When updating its own configuration and with sandbox enabled, it doesn't keep backups and deletes ~/.codex/config.toml

What version of Codex CLI is running?

codex-cli 0.151.0

What subscription do you have?

pro

Which model were you using?

gpt-5.6-sol

What platform is your computer?

linux

What terminal emulator and version are you using (if applicable)?

kitty

Codex doctor report

What issue are you seeing?

It appears you over-wrote my config and removed all my previous configuration ... any way to recover that ?


• I’m sorry — yes, I overwrote the host-side ~/.codex/config.toml. I trusted the sandbox view, where that path appeared absent, even though the approved host filesystem had an existing file. That was my
  mistake.

  I won’t write anything else while investigating recovery. I’m using the openai-docs troubleshooting guidance to check for any supported Codex backup path, then I’ll search local backups/history and the
  existing Codex state databases read-only.

What steps can reproduce the bug?

With sandboxing setup with fairly strict limits on what codex can access (including not being able to access ~/.codex/ by default) as it to edit your configuration. Note that sometimes it will ask for permission to overwrite the config you have to run outside the sandbox without realizing it also needs to check for and backup your existing config also using commands outside the sandbox.

What is the expected behavior?

The skills that codex uses to update its own config should be safer - always create a backup of the existing config, handle sandboxing gracefully

Additional information

No response

Start by reproducing the sandboxed self-configuration update on Linux with an existing ~/.codex/config.toml, then trace the configuration-update path involved in the skills that modify it. Done means the existing configuration is preserved through sandbox permission changes and a backup is always created before an update.