/codex: the filesystem boundary's bare `agents/` makes Codex skip a repository's own agents/ folder

Open Beginner friendly
  • Is something wrong?
#3,924 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@indraoverflow is already working on this.

Since Nov 5, 2026.

  • #3995 by @indraoverflow — closed without merging
  • #4037 by @indraoverflow — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
70/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
markdown
Domain
devtools

Research direction

Start in codex/SKILL.md, in the "Filesystem Boundary" section, where the prompt text lists the protected paths and includes the bare agents/ entry. Check how that boundary text is injected into each codex exec prompt. Done when the entry names only the exact install paths (~/.claude/skills/, ~/.agents/, .claude/skills/, agents/openai.yaml), or the text states that the reviewed repository's own folders are readable, and a test prompt with an agents/ change in the diff confirms it.

Written by the indexing model from the issue text.

Description

bug S3

What happens

The filesystem boundary that /codex puts in front of every codex exec prompt (codex/SKILL.md, "Filesystem Boundary") reads:

IMPORTANT: Do NOT read or execute any files under ~/.claude/, ~/.agents/, .claude/skills/, or agents/. ...

The first three entries are the skill install paths. The last one, agents/, is relative to the repository, so it also matches a repository's own agents/ folder when that folder is reviewed code (for example a repo that keeps agent prompt files in agents/ and tests them).

Seen on v1.91.162.0 (the text is unchanged in v1.91.350.0), Codex consult mode, reviewing a diff that changed agents/planner.md:

  • Codex left the changed agents/planner.md out of its review.
  • It wrapped the repo's documentation test suites in a read guard, and the suites that read agents/ were blocked (4 of 12 in one run; 3 of 3 that read it in a later run whose diff didn't touch agents/ at all).
  • Its verdict was "Can't verify".

It isn't consistent: an earlier run in the same session, with the same boundary, ran all 12 suites. The workaround is one extra sentence in the task text saying the repository's agents/ folder is reviewed code and may be read.

Expected

The boundary keeps Codex out of skill definitions without hiding repository content that happens to share the folder name.

Suggestion

Name the exact install paths the boundary protects (~/.claude/skills/, ~/.agents/, .claude/skills/, and the generated agents/openai.yaml it already names), not a bare agents/. Or add a sentence saying the reviewed repository's own folders are always readable. A test prompt for a repo with an agents/ folder in its diff would pin it.

Dominant language
TypeScript
Stars
139k
Forks
20.6k
Avg merge
10h 12m
Merged PRs (30d)
655

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from garrytan/gstack

All issues in garrytan/gstack

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.