Module dangerous 

Opt-in access to the flags that disable codex’s safety controls.

--dangerously-bypass-approvals-and-sandbox turns off every approval prompt and the sandbox. --dangerously-bypass-hook-trust lets configured hooks run without confirmation. Both were plain builder methods, reachable from any chain by autocomplete, by a copied snippet, or by an agent editing a call site. A method name is not a barrier.

They now need two things that cannot both happen by accident:

1. A DangerousClient, which only constructs when CODEX_WRAPPER_ALLOW_DANGEROUS is set in the process environment.
2. A call through Dangerous, passing that client, which re-checks the variable at the point of use.

The second check is not redundant. A client built while the variable was set stops working the moment it is unset, so the gate reflects the environment at the moment the bypass is applied rather than whenever the client happened to be created.

The name matches the sibling crate’s CLAUDE_WRAPPER_ALLOW_DANGEROUS.

Example

use codex_wrapper::{ExecCommand, dangerous::{Dangerous, DangerousClient}};

// Without the environment variable, there is no way through.
assert!(DangerousClient::new().is_err());

use codex_wrapper::{CodexCommand, ExecCommand};
use codex_wrapper::dangerous::{Dangerous, DangerousClient};

// With CODEX_WRAPPER_ALLOW_DANGEROUS set in the environment:
let allow = DangerousClient::new()?;
let output = ExecCommand::new("rewrite everything")
    .bypass_approvals_and_sandbox(&allow)?
    .execute(codex)
    .await?;

Structs

DangerousClient

Proof that bypassing codex’s safety controls is permitted here.

Constants

ALLOW_DANGEROUS_ENV

The environment variable that unlocks the bypass flags.

Traits

Dangerous

Bypassing codex’s safety controls, for the builders that support it.