A bubblewrap startup failure now fails the cell as 'sandbox failed to start' instead of passing as a refusal.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Planning in an external sandbox keeps full-disk read so Codex skips its network-isolated filesystem helper, but its network now follows PAPERCLIP_RUNNER_NETWORK_ACCESS. The session context reports the real root access, and the e2e grader only accepts a sandbox refusal of the requested write, checked before the UI step.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex planning runs use the paperclip-runner-workspace-read-only profile.
Its restricted reads made Codex load AGENTS.md through the filesystem
helper, which always runs bubblewrap with --unshare-net. Daytona has no
CAP_NET_ADMIN, so thread creation failed with "bwrap: loopback: Failed
RTM_NEWADDR". Inside an external sandbox the planning profile now reads the
whole filesystem, writes nowhere and enables network, so Codex reads files
directly and runs commands without a new network namespace while still
refusing writes. Adds a manual codex-planning-read-only e2e suite that
proves a planning write attempt is refused.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
