workspace-write cannot edit .agents/skills/** inside trusted workspace, but danger-full-access can

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.409.20454 (1462)

What subscription do you have?

100$

What platform is your computer?

Darwin 24.6.0 arm64 arm

What issue are you seeing?

In workspace-write mode, Codex can read files under .agents/skills/** but cannot write them, even though they are inside a trusted workspace.
The same edit succeeds immediately in danger-full-access, and other workspace files remain writable in workspace-write.
This makes repo-local skills unusable as living documents during normal development.

What steps can reproduce the bug?

1. Open a trusted local workspace repo.
2. Ensure Codex is running in workspace-write mode.
3. Ask Codex to edit a skill file inside the workspace, for example:

.agents/skills/skill-creator/SKILL.md

1. Codex attempts either:

• apply_patch, or
• a direct file write using Node

1. The write fails.

I reproduced both failure modes.

apply_patch failure:
patch rejected: writing outside of the project; rejected by user approval settings

Direct write failure:
Error: EPERM: operation not permitted, open '.agents/skills/skill-creator/SKILL.md'

What is the expected behavior?

Expected

Files under .agents/skills/** are inside the trusted workspace root and should be writable in workspace-write, just like other files in the repo.

Actual

Codex can read files under .agents/skills/**, but cannot write them in workspace-write.

The same write succeeds immediately if I switch the session to danger-full-access.

Additional information

I verified all of the following locally:

• Writing to repo-root files succeeds in workspace-write
• Writing to /tmp succeeds
• Writing to another hidden directory in the same repo succeeds
• Writing specifically under .agents/** fails in workspace-write
• The exact same skill-file write succeeds in danger-full-access

So this appears to be a path-specific sandbox issue for .agents/**, not a general filesystem permission problem.

My Codex config includes:

model = "gpt-5.4"
profile = "backend_auto"
sandbox_mode = "workspace-write"
approval_policy = "on-request"

[sandbox_workspace_write]
network_access = true

[profiles.backend_auto]
sandbox_mode = "workspace-write"
approval_policy = "never"

[projects."/path/to/repo"]
trust_level = "trusted"

OpenAI’s docs say repo-local skills live under .agents/skills, so this path appears intended to be part of normal editable workspace content:
https://developers.openai.com/codex/skills

This is a workflow blocker because repo-local skills are living documents that need to be updated during normal work.