Codex CLI v0.1.x fails with "Sandbox was mandated, but no sandbox is available!" on Fedora with Docker installed

[arbaminim]

What version of Codex is running?

0.1.2504301751

Which model were you using?

o4-mini

What platform is your computer?

Linux 6.14.4-300.fc12.x86_64 x86_64 unknown

What steps can reproduce the bug?

On Fedora Linux, install Codex via npm install -g @openai/codex

Ensure Docker is installed, started, and user is in the docker group

Run: codex --approval-mode full-auto

Enter prompt

Observe crash

What is the expected behavior?

Codex should detect Docker as a valid sandbox and proceed in full-auto mode.

What do you see instead?

OK, here is the full dump of the error

file:///home/myusername/.nvm/versions/node/v23.11.0/lib/node_modules/@openai/codex/dist/cli.js:468
STDERR: ${A}),{stdout:f,stderr:A,exitCode:h,durationMs:d}}var AOe=oO.access(a4,oO.constants.X_OK).then(()=>!0,e=>(["ENOENT","ACCESS","EPERM"].includes(e.code)||jt(Unexpected error for `stat ${a4}`: ${e.message}),!1));async function hOe(e){if(e){if(process.platform==="darwin"){if(await AOe)return"macos.seatbelt";throw new Error("Sandbox was mandated, but 'sandbox-exec' was not found in PATH!")}else if(iR)return"none";throw new Error("Sandbox was mandated, but no sandbox is available!")}else return"none"}async function qne(e,t,r){let{review:n,customDenyMessage:a}=await r(e.cmd,t);if(n==="always"){let i=Wne(e.cmd);Vne.add(i)}if(n==="explain")return null;if(n!=="yes"&&n!=="always"){let i=n==="no-continue"?a?.trim()||"No, don't do that \u2014 keep going though.":"No, don't do that \u2014 stop for now.";return{outputText:"aborted",metadata:{},additionalItems:[{type:"message",role:"user",content:[{type:"input_text",text:i}]}]}}else return null}import{randomUUID as Uke}from"node:crypto";m();m();m();var o4="RFC3986",s4={RFC1738:e=>String(e).replace(/%20/g,"+"),RFC3986:e=>String(e)},Kne="RFC1738";m();m();var EOe=Array.isArray,Sd=(()=>{let e=[];for(let t=0;t<256;++t)e.push("%"+((t<16?"0":"")+t.toString(16)).toUpperCase());return e})();var sO=1024,jne=(e,t,r,n,a)=>{if(e.length===0)return e;let i=e;if(typeof e=="symbol"?i=Symbol.prototype.toString.call(e):typeof e!="string"&&(i=String(e)),r==="iso-8859-1")return escape(i).replace(/%u[0-9a-f]{4}/gi,function(c){return"%26%23"+parseInt(c.slice(2),16)+"%3B"});let o="";for(let c=0;c<i.length;c+=sO){let d=i.length>=sO?i.slice(c,c+sO):i,f=[];for(let A=0;A<d.length;++A){let h=d.charCodeAt(A);if(h===45||h===46||h===95||h===126||h>=48&&h<=57||h>=65&&h<=90||h>=97&&h<=122||a===Kne&&(h===40||h===41)){f[f.length]=d.charAt(A);continue}if(h<128){f[f.length]=Sd[h];continue}if(h<2048){f[f.length]=Sd[192|h>>6]+Sd[128|h&63];continue}if(h<55296||h>=57344){f[f.length]=Sd[224|h>>12]+Sd[128|h>>6&63]+Sd[128|h&63];continue}A+=1,h=65536+((h&1023)<<10|d.charCodeAt(A)&1023),f[f.length]=Sd[240|h>>18]+Sd[128|h>>12&63]+Sd[128|h>>6&63]+Sd[128|h&63]}o+=f.join("")}return o};function Xne(e){return!e||typeof e!="object"?!1:!!(e.constructor&&e.constructor.isBuffer&&e.constructor.isBuffer(e))}function lO(e,t){if(EOe(e)){let r=[];for(let n=0;n<e.length;n+=1)r.push(t(e[n]));return r}return t(e)}var yOe=Object.prototype.hasOwnProperty,Jne={brackets(e){return String(e)+"[]"},comma:"comma",indices(e,t){return String(e)+"["+t+"]"},repeat(e){return String(e)}},Dd=Array.isArray,COe=Array.prototype.push,Zne=function(e,t){COe.apply(e,Dd(t)?t:[t])},SOe=Date.prototype.toISOString,Gi={addQueryPrefix:!1,allowDots:!1,allowEmptyArrays:!1,arrayFormat:"indices",charset:"utf-8",charsetSentinel:!1,delimiter:"&",encode:!0,encodeDotInKeys:!1,encoder:jne,encodeValuesOnly:!1,format:o4,formatter:s4[o4],indices:!1,serializeDate(e){return SOe.call(e)},skipNulls:!1,strictNullHandling:!1};function DOe(e){return typeof e=="string"||typeof e=="number"||typeof e=="boolean"||typeof e=="symbol"||typeof e=="bigint"}var cO={};function eae(e,t,r,n,a,i,o,c,d,f,A,h,S,C,b,w,I,O){let B=e,U=O,G=0,j=!1;for(;(U=U.get(cO))!