Windows: Sites publishing blocked by granular sandbox approval policy despite explicit approval #49944

Problem

Sites publishing is blocked on Windows before any source upload occurs. The official Sites workflow starts, but its required write_stdin call is rejected with:

approval required by policy, but AskForApproval::Granular.sandbox_approval is false

Environment

• Windows desktop
• Bundled Codex executable: 0.159.2
• Sites plugin: 0.1.75
• Sandbox: workspace-write

Troubleshooting already performed

• Explicitly authorized publishing.
• Granted network and filesystem permissions for the source checkout.
• Tried both Ask for approval and Approve for me.
• Restarted the app and retried the official workflow.
• Tried /approve, but the composer shows “No commands.”
• Inspected relevant local configuration: no matching approval restriction was found.
• Confirmed that recent session records still contain approval_policy.granular.sandbox_approval: false.

Expected behavior

The approved Sites publishing workflow should be able to surface the required approval and proceed, or clearly identify the policy source and the supported way to resolve it.

Actual behavior

The publishing continuation is rejected before an approval prompt can appear. Changing the visible permission mode and granting the requested access have not resolved the issue. No source upload occurs, so the website cannot be updated.

Please investigate the effective approval policy and provide a supported repair.

No credentials or conversation logs are included in this report.