From d83bb540ec64bf6b009bca0283b0be91ea33f26a Mon Sep 17 00:00:00 2001
From: jif <jif@openai.com>
Date: Wed, 7 Oct 2026 12:37:55 +0000
Subject: [PATCH] Move Windows sandbox tests into a dedicated integration
 binary (#51678)

## Why

Elevated Windows sandbox tests share machine-wide accounts. Running them in the sharded core suite can consume test deadlines while shards wait for the account lock.

## What changed

Move the Windows sandbox tests into the Windows-only `windows_sandbox` integration-test binary. Update the nextest account-sharing group to select the entire binary instead of individual test names, so tests queue before their timeouts start. Keep the existing guard for coordination with other test binaries.

GitOrigin-RevId: 613925c9398b5acc8440fa34c658680f31f65c8b
---
 codex-rs/.config/nextest.toml                      | 8 +-------
 codex-rs/core/tests/suite/mod.rs                   | 2 --
 codex-rs/core/tests/{suite => }/windows_sandbox.rs | 9 +++++++++
 3 files changed, 10 insertions(+), 9 deletions(-)
 rename codex-rs/core/tests/{suite => }/windows_sandbox.rs (99%)

diff --git a/codex-rs/.config/nextest.toml b/codex-rs/.config/nextest.toml
index 17decdc0b8..f370a0aa36 100644
--- a/codex-rs/.config/nextest.toml
+++ b/codex-rs/.config/nextest.toml
@@ -90,13 +90,7 @@ test-group = 'core_apply_patch_cli_integration'
 # starting their timeout; their file lock still coordinates other test processes.
 platform = 'cfg(windows)'
 filter = '''
-    (package(codex-core) & (
-        test(windows_sandbox_cli_preserves_managed_deny_reads_across_launches) |
-        test(windows_elevated_does_not_create_missing_workspace_metadata) |
-        test(windows_elevated_enforces_deny_read_and_protects_setup_marker) |
-        test(windows_elevated_unified_exec_enforces_large_recursive_deny_reads) |
-        test(windows_elevated_approved_git_pull_preserves_deny_read)
-    )) |
+    (package(codex-core) & binary(windows_sandbox)) |
     (package(codex-exec-server) & test(file_system_elevated_relative_read_denial_uses_policy_cwd)) |
     (package(codex-windows-sandbox) & test(elevated_non_tty_cmd_forwards_env_output_and_exit))
 '''
diff --git a/codex-rs/core/tests/suite/mod.rs b/codex-rs/core/tests/suite/mod.rs
index 8880c318e2..159e505be7 100644
--- a/codex-rs/core/tests/suite/mod.rs
+++ b/codex-rs/core/tests/suite/mod.rs
@@ -251,8 +251,6 @@ mod web_search;
 mod web_search_system_proxy;
 mod websocket_fallback;
 mod window_headers;
-#[cfg(target_os = "windows")]
-mod windows_sandbox;
 mod workspace_roots;
 mod worktree_trust;
 
diff --git a/codex-rs/core/tests/suite/windows_sandbox.rs b/codex-rs/core/tests/windows_sandbox.rs
similarity index 99%
rename from codex-rs/core/tests/suite/windows_sandbox.rs
rename to codex-rs/core/tests/windows_sandbox.rs
index 006913e4d4..cf7f6a8799 100644
--- a/codex-rs/core/tests/suite/windows_sandbox.rs
+++ b/codex-rs/core/tests/windows_sandbox.rs
@@ -1,3 +1,12 @@
+//! Exercises the Windows sandbox in a dedicated integration-test binary.
+//!
+//! Elevated cases share machine-wide accounts, so keep them out of the sharded
+//! core suite: otherwise several shards spend their test deadlines waiting for
+//! the account lock. The guard still coordinates with other test binaries.
+
+#![cfg(target_os = "windows")]
+#![allow(clippy::expect_used)]
+
 use anyhow::Context;
 use codex_config::types::ApprovalsReviewer;
 use codex_core::TurnInputRequest;