From b3f1e4aa02dc71235b121d1fc1dbfc32e1a39e85 Mon Sep 17 00:00:00 2001 From: Yuichi Uemura Date: Fri, 2 Oct 2026 02:34:46 +0900 Subject: [PATCH 1/2] fix(codex): mirror execpolicy rules into managed Codex homes Orca-launched Codex uses a managed CODEX_HOME, and Codex loads execpolicy .rules only from $CODEX_HOME/rules. The managed home linked skills, hooks, prompts and AGENTS.md from ~/.codex but not rules, so the user's allow/prompt/forbidden rules did not apply in Orca sessions. Co-Authored-By: Claude Opus 5.5 --- src/main/codex/codex-home-paths.test.ts | 16 ++++++++++++++++ src/main/codex/codex-home-paths.ts | 2 ++ 2 files changed, 18 insertions(+) diff --git a/src/main/codex/codex-home-paths.test.ts b/src/main/codex/codex-home-paths.test.ts index 26053b8786c9..5b87165bafc2 100644 --- a/src/main/codex/codex-home-paths.test.ts +++ b/src/main/codex/codex-home-paths.test.ts @@ -268,6 +268,22 @@ describe('syncSystemCodexResourcesIntoManagedHome', () => { expectSymbolicLinkTargetIfLinked(runtimeHooksPath, systemHooksPath) }) + it('mirrors execpolicy rules into a per-account home so the user rules still apply', () => { + const systemRulesPath = join(getSystemCodexHomePath(), 'rules') + mkdirSync(systemRulesPath, { recursive: true }) + writeFileSync(join(systemRulesPath, 'default.rules'), 'prefix_rule(pattern=["git", "add"])\n') + const perAccountHome = join(userDataDir, 'codex-accounts', 'account-1', 'home') + mkdirSync(perAccountHome, { recursive: true }) + + syncSystemCodexResourcesIntoManagedHome(perAccountHome) + + const perAccountRulesPath = join(perAccountHome, 'rules') + expect(readFileSync(join(perAccountRulesPath, 'default.rules'), 'utf-8')).toBe( + 'prefix_rule(pattern=["git", "add"])\n' + ) + expectSymbolicLinkTargetIfLinked(perAccountRulesPath, systemRulesPath) + }) + it('mirrors the global AGENTS.md into the managed runtime home so user instructions survive', () => { const systemAgentsPath = join(getSystemCodexHomePath(), 'AGENTS.md') const runtimeAgentsPath = join(getRuntimeCodexHomePath(), 'AGENTS.md') diff --git a/src/main/codex/codex-home-paths.ts b/src/main/codex/codex-home-paths.ts index e838d11fe6b2..e1e944ddb0d4 100644 --- a/src/main/codex/codex-home-paths.ts +++ b/src/main/codex/codex-home-paths.ts @@ -29,6 +29,8 @@ const CODEX_SYSTEM_RESOURCE_ENTRIES = [ 'profile-v2', 'themes', 'prompts', + // Why: Codex loads execpolicy `.rules` only from `$CODEX_HOME/rules`. + 'rules', CODEX_GLOBAL_INSTRUCTIONS_ENTRY ] as const From 89456cdfe235153efdbe62c1e76e43ae769b0145 Mon Sep 17 00:00:00 2001 From: Yuichi Uemura Date: Fri, 2 Oct 2026 17:59:02 +0900 Subject: [PATCH 2/2] fix(codex): clarify why rules are mirrored Codex also reads rules from Team Config and trusted project layers; the managed home only needs the user layer at $CODEX_HOME/rules. Co-Authored-By: Claude Opus 5.5 --- src/main/codex/codex-home-paths.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/codex/codex-home-paths.ts b/src/main/codex/codex-home-paths.ts index e1e944ddb0d4..79d008993088 100644 --- a/src/main/codex/codex-home-paths.ts +++ b/src/main/codex/codex-home-paths.ts @@ -29,7 +29,7 @@ const CODEX_SYSTEM_RESOURCE_ENTRIES = [ 'profile-v2', 'themes', 'prompts', - // Why: Codex loads execpolicy `.rules` only from `$CODEX_HOME/rules`. + // Why: Codex loads the user's execpolicy `.rules` from `$CODEX_HOME/rules`. 'rules', CODEX_GLOBAL_INSTRUCTIONS_ENTRY ] as const