Sandbox policy inconsistency: Git metadata writes bypass approval after repo root relocation

What version of Codex is running?

codex-cli 0.118.0

What subscription do you have?

ChatGPT Pro

Which model were you using?

gpt-5.4

What platform is your computer?

macOS

What issue are you seeing?

There appears to be a sandbox / approval policy inconsistency affecting Git history-changing operations.

In an initial workspace layout, commands like:

• git add -A
• git commit -m "..."

either required explicit approval or were blocked due to writes to .git metadata.

After relocating the repository root into a subdirectory, the same operations succeeded inside the sandbox without any approval prompt, producing a real commit.

This indicates that approval enforcement is not tied to the actual operation (writes to Git metadata and history mutation), but instead depends on workspace layout or cwd-relative heuristics.

Why this is a problem

Git commits mutate repository history and write to .git internals such as the index, objects, and refs. These are clearly sensitive operations.

Approval requirements for such operations must be invariant with respect to directory layout.

A change in repository placement should not downgrade enforcement.

Current behavior suggests a layout-dependent enforcement boundary, which effectively enables bypassing intended approval constraints.

This breaks the assumption that approval policies are operation-based rather than layout-dependent.

What steps can reproduce the bug?

1. Start a sandboxed session where Git metadata writes require approval or are restricted.
2. Use a repository in its original layout and confirm that:

• git add / git commit require approval or fail.

1. Move the repository so that its root is inside a subdirectory.
2. Change working directory to that subdirectory.
3. Run:

git add -A
git commit -m "test commit"

1. Observe that the commands succeed without approval.

What is the expected behavior?

Approval enforcement for Git metadata writes and history mutations must be consistent regardless of:

• cwd
• workspace root
• repository nesting

If git commit is considered a sensitive operation in one layout, it must remain sensitive in all layouts.

Additional information

Likely root cause:

Approval / sandbox logic appears to rely on workspace-root or cwd-relative writable scopes, rather than on:

• actual access to .git internals
• or detection of history-mutating Git operations

If so, this creates a class of layout-based policy bypasses, where relocating a repository changes the effective enforcement boundary.