeatbeltProfileExtensions,
@@ -762,7 +785,8 @@ impl CoreShellCommandExecutor {
             .ok_or_else(|| anyhow::anyhow!("prepared command must not be empty"))?;
         let sandbox_manager = crate::sandboxing::SandboxManager::new();
         let sandbox = sandbox_manager.select_initial(
-            sandbox_policy,
+            file_system_sandbox_policy,
+            network_sandbox_policy,
             SandboxablePreference::Auto,
             self.windows_sandbox_level,
             self.network.is_some(),
@@ -784,6 +808,8 @@ impl CoreShellCommandExecutor {
                     justification: self.justification.clone(),
                 },
                 policy: sandbox_policy,
+                file_system_policy: file_system_sandbox_policy,
+                network_policy: network_sandbox_policy,
                 sandbox,
                 enforce_managed_network: self.network.is_some(),
                 network: self.network.as_ref(),

codex-rs/core/src/tools/runtimes/shell/unix_escalation_tests.rs

@@ -30,6 +30,10 @@ use codex_protocol::models::FileSystemPermissions;
 use codex_protocol::models::MacOsPreferencesPermission;
 use codex_protocol::models::MacOsSeatbeltProfileExtensions;
 use codex_protocol::models::PermissionProfile;
+#[cfg(target_os = "macos")]
+use codex_protocol::protocol::FileSystemSandboxPolicy;
+#[cfg(target_os = "macos")]
+use codex_protocol::protocol::NetworkSandboxPolicy;
 use codex_shell_escalation::EscalationExecution;
 use codex_shell_escalation::EscalationPermissions;
 use codex_shell_escalation::ExecResult;
@@ -418,6 +422,10 @@ async fn prepare_escalated_exec_turn_default_preserves_macos_seatbelt_extensions
         network: None,
         sandbox: SandboxType::None,
         sandbox_policy: SandboxPolicy::new_read_only_policy(),
+        file_system_sandbox_policy: FileSystemSandboxPolicy::from(
+            &SandboxPolicy::new_read_only_policy(),
+        ),
+        network_sandbox_policy: NetworkSandboxPolicy::Restricted,
         windows_sandbox_level: WindowsSandboxLevel::Disabled,
         sandbox_permissions: SandboxPermissions::UseDefault,
         justification: None,
@@ -468,6 +476,8 @@ async fn prepare_escalated_exec_permissions_preserve_macos_seatbelt_extensions()
         network: None,
         sandbox: SandboxType::None,
         sandbox_policy: SandboxPolicy::DangerFullAccess,
+        file_system_sandbox_policy: FileSystemSandboxPolicy::from(&SandboxPolicy::DangerFullAccess),
+        network_sandbox_policy: NetworkSandboxPolicy::Enabled,
         windows_sandbox_level: WindowsSandboxLevel::Disabled,
         sandbox_permissions: SandboxPermissions::UseDefault,
         justification: None,
@@ -481,6 +491,10 @@ async fn prepare_escalated_exec_permissions_preserve_macos_seatbelt_extensions()
     let permissions = Permissions {
         approval_policy: Constrained::allow_any(AskForApproval::Never),
         sandbox_policy: Constrained::allow_any(SandboxPolicy::new_read_only_policy()),
+        file_system_sandbox_policy: FileSystemSandboxPolicy::from(
+            &SandboxPolicy::new_read_only_policy(),
+        ),
+        network_sandbox_policy: NetworkSandboxPolicy::Restricted,
         network: None,
         allow_login_shell: true,
         shell_environment_policy: ShellEnvironmentPolicy::default(),

