Merge pull request #2294 from dyoshikawa/resolve-scrap-issue-2279-codex-git-config-writable

fix: drop the Codex CLI .git/config read carve-out and keep only .git/** write

Author: dyoshikawa

docs/faq.md

@@ -42,7 +42,7 @@ Note: `.git/info/exclude` can't be shared with your team since it's not committe
 
 The `[permissions.rulesync]` profile that rulesync generates into `.codex/config.toml` extends Codex CLI's `:workspace` baseline. That baseline is deliberately conservative, so day-to-day development can still hit permission denials: `git push`/`git fetch` over SSH cannot reach the SSH agent socket, some build tools fail without a writable temp dir, and Codex may be blocked from reading its own `~/.codex` configuration.
 
-rulesync emits the `.git` write carve-outs for you (`".git/**" = "write"` with `".git/config" = "read"` under `:workspace_roots`; opt out with the `codexcli.git_write_rules: false` override). Everything below, however, depends on your environment or workflow, so rulesync does not add it by default. Where to put each piece differs, because the two tables are managed differently:
+rulesync emits the `.git` write carve-out for you (`".git/**" = "write"` under `:workspace_roots`; opt out with the `codexcli.git_write_rules: false` override). The whole subtree — including `.git/config` — is writable, because everyday commands such as `git remote add`, `git push -u`, and local-scope `git config` write to the repository config; users who want stricter isolation can add their own `read` override (e.g. `read: { ".git/config": "allow" }`) in the canonical permissions. Everything below, however, depends on your environment or workflow, so rulesync does not add it by default. Where to put each piece differs, because the two tables are managed differently:
 
 **Network settings: edit `.codex/config.toml` directly.** Network settings are out of rulesync's management scope by design, keeping you free to edit them. rulesync preserves user-authored network keys when it regenerates the file — `network.enabled` (as long as the profile carries no rulesync-managed allow domains) and unknown keys such as `dangerously_allow_all_unix_sockets` are carried forward verbatim, with a warning so they stay visible:
 
