Sandbox broken in 0.133.0

[shteren1]

What version of Codex CLI is running?

0.133.0

What subscription do you have?

Plus

Which model were you using?

5.3 codex/ 5.4 mini

What platform is your computer?

Windows 11

What terminal emulator and version are you using (if applicable)?

Powershell7

Codex doctor report

What issue are you seeing?

The sandbox is broken agent couldnt read any file even without elevated permissions. Rolling back to 0.132.0 solved the problem.

What steps can reproduce the bug?

Update to 0.133.0 ask the model to read files from project thaf you usually work with

What is the expected behavior?

Agent can read/write files within the project without elevated permissions

Additional information

No response

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• 0.133.0 Windows sandbox regression: read-only mode rejects basic git/PowerShell inspection that 0.130.0 allowed #23965
• Windows sandbox setup helper triggers UAC installer detection (os error 740) #24050
• Windows sandbox setup refresh failure on v0.131.0 #23587

Powered by Codex Action

[xiecheng7511]

same problem

[jshaofa-ui]

openai/codex #24133: Sandbox Broken in 0.133.0 — Agent Cannot Read Files

🔍 Root Cause Analysis

Severity: P0 — Sandbox regression; agent cannot read any files without elevated permissions

The sandbox in codex-cli 0.133.0 is completely broken on Windows 11 — the agent cannot read any project files even without elevated permissions. Rolling back to 0.132.0 resolves the issue, confirming this is a regression in 0.133.0.

Root Cause Analysis

This is a sandbox permission regression in the 0.133.0 release. The sandbox layer is over-blocking file read operations that should be allowed under default permissions. Likely causes:

1. Sandbox ACL regression: The permission allowlist for file reads was narrowed or reset in 0.133.0
2. Path normalization change: A change in how paths are normalized (e.g., case sensitivity, trailing slashes) causes valid paths to fail ACL checks
3. Sandbox mode default change: The default sandbox mode may have changed from "allow reads" to "deny all"
4. Windows-specific path handling: The sandbox may not correctly handle Windows path formats (backslashes, drive letters, UNC paths)

Regression Pattern

This follows the same pattern as codex #24036 (Desktop permission mode reset on restart) and #24101 (WSL Sandbox ACL failure) — sandbox permission handling has systemic issues across multiple code paths.

🛠️ Proposed Fix

Fix 1: Sandbox Permission Regression Test (Critical)

// In SandboxManager — add regression test for basic file read
class SandboxManager {
  async initialize(): Promise<void> {
    await this.loadSandboxConfig();

    // NEW: Verify basic file read works after sandbox initialization
    const testFile = path.join(this.workspaceRoot, 'package.json');
    try {
      await this.readWithSandbox(testFile);
      this.logger.info('Sandbox file read verification passed');
    } catch (err) {
      this.logger.error('Sandbox file read verification FAILED', {
        error: err.message,
        workspaceRoot: this.workspaceRoot,
        version: process.env.CODEX_VERSION,
      });
      // Fall back to permissive mode if sandbox is broken
      if (this.config.sandboxMode === 'default') {
        this.logger.warn('Falling back to permissive sandbox mode');
        this.config.sandboxMode = 'permissive';
      }
    }
  }

  async readWithSandbox(filePath: string): Promise<string> {
    // Verify the path is within the workspace
    const normalized = this.normalizePath(filePath);
    if (!this.isWithinWorkspace(normalized)) {
      throw new SandboxError('Path outside workspace', { path: normalized });
    }

    // NEW: Check if the file exists before applying sandbox ACL
    try {
      await fs.access(normalized, fs.constants.R_OK);
    } catch (err) {
      // If the file is readable by the OS but sandbox blocks it, that's a bug
      throw new SandboxError('Sandbox blocked readable file', {
        path: normalized,
        osReadable: true,
        sandboxMode: this.config.sandboxMode,
      });
    }

    return fs.readFile(normalized, 'utf-8');
  }
}

Fix 2: Sandbox ACL Allowlist Verification (Critical)

// In SandboxACL — verify the default allowlist includes workspace files
class SandboxACL {
  private defaultReadAllowlist: string[];

  constructor(config: SandboxConfig) {
    // NEW: Ensure workspace root is always in the read allowlist
    this.defaultReadAllowlist = [

[shteren1]

The problem persists on new version 0.134.0