==void 0&&!j;){let le=U.get(e);if(G+=1,typeof le<"u"){if(le===G)throw new RangeError("Cyclic object value");j=!0}typeof U.get(cO)>"u"&&(G=0)}if(typeof f=="function"?B=f(t,B):B instanceof Date?B=S?.(B):r==="comma"&&Dd(B)&&(B=lO(B,function(le){return le instanceof Date?S?.(le):le})),B===null){if(i)return d&&!w?d(t,Gi.encoder,I,"key",C):t;B=""}if(DOe(B)||Xne(B)){if(d){let le=w?t:d(t,Gi.encoder,I,"key",C);return[b?.(le)+"="+b?.(d(B,Gi.encoder,I,"value",C))]}return[b?.(t)+"="+b?.(String(B))]}let re=[];if(typeof B>"u")return re;let W;if(r==="comma"&&Dd(B))w&&d&&(B=lO(B,d)),W=[{value:B.length>0?B.join(",")||null:void 0}];else if(Dd(f))W=f;else{let le=Object.keys(B);W=A?le.sort(A):le}let te=c?String(t).replace(/\./g,"%2E"):String(t),V=n&&Dd(B)&&B.length===1?te+"[]":te;if(a&&Dd(B)&&B.length===0)return V+"[]";for(let le=0;le<W.length;++le){let fe=W[le],Ve=typeof fe=="object"&&typeof fe.value<"u"?fe.value:B[fe];if(o&&Ve===null)continue;let xe=h&&c?fe.replace(/\./g,"%2E"):fe,At=Dd(B)?typeof r=="function"?r(V,xe):V:V+(h?"."+xe:"["+xe+"]");O.set(e,G);let Ce=new WeakMap;Ce.set(cO,O),Zne(re,eae(Ve,At,r,n,a,i,o,c,r==="comma"&&w&&Dd(B)?null:d,f,A,h,S,C,b,w,I,Ce))}return re}function bOe(e=Gi){if(typeof e.allowEmptyArrays<"u"&&typeof e.allowEmptyArrays!="boolean")throw new TypeError("allowEmptyArraysoption can only betrueorfalse, when provided");if(typeof e.encodeDotInKeys<"u"&&typeof e.encodeDotInKeys!="boolean")throw new TypeError("encodeDotInKeysoption can only betrueorfalse, when provided");if(e.encoder!==null&&typeof e.encoder<"u"&&typeof e.encoder!="function")throw new TypeError("Encoder has to be a function.");let t=e.charset||Gi.charset;if(typeof e.charset<"u"&&e.charset!=="utf-8"&&e.charset!=="iso-8859-1")throw new TypeError("The charset option must be either utf-8, iso-8859-1, or undefined");let r=o4;if(typeof e.format<"u"){if(!yOe.call(s4,e.format))throw new TypeError("Unknown format option provided.");r=e.format}let n=s4[r],a=Gi.filter;(typeof e.filter=="function"||Dd(e.filter))&&(a=e.filter);let i;if(e.arrayFormat&&e.arrayFormat in Jne?i=e.arrayFormat:"indices"in e?i=e.indices?"indices":"repeat":i=Gi.arrayFormat,"commaRoundTrip"in e&&typeof e.commaRoundTrip!="boolean")throw new TypeError("commaRoundTrip must be a boolean, or absent");let o=typeof e.allowDots>"u"?e.encodeDotInKeys?!0:Gi.allowDots:!!e.allowDots;return{addQueryPrefix:typeof e.addQueryPrefix=="boolean"?e.addQueryPrefix:Gi.addQueryPrefix,allowDots:o,allowEmptyArrays:typeof e.allowEmptyArrays=="boolean"?!!e.allowEmptyArrays:Gi.allowEmptyArrays,arrayFormat:i,charset:t,charsetSentinel:typeof e.charsetSentinel=="boolean"?e.charsetSentinel:Gi.charsetSentinel,commaRoundTrip:!!e.commaRoundTrip,delimiter:typeof e.delimiter>"u"?Gi.delimiter:e.delimiter,encode:typeof e.encode=="boolean"?e.encode:Gi.encode,encodeDotInKeys:typeof e.encodeDotInKeys=="boolean"?e.encodeDotInKeys:Gi.encodeDotInKeys,encoder:typeof e.encoder=="function"?e.encoder:Gi.encoder,encodeValuesOnly:typeof e.encodeValuesOnly=="boolean"?e.encodeValuesOnly:Gi.encodeValuesOnly,filter:a,format:r,formatter:n,serializeDate:typeof e.serializeDate=="function"?e.serializeDate:Gi.serializeDate,skipNulls:typeof e.skipNulls=="boolean"?e.skipNulls:Gi.skipNulls,sort:typeof e.sort=="function"?e.sort:null,strictNullHandling:typeof e.strictNullHandling=="boolean"?e.strictNullHandling:Gi.strictNullHandling}}function uO(e,t={}){let r=e,n=bOe(t),a,i;typeof n.filter=="function"?(i=n.filter,r=i("",r)):Dd(n.filter)&&(i=n.filter,a=i);let o=[];if(typeof r!="object"||r===null)return"";let c=Jne[n.arrayFormat],d=c==="comma"&&n.commaRoundTrip;a||(a=Object.keys(r)),n.sort&&a.sort(n.sort);let f=new WeakMap;for(let S=0;S<a.length;++S){let C=a[S];n.skipNulls&&r[C]===null||Zne(o,eae(r[C],C,c,d,n.allowEmptyArrays,n.strictNullHandling,n.skipNulls,n.encodeDotInKeys,n.encode?n.encoder:null,n.filter,n.sort,n.allowDots,n.serializeDate,n.format,n.formatter,n.encodeValuesOnly,n.charset,f))}let A=o.join(n.delimiter),h=n.addQueryPrefix===!0?"