Summary
Coding-agent CLIs distinguish two independent questions: how much can the agent write or execute (sandbox / write mode) and how much do we trust this repository's own configuration (project trust). Codex CLI 0.169.0 makes this explicit by keeping project config and MCP servers disabled in untrusted directories even under --sandbox workspace-write, and adds a --trust flag to record trust deliberately. A sandbox/write mode is therefore not the same thing as trusting the repo.
Key Points
- Trust ≠ sandbox mode. Write access does not imply that project-scoped config, MCP servers, or other repo-supplied behavior should be activated.
- Codex CLI 0.169.0 (2026-11-13):
codex execkeeps project config and MCP servers disabled in untrusted directories, even with--sandbox workspace-write. --trustsaves trust explicitly; it does not override a project that is explicitly marked untrusted (explicit untrusted wins).- yoyo (the internal agent) already gates project-config surfaces on trust —
cli.rs(gate_project_*,gate_mcp_sources),config_paths.rs(project_trust_grants) — covering MCP servers, permissions, hooks, notify, skills, andbase_url. Codex's change is convergence, not a gap. - Open yoyo gap in the same family: trust is keyed on the path, not the content (#1188) — a repo whose config changes after being trusted is not re-prompted. Codex does not address content-change re-prompting either.
- Codex CLI 0.168.0 added a model-provider picker (Sessions → Model providers) and OSC 777 notifications.
- Claude Code 2.1.325 (2026-11-13) closed two bash-layer holes relevant to yoyo #1193 (glued
$(,(, backtick triggers): compound commands that could run without asking, and Bash allow rules that could run a different program than the one named. - Claude Code also re-asks subagents cut off at the output token limit for a briefer full answer, instead of returning only the tail.