›_ Codex Issues
Codex Issues / #18448

--add-dir does not grant write access on Ubuntu (workspace-write); writable_roots works

Open 💬 3 comments Opened Apr 18, 2026 by ssaattww
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of Codex CLI is running?

codex-cli 0.117.0 and codex-cli 0.121.0

What subscription do you have?

Plus

Which model were you using?

gpt-5.4-mini (low)

What platform is your computer?

Linux 6.8.0-107-generic x86_64 x86_64

What terminal emulator and version are you using (if applicable)?

VSCode

What issue are you seeing?

--add-dir does not grant write access to the specified directory when using -s workspace-write.

Even though the directory is writable at the OS level, Codex cannot write to it.
However, configuring the same path via writable_roots in config.toml works as expected.

This suggests that --add-dir is not correctly applied to sandbox writable roots.

What steps can reproduce the bug?

  1. Ensure the directory is writable:

ls -ld /home/ibis/AI/CodexSkill
test -w /home/ibis/AI/CodexSkill && echo WRITABLE

  1. Start Codex with:

codex --add-dir /home/ibis/AI/CodexSkill -s workspace-write

  1. Ask Codex to create a file in that directory

Result:

  • Write fails with sandbox permission error
  • Writing to /tmp succeeds
  1. Add the same path to config:

[sandbox_workspace_write]
writable_roots = ["/home/ibis/AI/CodexSkill"]

  1. Restart Codex and repeat

Result:

  • Writing succeeds

What is the expected behavior?

--add-dir should behave equivalently to adding the path to writable_roots,
and allow write access to the specified directory.

What is the actual behavior?

--add-dir does not grant write access, even though:

  • The directory is writable at OS level
  • The same path works via writable_roots

Additional information

  • The issue is not related to filesystem permissions (verified with test -w)
  • The issue is not resolved by --enable use_legacy_landlock
  • /tmp remains writable in the same session
  • This appears to be a CLI-level issue where --add-dir is not properly propagated to sandbox configuration

View original on GitHub ↗

3 Comments

github-actions[bot] contributor · 4 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #18204

Powered by Codex Action

etraut-openai contributor · 4 months ago

I'm not able to repro. See https://github.com/openai/codex/pull/18459.

joe-blueghost · 3 months ago
I'm not able to repro. See #18459.

I found this issue while having the same problem on MacOS (Darwin, arm64) using the TypeScript SDK (@openai/codex-sdk@0.130.0).

Scenario: We run Codex inside git worktrees. The working directory is a worktree at e.g. /Users/joe/.cate/worktrees/project/agent-abc, whose .git file points to the main repo's git dir at /Users/joe/dev/scratch/project/.git/worktrees/agent-abc. Git needs write access to the main .git directory (specifically to create index.lock under .git/worktrees/<name>/) in order to commit.

What we tried:

const threadOptions: ThreadOptions = {
  sandboxMode: 'workspace-write',
  workingDirectory: '/Users/joe/.cate/worktrees/project/agent-abc',
  additionalDirectories: ['/Users/joe/dev/scratch/project/.git'],
  // ...
};
const thread = codex.startThread(threadOptions);

The SDK correctly translates additionalDirectories into --add-dir flags. We confirmed the CLI receives:

codex exec --sandbox workspace-write --cd /Users/joe/.cate/worktrees/project/agent-abc --add-dir /Users/joe/dev/scratch/project/.git

Result: git commit fails inside the sandbox:

fatal: Unable to create '/Users/joe/dev/scratch/project/.git/worktrees/agent-abc/index.lock': Operation not permitted

Switching sandboxMode to danger-full-access makes the same commit succeed, confirming --add-dir isn't actually granting write access.

What works (workaround):

Passing the same directory via config → sandbox_workspace_write.writable_roots instead:

const codexOpts: CodexOptions = {
  codexPathOverride: codexPath,
  config: {
    sandbox_workspace_write: {
      writable_roots: ['/Users/joe/dev/scratch/project/.git'],
    },
  },
};
const codex = new Codex(codexOpts);

const threadOptions: ThreadOptions = {
  sandboxMode: 'workspace-write',
  workingDirectory: '/Users/joe/.cate/worktrees/project/agent-abc',
  // no additionalDirectories
};
const thread = codex.startThread(threadOptions);

This serializes to --config sandbox_workspace_write.writable_roots=["/Users/joe/dev/scratch/project/.git"] and git commit succeeds inside the sandbox.