`file_change` fails under `workspace-write` when `sandbox_workspace_write.network_access = true`

What version of Codex CLI is running?

v0.121.0

What subscription do you have?

Plus

Which model were you using?

gpt-5.4

What platform is your computer?

Linux 6.8.0-110-generic x86_64 x86_64

What terminal emulator and version are you using (if applicable)?

Terminal

What issue are you seeing?

Summary

On Codex CLI v0.121.0, file edits via the file_change / patch tool fail in a trusted local project when workspace-write is combined with:

[sandbox_workspace_write]
network_access = true
````

This does **not** affect ordinary shell commands in the same session: `touch`, `printf > file`, `git status`, and sandboxed Python commands still work. The failure appears specific to the patch/file-change path.

Disabling `network_access = true` makes the problem go away immediately.

## Environment

* Codex CLI: `v0.121.0`
* OS: Ubuntu Linux
* Project: trusted local repo
* Working directory: repo root

My config:

```toml
model = "gpt-5.4"
model_reasoning_effort = "xhigh"
personality = "pragmatic"
web_search = "live"
sandbox_mode = "workspace-write"

[sandbox_workspace_write]                                                     
network_access = true 

[projects."/home/jvdh/Documents/jobwatch"]
trust_level = "trusted"

[tui]
status_line = ["model-with-reasoning", "current-dir", "context-used", "weekly-limit", "total-input-tokens", "total-output-tokens"]

[features]
multi_agent = true
prevent_idle_sleep = true

Project-scoped config used for repro:

[shell_environment_policy]
inherit = "all"
set = { PATH = "/home/jvdh/Documents/jobwatch/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" }

[sandbox_workspace_write]
network_access = true

Reproduction

Run:

codex exec --json --full-auto "create a file foo.txt containing hello"

Observed behavior

The file_change step fails, even though normal shell writes work.

Relevant sanitized log excerpt:

{"type":"item.started","item":{"id":"item_4","type":"file_change","changes":[{"path":"/home/jvdh/Documents/jobwatch/foo.txt","kind":"add"}],"status":"in_progress"}}
{"type":"item.completed","item":{"id":"item_4","type":"file_change","changes":[{"path":"/home/jvdh/Documents/jobwatch/foo.txt","kind":"add"}],"status":"failed"}}

When retrying after creating the file through the shell, the update path fails with:

Failed to read file to update /home/jvdh/Documents/jobwatch/foo.txt: fs sandbox helper failed with status exit status: 101: thread 'main' (...) panicked at linux-sandbox/src/linux_run_main.rs:130:27:
legacy sandbox policy must match split sandbox policies:
provided=WorkspaceWrite { writable_roots: [AbsolutePathBuf("/home/jvdh/.codex/memories")], read_only_access: FullAccess, network_access: true, exclude_tmpdir_env_var: false, exclude_slash_tmp: false },
derived=WorkspaceWrite { writable_roots: [AbsolutePathBuf("/home/jvdh/.codex/memories")], read_only_access: FullAccess, network_access: false, exclude_tmpdir_env_var: false, exclude_slash_tmp: false }

Expected behavior

With workspace-write and [sandbox_workspace_write].network_access = true, the patch/file-change tool should be able to create and edit files inside the workspace, just like shell commands can.

Workaround

Comment out:

[sandbox_workspace_write]
network_access = true

Then rerun:

codex exec --json --full-auto "create a file foo.txt containing hello"

This succeeds, and the file_change step completes normally.

Notes

This does not look like a general sandbox write failure:

• bwrap is present
• target file is inside the workspace
• shell writes succeed
• sandboxed Python succeeds
• only the patch/file-change path fails

This looks like an internal sandbox policy mismatch in the file-change helper when network_access = true is enabled for workspace-write.

What steps can reproduce the bug?

set

sandbox_mode = "workspace-write"
[sandbox_workspace_write]                                                     
network_access = true 

Run:

codex exec --json --full-auto "create a file foo.txt containing hello"

What is the expected behavior?

With workspace-write and [sandbox_workspace_write].network_access = true, the patch/file-change tool should be able to create and edit files inside the workspace, just like shell commands can.

Additional information

_No response_