dotnet command hangs until timeout, with high cpu

I saw the windows-os tag but this is macOS 15.6.1

I can confirm it also happens on mac. there were several node process, consuming all my system memory, swap was at 24gb, had to restart with the power button. I restart codex every few tasks to have fresh context, the processes are still there.

Also using vitest.

Same issue for me dotnet build on Mac never finishes making codex for dotnet useless because it can’t check for errors

dotnet build hangs when codex runs it however if i set access to full access it builds fine

Thanks for that note on enabling full access. It turns out codex 0.36.0 has an improved error message;

▌ run dotnet test to test the backend code

• Ran dotnet test

• Explored
  └ List ls

• Ran dotnet test <solution>.sln
  └ Unhandled exception. System.Net.Sockets.SocketException (13): Permission
    denied
       at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot,
    SocketAddress socketAddress)
       at System.Net.Sockets.Socket.Bind(EndPoint localEP)
       at System.IO.Pipes.NamedPipeServerStream.SharedServer..ctor(String path,
    Int32 maxCount, Boolean isFirstPipeInstance)
       at System.IO.Pipes.NamedPipeServerStream.SharedServer.Get(String path,
    Int32 maxCount, PipeOptions pipeOptions)
    … +81 lines
       at Microsoft.Build.Execution.OutOfProcNode.Run(Boolean enableReuse,
    Boolean lowPriority, Exception& shutdownException)
       at
    Microsoft.Build.CommandLine.MSBuildApp.StartLocalNode(CommandLineSwitches
    commandLineSwitches, Boolean lowpriority)
       at
    Microsoft.Build.CommandLine.MSBuildApp.ProcessCommandLineSwitches(CommandLin
    eSwitches switchesFromAutoResponseFile, CommandLineSwitches
    switchesNotFromAutoResponseFile, String& projectFile, String[]& targets,
    String& toolsVersion, Dictionary`2& globalProperties, ILogger[]& loggers,
    LoggerVerbosity& verbosity, LoggerVerbosity& originalVerbosity, List`1&
    distributedLoggerRecords, Int32& cpuCount, Boolean& enableNodeReuse,
    TextWriter& preprocessWriter, TextWriter& targetsWriter, Boolean&
    detailedSummary, ISet`1& warningsAsErrors, ISet`1& warningsNotAsErrors,
    ISet`1& warningsAsMessages, Boolean& enableRestore, Boolean& interactive,
    ProfilerLogger& profilerLogger, Boolean& enableProfiler, Dictionary`2&
    restoreProperties, ProjectIsolationMode& isolateProjects, GraphBuildOptions&
    graphBuild, String[]& inputResultsCaches, String& outputResultsCache,
    Boolean& lowPriority, Boolean& question, Boolean& isBuildCheckEnabled,
    String[]& getProperty, String[]& getItem, String[]& getTargetResult, String&
    getResultOutputFile, Boolean recursing, String commandLine)
       at Microsoft.Build.CommandLine.MSBuildApp.Execute(String[] commandLine)
       at Microsoft.Build.CommandLine.MSBuildApp.Main(String[] args)

