Codex CLI 0.130.0: MCP tool calls fail silently with "user cancelled MCP tool call" under --sandbox workspace-write\n\nWhen running codex exec --json --sandbox workspace-write with MCP servers con

Use --dangerously-bypass-approvals-and-sandbox instead of --sandbox workspace-write when MCP tool calls need network access (e.g. eval frameworks, CI containers that are already externally sandboxed).

For hooks configuration: remove [features].codex_hooks = true from config.toml entirely. The hooks feature is stable and enabled by default in codex-cli 0.130.0+. Adding the deprecated codex_hooks key emits a warning on every exec run.