Continuous permission errors since 0.59->0.60, 5.1-Codex-Max upgrade

[JeongJuhyeon]

What version of Codex is running?

codex-cli 0.60.1

What subscription do you have?

Plus

Which model were you using?

5.1-codex-max

What platform is your computer?

MacOS, using zsh, installed Codex through Homebrew

What issue are you seeing?

Since updating 0.59->0.60 and switching to 5.1-Codex-Max, continuously seeing this:

• Explored
  └ Read useDataScreen.ts

• I’m working on a new persistent store to track scroll offsets by format, using
  │ *** Begin Patch
  │ *** Add File: stores/dataUiStore.ts
  │ … +53 lines
  └ /opt/homebrew/Library/Homebrew/cmd/shellenv.sh: line 18: /bin/ps: Operation not permitted
    Success. Updated the following files:
    A stores/dataUiStore.ts

Ran cd /Users/sam/Developer/camera-app && apply_patch <<'PATCH'
  │ *** Begin Patch
  │ *** Update File: stores/hydration.ts
  │ … +18 lines
  └ /opt/homebrew/Library/Homebrew/cmd/shellenv.sh: line 18: /bin/ps: Operation not permitted
    Success. Updated the following files:
    M stores/hydration.ts

Note the repeated opt/homebrew/Library/Homebrew/cmd/shellenv.sh: line 18: /bin/ps: Operation not permitted as well as the use of && apply_patch <<'PATCH' which wasn't there before.

What steps can reproduce the bug?

Ask Codex to do virtually anything. It even happens when it does a sed.

Ran cd /Users/sam/Developer/camera-app && sed -n '1,200p' app/camera/[id].tsx
  └ /opt/homebrew/Library/Homebrew/cmd/shellenv.sh: line 18: /bin/ps: Operation not permitted
    zsh:1: no matches found: app/camera/[id].tsx

What is the expected behavior?

It didn't happen in 0.59.?, whatever I was on before.

Additional information

MacOS, using zsh, installed Codex through Homebrew

[etraut-openai]

Thanks for the bug report. Could you use the /feedback slash command to upload the session and report the thread ID here?

[JeongJuhyeon]

Thanks for the bug report. Could you use the /feedback slash command to upload the session and report the thread ID here?

019a9f00-2f7c-7f70-ac97-61fd627822eb

[zzhang1]

Same here. Unfortunately I can't share my session but on Ubuntu Linux 22.04 LTS, Codex 0.60.1. This worked fine until about recent hours. It seems to be related to the sandbox. The folder is in a git repo and is whitelisted and has been used with Codex for over a month. I am unable to reproduce it with a new test repo. Codex eventually found a workaround by escalating every single command and writing Python scripts instead of using patch, but this is far from ideal.

`

rename the API Migration folder to API_Migration

• Tried renaming documentation/API Migration → documentation/
Response_Migration, but the documentation folder itself is not writable (even as
owner). Evidence:

• mv and cp both failed with “Permission denied”.
• touch documentation/testfile fails with “Permission denied”.

I can proceed once the parent directory permissions/ACL allow creating/renaming
entries in documentation/. If you prefer, I can keep working inside the existing
API Migration folder until permissions are adjusted.
`

[etraut-openai]

@zzhang1, what do you mean when you say the folder is "whitelisted"? Is it within the main working directory (where you launch codex)? Or are you configuring additional writable_roots in your codex.toml? Can you confirm that you are able to write to that directory yourself outside of the sandbox?

[lzfxxx]

same here 019a9fe2-a6be-75e2-b84e-4deeefa4e39a

[AJINGOUP]

facing the same issue here 019a9fff-7753-7f23-85ef-d95519088b0c with a simple rg command.

[lzfxxx]

same here 019a9fe2-a6be-75e2-b84e-4deeefa4e39a

#4620 (comment)

# Only run Homebrew shellenv in interactive shells,
# and only if brew actually exists.
if [[ $- == *i* ]] && [[ -x /opt/homebrew/bin/brew ]]; then
  eval "$(/opt/homebrew/bin/brew shellenv)"
fi

Fixed this for me.

[AJINGOUP]

same here 019a9fe2-a6be-75e2-b84e-4deeefa4e39a

The problem seems to be solved.

I fix this issue by explicitly specifying the terminal type in my .zprofile file.

# eval "$(/opt/homebrew/bin/brew shellenv)"
eval "$(/opt/homebrew/bin/brew shellenv zsh)"

so that shellenv.sh will not execute the code on line 18, as mentioned in #4620

[zzhang1]

@zzhang1, what do you mean when you say the folder is "whitelisted"? Is it within the main working directory (where you launch codex)? Or are you configuring additional writable_roots in your codex.toml? Can you confirm that you are able to write to that directory yourself outside of the sandbox?

Interestingly, it all started working again this morning with no changes from my end.

Apologies for the confusion on 'whitelisting,' I just meant that the folder was trusted, e.g.,
[projects."/home/zzhang1/project"] trust_level = "trusted"
When it wasn't working, I was still able to write and delete files in any of the project folders myself as the same user used to run Codex. Nothing looked strange in permissions via lsattr. And Codex could even write to them if it ran Python scripts on the fly to modify files.

[adirburke]

019aba6e-eaf4-7170-bac0-8e92096afbe3

[SwiftedMind]

Same problem for me. Unfortunately, none of the fixes above work for me.

019ac430-d584-74a3-b596-e284568e0ff5