@dnznjuan
Looks like this is the right setup I was looking for to run Codex & VSCode on a Mac:
Look for: /etc/codex/requirements.toml
It should have:
allowed_approval_policies = ["untrusted", "never"]
allowed_sandbox_modes = ["read-only", "workspace-write"]
allowed_web_search_modes = []
This file defines what can be set.
Then, look for [user]/.codex/config.toml
It should have:
approval_policy = "never"
sandbox_mode = "workspace-write"
web_search = "disabled"
[sandbox_workspace_write]
network_access = false
exclude_slash_tmp = true
exclude_tmpdir_env_var = true
writable_roots = []
This will let Codex do edits just on the project directory. And you can ask it to give you the commands for installations or searches that it needs.
Or get a mini and let it run rampant :)