Angelia 路 Updated 27 October 2026 # Angelia for Codex: setup, sandbox, approvals and limits Angelia connects the Codex CLI on your Mac to WhatsApp and Telegram. Each chat gets its own Codex session, in its own folder. Codex runs every command inside its own sandbox, which the operating system enforces, and Angelia gives that sandbox the profile's rules. Angelia runs no model of its own: Codex does the work, under your own `codex login`. ## What Angelia does for Codex - **One session per chat.** Each chat is routed to a profile: a folder with its own instructions and memory. Angelia keeps one `codex app-server` process per chat, and the session comes back after a restart. `/new` in one chat never touches another. - **The sandbox holds the profile's rules.** Angelia passes them on Codex's command line, where the agent cannot edit them. The agent writes only in the profile's folders and temp. It cannot read your credentials, Angelia's own files or the other profiles' folders, shell commands included. - **Your instructions.** Codex looks for `AGENTS.md`. Angelia names the profile's `CLAUDE.md` as the fallback, so one instruction file serves every CLI. If the folder also has an `AGENTS.md`, Codex reads that one instead, and `angelia compile` warns you. - **It keeps running.** As a LaunchAgent, Angelia starts at login and comes back after a crash. The chat answers whenever the Mac is on and awake. ## What you need - A Mac with Node 22.23.4+, 24.22.1+ or 26.12.1+ and git. - Codex 0.157 or newer, signed in with `codex login`. Check with `codex --version`. - A chat app on your phone. For Telegram, a bot token from [@BotFather](https://t.me/BotFather) ([more](https://useangelia.com/telegram/)). For WhatsApp, a second, established number, not your personal one ([why](https://useangelia.com/whatsapp/)). - Optional: `brew install openai-whisper ffmpeg` for voice notes. ## Set it up ``` curl -fsSL https://useangelia.com/install | sh angelia service install ``` The first line checks the release's signature, installs Angelia and starts a setup wizard ([read the script](https://github.com/korengast/angelia/blob/v0.3.24/install.sh)). Pick Quick or Advanced, then Telegram, WhatsApp or both. Pick Codex as the CLI, then send the bot (or the second number) a message from your phone to pair the chat. The second line keeps Angelia running. Already running Angelia with another CLI? An owner sends `/backend codex` in one of the profile's chats. Angelia edits the routing table, `~/.angelia/workspace/routing.yaml`, with a backup, compiles the profile for Codex and starts a fresh session. A session never moves between CLIs. `/backend` alone lists the CLIs installed. To let the agent write in a repo, list it in the profile's `add_dirs` in `routing.yaml`: ``` profiles: main: { cwd: ~/.angelia/workspace/profiles/main, backend: codex, permission_mode: default, add_dirs: [~/code/my-app] } ``` Then accept the change to the routing table and compile the profile's rules. `angelia compile` refuses while `routing.yaml` has changes you have not accepted, so accept first: ``` angelia accept angelia compile main --write ``` Send `/restart` in the chat. If the restart would give the profile new rights, Angelia lists them; then send `/restart confirm`. ## What works from the chat ### Approvals Inside its sandbox, Codex runs commands without asking. It asks in the chat only for more access than the sandbox gives, such as write access to one more folder for this turn: ``` 馃攼 more access, this turn: write access to /Users/example/code/other. Or add the folder to add_dirs instead. Reply "yes 6b480a6f" or "no 6b480a6f". ``` A yes grants exactly that, for that turn. The deny rules still hold, so a yes never opens another profile's folder or your credentials. A no grants nothing. No answer in ten minutes means no. In a group, other members can talk to the agent but cannot approve. A lasting fix is the folder in `add_dirs`. - `default` and `acceptEdits`: Codex asks for more access as above. - `bypassPermissions`: Codex never asks and never widens the sandbox. - `plan`: the sandbox is read-only. - `sandbox: false` on the profile turns the sandbox off. Codex then has full access and runs commands without asking, in every mode. ### What the sandbox allows - **Writes** in the profile's folder, its `add_dirs` and temp. A `.git` folder at the top of those is read-only, so the agent cannot commit there. - **The web only.