Codex CLI in read-only mode can write

What version of Codex CLI is running?

0.105.0

What subscription do you have?

Plus

Which model were you using?

gpt-5.3-codex

What platform is your computer?

Linux 6.17.0-14-generic x86_64 unknown

What terminal emulator and version are you using (if applicable)?

bash

What issue are you seeing?

Codex CLI in read-only mode can write

What steps can reproduce the bug?

Setup:

My ~/.codex/config.toml contains only one line:

sandbox_mode="read-only"

Steps:

• In bash, I navigated to a repository without an AGENTS.md file.
• I opened codex with codex and asked "add an AGENTS.md file"
• Codex suggested a change and asked for approval to execute it
• Approval was granted
• The codex session was exited
• A file AGENTS.md had been written to the repository.

What is the expected behavior?

I am no UX designer so I don't know exactly what should have happened instead. An error message, perhaps. But a read-only session should definitely not have written.

Additional information

_No response_