codex-rs/core/src/tools/sandboxing.rs

@@ -7,6 +7,8 @@
 use crate::codex::Session;
 use crate::codex::TurnContext;
 use crate::error::CodexErr;
+use crate::protocol::FileSystemSandboxPolicy;
+use crate::protocol::NetworkSandboxPolicy;
 use crate::protocol::SandboxPolicy;
 use crate::sandboxing::CommandSpec;
 use crate::sandboxing::SandboxManager;
@@ -318,6 +320,8 @@ pub(crate) trait ToolRuntime<Req, Out>: Approvable<Req> + Sandboxable {
 pub(crate) struct SandboxAttempt<'a> {
     pub sandbox: crate::exec::SandboxType,
     pub policy: &'a crate::protocol::SandboxPolicy,
+    pub file_system_policy: &'a FileSystemSandboxPolicy,
+    pub network_policy: NetworkSandboxPolicy,
     pub enforce_managed_network: bool,
     pub(crate) manager: &'a SandboxManager,
     pub(crate) sandbox_cwd: &'a Path,
@@ -336,6 +340,8 @@ impl<'a> SandboxAttempt<'a> {
             .transform(crate::sandboxing::SandboxTransformRequest {
                 spec,
                 policy: self.policy,
+                file_system_policy: self.file_system_policy,
+                network_policy: self.network_policy,
                 sandbox: self.sandbox,
                 enforce_managed_network: self.enforce_managed_network,
                 network,

codex-rs/core/src/unified_exec/mod.rs

@@ -201,6 +201,10 @@ mod tests {
         turn.sandbox_policy
             .set(SandboxPolicy::DangerFullAccess)
             .expect("test setup should allow updating sandbox policy");
+        turn.file_system_sandbox_policy =
+            crate::protocol::FileSystemSandboxPolicy::from(turn.sandbox_policy.get());
+        turn.network_sandbox_policy =
+            crate::protocol::NetworkSandboxPolicy::from(turn.sandbox_policy.get());
         (Arc::new(session), Arc::new(turn))
     }
 

codex-rs/core/tests/suite/approvals.rs

@@ -2234,7 +2234,7 @@ async fn denying_network_policy_amendment_persists_policy_and_skips_future_netwo
     let home = Arc::new(TempDir::new()?);
     fs::write(
         home.path().join("config.toml"),
-        r#"[permissions.network]
+        r#"[network]
 enabled = true
 mode = "limited"
 allow_local_binding = true

codex-rs/core/tests/suite/exec.rs

@@ -10,6 +10,8 @@ use codex_core::exec::process_exec_tool_call;
 use codex_core::sandboxing::SandboxPermissions;
 use codex_core::spawn::CODEX_SANDBOX_ENV_VAR;
 use codex_protocol::config_types::WindowsSandboxLevel;
+use codex_protocol::protocol::FileSystemSandboxPolicy;
+use codex_protocol::protocol::NetworkSandboxPolicy;
 use codex_protocol::protocol::SandboxPolicy;
 use tempfile::TempDir;
 
@@ -45,7 +47,17 @@ async fn run_test_cmd(tmp: TempDir, cmd: Vec<&str>) -> Result<ExecToolCallOutput
 
     let policy = SandboxPolicy::new_read_only_policy();
 
-    process_exec_tool_call(params, &policy, tmp.path(), &None, false, None).await
+    process_exec_tool_call(
+        params,
+        &policy,
+        &FileSystemSandboxPolicy::from(&policy),
+        NetworkSandboxPolicy::from(&policy),
+        tmp.path(),
+        &None,
+        false,
+        None,
+    )
+    .await
 }
 
 /// Command succeeds with exit code 0 normally

codex-rs/core/tests/suite/user_shell_cmd.rs

@@ -5,6 +5,7 @@ use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::ExecCommandEndEvent;
 use codex_protocol::protocol::ExecCommandSource;
 use codex_protocol::protocol::ExecOutputStream;
+use codex_protocol::protocol::NetworkSandboxPolicy;
 use codex_protocol::protocol::Op;
 use codex_protocol::protocol::SandboxPolicy;
 use codex_protocol::protocol::TurnAbortReason;
@@ -23,6 +24,7 @@ use core_test_support::test_codex::test_codex;
 use core_test_support::wait_for_event;
 use core_test_support::wait_for_event_match;
 use core_test_support::wait_for_event_with_timeout;
+use pretty_assertions::assert_eq;
 use regex_lite::escape;
 use std::path::PathBuf;
 use tempfile::TempDir;
@@ -328,6 +330,35 @@ async fn user_shell_command_history_is_persisted_and_shared_with_model() -> anyh
     Ok(())
 }
 
