Codex App copied an entire external project into another repo and then hid it via .gitignore

What version of the Codex App are you using (From “About Codex” dialog)?

26.707.72221 (build 5307)

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

During a long-running multi-repository Unity/SDK task, Codex created a full physical copy of one Unity project inside another project.

The intended projects were separate:

• <home>/yovo/project-a
• <home>/yovo/project-b

Instead, Codex created:
<home>/yovo/project-b/Users/<user>/yovo/project-a

The nested directory was about 10 GB and contained the complete source project, including .git, Library, Temp, build outputs, and other generated files. It was a real directory, not a symlink.

A later Codex audit noticed the unexpected Users/ directory but added /Users/ to project-b's .gitignore instead of investigating or warning the user. This hid the accidental copy from git status.

This is a high-risk filesystem safety issue: it silently consumed substantial disk space, duplicated a Git repository inside another repository, and could cause Unity to index or build the wrong project.

What steps can reproduce the bug?

1. Open Codex App with a workspace that contains an SDK repository.
2. Ask Codex to update the SDK and propagate selected SDK files into two external Unity game projects referenced by absolute paths.
3. Continue with several sync/build/audit tasks across those repositories.
4. Inspect the second game project.
5. Observe that the full absolute source hierarchy for the first game was recreated below the second project as project-b/Users/<user>/.../project-a.
6. Run git status --ignored: a later agent change may have added /Users/ to .gitignore, hiding the copy.

I could not recover the exact copy command from the available task logs, so I am not claiming a specific implementation such as rsync -R or cp --parents. However, filesystem timestamps confirmed the nested project was created during the Codex work, and its path shape is consistent with an absolute parent hierarchy being preserved under a relative destination.

Task/session id: 019e5dc3-b0ee-7b11-b1c3-bb69290cec27

What is the expected behavior?

Codex should copy only the explicitly requested SDK files and preserve each project's existing game-specific configuration.

Before any recursive copy or sync, Codex should resolve and validate source and destination paths and refuse operations that would:

• place one repository inside another unrelated repository;
• recreate an absolute parent hierarchy under the current working directory;
• copy a full project when only an SDK subtree was requested.

If an unexpected root-level directory such as Users/ appears, Codex should report and investigate it. It must not silently add the directory to .gitignore.

Additional information

Verification performed after discovery:

• no project file, generated configuration, symlink, or running process referenced the nested copy;
• the nested copy was a physical directory and occupied approximately 10 GB;
• the correct source project remained at its original path;
• the nested copy was deleted manually;
• the erroneous /Users/ ignore rule was removed.

User-specific names and private repository contents are redacted from this report.