Allow writable `.git`/`gitdir`

Open 💬 4 comments Opened Feb 19, 2026 by gyf1214

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What variant of Codex are you using?

CLI

What feature would you like to see?

This is related to #7071 , see also my comment there.

There are read-only exceptions to a writable root (WritableRoot.read_only_subpaths, see protocol.rs). Currently this is hard-coded with: .git (or gitdir equivalent), .codex and .agents.

It would be nice to make this configurable, especially adding a config to make .git/gitdir writable. Otherwise the agent cannot do any git operations without escalation. It's very annoying to keep approving those operations and make it harder for agents to work autonomously.

The rules system works sometime, but the current pattern matching capability does not deal with shell wrapper very well.

I understand the security concern, but it is less applicable to Codex CLI. In most cases, the project directory is a local git copy of a remote repo. The remote repo has its own security policy to guard against dangerous operations (e.g. protected main, no force push, etc.).

Making this configurable under workspace_write would be the best solution.

Additional information

_No response_

View original on GitHub ↗

4 Comments

github-actions[bot] contributor · 6 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#11960

Powered by Codex Action

samdeane · 6 months ago

+1 on this change.

It's not just that it is massively annoying to have to keep approving these operations (although it is!).

It is also a large security risk, since it trains the user to mindlessly approve. I just accidentally approved an operation on ~/.cache because it was interleaved with some other git changes and I was having to approve every one.

ryush00 · 5 months ago

I'm using the Graphite CLI, which requires access to the .git directory. Since Codex doesn't currently allow that, I always have to use full-access mode. That feels unnecessarily risky.

gyf1214 · 5 months ago

If you bother build from source (take ~2hrs, I have to do this anyway since the pre-built release does not work on my env)

I have a fork that simply bypass these "read-only exceptions" to a writable root: https://github.com/gyf1214/codex

Interestingly I use codex itself to periodically sync with latest release and do build for me.

Anyway, I really think this should be a configurable feature in the official release.