Codex app automations have a "never" approval policy and can't escalate

[anorth2]

What version of the Codex App are you using (From “About Codex” dialog)?

26.527.31326

What subscription do you have?

Pro ($100)

What platform is your computer?

macOS (Apple Silicon)

What issue are you seeing?

In interactive mode sessions are able to escalate approvals for actions like docker socket interactions and running curl commands.

When triggered as an automation they have a "never" escalation policy. This hinders their capabilities since they can't interact with various tools (i.e. sending a curl to ntfy to trigger a phone notification)

What steps can reproduce the bug?

Create an automation that uses curl and notice it can't run curl.

What is the expected behavior?

It should trigger escalation and approval policies and trigger the curl command.

Additional information

No response

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• Scheduled automations on Windows cannot rewrite .codex/browser/sessions policy files, breaking Chrome/X skills that pass manually #24360
• VS Code goal continuation starts with managed workspace-write sandbox instead of configured full access #24326

Powered by Codex Action

[Ashwinning]

Same

I’m seeing the same behavior on Codex Desktop for Windows.

Evidence:

• config.toml has:

  [sandbox_workspace_write]
  network_access = true

• The automation itself is configured with:

  execution_environment = "local"

• But the initial scheduled wakeup/session metadata still shows:
  • sandbox_policy.type = workspace-write
  • network_access = false
• If I later continue the same thread manually, the effective sandbox can switch to danger-full-access, and the exact same network-dependent steps then work.

Seems like the cron/scheduled automation wakeup path is not respecting the local sandbox/network configuration, even though normal interactive continuation can.