/codex:rescue fails to write files — always returns a read-only sandbox error

[Marcos-SA-git]

Summary
I want Codex to make an actual file change when I ask /codex:rescue to do something that requires writing (create, edit, or delete a file). Every time, it comes back saying it can't because the sandbox is read-only — even for something as simple as creating a plain text file inside my own project folder.

Environment

• OS: Windows 11
• Codex CLI: 0.142.4
• Plugin: codex-plugin-cc 1.0.5
• Claude Code, invoking via /codex:rescue

Steps to reproduce

1. Open a project in Claude Code with the Codex plugin installed and authenticated.
2. Run /codex:rescue create a file named test.txt containing "hello" (or any task that clearly requires a write).
3. Wait for the result.

Expected
The file gets created.

Actual
Codex reports the workspace as read-only and refuses to write, every time — not occasionally.

Related
Possibly the same underlying issue as openai/codex#6428, though that one isn't specific to this plugin and I couldn't find a plugin-side issue describing this exact case.

[Marcos-SA-git]

(Note: this was found by Claude while investigating, not something I diagnosed manually myself.)
Follow-up with a repro and a fix, in case it's useful for tracking this down.

Root cause: Codex CLI (0.142.4, Windows) silently downgrades a workspace-write sandbox to effectively read-only when approval_policy is never. Confirmed this is a Codex CLI behavior, not plugin-specific, by reproducing it with codex exec directly (no plugin involved):

codex exec -s workspace-write -c approval_policy=never "create a file"
→ fails: "blocked by policy" / "rejected by user approval settings"

codex exec -s workspace-write -c approval_policy=on-request "create a file"
→ succeeds, no approval prompt (write stays inside the sandbox root, nothing needs to escalate)

Where the plugin was affected: codex-companion.mjs always sent approvalPolicy: "never" for every task — write-capable runs only toggled sandbox between read-only/workspace-write, never approvalPolicy. So any /codex:rescue write task hit exactly the CLI behavior above.

Fix: for write-capable task runs, request approvalPolicy: "on-request" instead of "never", keeping sandbox: "workspace-write" unchanged. Verified end-to-end through the plugin itself (not just the CLI repro above) — write-capable /codex:rescue tasks now create/delete files as expected.

Not sure if the CLI's never + workspace-write interaction is intended (the docs suggest never should work with any sandbox mode) or a bug worth reporting separately against openai/codex, but wanted to leave the repro + plugin-side fix here either way.

[mvanhorn]

Opened a fix in #426 - approvalPolicy is now threaded through runAppServerTurn, with on-request for write-capable runs per the repro in this thread.