From 2c18923a09a96f7312c8896be7836deebdf9129b Mon Sep 17 00:00:00 2001
From: Ahmed Ibrahim <219906144+aibrahim-oai@users.noreply.github.com>
Date: Fri, 20 Mar 2026 17:35:49 +0000
Subject: [PATCH] Fix CLI sandbox debug enum mapping

Co-authored-by: Codex <noreply@openai.com>
---
 codex-rs/cli/src/debug_sandbox.rs | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/codex-rs/cli/src/debug_sandbox.rs b/codex-rs/cli/src/debug_sandbox.rs
index 337dcb9b90..2952831e4a 100644
--- a/codex-rs/cli/src/debug_sandbox.rs
+++ b/codex-rs/cli/src/debug_sandbox.rs
@@ -19,6 +19,9 @@ use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_sandbox::CODEX_SANDBOX_ENV_VAR;
 use codex_sandbox::CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR;
 use codex_sandbox::SandboxType;
+use codex_sandbox::SandboxType::LinuxSeccomp;
+use codex_sandbox::SandboxType::MacosSeatbelt;
+use codex_sandbox::SandboxType::WindowsRestrictedToken;
 use codex_sandbox::WindowsSandboxLevelExt;
 use codex_sandbox::create_linux_sandbox_command_args_for_policies;
 #[cfg(target_os = "macos")]
@@ -52,7 +55,7 @@ pub async fn run_command_under_seatbelt(
         command,
         config_overrides,
         codex_linux_sandbox_exe,
-        SandboxType::Seatbelt,
+        MacosSeatbelt,
         log_denials,
     )
     .await
@@ -80,7 +83,7 @@ pub async fn run_command_under_landlock(
         command,
         config_overrides,
         codex_linux_sandbox_exe,
-        SandboxType::Landlock,
+        LinuxSeccomp,
         /*log_denials*/ false,
     )
     .await
@@ -100,7 +103,7 @@ pub async fn run_command_under_windows(
         command,
         config_overrides,
         codex_linux_sandbox_exe,
-        SandboxType::Windows,
+        WindowsRestrictedToken,
         /*log_denials*/ false,
     )
     .await
@@ -137,7 +140,7 @@ async fn run_command_under_sandbox(
     );
 
     // Special-case Windows sandbox: execute and exit the process to emulate inherited stdio.
-    if let SandboxType::Windows = sandbox_type {
+    if let WindowsRestrictedToken = sandbox_type {
         #[cfg(target_os = "windows")]
         {
             use codex_windows_sandbox::run_windows_sandbox_capture;
@@ -243,7 +246,7 @@ async fn run_command_under_sandbox(
 
     let mut child = match sandbox_type {
         #[cfg(target_os = "macos")]
-        SandboxType::Seatbelt => {
+        MacosSeatbelt => {
             let args = create_seatbelt_command_args_for_policies_with_extensions(
                 command,
                 &config.permissions.file_system_sandbox_policy,
@@ -270,7 +273,7 @@ async fn run_command_under_sandbox(
             )
             .await?
         }
-        SandboxType::Landlock => {
+        LinuxSeccomp => {
             #[expect(clippy::expect_used)]
             let codex_linux_sandbox_exe = config
                 .codex_linux_sandbox_exe
@@ -302,7 +305,7 @@ async fn run_command_under_sandbox(
             )
             .await?
         }
-        SandboxType::Windows => {
+        WindowsRestrictedToken => {
             unreachable!("Windows sandbox should have been handled above");
         }
     };