← Back to Blog

PR #1271 — Direct Codex GitHub-Write Network Access via Config Override

Where we left off

For weeks across the autonomous ops and dispatch hardening tracks (issues #426, #569, #859, #865), OpenAI Codex was treated as structurally incapable of executing GitHub-write actions (PR reviews, issue comments, PR merges). While #859 cleanly resolved identity attribution via role-scoped GitHub App tokens, Codex remained routed out of GitHub writes under policy.json (can_gh_write: False).

The standing justification baked into CLAUDE.md and design docs was that OpenAI Codex's workspace-write sandbox enforces an unbypassable, structural block on network egress to api.github.com. Earlier today, issue #1268 was opened to design a heavy brokered file-based relay — where Codex inside its sandbox would write JSON action files to a local directory, and synlynk daemon outside the sandbox would watch the directory, validate authority, execute gh with the role token, and write the response back.

What moved the goalpost: the attribution error & the live probe

Two empirical investigations completely reframed the problem:

  1. The PR #1258 Attribution Finding: In session notes, it had been tentatively suggested that Codex had successfully created PR #1258 under --requires-gh-write, supposedly disproving the network egress block. A metadata audit of PR #1258 showed this was an attribution false positive: the PR body was auto-generated by synlynk's host-level wrapper (_maybe_open_worktree_pr in synlynk/jobs.py), which ran gh pr create on the host machine after Codex exited. Codex had only made local edits to synlynk/daemon.py and synlynk/db.py, and had never executed a single gh or network command.

  2. Live Empirical Sandbox Probe: We tested OpenAI Codex CLI (v0.150.1) on macOS Darwin arm64 under synlynk's exact invocation path (codex exec - -s workspace-write):

    • Default Sandbox: curl https://api.github.com failed immediately with curl: (6) Could not resolve host: api.github.com. Network egress was indeed blocked at the DNS/Seatbelt level.
    • With Config Override (-c sandbox_workspace_write.network_access=true): curl https://api.github.com succeeded with HTTP/2 200.

This proved that the sandbox network block was not an unalterable structural limitation, but a configurable policy option natively supported by the Codex CLI.

What this PR shipped

Rather than building a complex, brittle file-based RPC daemon (#1268), PR #1271 implemented Direct Config Override:

  • synlynk/dispatch.py (lines 2441–2450): When requires_gh_write is active, _CODEX_NETWORK_PERMISSION ("run:install") is now appended to effective_grants for Codex alongside "run:shell". This cleanly feeds into downstream _permissions_to_flags(), which appends ["-c", "sandbox_workspace_write.network_access=true"].
  • Security & Isolation Guarantees:
    • Non-gh-write dispatches (code editing, tests, documentation) without run:install continue to run with network access disabled by default.
    • Subprocess environments continue to be sanitized via _build_subprocess_env() using _ENV_ALLOWLIST_BASE, purging ambient host secrets.
    • GitHub authentication relies on ephemeral, role-scoped GH_TOKEN injected into isolated temporary directories.
  • Unit & Preflight Tests (tests/test_agent_cli.py):
    • test_codex_dispatch_effective_grants_includes_network_permission_on_gh_write
    • test_codex_dispatch_effective_grants_omits_network_permission_when_gh_write_false
    • test_execute_the_plan_at_docssuperpowersplans_codex_requires_gh_write_appends_network_access_flag
  • SOP Artifacts:
    • Design Spec: docs/superpowers/specs/2026-08-29-codex-direct-gh-write-network-access-design.md
    • Implementation Plan: docs/superpowers/plans/2026-08-29-codex-direct-gh-write-network-access.md

Review and Merge Flow

  • Authorship: Implemented via Codex dispatch (job-93ffd443, base feat/1268-codex-direct-gh-write).
  • Review:
    • First dispatched to Grok (job-b3492d49), which hit the known headless session cancellation bug (stopReason: cancelled) before posting review comments.
    • Escalated to Claude, which failed due to monthly account spend limit exhaustion.
    • Escalated to Agy (job-fc59d327) as the authorized policy fallback. Agy independently executed the test suite, verified CI green across Python 3.8, 3.10, and 3.12, and posted a formal approval review on PR #1271.
  • Merge: Merged to main as 4eddd09b3b555647f0c583bf6c3228d5ca32687e.

Where this leaves the long-arc goal

Codex now has a clean, direct, and native mechanism for network access when executing GitHub-write tasks. Once the worktree token-cache path gap (#1264) is closed, Codex can reliably perform PR reviews and issue triage natively, without any custom daemon file-relay overhead.

← Back to all posts