Fix Codex CLI approval policy and sandbox settings

Check what approval_policy (when Codex asks you) and sandbox_mode (what commands can touch) accept in your installed version, and fix errors from old settings.

[1] Check the version.

$ codex --versioncodex-cli 0.163.0

[2] List the accepted values. They change between versions, so the installed help is the reference.

$ codex --help | grep -A3 -E '^\s+-(s|a), '  -s, --sandbox <SANDBOX_MODE>          Select the sandbox policy to use when executing model-generated shell commands                    [possible values: read-only, workspace-write, danger-full-access]--  -a, --ask-for-approval <APPROVAL_POLICY>          Configure when the model requires human approval before executing a command

-a accepts on-request (the model decides when to ask) and never (no prompts; failures go straight back to the model). The sandbox modes, per the official docs:

• read-only — read access only.
• workspace-write — writes inside the workspace. Writes outside it and network access need approval; network is off by default.
• danger-full-access — no sandbox, no approvals. Not recommended.

[3] Set both values explicitly in config.toml.

approval_policy = "on-request"sandbox_mode = "workspace-write"

[4] If approval_policy = "untrusted" is set, Codex refuses to start. Delete that line.

$ codex exec "hi"Error: approval_policy = "untrusted" is no longer supported; remove this setting

Passing -c 'approval_policy="untrusted"' gives the same error, and -a untrusted gives invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'. To keep the stricter behavior, omit approval_policy and set trust_level = "untrusted" per project.

[projects."/path/to/project"]trust_level = "untrusted"

[5] Replace --full-auto with explicit options. 0.163.0 does not accept it.

$ codex exec --full-auto "hi"error: unexpected argument '--full-auto' found$ codex -a on-request -s workspace-write

[6] Add --strict-config to catch misspelled settings. Without it, unknown keys may be ignored. A bad value fails even without the flag.

$ codex --strict-config exec --skip-git-repo-check "hi"Error loading config.toml:~/.codex/config.toml:1:1: unknown configuration field `approval_polcy`$ codex exec "hi"Error loading config.toml: unknown variant `workspce-write`, expected one of `read-only`, `workspace-write`, `danger-full-access`in `sandbox_mode`

[7] If Codex asks before every command, find the cause first. Three things commonly trigger it:

• With a read-only sandbox, every write needs approval. Move up to workspace-write.
• Under workspace-write the network is off. Allow it if you need it.

[sandbox_workspace_write]network_access = true

• Inside writable folders, .git, .agents, .codex and .aws (when they are directories) stay read-only.

To auto-reject chosen kinds of prompts, use approval_policy = { granular = { ... } } (keys: sandbox_approval, rules, mcp_elicitations, request_permissions, skill_approval). To send approval requests to a reviewer agent first, set approvals_reviewer = "auto_review".