Codex CLI in YOLO mode on Mac: limit file access
codex --yolo switches off every prompt: Codex reads, writes and executes without asking. That's the fastest workflow — and the most open one: the agent runs with your full user rights, including ~/.ssh, keychains and every document you own. Between „allow everything" and „approve everything" sits the Seatbelt sandbox: set the boundaries once before launch, then let it work freely.
Setup: terminal launcher with Codex grants
Codex CLI runs in a terminal — so ScopeShelf sandboxes the terminal session. Tested with Codex CLI 0.153.4 (Homebrew install) on macOS 26:
- Install ScopeShelf and launch it once.
- Create a launcher for your terminal: New launcher → click iTerm or Terminal in the row of installed apps.
- Add these grants:
# Writable: ~/your-project-folder # the code Codex works on ~/.codex # Codex config, auth, session data # Individual file (optional): ~/.gitconfig # git identity for commits
Homebrew tools need no extra grant: /opt/homebrew is outside your home folder and reachable via allow default — so the codex binary installed there starts without any additional rule. Keep network „allowed" (API access).
- Save, then click Start shell. ScopeShelf asks once for the project folder (it becomes writable and is remembered) and opens a new terminal window with a sandboxed shell. Work inside it:
codex --yolo, with sandbox boundaries instead of no safety net at all. Details for every setting: terminal help page.
Via the CLI
scopeshelf add "Terminal Codex" --app /Applications/iTerm.app --write ~/.codex scopeshelf dry terminal-codex # inspect the profile scopeshelf shell terminal-codex --cd ~/repos/my-project # sandboxed shell, project writable
The protection test (verified)
codex --version # works normally inside the profile cat ~/.ssh/config # Operation not permitted — invisible to the session
Everything else in the home folder is gone — kernel-enforced, not convention-based. Blocked accesses show up visibly in ScopeShelf's audit log (operation, path, frequency).
The honest limits
- Inside the project folder Codex may delete and modify — that's by design. git protects you there; the sandbox protects everything else.
- Network stays open (the API needs it). The network switch is all-or-nothing per launcher.
- System services outside $HOME stay allowed — the profile denies the home folder specifically instead of everything, so nothing breaks. A documented design decision.
- Prompt injection in the granted area remains your risk — the sandbox limits access, not intent.
Bottom line
--yolo doesn't have to mean Codex can read your whole life. One launcher for the terminal, three grants, and YOLO mode runs inside visible, reusable boundaries — the same setup also works for Claude Code and other AI tools in the same terminal.
ScopeShelf is being prepared for macOS 27. Purchases and downloads are paused. Launch announcement · Read next: Use Claude Code without constant permission prompts