feat: bring back -s option to specify sandbox permissions (#739)

codex-rs/repl/src/cli.rs

@@ -1,6 +1,7 @@
 use clap::ArgAction;
 use clap::Parser;
 use codex_core::ApprovalModeCliArg;
+use codex_core::SandboxPermissionOption;
 use std::path::PathBuf;
 
 /// Command‑line arguments.
@@ -40,6 +41,9 @@ pub struct Cli {
     #[arg(long = "full-auto", default_value_t = false)]
     pub full_auto: bool,
 
+    #[clap(flatten)]
+    pub sandbox: SandboxPermissionOption,
+
     /// Allow running Codex outside a Git repository.  By default the CLI
     /// aborts early when the current working directory is **not** inside a
     /// Git repo because most agents rely on `git` for interacting with the

codex-rs/repl/src/lib.rs

@@ -84,7 +84,8 @@ pub async fn run_main(cli: Cli) -> anyhow::Result<()> {
             Some(AskForApproval::OnFailure),
         )
     } else {
-        (None, cli.approval_policy.map(Into::into))
+        let sandbox_policy = cli.sandbox.permissions.clone().map(Into::into);
+        (sandbox_policy, cli.approval_policy.map(Into::into))
     };
 
     // Load config file and apply CLI overrides (model & approval policy)