codex-cli 0.133.0` fails to execute tool commands under the default `bwrap` sandbox when Codex is launched from `~/.local/bin/codex`

What version of Codex CLI is running?

0.133.0

What subscription do you have?

plus

Which model were you using?

gpt-5.5

What platform is your computer?

PRETTY_NAME="Ubuntu 22.04.5 LTS"

What terminal emulator and version are you using (if applicable)?

Mate Terminal v1.26.0

Codex doctor report

What issue are you seeing?

## Summary

codex-cli 0.133.0 fails to execute tool commands under the default bwrap sandbox when Codex is launched from ~/.local/bin/codex. The same binary works when copied into the workspace and
launched as ./codex.

What steps can reproduce the bug?

## Reproduction

  Start Codex from ~/.local/bin/codex:

  cd ~/bin
  codex

  Then ask Codex to run:

  pwd

  The command fails before execution with:

  bwrap: execvp /home/jk/.codex/tmp/arg0/codex-arg0.../codex-linux-sandbox: No such file or directory

  The generated launcher exists and resolves on the host:

  readlink /home/jk/.codex/tmp/arg0/codex-arg0.../codex-linux-sandbox
  # /home/jk/.local/bin/codex

  readlink -f /home/jk/.codex/tmp/arg0/codex-arg0.../codex-linux-sandbox
  # /home/jk/.local/bin/codex

  ls -lL /home/jk/.codex/tmp/arg0/codex-arg0.../codex-linux-sandbox
  # -rwx------ ... /home/jk/.codex/tmp/arg0/.../codex-linux-sandbox

## Workaround

  Copying the exact same Codex binary into the workspace and launching it directly fixes the problem:

  cp ~/.local/bin/codex ~/bin/codex
  chmod 755 ~/bin/codex
  cd ~/bin
  ./codex

  After launching this way, tool commands such as pwd execute successfully:

  /home/jk/bin

What is the expected behavior?

## Expected Behavior

  Tool commands should execute successfully regardless of whether Codex is launched from ~/.local/bin/codex or ~/bin/codex, assuming the binary exists and is executable.

## Actual Behavior

  When launched from ~/.local/bin/codex, Codex creates a sandbox launcher under:

  ~/.codex/tmp/arg0/.../codex-linux-sandbox

  as an absolute symlink to:

  /home/jk/.local/bin/codex

  bwrap then fails to execvp that launcher with ENOENT.

## Suspected Cause

  The launcher path exists on the host, but inside the bwrap filesystem namespace the absolute symlink target /home/jk/.local/bin/codex appears not to be visible or resolvable. Copying the
  binary into the workspace avoids the issue, suggesting the sandbox bind mounts include the workspace path but not the absolute symlink target under ~/.local/bin.

Additional information

## Environment

• Codex CLI version: codex-cli 0.133.0
• Install method: GitHub release tarball, not npm
• Binary: codex-x86_64-unknown-linux-musl
• OS: Ubuntu 22.04.5 LTS (Jammy Jellyfish)
• Kernel: Linux vmu22 5.15.0-177-generic #187-Ubuntu SMP Sat Apr 11 22:54:33 UTC 2026 x86_64 GNU/Linux
• bubblewrap: 0.6.1
• Working directory: /home/jk/bin

## Installation Details

Downloaded:

```bash
wget https://github.com/openai/codex/releases/download/rust-v0.133.0/codex-x86_64-unknown-linux-musl.tar.gz

Checksum verified:

d06019ab9c35d281b78dc2ebb2ae55c2bb97ea11bf7f452bafe390eddb0034ef codex-x86_64-unknown-linux-musl.tar.gz

Installed with:

mkdir -p ~/.local/opt/codex/0.133.0
mkdir -p ~/.local/bin
tar -xzf codex-x86_64-unknown-linux-musl.tar.gz -C ~/.local/opt/codex/0.133.0
chmod 700 ~/.local/opt/codex/0.133.0/codex-x86_64-unknown-linux-musl
cp ~/.local/opt/codex/0.133.0/codex-x86_64-unknown-linux-musl ~/.local/bin/codex
chmod 755 ~/.local/bin
chmod 755 ~/.local/bin/codex

The binary itself works:

/home/jk/.local/bin/codex --version
# codex-cli 0.133.0

file reports:

/home/jk/.local/bin/codex: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped