Remote ChatGPT desktop tasks ignore writable_roots for new tasks

What version of the Codex App are you using (From “About Codex” dialog)?

26.819.11345

What subscription do you have?

enterprise

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

Title: Remote ChatGPT desktop tasks ignore writable_roots for new tasks

Environment

• ChatGPT/Codex desktop app on macOS connecting by SSH to a Linux host
• Remote server: Codex app-server / code-mode host
• Codex release: 0.147.0
• A network filesystem mount is rw for the authenticated user over SSH

Config on the remote host (~/.codex/config.toml)

sandbox_mode = "workspace-write"

[sandbox_workspace_write]
writable_roots = [
"/path/to/runtime/database-directory",
]

Expected
Every newly created remote Codex task should receive rw access to the configured
additional writable root.

Actual
New ChatGPT desktop tasks run Bubblewrap with:
--ro-bind / /
--bind /path/to/runtime/database-directory
/path/to/runtime/database-directory

but inside those new tasks:
test -w /path/to/runtime/database-directory # false
test -w /path/to/runtime/database-file.sqlite3 # false
findmnt -T /path/to/runtime/database-directory # ro

The directory and database file are owned by the authenticated user and have
normal owner-write permissions. The same paths are writable over a normal SSH
session.

Restarting the remote app-server can make existing sessions see the directory
as rw, but newly created ChatGPT desktop tasks still receive it as ro.

What steps can reproduce the bug?

Expected
Every newly created remote Codex task should receive rw access to the configured
additional writable root.

Actual
New ChatGPT desktop tasks run Bubblewrap with:
--ro-bind / /
--bind /path/to/runtime/database-directory
/path/to/runtime/database-directory

but inside those new tasks:
test -w /path/to/runtime/database-directory # false
test -w /path/to/runtime/database-file.sqlite3 # false
findmnt -T /path/to/runtime/database-directory # ro

The directory and database file are owned by the authenticated user and have
normal owner-write permissions. The same paths are writable over a normal SSH
session.

Restarting the remote app-server can make existing sessions see the directory
as rw, but newly created ChatGPT desktop tasks still receive it as ro.

What is the expected behavior?

Expected
Every newly created remote Codex task should receive rw access to the configured
additional writable root.

Additional information

_No response_