Skip to content

feat(codex): update managed defaults #2074

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 2 commits into from
Jul 15, 2026
Merged

feat(codex): update managed defaults #2074

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
40898c1
feat(codex): update managed defaults
shunkakinoki Jul 15, 2026
1790006
fix(codex): limit reasoning to medium and high
shunkakinoki Jul 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 20 additions & 1 deletion config/codex/config.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,14 @@
suppress_unstable_features_warning = true
web_search = "cached"
model = "gpt-5.6-sol"
model_reasoning_effort = "xhigh"
enabled-reasoning-efforts = ["medium", "high"]
model_reasoning_effort = "high"
approval_policy = "never"
sandbox_mode = "danger-full-access"
Comment on lines +6 to +7

@gemini-code-assist gemini-code-assist Bot Jul 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-critical critical

Setting approval_policy = "never" in conjunction with sandbox_mode = "danger-full-access" presents a severe security risk. This configuration allows the language model to execute arbitrary commands on the host system without any user confirmation or sandboxing boundaries. If the model is subjected to prompt injection (e.g., via untrusted web search results or repository files), an attacker could achieve full remote code execution (RCE) on the host machine. Consider requiring approval for tool execution or using a restricted sandbox mode.

Comment on lines +6 to +7

@cubic-dev-ai cubic-dev-ai Bot Jul 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: All managed Codex sessions now run without approval prompts and with unrestricted host access, so a mistaken or prompt-injected command can alter or expose files without confirmation. A safer managed default would pair approval_policy = "on-request" with sandbox_mode = "workspace-write", leaving unrestricted execution to an explicit opt-in profile or command.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At config/codex/config.toml, line 6:

<comment>All managed Codex sessions now run without approval prompts and with unrestricted host access, so a mistaken or prompt-injected command can alter or expose files without confirmation. A safer managed default would pair `approval_policy = "on-request"` with `sandbox_mode = "workspace-write"`, leaving unrestricted execution to an explicit opt-in profile or command.</comment>

<file context>
@@ -1,7 +1,14 @@
 model = "gpt-5.6-sol"
+enabled-reasoning-efforts = ["medium", "xhigh"]
 model_reasoning_effort = "xhigh"
+approval_policy = "never"
+sandbox_mode = "danger-full-access"
+personality = "pragmatic"
</file context>
Suggested change
approval_policy = "never"
sandbox_mode = "danger-full-access"
approval_policy = "on-request"
sandbox_mode = "workspace-write"

personality = "pragmatic"
model_verbosity = "low"
model_reasoning_summary = "concise"
notify = ["turn-ended"]

@indent-zero indent-zero Bot Jul 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

notify is an external command, not an event list. Codex's config.schema.json defines notify as array<string> — 'Optional external command to spawn for end-user notifications' — and the sample config uses it as notify = ["notify-send", "Codex"]. With notify = ["turn-ended"], Codex will attempt to exec("turn-ended", ...) on every notification event and fail with ENOENT (no such binary on PATH).

On top of that, this is redundant with the existing hook path — config/codex/hooks.json already registers ~/.codex/hooks/notify.sh (and pushover.sh) on the Stop event, which is exactly the 'turn ended' case.

Recommend deleting this line (and the mirrored one in config.tpl.toml:11). If you actually want a second, top-level notifier, point it at a real script, e.g. notify = ["$HOME/.codex/hooks/notify.sh"].

Suggested change
notify = ["turn-ended"]

@cubic-dev-ai cubic-dev-ai Bot Jul 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Turn-end notifications will not invoke a notification hook because notify treats the first array element as the executable, not as an event selector. Configuring an actual executable command (or relying solely on the desktop notification setting) would make the notification behavior functional.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At config/codex/config.toml, line 11:

<comment>Turn-end notifications will not invoke a notification hook because `notify` treats the first array element as the executable, not as an event selector. Configuring an actual executable command (or relying solely on the desktop notification setting) would make the notification behavior functional.</comment>

