diff --git a/.changeset/codex-skill-network.md b/.changeset/codex-skill-network.md
index 24295eda..35a2406f 100644
--- a/.changeset/codex-skill-network.md
+++ b/.changeset/codex-skill-network.md
@@ -1,5 +1,5 @@
 ---
-"aicodeman": minor
+'aicodeman': minor
 ---
 
 **Codex sessions can drive other sessions through the Codeman skill.** A new opt-in Codex setting, **Allow network access** (App Settings, Codex, off by default), starts every new local Codex session with `sandbox_workspace_write.network_access=true`, so the skill's calls to this server are no longer blocked by Codex's sandbox. It has a cost: commands in Codex's sandbox can then call Codeman's API, which can start a session outside the sandbox with no approval prompt, even when a password is set, so the sandbox no longer contains a prompt-injected command. It is forced off for users without the privileged-commands grant in multi-user mode, and scheduled jobs do not use it. It applies where Codex runs the folder workspace-write and does not change Codex's sandbox mode: a folder Codex runs read-only keeps the network closed and asks per command. A local Codex 0.162 or later now also starts with `--no-daemon`, so each session runs its own Codex app server: a shared background server (another version's included) no longer stops a launch on an "incompatible feature settings" dialog, and commands inside Codex see their own session's `CODEMAN_*` variables. Remote and Docker launches do not get the flag. Version gates in the CLI registry are now measured against that CLI's own version instead of Claude's. The skill falls back to its `curl` path when `codeman` is not on PATH, and asks Codex to re-run a blocked call with approval instead of giving up.