From 5d82aeefcc929ed35e855f60e92bb8841c78a5fc Mon Sep 17 00:00:00 2001
From: Michael Bolin <mbolin@openai.com>
Date: Thu, 30 Apr 2026 05:32:17 -0700
Subject: [PATCH] test support: derive turn sandbox from permission profiles

---
 codex-rs/Cargo.lock                      |  1 +
 codex-rs/core/tests/common/Cargo.toml    |  1 +
 codex-rs/core/tests/common/test_codex.rs | 11 ++++++++---
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/codex-rs/Cargo.lock b/codex-rs/Cargo.lock
index d8744c4373..917608226d 100644
--- a/codex-rs/Cargo.lock
+++ b/codex-rs/Cargo.lock
@@ -4161,6 +4161,7 @@ dependencies = [
  "codex-model-provider-info",
  "codex-models-manager",
  "codex-protocol",
+ "codex-sandboxing",
  "codex-utils-absolute-path",
  "codex-utils-cargo-bin",
  "ctor 0.6.3",
diff --git a/codex-rs/core/tests/common/Cargo.toml b/codex-rs/core/tests/common/Cargo.toml
index f710aa36cc..158210f6a6 100644
--- a/codex-rs/core/tests/common/Cargo.toml
+++ b/codex-rs/core/tests/common/Cargo.toml
@@ -23,6 +23,7 @@ codex-login = { workspace = true }
 codex-model-provider-info = { workspace = true }
 codex-models-manager = { workspace = true }
 codex-protocol = { workspace = true }
+codex-sandboxing = { workspace = true }
 codex-utils-absolute-path = { workspace = true }
 codex-utils-cargo-bin = { workspace = true }
 ctor = { workspace = true }
diff --git a/codex-rs/core/tests/common/test_codex.rs b/codex-rs/core/tests/common/test_codex.rs
index 2eccaeeeb9..d377a97ef9 100644
--- a/codex-rs/core/tests/common/test_codex.rs
+++ b/codex-rs/core/tests/common/test_codex.rs
@@ -39,6 +39,7 @@ use codex_protocol::protocol::SessionConfiguredEvent;
 use codex_protocol::protocol::SessionSource;
 use codex_protocol::protocol::TurnEnvironmentSelection;
 use codex_protocol::user_input::UserInput;
+use codex_sandboxing::compatibility_sandbox_policy_for_permission_profile;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use futures::future::BoxFuture;
 use serde_json::Value;
@@ -209,9 +210,13 @@ pub fn turn_permission_fields(
     permission_profile: PermissionProfile,
     cwd: &Path,
 ) -> (SandboxPolicy, Option<PermissionProfile>) {
-    let sandbox_policy = permission_profile
-        .to_legacy_sandbox_policy(cwd)
-        .unwrap_or_else(|_| SandboxPolicy::new_read_only_policy());
+    let file_system_sandbox_policy = permission_profile.file_system_sandbox_policy();
+    let sandbox_policy = compatibility_sandbox_policy_for_permission_profile(
+        &permission_profile,
+        &file_system_sandbox_policy,
+        permission_profile.network_sandbox_policy(),
+        cwd,
+    );
     (sandbox_policy, Some(permission_profile))
 }