<file context>
@@ -1,7 +1,14 @@
+personality = "pragmatic"
+model_verbosity = "low"
+model_reasoning_summary = "concise"
+notify = ["turn-ended"]
 oss_provider = "lmstudio"
 
</file context>

oss_provider = "lmstudio"

[features]
Expand Down Expand Up @@ -82,3 +89,15 @@ env_key = "OPENROUTER_API_KEY"
model = "qwen3.5-0.8b-optiq"
model_provider = "lmstudio"
model_reasoning_effort = "minimal"

[desktop]
preventSleepWhileRunning = true
show-context-window-usage = true
notifications-turn-mode = "always"
composerEnterBehavior = "cmdIfMultiline"
Comment on lines +94 to +97

@gemini-code-assist gemini-code-assist Bot Jul 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The keys within the [desktop] section use inconsistent casing styles, mixing camelCase (preventSleepWhileRunning, composerEnterBehavior) and kebab-case (show-context-window-usage, notifications-turn-mode). If the underlying application supports a consistent casing style, please standardize these keys to use a single convention (e.g., all camelCase or all kebab-case) to improve readability and maintainability.


[plugins."computer-use@openai-bundled"]
enabled = true

[plugins."browser@openai-bundled"]
enabled = true
21 changes: 20 additions & 1 deletion config/codex/config.tpl.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,14 @@
suppress_unstable_features_warning = true
web_search = "cached"
model = "__GPT__"
model_reasoning_effort = "xhigh"
enabled-reasoning-efforts = ["medium", "high"]
model_reasoning_effort = "high"
approval_policy = "never"
sandbox_mode = "danger-full-access"
Comment on lines +6 to +7

@gemini-code-assist gemini-code-assist Bot Jul 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-critical critical

Setting approval_policy = "never" in conjunction with sandbox_mode = "danger-full-access" presents a severe security risk. This configuration allows the language model to execute arbitrary commands on the host system without any user confirmation or sandboxing boundaries. If the model is subjected to prompt injection (e.g., via untrusted web search results or repository files), an attacker could achieve full remote code execution (RCE) on the host machine. Consider requiring approval for tool execution or using a restricted sandbox mode.

personality = "pragmatic"
model_verbosity = "low"
model_reasoning_summary = "concise"
notify = ["turn-ended"]

@cubic-dev-ai cubic-dev-ai Bot Jul 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Turn-completion notifications will not run because notify names turn-ended as the executable rather than an event selector. A real executable plus an adapter for Codex's argument-based JSON payload, or an intentionally empty notify, would avoid the failed invocation.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At config/codex/config.tpl.toml, line 11:

<comment>Turn-completion notifications will not run because `notify` names `turn-ended` as the executable rather than an event selector. A real executable plus an adapter for Codex's argument-based JSON payload, or an intentionally empty `notify`, would avoid the failed invocation.</comment>

<file context>
@@ -1,7 +1,14 @@
+personality = "pragmatic"
+model_verbosity = "low"
+model_reasoning_summary = "concise"
+notify = ["turn-ended"]
 oss_provider = "lmstudio"
 
</file context>

oss_provider = "lmstudio"

[features]
Expand Down Expand Up @@ -82,3 +89,15 @@ env_key = "OPENROUTER_API_KEY"
model = "__QWEN_LOCAL__"
model_provider = "lmstudio"
model_reasoning_effort = "minimal"

[desktop]
preventSleepWhileRunning = true
show-context-window-usage = true
notifications-turn-mode = "always"
composerEnterBehavior = "cmdIfMultiline"
Comment on lines +94 to +97

@gemini-code-assist gemini-code-assist Bot Jul 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The keys within the [desktop] section use inconsistent casing styles, mixing camelCase (preventSleepWhileRunning, composerEnterBehavior) and kebab-case (show-context-window-usage, notifications-turn-mode). If the underlying application supports a consistent casing style, please standardize these keys to use a single convention (e.g., all camelCase or all kebab-case) to improve readability and maintainability.


[plugins."computer-use@openai-bundled"]
enabled = true

[plugins."browser@openai-bundled"]
enabled = true
Loading