Agent used git clean on nested ignored paths and deleted the entire ignored parent directory

Environment

• Codex CLI 0.152.1
• Windows
• Repository contained an ignored config/ directory with local secrets and operational files

What happened

The user requested removal of several specific unused skill directories after backing them up. The agent created a partial backup of the selected skills and prompts, then ran a command equivalent to:

git clean -fdX -- config/<nested-paths>

The intended scope was only the named nested directories. Because the parent directory was ignored, Git removed the entire config/ directory. This deleted API key files and operational scripts that were not included in the partial backup.

The command was executed without a prior destructive-operation warning, without an explicit confirmation of the resolved deletion scope, and without first running and reviewing git clean -ndX. The loss was only disclosed after execution.

No secrets or repository contents are attached to this report.

Expected behavior

Before running git clean or an equivalent recursive destructive command, Codex should:

1. Resolve and display the actual deletion scope.
2. Run a dry-run and verify that every candidate remains within the explicitly requested paths.
3. Stop if an ignored parent directory would be removed instead of only the requested children.
4. Require explicit confirmation when untracked or ignored files may be permanently deleted.
5. Prefer literal, individually validated paths for targeted removal.
6. Verify that the backup covers every file in the effective deletion scope.

Impact

The entire local configuration directory was deleted. The user recovered the API keys only because they had independently created a separate backup.

Start by tracing the Codex CLI path that constructs and executes git clean or equivalent recursive deletion commands. Reproduce the nested ignored-parent case with git clean -ndX, then verify that the effective scope is displayed, backups are checked, destructive confirmation is required, and unsafe parent-directory deletion is blocked.