Windows: .git owned by CodexSandboxOffline causes Codex project detection and Git clients to reject repository

Codex App version

Codex Desktop 26.803.5235.0.

Platform

• Windows: Microsoft Windows NT 10.0.26200.0
• Git: git version 2.54.0.windows.1

Summary

On Windows, a repository initialized from a Codex task had its .git directory owned by the Codex sandbox account while the project directory remained owned by the interactive Windows user.

Git's ownership protection then rejected the repository when Codex Desktop and external Git clients accessed it as the interactive user. Codex Desktop silently failed to recognize the project as a Git repository, while SourceTree displayed Git's detected dubious ownership error.

Repository state before remediation

Windows ownership was:

<project-root>       DEV\vygka
<project-root>\.git  DEV\CodexSandboxOffline

The repository itself was valid and contained a branch and commit. However, Git commands executed as DEV\vygka failed with code 128:

fatal: detected dubious ownership in repository at '<project-root>'
'<project-root>/.git' is owned by:
    DEV/CodexSandboxOffline
but the current user is:
    DEV/vygka

Observed application behavior:

• SourceTree could not open the repository because git log exited with code 128.
• Codex Desktop did not show the project as a Git repository.
• The project was absent from Codex's local Git-project inventory.

Steps to reproduce

1. Create or open a Windows project directory owned by the interactive user.
2. From a Codex task running as DEV\CodexSandboxOffline, initialize Git and create a commit.
3. Inspect the owner of the project directory and its .git directory:

   (Get-Acl "<project-root>").Owner
   (Get-Acl "<project-root>\.git").Owner
   

4. Open the repository in a Git client running as the interactive user.
5. Refresh or reopen the project in Codex Desktop.

Actual behavior

The project directory and .git directory have different owners. Git rejects the repository for the interactive user. SourceTree reports the ownership error, and Codex Desktop treats the project as if no Git repository were available.

Verified remediation

The .git owner was changed from an elevated PowerShell shell:

icacls "<project-root>\.git" /setowner "DEV\vygka" /T /C

No Git safe.directory exception was added.

After the ownership change:

<project-root>       DEV\vygka
<project-root>\.git  DEV\vygka

Both affected applications recovered immediately:

• SourceTree opened the repository successfully.
• Codex Desktop recognized the project as a Git repository.
• Codex's project inventory reported the project with isGitRepository: true.

This before/after result isolates the ownership mismatch as the cause.

Expected behavior

Git repositories initialized or modified by a Codex task inside a user-owned project should remain usable by the interactive Windows user.

Codex should either:

• preserve or restore appropriate ownership when creating the .git directory; or
• detect Git's dubious-ownership failure and display an actionable diagnostic instead of silently classifying the project as non-Git.

Codex should not broadly bypass Git's ownership protection or automatically add unrestricted safe.directory entries.

Start by reproducing the Windows workflow described: initialize Git and create a commit from a Codex task, then compare ownership of the project root and .git with Get-Acl and observe Git's dubious-ownership failure. Trace the repository detection and local Git-project inventory paths; done means user-owned repositories remain usable without unrestricted safe.directory entries, or the failure produces an actionable diagnostic.