Your internet is fine, Codex's is not. In the default workspace-write sandbox, network access is off. That is on purpose: a model that can reach the internet can also send your code or keys somewhere.
Options, safest first:
- Run
npm install zodyourself in your own terminal and tell Codex it is installed. Takes five seconds. - Let it ask: when it hits the sandbox it can request to run the command outside it, and you approve that one command.
- Turn network on for the sandbox in
~/.codex/config.toml:
[sandbox_workspace_write]
network_access = true
I stick to 1. The bigger lesson is the last part of your question: when it cannot install something, it quietly writes its own version. Tell it in AGENTS.md to stop and ask instead.