** HTTP and HTTPS go through Codex's network proxy. SSH and local ports do not work, so the agent cannot run a server and connect to it. - **Angelia's socket.** It is the one local socket the agent can reach, so `angelia send-media` and `angelia turn` work from inside. - **Package caches** (npm, pip, uv) go to the profile's own cache folder. - **MCP servers.** A server in your Codex config that the profile was not given is switched off. If your Codex config would load one anyway, the session does not start. Compile does not write a Codex profile's MCP servers yet: add them with `codex mcp add`. - **Skills** given to the profile are linked into `.agents/skills`, where Codex looks. ### Voice notes, photos and files A photo or document you send lands in the profile's `.inbox/` folder, up to 20 MB, and Codex gets a `[file: path]` line. A voice note arrives as `[voice note: path]`, and the agent runs `angelia transcribe `. Codex sends files back with `angelia send-media`. Every path is checked first: never a credential location, never another profile's folder. ### Chat commands `/new`, `/stop`, `/status`, `/resume`, `/model`, `/effort`, `/backend`, `/restart` and the others `/help` lists are answered by Angelia, without spending a token. `/model` alone shows the models Codex lists, and `/effort` the levels of the model in use. A model or level Codex does not offer is refused. Without a model in the profile, Codex's own default is used. `/compact` goes to Codex's own compaction. Long answers are split as for [every CLI](https://useangelia.com/claude-code/#long-answers). ## Tested On 2026-10-27, with Angelia 0.3.22 and Codex 0.163.0 on macOS, in a WhatsApp group routed to one profile in `permission_mode: default`: - An answer came in about 8 seconds. A 6,533-character answer arrived as 2 messages, in order. - Writes in the profile's folder and web access ran without a question. Access outside the sandbox brought a 馃攼 question. `yes ` granted it, and `no ` declined it. - A file sent back with `angelia send-media` arrived in the chat. - `/status`, `/new` and `/stop` work. `/stop` ended a running `sleep`. - A small quirk: a progress line can arrive after the 馃攼 question. Codex on Telegram is not tested yet. Voice notes are tested with Claude Code only. ## Limits - macOS only for now. Linux is next. The Mac must be on and awake: while it sleeps, nothing answers. - Codex marks its app-server protocol as experimental, and marks the two settings Angelia turns on for chat approvals as under development. A Codex without them still runs sandboxed, but a yes adds nothing. - The sandbox lets commands reach the web, and nothing else on the network. - The terminal resume line in `/status` and the Claude app view are for Claude Code only. - API key variables (`OPENAI_API_KEY`, `CODEX_API_KEY`) are kept out of the agent's environment. - Prompt injection is not solved. A web page or a forwarded message can still talk the agent into what its sandbox and mode allow. Read the [security model](https://useangelia.com/docs/security/) before you give the bot to anyone but yourself. - It is a young project (v0.3), maintained by one person. ## More about Angelia - [Claude Code on WhatsApp and Telegram: sessions, approvals](https://useangelia.com/claude-code/) - [Angelia for Grok Build: setup, approvals and limits](https://useangelia.com/grok/) - [Angelia for pi: setup, sandbox, approvals and limits](https://useangelia.com/pi/) - [Claude Code on WhatsApp](https://useangelia.com/whatsapp/) - [Claude Code Telegram bot](https://useangelia.com/telegram/) - [Angelia vs OpenClaw, Hermes Agent and Remote Control](https://useangelia.com/alternatives/) - [Docs](https://useangelia.com/docs/) - [Tools](https://useangelia.com/tools/) - [Guides](https://useangelia.com/guides/) ## Try Angelia ``` curl -fsSL https://useangelia.com/install | sh ``` It checks the release's signature, then a wizard pairs your first chat. Free and open source (MIT). [How it works](https://useangelia.com/) 路 [Why Codex runs this way](https://useangelia.com/docs/decisions/0012-codex-backend/) 路 [GitHub](https://github.com/korengast/angelia) Angelia 路 open source, MIT [Docs](https://useangelia.com/docs/) 路 [info@useangelia.com](mailto:info@useangelia.com) 路 [GitHub](https://github.com/korengast/angelia)