• Ran
  └ DOTNET_CLI_ENABLE_MSBUILD_SERVER=0 MSBUILDDISABLENODEREUSE=1 dotnet test
        <solution>.sln
    Unhandled exception. System.Net.Sockets.SocketException (13): Permission
    denied
       at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot,
    SocketAddress socketAddress)
       at System.Net.Sockets.Socket.Bind(EndPoint localEP)
       at System.IO.Pipes.NamedPipeServerStream.SharedServer..ctor(String path,
    Int32 maxCount, Boolean isFirstPipeInstance)
       at System.IO.Pipes.NamedPipeServerStream.SharedServer.Get(String path,
    Int32 maxCount, PipeOptions pipeOptions)
    … +900 lines
       at Microsoft.Build.Execution.OutOfProcNode.Run(Boolean enableReuse,
    Boolean lowPriority, Exception& shutdownException)
       at
    Microsoft.Build.CommandLine.MSBuildApp.StartLocalNode(CommandLineSwitches
    commandLineSwitches, Boolean lowpriority)
       at
    Microsoft.Build.CommandLine.MSBuildApp.ProcessCommandLineSwitches(CommandLin
    eSwitches switchesFromAutoResponseFile, CommandLineSwitches
    switchesNotFromAutoResponseFile, String& projectFile, String[]& targets,
    String& toolsVersion, Dictionary`2& globalProperties, ILogger[]& loggers,
    LoggerVerbosity& verbosity, LoggerVerbosity& originalVerbosity, List`1&
    distributedLoggerRecords, Int32& cpuCount, Boolean& enableNodeReuse,
    TextWriter& preprocessWriter, TextWriter& targetsWriter, Boolean&
    detailedSummary, ISet`1& warningsAsErrors, ISet`1& warningsNotAsErrors,
    ISet`1& warningsAsMessages, Boolean& enableRestore, Boolean& interactive,
    ProfilerLogger& profilerLogger, Boolean& enableProfiler, Dictionary`2&
    restoreProperties, ProjectIsolationMode& isolateProjects, GraphBuildOptions&
    graphBuild, String[]& inputResultsCaches, String& outputResultsCache,
    Boolean& lowPriority, Boolean& question, Boolean& isBuildCheckEnabled,
    String[]& getProperty, String[]& getItem, String[]& getTargetResult, String&
    getResultOutputFile, Boolean recursing, String commandLine)
       at Microsoft.Build.CommandLine.MSBuildApp.Execute(String[] commandLine)
       at Microsoft.Build.CommandLine.MSBuildApp.Main(String[] args)

> Tried dotnet test <solution>.sln (with
  DOTNET_CLI_ENABLE_MSBUILD_SERVER=0 and MSBUILDDISABLENODEREUSE=1 to avoid
  MSBuild server), but the run failed immediately: MSBuild can’t create its
  named pipe endpoints in this sandbox (System.Net.Sockets.SocketException (13):
  Permission denied). Tests didn’t execute. If you can run outside the sandbox
  (or permit named pipes), rerun the same command from the repo root.

So I went into config.toml and set

[sandbox_workspace_write]
network_access = true

Now the same command rendered the following output;

run dotnet test to test backend code

• Ran dotnet test

• Explored
  └ List ls
    List ls

• Ran dotnet test <solution>.sln
  └ Unhandled exception. System.Net.Sockets.SocketException (13): Permission
    denied
       at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot,
    SocketAddress socketAddress)
       at System.Net.Sockets.Socket.Bind(EndPoint localEP)
       at System.IO.Pipes.NamedPipeServerStream.SharedServer..ctor(String path,
    Int32 maxCount, Boolean isFirstPipeInstance)
       at System.IO.Pipes.NamedPipeServerStream.SharedServer.Get(String path,
    Int32 maxCount, PipeOptions pipeOptions)
    … +81 lines
       at Microsoft.Build.Execution.OutOfProcNode.Run(Boolean enableReuse,
    Boolean lowPriority, Exception& shutdownException)
       at
    Microsoft.Build.CommandLine.MSBuildApp.StartLocalNode(CommandLineSwitches
    commandLineSwitches, Boolean lowpriority)
       at
    Microsoft.Build.CommandLine.MSBuildApp.ProcessCommandLineSwitches(CommandLin
    eSwitches switchesFromAutoResponseFile, CommandLineSwitches
    switchesNotFromAutoResponseFile, String& projectFile, String[]& targets,
    String& toolsVersion, Dictionary`2& globalProperties, ILogger[]& loggers,
    LoggerVerbosity& verbosity, LoggerVerbosity& originalVerbosity, List`1&
    distributedLoggerRecords, Int32& cpuCount, Boolean& enableNodeReuse,
    TextWriter& preprocessWriter, TextWriter& targetsWriter, Boolean&
    detailedSummary, ISet`1& warningsAsErrors, ISet`1& warningsNotAsErrors,
    ISet`1& warningsAsMessages, Boolean& enableRestore, Boolean& interactive,
    ProfilerLogger& profilerLogger, Boolean& enableProfiler, Dictionary`2&
    restoreProperties, ProjectIsolationMode& isolateProjects, GraphBuildOptions&
    graphBuild, String[]& inputResultsCaches, String& outputResultsCache,
    Boolean& lowPriority, Boolean& question, Boolean& isBuildCheckEnabled,
    String[]& getProperty, String[]& getItem, String[]& getTargetResult, String&
    getResultOutputFile, Boolean recursing, String commandLine)
       at Microsoft.Build.CommandLine.MSBuildApp.Execute(String[] commandLine)
       at Microsoft.Build.CommandLine.MSBuildApp.Main(String[] args)

