codex-rescue with --cwd <git worktree>: git write ops fail because the linked worktree's gitdir (hub .git/worktrees/<name>) is outside the sandbox writable roots

Summary

When the Claude Code Codex plugin (codex 1.0.6, codex:codex-rescue agent) is dispatched with a real --cwd <path> flag where <path> is a linked git worktree (git worktree add), file edits inside the worktree succeed but every git operation that writes metadata fails, because a linked worktree's .git is a file containing gitdir: <hub>/.git/worktrees/<name>, and that directory lies outside both the session cwd and the --cwd root that the workspace-write sandbox allows.

Repro

1. git clone <repo> hub && cd hub && git worktree add ../wt-feature -b feature
2. Start Claude Code in hub (or any other directory), dispatch codex:codex-rescue with a prompt beginning --model gpt-6-astra --fresh --cwd /abs/path/wt-feature and ask it to run git fetch origin main (or git commit, git merge, git checkout).

Observed:

error: cannot open '<hub>/.git/worktrees/wt-feature/FETCH_HEAD': Read-only file system

Codex's own explanation in its report: "The Codex sandbox only permits writes in and /tmp, with permission escalation disabled — so it could not write into the worktree's git metadata."

Expected

With --cwd pointing at a linked worktree, the sandbox should also grant write access to that worktree's gitdir (resolve <cwd>/.git when it is a file with a gitdir: line, and add that directory — or the hub .git — to the writable roots). Otherwise a worktree-based workflow (one worktree per branch/agent, which is the pattern Claude Code itself uses for isolation) cannot commit, merge, or fetch from Codex.

Related: sqlite state contention with several app-servers

With ~6 concurrent Claude Code sessions each holding an app-server-broker.mjs on the same ~/.codex (logs_2.sqlite at ~630 MB with a ~75 MB WAL, state_5.sqlite, queue_1.sqlite, all open by 5-6 pids), a dispatch failed before running anything with:

Codex app-server could not start: sqlite state runtime error under ~/.codex

A retry about two minutes later started fine, so it looks like transient lock contention rather than corruption; reporting it here because it happens on the same multi-session boxes where the worktree issue bites.

Environment: Linux x86_64, node 22.23.2, plugin codex 1.0.6 from the openai-codex marketplace, ChatGPT-subscription auth.

Start by tracing how the codex:codex-rescue dispatch handles --cwd and how the workspace-write sandbox builds its writable roots. Reproduce with a linked worktree, then verify that git fetch, commit, merge, and checkout can write the linked worktree's git metadata. Keep the separate sqlite contention report in scope only if the relevant entry point connects the two failures.