?":"";return n.charsetSentinel&&(n.charset==="iso-8859-1"?h+="utf8=%26%2310003%3B&":h+="utf8=%E2%9C%93&"),A.length>0?h+A:""}m();m();var Og="4.95.1";m();m();m();var tae=!1,Bg,dO,TOe,IOe,wOe,pO,ROe,l4,fO,mO,gO,c4,_O;function rae(e,t={auto:!1}){if(tae)throw new Error(you must `import 'openai/shims/${e.kind}'` before importing anything else from openai);if(Bg)throw new Error(can't `import 'openai/shims/${e.kind}'` after `import 'openai/shims/${Bg}'`);tae=t.auto,Bg=e.kind,dO=e.fetch,TOe=e.Request,IOe=e.Response,wOe=e.Headers,pO=e.FormData,ROe=e.Blob,l4=e.File,fO=e.ReadableStream,mO=e.getMultipartRequestOptions,gO=e.getDefaultAgent,c4=e.fileFromPath,_O=e.isFsReadStream}m();var Of=Ne(Gae(),1);m();m();uS();o7();import{inspect as j7e}from"util";m();q4();var foe=e=>e instanceof wd;z4();m();import{deprecate as K7e}from"util";var moe=K7e(()=>{},'Constructor "entries" argument is not spec-compliant and will be removed in next major release.');var Rd=function(e,t,r,n){if(r==="a"&&!n)throw new TypeError("Private accessor was defined without a getter");if(typeof t=="function"?e!==t||!n:!t.has(e))throw new TypeError("Cannot read private member from an object whose class did not declare it");return r==="m"?n:r==="a"?n.call(e):n?n.value:t.get(e)},$4,Nd,s7,K4=class{constructor(t){$4.add(this),Nd.set(this,new Map),t&&(moe(),t.forEach(({name:r,value:n,fileName:a})=>this.append(r,n,a)))}static[(Nd=new WeakMap,$4=new WeakSet,Symbol.hasInstance)](t){return!!(t&&ci(t.constructor)&&t[Symbol.toStringTag]==="FormData"&&ci(t.append)&&ci(t.set)&&ci(t.get)&&ci(t.getAll)&&ci(t.has)&&ci(t.delete)&&ci(t.entries)&&ci(t.values)&&ci(t.keys)&&ci(t[Symbol.iterator])&&ci(t.forEach))}append(t,r,n){Rd(this,$4,"m",s7).call(this,{name:t,fileName:n,append:!0,rawValue:r,argsLength:arguments.length})}set(t,r,n){Rd(this,$4,"m",s7).call(this,{name:t,fileName:n,append:!1,rawValue:r,argsLength:arguments.length})}get(t){let r=Rd(this,Nd,"f").get(String(t));return r?r[0]:null}getAll(t){let r=Rd(this,Nd,"f").get(String(t));return r?r.slice():[]}has(t){return Rd(this,Nd,"f").has(String(t))}delete(t){Rd(this,Nd,"f").delete(String(t))}*keys(){for(let t of Rd(this,Nd,"f").keys())yield t}*entries(){for(let t of this.keys()){let r=this.getAll(t);for(let n of r)yield[t,n]}}*values(){for(let[,t]of this)yield t}[(s7=function({name:r,rawValue:n,append:a,fileName:i,argsLength:o}){let c=a?"append":"set";if(o<2)throw new TypeError(Failed to execute '${c}' on 'FormData': 2 arguments required, but only ${o} present.);r=String(r);let d;if(i7(n))d=i===void 0?n:new fu([n],i,{type:n.type,lastModified:n.lastModified});else if(foe(n))d=new fu([n],i===void 0?"blob":i,{type:n.type});else{if(i)throw new TypeError(Failed to execute '${c}' on 'FormData': parameter 2 is not of type 'Blob'.);d=String(n)}let f=Rd(this,Nd,"f").get(r);if(!f)return void Rd(this,Nd,"f").set(r,[d]);if(!a)return void Rd(this,Nd,"f").set(r,[d]);f.push(d)},Symbol.iterator)](){return this.entries()}forEach(t,r){for(let[n,a]of this)t.call(r,a,n,this)}get[Symbol.toStringTag](){return"FormData"}[j7e.custom](){return this[Symbol.toStringTag]}};q4();uS();var D7=Ne(Toe(),1),ese=Ne(Qoe(),1);import{ReadStream as wBe}from"node:fs";m();m();m();var Uoe="abcdefghijklmnopqrstuvwxyz0123456789";function fBe(){let e=16,t="";for(;e--;)t+=Uoe[Math.random()*Uoe.length<<0];return t}var Goe=fBe;m();var mBe=e=>Object.prototype.toString.call(e).slice(8,-1).toLowerCase();function gBe(e){if(mBe(e)!=="object")return!1;let t=Object.getPrototypeOf(e);return t==null?!0:(t.constructor&&t.constructor.toString())===Object.toString()}var h7=gBe;m();var _Be=e=>String(e).replace(/\r|\n/g,(t,r,n)=>t==="\r"&&n[r+1]!==
^

