Windows desktop: Sites helper stdin blocked by granular sandbox approval after network grant #53198

Environment

Codex desktop on Windows, PowerShell, Sites plugin 1.0.0. Installed desktop app version has not been confirmed. Reproduced on 2026-10-11.

Problem

The supported workflow for updating an existing Sites project cannot proceed past sending hidden credential JSON to site-workflow.mjs via write_stdin.

Exact error:

write_stdin rejected: approval required by policy, but AskForApproval::Granular.sandbox_approval is false

Steps to reproduce

1. Use Sites get_site for an existing project: succeeds and confirms owner access and active status.
2. Obtain a short-lived source repository credential using the native Sites tool: succeeds.
3. Grant requested network access through request_permissions: granted for the turn.
4. Launch the official Sites site-workflow.mjs helper with the selected project ID, using exec_command with tty:true.
5. Wait for Ready for Site workflow JSON on stdin (input is hidden).
6. Send a newline-terminated JSON object containing the credential and commands:[] through write_stdin, as required by the Sites skill.
7. The call is rejected automatically with the error above before the helper can synchronize the source. No actionable approval prompt is provided.

Additional observations

• Empty polling of a waiting session succeeds.
• In one attempt before the network grant, the input was accepted but the helper exited with Unable to prepare the Site; this alone does not establish the cause of that failure.
• After the official network permission was granted, the needed stdin submission was rejected again with the granular approval error.
• No security bypass, alternate credential transport, or global permission relaxation was attempted.
• No source sync or deployment of the requested change succeeded. A restart was suggested but has not been confirmed as performed or tested.

Expected behavior

Allow the supported Sites helper operation under appropriate permissions, or provide a reviewable approval prompt and identify the effective policy preventing it. Please provide a supported recovery path that preserves hidden credential transport and security controls.

Impact

Blocks publication of an authorized tracking integration on an existing site. The site's separate database was restored and responds to queries, but that does not resolve the local helper rejection.

Related reports

Possibly related to #50874, #52517 and #53032. This report adds the Windows reproduction and the contrast between empty session polling and required stdin submission after a network grant.

Project identifiers, local user paths, customer information and credentials have been omitted from this public report.