+#[tokio::test]
+async fn user_shell_command_does_not_set_network_sandbox_env_var() -> anyhow::Result<()> {
+    let server = responses::start_mock_server().await;
+    let mut builder = core_test_support::test_codex::test_codex().with_config(|config| {
+        config.permissions.network_sandbox_policy = NetworkSandboxPolicy::Restricted;
+    });
+    let test = builder.build(&server).await?;
+
+    #[cfg(windows)]
+    let command = r#"$val = $env:CODEX_SANDBOX_NETWORK_DISABLED; if ([string]::IsNullOrEmpty($val)) { $val = 'not-set' } ; [System.Console]::Write($val)"#.to_string();
+    #[cfg(not(windows))]
+    let command =
+        r#"sh -c "printf '%s' \"${CODEX_SANDBOX_NETWORK_DISABLED:-not-set}\"""#.to_string();
+
+    test.codex
+        .submit(Op::RunUserShellCommand { command })
+        .await?;
+
+    let end_event = wait_for_event_match(&test.codex, |ev| match ev {
+        EventMsg::ExecCommandEnd(event) => Some(event.clone()),
+        _ => None,
+    })
+    .await;
+    assert_eq!(end_event.exit_code, 0);
+    assert_eq!(end_event.stdout.trim(), "not-set");
+
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 #[cfg(not(target_os = "windows"))] // TODO: unignore on windows
 async fn user_shell_command_output_is_truncated_in_history() -> anyhow::Result<()> {

codex-rs/linux-sandbox/tests/suite/landlock.rs

@@ -9,6 +9,8 @@ use codex_core::exec::process_exec_tool_call;
 use codex_core::exec_env::create_env;
 use codex_core::sandboxing::SandboxPermissions;
 use codex_protocol::config_types::WindowsSandboxLevel;
+use codex_protocol::protocol::FileSystemSandboxPolicy;
+use codex_protocol::protocol::NetworkSandboxPolicy;
 use codex_protocol::protocol::SandboxPolicy;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use pretty_assertions::assert_eq;
@@ -102,6 +104,8 @@ async fn run_cmd_result_with_writable_roots(
     process_exec_tool_call(
         params,
         &sandbox_policy,
+        &FileSystemSandboxPolicy::from(&sandbox_policy),
+        NetworkSandboxPolicy::from(&sandbox_policy),
         sandbox_cwd.as_path(),
         &codex_linux_sandbox_exe,
         use_bwrap_sandbox,
@@ -333,6 +337,8 @@ async fn assert_network_blocked(cmd: &[&str]) {
     let result = process_exec_tool_call(
         params,
         &sandbox_policy,
+        &FileSystemSandboxPolicy::from(&sandbox_policy),
+        NetworkSandboxPolicy::from(&sandbox_policy),
         sandbox_cwd.as_path(),
         &codex_linux_sandbox_exe,
         false,

codex-rs/protocol/src/protocol.rs

@@ -7,6 +7,7 @@ use std::collections::HashMap;
 use std::collections::HashSet;
 use std::ffi::OsStr;
 use std::fmt;
+use std::io;
 use std::path::Path;
 use std::path::PathBuf;
 use std::str::FromStr;
@@ -537,6 +538,279 @@ impl NetworkAccess {
     }
 }
 