Error: Sandbox was mandated, but no sandbox is available!
at hOe (file:///home/myusername/.nvm/versions/node/v23.11.0/lib/node_modules/@openai/codex/dist/cli.js:468:433)
at iO (file:///home/myusername/.nvm/versions/node/v23.11.0/lib/node_modules/@openai/codex/dist/cli.js:466:2281)
at $ne (file:///home/myusername/.nvm/versions/node/v23.11.0/lib/node_modules/@openai/codex/dist/cli.js:466:1418)
at dE.handleFunctionCall (file:///home/myusername/.nvm/versions/node/v23.11.0/lib/node_modules/@openai/codex/dist/cli.js:490:4648)
at dE.processEventsWithoutStreaming (file:///home/myusername/.nvm/versions/node/v23.11.0/lib/node_modules/@openai/codex/dist/cli.js:492:3562)
at dE.run (file:///home/myusername/.nvm/versions/node/v23.11.0/lib/node_modules/@openai/codex/dist/cli.js:491:3235)
at process.processTicksAndRejections (node:internal/process/task_queues:105:5)

Node.js v23.11.0

Additional information

According to ChatGPT:

Suggested fix: Update the sandbox detection logic to recognize Docker on Linux as a valid environment. Currently, the CLI checks for process.platform === 'darwin' or iR but appears to lack a Linux branch.

[josephbartlett]

I can confirm this is also happening on Windows 11 through WSL. It seems to happen with full-auto, and quiet mode. suggest and full-edit seem fine.

