Custom (config.toml) option disappears for never + danger-full-access
Open 💬 2 comments Opened Aug 14, 2026 by heyarny
💡 Likely answer: A maintainer (github-actions[bot], contributor)
responded on this thread — see the highlighted reply below.
What issue are you seeing?
The Custom (config.toml) permission option disappears when config.toml contains:
approval_policy = "never"
sandbox_mode = "danger-full-access"This affects the ChatGPT Desktop app, Codex VS Code extension, and Codex CLI.
What steps can reproduce the bug?
- Set the configuration above.
- Open the permission selector.
- Custom (config.toml) is missing. With another combination, such as
on-requestplusworkspace-write, it appears normally.
What is the expected behavior?
Keep Custom (config.toml) available, or show Full access (from config.toml).
Additional information
Version 26.727.40816 still showed Custom (config.toml) for this configuration. In 26.810.41047, only the built-in options remain. Although the configuration is effectively equivalent to Full access, the UI no longer indicates that permissions came from config.toml or provides a way to select the configuration-defined mode again.
In the comparison screenshot where Full access is shown, it was selected manually; the issue is the missing Custom (config.toml) option.
2 Comments
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
Resolution: migrating from the legacy sandbox setting to the current built-in permission profile restored the Desktop UI option after restarting the app.
I removed
sandbox_mode = "danger-full-access"(the current configuration reference says not to combine it withdefault_permissions) and retained[windows] sandbox = "elevated"plus the trusted project setting. After the restart, “Do anything” was selectable again.This looks like the Desktop selector recognises the new
default_permissionsprofile but not the legacysandbox_modeform.