{"record":{"id":"33ee5f1bb44bf702","repo":"openai/codex","slug":"sandbox-state-disable-network-cannot-be-applied","errorCode":null,"errorMessage":"--sandbox-state-disable-network cannot be applied to a disabled permission profile","messagePattern":"--sandbox-state-disable-network cannot be applied to a disabled permission profile","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/cli/src/debug_sandbox.rs","lineNumber":278,"sourceCode":"    let env = create_env(\n        &config.permissions.shell_environment_policy,\n        /*thread_id*/ None,\n    );\n    let mut permission_profile = match sandbox_state.as_ref() {\n        Some(state) => match &state.permission_profile {\n            PermissionProfile::External { .. } => {\n                // `External` only says that the producer relies on an outer sandbox; it does not\n                // include filesystem permissions we can recreate here. The consumer may not share\n                // that sandbox, so use a locally enforceable read-only profile instead of spawning\n                // without a sandbox.\n                PermissionProfile::read_only()\n            }\n            permission_profile => permission_profile.clone(),\n        },\n        None => config.permissions.effective_permission_profile(),\n    };\n    if matches!(permission_profile, PermissionProfile::Disabled) && sandbox_state_disable_network {\n        anyhow::bail!(\n            \"--sandbox-state-disable-network cannot be applied to a disabled permission profile\"\n        );\n    }\n    if !matches!(permission_profile, PermissionProfile::Disabled)\n        && (!sandbox_state_readable_root.is_empty() || sandbox_state_disable_network)\n    {\n        let file_system = permission_profile\n            .file_system_sandbox_policy()\n            .with_additional_readable_roots(&cwd, &sandbox_state_readable_root);\n        let network = if sandbox_state_disable_network {\n            NetworkSandboxPolicy::Restricted\n        } else {\n            permission_profile.network_sandbox_policy()\n        };\n        permission_profile = PermissionProfile::from_runtime_permissions(&file_system, network);\n    }\n    let use_legacy_landlock = sandbox_state.as_ref().map_or_else(\n        || config.features.use_legacy_landlock(),","sourceCodeStart":260,"sourceCodeEnd":296,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/cli/src/debug_sandbox.rs#L260-L296","documentation":"Error \"--sandbox-state-disable-network cannot be applied to a disabled permission profile\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/cli/src/debug_sandbox.rs:278 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}