CLI sandbox: cannot commit because .git is read-only (“Unable to create .git/index.lock”)

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #6797
• #6688

Powered by Codex Action

This a model tuning issue that can be ameliorated with a prompt. Add this to your AGENTS.md:
If a command fails due to insufficient permissions, you must elevate the command to the user for approval.

This is emphatically not fixed.

Bro codex can’t even run bash commands 🤣 light years behind Claude.

This is how people are commenting on Codex about this problem on Reddit. It's _extremely_ damaging for the reputation of OpenAI!

Personally, I've just installed Codex, I've no idea what the problem is with 'sandboxing', I do not want any git commands 'escalated' to me- in fact, I'd rather never touch a git commit again, all other LLMs are _perfectly_ equipped to do this automatically, so why can't GPT? It's the kind of thing that will make me never use it again.

This is an urgent and awful bug.

Yeah this is a huge pain, anyone got a workaround?

Same issue, codex suggested and applied a workaround to use a tmp folder outside the workspace to push

I was able to workaround this by adding .git as an additional directory when spawning codex via the sdk/cli

@jacobsapps, @lemieapp,

As mentioned in a older related issue, you could use a "git-shadow-dir". It is a writable, self referencing git worktree.

https://github.com/openai/codex/issues/5034#issuecomment-3529984021

Sadly this is intended: https://github.com/openai/codex/blob/a1b8e34938a26b3910de2abdb2e984aa12624354/codex-rs/protocol/src/protocol.rs#L753-L774

The subpaths are read-only sub-directory exceptions even when a directory is writable under workspace-write. Right now it includes .git (also gitdir when using worktree), .codex and .agents.

The rationale does not make sense to me. When I use codex CLI/TUI, the git repo is mostly a local copy. I will use rules in remote repo to guard against dangerous operations (protected main, no force push, etc.).

The "workaround" for me is simply comment out these lines and rebuild from source. But I would suggest to add a knob in workspace_write option to bypass this. Or, add a black list option explicitly with the current list as a default. A hidden hardcoded list is never a good practice in the long run.

Adding a approval rule for git also works some time, but it works poorly under approval-policy = never in environments where interaction is not possible. I have to tell agent again and again to "run command with escalation, without shell wrapper or bash script", etc.

I ran into the same safety/autonomy tradeoff: I wanted to keep Codex in a safer workspace-write posture, but normal local Git operations need writes under .git, so the options become either repeated approvals/manual Git or relaxing the sandbox much more than I wanted.

I built a small local MCP server as a workaround: codex-safe-git.

Repo: https://github.com/K1-R1/codex-safe-git

It does not make .git broadly writable and it does not expose arbitrary shell/Git access. Instead it gives Codex a narrow, auditable Git tool surface for things like status, diff summaries, branch preparation, and exact-file commits. Remote operations are intentionally out of scope.

Install:

go install github.com/K1-R1/codex-safe-git/cmd/codex-safe-git-mcp@v0.4.3

This is not a replacement for a proper upstream fix/config option, but it may be useful for people who want Codex to stay sandboxed while still letting it handle local Git workflows more autonomously.

It's kinda odd that there isn't a way to specify in the config file that agents should have permission to commit without prompting the human. Committing is such a cornerstone of coding tasks. Just let me manually specify that .git is writable, please.

Also, allowing agents to run git outside the sandbox is such a bad idea. Actually running anything outside the sandbox is a bad idea. It gives much broader access than merely making .git writable.

@K1-R1 @dlight you can already do these things. See the rules docs.

@miraclebakelaser I want Codex to still run git sandboxed. I just don't want the sandbox to make .git read only. However this sandboxing rule appears to be hardcoded.

The problem with allowing commands to run outside the sandbox is that there isn't a way to say "give this command write to .git, and nothing more". Instead, the command will bypass the sandbox entirely. So for example, if the sandbox doesn't allow network access, when you add an exception for a command, it will allow network access for that command too.

Ideally I want zero exceptions on sandboxing, but instead tweak the sandbox to allow or disallow operations for all commands. Just like one can enable/disable networking for all commands inside the sandbox, marking .git writable should be possible, too.