Linux/VS Code: approved apply_patch fails through directory symlink to SSHFS; canonical path succeeds

What version of the IDE extension are you using?

26.901.22334

What subscription do you have?

Plus

Which IDE are you using?

VS Code

What platform is your computer?

Linux 7.1.10-100.fc43.x86_64 x86_64 unknown

What issue are you seeing?

Native apply_patch fails through a workspace directory symlink pointing to an external SSHFS mount, even after user approval. Addressing the same file by its resolved absolute path succeeds.

Both path forms displayed approval prompts, which I approved.

The errors as codex reported them:

Failed to write file /home/dev/project/.live/etc/nginx/snippets/.codex-write-probe.txt

Updating an existing probe through the symlink fails with:

Failed to read file to update /home/dev/project/.live/etc/nginx/snippets/.codex-write-probe.txt: Not a directory (os error 20)

What steps can reproduce the bug?

1. Mount a remote directory containing a writable snippets/ subdirectory outside the workspace. My mount layout:

   nginx-vm:/etc/nginx on /run/user/1000/code-sshfs/nginx-repro
   type fuse.sshfs
   (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)
   

2. Expose its subdirectory through a workspace symlink:

   mkdir -p /home/dev/project/.live/etc/nginx
   ln -s /run/user/1000/code-sshfs/nginx-repro/snippets \
     /home/dev/project/.live/etc/nginx/snippets
   

   Open /home/dev/project in VS Code. Use workspace-write, approval_policy = "on-request", and approvals_reviewer = "user". Do not add the SSHFS target to writable roots.

3. Ask Codex to submit this through its native apply_patch tool and approve it:

   *** Begin Patch
   *** Add File: /home/dev/project/.live/etc/nginx/snippets/.codex-write-probe.txt
   +# Codex SSHFS write probe: initial.
   *** End Patch
   

   Creation fails.

4. Retry the identical patch, replacing only the target with:

   /run/user/1000/code-sshfs/nginx-repro/snippets/.codex-write-probe.txt
   

   Approve it: creation succeeds.

5. Ask Codex to update the probe from initial. to updated.. Through the workspace symlink this fails with the second error above; through the canonical path it succeeds.

What is the expected behavior?

After explicit approval for the external target, the patch should succeed through either path, while remaining blocked without approval. Approved outside-workspace edits are part of the [documented approval workflow](https://learn.chatgpt.com/docs/agent-approvals-security).

Additional information

• Bundled CLI: 0.153.0; VS Code extension: openai.chatgpt-26.901.22334-linux-x64.
• Host: Linux x86_64, kernel 7.1.10-100.fc43.x86_64.
• Actual kernel SSHFS mount, not a VS Code virtual filesystem.
• Host mount is rw; ordinary sandbox sees it as ro, including after successful approved canonical-path patches.
• Canonical-path creation, updating, and deletion succeeded; probe removed.
• Possibly related to [#15981](https://github.com/openai/codex/pull/15981). No before/after test establishes [#39614](https://github.com/openai/codex/pull/39614) as the cause.

Start with the native apply_patch path handling and approval workflow, then reproduce the issue using the documented symlink and SSHFS mount setup. Done means an explicitly approved edit succeeds through the workspace symlink while an unapproved external edit remains blocked; verify both creation and update cases.