Cannot select managed permission profile from requirements.toml if it enables network access

What version of Codex CLI is running?

codex-cli 0.142.5

What subscription do you have?

Enterprise

Which model were you using?

gpt-5.5

What platform is your computer?

Microsoft Windows NT 10.0.28000.0 x64

What terminal emulator and version are you using (if applicable)?

_No response_

Codex doctor report

{
  "schemaVersion": 1,
  "generatedAt": "1782920295s since unix epoch",
  "overallStatus": "fail",
  "codexVersion": "0.142.5",
  "checks": {
    "config.load": {
      "id": "config.load",
      "category": "config",
      "status": "fail",
      "summary": "config could not be loaded",
      "details": {},
      "notes": [
        "failed to load Codex config"
      ],
      "remediation": "Fix the reported config error, then rerun codex doctor.",
      "durationMs": 0
    },
    "git.environment": {
      "id": "git.environment",
      "category": "git",
      "status": "ok",
      "summary": "git executable not found",
      "details": {
        "PATH git entries": "0",
        "repo detected": "false",
        "selected git": "not found"
      },
      "remediation": null,
      "durationMs": 3
    },
    "installation": {
      "id": "installation",
      "category": "install",
      "status": "ok",
      "summary": "installation looks consistent",
      "details": {
        "PATH codex #1": "C:\\Users\\vboxuser\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
        "current executable": "C:\\Users\\vboxuser\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
        "install context": "standalone (windows, package C:\\Users\\vboxuser\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc, bin C:\\Users\\vboxuser\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\bin, resources C:\\Users\\vboxuser\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\vboxuser\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-path)",
        "managed by bun": "false",
        "managed by npm": "false",
        "managed package root": "not set"
      },
      "remediation": null,
      "durationMs": 117
    },
    "network.env": {
      "id": "network.env",
      "category": "network",
      "status": "ok",
      "summary": "network-related environment looks readable",
      "details": {
        "proxy env vars": "none"
      },
      "remediation": null,
      "durationMs": 0
    },
    "network.provider_reachability": {
      "id": "network.provider_reachability",
      "category": "reachability",
      "status": "ok",
      "summary": "active provider endpoints are reachable over HTTP",
      "details": {
        "ChatGPT base URL": "https://chatgpt.com/backend-api/ reachable (HTTP 403)",
        "reachability mode": "ChatGPT auth"
      },
      "remediation": null,
      "durationMs": 68
    },
    "runtime.provenance": {
      "id": "runtime.provenance",
      "category": "runtime",
      "status": "ok",
      "summary": "running standalone on windows-x86_64",
      "details": {
        "commit": "unknown",
        "current executable": "C:\\Users\\vboxuser\\AppData\\Local\\Programs\\OpenAI\\Codex\\bin\\codex.exe",
        "install method": "standalone (windows, package C:\\Users\\vboxuser\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc, bin C:\\Users\\vboxuser\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\bin, resources C:\\Users\\vboxuser\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\vboxuser\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-path)",
        "platform": "windows-x86_64",
        "version": "0.142.5"
      },
      "remediation": null,
      "durationMs": 0
    },
    "runtime.search": {
      "id": "runtime.search",
      "category": "search",
      "status": "ok",
      "summary": "search is OK (bundled)",
      "details": {
        "search command": "C:\\Users\\vboxuser\\.codex\\packages\\standalone\\releases\\0.142.5-x86_64-pc-windows-msvc\\codex-path\\rg.exe",
        "search command readiness": "file exists",
        "search provider": "bundled"
      },
      "remediation": null,
      "durationMs": 0
    },
    "state.paths": {
      "id": "state.paths",
      "category": "state",
      "status": "ok",
      "summary": "CODEX_HOME was resolved without config",
      "details": {
        "CODEX_HOME": "C:\\Users\\vboxuser\\.codex"
      },
      "remediation": null,
      "durationMs": 0
    },
    "system.environment": {
      "id": "system.environment",
      "category": "system",
      "status": "ok",
      "summary": "OS language en-US",
      "details": {
        "EDITOR": "not set",
        "VISUAL": "not set",
        "os": "Windows 10.0.28000 (Windows 11 Professional) [64-bit]",
        "os language": "en-US",
        "os type": "Windows",
        "os version": "10.0.28000"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.env": {
      "id": "terminal.env",
      "category": "terminal",
      "status": "ok",
      "summary": "terminal metadata was detected",
      "details": {
        "WT_SESSION": "present",
        "color output": "enabled",
        "console input code page": "437",
        "console output code page": "437",
        "stderr console mode": "0x00000007 (VT processing: true)",
        "stderr is terminal": "true",
        "stdin is terminal": "true",
        "stdout console mode": "0x00000007 (VT processing: true)",
        "stdout is terminal": "true",
        "terminal": "Windows Terminal",
        "terminal size": "120x30"
      },
      "remediation": null,
      "durationMs": 0
    }
  }
}

What issue are you seeing?

Updating permissions to a profile defined in requirements.toml fails with error Failed to update thread settings: thread/settings/update failed in TUI if the permissions profile enables network access, and the Codex CLI then exits with error message Error: turn/start failed in TUI if you send a message in this state.

What steps can reproduce the bug?

On a clean virtual computer with only Windows 11 installed:

1. Open a Terminal window with a PowerShell session
2. Run $env:CODEX_NON_INTERACTIVE=1; irm https://chatgpt.com/codex/install.ps1 | iex

==> Installing Codex CLI
==> Detected platform: Windows (x64)
==> Resolved version: 0.142.5
==> Downloading Codex CLI
==> PATH updated for future PowerShell sessions.
==> Current PowerShell session: codex
==> Future PowerShell windows: open a new PowerShell window and run: codex
Codex CLI 0.142.5 installed successfully.

1. Create a file %PROGRAMDATA%\OpenAI\Codex\requirements.toml with the following content:

[permissions.perms.network]
enabled = true

1. Run codex -c default_permissions=:workspace, sign in with ChatGPT, and trust the current directory. Until #30829 is fixed, choose to use the non-admin sandbox.
2. Type /permissions and select perms.
3. Note that you get an error printout:

• Permissions updated to perms

■ Failed to update thread settings: thread/settings/update failed in TUI

1. Type Hi! as initial prompt and note that you get an error message and the Codex CLI exists:

Error: turn/start failed in TUI

What is the expected behavior?

No error printout when updating permissions and the session starting without error.

Additional information

The following modifications give the expected behavior instead of the errors:

1. Setting the network.enabled option to false.
2. Moving the perms entry from %PROGRAMDATA\OpenAI\Codex\requirements.toml to %USERPROFILE\.codex\config.toml or passing it as -c permissions.perms.network.enabled=true to codex.
3. Passing -c default_permissions=perms to codex instead of using /permissions avoids the first error, but the session still fails to start when you send the initial prompt.