Codex CLI 0.156.0 closes sandbox gaps on three platforms

The release notes give the sandbox work one line: the release closes "sandbox isolation gaps involving inbound Windows connections, privileged Linux/macOS sockets, and writes through read-only macOS file handles." The linked pull requests say what each gap was. On Windows, the offline sandbox's firewall block "covered only outbound traffic"; #44639 adds a matching inbound block. On macOS, two file-control operations "can mutate files through read-only descriptors, bypassing file-write* and file-ioctl restrictions"; #46500 denies both whenever the policy lacks full disk write access. #45984 stops commands under filesystem restrictions from reaching the privileged app-server's Unix sockets, including when network access or socket allowlists grant broader access. Each pull request describes regression tests added with the fix. GitHub shows the release published at 19:51 UTC.

The socket fix comes with a configuration change. Per #45984, Codex now requires bubblewrap for filesystem-restricted execution on Linux, and "Users with features.use_legacy_landlock enabled must disable it for these policies." The same release also turns worktree support on by default and adds a /usage dashboard showing token totals and plugin and skill activity.

Why it matters: OpenAI's own pull requests say that before this release, a macOS command under a read-only or workspace-write policy could still modify files through two operations, and the Windows offline sandbox's firewall rule did not cover inbound traffic. If you run Codex unattended under those policies, upgrade. On Linux, confirm bubblewrap is available and legacy Landlock is off, because this release makes the first a requirement and the second incompatible with restricted policies.