From 4c66978591fb51fa661ede6f67cc87f12d403735 Mon Sep 17 00:00:00 2001
From: Pedro Gonzalez <19900049+plgonzalezrx8@users.noreply.github.com>
Date: Thu, 16 Apr 2026 12:32:29 +0000
Subject: [PATCH] security(codex): restore sandbox protections for resumed CLI
 sessions

---
 extensions/openai/cli-backend.ts | 2 +-
 src/agents/cli-backends.test.ts  | 9 ++-------
 2 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/extensions/openai/cli-backend.ts b/extensions/openai/cli-backend.ts
index 1d9c7ccc285..256d9222956 100644
--- a/extensions/openai/cli-backend.ts
+++ b/extensions/openai/cli-backend.ts
@@ -31,7 +31,7 @@ export function buildOpenAICodexCliBackend(): CliBackendPlugin {
         "workspace-write",
         "--skip-git-repo-check",
       ],
-      resumeArgs: ["exec", "resume", "{sessionId}", "--dangerously-bypass-approvals-and-sandbox"],
+      resumeArgs: ["exec", "resume", "{sessionId}"],
       output: "jsonl",
       resumeOutput: "text",
       input: "arg",
diff --git a/src/agents/cli-backends.test.ts b/src/agents/cli-backends.test.ts
index 46c3bb56cf2..49638c8f8e2 100644
--- a/src/agents/cli-backends.test.ts
+++ b/src/agents/cli-backends.test.ts
@@ -244,7 +244,7 @@ beforeEach(() => {
           "workspace-write",
           "--skip-git-repo-check",
         ],
-        resumeArgs: ["exec", "resume", "{sessionId}", "--dangerously-bypass-approvals-and-sandbox"],
+        resumeArgs: ["exec", "resume", "{sessionId}"],
         systemPromptFileConfigArg: "-c",
         systemPromptFileConfigKey: "model_instructions_file",
         systemPromptWhen: "first",
@@ -322,12 +322,7 @@ describe("resolveCliBackendConfig reliability merge", () => {
       "workspace-write",
       "--skip-git-repo-check",
     ]);
-    expect(resolved?.config.resumeArgs).toEqual([
-      "exec",
-      "resume",
-      "{sessionId}",
-      "--dangerously-bypass-approvals-and-sandbox",
-    ]);
+    expect(resolved?.config.resumeArgs).toEqual(["exec", "resume", "{sessionId}"]);
   });
 
   it("deep-merges reliability watchdog overrides for codex", () => {