Skip to content

fix(codex): honor effective CODEX_HOME during launch - #115

Merged
aannoo merged 3 commits into
aannoo:mainfrom
yasinozmeen:fix/codex-home-launch-env
Sep 13, 2026
Merged

aannoo merged 3 commits into
aannoo:mainfrom
yasinozmeen:fix/codex-home-launch-env

Conversation

@yasinozmeen

Copy link
Copy Markdown
Contributor

Summary

  • resolve Codex's state directory from the effective child launch environment after config.toml, ~/.hcom/env, and caller env overlays
  • use that same CODEX_HOME for the writability preflight, hook installation/verification, hook trust scanning, and the Codex app-server probe
  • add regressions proving the child override wins and hooks are written only to the effective child home

Problem

When hcom runs inside a sandboxed parent Codex, a writable CODEX_HOME supplied through ~/.hcom/env is part of the child environment. The launch preflight and hook setup previously ran before that environment was built, so they still inspected the parent process's default ~/.codex and rejected an otherwise valid launch with Operation not permitted.

Verification

  • cargo fmt --all -- --check
  • cargo clippy --all-targets --locked -- -D warnings
  • cargo test --locked (2177 unit tests and 35 integration/smoke tests passed; only opt-in real-tool/PTY tests were ignored)
  • live launch from a sandboxed parent using the patched binary directly, without a wrapper: the child Codex initialized from the overridden CODEX_HOME, bound its hooks, and delivered an hcom message back to the parent

@aannoo

aannoo commented Sep 13, 2026

Copy link
Copy Markdown
Owner

thanks

@aannoo
aannoo merged commit dc633b5 into aannoo:main Sep 13, 2026
20 checks passed
orgoj added a commit to orgoj/hcom that referenced this pull request Sep 13, 2026
… module)

Upstream fabb309 brings the runner Node-precedence fix (aannoo#117), the grown
CODEX_HOME resolution (aannoo#115), Ptyxis support (aannoo#113), the Windows nested
PowerShell removal (aannoo#137) and the kimi modularisation (aannoo#106).

Conflicts resolved in upstream's favour:
- codex.rs / codex_preprocessing.rs: the fork's cherry-picked 080c78a used a
  thread-local CODEX_HOME override; upstream's explicit `*_at` threading
  replaces it, so the wrapper functions and the thread-local are dropped.
- launcher.rs: upstream's case-insensitive effective-env helpers and the
  earlier canonical_dir are taken; the fork's per-instance system-prompt
  path stays and upstream's global gemini system-prompt block is dropped.
- kimi: upstream's src/hooks/kimi/ module replaces the fork's kimi.rs (it
  already carries the fork's lifecycle and observation fixes); only the
  fork's nested-identity gate `hook_gate_check_for_tools` is re-applied.
- terminal_presets: expected preset count raised to 30 for Ptyxis.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WDRs6TVA2uSBXG2TQacFRf
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants