feat(sandbox): support launch-configured permission profiles

[zfy0701]

Summary

• allow a trusted ACP launcher to provide Codex app-server configuration overrides and map ACP modes to named permission profiles
• select the mapped profile when starting, resuming, or loading a thread, and update it when the ACP mode changes
• preserve additional workspace roots and omit the legacy per-turn sandbox policy while a named profile is active
• keep profile definitions opaque to codex-acp and preserve the existing behavior when no profile mapping is configured

Motivation

Named Codex permission profiles can express runtime policy that the legacy ACP sandboxPolicy cannot represent. ACP hosts need a launch-wide way to select those profiles consistently without making codex-acp own any operator-specific policy.

The launcher supplies CODEX_ACP_PERMISSION_PROFILE_CONFIG with app-server -c overrides and a complete mapping for the three ACP modes. codex-acp validates the mapping at startup, removes the launch variable from the Codex child environment, and uses the experimental app-server permission-profile fields for thread creation, resume, mode changes, and turns.

Compatibility

This is opt-in. Without CODEX_ACP_PERMISSION_PROFILE_CONFIG, codex-acp continues to send the existing per-turn sandbox policy unchanged. Invalid or incomplete profile mappings fail startup instead of silently weakening the requested policy.

Validation

• npm run typecheck
• npm test (342 passed, 28 skipped)
• npm run build
• Linux app-server smoke test covering session creation and all three ACP mode transitions
• Linux sandbox smoke test confirming that a profile-level file deny remained effective without a legacy per-turn sandbox override

Created by Codex . GPT-5.6