When Codex fails to perform npm install, pip install, or pull the repository, first check whether the error is timeout, DNS, or network rejection. Codex can search web pages, but that doesn't mean the terminal commands it runs can also access the internet; Web search and command network are two separate permissions, and must be checked separately.
Local Codex first looks at the sandbox network
CLI, IDE extensions, and desktop applications do not open command networks by default under the workspace-write sandbox. When you need to network project commands, configure the following in the actual config.toml:
[sandbox_workspace_write]
network_access = trueRestart Codex before proceeding with the installation. If the task still requests approval, check the current approval policy instead of repeatedly retesting the package manager. Don't switch to completely unrestricted mode just to install a dependency.
Even after turning on the internet, I still can't access the domain name
If the network proxy policy is also enabled, the network will filter according to domain name rules. Make sure the registry, source code hosting site, and download domain name actually accessed by the package manager are all within the allowed range; Only the homepage domain name is allowed; dependency files may still be downloaded from other subdomains or object storage. deny rules will cover allow, and wildcards should not be unintentionally extended to all sites.
Normal web search does not mean the installation commands are working
web_search controls the Codex search tool, which can use caching, indexing, real-time, or off-mode. It does not grant network permissions for npm, pip, git, or curl in the terminal. Therefore, "Document can be found but download failed" is not contradictory; we should return to the command network and domain name policy check.
Cloud tasks should be distinguished between the setup and agent stages
The setup phase of the Codex cloud environment allows network installation and dependencies, while the official agent phase is offline by default. Fixed dependencies prioritize writing to the environment's setup script; If the task does require access to external services during runtime, enable Agent Internet Access for that environment, allowing only the necessary domain names and request methods.
Finally, use a minimum request to verify the actual registry address, then run the full installation. If the minimum request also fails, record the target domain name and error type; If the minimum request succeeds but installation fails, the file lock, proxy variable, certificate, or package manager configuration is forwarded and Codex permissions are no longer relaxed.
