fix(permissions): validate network access flow

crates/infrastructure/src/session/factory.rs

@@ -14,7 +14,7 @@ use serde_json::Value;
 
 use domain::ports::{
     AgentSession, AgentSessionError, AgentSessionFactory, PreparedContext, SessionPlan,
-    ToolInvocationError, ToolInvoker, ToolSpec,
+    StructuredProviderLaunchPolicy, ToolInvocationError, ToolInvoker, ToolSpec,
 };
 use domain::profile::{AgentProfile, StructuredAdapter};
 use domain::project::ProjectPath;
@@ -139,6 +139,7 @@ impl AgentSessionFactory for StructuredSessionFactory {
         requester: Option<&str>,
         env: &[(String, String)],
         sandbox: Option<&SandboxPlan>,
+        structured_policy: Option<&StructuredProviderLaunchPolicy>,
     ) -> Result<Arc<dyn AgentSession>, AgentSessionError> {
         let adapter = profile.structured_adapter.ok_or_else(|| {
             AgentSessionError::Start(format!(
@@ -171,16 +172,36 @@ impl AgentSessionFactory for StructuredSessionFactory {
             StructuredAdapter::Claude => Arc::new(ClaudeSdkSession::new(
                 id, command, cwd, seed, plan, enforcer,
             )),
-            StructuredAdapter::Codex => Arc::new(CodexExecSession::new(
-                id,
-                command,
-                cwd,
-                seed,
-                vec![ctx.project_root.clone()],
-                env.to_vec(),
-                plan,
-                enforcer,
-            )),
+            StructuredAdapter::Codex => {
+                let policy = match structured_policy {
+                    Some(StructuredProviderLaunchPolicy::Codex {
+                        sandbox_mode,
+                        writable_roots,
+                        network_access,
+                    }) => (
+                        sandbox_mode.clone(),
+                        writable_roots.clone(),
+                        Some(*network_access),
+                    ),
+                    None => (
+                        "workspace-write".to_owned(),
+                        vec![ctx.project_root.clone()],
+                        None,
+                    ),
+                };
+                Arc::new(CodexExecSession::new_with_policy(
+                    id,
+                    command,
+                    cwd,
+                    seed,
+                    policy.0,
+                    policy.1,
+                    policy.2,
+                    env.to_vec(),
+                    plan,
+                    enforcer,
+                ))
+            }
             StructuredAdapter::OpenCode => Arc::new(OpenCodeSession::new(
                 id,
                 profile.command.clone(),