• Proposed Command
  └ dotnet test <solution>.sln

dotnet test needs named pipes which sandbox blocks; running without sandbox
allows backend tests to complete

▌Allow command?
▌ Yes   Always   No, provide feedback 
▌ Approve and run the command       

You approved codex to run dotnet test <solution>.sln
every time this session

• Ran dotnet test <solution>.sln

So allowing network access seems to be a workaround for running dotnet commands in codex. I still think this default behaviour is not very user friendly and confusing coming from Claude Code where dotnet commands run out of the box. I am also unsure what security implications this have for me enabling network access in the sandbox mode.

This hanging has been a problem for me for some time.

I confirm that running it in full access fixes the problem! Thanks @danyo1399

dotnet test doesnt work even with workspace-write and network access:

sandbox_mode = "workspace-write"
[sandbox_workspace_write]
network_access = true

output:

$ bash -lc 'dotnet test'
MSBUILD : error MSB1025: An internal failure occurred while running MSBuild.
System.Net.Sockets.SocketException (13): Permission denied
   at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot, SocketAddress socketAddress)
   at System.Net.Sockets.Socket.Bind(EndPoint localEP)
   at System.IO.Pipes.NamedPipeServerStream.SharedServer..ctor(String path, Int32 maxCount, Boolean isFirstPipeInstance)
   at System.IO.Pipes.NamedPipeServerStream.SharedServer.Get(String path, Int32 maxCount, PipeOptions pipeOptions)
   at System.IO.Pipes.NamedPipeServerStream.Create(String pipeName, PipeDirection direction, Int32 maxNumberOfServerInstances, PipeTransmissionMode transmissionMode, PipeOptions options, Int32 inBufferSize, Int32 outBufferSize, HandleInheritability inheritability)
   at System.IO.Pipes.NamedPipeServerStream..ctor(String pipeName, PipeDirection direction, Int32 maxNumberOfServerInstances, PipeTransmissionMode transmissionMode, PipeOptions options, Int32 inBufferSize, Int32 outBufferSize)
   at Microsoft.Build.BackEnd.NodeEndpointOutOfProcBase.InternalConstruct(String pipeName)
   at Microsoft.Build.Execution.OutOfProcNode.Run(Boolean enableReuse, Boolean lowPriority, Exception& shutdownException)
   at Microsoft.Build.CommandLine.MSBuildApp.StartLocalNode(CommandLineSwitches commandLineSwitches, Boolean lowpriority)
   at Microsoft.Build.CommandLine.MSBuildApp.ProcessCommandLineSwitches(CommandLineSwitches switchesFromAutoResponseFile, CommandLineSwitches switchesNotFromAutoResponseFile, String& projectFile, String[]& targets, String& toolsVersion, Dictionary`2& globalProperties, ILogger[]& loggers, LoggerVerbosity& verbosity, LoggerVerbosity& originalVerbosity, List`1& distributedLoggerRecords, Int32& cpuCount, Boolean& enableNodeReuse, TextWriter& preprocessWriter, TextWriter& targetsWriter, Boolean& detailedSummary, ISet`1& warningsAsErrors, ISet`1& warningsNotAsErrors, ISet`1& warningsAsMessages, Boolean& enableRestore, Boolean& interactive, ProfilerLogger& profilerLogger, Boolean& enableProfiler, Dictionary`2& restoreProperties, ProjectIsolationMode& isolateProjects, GraphBuildOptions& graphBuild, String[]& inputResultsCaches, String& outputResultsCache, Boolean& lowPriority, Boolean& question, Boolean& isBuildCheckEnabled, String[]& getProperty, String[]& getItem, String[]& getTargetResult, String& getResultOutputFile, Boolean recursing, String commandLine)
