CLI documentation incorrectly states that `!` shell commands inherit sandbox settings

Start with the CLI global flags and interactive shortcuts sections, then compare them with the App Server thread/shellCommand documentation and PR #14988. Correct the interactive-shortcuts wording to reflect the observed sandbox behavior and clarify the conflicting PR description.

What is the type of issue?

Documentation is incorrect

What is the issue?

The Codex CLI documentation states that user-initiated ! shell commands run under the current approval and sandbox settings, but this does not match the observed behavior or the App Server documentation.

The CLI documentation currently says:

• The --sandbox option selects the sandbox policy for “model-generated shell commands”.
• The interactive-shortcuts section says: “Prefix a line with ! to run a local shell command under the current approval and sandbox settings.”

However, a command entered with ! is user-initiated rather than model-generated, and it appears to run outside the configured sandbox.

For example, with Codex CLI v0.146.0:

$ codex --sandbox read-only

Then, in the interactive session:

!touch foobar

The command succeeds and creates foobar, even though the session was started with --sandbox read-only.

This behavior is consistent with the App Server documentation for thread/shellCommand, which explicitly states that the API:

• runs outside the sandbox with full access; and
• does not inherit the thread sandbox policy.

There is also a conflicting statement in PR #14988. Its description says that thread/shellCommand commands are executed within the sandbox and that the implementation mirrors the existing TUI ! behavior. This appears inconsistent with both the current behavior of the merged implementation and the current App Server documentation.

Because this distinction affects the security expectations of CLI users, could the interactive-shortcuts documentation be corrected to state that ! commands run outside the sandbox with full access and do not inherit the current sandbox policy?

A clarification or correction on PR #14988 would also help prevent its description from being treated as documentation of the current security behavior.

Where did you find it?

• CLI global flags (--sandbox):
  https://learn.chatgpt.com/docs/developer-commands?surface=cli#cli-global-flags

• CLI interactive shortcuts (!):
  https://learn.chatgpt.com/docs/developer-commands?surface=cli#cli-interactive-shortcuts

• App Server documentation (thread/shellCommand):
  https://learn.chatgpt.com/docs/app-server#run-a-thread-shell-command

• PR #14988