Windows: Force delete without confirmation
What version of Codex is running?
0.77.0
What subscription do you have?
no subscription
Which model were you using?
custom
What platform is your computer?
Microsoft Windows NT 10.0.26100.0 x64
What issue are you seeing?
The force delete functionality behaves inconsistently between Windows and Linux platforms when --ask-for-approval on-request is configured. On Windows, the operation executes without requesting user confirmation, while on Linux, a similar force delete operation (rm -rf) properly prompts for approval.
If such commands are executed without an explicit user confirmation step, the system may delete these files directly, increasing the risk of accidental or unintended file loss.
What steps can reproduce the bug?
Windows Platform:
- Create a test directory structure:
``powershell``
mkdir test
echo "content" > test/test.txt
- Make test.txt read-only:
``powershell``
attrib +r test/test.txt
- Verify that direct deletion is blocked (without admin privileges):
``powershell``
cd test
rm test.txt
# Expected: Error - "You do not have sufficient access rights to perform this operation"
- Run codex with
-a on-requestand tell it to remove the test
``````
cd ..
codex -a on-request
```codex
› delete the test folder
• I'll help you delete the test folder. Let me first check what's in the current directory and then remove the test
folder.
• Ran Get-ChildItem -Force
└
… +8 lines
─ Worked for 4s ────────────────────────────────────────────────────────────────────────────────────────────────────────
• Ran Remove-Item -Path 'test' -Recurse -Force
└ (no output)
─ Worked for 6s ────────────────────────────────────────────────────────────────────────────────────────────────────────
• Ran Get-ChildItem -Force
└
… +7 lines
```
What is the expected behavior?
ask user to approval before execute the command
Additional information
_No response_
3 Comments
Refer to this documentation about the sandboxing mechanism in Codex. The sandbox is implemented in MacOS and Linux. If you're using Windows, we recommend using Windows Subsystem for Linux (WSL).
We are in the process of implementing a sandbox mechanism for the native Windows environment. It's available in experimental form today, but there are still known holes that we are working to fix. Refer to the documentation here for details if you would like to try the experimental sandbox in Windows.
Hi @etraut-openai,
I'd like to clarify to ensure we're on the same page regarding two distinct concepts:
This separation matters because: if a user denies approval, the command should never reach the execution stage at all—and therefore, sandboxing should not be invoked.
Additionally, I submitted PR #8568, which flags
force deleteoperations as dangerous. This prompts the user to explicitly confirm or cancel the action before execution, rather than relying on the sandbox to protect the system after the command has already been initiated.Thanks