   at Microsoft.Build.CommandLine.MSBuildApp.Execute(String[] commandLine)
Unhandled exception. System.Net.Sockets.SocketException (13): Permission denied
   at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot, SocketAddress socketAddress)
   at System.Net.Sockets.Socket.Bind(EndPoint localEP)
   at System.IO.Pipes.NamedPipeServerStream.SharedServer..ctor(String path, Int32 maxCount, Boolean isFirstPipeInstance)
   at System.IO.Pipes.NamedPipeServerStream.SharedServer.Get(String path, Int32 maxCount, PipeOptions pipeOptions)
   at System.IO.Pipes.NamedPipeServerStream.Create(String pipeName, PipeDirection direction, Int32 maxNumberOfServerInstances, PipeTransmissionMode transmissionMode, PipeOptions options, Int32 inBufferSize, Int32 outBufferSize, HandleInheritability inheritability)
   at System.IO.Pipes.NamedPipeServerStream..ctor(String pipeName, PipeDirection direction, Int32 maxNumberOfServerInstances, PipeTransmissionMode transmissionMode, PipeOptions options, Int32 inBufferSize, Int32 outBufferSize)
   at Microsoft.Build.BackEnd.NodeEndpointOutOfProcBase.InternalConstruct(String pipeName)
   at Microsoft.Build.Execution.OutOfProcNode.Run(Boolean enableReuse, Boolean lowPriority, Exception& shutdownException)
   at Microsoft.Build.CommandLine.MSBuildApp.StartLocalNode(CommandLineSwitches commandLineSwitches, Boolean lowpriority)
   at Microsoft.Build.CommandLine.MSBuildApp.ProcessCommandLineSwitches(CommandLineSwitches switchesFromAutoResponseFile, CommandLineSwitches switchesNotFromAutoResponseFile, String& projectFile, String[]& targets, String& toolsVersion, Dictionary`2& globalProperties, ILogger[]& loggers, LoggerVerbosity& verbosity, LoggerVerbosity& originalVerbosity, List`1& distributedLoggerRecords, Int32& cpuCount, Boolean& enableNodeReuse, TextWriter& preprocessWriter, TextWriter& targetsWriter, Boolean& detailedSummary, ISet`1& warningsAsErrors, ISet`1& warningsNotAsErrors, ISet`1& warningsAsMessages, Boolean& enableRestore, Boolean& interactive, ProfilerLogger& profilerLogger, Boolean& enableProfiler, Dictionary`2& restoreProperties, ProjectIsolationMode& isolateProjects, GraphBuildOptions& graphBuild, String[]& inputResultsCaches, String& outputResultsCache, Boolean& lowPriority, Boolean& question, Boolean& isBuildCheckEnabled, String[]& getProperty, String[]& getItem, String[]& getTargetResult, String& getResultOutputFile, Boolean recursing, String commandLine)
   at Microsoft.Build.CommandLine.MSBuildApp.Execute(String[] commandLine)
   at Microsoft.Build.CommandLine.MSBuildApp.Main(String[] args)

