Give Codex Write Access to the Repo Without Giving It the Network

Fixing a bug in an eval script needs write access to the repository. It does not need the network. But if the script's tests call a paid model API, or download a benchmark from a hub on first run, a routine fix can spend money, hit rate limits or pull data you did not intend to. Treat file access and network access as two decisions.

OpenAI's Codex security documentation says that for the CLI, IDE extension and desktop app, the default workspace-write sandbox keeps network access off unless you enable it:

[sandbox_workspace_write]
network_access = true

It also says .git stays read-only inside a writable workspace, that /status shows which directories are in the workspace, and that turning on the network proxy feature constrains network traffic but does not grant network access by itself.

The check, in a scratch repository:

codex --sandbox workspace-write --ask-for-approval on-request
# ask: "Run curl -sI https://pypi.org and report the exit code."
codex --sandbox workspace-write --ask-for-approval on-request \
  -c 'sandbox_workspace_write.network_access=true'
# ask the same thing

The documentation says that in this mode Codex asks for approval before running a command that needs network access. In the first session, decline; the command should not reach the network. In the second, it should succeed. These commands follow the documented flags and were not run for this note, so treat the expected results as behavior to confirm on your machine and version.

Then remove the need for the network. Record one real API response per test case once, save it as a fixture, and make the tests read the fixture. Keep the same assertions. The fix then needs no network at all, and the tests become reproducible too. The book's isolation chapter covers why an enforced boundary beats a sentence in the prompt.

OpenAI documentation.