From fa61db6c33eb72e9b48f6da7c5950d5732afb5b4 Mon Sep 17 00:00:00 2001
From: viyatb-oai <viyatb@openai.com>
Date: Mon, 13 Apr 2026 15:04:48 -0700
Subject: [PATCH] test: fix CI expectations after symlink hardening

Co-authored-by: Codex <noreply@openai.com>
---
 codex-rs/core/src/config/config_loader_tests.rs | 10 ++++++++--
 codex-rs/linux-sandbox/src/bwrap.rs             |  9 ++++-----
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/codex-rs/core/src/config/config_loader_tests.rs b/codex-rs/core/src/config/config_loader_tests.rs
index ef25119878..1dca39fa31 100644
--- a/codex-rs/core/src/config/config_loader_tests.rs
+++ b/codex-rs/core/src/config/config_loader_tests.rs
@@ -2083,7 +2083,13 @@ async fn symlinked_project_config_is_rejected() -> std::io::Result<()> {
     tokio::fs::write(project_root.join(".git"), "gitdir: here").await?;
     tokio::fs::write(&payload, "sandbox_mode = \"danger-full-access\"\n").await?;
     symlink(&payload, dot_codex.join(CONFIG_TOML_FILE)).expect("create config symlink");
-    make_config_for_test(&codex_home, &project_root, TrustLevel::Trusted, None).await?;
+    make_config_for_test(
+        &codex_home,
+        &project_root,
+        TrustLevel::Trusted,
+        /*project_root_markers*/ None,
+    )
+    .await?;
 
     let err = ConfigBuilder::default()
         .codex_home(codex_home)
@@ -2230,7 +2236,7 @@ async fn project_root_markers_supports_alternate_markers() -> std::io::Result<()
         &codex_home,
         &project_root,
         TrustLevel::Trusted,
-        Some(vec![".hg".to_string()]),
+        /*project_root_markers*/ Some(vec![".hg".to_string()]),
     )
     .await?;
 
diff --git a/codex-rs/linux-sandbox/src/bwrap.rs b/codex-rs/linux-sandbox/src/bwrap.rs
index 36059abb23..dafe72dd39 100644
--- a/codex-rs/linux-sandbox/src/bwrap.rs
+++ b/codex-rs/linux-sandbox/src/bwrap.rs
@@ -2226,7 +2226,7 @@ mod tests {
 
     #[cfg(unix)]
     #[test]
-    fn split_policy_masks_symlinked_project_config_file() {
+    fn split_policy_remounts_symlinked_project_config_target_read_only() {
         let temp_dir = TempDir::new().expect("temp dir");
         let writable_root = temp_dir.path().join("workspace");
         let dot_codex = writable_root.join(".codex");
@@ -2235,10 +2235,9 @@ mod tests {
         std::fs::create_dir_all(&dot_codex).expect("create .codex");
         std::fs::write(&payload, "sandbox_mode = \"danger-full-access\"").expect("write payload");
         std::os::unix::fs::symlink(&payload, &config).expect("create config symlink");
+        let payload_str = path_to_string(&payload);
         let writable_root =
             AbsolutePathBuf::from_absolute_path(&writable_root).expect("absolute writable root");
-        let config = AbsolutePathBuf::from_absolute_path(&config).expect("absolute config");
-        let config_str = path_to_string(config.as_path());
         let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
             path: FileSystemPath::Path {
                 path: writable_root,
@@ -2251,8 +2250,8 @@ mod tests {
         assert!(
             args.args
                 .windows(3)
-                .any(|window| window == ["--ro-bind", "/dev/null", config_str.as_str()]),
-            "expected symlinked config.toml to be masked: {:#?}",
+                .any(|window| window == ["--ro-bind", payload_str.as_str(), payload_str.as_str()]),
+            "expected symlinked config.toml target to be remounted read-only: {:#?}",
             args.args
         );
     }