Similar trace:

file:///usr/local/lib/node_modules/@openai/codex/dist/cli.js:468
STDERR: ${A}),{stdout:f,stderr:A,exitCode:h,durationMs:d}}var AOe=oO.access(a4,oO.constants.X_OK).then(()=>!0,e=>(["ENOENT","ACCESS","EPERM"].includes(e.code)||jt(Unexpected error for `stat ${a4}`: ${e.message}),!1));async function hOe(e){if(e){if(process.platform==="darwin"){if(await AOe)return"macos.seatbelt";throw new Error("Sandbox was mandated, but 'sandbox-exec' was not found in PATH!")}else if(iR)return"none";throw new Error("Sandbox was mandated, but no sandbox is available!")}else return"none"}async function qne(e,t,r){let{review:n,customDenyMessage:a}=await r(e.cmd,t);if(n==="always"){let i=Wne(e.cmd);Vne.add(i)}if(n==="explain")return null;if(n!=="yes"&&n!=="always"){let i=n==="no-continue"?a?.trim()||"No, don't do that \u2014 keep going though.":"No, don't do that \u2014 stop for now.";return{outputText:"aborted",metadata:{},additionalItems:[{type:"message",role:"user",content:[{type:"input_text",text:i}]}]}}else return null}import{randomUUID as Uke}from"node:crypto";m();m();m();var o4="RFC3986",s4={RFC1738:e=>String(e).replace(/%20/g,"+"),RFC3986:e=>String(e)},Kne="RFC1738";m();m();var EOe=Array.isArray,Sd=(()=>{let e=[];for(let t=0;t<256;++t)e.push("%"+((t<16?"0":"")+t.toString(16)).toUpperCase());return e})();var sO=1024,jne=(e,t,r,n,a)=>{if(e.length===0)return e;let i=e;if(typeof e=="symbol"?i=Symbol.prototype.toString.call(e):typeof e!="string"&&(i=String(e)),r==="iso-8859-1")return escape(i).replace(/%u[0-9a-f]{4}/gi,function(c){return"%26%23"+parseInt(c.slice(2),16)+"%3B"});let o="";for(let c=0;c<i.length;c+=sO){let d=i.length>=sO?i.slice(c,c+sO):i,f=[];for(let A=0;A<d.length;++A){let h=d.charCodeAt(A);if(h===45||h===46||h===95||h===126||h>=48&&h<=57||h>=65&&h<=90||h>=97&&h<=122||a===Kne&&(h===40||h===41)){f[f.length]=d.charAt(A);continue}if(h<128){f[f.length]=Sd[h];continue}if(h<2048){f[f.length]=Sd[192|h>>6]+Sd[128|h&63];continue}if(h<55296||h>=57344){f[f.length]=Sd[224|h>>12]+Sd[128|h>>6&63]+Sd[128|h&63];continue}A+=1,h=65536+((h&1023)<<10|d.charCodeAt(A)&1023),f[f.length]=Sd[240|h>>18]+Sd[128|h>>12&63]+Sd[128|h>>6&63]+Sd[128|h&63]}o+=f.join("")}return o};function Xne(e){return!e||typeof e!="object"?!1:!!(e.constructor&&e.constructor.isBuffer&&e.constructor.isBuffer(e))}function lO(e,t){if(EOe(e)){let r=[];for(let n=0;n<e.length;n+=1)r.push(t(e[n]));return r}return t(e)}var yOe=Object.prototype.hasOwnProperty,Jne={brackets(e){return String(e)+"[]"},comma:"comma",indices(e,t){return String(e)+"["+t+"]"},repeat(e){return String(e)}},Dd=Array.isArray,COe=Array.prototype.push,Zne=function(e,t){COe.apply(e,Dd(t)?t:[t])},SOe=Date.prototype.toISOString,Gi={addQueryPrefix:!1,allowDots:!1,allowEmptyArrays:!1,arrayFormat:"indices",charset:"utf-8",charsetSentinel:!1,delimiter:"&",encode:!0,encodeDotInKeys:!1,encoder:jne,encodeValuesOnly:!1,format:o4,formatter:s4[o4],indices:!1,serializeDate(e){return SOe.call(e)},skipNulls:!1,strictNullHandling:!1};function DOe(e){return typeof e=="string"||typeof e=="number"||typeof e=="boolean"||typeof e=="symbol"||typeof e=="bigint"}var cO={};function eae(e,t,r,n,a,i,o,c,d,f,A,h,S,C,b,w,I,O){let B=e,U=O,G=0,j=!1;for(;(U=U.get(cO))!==void 0&&!j;){let le=U.get(e);if(G+=1,typeof le<"u"){if(le===G)throw new RangeError("Cyclic object value");j=!0}typeof U.get(cO)>"u"&&(G=0)}if(typeof f=="function"?B=f(t,B):B instanceof Date?B=S?.(B):r==="comma"&&Dd(B)&&(B=lO(B,function(le){return le instanceof Date?S?.(le):le})),B===null){if(i)return d&&!w?d(t,Gi.encoder,I,"key",C):t;B=""}if(DOe(B)||Xne(B)){if(d){let le=w?t:d(t,Gi.encoder,I,"key",C);return[b?.