Linux workspace-write sandbox creates empty read-only .codex file in repo root

What version of Codex CLI is running?

codex-cli 0.120.0

What subscription do you have?

Plus

Which model were you using?

gpt-5.4

What platform is your computer?

Linux 6.19.11-arch1-1 x86_64 unknown

What terminal emulator and version are you using (if applicable)?

Ghostty

What issue are you seeing?

On Linux, Codex can create a top-level .codex entry in the workspace as an empty regular file rather than a directory.

This does not look like intended project config state. If Codex wants project-local config, the expected shape is a .codex/ directory with contents such as config.toml, not a zero-byte read-only file.

This appears related to recent sandbox changes:

• 774965f1e8 (2026-03-12), fix: preserve split filesystem semantics in linux sandbox (#14173)
• 86764af684 (2026-03-26), Protect first-time project .codex creation across Linux and macOS sandboxes (#15067)

For a missing workspace .codex, that appears to materialize a visible .codex file in the real repo.

What steps can reproduce the bug?

1. Use Linux.
2. Open a repo with no existing top-level .codex.
3. Run Codex with workspace-write sandboxing.
4. After the turn, observe that .codex may exist as an empty regular file in the repo root.

What is the expected behavior?

Protect first-time writes under a missing top-level project .codex without creating or leaving behind a visible .codex file in the workspace.

Additional information

_No response_