`is_likely_sandbox_denied` false positive when command output contains "sandbox" in file paths

What version of Codex CLI is running?

rust-v0.117.0 (via codex-acp v0.11.1)

What subscription do you have?

Pro

Which model were you using?

_No response_

What platform is your computer?

Darwin 25.3.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

_No response_

What issue are you seeing?

What happened

A find command that successfully located files was classified as a sandbox denial and its results were discarded. The agent received a SandboxDenied error instead of the actual output.

The command:

find /Users/dev -maxdepth 4 -type f -name 'package.json' 2>/dev/null

This ran fine — it found dozens of package.json files. But some of those files lived under a directory called sandbox/ (e.g. /Users/dev/Projects/sandbox/codex-main/package.json). The word "sandbox" in the file path matched the SANDBOX_DENIED_KEYWORDS list in is_likely_sandbox_denied, and since find exited with code 1 (partial permission errors on some directories), the heuristic flagged the entire result as a sandbox denial.

ERROR codex_core::tools::router:
  error=exec_command failed for `/bin/zsh -lc "find /Users/dev -maxdepth 4 -type f -name 'package.json' 2>/dev/null"`:
  SandboxDenied { message: "/Users/dev/Projects/sandbox/codex-main/package.json\n..." }

Steps to reproduce

Unit test that demonstrates the false positive (can be added to exec_tests.rs):

#[test]
fn sandbox_detection_false_positive_on_path_containing_sandbox() {
    let find_output = "/Users/dev/Projects/sandbox/codex-main/package.json\n\
                       /Users/dev/Projects/sandbox/openai-node/package.json\n\
                       /Users/dev/.npm/_npx/b8d86e6551a4f492/package.json\n";
    let output = make_exec_output(
        /*exit_code*/ 1,
        "",
        find_output,
        find_output,
    );
    // Returns true (false positive) — "sandbox" in file paths
    // matches SANDBOX_DENIED_KEYWORDS.
    assert!(is_likely_sandbox_denied(SandboxType::MacosSeatbelt, &output));
}

What I expected

The command output should have been returned to the agent. The word "sandbox" appearing in a file path is not a sandbox denial message.

Why this happens

is_likely_sandbox_denied in exec.rs does a substring search for keywords like "sandbox", "permission denied", "operation not permitted" across the entire command output. The keyword "sandbox" is too broad — it matches directory names, project names, or any text that happens to contain the word.

On top of that, check_for_sandbox_denial_with_text in process.rs puts the entire merged stdout+stderr into the stderr field of ExecToolCallOutput, so even stdout content (like successfully found file paths) gets scanned for denial keywords.

This creates two compounding issues:

1. A generic keyword matches non-error content
2. Successful output (stdout) is treated as error output (stderr) during the check

What I think is worth considering

This feels like an architectural decision for the team rather than a simple keyword swap. A few directions that came to mind:

• Checking denial keywords against stderr only (not merged output), so successful command results in stdout don't trigger false positives
• Using more specific patterns for sandbox detection — real Seatbelt denials produce messages like "sandbox-exec: sandbox_apply: Operation not permitted", which is already caught by the "operation not permitted" keyword
• Weighing the ratio of denial-like lines vs total output — a single "permission denied" among 50 successful results is probably not a sandbox denial

I have a reproducing test ready in my fork if that's useful.

What steps can reproduce the bug?

1. Have a directory named sandbox/ anywhere in your home folder (e.g. ~/Projects/sandbox/)
2. Run a find or similar command under Seatbelt sandbox that traverses your home directory and hits some permission-denied directories (exit code 1)
3. The output includes file paths containing the word "sandbox" as a directory name
4. Observe: the command result is discarded and reported as SandboxDenied

Unit test reproduction (add to exec_tests.rs):

let find_output = "/Users/dev/Projects/sandbox/codex-main/package.json\n";
let output = make_exec_output(1, "", find_output, find_output);
assert!(is_likely_sandbox_denied(SandboxType::MacosSeatbelt, &output)); // false positive

What is the expected behavior?

The command output should be returned to the agent. File paths containing the word "sandbox" as a directory name should not trigger sandbox denial detection.

Additional information

_No response_