Grant the sandbox extra write or network access
approvals & sandbox
// what it does
In workspace-write only the project directory is writable and the network is off. --add-dir grants write access to an extra directory for the run, while outbound network is enabled with the sandbox_workspace_write.network_access config key (or a -c override).
// shell
$ codex --add-dir ../shared-lib "update the shared types"$ codex -c sandbox_workspace_write.network_access=true "install deps and build"// gotcha
Without network_access, commands like npm install or pip install fail inside workspace-write because the sandbox blocks sockets. Enable it deliberately for the run that needs it rather than globally.