Interactive sandboxed shell_command fails with execution error: Sandbox(Signal(6)) on macOS, but fresh codex exec succeeds

Codex Bug Report Draft: Interactive sandboxed shell fails with Sandbox(Signal(6)) while external codex exec succeeds

Proposed title

Interactive sandboxed shell_command fails with execution error: Sandbox(Signal(6)) on macOS, but fresh codex exec --sandbox workspace-write succeeds

Repository-independent summary

On macOS, sandboxed shell execution in an interactive Codex session fails immediately for trivial commands such as pwd with:

• execution error: Sandbox(Signal(6))

The same machine, same user account, and same repo can successfully run sandboxed shell commands through fresh external codex exec invocations. This points to an interactive/session runtime bug rather than a general CLI install problem, a simple config problem, or repo corruption.

Environment

• Codex version: codex-cli 0.130.0
• Install method: Homebrew cask
• macOS: 26.4
• Build: 25E246
• Hardware: Apple Silicon (/opt/homebrew install path, codex-aarch64-apple-darwin)

Config state

Both config layers disable unified exec:

Repo-local .codex/config.toml

experimental_use_unified_exec_tool = false

[features]
unified_exec = false

User-level ~/.codex/config.toml

experimental_use_unified_exec_tool = false

[features]
unified_exec = false

This was verified against current Codex config docs before filing.

Reproduction

1. Open an interactive Codex session in a trusted repo.
2. Ask Codex to run a trivial shell command such as pwd.
3. Observe immediate failure in the tool path:

• execution error: Sandbox(Signal(6))

1. In the same repo, same machine, and same user account, run a fresh external Codex process from the terminal:

codex exec --json --sandbox workspace-write --skip-git-repo-check --ephemeral -C /path/to/repo \
  "Run the shell command \`pwd\` exactly once and then stop. In the final answer, report only the command output."

1. That external codex exec succeeds and returns the working directory path.

Actual behavior

• Interactive session shell_command fails for trivial commands such as:
• pwd
• git status --short
• sed -n '1,220p' some-file.md
• env | head -n 5
• Failure mode is consistently:
• execution error: Sandbox(Signal(6))

Expected behavior

• A trivial sandboxed shell command like pwd should succeed inside the interactive session, especially when the equivalent fresh external codex exec call succeeds on the same machine.

Why this does not look like a simple misconfiguration

• The current stable release is installed: 0.130.0
• Repo-local config disables unified exec
• User-level config disables unified exec
• Fresh external codex exec succeeds with normal inherited environment
• Fresh external codex exec also succeeds with:
• env -i
• --ignore-user-config
• --disable shell_snapshot
• Fresh external codex exec also succeeds with a clean alternate CODEX_HOME seeded only with auth.json
• ~/.codex/state_5.sqlite and ~/.codex/logs_2.sqlite both pass PRAGMA quick_check

Taken together, this suggests the bug is in the interactive/session runtime path rather than:

• repo corruption
• a broken Homebrew install
• bad user config
• obviously corrupted Codex SQLite state

Relevant log excerpt

From ~/.codex/log/codex-tui.log:

2026-05-17T19:37:33.790529Z  INFO ... ToolCall: shell_command {"command":"pwd","workdir":"/Users/aitestbed/Codex/projects/invention-disclosures","timeout_ms":10000}
2026-05-17T19:37:33.810527Z  INFO ... ToolCall: shell_command {"command":"sed -n '1,220p' notes/session-handoff-2026-05-17-shell-fix-and-resume.md","workdir":"/Users/aitestbed/Codex/projects/invention-disclosures","timeout_ms":10000}
2026-05-17T19:37:33.810756Z  INFO ... ToolCall: shell_command {"command":"git status --short","workdir":"/Users/aitestbed/Codex/projects/invention-disclosures","timeout_ms":10000}
2026-05-17T19:37:33.819373Z ERROR codex_core::tools::router: error=execution error: Sandbox(Signal(6))
2026-05-17T19:37:33.826133Z ERROR codex_core::tools::router: error=execution error: Sandbox(Signal(6))
2026-05-17T19:37:33.826409Z ERROR codex_core::tools::router: error=execution error: Sandbox(Signal(6))
2026-05-17T19:37:33.828400Z ERROR codex_core::tools::router: error=execution error: Sandbox(Signal(6))

Additional context

• The machine also has Claude Code installed, and Codex shell snapshots show inherited Claude-related shell state such as CLAUDE_CODE_SSE_PORT.
• However, the strongest current evidence points away from that being the primary cause, because fresh external codex exec succeeds both with the normal inherited environment and with a nearly empty env -i environment.
• Public issue search turned up related macOS sandbox instability in openai/codex, and maintainer-side notes referencing local Sandbox(Signal(6)) failures, but I did not find a public issue matching this exact interactive-vs-external split.

Practical workaround

• Work continues by using escalated shell access or fresh external codex exec calls when shell work is required.

Requested investigation

• Compare the interactive TUI/session shell execution path against the external codex exec shell execution path on macOS.
• Check whether the interactive path is still routing through a different sandbox/runtime backend despite both unified-exec disable flags being set.
• Check whether plugin/session initialization in the interactive runtime can poison subsequent shell tool invocations even though standalone codex exec remains healthy.