#sandbox
2 articles
-
Let Codex write outside the workspace in workspace-write mode: writable_roots and the /tmp rules
What Codex's workspace-write sandbox can write to by default (cwd, /tmp, $TMPDIR), how to add paths with writable_roots, how to exclude temp directories, and why .git is read-only.
-
Codex CLI approval modes versus sandbox modes: safe combinations for autonomous runs
What Codex CLI's approval policy and sandbox mode each control, what --full-auto really does, how to pin them in config.toml, and which pair fits research, daily work and CI.