Remote/SSH: Mac-sent turns add a visualization root and break Linux shell startup (bwrap missing .git)

Summary

Sending a message to an existing Linux conversation from the Mac app over Remote/SSH adds a visualization workspace root. Every shell command then fails during Bubblewrap setup. Sending the next message from the server-side terminal removes that extra root and restores shell execution, without changing files or permissions manually.

This is reproducible with either one client connected or both clients open. Chat still works when the shell is broken.

Environment

• Linux server: x86_64, kernel 7.0.0-31-generic; server PATH reports codex-cli 0.153.4 (the exact running app-server build has not been independently verified).
• Mac app logs report release 26.901.51231; connected through the built-in SSH connection flow.
• Remote bundled Visualize manifest: 1.0.29, bundledContentVariant=live-disabled, enabled in config.
• Controlled tests used managed/restricted filesystem permissions, workspace-write, approval policy never, and restricted network access.
• Workspace is the user's home directory; the actual repository is beneath it. The visualization directory exists, but its .git child does not. Paths below are sanitized.

Reproduction

1. From the server terminal, send a message asking Codex to run pwd and git -C /home/USER/repos/PROJECT status --short. Both succeed; the workspace root is /home/USER.
2. Open the same conversation in the Mac app through Remote/SSH and send the same request. The incoming workspace roots now also include /home/USER/.codex/visualizations/YYYY/MM/DD/THREAD_ID.
3. pwd fails before shell startup:

bwrap: Can't mkdir /home/USER/.codex/visualizations/YYYY/MM/DD/THREAD_ID/.git: Read-only file system

4. Retry pwd within that Mac-origin turn: same failure.
5. Send a new message from the server terminal: the visualization root disappears and both commands succeed again. Closing the Mac is not necessary for this recovery.

Controlled results

Tests on September 7, 2026; times are UTC:

Read-only server-log inspection confirmed that incoming roots and the effective sandbox policy changed with the sending client. In a separate control, opening the Mac conversation during an active server-origin turn logged a resume at 16:49:21; shell checks before and afterward both passed. Attachment alone did not reproduce the failure in that test.

No config edits, plugin disabling, cache cleanup, service restarts, or sandbox bypasses were performed between these test passes. Repository status stayed unchanged.

Expected behavior / investigation

Sending from another client should not make an otherwise working session unable to launch commands. Any visualization output root should coexist safely with the protected .codex ancestor and protected child paths.

The client-dependent root change is observed. An isolated Linux test reproduced the same error and passed after reordering the nested writable bind before its metadata masks. Test results and code references are in the comment below. The actual Codex-generated Bubblewrap arguments remain uncaptured. Mac logs also repeatedly report Visualize installation requested with reason=missing, followed by success, after reconnects; its connection to this failure is unproven.

Possible fix direction: defer a nested writable root's metadata masks until after its writable bind, while preserving the ancestor protections elsewhere. This ordering passed the isolated experiment; no Codex patch has been implemented or validated. The handling of client-added visualization output paths should also be reviewed. Preserve the protections without requiring users to create dummy .git entries or disable sandboxing. A regression test should switch sending clients, verify shell startup, and assert that protected paths remain protected.

Related reports

• #37318: closest shell failure, but its trigger is a non-writable, non-repository cwd. This report adds a client-injected visualization root and a repeatable sender-switch control; it may share the underlying sandbox bug.
• #37570: closely related Remote/SSH permission restoration. Here the controlled failure follows the extra workspace root while sandbox mode and approval policy stay unchanged.
• #30485: related mobile permission restoration; the controlled reproduction above is Mac-to-Linux, not a claim of an independently verified mobile reproduction.
• #36234: related Visualize variant/registration report. #35211 and #38736 concern renderer-path and icon-network problems, not this shell-startup failure.

If this belongs under an existing issue, please link or merge it there; the new evidence is the repeatable Mac-sender/server-sender root transition.

Start with the code that builds Bubblewrap arguments and handles client-added visualization output paths; compare the isolated Linux experiment's bind and metadata-mask ordering with the current behavior. Reproduce by switching between Mac and server senders, then verify shell startup succeeds while protected paths remain protected and a regression test covers the sender switch.