(le)+"="+b?.(d(B,Gi.encoder,I,"value",C))]}return[b?.(t)+"="+b?.(String(B))]}let re=[];if(typeof B>"u")return re;let W;if(r==="comma"&&Dd(B))w&&d&&(B=lO(B,d)),W=[{value:B.length>0?B.join(",")||null:void 0}];else if(Dd(f))W=f;else{let le=Object.keys(B);W=A?le.sort(A):le}let te=c?String(t).replace(/\./g,"%2E"):String(t),V=n&&Dd(B)&&B.length===1?te+"[]":te;if(a&&Dd(B)&&B.length===0)return V+"[]";for(let le=0;le<W.length;++le){let fe=W[le],Ve=typeof fe=="object"&&typeof fe.value<"u"?fe.value:B[fe];if(o&&Ve===null)continue;let xe=h&&c?fe.replace(/\./g,"%2E"):fe,At=Dd(B)?typeof r=="function"?r(V,xe):V:V+(h?"."+xe:"["+xe+"]");O.set(e,G);let Ce=new WeakMap;Ce.set(cO,O),Zne(re,eae(Ve,At,r,n,a,i,o,c,r==="comma"&&w&&Dd(B)?null:d,f,A,h,S,C,b,w,I,Ce))}return re}function bOe(e=Gi){if(typeof e.allowEmptyArrays<"u"&&typeof e.allowEmptyArrays!="boolean")throw new TypeError("allowEmptyArraysoption can only betrueorfalse, when provided");if(typeof e.encodeDotInKeys<"u"&&typeof e.encodeDotInKeys!="boolean")throw new TypeError("encodeDotInKeysoption can only betrueorfalse, when provided");if(e.encoder!==null&&typeof e.encoder<"u"&&typeof e.encoder!="function")throw new TypeError("Encoder has to be a function.");let t=e.charset||Gi.charset;if(typeof e.charset<"u"&&e.charset!=="utf-8"&&e.charset!=="iso-8859-1")throw new TypeError("The charset option must be either utf-8, iso-8859-1, or undefined");let r=o4;if(typeof e.format<"u"){if(!yOe.call(s4,e.format))throw new TypeError("Unknown format option provided.");r=e.format}let n=s4[r],a=Gi.filter;(typeof e.filter=="function"||Dd(e.filter))&&(a=e.filter);let i;if(e.arrayFormat&&e.arrayFormat in Jne?i=e.arrayFormat:"indices"in e?i=e.indices?"indices":"repeat":i=Gi.arrayFormat,"commaRoundTrip"in e&&typeof e.commaRoundTrip!="boolean")throw new TypeError("commaRoundTrip must be a boolean, or absent");let o=typeof e.allowDots>"u"?e.encodeDotInKeys?!0:Gi.allowDots:!!e.allowDots;return{addQueryPrefix:typeof e.addQueryPrefix=="boolean"?e.addQueryPrefix:Gi.addQueryPrefix,allowDots:o,allowEmptyArrays:typeof e.allowEmptyArrays=="boolean"?!!e.allowEmptyArrays:Gi.allowEmptyArrays,arrayFormat:i,charset:t,charsetSentinel:typeof e.charsetSentinel=="boolean"?e.charsetSentinel:Gi.charsetSentinel,commaRoundTrip:!!e.commaRoundTrip,delimiter:typeof e.delimiter>"u"?Gi.delimiter:e.delimiter,encode:typeof e.encode=="boolean"?e.encode:Gi.encode,encodeDotInKeys:typeof e.encodeDotInKeys=="boolean"?e.encodeDotInKeys:Gi.encodeDotInKeys,encoder:typeof e.encoder=="function"?e.encoder:Gi.encoder,encodeValuesOnly:typeof e.encodeValuesOnly=="boolean"?e.encodeValuesOnly:Gi.encodeValuesOnly,filter:a,format:r,formatter:n,serializeDate:typeof e.serializeDate=="function"?e.serializeDate:Gi.serializeDate,skipNulls:typeof e.skipNulls=="boolean"?e.skipNulls:Gi.skipNulls,sort:typeof e.sort=="function"?e.sort:null,strictNullHandling:typeof e.strictNullHandling=="boolean"?e.strictNullHandling:Gi.strictNullHandling}}function uO(e,t={}){let r=e,n=bOe(t),a,i;typeof n.filter=="function"?(i=n.filter,r=i("",r)):Dd(n.filter)&&(i=n.filter,a=i);let o=[];if(typeof r!="object"||r===null)return"";let c=Jne[n.arrayFormat],d=c==="comma"&&n.commaRoundTrip;a||(a=Object.keys(r)),n.sort&&a.sort(n.sort);let f=new WeakMap;for(let S=0;S<a.length;++S){let C=a[S];n.skipNulls&&r[C]===null||Zne(o,eae(r[C],C,c,d,n.allowEmptyArrays,n.strictNullHandling,n.skipNulls,n.encodeDotInKeys,n.encode?n.encoder:null,n.filter,n.sort,n.allowDots,n.serializeDate,n.format,n.formatter,n.encodeValuesOnly,n.charset,f))}let A=o.join(n.delimiter),h=n.addQueryPrefix===!0?"