Codex desktop app ignores custom default_permissions profile for read-only filesystem with network access

Summary

The Codex desktop app does not apply a custom permissions profile configured through default_permissions. New desktop threads continue to use readOnly + networkAccess:false, even after fully restarting the app.

The same permissions profile works correctly when explicitly selected through the Codex CLI with codex sandbox -P net-readonly.

Environment

• Codex desktop app / bundled CLI: codex-cli 0.140.0-alpha.2
• OS: macOS 14.6, arm64
• Approval policy: on-request
• Project trust level: trusted

Configuration

approval_policy = "on-request"
approvals_reviewer = "user"
default_permissions = "net-readonly"

[permissions.net-readonly]
description = "Allow network, but require approval for writes"
extends = ":read-only"

[permissions.net-readonly.network]
enabled = true
mode = "limited"

[permissions.net-readonly.network.domains]
"*" = "allow"

Steps to reproduce

1. Add the configuration above to ~/.codex/config.toml.
2. Fully restart the Codex desktop app.
3. Create a new desktop thread in a trusted project.
4. Run a network request such as curl -I https://example.com.
5. Attempt to write a file.

Actual behavior

• Desktop thread permission snapshot is created as:

sandboxPolicy: readOnly
networkAccess: false

• Network requests fail because DNS/network access is denied.
• File writes correctly require approval.
• Restarting the app and creating new threads does not apply the configured profile.

Expected behavior

The desktop app should apply default_permissions = "net-readonly" to new threads, resulting in:

• Read-only filesystem, with writes requiring approval.
• Network access controlled by the profile's domain allowlist.

CLI verification

The profile itself is valid and works when explicitly selected:

codex sandbox -P net-readonly curl -I https://example.com

This successfully returns HTTP 200, confirming the issue appears specific to how the desktop app resolves or passes the default permissions profile.

Additional diagnostic information

codex doctor --json reports the desktop thread sandbox as restricted with the network sandbox enabled. The desktop app global state records newly created affected threads as readOnly + networkAccess:false.