codex exec review --skip-git-repo-check scans child repos when run outside Git

codex exec review --skip-git-repo-check scans and probes child repos when run outside Git

Summary

When codex exec review --skip-git-repo-check is run from a directory that is not itself a Git repository, Codex does not fail fast or ask the user to choose a repository.

Instead, it searches for .git directories under the current tree and starts running review commands against the child repositories it finds.

That creates ambiguous targeting and can cause review commands to touch multiple unrelated repos.

Repro

Create a parent directory with two independent child repos:

mkdir -p /tmp/codex_review_scan_root/repo_a /tmp/codex_review_scan_root/repo_b

git -C /tmp/codex_review_scan_root/repo_a init
git -C /tmp/codex_review_scan_root/repo_a config user.email test@example.com
git -C /tmp/codex_review_scan_root/repo_a config user.name test
printf 'a\n' >/tmp/codex_review_scan_root/repo_a/a.txt
git -C /tmp/codex_review_scan_root/repo_a add a.txt
git -C /tmp/codex_review_scan_root/repo_a commit -m init
printf 'change\n' >>/tmp/codex_review_scan_root/repo_a/a.txt

git -C /tmp/codex_review_scan_root/repo_b init
git -C /tmp/codex_review_scan_root/repo_b config user.email test@example.com
git -C /tmp/codex_review_scan_root/repo_b config user.name test
printf 'b\n' >/tmp/codex_review_scan_root/repo_b/b.txt
git -C /tmp/codex_review_scan_root/repo_b add b.txt
git -C /tmp/codex_review_scan_root/repo_b commit -m init
printf 'other\n' >>/tmp/codex_review_scan_root/repo_b/b.txt

Run review from the parent directory, which is not a Git repo:

cd /tmp/codex_review_scan_root
codex exec review --skip-git-repo-check --json "Give a one-line review." \
  > /tmp/codex_review_scan_repro.jsonl

Observed transcript excerpt:

{"type":"item.completed","item":{"id":"item_0","type":"command_execution","command":"/bin/bash -lc \"git -C /tmp/codex_review_scan_root status --short && echo '---DIFF---' && git -C /tmp/codex_review_scan_root diff --stat && echo '---FILES---' && git -C /tmp/codex_review_scan_root diff --name-only\"","aggregated_output":"fatal: not a git repository (or any of the parent directories): .git\n","exit_code":128,"status":"failed"}}
{"type":"item.completed","item":{"id":"item_1","type":"command_execution","command":"/bin/bash -lc \"pwd && ls -la /tmp/codex_review_scan_root && echo '---find .git---' && find /tmp/codex_review_scan_root -maxdepth 3 -name .git -type d\"","aggregated_output":"/tmp/codex_review_scan_root\n...\n/tmp/codex_review_scan_root/repo_b/.git\n/tmp/codex_review_scan_root/repo_a/.git\n","exit_code":0,"status":"completed"}}
{"type":"item.completed","item":{"id":"item_2","type":"command_execution","command":"/bin/bash -lc \"git -C /tmp/codex_review_scan_root/repo_a status --short && echo '---DIFF---' && git -C /tmp/codex_review_scan_root/repo_a diff --stat && echo '---FILES---' && git -C /tmp/codex_review_scan_root/repo_a diff --name-only\"","aggregated_output":" M a.txt\n---DIFF---\n a.txt | 1 +\n 1 file changed, 1 insertion(+)\n---FILES---\na.txt\n","exit_code":0,"status":"completed"}}
{"type":"item.completed","item":{"id":"item_3","type":"command_execution","command":"/bin/bash -lc \"git -C /tmp/codex_review_scan_root/repo_b status --short && echo '---DIFF---' && git -C /tmp/codex_review_scan_root/repo_b diff --stat && echo '---FILES---' && git -C /tmp/codex_review_scan_root/repo_b diff --name-only\"","aggregated_output":" M b.txt\n---DIFF---\n b.txt | 1 +\n 1 file changed, 1 insertion(+)\n---FILES---\nb.txt\n","exit_code":0,"status":"completed"}}

So one review invocation outside Git ended up probing both child repos.

Expected behavior

One of these should happen instead:

• fail clearly because the current working directory is not a Git repository
• or require the user to specify/select exactly which repository to review

Actual behavior

Codex auto-discovers child repos under the current tree and starts running review commands against them.

Why this matters

This can review the wrong repository, multiple repositories, or sensitive neighboring repositories without an explicit target.

Files / artifacts

• /tmp/codex_review_scan_repro.jsonl