From c336c2c7d2349ef8a690ef3c350f6021e2503b45 Mon Sep 17 00:00:00 2001
From: Noah Lindner <noah@bevyl.ai>
Date: Tue, 8 Sep 2026 16:55:49 -0400
Subject: [PATCH] Threads run with full access; the VM is the sandbox

With a sandbox on, codex wanted an approval for every MCP tool call
and approvals are off, so no tool ran.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 src/codex.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/codex.ts b/src/codex.ts
index b2bfd7a..1ae9cd9 100644
--- a/src/codex.ts
+++ b/src/codex.ts
@@ -59,7 +59,7 @@ export class Codex {
     return codexThread({
       tools,
       workingDirectory: this.workspaces[role],
-      sandboxMode: "workspace-write",
+      sandboxMode: "danger-full-access",
       networkAccessEnabled: true,
       ...(tier.model ? { model: tier.model } : {}),
       ...(tier.effort ? { modelReasoningEffort: tier.effort } : {}),