Codex does not seem to know when a tool call fails due to sandboxing

[igor-makarov]

What version of Codex is running?

codex-cli 0.77.0

What subscription do you have?

API key

Which model were you using?

gpt-5.1-codex-max

What platform is your computer?

Darwin 24.6.0 arm64 arm

What issue are you seeing?

When Codex tries to run some commands, they fail in odd ways:

• git writes (like in codex tries to delete .git/index.lock when performing git operations #6797)
• xcodebuild (Apple's CLI for building with Xcode)
• swiftformat (Swift auto-formatter, has shared cache outside the sandbox)

In these cases (and I'm sure I've had others), Codex is completely unaware that these are sandboxing issues, and therefore tries to resolve the issues in ways that don't make sense - deleting git index, trying to find an Xcode workspace file, etc.

I am running with these security settings:

Approval: on-request
Sandbox: workspace-write

I believe some indication to the model that "the command attempted to cross a sandbox boundary" might be helpful.

What steps can reproduce the bug?

Run codex with xcodebuild.

What is the expected behavior?

Sandbox permission prompt

Additional information

No response

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• error running landlock #8217
• Sandbox error error running landlock: Sandbox(LandlockRestrict) using Codex in the browser #8218
• CLI sandbox: cannot commit because .git is read-only (“Unable to create .git/index.lock”) #7071
• Codex cannot edit file. Claims its read only when its set to Full Access #6428

Powered by Codex Action

[igor-makarov]

These issues seem to be related, but I think this is a more broad high-level design issue: the tool calls fail with opaque and different errors and Codex does not understand that this is a sandbox issue.

[igor-makarov]

More information: running log stream shows the offending process being denied by the sandbox:

log stream --predicate 'eventMessage CONTAINS "deny"'
2025-12-22 18:50:12.151270+0200 0x6f1d61c  Error       0x0                  0      0    kernel: (Sandbox) Sandbox: git(77020) deny(1) file-write-create /Users/xxxx/redacted/.git/index.lock

[dylan-hurd-oai]

@igor-makarov could you use /feedback for some of these sessions and provide thread ids?

And just to be explicit, the desired behavior is that the model should run these commands with escalated permissions?

[igor-makarov]

Hi, I have not used the feedback tool, though I do still believe this to be a harness design issue. If I understand correctly, it expects the model to "guess" that the sandbox was the cause of the failure, but in many cases the external tools run do not make this clear at all.

[igor-makarov]

I've realized that the Claude Code sandbox is open source, and apparently it does log monitoring pretty much in the same way I described:

https://github.com/anthropic-experimental/sandbox-runtime/blob/a266a31cd6d34f627b5a8cc40cdab192913f6369/src/sandbox/macos-sandbox-utils.ts#L735

[leynos]

Why isn't the sandbox just instrumented to report attempts to write outside of it? Asking the model to guess when it could be done deterministically seems like a strange design choice.