Windows: Force delete without confirmation

[448523760]

What version of Codex is running?

0.77.0

What subscription do you have?

no subscription

Which model were you using?

custom

What platform is your computer?

Microsoft Windows NT 10.0.26100.0 x64

What issue are you seeing?

The force delete functionality behaves inconsistently between Windows and Linux platforms when --ask-for-approval on-request is configured. On Windows, the operation executes without requesting user confirmation, while on Linux, a similar force delete operation (rm -rf) properly prompts for approval.

If such commands are executed without an explicit user confirmation step, the system may delete these files directly, increasing the risk of accidental or unintended file loss.

What steps can reproduce the bug?

Windows Platform:

1. Create a test directory structure:

   mkdir test
   echo "content" > test/test.txt

2. Make test.txt read-only:

   attrib +r test/test.txt

3. Verify that direct deletion is blocked (without admin privileges):

   cd test
   rm test.txt
   # Expected: Error - "You do not have sufficient access rights to perform this operation"

4. Run codex with -a on-request and tell it to remove the test

   cd ..
   codex -a on-request
   

       › delete the test folder
       
       
       • I'll help you delete the test folder. Let me first check what's in the current directory and then remove the test
         folder.
       
       • Ran Get-ChildItem -Force
         └
       
           … +8 lines
       
       
       
       ─ Worked for 4s ────────────────────────────────────────────────────────────────────────────────────────────────────────
       
       • Ran Remove-Item -Path 'test' -Recurse -Force
         └ (no output)
       
       ─ Worked for 6s ────────────────────────────────────────────────────────────────────────────────────────────────────────
       
       • Ran Get-ChildItem -Force
         └
       
           … +7 lines
       
       ```
   
   

What is the expected behavior?

ask user to approval before execute the command

Additional information

No response

[etraut-openai]

Refer to this documentation about the sandboxing mechanism in Codex. The sandbox is implemented in MacOS and Linux. If you're using Windows, we recommend using Windows Subsystem for Linux (WSL).

We are in the process of implementing a sandbox mechanism for the native Windows environment. It's available in experimental form today, but there are still known holes that we are working to fix. Refer to the documentation here for details if you would like to try the experimental sandbox in Windows.

[448523760]

Hi @etraut-openai,

I'd like to clarify to ensure we're on the same page regarding two distinct concepts:

• Ask-for-approval: This is a user-facing decision stage that occurs before any command execution. It reflects the user's subjective choice to authorize or deny a requested action.
• Sandboxing: This is a system-level runtime protection mechanism that applies during execution.

This separation matters because: if a user denies approval, the command should never reach the execution stage at all—and therefore, sandboxing should not be invoked.

Additionally, I submitted PR #8568, which flags force delete operations as dangerous. This prompts the user to explicitly confirm or cancel the action before execution, rather than relying on the sandbox to protect the system after the command has already been initiated.

[anowardear062-svg]

Thanks