Codex blocks writes to a .git directory that resolves into another writable root

GitHub·medium signalXBlueskyLinkedInCopy link

Codex PR #47974, merged 2026-09-25, fixes a sandbox gap: a .git pointer or symlink could resolve to a Git directory inside a different writable root, where broader Seatbelt grants or later bubblewrap mounts left the metadata writable. Codex now resolves Git directories, including symlink aliases and linked worktrees under the macOS temp dir, and adds them to read-only exclusions on Linux and macOS. Regression tests check that metadata writes are denied while ordinary files stay writable. Agents with multiple writable roots could previously rewrite hooks or config in a sibling repo's .git.