docs(codex): say what Allow network access leaves alone

The owner's answer to the PR's open question: the switch does not also pass
--sandbox workspace-write. Settings, wiki, skill and release note now state
the consequence: a folder Codex runs read-only keeps the network closed and
asks per command. A golden test pins the decision by name, and the stale
launch-defaults comments now name networkAccess.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/config/cli-registry/stock.ts

@@ -674,8 +674,9 @@ const CODEX: CliEntry = {
           // a live pane): loopback stays blocked under workspace-write until this is set.
           // ⚠️ Workspace-write ONLY: a folder codex runs read-only (one it does not trust,
           // such as a fresh non-git case) keeps the network closed and asks per command.
-          // Deliberately not paired with `--sandbox workspace-write`, which would also
-          // grant write access to a folder codex itself chose not to trust.
+          // Deliberately not paired with `--sandbox workspace-write` (owner decision,
+          // 2026-11-06), which would also grant write access to a folder codex itself chose
+          // not to trust, under a label that only says "network".
           {
             flag: '--config',
             value: 'sandbox_workspace_write.network_access=true',

src/types/session.ts

@@ -439,8 +439,10 @@ export interface CodexConfig {
   dangerouslyBypassApprovals?: boolean;
   /**
    * Let commands in codex's workspace-write sandbox use the network, Codeman's loopback API
-   * included (passes --config sandbox_workspace_write.network_access=true). Filled from the
-   * synced `codexNetworkAccess` setting when unset; clamped off for a non-granted owner.
+   * included (passes --config sandbox_workspace_write.network_access=true). Never changes the
+   * sandbox mode: a folder codex runs read-only keeps the network closed and asks per command.
+   * Filled from the synced `codexNetworkAccess` setting when unset; clamped off for a
+   * non-granted owner.
    */
   networkAccess?: boolean;
   /** Enable Codex's decorative TUI animations. Disable to reduce remote terminal redraws. */

src/web/launch-defaults.ts

@@ -2,7 +2,7 @@
  * @fileoverview Launch-time defaults from synced App Settings, driven by registry data.
  *
  * A CLI entry declares `capabilities.launchDefaults` (launch param -> settings key; today
- * only codex, `{ model: 'codexModel', reasoningEffort: 'codexReasoningEffort' }`), and
+ * only codex: `model`, `reasoningEffort` and `networkAccess`), and
  * `applyLaunchDefaults()` fills those settings into the entry's `launch.legacyConfigField`
  * object, setting ONLY the fields the caller left unset. Persisted values are re-validated
  * with `SettingsUpdateSchema`, so a hand-edited settings.json can never smuggle an
@@ -39,7 +39,7 @@ export async function applyLaunchDefaults<T extends object>(
   const defaults: Record<string, unknown> = {};
   for (const [param, settingKey] of Object.entries(declared)) {
     const parsed = SettingsUpdateSchema.shape[settingKey].safeParse(settings[settingKey]);
-    // '' is the settings' "leave it to the CLI" value, the same as unset.
+    // '' and an off switch are the settings' "leave it to the CLI" value, the same as unset.
     const value = parsed.success ? parsed.data || undefined : undefined;
     const wireKey = aliases[param] ?? param;
     if (value !== undefined && (current?.[wireKey] ?? undefined) === undefined) defaults[wireKey] = value;

src/web/public/index.html

@@ -3048,7 +3048,7 @@
                   <div class="set-row" data-search="codex network access sandbox loopback codeman skill orchestrate spawn">
                     <div class="set-row-text">
                       <span class="set-row-label">Allow network access</span>
-                      <span class="set-row-desc">Lets commands in Codex's workspace-write sandbox use the network, which the Codeman skill needs to reach this server. A folder Codex runs read-only (one it does not trust) still asks per command. The sandbox and approvals stay on. Applies to new Codex sessions.</span>
+                      <span class="set-row-desc">Lets commands in Codex's workspace-write sandbox use the network, which the Codeman skill needs to reach this server. It does not change Codex's sandbox mode: a folder Codex runs read-only (one it does not trust) keeps the network closed and asks per command. The sandbox and approvals stay on. Applies to new local Codex sessions.</span>
                     </div>
                     <label class="switch switch-sm"><input type="checkbox" id="appSettingsCodexNetworkAccess"><span class="slider"></span></label>
                   </div>