From 67691a8b3a12af977323a1300bee2d4f4379f7ae Mon Sep 17 00:00:00 2001
From: starr-openai <starr@openai.com>
Date: Thu, 14 May 2026 18:29:27 -0700
Subject: [PATCH] Fix Windows sandbox helper discovery in Cargo tests

---
 .github/workflows/rust-ci-full.yml           | 10 +++++++++
 codex-rs/core/tests/suite/windows_sandbox.rs | 23 +++++++++++++++++++-
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/rust-ci-full.yml b/.github/workflows/rust-ci-full.yml
index de37faa4ca..0c07448a70 100644
--- a/.github/workflows/rust-ci-full.yml
+++ b/.github/workflows/rust-ci-full.yml
@@ -680,6 +680,16 @@ jobs:
           echo "CODEX_TEST_REMOTE_ENV=${CODEX_TEST_REMOTE_ENV}" >> "$GITHUB_ENV"
           echo "CODEX_TEST_REMOTE_EXEC_SERVER_URL=${CODEX_TEST_REMOTE_EXEC_SERVER_URL}" >> "$GITHUB_ENV"
 
+      - name: Build Windows sandbox test helpers
+        if: runner.os == 'Windows'
+        run: |
+          cargo build `
+            --target ${{ matrix.target }} `
+            --profile ci-test `
+            -p codex-windows-sandbox `
+            --bin codex-windows-sandbox-setup `
+            --bin codex-command-runner
+
       - name: tests
         id: test
         run: cargo nextest run --no-fail-fast --target ${{ matrix.target }} --cargo-profile ci-test --timings
diff --git a/codex-rs/core/tests/suite/windows_sandbox.rs b/codex-rs/core/tests/suite/windows_sandbox.rs
index d0919b3dee..5f3c707d5f 100644
--- a/codex-rs/core/tests/suite/windows_sandbox.rs
+++ b/codex-rs/core/tests/suite/windows_sandbox.rs
@@ -54,13 +54,34 @@ fn stage_windows_sandbox_helpers() -> anyhow::Result<()> {
     let resources_dir = test_exe_dir.join("codex-resources");
     std::fs::create_dir_all(&resources_dir)?;
     for helper_name in ["codex-windows-sandbox-setup", "codex-command-runner"] {
-        let helper = codex_utils_cargo_bin::cargo_bin(helper_name)?;
+        let helper = windows_sandbox_helper_path(test_exe_dir, helper_name)?;
         let file_name = Path::new(helper_name).with_extension("exe");
         std::fs::copy(helper, resources_dir.join(file_name))?;
     }
     Ok(())
 }
 
+fn windows_sandbox_helper_path(
+    test_exe_dir: &Path,
+    helper_name: &str,
+) -> anyhow::Result<std::path::PathBuf> {
+    let cargo_bin_error = match codex_utils_cargo_bin::cargo_bin(helper_name) {
+        Ok(helper) => return Ok(helper),
+        Err(error) => error,
+    };
+
+    let helper = test_exe_dir
+        .parent()
+        .context("Windows test executable directory should have a parent directory")?
+        .join(Path::new(helper_name).with_extension("exe"));
+    anyhow::ensure!(
+        helper.exists(),
+        "failed to resolve Windows sandbox helper {helper_name:?} via cargo_bin ({cargo_bin_error}); fallback path does not exist at {}",
+        helper.display(),
+    );
+    Ok(helper)
+}
+
 #[tokio::test]
 #[serial(codex_home)]
 async fn windows_restricted_token_rejects_exact_and_glob_deny_read_policy() -> anyhow::Result<()> {