Issue Station
Sign In
Tools hereToolbox

codex - 💡(How to fix) Fix codex upload ~/.codex/rules/default.rules even when sandbox_mode = "danger-full-access"

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Code Example

// ~/.codex/rules/default.rules
// example
prefix_rule(pattern=["curl", "-L"], decision="allow")
prefix_rule(pattern=["node", "scripts/open-chrome-window.js"], decision="allow")
prefix_rule(pattern=["open", "-a"], decision="allow")
prefix_rule(pattern=["npm", "run", "build:wx"], decision="allow")
prefix_rule(pattern=["rtk", "mkdir"], decision="allow")
prefix_rule(pattern=["rtk", "cp"], decision="allow")
prefix_rule(pattern=["rtk", "git"], decision="allow")

---

<permissions instructions>
...

### Examples
...

## Approved command prefixes
The following prefix rules have already been approved: - ["rtk", "cp"]
- ["curl", "-L"]
- ["open", "-a"]
- ["rtk", "git"]
- ["rtk", "mkdir"]
- ["node", "scripts/open-chrome-window.js"]
- ["npm", "run", "build:wx"]
</permissions instructions>

---

sandbox_mode = "danger-full-access"
RAW_BUFFERClick to expand / collapse

What version of Codex CLI is running?

codex-cli 0.137.0

I would like to understand why codex includes the contents of ~/.codex/rules/default.rules as part of the model input.

// ~/.codex/rules/default.rules
// example
prefix_rule(pattern=["curl", "-L"], decision="allow")
prefix_rule(pattern=["node", "scripts/open-chrome-window.js"], decision="allow")
prefix_rule(pattern=["open", "-a"], decision="allow")
prefix_rule(pattern=["npm", "run", "build:wx"], decision="allow")
prefix_rule(pattern=["rtk", "mkdir"], decision="allow")
prefix_rule(pattern=["rtk", "cp"], decision="allow")
prefix_rule(pattern=["rtk", "git"], decision="allow")

Does the model need to rely on this file in order to generate commands with the correct permissions?

Why is this handled by providing the rules to the model, instead of enforcing the restrictions only at execution time?

input like:

<permissions instructions>
...

### Examples
...

## Approved command prefixes
The following prefix rules have already been approved: - ["rtk", "cp"]
- ["curl", "-L"]
- ["open", "-a"]
- ["rtk", "git"]
- ["rtk", "mkdir"]
- ["node", "scripts/open-chrome-window.js"]
- ["npm", "run", "build:wx"]
</permissions instructions>

In addition, even though I have already set:

sandbox_mode = "danger-full-access"

Codex still uploaded the contents of ~/.codex/rules/default.rules.

Could you clarify the intended behavior here? Is this expected, or should the rules file not be uploaded when full access mode is enabled?

Thanks.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING