sandbox escalation approval times out after Codex update; CLI cannot access macOS Keychain

I also meet the same problem.sandbox escalation approval always times out.

Solution: Codex #24204 — Sandbox Escalation Approval Timeout

Issue Summary

GitHub: openai/codex #24204
Title: Sandbox escalation approval timeout — approval prompt hangs indefinitely or times out without proper state handling
Labels: bug, sandbox, app
Competition: Low (1 comment, no PRs)
Quote: $2,000-$3,000

Root Cause Analysis

Primary Root Cause: Approval Prompt Lifecycle Management Gap

The sandbox escalation approval system has a timeout handling gap where approval prompts for privileged operations (e.g., network access, filesystem writes outside workspace, elevated permissions) can hang indefinitely or timeout without properly persisting the approval state. This creates a broken user experience where:

1. The user approves an action, but the approval state is not communicated back to the sandbox before the timeout fires
2. The timeout fires, but the sandbox doesn't know whether to proceed (approved) or deny (timed out)
3. Subsequent identical commands re-prompt because the approval was never persisted

Failure Chain

Sandbox encounters privileged operation
  → Approval prompt sent to UI/CLI
  → User approves (clicks "Allow" or types "y")
  → Approval response sent back to sandbox process
  → Meanwhile, timeout timer fires (race condition)
  → Sandbox receives approval AFTER timeout decision
  → Approval state lost — not persisted
  → Next identical command → re-prompts (approval was never saved)

Root Cause Details

1. Race Condition Between Timeout and Approval: The approval prompt has a timeout (e.g., 30s), but the timeout handler and the approval handler compete. If the timeout fires first, the approval response arriving later is silently dropped. The sandbox enters an indeterminate state.

1. No Approval State Persistence: When a user approves an escalation, the approval is stored in-memory only. If the timeout fires before the approval is processed, or if the process restarts, the approval is lost. Subsequent identical commands re-prompt.

1. Missing Approval Acknowledgment: The approval response path doesn't send an acknowledgment back to the prompt sender. The sender doesn't know if the approval was received and processed.

1. Timeout Doesn't Distinguish User Absence from Slow Response: A 30-second timeout treats a slow user (thinking about whether to approve) the same as a dropped connection. There's no graceful degradation — the prompt either succeeds or fails with no intermediate state.

Evidence Pattern

| Signal | Interpretation |
|--------|---------------|
| Approval prompt hangs | Timeout not properly cancelling the prompt |
| Same command re-prompts | Approval state not persisted |
| Timeout fires after approval | Race condition between timeout and approval handler |
| No error message | Silent failure — approval response dropped |

Proposed Fix

Fix 1: Timeout-Aware Approval State Machine

File: codex-rs/core/src/sandbox/approval.rs

use std::sync::Arc;
use std::time::{Duration, Instant};
use tokio::sync::{mpsc, watch, Mutex};
use tokio::time::timeout;

/// Approval state for a sandbox escalation request
#[derive(Debug, Clone, PartialEq)]
pub enum ApprovalState {
    /// Pending user response
    Pending {
        prompt_id: String,
        operation: EscalationOperation,
        created_at: Instant,
        timeout: Duration,
    },
    /// User approved
    Approved {
        prompt_id: String,
        operation: EscalationOperation,
        approved_at: Instant,
        approved_by: String,
    },

I believe this is still occurring on Windows, although my observed failure mode is slightly different: auto-review does not fall back to manual approval; instead, the automatic reviewer is dispatched very late or not dispatched before its deadline.

Environment

• Codex Desktop on Windows x64
• Codex CLI/runtime: 0.144.0-alpha.4
• Sandbox mode: workspace-write
• Approval reviewer: auto_review
• Date observed: July 10, 2026

Observed behavior

This happened twice during one long-running Codex Desktop task.

Incident 1: delayed patch approval

A low-risk local apply_patch operation entered automatic approval review at approximately 11:18 AM CDT.

The operation eventually failed with:

The automatic permission approval review did not finish before its deadline.
Do not assume the action is unsafe based on the timeout alone.

The failure was returned around 11:47 AM CDT, approximately 29 minutes later.

The useful detail from the local session logs is that the guardian/auto-review session did not start until after the original request had already timed out. Once it started, it returned:

{"outcome":"allow"}

in approximately 3 seconds.

The same reviewer then processed a backlog of queued approval requests over the following several minutes. Most of those reviews completed and allowed the actions within approximately 2–7 seconds.

This suggests the delay was in scheduling or dispatching the automatic reviewer, not in the reviewer evaluating the operation.

Incident 2: Git restoration never launched

Later, Codex attempted this narrow local restoration:

git checkout-index --force -- .editorconfig

It waited approximately 654 seconds before returning:

CreateProcess Rejected: The automatic permission approval review did not finish before its deadline.

Because the result was CreateProcess Rejected, PowerShell and Git were never actually launched. The elapsed time was spent waiting for automatic approval review.

I could not find a corresponding guardian review for this request before the deadline, suggesting that this approval was never dispatched to the reviewer in time.

Additional observations

• These were routine, narrowly scoped local operations.
• The reviewer allowed the first operation immediately once it actually received it.
• The session still had approvals_reviewer = "auto_review" configured.
• I did not observe quota exhaustion for this thread; local rate-limit records reported rate_limit_reached_type: null.
• This occurred in a long-running thread with multiple approval-gated operations and subagent activity.
• Restarting or moving to a fresh thread appears likely to clear the condition, which makes this look session- or dispatcher-state-related.

Although the original report is macOS-specific, this Windows case produces the exact same timeout and provides evidence that the reviewer may be dispatched late or starved behind a queue.

This may also be related to the stale long-running-thread reviewer state described in #22132.

Could this issue be expanded to cover Windows, or should I open a separate Windows-specific report?

I can reproduce this on Codex Desktop for Manjaro Linux.

A narrowly scoped git add requires escalation because .git is read-only
under the workspace-write sandbox. Instead of showing a manual approval prompt,
the request eventually fails with:

“The automatic permission approval review did not finish before its deadline.”

I explicitly approved git add and git commit in the conversation, but
repeated identical requests still timed out before execution. Normal workspace
edits and tests work correctly. No approval dialog appeared.

Codex Desktop version: [version]
Permission mode: [mode]
Time observed: 2026-08-13 [time], Europe/Warsaw