Sandbox broken in 0.133.0

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #23965
• #24050
• #23587

Powered by Codex Action

same problem

openai/codex #24133: Sandbox Broken in 0.133.0 — Agent Cannot Read Files

🔍 Root Cause Analysis

Severity: P0 — Sandbox regression; agent cannot read any files without elevated permissions

The sandbox in codex-cli 0.133.0 is completely broken on Windows 11 — the agent cannot read any project files even without elevated permissions. Rolling back to 0.132.0 resolves the issue, confirming this is a regression in 0.133.0.

Root Cause Analysis

This is a sandbox permission regression in the 0.133.0 release. The sandbox layer is over-blocking file read operations that should be allowed under default permissions. Likely causes:

1. Sandbox ACL regression: The permission allowlist for file reads was narrowed or reset in 0.133.0
2. Path normalization change: A change in how paths are normalized (e.g., case sensitivity, trailing slashes) causes valid paths to fail ACL checks
3. Sandbox mode default change: The default sandbox mode may have changed from "allow reads" to "deny all"
4. Windows-specific path handling: The sandbox may not correctly handle Windows path formats (backslashes, drive letters, UNC paths)

Regression Pattern

This follows the same pattern as codex #24036 (Desktop permission mode reset on restart) and #24101 (WSL Sandbox ACL failure) — sandbox permission handling has systemic issues across multiple code paths.

🛠️ Proposed Fix

Fix 1: Sandbox Permission Regression Test (Critical)

// In SandboxManager — add regression test for basic file read
class SandboxManager {
  async initialize(): Promise<void> {
    await this.loadSandboxConfig();

    // NEW: Verify basic file read works after sandbox initialization
    const testFile = path.join(this.workspaceRoot, 'package.json');
    try {
      await this.readWithSandbox(testFile);
      this.logger.info('Sandbox file read verification passed');
    } catch (err) {
      this.logger.error('Sandbox file read verification FAILED', {
        error: err.message,
        workspaceRoot: this.workspaceRoot,
        version: process.env.CODEX_VERSION,
      });
      // Fall back to permissive mode if sandbox is broken
      if (this.config.sandboxMode === 'default') {
        this.logger.warn('Falling back to permissive sandbox mode');
        this.config.sandboxMode = 'permissive';
      }
    }
  }

  async readWithSandbox(filePath: string): Promise<string> {
    // Verify the path is within the workspace
    const normalized = this.normalizePath(filePath);
    if (!this.isWithinWorkspace(normalized)) {
      throw new SandboxError('Path outside workspace', { path: normalized });
    }

    // NEW: Check if the file exists before applying sandbox ACL
    try {
      await fs.access(normalized, fs.constants.R_OK);
    } catch (err) {
      // If the file is readable by the OS but sandbox blocks it, that's a bug
      throw new SandboxError('Sandbox blocked readable file', {
        path: normalized,
        osReadable: true,
        sandboxMode: this.config.sandboxMode,
      });
    }

    return fs.readFile(normalized, 'utf-8');
  }
}

Fix 2: Sandbox ACL Allowlist Verification (Critical)

// In SandboxACL — verify the default allowlist includes workspace files
class SandboxACL {
  private defaultReadAllowlist: string[];

  constructor(config: SandboxConfig) {
    // NEW: Ensure workspace root is always in the read allowlist
    this.defaultReadAllowlist = [

The problem persists on new version 0.134.0