codex-rescue with --cwd <git worktree>: git write ops fail because the linked worktree's gitdir (hub .git/worktrees/<name>) is outside the sandbox writable roots

Summary

When the Claude Code Codex plugin (codex 1.0.6, codex:codex-rescue agent) is dispatched with a real --cwd <path> flag where <path> is a linked git worktree (git worktree add), file edits inside the worktree succeed but every git operation that writes metadata fails, because a linked worktree's .git is a file containing gitdir: <hub>/.git/worktrees/<name>, and that directory lies outside both the session cwd and the --cwd root that the workspace-write sandbox allows.

Repro

1. git clone <repo> hub && cd hub && git worktree add ../wt-feature -b feature
2. Start Claude Code in hub (or any other directory), dispatch codex:codex-rescue with a prompt beginning --model gpt-6-astra --fresh --cwd /abs/path/wt-feature and ask it to run git fetch origin main (or git commit, git merge, git checkout).

Observed:

error: cannot open '<hub>/.git/worktrees/wt-feature/FETCH_HEAD': Read-only file system

Codex's own explanation in its report: "The Codex sandbox only permits writes in and /tmp, with permission escalation disabled — so it could not write into the worktree's git metadata."

Expected

With --cwd pointing at a linked worktree, the sandbox should also grant write access to that worktree's gitdir (resolve <cwd>/.git when it is a file with a gitdir: line, and add that directory — or the hub .git — to the writable roots). Otherwise a worktree-based workflow (one worktree per branch/agent, which is the pattern Claude Code itself uses for isolation) cannot commit, merge, or fetch from Codex.

Related: sqlite state contention with several app-servers

With ~6 concurrent Claude Code sessions each holding an app-server-broker.mjs on the same ~/.codex (logs_2.sqlite at ~630 MB with a ~75 MB WAL, state_5.sqlite, queue_1.sqlite, all open by 5-6 pids), a dispatch failed before running anything with:

Codex app-server could not start: sqlite state runtime error under ~/.codex

A retry about two minutes later started fine, so it looks like transient lock contention rather than corruption; reporting it here because it happens on the same multi-session boxes where the worktree issue bites.

Environment: Linux x86_64, node 22.23.2, plugin codex 1.0.6 from the openai-codex marketplace, ChatGPT-subscription auth.