feat(codex): update managed defaults - #2074
Conversation
|
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
📝 WalkthroughWalkthroughCodex configuration files now define expanded model and execution policies, desktop runtime preferences, turn notifications, and enabled bundled computer-use and browser plugins. ChangesCodex configuration
Estimated code review effort: 2 (Simple) | ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the configuration files config.toml and config.tpl.toml to introduce new settings for reasoning efforts, approval policies, sandbox modes, desktop behaviors, and bundled plugins. The review highlights a critical security vulnerability where combining approval_policy = "never" with sandbox_mode = "danger-full-access" allows arbitrary command execution on the host system, risking remote code execution. Additionally, there are consistency issues with key casing, specifically mixing kebab-case with snake_case at the root level, and mixing camelCase with kebab-case under the [desktop] section.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| approval_policy = "never" | ||
| sandbox_mode = "danger-full-access" |
There was a problem hiding this comment.
Setting approval_policy = "never" in conjunction with sandbox_mode = "danger-full-access" presents a severe security risk. This configuration allows the language model to execute arbitrary commands on the host system without any user confirmation or sandboxing boundaries. If the model is subjected to prompt injection (e.g., via untrusted web search results or repository files), an attacker could achieve full remote code execution (RCE) on the host machine. Consider requiring approval for tool execution or using a restricted sandbox mode.
| approval_policy = "never" | ||
| sandbox_mode = "danger-full-access" |
There was a problem hiding this comment.
Setting approval_policy = "never" in conjunction with sandbox_mode = "danger-full-access" presents a severe security risk. This configuration allows the language model to execute arbitrary commands on the host system without any user confirmation or sandboxing boundaries. If the model is subjected to prompt injection (e.g., via untrusted web search results or repository files), an attacker could achieve full remote code execution (RCE) on the host machine. Consider requiring approval for tool execution or using a restricted sandbox mode.
| suppress_unstable_features_warning = true | ||
| web_search = "cached" | ||
| model = "gpt-5.6-sol" | ||
| enabled-reasoning-efforts = ["medium", "xhigh"] |
There was a problem hiding this comment.
The key enabled-reasoning-efforts uses kebab-case, whereas all other root-level configuration keys in this file (such as model_reasoning_effort, approval_policy, sandbox_mode, etc.) use snake_case. To maintain consistency and avoid potential configuration parsing issues, please use snake_case (enabled_reasoning_efforts).
| enabled-reasoning-efforts = ["medium", "xhigh"] | |
| enabled_reasoning_efforts = ["medium", "xhigh"] |
| preventSleepWhileRunning = true | ||
| show-context-window-usage = true | ||
| notifications-turn-mode = "always" | ||
| composerEnterBehavior = "cmdIfMultiline" |
There was a problem hiding this comment.
The keys within the [desktop] section use inconsistent casing styles, mixing camelCase (preventSleepWhileRunning, composerEnterBehavior) and kebab-case (show-context-window-usage, notifications-turn-mode). If the underlying application supports a consistent casing style, please standardize these keys to use a single convention (e.g., all camelCase or all kebab-case) to improve readability and maintainability.
| suppress_unstable_features_warning = true | ||
| web_search = "cached" | ||
| model = "__GPT__" | ||
| enabled-reasoning-efforts = ["medium", "xhigh"] |
There was a problem hiding this comment.
The key enabled-reasoning-efforts uses kebab-case, whereas all other root-level configuration keys in this file (such as model_reasoning_effort, approval_policy, sandbox_mode, etc.) use snake_case. To maintain consistency and avoid potential configuration parsing issues, please use snake_case (enabled_reasoning_efforts).
| enabled-reasoning-efforts = ["medium", "xhigh"] | |
| enabled_reasoning_efforts = ["medium", "xhigh"] |
| preventSleepWhileRunning = true | ||
| show-context-window-usage = true | ||
| notifications-turn-mode = "always" | ||
| composerEnterBehavior = "cmdIfMultiline" |
There was a problem hiding this comment.
