Codex 0.147.0: Workspace writes unexpectedly require approval with workspace-write + on-request
What version of Codex CLI is running?
codex-cli 0.147.0
What subscription do you have?
Plus
Which model were you using?
luna xhigh
What platform is your computer?
Linux 6.18.33.2-microsoft-standard-WSL2 x86_64 unknown
What terminal emulator and version are you using (if applicable)?
PowerShell 7.6.5
Codex doctor report
Codex Doctor v0.147.0 · linux-x86_64
Environment
✓ system en-US
os Arch Linux [64-bit]
OS language en-US
LANG en_US.UTF-8
VISUAL not set
EDITOR not set
✓ runtime other
version 0.147.0
install method other
commit unknown
executable /usr/bin/codex
✓ install consistent
context other
managed by npm: no · bun: no · pnpm: no · package root —
PATH entries (4) /usr/sbin/codex
/usr/bin/codex
/sbin/codex
… (full list with --all)
✓ search ripgrep 15.2.0 (system, rg)
search command rg
search provider system
search command readiness ripgrep 15.2.0
✓ git git version 2.55.0
selected git /usr/sbin/git
version git version 2.55.0
exec path /usr/lib/git-core
repo detected true
repo root /mnt/c/Users/Naj/git/ffishm
.git entry directory
branch master
PATH entries (4) /usr/sbin/git
/usr/bin/git
/sbin/git
… (full list with --all)
✓ terminal Windows Terminal
terminal Windows Terminal
stdin is terminal true
stdout is terminal true
stderr is terminal true
terminal size 133x35
color output enabled
effective locale en_US.UTF-8
WSL_DISTRO_NAME present
WSL_INTEROP present
WAYLAND_DISPLAY present
DISPLAY present
WT_SESSION present
✓ title default · project ffishm
title source default
title items activity, project-name
activity item true
project source git repo root
project value ffishm
✓ state databases healthy
CODEX_HOME ~/.codex (dir)
log dir ~/.codex/log (missing)
sqlite home ~/.codex (dir)
state DB ~/.codex/state_5.sqlite (file) · integrity ok
log DB ~/.codex/logs_2.sqlite (file) · integrity ok
goals DB ~/.codex/goals_1.sqlite (file) · integrity ok
memories DB ~/.codex/memories_1.sqlite (file) · integrity ok
active rollouts 5 files · 25.61 MB (avg 5.12 MB)
archived rollouts 0 files · 0 B (avg 0 B)
queue DB ~/.codex/queue_1.sqlite (file)
queue DB integrity ok
thread history DB ~/.codex/thread_history_1.sqlite (file)
thread history DB integrity ok
✓ threads rollout files and state DB thread inventory agree
default model provider openai
rollout DB active files 5
rollout DB archived files 0
rollout DB scan errors 0
rollout DB malformed file names 0
rollout DB scan cap reached false
rollout DB rows 5
rollout DB active rows 5
rollout DB archived rows 0
rollout DB missing active rows 0
rollout DB missing archived rows 0
rollout DB stale rows 0
rollout DB archive mismatches 0
rollout DB duplicate rollout thread ids 0
rollout DB duplicate DB paths 0
rollout DB model providers openai=5
rollout DB sources cli=5
Configuration
✓ config loaded
model gpt-5.6-luna · openai
cwd /mnt/c/Users/Naj/git/ffishm
config.toml ~/.codex/config.toml
config.toml parse ok
MCP servers 0
feature flags 39 enabled · 0 overridden (full list with --all)
✓ auth auth is configured
auth storage mode File
auth file ~/.codex/auth.json
stored auth mode chatgpt
stored API key false
stored ChatGPT tokens true
stored agent identity false
✓ mcp no MCP servers configured
✓ sandbox restricted fs + restricted network · approval OnRequest
approval policy OnRequest
filesystem sandbox restricted
network sandbox restricted
linux helper ~/.codex/tmp/arg0/codex-…zrj/codex-linux-sandbox
execve wrapper helper ~/.codex/tmp/arg0/codex-…rj/codex-execve-wrapper
Updates
✓ updates update configuration is locally consistent
startup update check true
update action manual or unknown
version cache ~/.codex/version.json
cached latest version 0.147.0
last checked at 2026-08-18 09:23 UTC
latest version 0.147.0
latest version status current version is not older
Connectivity
✓ network no proxy env vars
proxy env vars none
✓ websocket connected (HTTP 101 Switching Protocols) · 15s timeout
model provider openai
provider name OpenAI
wire API responses
supports websockets true
proxy env vars none
connect timeout 15000 ms
auth mode chatgpt
endpoint wss://chatgpt.com/backend-api/<redacted>
DNS 2 IPv4, 2 IPv6, first IPv4
handshake result HTTP 101 Switching Protocols
reasoning header false
models etag present true
server model present false
✓ reachability active provider endpoints are reachable over HTTP
reachability mode ChatGPT auth
ChatGPT base URL https://chatgpt.com/backend-api/ reachable (HTTP 404)
Background Server
○ app-server not running (ephemeral mode)
daemon state dir ~/.codex/app-server-daemon
settings ~/.codex/app-server-daemon/settings.json (missing)
pid file ~/.codex/app-server-daemon/app-server.pid (missing)
update-loop pid file ~/.codex/app-server-daem…/app-server-updater.pid (missing)
control socket ~/.codex/app-server-cont…app-server-control.sock
status not running
mode ephemeral
─────────────────────────────────────────────────────────────
17 ok · 1 idle · 0 warn · 0 fail ok
--summary compact output --all expand truncated lists
--json redacted reportWhat issue are you seeing?
