Linux sandbox creates synthetic child .git when Codex is launched from a subdirectory of a parent Git repo

Summary

When Codex CLI is launched from a subdirectory inside a larger Git repo, the Linux workspace-write sandbox creates or mounts a synthetic child .git path at the current workspace root.

This breaks monorepo workflows where Codex is intentionally launched from a project subdirectory to load project-local AGENTS.md, .agents/, and harness docs without treating the monorepo root as the agent project.

Example layout:

<monorepo>/.git
<monorepo>/apps/<project>/

Codex is launched from:

<monorepo>/apps/<project>

Inside the active Codex sandbox, this appears:

<monorepo>/apps/<project>/.git

as a read-only tmpfs mount, even though the real .git is at the parent repo root.

## Environment

- Codex CLI: codex-cli 0.137.0
- Install: npm package @openai/codex, native package @openai/codex-linux-x64
- Platform: Linux x86_64
- Sandbox mode: workspace-write
- Working directory is a subdirectory of a parent Git repo

## Observed Evidence

From the affected Codex session:

pwd
# <monorepo>/apps/<project>

git rev-parse --show-toplevel
# <monorepo>

git rev-parse --git-dir
# <monorepo>/.git

findmnt <monorepo>/apps/<project>/.git
# TARGET                         SOURCE FSTYPE OPTIONS
# <monorepo>/apps/<project>/.git tmpfs  tmpfs  ro,nosuid,nodev,relatime,mode=555,uid=1000,gid=1000

This causes shell prompt tooling such as Oh My Posh, and any tool that checks for .git directly, to treat the subdirectory as its own repo root or otherwise mis-detect Git state.

## Minimal Reproduction

rm -rf /tmp/codex-git-repro
mkdir -p /tmp/codex-git-repro/repo/app
git -C /tmp/codex-git-repro/repo init --quiet

codex sandbox --permissions-profile ':workspace' \
  -C /tmp/codex-git-repro/repo/app \
  bash -lc '
    pwd
    git rev-parse --show-toplevel
    findmnt /tmp/codex-git-repro/repo/app/.git || echo no-findmnt
    if test -e /tmp/codex-git-repro/repo/app/.git; then
      echo child-git-exists
    else
      echo child-git-missing
    fi
  '

if test -e /tmp/codex-git-repro/repo/app/.git; then
  findmnt /tmp/codex-git-repro/repo/app/.git || true
  ls -ld /tmp/codex-git-repro/repo/app/.git
else
  echo host-child-git-missing
fi

Observed output:

/tmp/codex-git-repro/repo/app
/tmp/codex-git-repro/repo
TARGET                             SOURCE FSTYPE OPTIONS
/tmp/codex-git-repro/repo/app/.git tmpfs  tmpfs  ro,nosuid,nodev,relatime,mode=555,uid=1000,gid=1000
child-git-exists
host-child-git-missing

The short standalone command cleans up on exit, but long-running interactive Codex sessions keep the synthetic .git visible for the life of the session. I have also observed empty child .git directories appearing/reappearing around Codex activity in real monorepo workspaces.

## Expected Behavior

If Codex is launched from a subdirectory of a parent Git repo, and the current working directory does not already contain a real .git, the sandbox should not create or mount a synthetic child .git.

Git discovery should continue to resolve the real parent repo:

git rev-parse --show-toplevel
# <monorepo>

There should be no synthetic path at:

<monorepo>/apps/<project>/.git

## Actual Behavior

Codex mounts a synthetic read-only tmpfs at the child workspace .git path:

<monorepo>/apps/<project>/.git tmpfs ro mode=555

This shadows or confuses project/root detection for tools that look at filesystem .git paths.

## Why This Matters

This is a legitimate monorepo workflow.

The monorepo root can contain multiple agentic projects with conflicting AGENTS.md, .agents/, and harness docs. Launching Codex from the actual Git root is not a viable workaround because it causes Codex to load the wrong project context.

We need to launch Codex from:

<monorepo>/apps/<project>

while Git operations still resolve to:

<monorepo>/.git

## Likely Regression Area

This appears related to the recent Linux sandbox metadata-protection work:

- PR: https://github.com/openai/codex/pull/19852
- Commit: https://github.com/openai/codex/commit/74f06dcdfbb9f0c9f93ca0814ee873043e78faa4
- Related issue: https://github.com/openai/codex/issues/23747

The current upstream source appears to have intent/test coverage for this case:

- should_leave_missing_git_for_parent_repo_discovery
- missing_child_git_under_parent_repo_uses_protected_create_target

That test says a missing child .git under a parent repo should not shadow parent repo discovery. However, released codex-cli 0.137.0 still mounts the missing child .git as tmpfs in the active sandbox.

## Suggested Fix

Do not create or mount a missing child .git under the writable workspace root when an ancestor directory already contains real Git metadata.

A good integration test would run the actual codex sandbox command from a subdirectory of a parent Git repo and assert:

1. Inside sandbox, git rev-parse --show-toplevel resolves to the parent repo.
2. Inside sandbox, <cwd>/.git is not mounted as tmpfs.
3. After sandbox exit, <cwd>/.git does not exist on the host.
4. Existing real .git, .agents, and .codex paths remain protected as intended.

## Workaround

The only practical workaround I see is disabling the Codex sandbox for this workspace, which is not ideal.

Launching Codex from the monorepo root is not acceptable in this use case because project-level agent instructions conflict across apps.