The keys within the [desktop] section use inconsistent casing styles, mixing camelCase (preventSleepWhileRunning, composerEnterBehavior) and kebab-case (show-context-window-usage, notifications-turn-mode). If the underlying application supports a consistent casing style, please standardize these keys to use a single convention (e.g., all camelCase or all kebab-case) to improve readability and maintainability.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@config/codex/config.tpl.toml`:
- Around line 4-11: Replace the unrestricted approval and sandbox settings with
safer defaults: update approval_policy to require user confirmation and
sandbox_mode to a safe mode in config/codex/config.tpl.toml lines 4-11, then
apply the same settings in config/codex/config.toml lines 4-11 so the generated
configuration preserves them.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e3d1fae8-c19a-4dca-a3ef-ea5ba522577e
📒 Files selected for processing (2)
config/codex/config.tomlconfig/codex/config.tpl.toml
| enabled-reasoning-efforts = ["medium", "xhigh"] | ||
| model_reasoning_effort = "xhigh" | ||
| approval_policy = "never" | ||
| sandbox_mode = "danger-full-access" | ||
| personality = "pragmatic" | ||
| model_verbosity = "low" | ||
| model_reasoning_summary = "concise" | ||
| notify = ["turn-ended"] |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy lift
Critical security risk: unrestricted AI access.
Setting approval_policy = "never" and sandbox_mode = "danger-full-access" while enabling the computer-use and browser plugins grants the AI model unrestricted, unapproved access to execute arbitrary actions on the host system. This is extremely dangerous, as it exposes the system to severe risks including Prompt Injection leading to Remote Code Execution (RCE) or complete system compromise. The issue stems from the template and propagates to the final configuration.
config/codex/config.tpl.toml#L4-L11: changeapproval_policyto require user confirmation (e.g.,"always") and utilize a safersandbox_mode(e.g.,"safe").config/codex/config.toml#L4-L11: ensure these safer defaults are reflected in the generated configuration.
📍 Affects 2 files
config/codex/config.tpl.toml#L4-L11(this comment)config/codex/config.toml#L4-L11
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@config/codex/config.tpl.toml` around lines 4 - 11, Replace the unrestricted
approval and sandbox settings with safer defaults: update approval_policy to
require user confirmation and sandbox_mode to a safe mode in
config/codex/config.tpl.toml lines 4-11, then apply the same settings in
config/codex/config.toml lines 4-11 so the generated configuration preserves
them.
![indent-zero[bot]](https://avatars.githubusercontent.com/in/1426746?s=60&v=4){kind=small}
| personality = "pragmatic" | ||
| model_verbosity = "low" | ||
| model_reasoning_summary = "concise" | ||
| notify = ["turn-ended"] |
There was a problem hiding this comment.
notify is an external command, not an event list. Codex's config.schema.json defines notify as array<string> — 'Optional external command to spawn for end-user notifications' — and the sample config uses it as notify = ["notify-send", "Codex"]. With notify = ["turn-ended"], Codex will attempt to exec("turn-ended", ...) on every notification event and fail with ENOENT (no such binary on PATH).
On top of that, this is redundant with the existing hook path — config/codex/hooks.json already registers ~/.codex/hooks/notify.sh (and pushover.sh) on the Stop event, which is exactly the 'turn ended' case.
Recommend deleting this line (and the mirrored one in config.tpl.toml:11). If you actually want a second, top-level notifier, point it at a real script, e.g. notify = ["$HOME/.codex/hooks/notify.sh"].
| notify = ["turn-ended"] |
| suppress_unstable_features_warning = true | ||
| web_search = "cached" | ||
| model = "gpt-5.6-sol" | ||
| enabled-reasoning-efforts = ["medium", "xhigh"] |
There was a problem hiding this comment.
Unrecognized key — silently ignored. Codex's codex-rs/core/config.schema.json has no enabled_reasoning_efforts (nor enabled-reasoning-efforts) property, so this line has no effect on which reasoning efforts are available in the picker. The rest of this file also uses snake_case for CLI keys, so even if a similarly-named key existed it would likely be enabled_reasoning_efforts. Recommend removing this line in both config.toml and config.tpl.toml (or replacing with the correct key once verified against the Codex release you're targeting).
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
3 issues found and verified against the latest diff
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="config/codex/config.toml">
<violation number="1" location="config/codex/config.toml:6">
P1: All managed Codex sessions now run without approval prompts and with unrestricted host access, so a mistaken or prompt-injected command can alter or expose files without confirmation. A safer managed default would pair `approval_policy = "on-request"` with `sandbox_mode = "workspace-write"`, leaving unrestricted execution to an explicit opt-in profile or command.</violation>
<violation number="2" location="config/codex/config.toml:11">
P2: Turn-end notifications will not invoke a notification hook because `notify` treats the first array element as the executable, not as an event selector. Configuring an actual executable command (or relying solely on the desktop notification setting) would make the notification behavior functional.</violation>
</file>
<file name="config/codex/config.tpl.toml">
<violation number="1" location="config/codex/config.tpl.toml:11">
P2: Turn-completion notifications will not run because `notify` names `turn-ended` as the executable rather than an event selector. A real executable plus an adapter for Codex's argument-based JSON payload, or an intentionally empty `notify`, would avoid the failed invocation.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| approval_policy = "never" | ||
| sandbox_mode = "danger-full-access" |
There was a problem hiding this comment.
