From 71c231a9e751b6f122e7a7981ae943d7f74c538a Mon Sep 17 00:00:00 2001 From: garrytan Date: Sat, 3 Oct 2026 21:19:40 +0000 Subject: [PATCH] B1: state the effective read-only sandbox in /codex review prose The codex parity invariant requires the skill to state sandbox_mode="read-only"; the command now takes it from _GSTACK_CODEX_SANDBOX, so the prose names the effective default explicitly. --- codex/sections/review-mode.md.tmpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/codex/sections/review-mode.md.tmpl b/codex/sections/review-mode.md.tmpl index b957eeded..21afb3579 100644 --- a/codex/sections/review-mode.md.tmpl +++ b/codex/sections/review-mode.md.tmpl @@ -35,8 +35,8 @@ Use only one command path below. Remember its printed start token as CODEX_REVIE **Sandbox is pinned via config override.** Top-level `codex review` has no `-s`/`--sandbox` flag (verified on 0.147.0: `codex review --help` lists none), so the -sandbox is set with `-c "sandbox_mode=..."` from `_GSTACK_CODEX_SANDBOX`, which -`_gstack_codex_select_model` sets to `read-only` (full access only for +sandbox is set with `-c` from `_GSTACK_CODEX_SANDBOX`, which `_gstack_codex_select_model` +sets so the effective setting is `sandbox_mode="read-only"` (full access only for `GSTACK_CODEX_NO_SANDBOX=1`, with a warning). Without it the call inherits the user's `~/.codex/config.toml` default, which on a trusted project can be WRITE access — contradicting this skill's read-only contract (#2496, #2524):