openai/codex · error · anyhow::Error

--sandbox-state-disable-network cannot be applied to a disab

Error message

--sandbox-state-disable-network cannot be applied to a disabled permission profile

What it means

Error "--sandbox-state-disable-network cannot be applied to a disabled permission profile" thrown in openai/codex.

Source

Thrown at codex-rs/cli/src/debug_sandbox.rs:278

    let env = create_env(
        &config.permissions.shell_environment_policy,
        /*thread_id*/ None,
    );
    let mut permission_profile = match sandbox_state.as_ref() {
        Some(state) => match &state.permission_profile {
            PermissionProfile::External { .. } => {
                // `External` only says that the producer relies on an outer sandbox; it does not
                // include filesystem permissions we can recreate here. The consumer may not share
                // that sandbox, so use a locally enforceable read-only profile instead of spawning
                // without a sandbox.
                PermissionProfile::read_only()
            }
            permission_profile => permission_profile.clone(),
        },
        None => config.permissions.effective_permission_profile(),
    };
    if matches!(permission_profile, PermissionProfile::Disabled) && sandbox_state_disable_network {
        anyhow::bail!(
            "--sandbox-state-disable-network cannot be applied to a disabled permission profile"
        );
    }
    if !matches!(permission_profile, PermissionProfile::Disabled)
        && (!sandbox_state_readable_root.is_empty() || sandbox_state_disable_network)
    {
        let file_system = permission_profile
            .file_system_sandbox_policy()
            .with_additional_readable_roots(&cwd, &sandbox_state_readable_root);
        let network = if sandbox_state_disable_network {
            NetworkSandboxPolicy::Restricted
        } else {
            permission_profile.network_sandbox_policy()
        };
        permission_profile = PermissionProfile::from_runtime_permissions(&file_system, network);
    }
    let use_legacy_landlock = sandbox_state.as_ref().map_or_else(
        || config.features.use_legacy_landlock(),

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/cli/src/debug_sandbox.rs:278 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/33ee5f1bb44bf702. Report an issue: GitHub.