slash command /review failed because sandbox stops running shell command

Open 💬 4 comments Opened Mar 25, 2026 by xuziqiang98

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of Codex CLI is running?

codex-cli 0.116.0

What subscription do you have?

gpt-plus

Which model were you using?

gpt-5.4

What platform is your computer?

Linux 6.17.0-19-generic x86_64 x86_64

What terminal emulator and version are you using (if applicable)?

Termius, connecting to ubuntu with tmux

What issue are you seeing?

I directly use /review command to review uncommit code, but failed and told me
" I could not inspect the repository state because every shell command failed in the current sandbox (bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted), so I found no actionable issues from the available context."
Then I give it full access via /approvals command and run /review again. This time codex updates plan first using update_plan tool and then still failed:
“ I could not inspect the staged/unstaged/untracked changes because every attempt to read the
working tree failed in this environment with bwrap: loopback: Failed RTM_NEWADDR: Operation not
permitted. Since the patch could not be validated, it should not be considered correct based on
this review.”

The full procedure like following:

> Code review started: current changes <<

› Review the current code changes (staged, unstaged, and untracked files) and provide prioritized
findings.

I could not inspect the repository state because every shell command failed in the current
sandbox (bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted), so I found no actionable
issues from the available context.

<< Code review finished >>

• I could not inspect the repository state because every shell command failed in the current
sandbox (bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted), so I found no actionable
issues from the available context.

• Permissions updated to Full Access

> Code review started: current changes <<

• Updated Plan
└ □ Inspect repository status and diffs
□ Analyze changes for actionable bugs
□ Produce prioritized review findings JSON

• Updated Plan
└ Shell commands are blocked by the sandbox (bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted), so I couldn't inspect the working tree or diffs. Proceeding with a transparent,
no-findings result rather than inventing issues.
✔ Inspect repository status and diffs
✔ Analyze changes for actionable bugs
□ Produce prioritized review findings JSON

I could not inspect the staged/unstaged/untracked changes because every attempt to read the
working tree failed in this environment with bwrap: loopback: Failed RTM_NEWADDR: Operation not
permitted. Since the patch could not be validated, it should not be considered correct based on
this review.

<< Code review finished >>

• I could not inspect the staged/unstaged/untracked changes because every attempt to read the
working tree failed in this environment with bwrap: loopback: Failed RTM_NEWADDR: Operation not
permitted. Since the patch could not be validated, it should not be considered correct based on
this review.

What steps can reproduce the bug?

like above box

What is the expected behavior?

_No response_

Additional information

_No response_

View original on GitHub ↗

3 Comments

github-actions[bot] contributor · 5 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#15305
#15057
#14919
#15496
#15696

Powered by Codex Action

raye-deng · 5 months ago

This touches on a broader pattern we see across AI coding tools: the sandbox that protects the system also silently breaks the tool's ability to understand the repository state.

The /review command needs to inspect files, run git operations, and understand the diff — but the sandbox blocks exactly those operations. The result is a command that looks like it should work (it's built into the tool!) but fails in a way that gives the user no actionable information.

This is related to a class of AI-code defects we track where the tool's self-assessment capability is compromised by its own safety mechanisms. Three patterns we see:

Inspection blind spots: Sandboxed agents can't see the full file tree or diff context, so they make decisions based on incomplete information. The code they produce looks correct in isolation but breaks when combined with files they couldn't inspect.

Silent quality gate bypasses: When a review step fails (like /review here), the user often works around it by just pushing without review. The safety mechanism intended to enforce quality ends up bypassing it entirely.

False confidence from partial checks: When sandbox restrictions are partially lifted (some reads work, some don't), the agent gets a mix of valid and invalid data. It proceeds with false confidence rather than failing clearly.

The fix ideally needs to distinguish between "inspect repository state" (should always be allowed) and "execute arbitrary commands" (should be sandboxed). Git read operations, file reads, and diff inspection are inherently safe — blocking them in the sandbox is over-restrictive.

For CI-side validation that doesn't have sandbox issues: npx @opencodereview/cli scan . --sla L1

xuziqiang98 · 5 months ago

So this issue does indeed exist and has not been fixed yet, and for now the only workaround is to use npx @opencodereview/cli scan . --sla L1 as a substitute?
On my device, this is not an intermittent issue — it happens consistently. It started appearing in some 0.11x.0 version, possibly 0.114.0.
I also noticed that even with full access granted, it still asks me for permission when editing some files in the current working directory. In some cases, it keeps asking even after I selected the option not to ask again for that file next time.
Those issues started when /approvals was changed to only two permission options. I remember it used to have three options before.

Showing cached comments. Read the full discussion on GitHub ↗