fix(permissions): validate network access flow

crates/domain/src/ports.rs

@@ -146,6 +146,28 @@ pub struct StructuredSessionEnvironment {
     pub cwd: ProjectPath,
     /// Environment variables to pass to the structured session.
     pub env: Vec<(String, String)>,
+    /// Provider-specific launch policy to pass to the structured session.
+    pub structured_policy: Option<StructuredProviderLaunchPolicy>,
+}
+
+/// Provider-specific launch policy for structured/headless sessions.
+///
+/// This is intentionally separate from [`PermissionProjection`]: the projection is
+/// a generic CLI advisory plan (files/argv/env) while structured adapters may need
+/// a smaller, command-compatible contract. In particular, `codex exec` accepts
+/// `--sandbox` and `--add-dir`, but must never receive the interactive
+/// `--ask-for-approval` flag.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum StructuredProviderLaunchPolicy {
+    /// Policy subset supported by `codex exec`.
+    Codex {
+        /// Codex sandbox mode (`read-only`, `workspace-write`, ...).
+        sandbox_mode: String,
+        /// Workspace roots to pass as repeated `--add-dir` values.
+        writable_roots: Vec<String>,
+        /// Whether Codex workspace-write sandbox network access must be enabled.
+        network_access: bool,
+    },
 }
 
 /// Errors returned while preparing the IdeA-owned ticket assistant context.
@@ -1118,6 +1140,13 @@ pub trait AgentSessionFactory: Send + Sync {
     /// franchit le port en tant que **valeur domaine** ([`crate::sandbox::SandboxPlan`]) ;
     /// l'enforcer concret reste côté infra (injecté par instance dans la fabrique).
     ///
+    /// `structured_policy` est une projection optionnelle, provider-spécifique et
+    /// compatible avec la commande structurée. Elle ne remplace pas `sandbox` :
+    /// `sandbox` reste l'autorité OS, tandis que cette politique configure le CLI.
+    /// Elle est volontairement séparée de [`PermissionProjector`] pour éviter de
+    /// faire porter au projector le contrat exact de sous-commandes comme
+    /// `codex exec`.
+    ///
     /// # Errors
     /// [`AgentSessionError::Start`] si la CLI/SDK est indisponible ou le mode
     /// structuré ne peut s'initialiser.
@@ -1130,6 +1159,7 @@ pub trait AgentSessionFactory: Send + Sync {
         requester: Option<&str>,
         env: &[(String, String)],
         sandbox: Option<&crate::sandbox::SandboxPlan>,
+        structured_policy: Option<&StructuredProviderLaunchPolicy>,
     ) -> Result<Arc<dyn AgentSession>, AgentSessionError>;
 }