fix(ci) fix guardian ci (#13911)

## Summary
#13910 was merged with some unused imports, let's fix this

## Testing
- [x] Let's make sure CI is green

---------

Co-authored-by: Charles Cunningham <ccunningham@openai.com>
Co-authored-by: Codex <noreply@openai.com>

codex-rs/core/src/codex_tests_guardian.rs

@@ -17,6 +17,7 @@ use codex_protocol::models::FunctionCallOutputBody;
 use codex_protocol::models::NetworkPermissions;
 use codex_protocol::models::PermissionProfile;
 use codex_utils_absolute_path::AbsolutePathBuf;
+use core_test_support::codex_linux_sandbox_exe_or_skip;
 use pretty_assertions::assert_eq;
 use serde::Deserialize;
 use std::collections::HashMap;
@@ -27,6 +28,7 @@ use tempfile::tempdir;
 #[tokio::test]
 async fn guardian_allows_shell_additional_permissions_requests_past_policy_validation() {
     let (mut session, mut turn_context_raw) = make_session_and_context().await;
+    turn_context_raw.codex_linux_sandbox_exe = codex_linux_sandbox_exe_or_skip!();
     turn_context_raw
         .approval_policy
         .set(AskForApproval::OnRequest)

codex-rs/core/src/guardian_tests.rs

@@ -6,24 +6,11 @@ use crate::config_loader::FeatureRequirementsToml;
 use crate::config_loader::NetworkConstraints;
 use crate::config_loader::RequirementSource;
 use crate::config_loader::Sourced;
-use crate::test_support;
 use codex_network_proxy::NetworkProxyConfig;
 use codex_protocol::models::ContentItem;
-use core_test_support::context_snapshot;
-use core_test_support::context_snapshot::ContextSnapshotOptions;
-use core_test_support::responses::ev_assistant_message;
-use core_test_support::responses::ev_completed;
-use core_test_support::responses::ev_response_created;
-use core_test_support::responses::mount_sse_once;
-use core_test_support::responses::sse;
-use core_test_support::responses::start_mock_server;
-use core_test_support::skip_if_no_network;
-use insta::assert_snapshot;
 use pretty_assertions::assert_eq;
 use std::collections::BTreeMap;
 use std::path::PathBuf;
-use std::sync::Arc;
-use tokio_util::sync::CancellationToken;
 
 #[test]
 fn build_guardian_transcript_keeps_original_numbering() {

codex-rs/core/tests/common/lib.rs

@@ -475,6 +475,42 @@ macro_rules! skip_if_no_network {
     }};
 }
 
+#[macro_export]
+macro_rules! codex_linux_sandbox_exe_or_skip {
+    () => {{
+        #[cfg(target_os = "linux")]
+        {
+            match codex_utils_cargo_bin::cargo_bin("codex-linux-sandbox") {
+                Ok(path) => Some(path),
+                Err(err) => {
+                    eprintln!("codex-linux-sandbox binary not available, skipping test: {err}");
+                    return;
+                }
+            }
+        }
+        #[cfg(not(target_os = "linux"))]
+        {
+            None
+        }
+    }};
+    ($return_value:expr $(,)?) => {{
+        #[cfg(target_os = "linux")]
+        {
+            match codex_utils_cargo_bin::cargo_bin("codex-linux-sandbox") {
+                Ok(path) => Some(path),
+                Err(err) => {
+                    eprintln!("codex-linux-sandbox binary not available, skipping test: {err}");
+                    return $return_value;
+                }
+            }
+        }
+        #[cfg(not(target_os = "linux"))]
+        {
+            None
+        }
+    }};
+}
+
 #[macro_export]
 macro_rules! skip_if_windows {
     ($return_value:expr $(,)?) => {{

codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__experimental_popup_includes_guardian_approval_linux.snap

@@ -0,0 +1,19 @@
+---
+source: tui/src/chatwidget/tests.rs
+expression: popup
+---
+  Experimental features
+  Toggle experimental features. Changes are saved to config.toml.
+
+› [ ] JavaScript REPL              Enable a persistent Node-backed JavaScript REPL for interactive website debugging
+                                   and other inline JavaScript execution capabilities. Requires Node >= v22.22.0
+                                   installed.
+  [ ] Bubblewrap sandbox           Try the new linux sandbox based on bubblewrap.
+  [ ] Multi-agents                 Ask Codex to spawn multiple agents to parallelize the work and win in efficiency.
+  [ ] Apps                         Use a connected ChatGPT App using "$". Install Apps via /apps command. Restart
+                                   Codex after enabling.
+  [ ] Guardian approvals           Let a guardian subagent review `on-request` approval prompts instead of showing
+                                   them to you, including sandbox escapes and blocked network access.
+  [ ] Prevent sleep while running  Keep your computer awake while Codex is running a thread.
+
+  Press space to select or enter to save for next conversation

codex-rs/tui/src/chatwidget/tests.rs

@@ -6949,6 +6949,9 @@ async fn experimental_popup_includes_guardian_approval() {
     chat.open_experimental_popup();
 
     let popup = render_bottom_popup(&chat, 120);
+    #[cfg(target_os = "linux")]
+    assert_snapshot!("experimental_popup_includes_guardian_approval_linux", popup);
+    #[cfg(not(target_os = "linux"))]
     assert_snapshot!("experimental_popup_includes_guardian_approval", popup);
 }