codex - 💡(How to fix) Fix Codex Desktop Settings cannot save approval/sandbox config after plugin marketplace refresh updates config.toml

Summary

Codex Desktop Settings > Configuration shows:

Configuration was modified since last read. Fetch latest version and retry.

This happens when trying to change:

• Approval policy (approval_policy)
• Sandbox settings (sandbox_mode)

The actual config file is editable and valid. The failure appears to be an optimistic concurrency/version conflict in the Settings UI: the page reads a config.toml layer/version, but Codex plugin/marketplace refresh updates the same ~/.codex/config.toml shortly after, so the Settings page keeps using a stale expectedVersion when calling write-config-value.

Environment

• Product: Codex Desktop app
• App version: 26.519.31651
• Bundle id: com.openai.codex
• OS: macOS 26.5
• Architecture: arm64
• Config file: ~/.codex/config.toml

Reproduction Steps

1. Open Codex Desktop.

2. Open Settings > Configuration.

3. Select User config.

4. Try to change Approval policy, e.g. Never -> On request.

5. Try to change Sandbox settings, e.g. Read only / Full access.

6. Observe red error text under the control:

   Configuration was modified since last read. Fetch latest version and retry.

Observed Behavior

• The dropdown value may visually change, but saving fails with the error above.
• Refreshing/reopening the settings page can still reproduce the issue if a background plugin/marketplace refresh modifies config.toml soon after the page reads it.
• Editing ~/.codex/config.toml directly works.

Expected Behavior

Settings should either:

• Refetch the latest config layer/version before writing, or
• Retry the single-field upsert against the latest config after detecting a version mismatch, or
• Ignore unrelated concurrent changes like marketplace last_updated when writing unrelated keys such as approval_policy and sandbox_mode.

Changing approval_policy and sandbox_mode should not fail because an unrelated marketplace timestamp changed.

Evidence

Sanitized ~/.codex/config.toml relevant fields:

sandbox_mode = "danger-full-access"
approval_policy = "on-request"

[marketplaces.openai-bundled]
last_updated = "2026-05-22T10:51:24Z"
source_type = "local"
source = "<codex-home>/.tmp/bundled-marketplaces/openai-bundled"

[marketplaces.openai-primary-runtime]
last_updated = "2026-05-21T18:51:32Z"
source_type = "local"
source = "<user-cache>/codex-runtimes/codex-primary-runtime/plugins/openai-primary-runtime"

Enabled plugin entries include:

[plugins."computer-use@openai-bundled"]
enabled = true

[plugins."browser@openai-bundled"]
enabled = true

[plugins."chrome@openai-bundled"]
enabled = true

Relevant log patterns around the failure:

app-server request: config/value/write
app_server.request otel.name="config/value/write" rpc.method="config/value/write"
/etc/codex/managed_config.toml not found
Managed preferences for com.openai.codex key requirements_toml_base64 not found
failed to refresh remote installed plugins cache
failed to warm featured plugin ids cache
configured non-curated plugin no longer exists in discovered marketplaces during cache refresh plugin="browser" marketplace="openai-bundled"
configured non-curated plugin no longer exists in discovered marketplaces during cache refresh plugin="chrome" marketplace="openai-bundled"
configured non-curated plugin no longer exists in discovered marketplaces during cache refresh plugin="computer-use" marketplace="openai-bundled"

Suspected Cause

The Settings page passes a stale expectedVersion into write-config-value for approval_policy / sandbox_mode writes. The version becomes stale because plugin/marketplace refresh updates the same user config file, especially [marketplaces.openai-bundled].last_updated.

A local inspection of the bundled frontend showed the Settings code calls write-config-value with expectedVersion:B.expectedVersion for these fields. If any unrelated writer modifies config.toml after the settings page read, the write is rejected and the UI does not recover automatically.

Workaround

Manually edit ~/.codex/config.toml, for example:

approval_policy = "on-request"
sandbox_mode = "danger-full-access"

Then restart Codex Desktop.

Notes

This does not appear to be caused by project-level instructions (AGENTS.md / agent.md) or project-level config. In this reproduction, the project had no .codex/config.toml and no project requirements.toml; logs also reported no managed config or MDM requirements key found.