#sandbox
7 articles
-
Codex CLI v0.164 adds /presets and inline /permissions arguments for permission profiles
v0.164.0 stores reusable prompts in ten /presets slots and lets /permissions pick a permission profile as an argument. Plus credential masking and hardened sandbox checks.
-
Codex CLI v0.163 turns Daybreak back on by default and makes /config searchable
v0.163.0 enables Daybreak by default for eligible accounts, adds search across /config, lets you steer a response mid-turn, and checks proxy permission before a DNS lookup.
-
What does Codex --full-auto actually do? Approvals and sandbox explained
--full-auto is shorthand for on-request approvals plus a workspace-write sandbox, and it is now deprecated. What runs unattended, what stays blocked, and what to use instead.
-
Codex CLI v0.158: MCP OAuth client secrets and approval for elevated commands
What changed in Codex CLI v0.158.0: MCP servers that need pre-registered OAuth client secrets, terminal approval on by default for elevated commands, and the sandbox fixes.
-
Codex approval_policy vs sandbox_mode: which pairs are safe (on-request + workspace-write, never + read-only)
What approval_policy and sandbox_mode each control in Codex CLI, what --full-auto really sets, and which combination to pin in config.toml for research, daily work and CI.
-
writable_roots = ["/path"]: let Codex write outside the workspace (cwd, /tmp, $TMPDIR are writable by default)
In [sandbox_workspace_write] add writable_roots for caches such as ~/.pyenv/shims, set exclude_slash_tmp or exclude_tmpdir_env_var to block temp dirs, and why .git stays read-only.
-
When bypassPermissions is safe to use in Claude Code, and when it isn't
What --dangerously-skip-permissions actually turns off, what still stops it, the isolation conditions the docs require, and the alternatives worth trying before you reach for it.