codex - 💡(How to fix) Fix Allow project-level skills to be edited in workspace-write without approval

What version of Codex CLI is running?

codex-cli 0.130.0

What subscription do you have?

pro lite

Which model were you using?

No response

What platform is your computer?

Darwin 25.4.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

No response

Codex doctor report

What issue are you seeing?

Related: https://github.com/openai/codex/issues/17535

I understand the security concern: an agent updating its own instructions should not be allowed silently by default.

But the current behavior seems inconsistent between global and project skills.

If skills live in ~/.codex/skills, I can add ~/.codex to writable roots and Codex can edit global skills without danger-full-access.

If skills live in <project>/.codex/skills, I cannot make that path writable the same way. Even explicitly adding <project>/.codex as a writable root still fails because .codex is protected under the project root.

So explicit writable-root config is enough consent for global skills, but not enough consent for project skills. That is the part I do not understand.

I tried the writable roots method:

[sandbox_workspace_write]
writable_roots = [
  "<absolute path to the project>/.codex",
]

Equivalent test with --add-dir <project>/.codex still failed:

touch: .codex/add-dir-write-test.tmp: Operation not permitted

I also tried the newer permissions profile form:

default_permissions = "workspace_agent_edit"

[permissions.workspace_agent_edit.filesystem]
":project_roots" = {
  "." = "write",
  ".codex" = "write",
  ".codex/**" = "write"
}
"/absolute/path/to/project/.codex" = "write"

A fresh Codex debug prompt showed .codex in writable roots, but actual writes still failed with Operation not permitted.

I am not asking for project skill edits to be allowed by default. I want explicit, narrow config like this to work without using danger-full-access:

[permissions.workspace_agent_edit.filesystem]
":project_roots" = {
  "." = "write",
  ".codex/skills/**" = "write",
  ".git/**" = "read"
}

What steps can reproduce the bug?

explained above

What is the expected behavior?

No response

Additional information

No response