Repo-local .codex/config.toml sandbox_mode is ignored in Codex App

What version of the Codex App are you using (From “About Codex” dialog)?

26.616.10790.0

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

The Codex App appears to ignore repo-local .codex/config.toml sandbox settings after a recent update.

In my repository, .codex/config.toml contains:

approval_policy = "on-request"
sandbox_mode = "danger-full-access"

However, new Codex sessions were initialized with an effective filesystem sandbox of workspace-write instead of danger-full-access.

This caused Codex-run commands to fail or warn when accessing normal user-level files outside the workspace. For example, running this inside Codex:

git status --short

produced:

warning: unable to access 'C:\Users\username/.config/git/ignore': Permission denied

The same command run directly in my PowerShell did not produce the warning.
After I changed my global Codex config to use danger-full-access, the effective session sandbox changed to unrestricted and the same Codex-run git status --short command returned cleanly with no warning.

This suggests that global config is being honored, but repo-local .codex/config.toml is not taking precedence or is not being applied by the Codex App.

What steps can reproduce the bug?

1. On Windows, create or open a repo with a repo-local .codex/config.toml.
2. Set:

approval_policy = "on-request"
sandbox_mode = "danger-full-access"

1. Start a new Codex App session in that repo.
2. Ask Codex what sandbox is effective, or run a command that needs to read a normal user-level file outside the workspace.
3. Example command:

git status --short

1. Observe that the session is effectively workspace-write, and Git cannot read the default/global ignore path:

warning: unable to access 'C:\Users\username/.config/git/ignore': Permission denied

1. Run the same command directly in the user’s PowerShell. It succeeds without the warning.
2. Change the global Codex config to sandbox_mode = "danger-full-access".
3. Start/continue a Codex session and rerun:

git status --short

1. The command now succeeds without the warning, indicating the global config affected the effective sandbox while the repo-local config did not.

What is the expected behavior?

Repo-local .codex/config.toml should be applied for Codex App sessions opened in that repository.

If both global and repo-local config specify sandbox_mode, the documented/intended precedence should be respected. In particular, a repo-local setting of:

sandbox_mode = "danger-full-access"

should result in an effective unrestricted filesystem permission profile for that repo session, unless the App intentionally overrides it and clearly reports that override to the user.

Additional information

This reproduced in two separate Codex App sessions after the last update Model/Reasoning for each session was:
gpt-5.5 medium
gpt-5.5 high

Installed package observed from PowerShell:

OpenAI.Codex 26.616.10790.0
OpenAI.Codex_26.616.10790.0_x64__2p2nqsd0c76g0

The workaround is to set sandbox_mode = "danger-full-access" in the global Codex config. A command-local workaround for the Git warning is:

git -c core.excludesFile= status --short

But that only avoids this specific Git warning; it does not fix the underlying config precedence issue.