Profile repo-only still allows reading outside the repo / injecting workspace-write

What version of the Codex App are you using (From “About Codex” dialog)?

v0.132.0

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Darwin 25.5.0 arm64

What issue are you seeing?

/status reports:

text Permissions: Profile repo-only (workspace with network access, on-request)

I expected this to restrict filesystem reads to the current repository unless explicit approval was granted.

However, during the session, Codex was still able to read outside the repo and list my home directory contents without requesting approval.

Current repo:

text ~/repos/codex/bridge

Example interaction:

text › What is in my home directory? • Your home directory contains: Applications Desktop Documents Downloads Library Movies Music Pictures repos ...

This appears inconsistent with the meaning of Profile repo-only.

What steps can reproduce the bug?

1. Start Codex in a repository.
2. Confirm /status shows:

text Permissions: Profile repo-only (workspace with network access, on-request)

1. Ask Codex to inspect or list files outside the repo, e.g.:

text ls ~
or:
text What is in my home directory?

1. Codex reads/list files outside the repository without requesting approval.

What is the expected behavior?

Under Profile repo-only, filesystem reads outside the current repository should either:

• be blocked, or
• require explicit approval before access

The current behavior makes the scope of “repo-only” unclear.

I searched the repo-local config and did not find any explicit workspace-write, sandbox_mode, or related overrides in:

• AGENTS.md
• .agents/
• .codex/config.toml
• top-level config.toml

So this behavior appears to come from the active Codex permission profile/runtime rather than repository configuration.

Additional information

_No response_