apply_patch in nested read-only exec misreports in-project files as outside of the project

apply_patch in nested read-only exec misreports in-project files as "writing outside of the project"

Summary

When codex exec -s read-only is run from inside an existing Codex session, apply_patch correctly fails to modify a file in the current working directory, but the reported reason is wrong.

For an existing file ap_rel_target.txt located directly in the current working directory, the nested session reports:

writing outside of the project; rejected by user approval settings

That message is misleading because the file is inside the project/workdir. This looks like an error classification or approval-message bug, not an enforcement bug.

Environment

• Codex CLI: codex-cli 0.116.0
• Workdir: /home/cryptotrading74
• Outer session exists and nested codex exec is launched from within it

Repro

Create a file in the current working directory:

printf 'orig
' > /home/cryptotrading74/ap_rel_target.txt

Run nested read-only exec with apply_patch only:

codex exec --ephemeral --skip-git-repo-check --color never --json   -s read-only -C /home/cryptotrading74   'Use apply_patch only, not shell writes. Modify the existing file ap_rel_target.txt so its only line becomes changed. If apply_patch cannot do it, stop without fallback.'   > /tmp/codex_ro_applypatch_modify.jsonl

Observed transcript excerpt:

{"type":"item.completed","item":{"id":"item_3","type":"agent_message","text":"The first patch was rejected because the absolute path was treated as outside the writable project boundary. I’m retrying with the relative path, still using `apply_patch` only."}}
{"type":"item.completed","item":{"id":"item_4","type":"agent_message","text":"I could not modify `ap_rel_target.txt`. `apply_patch` was rejected twice by the environment as “writing outside of the project; rejected by user approval settings,” so I stopped without using any fallback."}}

The file remains unchanged:

orig

Control check

The same style of relative apply_patch works in workspace-write mode:

codex exec --ephemeral --skip-git-repo-check --color never --json   -s workspace-write -C /home/cryptotrading74   'Use apply_patch only, not shell writes. Create a new file named ws_applypatch_relative_ok.txt in the current working directory containing one line: applypatch_ws. If apply_patch cannot do it, stop without using any fallback.'   > /tmp/codex_ws_applypatch_only.jsonl

That nested session succeeds and creates the file in /home/cryptotrading74.

Expected behavior

If apply_patch is blocked because the session is read-only, the error should say that the write is blocked by read-only sandbox/policy.

Actual behavior

The rejection says the file is outside of the project, even when the file is an existing relative path inside the current working directory.

Files / artifacts

• /tmp/codex_ro_applypatch_modify.jsonl
• /tmp/codex_ws_applypatch_only.jsonl
• /home/cryptotrading74/ap_rel_target.txt

Suggested title

apply_patch in nested read-only exec misreports in-project files as outside of the project