Codex: إعدادات أذونات Codex

codex --sandbox readonly

codex --sandbox workspace-write

codex --sandbox full-access

def choose_sandbox(task_type):
    modes = {
        "code_review": "readonly",
        "daily_dev": "workspace-write",
        "full_migrate": "full-access",
    }
    return modes.get(task_type, "workspace-write")

# Alice's work today
print(choose_sandbox("code_review"))    # readonly
print(choose_sandbox("daily_dev"))      # workspace-write
print(choose_sandbox("full_migrate"))   # full-access

# ~/.codex/config.toml

[approval]
# Shell command approval
shell_commands = "ask"

# File write approval
file_writes = "ask"

# Network access approval
network_access = "deny"

# Sensitive path approval
sensitive_paths = "ask"

[approval]
shell_commands = "ask"

# Auto-approved safe commands
auto_approve_commands = [
    "git status",
    "git diff",
    "npm test",
    "pytest",
    "ls",
    "cat",
]

# Always-denied dangerous commands
always_deny_commands = [
    "rm -rf",
    "sudo",
    "chmod 777",
    "curl * | sh",
]

~/.ssh/
~/.gnupg/
/etc/
.env
.env.*
secrets/
credentials/
*.key
*.pem

[sandbox]
blocked_paths = [
    ".env",
    ".env.production",
    "secrets/",
    "credentials/",
    "config/production.yml",
    "*.key",
    "*.pem",
]

# Bob's project sandbox config
[sandbox]
mode = "workspace-write"
allowed_paths = ["src/", "tests/", "docs/"]
blocked_paths = [
    ".env.production",
    "config/prod/",
    "secrets/",
    "deploy/",
]

# View all operations in the current session
codex --audit-log

# Output example
[10:30:15] READ   src/auth.ts          (auto-approved)
[10:30:18] WRITE  src/auth.ts          (approved by user)
[10:30:22] SHELL  npm test             (approved by user)
[10:30:25] WRITE  test/auth.test.ts    (approved by user)

[audit]
log_all_operations = true
log_file = "~/.codex/audit.log"
include_shell_output = true