?":"";return n.charsetSentinel&&(n.charset==="iso-8859-1"?h+="utf8=%26%2310003%3B&":h+="utf8=%E2%9C%93&"),A.length>0?h+A:""}m();m();var Og="4.95.1";m();m();m();var tae=!1,Bg,dO,TOe,IOe,wOe,pO,ROe,l4,fO,mO,gO,c4,_O;function rae(e,t={auto:!1}){if(tae)throw new Error(you must `import 'openai/shims/${e.kind}'` before importing anything else from openai);if(Bg)throw new Error(can't `import 'openai/shims/${e.kind}'` after `import 'openai/shims/${Bg}'`);tae=t.auto,Bg=e.kind,dO=e.fetch,TOe=e.Request,IOe=e.Response,wOe=e.Headers,pO=e.FormData,ROe=e.Blob,l4=e.File,fO=e.ReadableStream,mO=e.getMultipartRequestOptions,gO=e.getDefaultAgent,c4=e.fileFromPath,_O=e.isFsReadStream}m();var Of=Ne(Gae(),1);m();m();uS();o7();import{inspect as j7e}from"util";m();q4();var foe=e=>e instanceof wd;z4();m();import{deprecate as K7e}from"util";var moe=K7e(()=>{},'Constructor "entries" argument is not spec-compliant and will be removed in next major release.');var Rd=function(e,t,r,n){if(r==="a"&&!n)throw new TypeError("Private accessor was defined without a getter");if(typeof t=="function"?e!==t||!n:!t.has(e))throw new TypeError("Cannot read private member from an object whose class did not declare it");return r==="m"?n:r==="a"?n.call(e):n?n.value:t.get(e)},$4,Nd,s7,K4=class{constructor(t){$4.add(this),Nd.set(this,new Map),t&&(moe(),t.forEach(({name:r,value:n,fileName:a})=>this.append(r,n,a)))}static[(Nd=new WeakMap,$4=new WeakSet,Symbol.hasInstance)](t){return!!(t&&ci(t.constructor)&&t[Symbol.toStringTag]==="FormData"&&ci(t.append)&&ci(t.set)&&ci(t.get)&&ci(t.getAll)&&ci(t.has)&&ci(t.delete)&&ci(t.entries)&&ci(t.values)&&ci(t.keys)&&ci(t[Symbol.iterator])&&ci(t.forEach))}append(t,r,n){Rd(this,$4,"m",s7).call(this,{name:t,fileName:n,append:!0,rawValue:r,argsLength:arguments.length})}set(t,r,n){Rd(this,$4,"m",s7).call(this,{name:t,fileName:n,append:!1,rawValue:r,argsLength:arguments.length})}get(t){let r=Rd(this,Nd,"f").get(String(t));return r?r[0]:null}getAll(t){let r=Rd(this,Nd,"f").get(String(t));return r?r.slice():[]}has(t){return Rd(this,Nd,"f").has(String(t))}delete(t){Rd(this,Nd,"f").delete(String(t))}*keys(){for(let t of Rd(this,Nd,"f").keys())yield t}*entries(){for(let t of this.keys()){let r=this.getAll(t);for(let n of r)yield[t,n]}}*values(){for(let[,t]of this)yield t}[(s7=function({name:r,rawValue:n,append:a,fileName:i,argsLength:o}){let c=a?"append":"set";if(o<2)throw new TypeError(Failed to execute '${c}' on 'FormData': 2 arguments required, but only ${o} present.);r=String(r);let d;if(i7(n))d=i===void 0?n:new fu([n],i,{type:n.type,lastModified:n.lastModified});else if(foe(n))d=new fu([n],i===void 0?"blob":i,{type:n.type});else{if(i)throw new TypeError(Failed to execute '${c}' on 'FormData': parameter 2 is not of type 'Blob'.);d=String(n)}let f=Rd(this,Nd,"f").get(r);if(!f)return void Rd(this,Nd,"f").set(r,[d]);if(!a)return void Rd(this,Nd,"f").set(r,[d]);f.push(d)},Symbol.iterator)](){return this.entries()}forEach(t,r){for(let[n,a]of this)t.call(r,a,n,this)}get[Symbol.toStringTag](){return"FormData"}[j7e.custom](){return this[Symbol.toStringTag]}};q4();uS();var D7=Ne(Toe(),1),ese=Ne(Qoe(),1);import{ReadStream as wBe}from"node:fs";m();m();m();var Uoe="abcdefghijklmnopqrstuvwxyz0123456789";function fBe(){let e=16,t="";for(;e--;)t+=Uoe[Math.random()*Uoe.length<<0];return t}var Goe=fBe;m();var mBe=e=>Object.prototype.toString.call(e).slice(8,-1).toLowerCase();function gBe(e){if(mBe(e)!=="object")return!1;let t=Object.getPrototypeOf(e);return t==null?!0:(t.constructor&&t.constructor.toString())===Object.toString()}var h7=gBe;m();var _Be=e=>String(e).replace(/\r|\n/g,(t,r,n)=>t==="\r"&&n[r+1]!==
^

