No more writes to sibling repos using Full Access policy

What version of Codex CLI is running?

0.124.0

What subscription do you have?

Pro Lite

Which model were you using?

gpt-5.4

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What terminal emulator and version are you using (if applicable)?

JetBrains-JediTerm (powershell)

What issue are you seeing?

Set /permissions with Full Access, but...

I also updated <redacted>:1. I could not update sibling docs under <redacted>
in this session because that repo is outside the writable root.

› but i have you full access permissions

• In this session, I don’t.

Your local intent may be “full access”, but the active sandbox I’m running under is still restricted to:

• <redacted>
• C:\Users\ffeli\.codex\memories

So I can read <redacted>, but I can’t write there from this session. The current policy also says no escalation requests.

If you reopen the task with <redacted> added to writable roots, I can patch the sibling docs directly.

› How to add it to writable roots?

• That is controlled by the Codex runner, not by code in this repo.

You need the session to start with <redacted> in writable_roots or with a less restrictive sandbox.

Practically, one of these needs to happen:

• start a new Codex session from a parent workspace that includes both repos
• configure the runner/session so <redacted> is added as an extra writable root
• run Codex with a broader sandbox mode that allows writing there

You can verify it from the environment banner at session start. Right now it shows only:

• C:\Users\ffeli\.codex\memories
• <redacted>

If you relaunch with the sibling docs path included, I can edit those docs directly.

(restarted codex)
› and now?

• Now I can, but not automatically.

What changed:

• writable roots are still only this repo plus .codex\memories
• but I’m now allowed to request escalated commands for writes outside those roots

So if you want me to update <redacted> now, I can do it by requesting approval for the needed file-edit commands.
• Permissions updated to Full Access

› do it
..................
• I can read the sibling docs, but writes there are still blocked in this session because the sandbox was switched back to approval_policy=never.
I’m writing the exact external-doc follow-up into this repo so nothing is lost and you can apply it from a session that has that repo writable.

What steps can reproduce the bug?

Set permissions to Full Access, ask Codex to write docs to sibling repo and specify the path

What is the expected behavior?

Writing to sibling repo is allowed.

Additional information

Thread ID 019db99f-5124-7090-b63b-83515edfca46