Codex agent commits unrelated files using git add -A despite explicit “commit only working changes” policy

[Igorbunow]

What version of Codex is running?

codex-cli 0.77.0

What subscription do you have?

ChatGPT Plus

Which model were you using?

gpt-5.1-codex-mini (reasoning medium, summaries auto)

What platform is your computer?

Linux 6.12.48+deb13-amd64 x86_64 unknown

What issue are you seeing?

The Codex agent commits unrelated and unreviewed files by running git add -A, even when the repository explicitly defines a strict commit policy (“commit only working changes”) and the agent previously acknowledged that unrelated changes were present.

A generic user confirmation (“Let’s commit the changes”) is incorrectly interpreted as permission to stage and commit the entire working tree, resulting in unsafe and policy-violating commits.

What steps can reproduce the bug?

1. Prepare a Git repository with:

   • multiple unrelated modified and/or untracked files;
   • an AGENTS.md file that explicitly states “commit only working changes”.

2. Ask the agent to perform a refactoring task affecting only a subset of files.

3. The agent detects unrelated changes and states it cannot safely commit without guidance.

4. User replies with a generic confirmation, e.g. “Let’s commit the changes”.

5. The agent executes:

   • git add -A
   • git commit …

6. The resulting commit includes unrelated files from the working tree.

What is the expected behavior?

What is the expected behavior?

When unrelated or untracked files are present, the agent should:

• never use git add -A by default;
• treat generic confirmations as insufficient authorization;
• request an explicit file list or use constrained staging (explicit paths, whitelist, or git add -p);
• consistently enforce repository-defined commit policies, regardless of user confirmation phrasing.

Additional information

• The agent correctly stated the policy and risks during planning but failed to enforce them at execution time.
• This appears to be a guardrail or execution-layer issue rather than a misunderstanding of repository rules.
• From the user’s perspective, this behavior is unsafe and breaks trust in agent-driven Git operations, especially in professional workflows.

Commit AGENTS.md rules part:

Commit policy (mandatory)

• Commit only working changes. Do NOT commit WIP, broken builds, partially-applied patches, or “temporary” hacks.
• Each commit must leave the tree in a buildable state. If tests are expected for the change, they must pass before committing.
• Any debug/diagnostic logging added to library code must remain fully disable-able via conditional compilation
  and must not change release behavior unless explicitly intended and documented.
• Before committing, validate via the canonical scripts (or equivalent):
  ./project-tool.sh build, ./project-tool.sh test, and ./project-tool.sh coverage when applicable.

Commit messages (mandatory)

• Commit messages MUST be written in English.
• Messages must be sufficiently detailed to explain:
  • What changed (key behavior and files/modules impacted),
  • Why it changed (motivation / bug / requirement),
  • How it was validated (tests/manual/hardware), including notable parameters or device info where relevant.
• Use a conventional format:
  • Subject line: short, imperative, scoped (e.g., Fix ..., Add ..., Update ...), ideally ≤ 72 chars.
  • Blank line.
  • Body: structured details (bullets preferred).

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• GPT 5.2 keeps staging its changes #8405
• GPT 5.2 will clobber uncommitted changes #8213
• /undo destructively interacts with git staging #8214
• Review against base branch includes working-tree changes and repeats non-diff hallucinated findings #8404

Powered by Codex Action

[etraut-openai]

Thanks for the bug report. What you're describing here is model behavior. We'll share the feedback with the team responsible for training our codex models. If you see other model behavior that you'd like to report, please use the /feedback command. That will provide us with additional details including logs and conversation text.