From 55cd78bce47f219d03c7b8b7a43963f5eae182b0 Mon Sep 17 00:00:00 2001
From: "Kai (Tam Nhu) Tran" <61256810+kaitranntt@users.noreply.github.com>
Date: Sat, 23 May 2026 21:45:12 -0400
Subject: [PATCH] fix: create explicit CODEX_HOME with secure permissions
 (#1380)

---
 src/targets/codex-adapter.ts                         | 2 +-
 tests/unit/targets/codex-runtime-integration.test.ts | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/targets/codex-adapter.ts b/src/targets/codex-adapter.ts
index 333dda86..ba22c63b 100644
--- a/src/targets/codex-adapter.ts
+++ b/src/targets/codex-adapter.ts
@@ -222,7 +222,7 @@ function prepareExplicitCodexHome(
   }
 
   try {
-    fs.mkdirSync(codexHome, { recursive: true });
+    fs.mkdirSync(codexHome, { mode: 0o700, recursive: true });
   } catch (err) {
     const error = err as NodeJS.ErrnoException;
     if (error.code !== 'EEXIST') {
diff --git a/tests/unit/targets/codex-runtime-integration.test.ts b/tests/unit/targets/codex-runtime-integration.test.ts
index a14dfed4..4018dd45 100644
--- a/tests/unit/targets/codex-runtime-integration.test.ts
+++ b/tests/unit/targets/codex-runtime-integration.test.ts
@@ -596,7 +596,9 @@ process.exit(0);
 
     expect(result.status).toBe(0);
     expect(fs.existsSync(freshCodexHome)).toBe(true);
-    expect(fs.statSync(freshCodexHome).isDirectory()).toBe(true);
+    const codexHomeStat = fs.statSync(freshCodexHome);
+    expect(codexHomeStat.isDirectory()).toBe(true);
+    expect(codexHomeStat.mode & 0o777).toBe(0o700);
     expect(readLoggedCodexCalls(codexArgsLogPath)).toEqual([
       ['-c', 'model="gpt-5"', '--version'],
       ['-c', 'model_reasoning_effort="high"', 'fix failing tests'],