Codex nuked the workspace

What version of Codex is running?

codex-cli 0.46.0

Which model were you using?

gpt-5-codex

What platform is your computer?

Linux 6.6.87.2-microsoft-standard-WSL2 x86_64 x86_64

What steps can reproduce the bug?

I can't reproduce it. I gave a prompt like "I've merged the PR for issue 24. Update main and start implementing issue 25". The model proceeded to nuke the entire local repo and then asked permission to delete the folder containing it.

I denied permission and tried to get it to restore the missing repo but then codex just hung for 20 minutes. Manually cloning the repo only took about 10s.

Since then when I open codex it claims the network is restricted unless I open it with the --sandbox danger-full-access mode. Below is my ~/.codex/config.toml file

What is the expected behavior?

I've used that same pattern of prompt in the past. I expected it to switch to main, do a git pull, use gh issue view 25 and start working on a new branch. This was a new and wholly unexpected result.

What do you see instead?

Codex nuked my workspace and refuses to provide network access unless I give it full access from the sandbox.

Additional information

It was hung on trying to re-clone the repo it nuked, so I wasn't able to grab the session id from the terminal. I zipped up the log, sessions, auth.json, history.jsonl, and version.json from when I opened this issue. I don't know if that contains any sensitive information (like the api key I redacted from the config.toml). Let me know what's safe to upload and I'd be happy to provide it.

# =====================================================================
# Codex Configuration File
# Location: ~/.codex/config.toml
# Version: Compatible with Codex 0.44.x
# ---------------------------------------------------------------------
# Controls sandbox behavior, approvals, trusted projects, and defaults.
# =====================================================================

# ---------------------------------------------------------------------
# Workspace Settings
# ---------------------------------------------------------------------
[api]
key = "sk-redacted"

[workspace]
# Root directory where Codex operates (optional)
# root = "/home/youruser/dev"
# Temporary sandbox path (optional)
# tmp_dir = "/tmp/codex"

# ---------------------------------------------------------------------
# Logging (Optional)
# ---------------------------------------------------------------------
[logging]
log_level = "info"
# log_file = "/home/youruser/.codex/codex.log"

# ---------------------------------------------------------------------
# Sandbox Defaults (Optional)
# ---------------------------------------------------------------------
[sandbox]
enabled = true
restrict_network = false
timeout = 120
env_passthrough = ["PATH", "HOME", "GITHUB_TOKEN"]
mount_binaries = [
    "gh",
    "git",
    "cargo",
    "/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe",
    "/mnt/c/Windows/System32/cmd.exe"
]


# ---------------------------------------------------------------------
# Trusted Projects
# ---------------------------------------------------------------------
# These paths are considered safe; Codex will not require re-approval
# for local agent or command operations inside them.
[projects."/mnt/c/Users/jmbat/Development/ForgeOfTales"]
trust_level = "trusted"

[projects."/mnt/c/Users/jmbat/Development/FluentAssert"]
trust_level = "trusted"

[projects."/mnt/c/Users/jmbat/Development/StorySpider"]
trust_level = "trusted"

[projects."/home/jmbattista/Development/BalexdaManagementCDK"]
trust_level = "trusted"

# ---------------------------------------------------------------------
# Approval Policy
# ---------------------------------------------------------------------
[approvals]
policy = "auto"

# Gradle host wrapper
[[allow.commands]]
args_startswith = ["python3", "tools/codex/scripts/host_gradle.py"]
description = "Allow codex to run gradle outside the sandbox, which is necessary because of socket loop back"

[[allow.commands]]
args = ["python3", "tools/codex/scripts/verify_gradle_outputs.py"]
description = "Allow codex to read resutls of running gradle outside the sandbox, which is necessary because of socket loop back"

[[approvals.rules]]
command = "python3"
args_startswith = ["tools/codex/scripts/host_gradle.py"]
description = "Allow codex to run gradle outside the sandbox."

[[approvals.rules]]
command = "python3"
args_startswith = ["tools/codex/scripts/verify_gradle_outputs.py"]
description = "Allow codex to verify results of gradle run outside the sandbox."

# Github Issues
[[approvals.rules]]
command = "gh"
args = ["issue", "list"]

[[approvals.rules]]
command = "gh"
args_startswith = ["issue", "view"]

# Github Labels
[[approvals.rules]]
command = "gh"
args = ["label", "list"]

# Github PRs
[[approvals.rules]]
command = "gh"
args_startswith = ["pr", "create"]

[[approvals.rules]]
command = "gh"
args_startswith = ["pr", "edit"]

[[approvals.rules]]
command = "gh"
args_startswith = ["pr", "status"]

[[approvals.rules]]
command = "gh"
args_startswith = ["pr", "view"]

[[approvals.rules]]
command = "gh"
args_startswith = ["run", "list"]

[[approvals.rules]]
command = "gh"
args_startswith = ["run", "view"]

[[approvals.rules]]
command = "gh"
args_startswith = ["api", "repos/", "*/pulls/*/comments"]
description = "Allow Codex to post PR review comments via gh api"

[[approvals.rules]]
command = "gh"
args_startswith = ["api", "repos/", "*/pulls/*/comments/*/replies"]
description = "Allow Codex to post replies to PR comments via gh api"

[[approvals.rules]]
command = "gh"
args_startswith = ["api", "repos/", "*/pulls/*/reviews"]
description = "Allow Codex to create GitHub review threads"

# Git commands - push
[[approvals.rules]]
command = "git"
args_startswith = ["push", "origin", "feature/"]

[[approvals.rules]]
command = "git"
args_startswith = ["push", "origin", "fix/"]

[[approvals.rules]]
command = "git"
args_startswith = ["push", "origin", "chore/"]

# Git commands - pull
[[approvals.rules]]
command = "git"
args_startswith = ["pull", "origin", "master"]

[[approvals.rules]]
command = "git"
args_startswith = ["fetch", "origin"]

# Git commands - other
[[approvals.rules]]
command = "git"
args_startswith = ["checkout"]

# ============================================================
# Bash -lc variants for Codex CLI (duplicated from direct rules)
# ============================================================

# --- Github Issues ---
[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "gh issue list"]

[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "gh issue view"]

# --- Github Labels ---
[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "gh label list"]

# --- Github PRs ---
[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "gh pr create"]

[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "gh pr edit"]

[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "gh pr status"]

[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "gh pr view"]

[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "gh run list"]

[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "gh run view"]

[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "gh api repos/"]
description = "Allow Codex to post PR review comments/replies via gh api (bash wrapper)"

# --- Git commands - push ---
[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "git push origin feature/"]

[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "git push origin fix/"]

[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "git push origin chore/"]

# --- Git commands - pull/fetch ---
[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "git pull origin master"]

[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "git fetch origin"]

# --- Git commands - checkout ---
[[approvals.rules]]
command = "bash"
args_startswith = ["-lc", "git checkout"]


# ---------------------------------------------------------------------
# Model Provider Settings (Optional)
# ---------------------------------------------------------------------
# [models]
# provider = "openai"
# default_model = "gpt-5"
# max_context = 16384