# fix\(server\): Codex keeps your permissions profile after switching to Full access and back \(\#20266\) · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/commit/deff3b89f555387f87fc8560e234c3b92b34d7a4)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

Requested revision: deff3b89f555387f87fc8560e234c3b92b34d7a4

Requested commit: deff3b89f555387f87fc8560e234c3b92b34d7a4

Commit: deff3b89f555387f87fc8560e234c3b92b34d7a4

Tree: 285e536c2efa6238d8e262aeae321da4d2cd6cc7

Author: Julius Marminge

Committer: Julius Marminge

## Message

```
fix(server): Codex keeps your permissions profile after switching to Full access and back (#20266)

Every Codex turn/start sent a legacy sandboxPolicy. Codex keeps a user's
named permission profile (default_permissions) only while that policy
matches the profile's projection, so after a Full access turn the next
Auto turn fell back to a plain workspaceWrite profile and lost the
profile's deny-read entries, such as .env files.

The adapter now remembers the user-defined activePermissionProfile that
thread/start and thread/resume report. When a turn's mode uses the same
sandbox type and no explicit sandbox override is given, turn/start selects
the profile with `permissions` instead of sending sandboxPolicy. Built-in
profiles and Codex versions without activePermissionProfile are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

```

## Parents

- [f650044b2ab1436be24a137f2f59cef65413e589](https://git.cafe/pingdotgg/t3code/commit/f650044b2ab1436be24a137f2f59cef65413e589?format=markdown)

[Source at this commit](https://git.cafe/pingdotgg/t3code/tree/deff3b89f555387f87fc8560e234c3b92b34d7a4?format=markdown)