github-outside-sandbox

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Chinese

Start normally. Escalate only the blocked command and only within the user's authorization.
If sandboxed
```
gh auth status
```
fails, rerun it outside the sandbox before claiming authentication is broken. Never expose or copy tokens.
Run GitHub CLI network operations outside the sandbox when required:
```
gh repo ...
```
,
```
gh pr ...
```
, and related
```
gh
```
commands.
Run Git writes outside the sandbox when
```
.git
```
is outside writable roots or errors mention
```
index.lock
```
or
```
Operation not permitted
```
:
```
git add
```
,
```
git commit
```
, and
```
git push
```
.
Use the harness's official host-execution mechanism. In Codex, set
```
sandbox_permissions: "require_escalated"
```
, give a concrete
```
justification
```
, and use only a narrow safe
```
prefix_rule
```
when appropriate.
Never use shell wrappers, credential copying, or broad approval prefixes to bypass the sandbox.
Verify from the host context with
```
git status -sb
```
,
```
git remote -v
```
, and the relevant
```
gh ... view
```
command. Ask the user to authenticate only if the host-context check also fails.