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Display, Default, JsonSchema, TS,
+)]
+#[serde(rename_all = "kebab-case")]
+#[strum(serialize_all = "kebab-case")]
+pub enum NetworkSandboxPolicy {
+    #[default]
+    Restricted,
+    Enabled,
+}
+
+impl NetworkSandboxPolicy {
+    pub fn is_enabled(self) -> bool {
+        matches!(self, NetworkSandboxPolicy::Enabled)
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Display, JsonSchema, TS)]
+#[serde(rename_all = "lowercase")]
+#[strum(serialize_all = "lowercase")]
+pub enum FileSystemAccessMode {
+    None,
+    Read,
+    Write,
+}
+
+impl FileSystemAccessMode {
+    pub fn can_read(self) -> bool {
+        !matches!(self, FileSystemAccessMode::None)
+    }
+
+    pub fn can_write(self) -> bool {
+        matches!(self, FileSystemAccessMode::Write)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema, TS)]
+#[serde(rename_all = "snake_case")]
+pub enum FileSystemSpecialPathKind {
+    Root,
+    Minimal,
+    CurrentWorkingDirectory,
+    ProjectRoots,
+    Tmpdir,
+    SlashTmp,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema, TS)]
+#[serde(rename_all = "snake_case")]
+pub struct FileSystemSpecialPath {
+    pub kind: FileSystemSpecialPathKind,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub subpath: Option<PathBuf>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema, TS)]
+#[serde(tag = "type", rename_all = "snake_case")]
+#[ts(tag = "type")]
+pub enum FileSystemPath {
+    Path { path: AbsolutePathBuf },
+    Special { value: FileSystemSpecialPath },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema, TS)]
+pub struct FileSystemSandboxEntry {
+    pub path: FileSystemPath,
+    pub access: FileSystemAccessMode,
+}
+
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Display, Default, JsonSchema, TS,
+)]
+#[serde(rename_all = "kebab-case")]
+#[strum(serialize_all = "kebab-case")]
+pub enum FileSystemSandboxKind {
+    #[default]
+    Restricted,
+    Unrestricted,
+    ExternalSandbox,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema, TS)]
+pub struct FileSystemSandboxPolicy {
+    pub kind: FileSystemSandboxKind,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub entries: Vec<FileSystemSandboxEntry>,
+}
+
+impl Default for FileSystemSandboxPolicy {
+    fn default() -> Self {
+        Self {
+            kind: FileSystemSandboxKind::Restricted,
+            entries: vec![FileSystemSandboxEntry {
+                path: FileSystemPath::Special {
+                    value: FileSystemSpecialPath {
+                        kind: FileSystemSpecialPathKind::Root,
+                        subpath: None,
+                    },
+                },
+                access: FileSystemAccessMode::Read,
+            }],
+        }
+    }
+}
+
+impl FileSystemSandboxPolicy {
+    pub fn unrestricted() -> Self {
+        Self {
+            kind: FileSystemSandboxKind::Unrestricted,
+            entries: Vec::new(),
+        }
+    }
+
+    pub fn external_sandbox() -> Self {
+        Self {
+            kind: FileSystemSandboxKind::ExternalSandbox,
+            entries: Vec::new(),
+        }
+    }
+
+    pub fn restricted(entries: Vec<FileSystemSandboxEntry>) -> Self {
+        Self {
+            kind: FileSystemSandboxKind::Restricted,
+            entries,
+        }
+    }
+
+    pub fn to_legacy_sandbox_policy(
+        &self,
+        network_policy: NetworkSandboxPolicy,
+        cwd: &Path,
+    ) -> io::Result<SandboxPolicy> {
+        Ok(match self.kind {
+            FileSystemSandboxKind::ExternalSandbox => SandboxPolicy::ExternalSandbox {
+                network_access: if network_policy.is_enabled() {
+                    NetworkAccess::Enabled
+                } else {
+                    NetworkAccess::Restricted
+                },
+            },
+            FileSystemSandboxKind::Unrestricted => {
+                if network_policy.is_enabled() {
+                    SandboxPolicy::DangerFullAccess
+                } else {
+                    SandboxPolicy::ExternalSandbox {
+                        network_access: NetworkAccess::Restricted,
+                    }
+                }
+            }
+            FileSystemSandboxKind::Restricted => {
+                let cwd_absolute = AbsolutePathBuf::from_absolute_path(cwd).ok();
+                let mut include_platform_defaults = false;
+                let mut has_full_disk_read_access = false;
+                let mut has_full_disk_write_access = false;
+                let mut workspace_root_writable = false;
+                let mut writable_roots = Vec::new();
+                let mut readable_roots = Vec::new();
+                let mut tmpdir_writable = false;
+                let mut slash_tmp_writable = false;
+
+                for entry in &self.entries {
+                    match &entry.path {
+                        FileSystemPath::Path { path } => {
+                            if entry.access.can_write() {
+                                if cwd_absolute.as_ref().is_some_and(|cwd| cwd == path) {
+                                    workspace_root_writable = true;
+                                } else {
+                                    writable_roots.push(path.clone());
+                                }
+                            } else if entry.access.can_read() {
