Issue Station
Sign In
Tools hereToolbox

codex - 💡(How to fix) Fix Worktree creation fails with "invalid sandbox policy" when requirements.toml has `allowed_sandbox_modes` [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openai/codex#18242•Fetched 2026-04-17 08:31:00
View on GitHub
Comments
1
Participants
2
Timeline
6
Reactions
0
Author
faevouritefaevourite
Participants
faevouritefaevouriteviyatb-oaiviyatb-oai
Timeline (top)
labeled ×4closed ×1commented ×1

Error Message

Error: invalid sandbox policy: invalid value for sandbox_mode: DangerFullAccess is not in the allowed set [ReadOnly, WorkspaceWrite] (set by /etc/codex/requirements.toml) [stderr] Error: invalid sandbox policy: invalid value for sandbox_mode: DangerFullAccess is not in the allowed set [ReadOnly, WorkspaceWrite] (set by /etc/codex/requirements.toml)

Code Example

Error: invalid sandbox policy: invalid value for `sandbox_mode`: `DangerFullAccess` is not in the allowed set [ReadOnly, WorkspaceWrite] (set by /etc/codex/requirements.toml)
[stderr] Error: invalid sandbox policy: invalid value for `sandbox_mode`: `DangerFullAccess` is not in the allowed set [ReadOnly, WorkspaceWrite] (set by /etc/codex/requirements.toml)

---

sandbox_mode = "workspace-write"
RAW_BUFFERClick to expand / collapse

What version of the Codex App are you using (From “About Codex” dialog)?

26.415.20818 (1727)

What subscription do you have?

Enterprise

What platform is your computer?

Darwin 25.4.0 arm64 arm

What issue are you seeing?

Worktree initiation fails on any starter message with this error:

Error: invalid sandbox policy: invalid value for `sandbox_mode`: `DangerFullAccess` is not in the allowed set [ReadOnly, WorkspaceWrite] (set by /etc/codex/requirements.toml)
[stderr] Error: invalid sandbox policy: invalid value for `sandbox_mode`: `DangerFullAccess` is not in the allowed set [ReadOnly, WorkspaceWrite] (set by /etc/codex/requirements.toml)

My own ~/.codex/config.toml has:

sandbox_mode = "workspace-write"

I don't use danger-full-access.

This started happening just today with 26.415.20818 (1727). Worked fine beforehand.

What steps can reproduce the bug?

  1. Add allowed_sandbox_modes = ["read-only", "workspace-write"] to /etc/codex/requirements.toml
  2. Start a new chat using a local worktree.
  3. Send any message to trigger the worktree creation (which fails).

Uploaded thread: f56ce032-c448-4253-92c5-6ca73a9d6d92

What is the expected behavior?

Worktree gets initialized and first message is processed.

Additional information

No response

extent analysis

TL;DR

The issue can likely be resolved by updating the allowed_sandbox_modes in /etc/codex/requirements.toml to include the value used in the user's ~/.codex/config.toml, which is workspace-write, or by changing the sandbox_mode in ~/.codex/config.toml to one of the allowed modes.

Guidance

  • Verify that the sandbox_mode in ~/.codex/config.toml matches one of the modes listed in the error message (ReadOnly or WorkspaceWrite) to ensure consistency.
  • Check the /etc/codex/requirements.toml file to confirm that allowed_sandbox_modes is correctly set to allow the workspace-write mode used by the user.
  • Consider updating the allowed_sandbox_modes in /etc/codex/requirements.toml to include workspace-write if it's not already included, to align with the user's configuration.
  • If the issue persists, try changing the sandbox_mode in ~/.codex/config.toml to ReadOnly to see if the worktree initiation fails due to a specific mode.

Example

No code snippet is provided as the issue seems to be related to configuration files rather than code.

Notes

The exact cause of the issue might be related to a recent update (version 26.415.20818), and ensuring configuration consistency between user and system settings could resolve the problem.

Recommendation

Apply a workaround by updating the allowed_sandbox_modes in /etc/codex/requirements.toml to include workspace-write, as this directly addresses the error message and is a targeted fix based on the information provided.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#training loop#device allocation#model download#tokenizer error#prompt formatting

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

codex - 💡(How to fix) Fix Worktree creation fails with "invalid sandbox policy" when requirements.toml has `allowed_sandbox_modes` [1 comments, 2 participants]