From e411b9357a3a787488b4ab553902ec78138f7a12 Mon Sep 17 00:00:00 2001
From: Michael Bolin <mbolin@openai.com>
Date: Thu, 30 Apr 2026 05:01:45 -0700
Subject: [PATCH] analytics tests: derive sandbox fixtures from profiles

---
 .../analytics/src/analytics_client_tests.rs     | 12 +++++++++---
 codex-rs/analytics/src/client_tests.rs          | 17 +++++++++++++----
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/codex-rs/analytics/src/analytics_client_tests.rs b/codex-rs/analytics/src/analytics_client_tests.rs
index 055fd98c19..7f2958e6d5 100644
--- a/codex-rs/analytics/src/analytics_client_tests.rs
+++ b/codex-rs/analytics/src/analytics_client_tests.rs
@@ -66,7 +66,6 @@ use codex_app_server_protocol::InitializeParams;
 use codex_app_server_protocol::JSONRPCErrorError;
 use codex_app_server_protocol::NonSteerableTurnKind;
 use codex_app_server_protocol::RequestId;
-use codex_app_server_protocol::SandboxPolicy as AppServerSandboxPolicy;
 use codex_app_server_protocol::ServerNotification;
 use codex_app_server_protocol::SessionSource as AppServerSessionSource;
 use codex_app_server_protocol::Thread;
@@ -106,6 +105,7 @@ use codex_utils_absolute_path::test_support::test_path_buf;
 use pretty_assertions::assert_eq;
 use serde_json::json;
 use std::collections::HashSet;
+use std::path::Path;
 use std::path::PathBuf;
 use std::sync::Arc;
 use std::sync::Mutex;
@@ -155,7 +155,10 @@ fn sample_thread_start_response(
         instruction_sources: Vec::new(),
         approval_policy: AppServerAskForApproval::OnFailure,
         approvals_reviewer: AppServerApprovalsReviewer::User,
-        sandbox: AppServerSandboxPolicy::DangerFullAccess,
+        sandbox: CorePermissionProfile::Disabled
+            .to_legacy_sandbox_policy(Path::new("/"))
+            .expect("disabled profile should project to legacy sandbox")
+            .into(),
         permission_profile: None,
         active_permission_profile: None,
         reasoning_effort: None,
@@ -209,7 +212,10 @@ fn sample_thread_resume_response_with_source(
         instruction_sources: Vec::new(),
         approval_policy: AppServerAskForApproval::OnFailure,
         approvals_reviewer: AppServerApprovalsReviewer::User,
-        sandbox: AppServerSandboxPolicy::DangerFullAccess,
+        sandbox: CorePermissionProfile::Disabled
+            .to_legacy_sandbox_policy(Path::new("/"))
+            .expect("disabled profile should project to legacy sandbox")
+            .into(),
         permission_profile: None,
         active_permission_profile: None,
         reasoning_effort: None,
diff --git a/codex-rs/analytics/src/client_tests.rs b/codex-rs/analytics/src/client_tests.rs
index 4b6fb54e95..832faedef1 100644
--- a/codex-rs/analytics/src/client_tests.rs
+++ b/codex-rs/analytics/src/client_tests.rs
@@ -7,7 +7,6 @@ use codex_app_server_protocol::ClientRequest;
 use codex_app_server_protocol::ClientResponsePayload;
 use codex_app_server_protocol::PermissionProfile as AppServerPermissionProfile;
 use codex_app_server_protocol::RequestId;
-use codex_app_server_protocol::SandboxPolicy as AppServerSandboxPolicy;
 use codex_app_server_protocol::SessionSource as AppServerSessionSource;
 use codex_app_server_protocol::Thread;
 use codex_app_server_protocol::ThreadArchiveParams;
@@ -26,6 +25,7 @@ use codex_protocol::models::PermissionProfile as CorePermissionProfile;
 use codex_utils_absolute_path::test_support::PathBufExt;
 use codex_utils_absolute_path::test_support::test_path_buf;
 use std::collections::HashSet;
+use std::path::Path;
 use std::sync::Arc;
 use std::sync::Mutex;
 use tokio::sync::mpsc;
@@ -109,7 +109,10 @@ fn sample_thread_start_response() -> ClientResponsePayload {
         instruction_sources: Vec::new(),
         approval_policy: AppServerAskForApproval::OnFailure,
         approvals_reviewer: AppServerApprovalsReviewer::User,
-        sandbox: AppServerSandboxPolicy::DangerFullAccess,
+        sandbox: CorePermissionProfile::Disabled
+            .to_legacy_sandbox_policy(Path::new("/"))
+            .expect("disabled profile should project to legacy sandbox")
+            .into(),
         permission_profile: Some(sample_permission_profile()),
         active_permission_profile: None,
         reasoning_effort: None,
@@ -126,7 +129,10 @@ fn sample_thread_resume_response() -> ClientResponsePayload {
         instruction_sources: Vec::new(),
         approval_policy: AppServerAskForApproval::OnFailure,
         approvals_reviewer: AppServerApprovalsReviewer::User,
-        sandbox: AppServerSandboxPolicy::DangerFullAccess,
+        sandbox: CorePermissionProfile::Disabled
+            .to_legacy_sandbox_policy(Path::new("/"))
+            .expect("disabled profile should project to legacy sandbox")
+            .into(),
         permission_profile: Some(sample_permission_profile()),
         active_permission_profile: None,
         reasoning_effort: None,
@@ -143,7 +149,10 @@ fn sample_thread_fork_response() -> ClientResponsePayload {
         instruction_sources: Vec::new(),
         approval_policy: AppServerAskForApproval::OnFailure,
         approvals_reviewer: AppServerApprovalsReviewer::User,
-        sandbox: AppServerSandboxPolicy::DangerFullAccess,
+        sandbox: CorePermissionProfile::Disabled
+            .to_legacy_sandbox_policy(Path::new("/"))
+            .expect("disabled profile should project to legacy sandbox")
+            .into(),
         permission_profile: Some(sample_permission_profile()),
         active_permission_profile: None,
         reasoning_effort: None,