Codex Desktop appears to ignore `sandbox_workspace_write.writable_roots`
Resolved 💬 4 comments Opened Feb 3, 2026 by corrylc Closed Feb 10, 2026
💡 Likely answer: A maintainer (github-actions[bot], contributor)
responded on this thread — see the highlighted reply below.
What version of Codex is running?
260202.0859 (517)
What subscription do you have?
Business
Which model were you using?
N/A
What platform is your computer?
Darwin 25.2.0 arm64 arm
What terminal emulator and version are you using (if applicable)?
N/A
What issue are you seeing?
<img width="1561" height="1158" alt="Image" src="https://github.com/user-attachments/assets/5dd4bf9e-d95e-4cf2-b248-3b5178248c6a" />
Writable roots within the Desktop app appear to be the "default" for codex, rather than those set by the config. This breaks quite a few tools, requiring they run via escalation.
What steps can reproduce the bug?
- Add some folder to
sandbox_workspace_write.writable_rootsin the config such as/Users/$USER/.bun - Open Codex Desktop and ask it to write a test file there
What is the expected behavior?
The writable roots within Codex Desktop match Codex CLI (and the config)
Additional information
_No response_
4 Comments
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
This is a really surprising bug. It is so awkward to use codex in sandbox mode with the defaults that don't even allow access to things like the standard package manager cache directories... I suspect lots of people getting great results with Codex are simply YOLO in full access mode, which is a bit scary!
<img width="376" height="270" alt="Image" src="https://github.com/user-attachments/assets/9d8806ea-eefd-467f-bd29-1846b376ecbe" />
I'm not sure which version added it, but Codex appears to have restored the config as effective when selected in this dropdown.
Hi all! Custom mode is the correct permission to use if you want the app to respect
sandbox_workspace_write.writable_roots. You will also need to set the sandbox_mode toworkspace-writein config.toml for it to be picked up correctly too. Please let me know if you are still see issues.