Desktop permission mismatch: hidden credential stdin rejected in original and fresh local chats #54031

What version of the Codex App are you using (From “About Codex” dialog)?

26.1007.71326 (build 20398); verified bundled CLI 0.162.0-alpha.17.2

What subscription do you have?

ChatGPT sign-in; subscription tier not verified

What platform is your computer?

Darwin 27.0.0 arm64 arm (Apple M4 Mac mini)

What issue are you seeing?

The desktop app supplies granular sandbox_approval=false despite selecting Ask for approval and testing Custom (config.toml) with ordinary on-request approval and later explicit granular sandbox_approval=true. The exact rejection is:

write_stdin rejected: approval required by policy, but AskForApproval::Granular.sandbox_approval is false

Original chat/session: 01a13788-8a62-7fd1-9768-c087cb679cc9
Fresh local chat/session: 01a13b42-ad51-73d0-8e9c-019cb3b9ec1c

The fresh chat passed a harmless hidden-stdin test, but its actual authorized installer credential handoff was rejected. In the original chat, harmless stdin also failed. Native narrow filesystem/network grants were accepted. We stopped at rejection; no bypass or alternate secret transport was used.

Documented standalone app-server config/read(includeLayers=true) resolves the correct user config, while configRequirements/read returns requirements:null. This separate process is not a proven connection to the desktop live app-server. Standard checked system/project/MDM policy locations contain no override. The CLI app-server proxy exits before initialization. Electron resume and turn-start logs supply the granular restriction.

A reviewed, redacted permission-only diagnostics file is included. No raw logs, credentials, authentication headers, prospect data or session transcripts are being published.

What steps can reproduce the bug?

1. In a local desktop chat select Ask for approval and verify local execution host.
2. Test Custom (config.toml): approval_policy="on-request", approvals_reviewer="user", sandbox_mode="workspace-write".
3. Observe effective/model-visible granular sandbox_approval=false. Updating the app and rebooting do not resolve it.
4. Test explicit granular sandbox_approval=true in user config; config/read resolves it correctly but desktop still supplies false.
5. Grant normal narrow filesystem/network requests.
6. Run a reviewed Python installer in a PTY. It disables termios ECHO, announces readiness, and reads one JSON line. Pass the authorized Site credential through write_stdin: the operation is rejected before input delivery.
7. Create a fresh local chat: harmless hidden stdin passes, but installer credential input fails with the same error.

Installation is for an authorized per-user draft-only polling worker with exact-origin validation and a no-redirect HTTP opener. No Full Access, database edits, approval bypasses, or alternate credential transports were used.

What is the expected behavior?

The selected mode should permit normal user-reviewed approval requests while retaining the workspace sandbox. If an enforced requirement prevents this, the UI/provenance diagnostics should identify it. Please clarify the app-supplied per-thread/turn policy and why harmless stdin can pass while installer credential input routes to a disabled approval category.

Additional information

Observed October 14, 2026. Diagnostics use UTC timestamps. Related symptom appears in #52458; this report adds original/fresh chat IDs, narrow-grant results, and the harmless-versus-credential stdin difference. Full logs and transcripts were reviewed but are not attached publicly. Only allowlisted permission fields and timestamps are included. Support’s AI assistant recommended filing a GitHub bug; no human case number was confirmed.

codex-permission-diagnostics.txt