From 18b353f577afea082493328f9305bf5323c15f31 Mon Sep 17 00:00:00 2001
From: starr-openai <starr@openai.com>
Date: Wed, 13 May 2026 16:53:13 -0700
Subject: [PATCH] codex: fix remote env test fixtures

---
 codex-rs/core/tests/common/test_codex.rs | 23 ++++++++++++++++-------
 codex-rs/core/tests/suite/remote_env.rs  |  2 +-
 codex-rs/core/tests/suite/view_image.rs  |  4 +---
 codex-rs/exec-server/src/environment.rs  | 14 ++++++++++++++
 4 files changed, 32 insertions(+), 11 deletions(-)

diff --git a/codex-rs/core/tests/common/test_codex.rs b/codex-rs/core/tests/common/test_codex.rs
index e7db3f4044..64e7fdbd14 100644
--- a/codex-rs/core/tests/common/test_codex.rs
+++ b/codex-rs/core/tests/common/test_codex.rs
@@ -391,13 +391,22 @@ impl TestCodexBuilder {
             std::env::current_exe()?,
             codex_linux_sandbox_exe,
         )?;
-        let environment_manager = Arc::new(
-            codex_exec_server::EnvironmentManager::create_for_tests(
-                exec_server_url,
-                local_runtime_paths,
-            )
-            .await,
-        );
+        let environment_manager = Arc::new(match exec_server_url {
+            Some(exec_server_url) => {
+                codex_exec_server::EnvironmentManager::create_for_tests_with_local(
+                    Some(exec_server_url),
+                    local_runtime_paths,
+                )
+                .await
+            }
+            None => {
+                codex_exec_server::EnvironmentManager::create_for_tests(
+                    /*exec_server_url*/ None,
+                    local_runtime_paths,
+                )
+                .await
+            }
+        });
         let file_system = test_env.environment().get_filesystem();
         let mut workspace_setups = vec![];
         swap(&mut self.workspace_setups, &mut workspace_setups);
diff --git a/codex-rs/core/tests/suite/remote_env.rs b/codex-rs/core/tests/suite/remote_env.rs
index dc6d5cefc5..f09df773d6 100644
--- a/codex-rs/core/tests/suite/remote_env.rs
+++ b/codex-rs/core/tests/suite/remote_env.rs
@@ -77,7 +77,7 @@ async fn submit_turn_with_approval_and_environments(
             cwd: test.cwd.path().to_path_buf(),
             approval_policy: AskForApproval::OnRequest,
             approvals_reviewer: Some(ApprovalsReviewer::User),
-            sandbox_policy: SandboxPolicy::new_workspace_write_policy(),
+            sandbox_policy: SandboxPolicy::new_read_only_policy(),
             permission_profile: None,
             model: test.session_configured.model.clone(),
             effort: None,
diff --git a/codex-rs/core/tests/suite/view_image.rs b/codex-rs/core/tests/suite/view_image.rs
index 4ff2062b40..3b11c37d50 100644
--- a/codex-rs/core/tests/suite/view_image.rs
+++ b/codex-rs/core/tests/suite/view_image.rs
@@ -582,9 +582,7 @@ async fn view_image_routes_to_selected_remote_environment() -> anyhow::Result<()
             /*sandbox*/ None,
         )
         .await?;
-    let png = BASE64_STANDARD.decode(
-        "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/p9sAAAAASUVORK5CYII=",
-    )?;
+    let png = png_bytes(/*width*/ 1, /*height*/ 1, [0, 255, 0, 255])?;
     test.fs()
         .write_file(&image_path, png, /*sandbox*/ None)
         .await?;
diff --git a/codex-rs/exec-server/src/environment.rs b/codex-rs/exec-server/src/environment.rs
index 7e4a3fb056..1d7d6e75f5 100644
--- a/codex-rs/exec-server/src/environment.rs
+++ b/codex-rs/exec-server/src/environment.rs
@@ -135,6 +135,20 @@ impl EnvironmentManager {
         }
     }
 
+    /// Builds a test-only manager that keeps the provider default while also
+    /// allowing tests to select the local environment explicitly.
+    pub async fn create_for_tests_with_local(
+        exec_server_url: Option<String>,
+        local_runtime_paths: ExecServerRuntimePaths,
+    ) -> Self {
+        let mut snapshot = DefaultEnvironmentProvider::new(exec_server_url).snapshot_inner();
+        snapshot.include_local = true;
+        match Self::from_provider_snapshot(snapshot, local_runtime_paths) {
+            Ok(manager) => manager,
+            Err(err) => panic!("test provider with local should create valid environments: {err}"),
+        }
+    }
+
     /// Builds a manager from a provider-supplied startup snapshot.
     pub async fn from_provider<P>(
         provider: &P,