workspace-write cannot write inside repo subdirectory agents/

What version of Codex CLI is running?

0.128.0

What subscription do you have?

Pro

Which model were you using?

gpt-5.5 high

What platform is your computer?

Darwin 23.5.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

iTerm2

What issue are you seeing?

Codex CLI 0.128.0
macOS
Started with:
codex -s workspace-write --add-dir /path/to/repo/agents -C /path/to/repo

Expected:
workspace-write can write inside repo subdirectory agents/, especially with --add-dir.

What steps can reproduce the bug?

Actual:
writing to repo root succeeds
writing to agents/.codex-sandbox-write-test fails:
zsh: operation not permitted: agents/.codex-sandbox-write-test

What is the expected behavior?

Expected:
workspace-write can write inside repo subdirectory agents/, especially with --add-dir.

Additional information

Notes:
agents/ is a normal directory, not a symlink.
.agents is a symlink to agents, but the failing path is agents/ itself.