+                                readable_roots.push(path.clone());
+                            }
+                        }
+                        FileSystemPath::Special { value } => match value.kind {
+                            FileSystemSpecialPathKind::Root => match entry.access {
+                                FileSystemAccessMode::None => {}
+                                FileSystemAccessMode::Read => has_full_disk_read_access = true,
+                                FileSystemAccessMode::Write => {
+                                    has_full_disk_read_access = true;
+                                    has_full_disk_write_access = true;
+                                }
+                            },
+                            FileSystemSpecialPathKind::Minimal => {
+                                if entry.access.can_read() {
+                                    include_platform_defaults = true;
+                                }
+                            }
+                            FileSystemSpecialPathKind::CurrentWorkingDirectory
+                            | FileSystemSpecialPathKind::ProjectRoots => {
+                                if value.subpath.is_none() && entry.access.can_write() {
+                                    workspace_root_writable = true;
+                                } else if let Some(path) =
+                                    resolve_file_system_special_path(value, cwd_absolute.as_ref())
+                                {
+                                    if entry.access.can_write() {
+                                        writable_roots.push(path);
+                                    } else if entry.access.can_read() {
+                                        readable_roots.push(path);
+                                    }
+                                }
+                            }
+                            FileSystemSpecialPathKind::Tmpdir => {
+                                if entry.access.can_write() {
+                                    tmpdir_writable = true;
+                                } else if entry.access.can_read()
+                                    && let Some(path) = resolve_file_system_special_path(
+                                        value,
+                                        cwd_absolute.as_ref(),
+                                    )
+                                {
+                                    readable_roots.push(path);
+                                }
+                            }
+                            FileSystemSpecialPathKind::SlashTmp => {
+                                if entry.access.can_write() {
+                                    slash_tmp_writable = true;
+                                } else if entry.access.can_read()
+                                    && let Some(path) = resolve_file_system_special_path(
+                                        value,
+                                        cwd_absolute.as_ref(),
+                                    )
+                                {
+                                    readable_roots.push(path);
+                                }
+                            }
+                        },
+                    }
+                }
+
+                if has_full_disk_write_access {
+                    return Ok(if network_policy.is_enabled() {
+                        SandboxPolicy::DangerFullAccess
+                    } else {
+                        SandboxPolicy::ExternalSandbox {
+                            network_access: NetworkAccess::Restricted,
+                        }
+                    });
+                }
+
+                let read_only_access = if has_full_disk_read_access {
+                    ReadOnlyAccess::FullAccess
+                } else {
+                    ReadOnlyAccess::Restricted {
+                        include_platform_defaults,
+                        readable_roots: dedup_absolute_paths(readable_roots),
+                    }
+                };
+
+                if workspace_root_writable {
+                    SandboxPolicy::WorkspaceWrite {
+                        writable_roots: dedup_absolute_paths(writable_roots),
+                        read_only_access,
+                        network_access: network_policy.is_enabled(),
+                        exclude_tmpdir_env_var: !tmpdir_writable,
+                        exclude_slash_tmp: !slash_tmp_writable,
+                    }
+                } else if !writable_roots.is_empty() || tmpdir_writable || slash_tmp_writable {
+                    return Err(io::Error::new(
+                        io::ErrorKind::InvalidInput,
+                        "permissions profile requests filesystem writes outside the workspace root, which is not supported until the runtime enforces FileSystemSandboxPolicy directly",
+                    ));
+                } else {
+                    SandboxPolicy::ReadOnly {
+                        access: read_only_access,
+                        network_access: network_policy.is_enabled(),
+                    }
+                }
+            }
+        })
+    }
+}
+
 fn default_include_platform_defaults() -> bool {
     true
 }
@@ -923,6 +1197,212 @@ impl SandboxPolicy {
     }
 }
 
