diff --git a/codex-rs/core/src/exec.rs b/codex-rs/core/src/exec.rs
index 0e831f1e91..3a0220e49f 100644
--- a/codex-rs/core/src/exec.rs
+++ b/codex-rs/core/src/exec.rs
@@ -95,7 +95,7 @@ pub async fn process_exec_tool_call(
         sandbox_cwd,
         codex_linux_sandbox_exe.as_ref(),
     )
-    .map_err(sandbox_launch_error_to_codex)?;
+    .map_err(CodexErr::from)?;
     execute_sandbox_launch(params, launch, sandbox_type, sandbox_policy, stdout_stream).await
 }
 
@@ -171,18 +171,6 @@ fn finalize_exec_result(
     }
 }
 
-pub(crate) fn sandbox_launch_error_to_codex(err: SandboxLaunchError) -> CodexErr {
-    match err {
-        SandboxLaunchError::MissingCommandLine => CodexErr::Io(io::Error::new(
-            io::ErrorKind::InvalidInput,
-            "command args are empty",
-        )),
-        SandboxLaunchError::MissingLinuxSandboxExecutable => {
-            CodexErr::LandlockSandboxExecutableNotProvided
-        }
-    }
-}
-
 async fn spawn_with_launch(
     params: ExecParams,
     launch: SandboxLaunch,
@@ -221,6 +209,25 @@ async fn spawn_with_launch(
     exec(updated_params, sandbox_policy, stdout_stream).await
 }
 
+pub(crate) mod errors {
+    use super::CodexErr;
+    use super::SandboxLaunchError;
+
+    impl From<SandboxLaunchError> for CodexErr {
+        fn from(err: SandboxLaunchError) -> Self {
+            match err {
+                SandboxLaunchError::MissingCommandLine => CodexErr::Io(std::io::Error::new(
+                    std::io::ErrorKind::InvalidInput,
+                    "command args are empty",
+                )),
+                SandboxLaunchError::MissingLinuxSandboxExecutable => {
+                    CodexErr::LandlockSandboxExecutableNotProvided
+                }
+            }
+        }
+    }
+}
+
 /// We don't have a fully deterministic way to tell if our command failed
 /// because of the sandbox - a command in the user's zshrc file might hit an
 /// error, but the command itself might fail or succeed for other reasons.
diff --git a/codex-rs/core/src/executor/runner.rs b/codex-rs/core/src/executor/runner.rs
index b28042b874..9bb5ce5311 100644
--- a/codex-rs/core/src/executor/runner.rs
+++ b/codex-rs/core/src/executor/runner.rs
@@ -16,7 +16,6 @@ use crate::exec::SandboxType;
 use crate::exec::StdoutStream;
 use crate::exec::StreamOutput;
 use crate::exec::execute_sandbox_launch;
-use crate::exec::sandbox_launch_error_to_codex;
 use crate::executor::errors::ExecError;
 use crate::executor::sandbox::RetrySandboxContext;
 use crate::executor::sandbox::SandboxDecision;
@@ -229,7 +228,7 @@ impl Executor {
         let sandbox_policy = plan.config().sandbox_policy.clone();
         let initial_launch = plan
             .initial_launch()
-            .map_err(|err| ExecError::Codex(sandbox_launch_error_to_codex(err)))?;
+            .map_err(|err| ExecError::Codex(err.into()))?;
         let first_attempt = execute_sandbox_launch(
             plan.request().params.clone(),
             initial_launch,
@@ -252,7 +251,7 @@ impl Executor {
                     {
                         let retry_launch = plan
                             .retry_launch()
-                            .map_err(|err| ExecError::Codex(sandbox_launch_error_to_codex(err)))?;
+                            .map_err(|err| ExecError::Codex(err.into()))?;
                         execute_sandbox_launch(
                             plan.request().params.clone(),
                             retry_launch,