Allow project-level skills to be edited in workspace-write without approval

What version of Codex CLI is running?

codex-cli 0.130.0

What subscription do you have?

pro lite

Which model were you using?

_No response_

What platform is your computer?

Darwin 25.4.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

_No response_

Codex doctor report

What issue are you seeing?

Related: https://github.com/openai/codex/issues/17535

I understand the security concern: an agent updating its own instructions should not be allowed silently by default.

But the current behavior seems inconsistent between global and project skills.

If skills live in ~/.codex/skills, I can add ~/.codex to writable roots and Codex can edit global skills without danger-full-access.

If skills live in <project>/.codex/skills, I cannot make that path writable the same way. Even explicitly adding <project>/.codex as a writable root still fails because .codex is protected under the project root.

So explicit writable-root config is enough consent for global skills, but not enough consent for project skills. That is the part I do not understand.

I tried the writable roots method:

[sandbox_workspace_write]
writable_roots = [
  "<absolute path to the project>/.codex",
]

Equivalent test with --add-dir <project>/.codex still failed:

touch: .codex/add-dir-write-test.tmp: Operation not permitted

I also tried the newer permissions profile form:

default_permissions = "workspace_agent_edit"

[permissions.workspace_agent_edit.filesystem]
":project_roots" = {
  "." = "write",
  ".codex" = "write",
  ".codex/**" = "write"
}
"/absolute/path/to/project/.codex" = "write"

A fresh Codex debug prompt showed .codex in writable roots, but actual writes still failed with Operation not permitted.

I am not asking for project skill edits to be allowed by default. I want explicit, narrow config like this to work without using danger-full-access:

[permissions.workspace_agent_edit.filesystem]
":project_roots" = {
  "." = "write",
  ".codex/skills/**" = "write",
  ".git/**" = "read"
}

What steps can reproduce the bug?

explained above

What is the expected behavior?

_No response_

Additional information

_No response_