@@ -69,18 +69,27 @@ dangerously_allow_all_unix_sockets = true
   },
   "codexcli": {
     "permission": {
-      "write": { ":root": "allow", ":tmpdir": "allow", ":slash_tmp": "allow" },
+      "write": {
+        ".": "allow",
+        ".git/**": "allow",
+        ".agents/**": "allow",
+        ".codex/**": "allow",
+        ":root": "allow",
+        ":tmpdir": "allow",
+        ":slash_tmp": "allow",
+      },
       "read": { "~/.codex/**": "allow", "~/.codex/auth.json": "deny" },
     },
   },
 }
 ```
 
-This generates into the profile as `":root" = "write"`, `":tmpdir" = "write"`, `":slash_tmp" = "write"`, `"~/.codex/**" = "read"`, and `"~/.codex/auth.json" = "deny"`, and round-trips through `rulesync import`. Note that a tool-scoped category replaces the shared one wholesale for Codex CLI: if your shared `permission` block already has `read`/`write` rules that should also apply to Codex CLI, repeat them inside `codexcli.permission`.
+This generates into the profile as `"." = "write"`, `".git/**" = "write"`, `".agents/**" = "write"`, and `".codex/**" = "write"` under `:workspace_roots`, plus `":root" = "write"`, `":tmpdir" = "write"`, `":slash_tmp" = "write"`, `"~/.codex/**" = "read"`, and `"~/.codex/auth.json" = "deny"`, and round-trips through `rulesync import` — with one exception: `".git/**" = "write"` matches rulesync's default carve-out exactly, so import skips it (it is re-added on every generate). If you later opt out with `codexcli.git_write_rules: false` after an import, re-author the `".git/**": "allow"` write rule in the canonical config. Note that a tool-scoped category replaces the shared one wholesale for Codex CLI: if your shared `permission` block already has `read`/`write` rules that should also apply to Codex CLI, repeat them inside `codexcli.permission`.
 
 What each entry does:
 
 - **Unix socket access**: `git push`/`git fetch` over SSH needs the agent socket. `dangerously_allow_all_unix_sockets = true` is the simple, environment-independent option; a per-socket `unix_sockets` allow entry with the resolved `$SSH_AUTH_SOCK` path is the stricter one.
+- **`.` / `.git/**` / `.agents/**` / `.codex/**` write**: the practical write set for the workspace itself. `"."` spells out the workspace-subtree write access the `:workspace` baseline already grants (a tool-scoped category replaces the shared block wholesale, so keeping it explicit avoids surprises), and `".git/**"` matches the carve-out rulesync emits by default anyway. `.agents/**` and `.codex/**` genuinely add access: Codex's `:workspace` baseline keeps `.git`, `.agents`, and `.codex` read-only inside workspace roots, so without these rules a Codex session cannot update agent files or its own project-level config — for example, running `rulesync generate` inside a session would be denied when writing `.agents/` or `.codex/` outputs. Trade-off: the baseline keeps those two directories read-only precisely so a sandboxed session cannot rewrite its own configuration — with `.codex/**` writable, a compromised or prompt-injected session could relax `.codex/config.toml` (approval policy, permission profiles, MCP servers) for its next run, and with `.agents/**` writable it could persist injected instructions into rule/skill files. Drop these two entries if your workflow does not need in-session writes there.
 - **`:root` write**: package runners such as `npx {package}` unpack into the npm cache under the home directory (`~/.npm/_npx`), and many dev tools write to home-directory caches (`~/.cache`, `~/.local`, corepack/pnpm stores); the `:workspace` baseline denies these writes, which breaks the commands outright. Trade-off: `":root" = "write"` effectively opens filesystem writes system-wide — if you want tighter scoping, grant narrower home-directory patterns instead (e.g. `"~/.npm/**"`, `"~/.cache/**"`) at the cost of chasing each tool's cache path.
 - **`:tmpdir` / `:slash_tmp` write**: many build tools require a writable temp directory (`$TMPDIR` and `/tmp` respectively).
 - **`~/.codex/**` read with `auth.json` deny**: Codex can read its own configuration tree while your credentials stay protected. Tilde paths are expanded by Codex itself, so no manual `$HOME` resolution is needed.

docs/reference/file-formats.md

@@ -42,7 +42,7 @@ Note: `.git/info/exclude` can't be shared with your team since it's not committe
 
 The `[permissions.rulesync]` profile that rulesync generates into `.codex/config.toml` extends Codex CLI's `:workspace` baseline. That baseline is deliberately conservative, so day-to-day development can still hit permission denials: `git push`/`git fetch` over SSH cannot reach the SSH agent socket, some build tools fail without a writable temp dir, and Codex may be blocked from reading its own `~/.codex` configuration.
 
-rulesync emits the `.git` write carve-outs for you (`".git/**" = "write"` with `".git/config" = "read"` under `:workspace_roots`; opt out with the `codexcli.git_write_rules: false` override). Everything below, however, depends on your environment or workflow, so rulesync does not add it by default. Where to put each piece differs, because the two tables are managed differently:
+rulesync emits the `.git` write carve-out for you (`".git/**" = "write"` under `:workspace_roots`; opt out with the `codexcli.git_write_rules: false` override). The whole subtree — including `.git/config` — is writable, because everyday commands such as `git remote add`, `git push -u`, and local-scope `git config` write to the repository config; users who want stricter isolation can add their own `read` override (e.g. `read: { ".git/config": "allow" }`) in the canonical permissions. Everything below, however, depends on your environment or workflow, so rulesync does not add it by default. Where to put each piece differs, because the two tables are managed differently:
 
 **Network settings: edit `.codex/config.toml` directly.** Network settings are out of rulesync's management scope by design, keeping you free to edit them. rulesync preserves user-authored network keys when it regenerates the file — `network.enabled` (as long as the profile carries no rulesync-managed allow domains) and unknown keys such as `dangerously_allow_all_unix_sockets` are carried forward verbatim, with a warning so they stay visible:
 
@@ -69,18 +69,27 @@ dangerously_allow_all_unix_sockets = true
   },
   "codexcli": {
     "permission": {
-      "write": { ":root": "allow", ":tmpdir": "allow", ":slash_tmp": "allow" },
+      "write": {
+        ".": "allow",
+        ".git/**": "allow",
+        ".agents/**": "allow",
+        ".codex/**": "allow",
+        ":root": "allow",
+        ":tmpdir": "allow",
+        ":slash_tmp": "allow",
+      },
       "read": { "~/.codex/**": "allow", "~/.codex/auth.json": "deny" },
     },
   },
 }
 ```
 