Summary
With Codex CLI 0.147.0 on Arch Linux under WSL, workspace-write + on-request unexpectedly prompts for approval when modifying files inside the configured workspace.
Environment
Codex CLI: 0.147.0
OS: Arch Linux x86_64 under WSL
Terminal: Windows Terminal
Git repository: /mnt/c/Users/Naj/git/ffishm
Filesystem: Windows-mounted /mnt/c
Model: gpt-5.6-luna
Configuration
~/.codex/config.toml:
model = "gpt-5.6-luna"
model_reasoning_effort = "xhigh"
approvals_reviewer = "auto_review"
[projects."/mnt/c/Users/Naj/git/ffishm"]
trust_level = "trusted"
codex doctor reports:
sandbox restricted fs + restricted network · approval OnRequest
approval policy OnRequest
filesystem sandbox restricted
network sandbox restricted
Expected behavior
With workspace-write and on-request:
File operations within the workspace should execute without approval.
Operations requiring access outside the workspace should require approval.
Specifically, modifying /mnt/c/Users/Naj/git/ffishm/... should not trigger an approval prompt.
Actual behavior
Codex prompts for approval for actions that modify files inside the configured workspace.
The workspace is a trusted project:
/mnt/c/Users/Naj/git/ffishm
but workspace-local operations still require approval.
Reproduction
Start Codex from the repository:
cd /mnt/c/Users/Naj/git/ffishm
codex -s workspace-write -a on-request
Ask Codex to create or modify a file in the current repository, for example:
Create codex-test.txt containing "hello".
Observed: Codex requests approval for the workspace-local file operation.
Expected: The operation executes without an approval prompt.
For comparison, an operation outside the workspace should require approval, e.g.:
Create /tmp/codex-test.txt containing "hello".
Additional information
codex doctor reports the configuration as valid and the effective approval policy as OnRequest; there are no configuration parse errors or filesystem sandbox warnings.
The issue appears to be specifically related to approval behavior for workspace-local operations under workspace-write, potentially involving the /mnt/c WSL-mounted filesystem.
What steps can reproduce the bug?
initiate any action inside the workspace normally requiring approval with more restrictive settings.
What is the expected behavior?
no approval
Additional information
_No response_
2 Comments
Could you paste the exact approval card and the tool/command Codex attempted, with paths redacted if needed? In particular, it would help to know whether the tool call itself requested elevated sandbox permissions or whether the sandbox rejected an ordinary workspace-scoped write.
That distinction separates an unnecessary model-requested escalation from a workspace root/path classification bug (for example around /mnt/c). I am also a Pro 20x user and can compare the behavior in a matching WSL setup once the exact call and approval reason are available.
So sorry, the approval card isn't available after approving. I can't copy it.
I'm now trying:
model = "gpt-5.6-luna"
model_reasoning_effort = "xhigh"
approvals_reviewer = "user"
sandbox_mode = "workspace-write"
approval_policy = "never"
[projects."/mnt/c/Users/Naj/git/ffishm"]
trust_level = "trusted"
[tui]
status_line = ["model-with-reasoning", "current-dir", "context-remaining", "weekly-limit", "used-tokens", "total-input-tokens", "total-output-tokens"]
status_line_use_colors = true
[sandbox_workspace_write]
network_access = true
writable_roots = [
"/mnt/e/shared-project",
"/mnt/e/another-directory",
]