@cyril265 codex is not very consistent here, sometimes it asks for elevated network access after setting sandboxed network access, sometimes not. I usually have to remember it to ask me - something like this to get the "Allow Access" prompt;

• Ran dotnet build <solution>.sln

■ Conversation interrupted - tell the model what to do differently

▌ build needs network access, ask me to elevate permission

• Proposed Command
  └ dotnet build <solution>.sln

✔ You approved codex to run dotnet build <solution>.sln every time this session

I agree. Codex appears to struggle with knowing when to request elevated permissions, leading to prolonged retries and occasional edits to unrelated items.
Perhaps this can be fixed broadly, eliminating the need for additional prompts.

@cyril265 codex is not very consistent here, sometimes it asks for elevated network access after setting sandboxed network access, sometimes not. I usually have to remember it to ask me - something like this to get the "Allow Access" prompt; `` • Ran dotnet build <solution>.sln ■ Conversation interrupted - tell the model what to do differently ▌ build needs network access, ask me to elevate permission • Proposed Command └ dotnet build <solution>.sln ✔ You approved codex to run dotnet build <solution>.sln every time this session ``

It would be handy to be able to give conditional reminders to the LLM when it runs specific tasks, including a "are you sure" when it's running something potentially destructive.

Yes, running with sandbox_mode = "danger-full-access" is the only solution.
Without it, there is no agentic loop in Codex on .Net projects, which is sad

Only found this issue now, but seems like i had the same problem on codex 0.50.0 in #5946
Thanks for tips in previous comments, running the same in full access mode finally worked. Yet i believe this should be fixed to work in regular permission auto-mode too

remember it to ask me

I solved this by modifying agents.md file to tell it to request elevated permissions, worked like a charm. Hope there will eventually be a broader fix

@AndrewNikolin yes, I find it responds even better to be explicit in AGENTS.md by including the actual internal flag Codex needs to use;

These commands will need network access and inside your sandbox you always have to run those commands
with `with_escalated_permissions: true` on the `shell` tool call and include a one-sentence justification
(e.g., "Need network access for npm install/build").
Ensure to include the `with_escalated_permissions` for all builds, restores, migrations, installs, tests, etc
where network access is required otherwise the command will hang.

That said, when Codex escalates, it would be nice if it was possible to make the approval last more than this session similar to Claude Code it would be a huge QOL to make it last the approval for all future sessions as well.

You approved codex to run npm run lint every time this session

=>

You approved codex to run npm run lint every time for future sessions

Similar issue is happening for me using VSCode extension with WSL2 on Win11. I have a python repo, where I have pytest suite using asyncio and sqlite, following snippet can be used to reproduce.

$ bash -lc 'python3 - <<'"'"'PY'"'"'
import asyncio
from sqlalchemy.ext.asyncio import create_async_engine

async def main():
    engine = create_async_engine('"'"'sqlite+aiosqlite:///:memory:'"'"')
    async with engine.begin() as conn:
        await asyncio.sleep(0.1)
    await engine.dispose()
    print('"'"'done'"'"')

asyncio.run(main())
PY'
done

without full access, test hangs on the db connection stages, but with @joakimriedel suggestion, if I put in in the agents.md to make codex ask for elevated access, it remembers to ask elevated permissions but feels like it should work in sandbox without full access.

These commands will need network access and inside your sandbox you always have to run those commands with with_escalated_permissions: true on the shell tool call and include a one-sentence justification (e.g., "Need network access for npm install/build"). Ensure to include the with_escalated_permissions for all builds, restores, migrations, installs, tests, etc where network access is required otherwise the command will hang.

This solved my issue, thanks!

Wanted to share here as well, 0.66.0 update makes this less painful: after command is remembered as "always allow" the timeouts and other related issues don't happen. On mac os that is stored in ~/.codex/policy/default.codexpolicy so i guess one can add patterns beforehand

same issue on macOS

same issue