-This generates into the profile as `":root" = "write"`, `":tmpdir" = "write"`, `":slash_tmp" = "write"`, `"~/.codex/**" = "read"`, and `"~/.codex/auth.json" = "deny"`, and round-trips through `rulesync import`. Note that a tool-scoped category replaces the shared one wholesale for Codex CLI: if your shared `permission` block already has `read`/`write` rules that should also apply to Codex CLI, repeat them inside `codexcli.permission`.
+This generates into the profile as `"." = "write"`, `".git/**" = "write"`, `".agents/**" = "write"`, and `".codex/**" = "write"` under `:workspace_roots`, plus `":root" = "write"`, `":tmpdir" = "write"`, `":slash_tmp" = "write"`, `"~/.codex/**" = "read"`, and `"~/.codex/auth.json" = "deny"`, and round-trips through `rulesync import` — with one exception: `".git/**" = "write"` matches rulesync's default carve-out exactly, so import skips it (it is re-added on every generate). If you later opt out with `codexcli.git_write_rules: false` after an import, re-author the `".git/**": "allow"` write rule in the canonical config. Note that a tool-scoped category replaces the shared one wholesale for Codex CLI: if your shared `permission` block already has `read`/`write` rules that should also apply to Codex CLI, repeat them inside `codexcli.permission`.
 
 What each entry does:
 
 - **Unix socket access**: `git push`/`git fetch` over SSH needs the agent socket. `dangerously_allow_all_unix_sockets = true` is the simple, environment-independent option; a per-socket `unix_sockets` allow entry with the resolved `$SSH_AUTH_SOCK` path is the stricter one.
+- **`.` / `.git/**` / `.agents/**` / `.codex/**` write**: the practical write set for the workspace itself. `"."` spells out the workspace-subtree write access the `:workspace` baseline already grants (a tool-scoped category replaces the shared block wholesale, so keeping it explicit avoids surprises), and `".git/**"` matches the carve-out rulesync emits by default anyway. `.agents/**` and `.codex/**` genuinely add access: Codex's `:workspace` baseline keeps `.git`, `.agents`, and `.codex` read-only inside workspace roots, so without these rules a Codex session cannot update agent files or its own project-level config — for example, running `rulesync generate` inside a session would be denied when writing `.agents/` or `.codex/` outputs. Trade-off: the baseline keeps those two directories read-only precisely so a sandboxed session cannot rewrite its own configuration — with `.codex/**` writable, a compromised or prompt-injected session could relax `.codex/config.toml` (approval policy, permission profiles, MCP servers) for its next run, and with `.agents/**` writable it could persist injected instructions into rule/skill files. Drop these two entries if your workflow does not need in-session writes there.
 - **`:root` write**: package runners such as `npx {package}` unpack into the npm cache under the home directory (`~/.npm/_npx`), and many dev tools write to home-directory caches (`~/.cache`, `~/.local`, corepack/pnpm stores); the `:workspace` baseline denies these writes, which breaks the commands outright. Trade-off: `":root" = "write"` effectively opens filesystem writes system-wide — if you want tighter scoping, grant narrower home-directory patterns instead (e.g. `"~/.npm/**"`, `"~/.cache/**"`) at the cost of chasing each tool's cache path.
 - **`:tmpdir` / `:slash_tmp` write**: many build tools require a writable temp directory (`$TMPDIR` and `/tmp` respectively).
 - **`~/.codex/**` read with `auth.json` deny**: Codex can read its own configuration tree while your credentials stay protected. Tilde paths are expanded by Codex itself, so no manual `$HOME` resolution is needed.