diff --git a/.changeset/codex-skill-network.md b/.changeset/codex-skill-network.md index cb80f287..e2a4d4c2 100644 --- a/.changeset/codex-skill-network.md +++ b/.changeset/codex-skill-network.md @@ -2,4 +2,4 @@ "aicodeman": minor --- -**Codex sessions can drive other sessions through the Codeman skill.** A new opt-in Codex setting, **Allow network access** (App Settings, Codex, off by default), starts Codex with `sandbox_workspace_write.network_access=true`, so the skill's calls to this server are no longer blocked by Codex's sandbox; the sandbox and approval prompts stay on, it applies where Codex runs the folder workspace-write, and it is forced off for users without the privileged-commands grant in multi-user mode. Codex 0.162 and later now also starts with `--no-daemon`, so each session runs its own Codex app server: a shared background server (another version's included) no longer stops a launch on an "incompatible feature settings" dialog, and commands inside Codex see their own session's `CODEMAN_*` variables. Version gates in the CLI registry are now measured against that CLI's own version instead of Claude's. The skill falls back to its `curl` path when `codeman` is not on PATH, and asks Codex to re-run a blocked call with approval instead of giving up. +**Codex sessions can drive other sessions through the Codeman skill.** A new opt-in Codex setting, **Allow network access** (App Settings, Codex, off by default), starts Codex with `sandbox_workspace_write.network_access=true`, so the skill's calls to this server are no longer blocked by Codex's sandbox; the sandbox and approval prompts stay on, and it is forced off for users without the privileged-commands grant in multi-user mode. It applies where Codex runs the folder workspace-write and does not change Codex's sandbox mode: a folder Codex runs read-only keeps the network closed and asks per command. Codex 0.162 and later now also starts with `--no-daemon`, so each session runs its own Codex app server: a shared background server (another version's included) no longer stops a launch on an "incompatible feature settings" dialog, and commands inside Codex see their own session's `CODEMAN_*` variables. Version gates in the CLI registry are now measured against that CLI's own version instead of Claude's. The skill falls back to its `curl` path when `codeman` is not on PATH, and asks Codex to re-run a blocked call with approval instead of giving up. diff --git a/docs/wiki/Agent-CLIs.md b/docs/wiki/Agent-CLIs.md index 414f5393..bd885eae 100644 --- a/docs/wiki/Agent-CLIs.md +++ b/docs/wiki/Agent-CLIs.md @@ -140,6 +140,11 @@ Explicit `codexConfig.model` / `codexConfig.reasoningEffort` values take precede Custom model endpoints, Docker containers and remote host command overrides keep their own settings. Changing a default affects new sessions and does not edit Codex configuration files. +**Allow network access** reaches the same local launches. It opens the network only where +Codex runs the folder in its workspace-write sandbox and does not change Codex's sandbox +mode: a folder Codex runs read-only keeps the network closed, and Codex asks per command. +See [The Codeman Skill](Codeman-Skill#when-the-agent-is-codex). + Two behaviours that are deliberate and worth knowing: - **Predictive echo instead of buffered echo.** Codex's composer reacts to every keystroke, diff --git a/docs/wiki/Codeman-Skill.md b/docs/wiki/Codeman-Skill.md index 5c2b615d..3861e626 100644 --- a/docs/wiki/Codeman-Skill.md +++ b/docs/wiki/Codeman-Skill.md @@ -145,10 +145,11 @@ Two things to know: drive others. It applies to Codex sessions started after you switch it on, and it keeps Codex's sandbox and approval prompts. It opens the network only where Codex runs the folder in its workspace-write sandbox, which is what Codex does for a project you - trusted. In a folder Codex runs read-only (a new case that is not a git repository, for - one), Codex asks you to approve each call to Codeman instead; `/permissions` in Codex - switches that session to workspace-write. **Bypass approvals and sandbox** works - everywhere, but removes the sandbox and the approval prompts. + trusted. It does not change Codex's sandbox mode: a folder Codex runs read-only (a new + case that is not a git repository, for one) keeps the network closed, and Codex asks you + to approve each call to Codeman. Trust the project in Codex, or use `/permissions` in + Codex for that session, to get workspace-write there. **Bypass approvals and sandbox** + works everywhere, but removes the sandbox and the approval prompts. - Codex 0.162 runs its commands in a shared background process, whose Codeman variables can belong to the session that started it. Codeman starts Codex 0.162 and later with `--no-daemon`, so each session runs its own; with an older Codex the skill notices and diff --git a/docs/wiki/Settings-Reference.md b/docs/wiki/Settings-Reference.md index 1a0b3a1e..28cbc39c 100644 --- a/docs/wiki/Settings-Reference.md +++ b/docs/wiki/Settings-Reference.md @@ -208,7 +208,7 @@ instead of its native cloud backend. See [Custom Model Endpoints](Custom-Model-E | Default Codex model | Model for new local Codex sessions; empty uses Codex's own config. Letters, digits, `.