Hey, I am trying to understand why I wasn't able to run `go build .` (same issue as in https://github.com/openai/codex/issues/207). To iterate quicker, I decided to not run Codex in TUI mode, and instead just use: ```bash codex debug seatbelt go build . ``` For context, my `config.toml` looks like this: ```toml model = "gpt-5-codex" sandbox_mode = "workspace-write" [sandbox_workspace_write] writable_roots = [ "/Users/mvalais/Library/Caches", "/Users/mvalais/go/pkg/mod/cache", ] ```

codex debug seatbelt ignores sandbox_mode in ~/.codex/config.toml

Resolved 💬 3 comments Opened Sep 24, 2025 by maelvls Closed Jan 10, 2026

💡 Likely answer: A maintainer (bolinfest, collaborator) responded on this thread — see the highlighted reply below.

Hey,

I am trying to understand why I wasn't able to run go build . (same issue as in https://github.com/openai/codex/issues/207). To iterate quicker, I decided to not run Codex in TUI mode, and instead just use:

codex debug seatbelt go build .

For context, my config.toml looks like this:

model = "gpt-5-codex"
sandbox_mode = "workspace-write"
[sandbox_workspace_write]
writable_roots = [
    "/Users/mvalais/Library/Caches",
    "/Users/mvalais/go/pkg/mod/cache",
]

I later realized that the codex debug seatbelt command was simply ignoring the sandbox_mode. I've dug into the code and found this:
https://github.com/openai/codex/blob/af6304c641df4dd7a2fc11974840da0ee5a855b7/codex-rs/cli/src/debug_sandbox.rs#L66

(had to run lldb to find that out)

So it looks like the only way to test whether my config.toml is correct is to replicate what I have in my config.toml using --full-auto (since --sandbox workspace-write isn't supported either).

Is this behavior intentional?

Thanks for taking a look!

View original on GitHub ↗

3 Comments

bolinfest collaborator · 10 months ago

It's somewhat intentional in that we currently use this for ad-hoc debugging and haven't polished the args to the point where it's something we want to promote. So you're right that --full-auto is the best way to approximate workspace-write at the moment.

lastzero · 10 months ago

Based on GPT-5 Thinking's recommendation, I used Codex CLI profiles to switch the authentication method between "apikey" for larger tasks and "chatgpt" for quick tasks.

This issue prevents me from using profiles, so hopefully it will be resolved in an upcoming release! 🙏

etraut-openai contributor · 7 months ago

Closing out old bugs.