Mac App cannot access iCloud Mobile Documents path via writable_roots, though CLI can

What version of the Codex App are you using (From “About Codex” dialog)?

26.325.31654（1272）

What subscription do you have?

Plus

What platform is your computer?

Darwin 25.3.0 arm64 arm

What issue are you seeing?

Summary

In Codex CLI, I can access an iCloud Mobile Documents directory by passing it through --add-dir under workspace-write.

In Codex Mac App, the same directory cannot be accessed from another workspace even when it is explicitly listed in .codex/config.toml under writable_roots.

This looks specific to iCloud ~/Library/Mobile Documents/... paths. Regular external local directories work as expected.

Environment

• Codex Mac App
• macOS
• Workspace root:

/Users/sishen/Work/life/lifestyle

• Target iCloud directory:

/Users/sishen/Library/Mobile Documents/iCloud~md~obsidian/Documents/PowerVault/Wardrobe

CLI Behavior

This works in Codex CLI:

--sandbox workspace-write --ask-for-approval on-request --add-dir "/Users/sishen/Library/Mobile Documents/iCloud~md~obsidian/Documents/PowerVault/Wardrobe"

The directory is readable there.

Mac App Config

Repo config:

/Users/sishen/Work/life/lifestyle/.codex/config.toml

sandbox_mode = "workspace-write"
approval_policy = "on-request"

[sandbox_workspace_write]
writable_roots = [
  "/Users/sishen/Library/Mobile Documents/iCloud~md~obsidian/Documents/PowerVault/Wardrobe"
]

Actual Behavior

In Codex Mac App, attempts to access that directory from the lifestyle workspace fail with permission errors, such as:

• Operation not permitted when reading the directory
• apply_patch blocked by file permissions when trying to edit there

What I Verified

• The .codex/config.toml syntax is correct
• The path appears in the App thread's effective writable_roots
• macOS privacy permissions such as Full Disk Access / Files and Folders were already enabled
• Codex Mac App was fully restarted
• This is not a general writable_roots failure

Repro / Comparison Experiments

1. Open the iCloud directory directly as a workspace

Open this directory directly in Codex Mac App:

/Users/sishen/Library/Mobile Documents/iCloud~md~obsidian/Documents/PowerVault/Wardrobe

Result: succeeds

2. Use writable_roots for a regular non-iCloud external directory

From another workspace, add a normal external local directory to writable_roots and access it.

Result: succeeds

3. Use writable_roots for the iCloud directory from another workspace

From /Users/sishen/Work/life/lifestyle, add the iCloud directory above to writable_roots and try to access it.

Result: fails

Expected Behavior

If a directory is explicitly listed in writable_roots, the Mac App should be able to access it consistently, matching CLI behavior, assuming the app has the necessary system permissions.

If iCloud Mobile Documents paths need extra user-granted security-scoped access, the app should surface that clearly in the UI or error message.

Likely Cause

My guess is that this is related to macOS security-scoped access / bookmark handling for iCloud ~/Library/Mobile Documents/... paths.

It seems the Mac App can access the directory when it is directly opened as a workspace, but not when it is only referenced indirectly via writable_roots from another workspace.

Suggested Improvement

Either:

1. Support writable_roots for iCloud Mobile Documents paths in the Mac App the same way CLI supports --add-dir
2. Or provide a clearer error / UI flow explaining that iCloud directories require explicit user-granted directory access in the app

What steps can reproduce the bug?

1. Open Codex Mac App on macOS.
2. Open the workspace ~/Work/with-icloud-dir.
3. In ~/Work/with-icloud-dir/.codex/config.toml, configure:

```toml
sandbox_mode = "workspace-write"
approval_policy = "on-request"

[sandbox_workspace_write]
writable_roots = [
"/Users/xxx/Library/Mobile Documents/iCloud~md~obsidian/icloud-dir"
]
```

1. Fully restart Codex Mac App.
2. In that lifestyle workspace, ask Codex to read or edit files under:

/Users/xxx/Library/Mobile Documents/iCloud~md~obsidian/icloud-dir

1. Observe that access fails with permission-related errors such as Operation not permitted or apply_patch being blocked by file permissions.
2. As a comparison, open the iCloud directory itself as a workspace in Codex Mac App and try the same read operation.
3. Observe that access succeeds when the same directory is opened directly as a workspace.
4. As another comparison, add a normal non-iCloud external directory to writable_roots and access it from the original workspace.
5. Observe that the non-iCloud external directory succeeds.

What is the expected behavior?

If a directory is explicitly listed in writable_roots, the Mac App should be able to access it consistently, matching CLI behavior, assuming the app has the necessary system permissions.

If iCloud Mobile Documents paths need extra user-granted security-scoped access, the app should surface that clearly in the UI or error message.

Additional information

_No response_