How to fix the Codex trusted-directory error

The launch directory of an editor task or scheduled job can differ from the project it is meant to inspect. When Codex reports a trusted-directory error, selecting that project's Git repository can restore the blocked task.

The repository guard stops codex exec before its prompt reaches the model. It is separate from authentication and from project trust settings such as trust_level, which control whether project-local configuration is loaded.

This fix applies to an existing Git project with a working Codex CLI model connection. Selecting its directory does not require broader trust or full-access execution, and a read-only task can keep its normal sandbox.

1. Identify the repository-guard message in the failed task's output.

   Not inside a trusted directory and --skip-git-repo-check was not specified.

   This message identifies a launch-directory check. A login, provider, approval, or sandbox error needs a separate diagnosis; reproducing the failure is unnecessary.

2. Confirm the root of the existing Git project that should own the task.

   $ git -C /work/example-app rev-parse --show-toplevel
   /work/example-app

   The path represents your existing checkout and must contain the files the task needs. A parent folder or another project's repository selects the wrong context. The message fatal: not a git repository means the supplied path is outside a working tree.

3. Retry the original task with that repository selected as the working directory.

   $ codex exec -C /work/example-app --sandbox read-only "What directory are you working in?"

   The -C option selects the Codex working directory without changing the parent shell's directory. The directory question is a benign example; your retry should keep the original task and its normal sandbox settings. A repository-guard error does not require disabling the sandbox or marking a parent directory as trusted.
   Related: How to set the working directory for Codex

4. Confirm that Codex completes the original task in the selected project.

   ##### snipped #####
   workdir: /work/example-app
   ##### snipped #####
   codex
   You are currently working in the directory `/work/example-app`.

   The workdir line identifies the selected checkout, and the response should answer the original request. A different project, another guard message, or a later provider error means the original task has not completed.