Windows: Force delete without confirmation

Resolved 💬 3 comments Opened Dec 27, 2025 by 448523760 Closed Jan 20, 2026
💡 Likely answer: A maintainer (etraut-openai, contributor) responded on this thread — see the highlighted reply below.

What version of Codex is running?

0.77.0

What subscription do you have?

no subscription

Which model were you using?

custom

What platform is your computer?

Microsoft Windows NT 10.0.26100.0 x64

What issue are you seeing?

The force delete functionality behaves inconsistently between Windows and Linux platforms when --ask-for-approval on-request is configured. On Windows, the operation executes without requesting user confirmation, while on Linux, a similar force delete operation (rm -rf) properly prompts for approval.

If such commands are executed without an explicit user confirmation step, the system may delete these files directly, increasing the risk of accidental or unintended file loss.

What steps can reproduce the bug?

Windows Platform:

  1. Create a test directory structure:

``powershell
mkdir test
echo "content" > test/test.txt
``

  1. Make test.txt read-only:

``powershell
attrib +r test/test.txt
``

  1. Verify that direct deletion is blocked (without admin privileges):

``powershell
cd test
rm test.txt
# Expected: Error - "You do not have sufficient access rights to perform this operation"
``

  1. Run codex with -a on-request and tell it to remove the test

```
cd ..
codex -a on-request
```

```codex
› delete the test folder

• I'll help you delete the test folder. Let me first check what's in the current directory and then remove the test
folder.

• Ran Get-ChildItem -Force
└

… +8 lines

─ Worked for 4s ────────────────────────────────────────────────────────────────────────────────────────────────────────

• Ran Remove-Item -Path 'test' -Recurse -Force
└ (no output)

─ Worked for 6s ────────────────────────────────────────────────────────────────────────────────────────────────────────

• Ran Get-ChildItem -Force
└

… +7 lines

```

What is the expected behavior?

ask user to approval before execute the command

Additional information

_No response_

View original on GitHub ↗

3 Comments

etraut-openai contributor · 8 months ago

Refer to this documentation about the sandboxing mechanism in Codex. The sandbox is implemented in MacOS and Linux. If you're using Windows, we recommend using Windows Subsystem for Linux (WSL).

We are in the process of implementing a sandbox mechanism for the native Windows environment. It's available in experimental form today, but there are still known holes that we are working to fix. Refer to the documentation here for details if you would like to try the experimental sandbox in Windows.

448523760 contributor · 8 months ago

Hi @etraut-openai,

I'd like to clarify to ensure we're on the same page regarding two distinct concepts:

  • Ask-for-approval: This is a user-facing decision stage that occurs before any command execution. It reflects the user's subjective choice to authorize or deny a requested action.
  • Sandboxing: This is a system-level runtime protection mechanism that applies during execution.

This separation matters because: if a user denies approval, the command should never reach the execution stage at all—and therefore, sandboxing should not be invoked.

Additionally, I submitted PR #8568, which flags force delete operations as dangerous. This prompts the user to explicitly confirm or cancel the action before execution, rather than relying on the sandbox to protect the system after the command has already been initiated.

anowardear062-svg · 8 months ago

Thanks