Codex 0.161: denied reads stay denied, so a Sume upload may fail

If Codex cannot read a file, it cannot upload it to Sume, even after you approve a broader write escalation. The Codex changelog for 0.161.0, dated October 7, 2026, says approved filesystem escalation can grant broader write access while preserving denied reads and network restrictions. Sume's hosted MCP cannot read files from your computer, so any local upload has to be read by the client process first.

That combination catches people who give an agent an image to animate: the escalation prompt looks like it opened everything, yet a denied read is still denied.

How a local file reaches Sume

Sume's docs describe the upload flow in three steps.

Steps if the upload fails

First, check where the file lives. A file in a denied path will not be read whatever you approve for writes. Copy it to the working directory, or change the read rule, and retry. Second, check network. If the sandbox restricts outbound hosts, the PUT to the upload URL needs permission, separate from the MCP host. Third, retry the whole flow with a fresh idempotency_key for the new assets_upload_url call; do not reuse the old URL.

• Keep source images inside the project folder the agent can read.
• Allow mcp.sume.com and the upload host the tool returns.
• Ask for dry_run=true before any paid generation that uses the asset.

A worked failure

Picture a folder where the sandbox denies reads of a private/ directory, and a product photo sits in it. You approve a write escalation so the agent can save results elsewhere. The agent then calls assets_upload_url, which succeeds, and tries to read the photo for the PUT. The read is denied, so the PUT never happens, and assets_complete would register an empty or missing upload. The agent may report a vague failure.

The fix is boring: move or copy the photo into a readable folder, and tell the agent to read the file before it asks Sume for an upload URL. Failing early avoids a half-finished asset record.

What Sume does not do

Sume does not reach into the sandbox, and it cannot see why a read failed. The server only gets calls that the client chose to make. A failed read shows up in the Codex output as a local error, not as a Sume error, so check there first.