Sandbox with custom profile forbids all commands on Mac OS once permissions ever change

What version of the Codex App are you using (From “About Codex” dialog)?

26.908.70816

What subscription do you have?

Business

What platform is your computer?

Darwin 27.0.0 arm64 arm

What issue are you seeing?

Codex App, when used without explicit project and a custom permission profile, will have the sandbox deny every execution after the first.

codex-cli does not show the same behaviour (though of course always has some dir implicitely as project dir) unless you explicitely use /permissions.

What steps can reproduce the bug?

Run Codex App with a permission profile.

default_permissions = "mine"

[permissions.mine]
extends = ":workspace"

[permissions.mine.filesystem]
":root" = "deny"
":minimal" = "read"
"/opt/homebrew" = "read"
"/opt/homebrew/var/mysql" = "deny"
"/usr" = "read"
"/bin" = "read"
"~/.ssh" = "deny"
"~/.env" = "deny"
"~/.bash_profile" = "read"
"~/.bashrc" = "read"

[permissions.mine.filesystem.":workspace_roots"]
"**/*.env" = "deny"

Start a chat, but OUTSIDE a project, you write: Please try calling "date"
Output: The date
You write: "Again"
Output: "Couldn’t run date again: the updated sandbox blocks the command runner’s configured /opt/homebrew/bin/bash, and permission was not granted."

You write: "Show exact error message"
Output: "sandbox-exec: execvp() of '/opt/homebrew/bin/bash' failed: Operation not permitted"

You write "Run it through /bin/bash"
Output: "It still fails before executing the command because the runner itself launches the configured Homebrew Bash:"

Also, it's super irritating that the visually selected policy seems to change automatically after the first test.
Also, if it tries to request permission, you can give it but sandbox will still fail.

On Codex App, without projects, default behaviour is already buggy.
Within a project, changing the active permissions through the UI in any way will also trigger the bug and condemn the chat to all access failing.
On codex CLI, sandbox will stay stable until you call /permissions in any way. Even switching to "Full access" will immediately fail with:

failed to load AGENTS.md instructions for environment `local`: fs sandbox helper failed with status exit status:
71: sandbox-exec: execvp() of '/opt/homebrew/bin/codex' failed: Operation not permitted

The root cause of all this seems to be the ":root" = "deny" entry in the config, even though it's officially in your documentation. Remove it from the profile (which I don't want), the problem vanishes.

What is the expected behavior?

Reliable sandbox behaviour.

Additional information

This might be related to https://github.com/openai/codex/issues/45657 - I am not sure. A sandbox that's tried to be constructed within the current sandbox might cause these problems.

Start by reproducing the Codex App and CLI behavior with the custom profile containing ":root" = "deny", both outside a project and after changing permissions. Compare the sandbox behavior before and after permission changes, including the configured /opt/homebrew/bin/bash and /opt/homebrew/bin/codex errors, and use issue #45657 as related context. Done means commands remain executable after permission changes and the documented profile no longer causes all execution to fail.