Codex sandbox_permissions approval doesn't get surfaced through app-server

[amirbarak]

What issue are you seeing?

While integrating Codex through codex app-server, I saw a codex turn stall on a permission/escalation prompt that appeared in the codex session transcript, but no matching app-server item/*/requestApproval server request over JSON-RPC.

This leaves app-server clients unable to display or resolve the approval. The turn appears active but cannot progress until the hidden approval times out.

• Codex CLI: 0.130.0
• Mode: codex app-server --listen stdio://
• Approval policy: on-request
• Sandbox: workspace-write
• Platform: Linux

What steps can reproduce the bug?

1. Start app-server:

codex app-server --listen stdio://
-c 'model="gpt-5.5"'
-c 'approval_policy="on-request"'
-c 'thread_sandbox="workspace-write"'
-c 'turn_sandbox_policy="workspace-write"'

2. Initialize app-server over stdio.
3. Start a thread in a git worktree whose .git metadata lives outside the sandbox writable roots.
4. Start a turn asking Codex to stage/commit changes, or otherwise run a command that requires sandbox escalation, for example git add .... This should trigger codex for sandbox_permissions approval.
5. Observe the app-server JSON-RPC stream.
6. Compare it with the saved Codex session transcript under ~/.codex/sessions/....

What is the expected behavior?

I expect app-server to surface a item/*/requestApproval as with other approval requests.

Additional information

Here's what it looked like for me:

session transcript:

{
"type": "function_call",
"name": "exec_command",
"arguments": {
"cmd": "git add foobar",
"workdir": "/tmp/testbranch1",
"yield_time_ms": 1000,
"max_output_tokens": 12000,
"sandbox_permissions": "require_escalated",
"justification": "Allow staging the test file in this git worktree; the git metadata lives under /home/... outside the writable sandbox.",
"prefix_rule": ["git", "add"]
}
}

After 300 seconds, the session transcript recorded:

{
"type": "function_call_output",
"output": "aborted by user after 300.0s"
}

But the app-server client never received an approval request it could answer.

[clucluclu]

Just leaving a note here as I am absolutely invested in the outcome for this - without it only options within paseo are full access permissions, which is too unsafe to be able to use in my case..really keen to see this one resolved. Linux daemon and codex server runtime .130 - win 11 and ios paseo clients latest as of today).

[etraut-openai]

Thanks for the detailed report. I investigated this path and I don’t think this is an app-server bug.

The important detail is that approval_policy = "on-request" is not, by itself, enough to guarantee that escalation requests are surfaced to the app-server client as item/commandExecution/requestApproval. If the session is configured with an automatic approvals reviewer, such as guardian_subagent / auto-review, the escalation is handled by that reviewer instead of being routed to the client for manual approval.

I was able to exercise the repro shape directly: app-server over stdio, workspace-write, on-request, a git worktree whose .git metadata points outside the writable root, and an exec_command call with sandbox_permissions = "require_escalated". When approvals_reviewer = "user" was set, app-server correctly emitted item/commandExecution/requestApproval.

So the behavior described here is most likely explained by the session using an automatic approvals reviewer, not by app-server dropping the approval request.

If you still believe this is a bug, please provide a raw JSON-RPC trace that includes the thread/start response, especially the approvalsReviewer value, plus the subsequent turn events. Without that, this looks like a configuration/client expectation issue rather than a Codex defect.

[amirbarak]

Hi @etraut-openai, thanks for looking into this!

Here's the thread/start trace I see in a failed run:

{"direction":"stdin","payload":{"id":2,"jsonrpc":"2.0","method":"thread/start","params":{"approvalPolicy":"on-request","cwd":"/tmp/the_target_branch","metadata":{"base_branch":"the_base_branch", "target_branch":"the_target_branch"},"sandbox":"workspace-write"}},"timestamp":1778370554.2516055}
{"direction":"stdout","payload":{"method":"remoteControl/status/changed","params":{"environmentId":null,"status":"disabled"}},"timestamp":1778370554.2518725}
{"direction":"stdout","payload":{"id":2,"result":{"activePermissionProfile":null,"approvalPolicy":"on-request","approvalsReviewer":"user","cwd":"/tmp/the_targe_branch","instructionSources":[".../AGENTS.md"],"model":"gpt-5.5","modelProvider":"openai","permissionProfile":{"fileSystem":{"entries":[{"access":"read","path":{"type":"special","value":{"kind":"root"}}},{"access":"write","path":{"type":"special","value":{"kind":"project_roots","subpath":null}}},{"access":"write","path":{"type":"special","value":{"kind":"slash_tmp"}}},{"access":"write","path":{"type":"special","value":{"kind":"tmpdir"}}},{"access":"read","path":{"type":"special","value":{"kind":"project_roots","subpath":".git"}}},{"access":"read","path":{"type":"special","value":{"kind":"project_roots","subpath":".agents"}}},{"access":"read","path":{"type":"special","value":{"kind":"project_roots","subpath":".codex"}}},{"access":"write","path":{"path":"/home/.../.codex/memories","type":"path"}},{"access":"read","path":{"path":"/home/.../.codex/memories/.git","type":"path"}},{"access":"read","path":{"path":"/home/.../.codex/memories/.agents","type":"path"}},{"access":"read","path":{"path":"/home/.../.codex/memories/.codex","type":"path"}}],"type":"restricted"},"network":{"enabled":true},"type":"managed"},"reasoningEffort":"medium","sandbox":{"excludeSlashTmp":false,"excludeTmpdirEnvVar":false,"networkAccess":true,"type":"workspaceWrite","writableRoots":["/home/.../.codex/memories"]},"serviceTier":null,"thread":{"agentNickname":null,"agentRole":null,"cliVersion":"0.130.0","createdAt":1778370554,"cwd":"/tmp/the_target_branch","ephemeral":false,"forkedFromId":null,"gitInfo":null,"id":"019e0f25-29eb-7df2-8394-64ec129950a5","modelProvider":"openai","name":null,"path":"/home/../.codex/sessions/...jsonl","preview":"","sessionId":"...","source":"vscode","status":{"type":"idle"},"threadSource":null,"turns":[],"updatedAt":1778370554}}},"timestamp":1778370554.4009073}

Is this what you were referring to?