P1: All managed Codex sessions now run without approval prompts and with unrestricted host access, so a mistaken or prompt-injected command can alter or expose files without confirmation. A safer managed default would pair approval_policy = "on-request" with sandbox_mode = "workspace-write", leaving unrestricted execution to an explicit opt-in profile or command.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At config/codex/config.toml, line 6:
<comment>All managed Codex sessions now run without approval prompts and with unrestricted host access, so a mistaken or prompt-injected command can alter or expose files without confirmation. A safer managed default would pair `approval_policy = "on-request"` with `sandbox_mode = "workspace-write"`, leaving unrestricted execution to an explicit opt-in profile or command.</comment>
<file context>
@@ -1,7 +1,14 @@
model = "gpt-5.6-sol"
+enabled-reasoning-efforts = ["medium", "xhigh"]
model_reasoning_effort = "xhigh"
+approval_policy = "never"
+sandbox_mode = "danger-full-access"
+personality = "pragmatic"
</file context>
| approval_policy = "never" | |
| sandbox_mode = "danger-full-access" | |
| approval_policy = "on-request" | |
| sandbox_mode = "workspace-write" |
| personality = "pragmatic" | ||
| model_verbosity = "low" | ||
| model_reasoning_summary = "concise" | ||
| notify = ["turn-ended"] |
There was a problem hiding this comment.
P2: Turn-end notifications will not invoke a notification hook because notify treats the first array element as the executable, not as an event selector. Configuring an actual executable command (or relying solely on the desktop notification setting) would make the notification behavior functional.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At config/codex/config.toml, line 11:
<comment>Turn-end notifications will not invoke a notification hook because `notify` treats the first array element as the executable, not as an event selector. Configuring an actual executable command (or relying solely on the desktop notification setting) would make the notification behavior functional.</comment>
<file context>
@@ -1,7 +1,14 @@
+personality = "pragmatic"
+model_verbosity = "low"
+model_reasoning_summary = "concise"
+notify = ["turn-ended"]
oss_provider = "lmstudio"
</file context>
| personality = "pragmatic" | ||
| model_verbosity = "low" | ||
| model_reasoning_summary = "concise" | ||
| notify = ["turn-ended"] |
There was a problem hiding this comment.
P2: Turn-completion notifications will not run because notify names turn-ended as the executable rather than an event selector. A real executable plus an adapter for Codex's argument-based JSON payload, or an intentionally empty notify, would avoid the failed invocation.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At config/codex/config.tpl.toml, line 11:
<comment>Turn-completion notifications will not run because `notify` names `turn-ended` as the executable rather than an event selector. A real executable plus an adapter for Codex's argument-based JSON payload, or an intentionally empty `notify`, would avoid the failed invocation.</comment>
<file context>
@@ -1,7 +1,14 @@
+personality = "pragmatic"
+model_verbosity = "low"
+model_reasoning_summary = "concise"
+notify = ["turn-ended"]
oss_provider = "lmstudio"
</file context>
1 participant
Summary
Validation
codex --strict-config doctor --summary(config loaded; expected isolated-auth/terminal diagnostics only)shellspec spec/activate_config_spec.sh spec/llm_update_spec.sh(102 examples, 0 failures)git diff --checkSummary by cubic
Update Codex managed defaults to use
gpt-5.6-sol, limit reasoning to medium/high with a high default, set policy/sandbox behavior, enable core plugins, and syncconfig.tomlwithconfig.tpl.toml.gpt-5.6-sol; enabled reasoning efforts["medium","high"]; default efforthigh; personalitypragmatic; verbositylow; reasoning summaryconcise.approval_policy: never,sandbox_mode: danger-full-access,notify: ["turn-ended"].computer-use@openai-bundledandbrowser@openai-bundled.config.tomlandconfig.tpl.tomlin sync.Written for commit 1790006. Summary will update on new commits.