How to fix the Codex trusted-directory error

The Codex trusted-directory error appears when codex exec starts with a working root that is not inside a Git repository. The command stops before the prompt runs, which usually means a shell, wrapper script, scheduler, or editor task launched Codex from the wrong folder.

For project work, keep the repository guard enabled and point Codex at the repository that should own the task. Git can prove whether the current directory belongs to a repository, and -C or --cd can select the repository root when the parent shell starts somewhere else.

The --skip-git-repo-check flag is for intentional scratch directories, not normal project repairs. It does not mark project-scoped .codex/config.toml as trusted, load project hooks, change authentication, or widen the sandbox; it only bypasses the non-interactive repository check for that run.

Steps to fix the Codex trusted-directory error:

Reproduce the failure from the directory that launched the blocked run.
```
$ codex exec --sandbox read-only "Return OK."
Not inside a trusted directory and --skip-git-repo-check was not specified.
```
The message appears before the prompt reaches the model, so it is separate from login, API key, sandbox, and approval errors.
Check whether the current directory is inside a Git working tree.
```
$ git rev-parse --show-toplevel
fatal: not a git repository (or any of the parent directories): .git
```
If this command prints a repository path, the failing Codex command was probably started from another shell location or with a different working-root flag.
Change to the repository that should own the Codex run.
```
$ cd /home/user/projects/example-repo
```
For wrapper scripts or scheduled jobs, pass the repository path with -C /home/user/projects/example-repo instead of relying on the parent shell directory.
Related: How to set the working directory for Codex
Confirm that the selected directory is now the intended repository.
```
$ git rev-parse --show-toplevel
/home/user/projects/example-repo
```
The printed path should be the repository root or a parent directory of the files Codex needs to inspect.
Run codex exec again from the repository.
```
$ codex exec --sandbox read-only "Return OK."
OK
```
If the CLI is not authenticated, the next error may ask for login or an API key instead of returning OK. The trusted-directory problem is fixed once this specific repository error no longer appears.

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.