Codex App: restrictive filesystem profile causes shell startup to abort with exit 134 and no output

What version of the Codex App are you using (From “About Codex” dialog)?

0.155.0-alpha.2.6

What subscription do you have?

Business Plan

What platform is your computer?

Darwin 25.6.0 arm64 arm

What issue are you seeing?

Local shell execution in the Codex App aborts when an administrator-managed, read-restricted filesystem profile is active. Commands return exit code 134 with no output, preventing even basic work inside the authorized workspace.

I have not established whether this is a Codex bug, an unsupported configuration, or a missing runtime permission.

Observed execution result:

{
  "exit_code": 134,
  "output": ""
}

Extracted fields from a corresponding zsh crash report:

process: zsh
exception_type: EXC_CRASH
signal: SIGABRT
termination.namespace: <0x23>
termination.flags: 582
termination.code: 2

Sanitized sandbox-denial summary from the relevant time window:

zsh:
  file-read-data /
  sysctl-read kern.bootargs
  sysctl-read security.mac.lockdown_mode_state

codex:
  file-read-metadata /System/[remaining path withheld]
  sysctl-read kern.bootargs
  sysctl-read kern.iossupportversion
  sysctl-read security.mac.lockdown_mode_state

These denials are diagnostic observations, not proof of which operation caused the abort. I have not established the meaning of termination code 2.

What steps can reproduce the bug?

This is the observed sequence, not yet a verified minimal reproducer:

1. Use the Codex App with bundled CLI version 0.155.0-alpha.2.6 on macOS 26.6.2, build 25G83.
2. Configure an administrator-managed permission profile that denies filesystem reads by default, permits workspace access, and grants selected read-only runtime paths. Leave :minimal disabled.
3. Select that profile, disable permission escalation and shell networking, restart the app, and start a fresh task in the authorized workspace.
4. Ask Codex to read a guide inside that workspace and verify its effective permissions without escalation.
5. Observe shell execution returning exit 134 with no output. Harmless shell checks also failed, so the planned disposable-file tests could not begin.

The original task prompt, with the personal path anonymized, was:

Continue the approved Codex hardening setup. Read
/Users/REDACTED/Workspace/Codex Hardening/filesystem-lock-guide.md.
Verify effective permissions and available tools first.
Then propose a disposable-file test plan and wait for approval.
Do not bypass denials or access Obsidian.

Relevant filesystem configuration at the initial failure is below. The profile name and home-directory paths are anonymized. This is the filesystem/network portion of a larger managed configuration, not a standalone installation recipe.

[permissions.restricted_workspace.filesystem]
":root" = "deny"

"/Users/REDACTED/Workspace" = "write"

"/Users/REDACTED/Workspace/.git" = "read"
"/Users/REDACTED/Workspace/.agents" = "read"
"/Users/REDACTED/Workspace/.codex" = "read"
"/Users/REDACTED/Workspace/.codex-shell" = "read"
"/Users/REDACTED/Workspace/Codex Hardening" = "read"

"/Users/REDACTED/Workspace/.obsidian" = "deny"
"/Users/REDACTED/Workspace/**/.obsidian/**" = "deny"
"/Users/REDACTED/Workspace/.codex-hardening-backups" = "deny"

"/bin/zsh" = "read"
"/usr/bin/python3" = "read"
"/usr/bin/git" = "read"
"/usr/bin/xcrun" = "read"
"/Applications/ChatGPT.app/Contents/Resources/rg" = "read"

"/Library/Developer/CommandLineTools/usr/bin/python3" = "read"
"/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/bin/python3.9" = "read"
"/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/Python3" = "read"
"/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9" = "read"
"/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/site-packages" = "deny"

"/Library/Developer/CommandLineTools/usr/bin/git" = "read"
"/Library/Developer/CommandLineTools/usr/share/git-core/templates" = "read"

"/usr/lib/dyld" = "read"

"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e" = "read"
"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e.01" = "read"
"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e.02.dylddata" = "read"
"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e.03.dyldreadonly" = "read"
"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e.04.dyldlinkedit" = "read"
"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e.05" = "read"
"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e.06.dylddata" = "read"
"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e.07.dyldreadonly" = "read"
"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e.08.dyldlinkedit" = "read"
"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e.09" = "read"
"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e.10.dylddata" = "read"
"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e.11" = "read"
"/System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e.12.dyldlinkedit" = "read"

"/usr/share/zoneinfo/Europe/Warsaw" = "read"
"/private/etc/localtime" = "read"
"/private/var/db/timezone/tz/2026c.1.0/zoneinfo/Europe/Warsaw" = "read"

"/dev/urandom" = "read"
"/dev/null" = "read"

[permissions.restricted_workspace.network]
enabled = false

Other relevant settings:

• Approval policy: never; allowed approval reviewer: user.
• Login shells disabled.
• TMPDIR, TMP and TEMP point to a dedicated directory inside the workspace.
• ZDOTDIR points to .codex-shell inside the workspace.
• Python user-site packages and bytecode writes disabled.
• Git system/global configuration loading restricted.
• Browser/computer automation and integrations were configured to be disabled.

Session ID, token usage and context-window usage are not available in the diagnostic information collected.

What is the expected behavior?

A supported restricted profile should allow command startup and normal work inside explicitly authorized folders while preventing unrelated personal-file access.

Necessary runtime permissions should have a documented, reviewable scope. I need to understand any additional path access, directory traversal/listing, runtime services or temporary-directory writes before enabling them.

If the configured runtime allowlist is insufficient or unsupported, I would expect an actionable diagnostic or documentation identifying the required permissions, rather than an unexplained startup abort.

I am not assuming my hand-selected runtime allowlist is sufficient, and I am not requesting unrestricted filesystem access as a workaround.

Additional information

The public release reference is:

https://github.com/openai/codex/releases/tag/rust-v0.155.0-alpha.2.6

It points to:

https://github.com/openai/codex/commit/bf6f0a4ec97919bf697cdc532e7b8af4ec482fc6

This identifies the public release reference; I have not independently matched the installed executable to that source commit.

:minimal remains disabled because its complete release-specific scope has not been established. Research found application-directory reads and shared temporary-directory writes in newer main source, but those findings must not be attributed to this release without verification.

Could maintainers clarify:

1. The complete command and filesystem-helper runtime allowances for this release, including the expansion of :minimal.
2. Whether explicit filesystem denials constrain every fixed runtime allowance, including shared temporary-directory access.
3. Whether supported configuration can allow reading the root directory itself, using literal-directory scope, without permitting descendant-file reads.
4. A supported startup configuration preserving explicitly authorized workspace access and narrowly scoped runtime exceptions.

Configuration installation was checked, but boundary tests could not run because shell execution remains unavailable. Effective containment has therefore not been verified.

Potentially related: https://github.com/openai/codex/issues/39528

That report describes a similar SIGABRT/exit-134 failure with restricted readable roots in CLI 0.146.1. This report concerns the Codex App’s bundled CLI 0.155.0-alpha.2.6 on macOS 26.6.2.

A shared cause has not been established. Please cross-reference or consolidate these reports if maintainers confirm they are the same issue.

Start by comparing the reported macOS 26.6.2 failure and restricted profile with potentially related issue 39528, then inspect release commit bf6f0a4ec97919bf697cdc532e7b8af4ec482fc. Verify the bundled CLI's required command, filesystem-helper, and temporary-directory allowances for 0.155.0-alpha.2.6. Done means a reproducible supported configuration or an actionable startup diagnostic and documentation.