Sandbox & Approvals

Every process Codex spawns inherits the sandbox: git, npm, test runners, package managers. workspace-write mode still blocks git commit because .git/ is a protected path.

These protected paths remain read-only even when the rest of the workspace is writable. Use the rules key to create specific command exceptions rather than escalating to full access.

--full-auto = workspace-write sandbox + on-request approvals. --yolo removes ALL boundaries. Using --yolo on a regular developer machine is a serious security mistake.

Add specific directories via sandbox_workspace_write.writable_roots. Targeted extension keeps the sandbox intact for everything else — almost always better than escalating to danger-full-access.

Declaratively allow, prompt, or forbid specific command prefixes. Block git push while allowing all other git commands — without changing sandbox_mode at all.

If a project is marked untrusted, its entire .codex/ layer is silently skipped. No project config, no project AGENTS.md. The untrusted flag is all-or-nothing.

Define [profiles.deep-review] with Opus + high reasoning + never-approval. Switch with codex --profile deep-review. Profiles are the correct mechanism for per-task resource allocation.

Set exporter = "otlp-http" to send Codex traces to your observability stack. log_user_prompt = false (default) redacts prompts from export.

Smart Approvals delegates recurring approval decisions to a guardian subagent for automated evaluation. This reduces approval fatigue without fully disabling approvals — safer than approval_policy = "never".

The codex sandbox subcommand runs any shell command under the exact same policies Codex uses during a session. Test before building automation around it.

Admins can ship requirements.toml disallowing dangerous configs. These are hard floors — no user config, profile, or CLI flag can bypass them. The correct architecture for enterprise compliance.

A recent fix: subagents now correctly inherit project-profile sandbox layering and persisted host approvals. Before this fix, subagents could silently run with more permissive sandbox rules than the parent.

Claude Code's devcontainer reference ships a firewall whitelisting only necessary domains. Inside it, --dangerously-skip-permissions is safe. The network firewall provides the security boundary the flag removes.

Codex adds a co-author trailer to commits by default. Set commit_coauthor_trailer = "" to disable. Use for internal repos where AI co-authorship shouldn't appear in the git log.

By default, Codex clears terminal scrollback on exit (like vim). Set this to keep all session output in your scroll history — critical for post-session debugging without checking log files.

Triggers an external program when Codex emits supported events. Use for desktop notifications, Slack webhooks, CI pipeline triggers — any side-channel alerting beyond what the built-in TUI covers.