Let Codex write outside the workspace in workspace-write mode: writable_roots and the /tmp rules

Running Codex in workspace-write mode, you may hit build or install failures caused by writes outside the working directory, to places like ~/.cache or ~/.pyenv. The sandbox is restricting where commands can write.

In short: add extra writable locations under [sandbox_workspace_write] with writable_roots. In the other direction, exclude_slash_tmp and exclude_tmpdir_env_var remove the /tmp and $TMPDIR locations that are writable by default.

The default scope of workspace-write

sandbox_mode takes three values.

Value	What it allows
read-only	inspect files only; edits and commands need approval
workspace-write	edit files within the workspace and run routine local commands inside that boundary; the default for local work
danger-full-access	no sandbox; filesystem and network boundaries are removed

Under workspace-write, the writable locations are the working directory plus, by default, /tmp and $TMPDIR. The sample configuration shows the defaults:

[sandbox_workspace_write]
# Additional writable roots beyond the workspace (cwd). Default: []
writable_roots = []
# Allow outbound network access inside the sandbox. Default: false
network_access = false
# Exclude $TMPDIR from writable roots. Default: false
exclude_tmpdir_env_var = false
# Exclude /tmp from writable roots. Default: false
exclude_slash_tmp = false

Adding paths with writable_roots

The official example adds the pyenv shims directory.

[sandbox_workspace_write]
writable_roots = ["/Users/YOU/.pyenv/shims"]

Typical candidates are tool caches and install locations.

Purpose	Example
Python environments and shims	~/.pyenv/shims
package manager caches	~/.npm, ~/.cache/pip, ~/.cargo/registry
work spanning repositories	a sibling repository's path

Write absolute paths. Whether ~ is expanded could not be confirmed from the official documentation, so use full paths as in the example.

Excluding /tmp and $TMPDIR

To block writes to the temp directories too, set the exclusion flags.

[sandbox_workspace_write]
exclude_slash_tmp = true
exclude_tmpdir_env_var = true

Most build tools and test runners create temporary files under /tmp, so excluding it means more approval prompts. Unless you have a concrete reason, such as a shared machine where other users' files live in /tmp, the defaults are fine.

Why .git and .codex are not writable

The docs note that in workspace-write mode some environments keep .git/ and .codex/ read-only even when the rest of the workspace is writable. This prevents Codex from rewriting git history or its own configuration. If you want Codex to create commits and the write is refused, run that step with approval or make the commit yourself.

Network access is a separate switch, network_access. The full picture of approvals and sandboxing is in the hub article Codex approval modes and sandbox settings, and the configuration layers in Configuring Codex with config.toml.

Summary

• workspace-write writes to the working directory plus /tmp and $TMPDIR by default
• Add outside paths as absolute paths in [sandbox_workspace_write] writable_roots; never the whole home directory
• exclude_slash_tmp / exclude_tmpdir_env_var (default false) remove the temp locations
• .git/ and .codex/ may stay read-only depending on the environment
• Network access is controlled separately by network_access