Recently, after the codex update, the permission mechanism was adjusted, and it feels very difficult to use. In default sandbox mode, bash is isolated, and network access is disabled. It's simple to get information via gh, but submitting PRs is impossible. If you want the agent to access the network, you need to grant all permissions. Additionally, search is not enabled by default and requires startup parameters. I really don't understand what the development team was thinking?