From 5ce02a8a742aee4880a9d65e6471895b54549eab Mon Sep 17 00:00:00 2001
From: viyatb-oai <viyatb@openai.com>
Date: Mon, 1 Jun 2026 12:29:23 -0700
Subject: [PATCH] fix(permissions): export linked gitdirs for allow_git

Co-authored-by: Codex noreply@openai.com
---
 codex-rs/protocol/src/protocol.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/codex-rs/protocol/src/protocol.rs b/codex-rs/protocol/src/protocol.rs
index 50f5b4ad8d..1c457fb6ce 100644
--- a/codex-rs/protocol/src/protocol.rs
+++ b/codex-rs/protocol/src/protocol.rs
@@ -1129,6 +1129,7 @@ impl SandboxPolicy {
 
                 // For each root, compute subpaths that should remain read-only.
                 let cwd_root = AbsolutePathBuf::from_absolute_path(cwd).ok();
+                let raw_roots = roots.clone();
                 let mut roots = roots
                     .into_iter()
                     .map(|writable_root| {
@@ -1147,7 +1148,7 @@ impl SandboxPolicy {
                     })
                     .collect::<Vec<_>>();
                 if *allow_limited_git_writes {
-                    add_limited_git_writable_roots(&mut roots);
+                    add_limited_git_writable_roots(&mut roots, &raw_roots);
                 }
                 roots
             }