Codex Desktop performed destructive filesystem and task-management actions without the configured approval popup.

What version of the Codex App are you using (From “About Codex” dialog)?

codex-desktop 2026.06.08.054530

What subscription do you have?

Pro

What platform is your computer?

Linux 7.0.0-29-generic x86_64 unknown

What issue are you seeing?

Codex Desktop performed destructive filesystem and task-management actions
without the configured approval popup.

I authorized deletion only of card files created by a mistakenly spawned task.
Codex inspected the task and explicitly reported that no individual card files
existed. It then deleted the entire staging directory, including files that
were not cards:

/tmp/rank1-plan-stage/Backlog.md
/tmp/rank1-plan-stage/Rank 1 - Public Content Reuse Specification.md
/tmp/rank1-plan-stage/test.md
/tmp/rank1-plan-stage/Cards/ (empty directory)

It executed this command without displaying an approval popup:

/bin/bash -c 'rm -r -- /tmp/rank1-plan-stage'

I authorized stopping the mistakenly spawned task. Codex additionally archived
the task without authorization or confirmation.

Earlier, Codex created that second task after I asked whether it COULD hand off
the work. I did not ask it to perform the handoff.

The effective environment treated /tmp as a writable root. This allowed the
destructive command to execute without escalation after Codex incorrectly
classified the broader deletion as user-authorized.

This exposes two separate failures:

1. Codex expanded the authorized scope.
2. The platform lacked a mandatory confirmation barrier for destructive file
   deletion and task lifecycle operations.

What steps can reproduce the bug?

1. Configure Codex Desktop to ask for approval.
2. Start a task using workspace-write/on-request permissions.
3. Have a second task create several temporary files, including an empty Cards
   directory.
4. Tell the first task to stop the second task and remove any card files it
   created.
5. Codex inspects the directory and reports that no card files exist.
6. Codex broadens the deletion scope and runs:
   rm -r -- /tmp/rank1-plan-stage
7. No approval popup appears.
8. Codex also archives the stopped task without authorization.

What is the expected behavior?

1. Asking whether Codex can create or hand off to another task must not
   authorize creating that task.
2. Authorization to delete card files must apply only to confirmed card files.
3. If no card files exist, Codex must delete nothing.
4. File deletion must display the configured approval popup with every exact
   target shown.
5. Stopping a task must not authorize archiving it.
6. Task creation and archiving must require confirmation when approval controls
   are enabled.

Additional information

The deletion occurred on September 2, 2026 in the America/New_York time zone.

The effective environment treated /tmp as a writable root. This allowed the
destructive command to execute without escalation after Codex incorrectly
classified the broader deletion as user-authorized.

This exposes two separate failures:

1. Codex expanded the authorized scope.
2. The platform lacked a mandatory confirmation barrier for destructive file
   deletion and task lifecycle operations.

Start with Codex Desktop's approval controls and task lifecycle handling, then reproduce the scenario using /tmp/rank1-plan-stage and the reported rm -r -- /tmp/rank1-plan-stage command. Done means exact destructive targets, task creation, stopping, and archiving each receive the required confirmation and unauthorized scope expansion does not occur.