Codex.app injecting restricted network access

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.226.940 (720)

What subscription do you have?

Plus? The $20/month one!

What platform is your computer?

macOS 26.3 (25D125)

What issue are you seeing?

I’m seeing inconsistent sandbox/network behavior in Codex.app.

Although my local configuration has network enabled and I explicitly request elevated execution when needed, Codex sometimes runs with a later-injected permissions block that says network is restricted, which causes gh/API commands to fail unless escalated again.

My config.toml includes:

model = "gpt-5.3-codex"
personality = "pragmatic"
profile = "full_auto"

[profiles.full_auto]
approval_policy = "on-request"
sandbox_mode    = "workspace-write"

[profiles.readonly_quiet]
approval_policy = "never"
sandbox_mode    = "read-only"

# Optional: Allow network in workspace-write mode
[sandbox_workspace_write]
network_access = true

[projects."/Users/sam/Developer/Projects/"]
trust_level = "trusted"

The project should be being treated as trusted as its path is /Users/sam/Developer/Projects/ActionStatus.

What happened

• A command using gh failed with:
• error connecting to api.github.com
• In the same session, the effective permissions instructions included:
• “Network access is restricted.”
• Retrying with escalated permissions succeeded.

Why this is a problem

• It makes behavior hard to predict from config.toml.
• It’s unclear which policy source is authoritative (local config vs app-injected runtime policy).
• It creates avoidable friction for normal GitHub workflows.

What steps can reproduce the bug?

1. Configure Codex with network enabled locally (for example via config.toml), then start a Codex.app session.
2. In the repo, run a GitHub API command in default sandbox mode, e.g. gh pr list --head <branch> --base main --json number,title,url.
3. Observe failure: error connecting to api.github.com (network unavailable in effective sandbox).
4. Check session-provided permissions context and note it includes Network access is restricted.
5. Re-run the same gh command with sandbox_permissions=require_escalated.
6. Observe success (command returns normal JSON output).
7. Re-run subsequent gh operations (e.g., gh pr create, gh pr view) with escalation and observe they also succeed.

What is the expected behavior?

• My configured sandbox/network settings (and explicit sandbox_permissions usage) should be applied consistently.
• If runtime policy overrides local config, that should be clearly surfaced in the UI/session metadata.

Additional information

• Codex.app (desktop)
• Repo workflow using gh CLI
• Local config has network enabled, but effective session policy reported restricted network access