+impl From<&SandboxPolicy> for NetworkSandboxPolicy {
+    fn from(value: &SandboxPolicy) -> Self {
+        if value.has_full_network_access() {
+            NetworkSandboxPolicy::Enabled
+        } else {
+            NetworkSandboxPolicy::Restricted
+        }
+    }
+}
+
+impl From<&SandboxPolicy> for FileSystemSandboxPolicy {
+    fn from(value: &SandboxPolicy) -> Self {
+        match value {
+            SandboxPolicy::DangerFullAccess => FileSystemSandboxPolicy::unrestricted(),
+            SandboxPolicy::ExternalSandbox { .. } => FileSystemSandboxPolicy::external_sandbox(),
+            SandboxPolicy::ReadOnly { access, .. } => {
+                let mut entries = Vec::new();
+                match access {
+                    ReadOnlyAccess::FullAccess => entries.push(FileSystemSandboxEntry {
+                        path: FileSystemPath::Special {
+                            value: FileSystemSpecialPath {
+                                kind: FileSystemSpecialPathKind::Root,
+                                subpath: None,
+                            },
+                        },
+                        access: FileSystemAccessMode::Read,
+                    }),
+                    ReadOnlyAccess::Restricted {
+                        include_platform_defaults,
+                        readable_roots,
+                    } => {
+                        entries.push(FileSystemSandboxEntry {
+                            path: FileSystemPath::Special {
+                                value: FileSystemSpecialPath {
+                                    kind: FileSystemSpecialPathKind::CurrentWorkingDirectory,
+                                    subpath: None,
+                                },
+                            },
+                            access: FileSystemAccessMode::Read,
+                        });
+                        if *include_platform_defaults {
+                            entries.push(FileSystemSandboxEntry {
+                                path: FileSystemPath::Special {
+                                    value: FileSystemSpecialPath {
+                                        kind: FileSystemSpecialPathKind::Minimal,
+                                        subpath: None,
+                                    },
+                                },
+                                access: FileSystemAccessMode::Read,
+                            });
+                        }
+                        entries.extend(readable_roots.iter().cloned().map(|path| {
+                            FileSystemSandboxEntry {
+                                path: FileSystemPath::Path { path },
+                                access: FileSystemAccessMode::Read,
+                            }
+                        }));
+                    }
+                }
+                FileSystemSandboxPolicy::restricted(entries)
+            }
+            SandboxPolicy::WorkspaceWrite {
+                writable_roots,
+                read_only_access,
+                exclude_tmpdir_env_var,
+                exclude_slash_tmp,
+                ..
+            } => {
+                let mut entries = Vec::new();
+                match read_only_access {
+                    ReadOnlyAccess::FullAccess => entries.push(FileSystemSandboxEntry {
+                        path: FileSystemPath::Special {
+                            value: FileSystemSpecialPath {
+                                kind: FileSystemSpecialPathKind::Root,
+                                subpath: None,
+                            },
+                        },
+                        access: FileSystemAccessMode::Read,
+                    }),
+                    ReadOnlyAccess::Restricted {
+                        include_platform_defaults,
+                        readable_roots,
+                    } => {
+                        if *include_platform_defaults {
+                            entries.push(FileSystemSandboxEntry {
+                                path: FileSystemPath::Special {
+                                    value: FileSystemSpecialPath {
+                                        kind: FileSystemSpecialPathKind::Minimal,
+                                        subpath: None,
+                                    },
+                                },
+                                access: FileSystemAccessMode::Read,
+                            });
+                        }
+                        entries.extend(readable_roots.iter().cloned().map(|path| {
+                            FileSystemSandboxEntry {
+                                path: FileSystemPath::Path { path },
+                                access: FileSystemAccessMode::Read,
+                            }
+                        }));
+                    }
+                }
+
+                entries.push(FileSystemSandboxEntry {
+                    path: FileSystemPath::Special {
+                        value: FileSystemSpecialPath {
+                            kind: FileSystemSpecialPathKind::CurrentWorkingDirectory,
+                            subpath: None,
