From dd1d88ff261b073d6219dbdc28db83e69bd656e1 Mon Sep 17 00:00:00 2001
From: David Wiesen <iceweasel@openai.com>
Date: Thu, 21 May 2026 09:51:06 -0700
Subject: [PATCH] Respect explicit Windows sandbox mode config

---
 codex-rs/core/src/windows_sandbox.rs       | 16 +++++----
 codex-rs/core/src/windows_sandbox_tests.rs | 41 ++++++++++++++++++++++
 2 files changed, 50 insertions(+), 7 deletions(-)

diff --git a/codex-rs/core/src/windows_sandbox.rs b/codex-rs/core/src/windows_sandbox.rs
index 2c87c885ad..fc5080e990 100644
--- a/codex-rs/core/src/windows_sandbox.rs
+++ b/codex-rs/core/src/windows_sandbox.rs
@@ -60,19 +60,21 @@ pub fn resolve_windows_sandbox_mode(
     cfg: &ConfigToml,
     profile: &ConfigProfile,
 ) -> Option<WindowsSandboxModeToml> {
+    if let Some(mode) = profile
+        .windows
+        .as_ref()
+        .and_then(|windows| windows.sandbox)
+        .or_else(|| cfg.windows.as_ref().and_then(|windows| windows.sandbox))
+    {
+        return Some(mode);
+    }
     if let Some(mode) = legacy_windows_sandbox_mode(profile.features.as_ref()) {
         return Some(mode);
     }
     if legacy_windows_sandbox_keys_present(profile.features.as_ref()) {
         return None;
     }
-
-    profile
-        .windows
-        .as_ref()
-        .and_then(|windows| windows.sandbox)
-        .or_else(|| cfg.windows.as_ref().and_then(|windows| windows.sandbox))
-        .or_else(|| legacy_windows_sandbox_mode(cfg.features.as_ref()))
+    legacy_windows_sandbox_mode(cfg.features.as_ref())
 }
 
 pub fn resolve_windows_sandbox_private_desktop(cfg: &ConfigToml, profile: &ConfigProfile) -> bool {
diff --git a/codex-rs/core/src/windows_sandbox_tests.rs b/codex-rs/core/src/windows_sandbox_tests.rs
index 27612c640a..df89bc4033 100644
--- a/codex-rs/core/src/windows_sandbox_tests.rs
+++ b/codex-rs/core/src/windows_sandbox_tests.rs
@@ -101,6 +101,47 @@ fn resolve_windows_sandbox_mode_prefers_profile_windows() {
     );
 }
 
+#[test]
+fn resolve_windows_sandbox_mode_explicit_profile_windows_beats_profile_legacy() {
+    let mut entries = BTreeMap::new();
+    entries.insert("elevated_windows_sandbox".to_string(), /*value*/ true);
+    let profile = ConfigProfile {
+        windows: Some(WindowsToml {
+            sandbox: Some(WindowsSandboxModeToml::Unelevated),
+            ..Default::default()
+        }),
+        features: Some(FeaturesToml::from(entries)),
+        ..Default::default()
+    };
+
+    assert_eq!(
+        resolve_windows_sandbox_mode(&ConfigToml::default(), &profile),
+        Some(WindowsSandboxModeToml::Unelevated)
+    );
+}
+
+#[test]
+fn resolve_windows_sandbox_mode_explicit_cfg_windows_beats_profile_legacy() {
+    let cfg = ConfigToml {
+        windows: Some(WindowsToml {
+            sandbox: Some(WindowsSandboxModeToml::Unelevated),
+            ..Default::default()
+        }),
+        ..Default::default()
+    };
+    let mut entries = BTreeMap::new();
+    entries.insert("elevated_windows_sandbox".to_string(), /*value*/ true);
+    let profile = ConfigProfile {
+        features: Some(FeaturesToml::from(entries)),
+        ..Default::default()
+    };
+
+    assert_eq!(
+        resolve_windows_sandbox_mode(&cfg, &profile),
+        Some(WindowsSandboxModeToml::Unelevated)
+    );
+}
+
 #[test]
 fn resolve_windows_sandbox_mode_falls_back_to_legacy_keys() {
     let mut entries = BTreeMap::new();