deepseek-ai/awesome-deepseek-agent
1
0
Fork 0
mirror of https://github.com/deepseek-ai/awesome-deepseek-agent.git synced 2026-11-05 01:07:37 +00:00
Code Issues 354 Projects Packages Wiki Activity

[GH-ISSUE #105] docs(codex): document sandbox_mode config requirement for write access #39

New issue
Open
opened 2026-10-26 09:44:08 +00:00 by bsakaguchi · 2 comments
bsakaguchi commented 2026-10-26 09:44:08 +00:00
Owner
Copy link

Originally created by @Jarvis-Baba on GitHub (May 13, 2026).
Original GitHub issue: https://github.com/deepseek-ai/awesome-deepseek-agent/issues/105

Problem

The Codex integration guide (docs/codex.md) generates a config.toml without sandbox_mode. This defaults to read-only, which means:

  • File creation via exec → echo > file fails
  • apply_patch tool cannot write files
  • Users see "The filesystem is read-only" and think DeepSeek can't write code

Root cause

The correct config key is sandbox_mode (not sandbox). Valid values:

  • read-only (default)
  • workspace-write — allows writes to workspace, /tmp, memories
  • danger-full-access — full disk write access

When sandbox_mode is not explicitly set, Codex defaults to read-only and ALL file mutations fail regardless of the model's capability.

Evidence

Tested with Moon Bridge + DeepSeek V4 + Codex CLI v0.128.0:

sandbox_mode exec read exec write apply_patch
(default / read-only) ✅ ❌ ❌
workspace-write ✅ ✅ ✅

With workspace-write, DeepSeek V4 successfully:

  • Creates files via echo > /tmp/file.py
  • Edits files via apply_patch with correct git diff format
  • Runs the modified code and verifies output

Suggested fix

Add a note in the Codex integration guide about setting sandbox_mode in config.toml:

sandbox_mode = "workspace-write"

Or update the config generation to include this setting by default.

Related

Originally created by @Jarvis-Baba on GitHub (May 13, 2026). Original GitHub issue: https://github.com/deepseek-ai/awesome-deepseek-agent/issues/105 ## Problem The Codex integration guide (docs/codex.md) generates a config.toml without `sandbox_mode`. This defaults to `read-only`, which means: - File creation via `exec` → `echo > file` fails - `apply_patch` tool cannot write files - Users see "The filesystem is read-only" and think DeepSeek can't write code ## Root cause The correct config key is `sandbox_mode` (not `sandbox`). Valid values: - `read-only` (default) - `workspace-write` — allows writes to workspace, /tmp, memories - `danger-full-access` — full disk write access When `sandbox_mode` is not explicitly set, Codex defaults to `read-only` and ALL file mutations fail regardless of the model's capability. ## Evidence Tested with Moon Bridge + DeepSeek V4 + Codex CLI v0.128.0: | sandbox_mode | exec read | exec write | apply_patch | |---|---|---|---| | (default / read-only) | ✅ | ❌ | ❌ | | workspace-write | ✅ | ✅ | ✅ | With `workspace-write`, DeepSeek V4 successfully: - Creates files via `echo > /tmp/file.py` - Edits files via `apply_patch` with correct git diff format - Runs the modified code and verifies output ## Suggested fix Add a note in the Codex integration guide about setting `sandbox_mode` in config.toml: ```toml sandbox_mode = "workspace-write" ``` Or update the config generation to include this setting by default. ## Related - Moon Bridge PR with protocol-level fixes: https://github.com/ZhiYi-R/moon-bridge/pull/29
bsakaguchi commented 2026-10-26 09:44:09 +00:00
Author
Owner
Copy link

@BenedictKing commented on GitHub (May 14, 2026):

试试 #55 完美接入codex和claude，还能无缝切换其他渠道

<!-- gh-comment-id:4446473728 --> @BenedictKing commented on GitHub (May 14, 2026): 试试 [#55](https://github.com/deepseek-ai/awesome-deepseek-agent/pull/55) 完美接入codex和claude，还能无缝切换其他渠道
bsakaguchi commented 2026-10-26 09:44:10 +00:00
Author
Owner
Copy link

@mustardwheat commented on GitHub (May 14, 2026):

PR merged.

<!-- gh-comment-id:4449390346 --> @mustardwheat commented on GitHub (May 14, 2026): PR merged.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

No labels
pull-request
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
deepseek-ai/awesome-deepseek-agent#39
No description provided.