CLI sandbox remounts Git worktree gitdir read-only despite explicit .git write permission #27418

What version of Codex CLI is running?

0.139.0

What subscription do you have?

Plus

Which model were you using?

gpt-5.5

What platform is your computer?

Linux 6.8.0-124-generic x86_64 unknown

What terminal emulator and version are you using (if applicable)?

Windows Terminal to connect to Linux host

Codex doctor report

What issue are you seeing?

When running Codex in a Git worktree, the Linux sandbox remounts the resolved worktree gitdir read-only even when the Codex permission profile explicitly grants write access to the repository .git directory.
This prevents normal Git operations such as git add and git commit.

What steps can reproduce the bug?

Repository layout:

• project root: /home/lcerman/foo
• worktree (and codex worspace/cwd): /home/lcerman/foo/lc_dev
• /home/lcerman/foo/lc_dev/.git file points to: /home/lcerman/foo/.git/worktrees/lc_dev
• common git dir for all worktrees: /home/lcerman/foo/.git

Permission config includes:

[permissions.read-all-write-workspace-full-net.filesystem]
":root" = "read"
"/home/lcerman/foo/.git" = "write"

[permissions.read-all-write-workspace-full-net.filesystem.":workspace_roots"]
"." = "write"

Run inside Codex:

git add changed-files

Actual result

fatal: Unable to create /home/lcerman/foo/.git/worktrees/lc_dev/index.lock: Read-only file system

findmnt -R /home/lcerman/foo/.git executed from sandboxed codex session shows:

/home/lcerman/foo/.git                    rw
/home/lcerman/foo/.git/worktrees/lc_dev   ro
`

### What is the expected behavior?

If an explicit write permission is granted for /home/lcerman/reqview_ai/.git, Codex should allow writes to the resolved worktree gitdir below it (including subdirectories), or provide a documented way to permit Git metadata writes for
staging/committing.

### Notes

This appears related to the protected metadata policy in:

- `codex-rs/linux-sandbox/src/bwrap.rs`
- `codex-rs/protocol/src/permissions.rs`

The source appears to detect .git pointer files, resolve gitdir: ..., and **add the resolved gitdir as a protected read-only subpath**. That is reasonable as a default, but it seems to override explicit user write permission for .git.

This basically prevents codex from being able to use git (it cannot commit the work done).

The explicit `"/home/lcerman/foo/.git" = "write"` shall prevent the read-only protection enforced on .git dirs.


### Additional information

_No response_