imagegen

Source excerpt starting at line 1.

1# Codex network approvals / sandbox notes2 3This file is for the fallback CLI mode only. Read it when the user explicitly asks to use `scripts/image_gen.py` / CLI / API / model controls, or after the user explicitly confirms that a transparent-output request should use the `gpt-image-1.5` true-transparency fallback path.4 5This guidance is intentionally isolated from `SKILL.md` because it can vary by environment and may become stale. Prefer the defaults in your environment when in doubt.6 7## Why am I asked to approve image generation calls?8The fallback CLI uses the OpenAI Image API, so it needs outbound network access. In many Codex setups, network access is disabled by default and/or the approval policy requires confirmation before networked commands run.9 10## Important note about approvals vs network11- `--ask-for-approval never` suppresses approval prompts.12- It does **not** by itself enable network access.13- In `workspace-write`, network access still depends on your Codex configuration (for example `[sandbox_workspace_write] network_access = true`).14 15## How do I reduce repeated approval prompts?16If you trust the repo and want fewer prompts, use a configuration or profile that both:17- enables network for the sandbox mode you plan to use18- sets an approval policy that matches your risk tolerance19 20Example `~/.codex/config.toml` pattern:21 22```toml23approval_policy = "on-request"24sandbox_mode = "workspace-write"25 26[sandbox_workspace_write]27network_access = true28```29 30If you want quieter automation after network is enabled, you can choose a stricter approval policy, but do that intentionally and with care.31 32## Safety note33Enabling network and reducing approvals lowers friction, but increases risk if you run untrusted code or work in an untrusted repository.34