codex --skip-git-repo-check is passed unconditionally, including for write-enabled runs

[pathscale]

Every codex exec invocation gets --skip-git-repo-check, regardless of permission posture.

Why it is like that

codex exec refuses to run outside a git repository. This crate is embedded in hosts that legitimately run against scratch directories, worktrees and review checkouts, so a hard abort there is useless to them, and making every caller pass the flag themselves meant every caller rediscovering the failure.

Decision recorded in PR #1: acceptable for the current use case, which is Codex doing code review under Permission::ReadOnly, where the sandbox blocks writes anyway.

The narrower concern

The safeguard exists to stop an agent editing files with no version control to undo them. That reasoning does not hold equally across postures:

• ReadOnly / Plan map to --sandbox read-only, so nothing is written and the check protects nothing.
• Edit / Auto map to --sandbox workspace-write. Here the agent can write, and outside a repo those edits have no undo. Bypassing the check automatically for these is the part worth revisiting.
• unchecked_args can also override sandbox settings via -c, so the "sandbox contains it" argument is not absolute.

Options if revisited

• Pass the flag only for non-writing postures, and require an explicit opt-in for Edit/Auto:

  Request::new(Agent::Codex, prompt)
      .permission(Permission::Edit)
      .codex_allow_non_git_workspace(true)

• Or keep it unconditional and document it as a deliberate property of the crate rather than an incidental one.

Current state

Documented in the README's gotchas section and in a comment next to the mapping in src/agent.rs. Not currently causing a known problem, since the write-enabled postures are unused by the current consumer.

Raised in PR #1 review.