` `_` `-` `/` only. | | Default Codex reasoning effort | Reasoning level for new local Codex sessions; empty uses Codex's own config. | | Bypass approvals and sandbox | Starts new Codex sessions with `--dangerously-bypass-approvals-and-sandbox`. Read [Agent CLIs](Agent-CLIs) before enabling. | -| Allow network access | Starts new Codex sessions with `sandbox_workspace_write.network_access=true`, so commands in Codex's workspace-write sandbox can use the network. The [Codeman Skill](Codeman-Skill) needs it to reach this server from a Codex session. It applies where Codex runs the folder in workspace-write (a project you trusted in Codex); in a folder Codex runs read-only, Codex asks for approval per command instead. The sandbox and approval prompts stay on. Synced, off by default; forced off for users without the privileged-commands grant in multi-user mode. | +| Allow network access | Starts new local Codex sessions with `sandbox_workspace_write.network_access=true`, so commands in Codex's workspace-write sandbox can use the network. The [Codeman Skill](Codeman-Skill) needs it to reach this server from a Codex session. It applies where Codex runs the folder in workspace-write (a project you trusted in Codex) and does not change Codex's sandbox mode: a folder Codex runs read-only keeps the network closed, and Codex asks for approval per command. The sandbox and approval prompts stay on. Synced, off by default; forced off for users without the privileged-commands grant in multi-user mode. | | Animated status effects | Cosmetic. | | MCP server sync | Copies the MCP servers each installed, enabled CLI (Claude, Codex, Gemini, OpenCode, Antigravity) and GitHub Copilot CLI has into the others' own config files. Synced, off by default, admin only in multi-user mode. Turn it on and **Apply** or **Save** (Apply keeps Settings open), then **Preview** shows what would change and **Sync now** applies it. It only adds missing servers, keeps the previous file as `.codeman-bak`, and leaves a file that receives env values or headers readable by you only. A config dir moved by `CODEX_HOME`, `CLAUDE_CONFIG_DIR`, `XDG_CONFIG_HOME`, `GEMINI_CLI_HOME` or `COPILOT_HOME` in Codeman's own environment is followed. | diff --git a/plugins/codeman/skills/codeman/SKILL.md b/plugins/codeman/skills/codeman/SKILL.md index 209840aa..4db080a4 100644 --- a/plugins/codeman/skills/codeman/SKILL.md +++ b/plugins/codeman/skills/codeman/SKILL.md @@ -78,9 +78,10 @@ retrying. command** once that way, never a different one; if the user declines, stop. For lasting access in Codex, the user turns on **Allow network access** (Codeman App Settings, Codex) and starts a new Codex session: it opens the network wherever Codex runs the - folder workspace-write, and keeps the sandbox and approvals. A folder Codex runs - read-only still needs the per-command approval (or `/permissions`). **Bypass approvals - and sandbox** works everywhere but drops the sandbox and approvals. + folder workspace-write, and keeps the sandbox and approvals. It does not change the + sandbox mode: a folder Codex runs read-only keeps the network closed, so each call + still needs the per-command approval (or `/permissions`). **Bypass approvals and + sandbox** works everywhere but drops the sandbox and approvals. - **`"${CURL[@]}" -o /dev/null -w '%{http_code}' "$API/api/v1/sessions/$SELF"` prints `404`.** The commands you run do not carry this session's environment: Codex can run them in a shared background process another session started, so `$CODEMAN_SESSION_ID` (and with it `$SELF` and diff --git a/skills/codeman/SKILL.md b/skills/codeman/SKILL.md index 209840aa..4db080a4 100644 --- a/skills/codeman/SKILL.md +++ b/skills/codeman/SKILL.md @@ -78,9 +78,10 @@ retrying. command** once that way, never a different one; if the user declines, stop. For lasting access in Codex, the user turns on **Allow network access** (Codeman App Settings, Codex) and starts a new Codex session: it opens the network wherever Codex runs the - folder workspace-write, and keeps the sandbox and approvals. A folder Codex runs - read-only still needs the per-command approval (or `/permissions`). **Bypass approvals - and sandbox** works everywhere but drops the sandbox and approvals. + folder workspace-write, and keeps the sandbox and approvals. It does not change the + sandbox mode: a folder Codex runs read-only keeps the network closed, so each call + still needs the per-command approval (or `/permissions`). **Bypass approvals and + sandbox** works everywhere but drops the sandbox and approvals. - **`"${CURL[@]}" -o /dev/null -w '%{http_code}' "$API/api/v1/sessions/$SELF"` prints `404`.