Windows CLI: Astra scratch cleanup blocked with never/full-access

Codex runtime rejects authorized scratch cleanup on Windows

Recorded: 2026-09-17.
Upstream issue: https://github.com/openai/codex/issues/46130.

Summary

Codex CLI rejects deletion of the consumer repository's disposable _handoff
directory before PowerShell starts, returning only blocked by policy.
The recorded Astra turn has approval policy never and sandbox policy
danger-full-access. The failure prevents a roadmap workflow from starting.

Environment

• Codex CLI: 0.154.0, established by session metadata and codex --version.
• Session originator: codex-tui; source: cli.
• Model in the recorded turn: gpt-6-astra.
• Host inspected during diagnosis: Windows build 10.0.26200.0, PowerShell 7.6.6.
• CLI 0.154.0 matches the latest stable GitHub release queried during reporting.
• Subscription and terminal emulator: not collected.

Verified runtime evidence

The local session records this turn context:

{"approval_policy":"never","sandbox_policy":{"type":"danger-full-access"},"model":"gpt-6-astra"}

At 2026-09-17T03:57:51.690Z, a command containing path resolution,
containment checking, recursive _handoff deletion, and setup was rejected.
At 2026-09-17T03:58:01.020Z, a separate literal-path deletion was also rejected.
The second command, with only its private workspace prefix replaced, was:

Remove-Item -LiteralPath C:/example/consumer-repository/_handoff -Recurse -Force

The tool output includes:

exec_command failed: CreateProcess { message: "Rejected(... rejected: blocked by policy)" }

This excerpt omits the escaped shell wrapper; it is not the complete error.
The raw error does not identify a rule, enforcing component, or remediation.
The assistant attributed the rejection to automatic approval review, but the
tool error does not independently establish that attribution.

The global configuration inspected later contains:

approvals_reviewer = "user"
approval_policy = "never"
sandbox_mode = "danger-full-access"

These later configuration values do not prove the effective reviewer setting
at rejection time; the recorded turn context establishes the other two settings.

Authorization change and reported persistence

The verified earlier session used tool-code-harness 0.26.0.
The package was then updated to 0.26.1 with this shared skill instruction:

Invoking this skill explicitly authorizes the _handoff cleanup required by
the selected workflow, including recursive deletion and recreation of
<consumer-repository-root>/_handoff and its contents.

It also directs the agent to proceed without additional confirmation and to
verify that the target resolves directly inside the consumer repository root.
The user supplied a subsequent 0.26.1 transcript reporting the same policy
rejection and the loaded authorization text. That later run's raw rejection
was not located during this investigation, so its persistence is user-reported.
The user reports that GPT-5.6 and Claude did not encounter this workflow problem;
no controlled model comparison was performed.

Reproduction shape

Observed during a real workflow; no new destructive reproduction was run while
investigating. In a disposable consumer checkout, the relevant sequence is:

• Have an existing disposable _handoff directory at the repository root.
• Invoke a workflow that explicitly authorizes deletion and recreation of it.
• Use Astra in Codex CLI with the recorded permission settings above.
• Resolve the repository and target paths, then attempt the prescribed cleanup.
• Observe the pre-execution policy rejection and workflow stop.

Expected behavior

Permit the specifically authorized scratch cleanup when policy allows it.
If a restriction applies, identify the enforcing component and rule, explain
the effective permission settings, and provide a supported resolution.
Please investigate whether this is a runtime false positive or an undisclosed
policy constraint; the evidence does not establish the underlying cause.

Related reports

• https://github.com/openai/codex/issues/34331 — desktop ignored-cache cleanup.
• https://github.com/openai/codex/issues/43732 — desktop non-forced cleanup.
• https://github.com/openai/codex/issues/46012 — CLI validation rejection diagnostics.

This report adds CLI 0.154.0 / Astra evidence for recursive scratch cleanup,
recorded turn-level permission settings, and the unsuccessful authorization
wording change. Private workspace names, user paths, credentials, and full
session logs are excluded.

Start by examining the Codex CLI policy path that handles the recorded PowerShell Remove-Item command and compare it with the turn-level approval_policy and sandbox_policy values. Use the provided disposable _handoff reproduction shape and related CLI reports as context. Done means either authorized cleanup succeeds or the rejection identifies its enforcing component, rule, effective settings, and supported resolution.