Angelia

Angelia · Updated

Angelia for Codex: setup, sandbox, approvals and limits

Angelia connects the Codex CLI on your Mac to WhatsApp and Telegram. Each chat gets its own Codex session, in its own folder. Codex runs every command inside its own sandbox, which the operating system enforces, and Angelia gives that sandbox the profile's rules. Angelia runs no model of its own: Codex does the work, under your own codex login.

What Angelia does for Codex

What you need

Set it up

curl -fsSL https://useangelia.com/install | sh
angelia service install

The first line checks the release's signature, installs Angelia and starts a setup wizard (read the script). Pick Quick or Advanced, then Telegram, WhatsApp or both. Pick Codex as the CLI, then send the bot (or the second number) a message from your phone to pair the chat. The second line keeps Angelia running.

Already running Angelia with another CLI? An owner sends /backend codex in one of the profile's chats. Angelia edits the routing table, ~/.angelia/workspace/routing.yaml, with a backup, compiles the profile for Codex and starts a fresh session. A session never moves between CLIs. /backend alone lists the CLIs installed.

To let the agent write in a repo, list it in the profile's add_dirs in routing.yaml:

profiles:
  main: { cwd: ~/.angelia/workspace/profiles/main, backend: codex, permission_mode: default, add_dirs: [~/code/my-app] }

Then accept the change to the routing table and compile the profile's rules. angelia compile refuses while routing.yaml has changes you have not accepted, so accept first:

angelia accept
angelia compile main --write

Send /restart in the chat. If the restart would give the profile new rights, Angelia lists them; then send /restart confirm.

What works from the chat

Approvals

Inside its sandbox, Codex runs commands without asking. It asks in the chat only for more access than the sandbox gives, such as write access to one more folder for this turn:

🔐 more access, this turn: write access to /Users/example/code/other. Or add the folder to add_dirs instead.
Reply "yes 6b480a6f" or "no 6b480a6f".

A yes grants exactly that, for that turn. The deny rules still hold, so a yes never opens another profile's folder or your credentials. A no grants nothing. No answer in ten minutes means no. In a group, other members can talk to the agent but cannot approve. A lasting fix is the folder in add_dirs.

What the sandbox allows

Voice notes, photos and files

A photo or document you send lands in the profile's .inbox/ folder, up to 20 MB, and Codex gets a [file: path] line. A voice note arrives as [voice note: path], and the agent runs angelia transcribe <path>. Codex sends files back with angelia send-media. Every path is checked first: never a credential location, never another profile's folder.

Chat commands

/new, /stop, /status, /resume, /model, /effort, /backend, /restart and the others /help lists are answered by Angelia, without spending a token. /model alone shows the models Codex lists, and /effort the levels of the model in use. A model or level Codex does not offer is refused. Without a model in the profile, Codex's own default is used. /compact goes to Codex's own compaction. Long answers are split as for every CLI.

Tested

On 2026-10-27, with Angelia 0.3.22 and Codex 0.163.0 on macOS, in a WhatsApp group routed to one profile in permission_mode: default:

Codex on Telegram is not tested yet. Voice notes are tested with Claude Code only.

Limits

Try Angelia

curl -fsSL https://useangelia.com/install | sh

It checks the release's signature, then a wizard pairs your first chat. Free and open source (MIT). How it works · Why Codex runs this way · GitHub