** The commands you run do not carry this session's environment: Codex can run them in a shared background process another session started, so `$CODEMAN_SESSION_ID` (and with it `$SELF` and diff --git a/src/config/cli-registry/stock.ts b/src/config/cli-registry/stock.ts index 6e9aa225..149d1511 100644 --- a/src/config/cli-registry/stock.ts +++ b/src/config/cli-registry/stock.ts @@ -674,8 +674,9 @@ const CODEX: CliEntry = { // a live pane): loopback stays blocked under workspace-write until this is set. // ⚠️ Workspace-write ONLY: a folder codex runs read-only (one it does not trust, // such as a fresh non-git case) keeps the network closed and asks per command. - // Deliberately not paired with `--sandbox workspace-write`, which would also - // grant write access to a folder codex itself chose not to trust. + // Deliberately not paired with `--sandbox workspace-write` (owner decision, + // 2026-11-06), which would also grant write access to a folder codex itself chose + // not to trust, under a label that only says "network". { flag: '--config', value: 'sandbox_workspace_write.network_access=true', diff --git a/src/types/session.ts b/src/types/session.ts index ca0f6503..66e7d200 100644 --- a/src/types/session.ts +++ b/src/types/session.ts @@ -439,8 +439,10 @@ export interface CodexConfig { dangerouslyBypassApprovals?: boolean; /** * Let commands in codex's workspace-write sandbox use the network, Codeman's loopback API - * included (passes --config sandbox_workspace_write.network_access=true). Filled from the - * synced `codexNetworkAccess` setting when unset; clamped off for a non-granted owner. + * included (passes --config sandbox_workspace_write.network_access=true). Never changes the + * sandbox mode: a folder codex runs read-only keeps the network closed and asks per command. + * Filled from the synced `codexNetworkAccess` setting when unset; clamped off for a + * non-granted owner. */ networkAccess?: boolean; /** Enable Codex's decorative TUI animations. Disable to reduce remote terminal redraws. */ diff --git a/src/web/launch-defaults.ts b/src/web/launch-defaults.ts index 3fc5a183..9e55968f 100644 --- a/src/web/launch-defaults.ts +++ b/src/web/launch-defaults.ts @@ -2,7 +2,7 @@ * @fileoverview Launch-time defaults from synced App Settings, driven by registry data. * * A CLI entry declares `capabilities.launchDefaults` (launch param -> settings key; today - * only codex, `{ model: 'codexModel', reasoningEffort: 'codexReasoningEffort' }`), and + * only codex: `model`, `reasoningEffort` and `networkAccess`), and * `applyLaunchDefaults()` fills those settings into the entry's `launch.legacyConfigField` * object, setting ONLY the fields the caller left unset. Persisted values are re-validated * with `SettingsUpdateSchema`, so a hand-edited settings.json can never smuggle an @@ -39,7 +39,7 @@ export async function applyLaunchDefaults( const defaults: Record = {}; for (const [param, settingKey] of Object.entries(declared)) { const parsed = SettingsUpdateSchema.shape[settingKey].safeParse(settings[settingKey]); - // '' is the settings' "leave it to the CLI" value, the same as unset. + // '' and an off switch are the settings' "leave it to the CLI" value, the same as unset. const value = parsed.success ? parsed.data || undefined : undefined; const wireKey = aliases[param] ?? param; if (value !== undefined && (current?.[wireKey] ?? undefined) === undefined) defaults[wireKey] = value; diff --git a/src/web/public/index.html b/src/web/public/index.html index 4620a557..667aea68 100644 --- a/src/web/public/index.html +++ b/src/web/public/index.html @@ -3048,7 +3048,7 @@
Allow network access - Lets commands in Codex's workspace-write sandbox use the network, which the Codeman skill needs to reach this server. A folder Codex runs read-only (one it does not trust) still asks per command. The sandbox and approvals stay on. Applies to new Codex sessions. + Lets commands in Codex's workspace-write sandbox use the network, which the Codeman skill needs to reach this server. It does not change Codex's sandbox mode: a folder Codex runs read-only (one it does not trust) keeps the network closed and asks per command. The sandbox and approvals stay on. Applies to new local Codex sessions.
diff --git a/test/cli-registry-spawn-golden.test.ts b/test/cli-registry-spawn-golden.test.ts index 569aab69..ae70f5f2 100644 --- a/test/cli-registry-spawn-golden.test.ts +++ b/test/cli-registry-spawn-golden.test.ts @@ -197,6 +197,21 @@ describe('codex', () => { expect(cx({ networkAccess: false })).toBe('codex'); }); + it('never pairs network access with a sandbox mode (owner decision, 2026-11-06)', () => { + // A folder codex runs read-only must stay read-only: it keeps the network closed and asks + // per command. `--sandbox workspace-write` here would also grant write access to it. + for (const version of ['0.162.0', null]) { + const command = render({ + mode: 'codex', + sessionId: SID, + codexConfig: { networkAccess: true }, + claudeCliVersion: version, + }); + expect(command).not.toContain('--sandbox'); + expect(command).not.toContain('-s '); + } + }); + // The `claudeCliVersion` option is the version every gate of THIS entry is measured // against (the name predates a second gated CLI); undefined probes codex itself. const cxv = (version: string | null, codexConfig?: SpawnBridgeOptions['codexConfig']) =>