Cmd. /setup-default-sandbox
Set up the elevated Windows agent sandbox when Codex is running in degraded restricted-token mode.
Key takeaways
- Set up the elevated Windows agent sandbox when Codex is running in degraded restricted-token mode.
- Check the input surface and availability before using the examples below.
Purpose
Set up the elevated Windows agent sandbox when Codex is running in degraded restricted-token mode.
/setup-default-sandboxAvailability
| Field | Value |
|---|---|
| Input surface | Running CLI prompt |
| Kind | Built-in |
| Status | Conditional |
| Aliases | — |
| Documented minimum | Not specified |
| Reviewed against | 2026-09-22 · Codex CLI 0.155.1 |
Native Windows only; distinguish this from Linux sandboxing under WSL.
Examples
/setup-default-sandboxWhen to use it
- Run it after Codex detects the degraded Windows sandbox and offers elevated setup.
- Verify the resulting sandbox and approval state with
/statusand/permissions.
Choosing related commands
| Command | Difference | Choose It When |
|---|---|---|
/setup-default-sandbox | Installs the elevated Windows sandbox | You need to replace degraded mode |
/sandbox-add-read-dir | Grants one extra absolute read path | Only a specific external directory is blocked |
/permissions | Changes approval profiles | You need a session policy change without installation |
Effects and persistence
Runs the Windows default-sandbox setup flow.
/setup-default-sandbox configures the elevated Windows agent sandbox when Codex detects degraded mode.
Cautions
- This is Windows-only and appears only in the degraded restricted-token state.
- Check organizational endpoint and security policy before the administrator flow.
- Re-check the effective mode and writable roots with
/statusafterward.
Official sources
Complete command list · Verification scope · History for this command