--add-dir does not grant write access on Ubuntu (workspace-write); writable_roots works

What version of Codex CLI is running?

codex-cli 0.117.0 and codex-cli 0.121.0

What subscription do you have?

Plus

Which model were you using?

gpt-5.4-mini (low)

What platform is your computer?

Linux 6.8.0-107-generic x86_64 x86_64

What terminal emulator and version are you using (if applicable)?

VSCode

What issue are you seeing?

--add-dir does not grant write access to the specified directory when using -s workspace-write.

Even though the directory is writable at the OS level, Codex cannot write to it.
However, configuring the same path via writable_roots in config.toml works as expected.

This suggests that --add-dir is not correctly applied to sandbox writable roots.

What steps can reproduce the bug?

1. Ensure the directory is writable:

ls -ld /home/ibis/AI/CodexSkill
test -w /home/ibis/AI/CodexSkill && echo WRITABLE

1. Start Codex with:

codex --add-dir /home/ibis/AI/CodexSkill -s workspace-write

1. Ask Codex to create a file in that directory

Result:

• Write fails with sandbox permission error
• Writing to /tmp succeeds

1. Add the same path to config:

[sandbox_workspace_write]
writable_roots = ["/home/ibis/AI/CodexSkill"]

1. Restart Codex and repeat

Result:

• Writing succeeds

What is the expected behavior?

--add-dir should behave equivalently to adding the path to writable_roots,
and allow write access to the specified directory.

What is the actual behavior?

--add-dir does not grant write access, even though:

• The directory is writable at OS level
• The same path works via writable_roots

Additional information

• The issue is not related to filesystem permissions (verified with test -w)
• The issue is not resolved by --enable use_legacy_landlock
• /tmp remains writable in the same session
• This appears to be a CLI-level issue where --add-dir is not properly propagated to sandbox configuration