VSCode Codex doesn't respect sandbox_workspace_write.writable_roots in config.toml

Resolved 💬 4 comments Opened Dec 15, 2025 by yiteng-guo Closed Dec 16, 2025

💡 Likely answer: A maintainer (gpeal, contributor) responded on this thread — see the highlighted reply below.

What version of Codex is running?

codex-cli 0.72.0

What subscription do you have?

azure foundry

Which model were you using?

gpt-5.2

What platform is your computer?

_No response_

What issue are you seeing?

I think vscode-codex overwrites the sandbox_workspace_write.writable_roots with the current project dir so it doesn't respect the one in config.toml

What steps can reproduce the bug?

In vscode-codex extension (version 0.4.51), asking codex

> what's your sandbox_workspace_write.writable_roots value?

sandbox_workspace_write.writable_roots is:
- /path/to/the_current_project_opened_in_vscode

even if in config.toml, I set

[sandbox_workspace_write]
writable_roots = ["/path/to/my_other_project"]

If you run codex cli in the current project dir and ask them the same question, it responds

• writable_roots is:
  - /path/to/my_other_project

What is the expected behavior?

vscode-codex should behave in the same way as codex cli.

Additional information

_No response_

View original on GitHub ↗

4 Comments

gpeal contributor · 8 months ago

This is correct, the extension users your open workspace folders as writable roots

yiteng-guo · 8 months ago

hi, I should add a bit more context here. I have git worktree setup such that

.../project
.../project-worktree1
.../project-worktree2

For any git operation I need to perform in project-worktree1, it needs to modify the main git repo ../project/.git/worktrees/project-worktree1/index. codex sandbox doesn't allow this so I have to whitelist .../project/.git to get this work.

This works in codex cli because cli includes both sandbox_workspace_write.writable_roots and the current working directory instead of overwriting it. However, this doesn't work in vscode-codex since it only includes the current working directory. I believe the cli behavior is correct where the current working directory should be appended to writable_roots instead of overriding writable_roots.

Fwiw, you also have this type of issue in non-git-worktree use case if you ever want to modify any file in a folder outside the workspace (e.g. a special tmp dir, some configuration dir, and etc)

Finally, I'd argue that the docs https://developers.openai.com/codex/local-config/ says additional writable roots so vscode-codex shouldn't override it. If you do still believe the current behavior is correct, I'd like to know how to handle the git worktree use case as I described above.

gpeal contributor · 8 months ago

Thanks for the additional info, I'll take this back to the team for further discussion.

yiteng-guo · 8 months ago

nvm - I found this #5041. I was just under the impression that vscode-codex reads ~/.codex/config.toml similar to many other users in that thread. The custom mode works for me. It would be nice if you can add that custom mode to the documentation here https://developers.openai.com/codex/ide