From 7430c5693221dcb09c5ddc33dfcebe2d45e72bc7 Mon Sep 17 00:00:00 2001
From: David Wiesen <iceweasel@openai.com>
Date: Thu, 28 May 2026 09:52:22 -0700
Subject: [PATCH] fix(windows-sandbox): skip setup refresh for full-access
 execs

---
 codex-rs/core/src/exec.rs       | 14 +++++++++++++-
 codex-rs/core/src/exec_tests.rs | 26 ++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/codex-rs/core/src/exec.rs b/codex-rs/core/src/exec.rs
index fd5cd7bcdc..05c5ab2bf8 100644
--- a/codex-rs/core/src/exec.rs
+++ b/codex-rs/core/src/exec.rs
@@ -482,7 +482,7 @@ async fn get_raw_output_result(
     >,
 ) -> Result<RawExecToolCallOutput> {
     #[cfg(target_os = "windows")]
-    if sandbox == SandboxType::WindowsRestrictedToken {
+    if should_route_through_windows_sandbox(sandbox, sandbox_policy) {
         return exec_windows_sandbox(params, sandbox_policy, windows_sandbox_filesystem_overrides)
             .await;
     }
@@ -490,6 +490,18 @@ async fn get_raw_output_result(
     exec(params, network_sandbox_policy, stdout_stream, after_spawn).await
 }
 
+#[cfg_attr(not(test), allow(dead_code))]
+fn should_route_through_windows_sandbox(
+    sandbox: SandboxType,
+    sandbox_policy: &SandboxPolicy,
+) -> bool {
+    sandbox == SandboxType::WindowsRestrictedToken
+        && !matches!(
+            sandbox_policy,
+            SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. }
+        )
+}
+
 #[cfg(target_os = "windows")]
 fn extract_create_process_as_user_error_code(err: &str) -> Option<String> {
     let marker = "CreateProcessAsUserW failed: ";
diff --git a/codex-rs/core/src/exec_tests.rs b/codex-rs/core/src/exec_tests.rs
index 9d335a81c7..05003029c5 100644
--- a/codex-rs/core/src/exec_tests.rs
+++ b/codex-rs/core/src/exec_tests.rs
@@ -394,6 +394,32 @@ fn windows_restricted_token_skips_external_sandbox_policies() {
     );
 }
 
+#[test]
+fn windows_exec_routing_skips_danger_full_access_policies() {
+    assert!(!should_route_through_windows_sandbox(
+        SandboxType::WindowsRestrictedToken,
+        &SandboxPolicy::DangerFullAccess,
+    ));
+}
+
+#[test]
+fn windows_exec_routing_skips_external_sandbox_policies() {
+    assert!(!should_route_through_windows_sandbox(
+        SandboxType::WindowsRestrictedToken,
+        &SandboxPolicy::ExternalSandbox {
+            network_access: codex_protocol::protocol::NetworkAccess::Restricted,
+        },
+    ));
+}
+
+#[test]
+fn windows_exec_routing_keeps_restricted_policies() {
+    assert!(should_route_through_windows_sandbox(
+        SandboxType::WindowsRestrictedToken,
+        &SandboxPolicy::new_workspace_write_policy(),
+    ));
+}
+
 #[test]
 fn windows_restricted_token_runs_for_legacy_restricted_policies() {
     let policy = SandboxPolicy::new_read_only_policy();