+                        },
+                    },
+                    access: FileSystemAccessMode::Write,
+                });
+                if !exclude_slash_tmp {
+                    entries.push(FileSystemSandboxEntry {
+                        path: FileSystemPath::Special {
+                            value: FileSystemSpecialPath {
+                                kind: FileSystemSpecialPathKind::SlashTmp,
+                                subpath: None,
+                            },
+                        },
+                        access: FileSystemAccessMode::Write,
+                    });
+                }
+                if !exclude_tmpdir_env_var {
+                    entries.push(FileSystemSandboxEntry {
+                        path: FileSystemPath::Special {
+                            value: FileSystemSpecialPath {
+                                kind: FileSystemSpecialPathKind::Tmpdir,
+                                subpath: None,
+                            },
+                        },
+                        access: FileSystemAccessMode::Write,
+                    });
+                }
+                entries.extend(
+                    writable_roots
+                        .iter()
+                        .cloned()
+                        .map(|path| FileSystemSandboxEntry {
+                            path: FileSystemPath::Path { path },
+                            access: FileSystemAccessMode::Write,
+                        }),
+                );
+                FileSystemSandboxPolicy::restricted(entries)
+            }
+        }
+    }
+}
+
+fn resolve_file_system_special_path(
+    value: &FileSystemSpecialPath,
+    cwd: Option<&AbsolutePathBuf>,
+) -> Option<AbsolutePathBuf> {
+    match value.kind {
+        FileSystemSpecialPathKind::Root | FileSystemSpecialPathKind::Minimal => None,
+        FileSystemSpecialPathKind::CurrentWorkingDirectory
+        | FileSystemSpecialPathKind::ProjectRoots => {
+            let cwd = cwd?;
+            match value.subpath.as_ref() {
+                Some(subpath) => {
+                    AbsolutePathBuf::resolve_path_against_base(subpath, cwd.as_path()).ok()
+                }
+                None => Some(cwd.clone()),
+            }
+        }
+        FileSystemSpecialPathKind::Tmpdir => {
+            let tmpdir = std::env::var_os("TMPDIR")?;
+            if tmpdir.is_empty() {
+                None
+            } else {
+                let tmpdir = AbsolutePathBuf::from_absolute_path(PathBuf::from(tmpdir)).ok()?;
+                match value.subpath.as_ref() {
+                    Some(subpath) => {
+                        AbsolutePathBuf::resolve_path_against_base(subpath, tmpdir.as_path()).ok()
+                    }
+                    None => Some(tmpdir),
+                }
+            }
+        }
+        FileSystemSpecialPathKind::SlashTmp => {
+            #[allow(clippy::expect_used)]
+            let slash_tmp = AbsolutePathBuf::from_absolute_path("/tmp").expect("/tmp is absolute");
+            if !slash_tmp.as_path().is_dir() {
+                return None;
+            }
+            match value.subpath.as_ref() {
+                Some(subpath) => {
+                    AbsolutePathBuf::resolve_path_against_base(subpath, slash_tmp.as_path()).ok()
+                }
+                None => Some(slash_tmp),
+            }
+        }
+    }
+}
+
+fn dedup_absolute_paths(paths: Vec<AbsolutePathBuf>) -> Vec<AbsolutePathBuf> {
+    let mut deduped = Vec::with_capacity(paths.len());
+    let mut seen = HashSet::new();
+    for path in paths {
+        if seen.insert(path.to_path_buf()) {
+            deduped.push(path);
+        }
+    }
+    deduped
+}
+
 fn is_git_pointer_file(path: &AbsolutePathBuf) -> bool {
     path.as_path().is_file() && path.as_path().file_name() == Some(OsStr::new(".git"))
 }
@@ -3201,6 +3681,36 @@ mod tests {
         }
     }
 
+    #[test]
+    fn file_system_policy_rejects_legacy_bridge_for_non_workspace_writes() {
+        let cwd = if cfg!(windows) {
+            Path::new(r"C:\workspace")
+        } else {
+            Path::new("/tmp/workspace")
+        };
+        let external_write_path = if cfg!(windows) {
+            AbsolutePathBuf::from_absolute_path(r"C:\temp").expect("absolute windows temp path")
+        } else {
+            AbsolutePathBuf::from_absolute_path("/tmp").expect("absolute tmp path")
+        };
+        let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
+            path: FileSystemPath::Path {
+                path: external_write_path,
+            },
+            access: FileSystemAccessMode::Write,
+        }]);
+
+        let err = policy
+            .to_legacy_sandbox_policy(NetworkSandboxPolicy::Restricted, cwd)
+            .expect_err("non-workspace writes should be rejected");
+
+        assert!(
+            err.to_string()
+                .contains("filesystem writes outside the workspace root"),
+            "{err}"
+        );
+    }
+
     #[test]
     fn item_started_event_from_web_search_emits_begin_event() {
         let event = ItemStartedEvent {