Respect explicit Windows sandbox mode config

codex-rs/core/src/windows_sandbox.rs

@@ -60,19 +60,21 @@ pub fn resolve_windows_sandbox_mode(
     cfg: &ConfigToml,
     profile: &ConfigProfile,
 ) -> Option<WindowsSandboxModeToml> {
+    if let Some(mode) = profile
+        .windows
+        .as_ref()
+        .and_then(|windows| windows.sandbox)
+        .or_else(|| cfg.windows.as_ref().and_then(|windows| windows.sandbox))
+    {
+        return Some(mode);
+    }
     if let Some(mode) = legacy_windows_sandbox_mode(profile.features.as_ref()) {
         return Some(mode);
     }
     if legacy_windows_sandbox_keys_present(profile.features.as_ref()) {
         return None;
     }
-
-    profile
-        .windows
-        .as_ref()
-        .and_then(|windows| windows.sandbox)
-        .or_else(|| cfg.windows.as_ref().and_then(|windows| windows.sandbox))
-        .or_else(|| legacy_windows_sandbox_mode(cfg.features.as_ref()))
+    legacy_windows_sandbox_mode(cfg.features.as_ref())
 }
 
 pub fn resolve_windows_sandbox_private_desktop(cfg: &ConfigToml, profile: &ConfigProfile) -> bool {

codex-rs/core/src/windows_sandbox_tests.rs

@@ -101,6 +101,47 @@ fn resolve_windows_sandbox_mode_prefers_profile_windows() {
     );
 }
 
+#[test]
+fn resolve_windows_sandbox_mode_explicit_profile_windows_beats_profile_legacy() {
+    let mut entries = BTreeMap::new();
+    entries.insert("elevated_windows_sandbox".to_string(), /*value*/ true);
+    let profile = ConfigProfile {
+        windows: Some(WindowsToml {
+            sandbox: Some(WindowsSandboxModeToml::Unelevated),
+            ..Default::default()
+        }),
+        features: Some(FeaturesToml::from(entries)),
+        ..Default::default()
+    };
+
+    assert_eq!(
+        resolve_windows_sandbox_mode(&ConfigToml::default(), &profile),
+        Some(WindowsSandboxModeToml::Unelevated)
+    );
+}
+
+#[test]
+fn resolve_windows_sandbox_mode_explicit_cfg_windows_beats_profile_legacy() {
+    let cfg = ConfigToml {
+        windows: Some(WindowsToml {
+            sandbox: Some(WindowsSandboxModeToml::Unelevated),
+            ..Default::default()
+        }),
+        ..Default::default()
+    };
+    let mut entries = BTreeMap::new();
+    entries.insert("elevated_windows_sandbox".to_string(), /*value*/ true);
+    let profile = ConfigProfile {
+        features: Some(FeaturesToml::from(entries)),
+        ..Default::default()
+    };
+
+    assert_eq!(
+        resolve_windows_sandbox_mode(&cfg, &profile),
+        Some(WindowsSandboxModeToml::Unelevated)
+    );
+}
+
 #[test]
 fn resolve_windows_sandbox_mode_falls_back_to_legacy_keys() {
     let mut entries = BTreeMap::new();