# Codex CLI: the "build" policy, with its directory and the network, but
# not its telemetry. It can change its own config, rules and skills,
# which run outside the sandbox later. policies/commands/codex.policy in
# blinker's config directory comes first.

# type  access  pattern
include build
file    write   ${CODEX_HOME:-~/.codex}/
env     allow   CODEX_HOME
env     allow   OPENAI_API_KEY

host    allow   *
host    deny    ab.chatgpt.com