Error: Sandbox was mandated, but no sandbox is available!
at hOe (file:///usr/local/lib/node_modules/@openai/codex/dist/cli.js:468:433)
at iO (file:///usr/local/lib/node_modules/@openai/codex/dist/cli.js:466:2281)
at $ne (file:///usr/local/lib/node_modules/@openai/codex/dist/cli.js:466:1418)
at dE.handleFunctionCall (file:///usr/local/lib/node_modules/@openai/codex/dist/cli.js:490:4648)
at dE.processEventsWithoutStreaming (file:///usr/local/lib/node_modules/@openai/codex/dist/cli.js:492:3562)
at dE.run (file:///usr/local/lib/node_modules/@openai/codex/dist/cli.js:491:3235)
at process.processTicksAndRejections (node:internal/process/task_queues:105:5)

Node.js v22.15.0

[JonKragh]

same. I had to downgrade: npm i -g @openai/codex@0.1.2504251709

running wsl2 on windows

p.s., ty for this amazing product!

[philkunz]

same here on ubuntu server

[xuezhaojun]

same

[jquiros2]

same. guessing i should look into creating a real sandbox, for safety's sake. no "at-hand" docs for this, yet.

[somainteligencia]

Same error here, wsl windows 11

Error: Sandbox was mandated, but no sandbox is available!
at hOe (file:///home/user/.nvm/versions/node/v22.14.0/lib/node_modules/@openai/codex/dist/cli.js:468:433)
at iO (file:///home/user/.nvm/versions/node/v22.14.0/lib/node_modules/@openai/codex/dist/cli.js:466:2281)
at $ne (file:///home/user/.nvm/versions/node/v22.14.0/lib/node_modules/@openai/codex/dist/cli.js:466:1418)
at dE.handleFunctionCall (file:///home/user/.nvm/versions/node/v22.14.0/lib/node_modules/@openai/codex/dist/cli.js:490:4648)
at dE.processEventsWithoutStreaming (file:///home/user/.nvm/versions/node/v22.14.0/lib/node_modules/@openai/codex/dist/cli.js:492:3562)
at dE.run (file:///home/user/.nvm/versions/node/v22.14.0/lib/node_modules/@openai/codex/dist/cli.js:491:3235)
at process.processTicksAndRejections (node:internal/process/task_queues:105:5)

[lemmski]

I encountered this on ubuntu24.04 wsl2 as well. Downgrade helped.

[pysupremacy]

Same for me on Linux Mint 22
node -v: v22.15.0
npm -v: 10.9.2

[get-loose]

Same
Manjaro
node --version v23.9.0

#849

[xuezhaojun]

I don't think sandbox is necessary. The tool user should ensure and confirm whether they're using sandbox env or not, not tool itself.

[gwpl]

The tool user should ensure and confirm whether they're using sandbox env or not, not tool itself.

I understand that for "average user" one may want to ensure that by default it does safety checks,

still :

User should be able to OVERWRITE with flag or env variable or both, and say "Behave like you are running in sandbox",

as sandbox maybe virtual machine that may look for bot like it's not sandbox while actually it is.

[codex-maintainers]

Thank you for the feedback! Please try using the latest version of Codex CLI, which has been rewritten in Rust for improved stability and performance. You can install it via brew install codex. If the issue persists, feel free to report it again. More details on the update are available here.