docs: recommend :minimal = write alongside :root = write in Codex CLI FAQ#2311
Merged
Conversation
… FAQ The always-emitted ":minimal" = "read" baseline is a write-narrowing entry in Codex's permission model, so ":root" = "write" alone does not restore full disk write access. Document pairing it with ":minimal": "allow" and the import caveat that :minimal never round-trips. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Add tests: canonical :minimal write rule overrides the read baseline on generate; a customized :minimal is dropped on import and falls back to read on regenerate. - Fix file-formats.md drift: :minimal is seeded as read but user-overridable on generate, and never round-trips through import. - Strengthen the FAQ trade-off disclosure with a concrete compromise scenario and add an inline note after the example block. - Align the source comment in codexcli-permissions.ts with the actual override behavior. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Owner
Author
|
@dyoshikawa Thank you! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Codex CLI FAQ entry recommended adding
":root": "allow"to the canonical write rules so package runners and home-directory caches work, but that alone is not enough: rulesync always emits":minimal" = "read"as a fixed baseline, and Codex treats that entry as a write-narrowing rule — the policy no longer qualifies for full disk write access (FileSystemSandboxPolicy::has_full_disk_write_access), so writes that:rootappears to allow can still be denied.This PR updates the FAQ to:
":minimal": "allow"to the example write block alongside":root": "allow".:rootbullet why:minimalmust be raised to write together with:root.:minimalis never imported regardless of its value (it is rulesync's fixed baseline), so afterrulesync importthe write rule must be re-authored or the next generate drops back to":minimal" = "read".skills/rulesync/faq.mdis regenerated byscripts/sync-skill-docs.ts.🤖 Generated with Claude Code