Skip to content

fix(codex): mirror execpolicy rules into managed Codex homes #24432

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
u-ichi wants to merge 2 commits into from
Closed

fix(codex): mirror execpolicy rules into managed Codex homes #24432

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b3f1e4a
fix(codex): mirror execpolicy rules into managed Codex homes
u-ichi Oct 1, 2026
89456cd
fix(codex): clarify why rules are mirrored
u-ichi Oct 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions src/main/codex/codex-home-paths.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -268,6 +268,22 @@ describe('syncSystemCodexResourcesIntoManagedHome', () => {
expectSymbolicLinkTargetIfLinked(runtimeHooksPath, systemHooksPath)
})

it('mirrors execpolicy rules into a per-account home so the user rules still apply', () => {
const systemRulesPath = join(getSystemCodexHomePath(), 'rules')
mkdirSync(systemRulesPath, { recursive: true })
writeFileSync(join(systemRulesPath, 'default.rules'), 'prefix_rule(pattern=["git", "add"])\n')
const perAccountHome = join(userDataDir, 'codex-accounts', 'account-1', 'home')
mkdirSync(perAccountHome, { recursive: true })

syncSystemCodexResourcesIntoManagedHome(perAccountHome)

const perAccountRulesPath = join(perAccountHome, 'rules')
expect(readFileSync(join(perAccountRulesPath, 'default.rules'), 'utf-8')).toBe(
'prefix_rule(pattern=["git", "add"])\n'
)
expectSymbolicLinkTargetIfLinked(perAccountRulesPath, systemRulesPath)
})

it('mirrors the global AGENTS.md into the managed runtime home so user instructions survive', () => {
const systemAgentsPath = join(getSystemCodexHomePath(), 'AGENTS.md')
const runtimeAgentsPath = join(getRuntimeCodexHomePath(), 'AGENTS.md')
Expand Down
2 changes: 2 additions & 0 deletions src/main/codex/codex-home-paths.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@ const CODEX_SYSTEM_RESOURCE_ENTRIES = [
'profile-v2',
'themes',
'prompts',
// Why: Codex loads the user's execpolicy `.rules` from `$CODEX_HOME/rules`.
'rules',

@pullfrog pullfrog Bot Oct 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On the Windows copy-fallback path (when directory symlink/junction creation fails), linkSystemCodexResource treats rules as a refreshable owned copy: it deletes the target and re-copies from ~/.codex/rules on every launch, with no content-match short-circuit like AGENTS.md gets. Because Codex writes newly saved "always allow" rules into $CODEX_HOME/rules/default.rules, those rules would live only in the managed copy and be discarded on the next sync — and never reach ~/.codex/rules. This only matters where the fallback is actually taken, so it may be moot if junctions always succeed for local NTFS homes.

Technical details 
# `rules` is the first writable resource in a delete-and-recopied fallback copy

## Affected sites
- `src/main/codex/codex-home-paths.ts:33` — `rules` added to the mirrored entries.
- `src/main/codex/codex-home-paths.ts:147-165` — owned fallback copies for non-`AGENTS.md` entries are unconditionally `rmSync`'d and recreated each sync; only `AGENTS.md` short-circuits on an unchanged read.
- `src/main/codex/codex-managed-home-resource-copy-marker.ts:54` — ownership keys on source path + non-symlink, so a Codex-modified copy is still "owned" and replaced.

## Required outcome
- A rule Codex saves into the managed home should survive a later sync, or the managed and user copies should converge.

## Suggested approach
- Skip the refresh for `rules` when the difference is Codex-added content, or merge new/changed `*.rules` back into `~/.codex/rules` before replacing the copy.

## Open questions for the human
- Is the fallback reachable on Windows in practice, or does directory `junction` creation always succeed for local NTFS managed homes? If fallback copies are expected, auto-saved rules are lost on the next launch.

@u-ichi u-ichi Oct 2, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. The nitpick on the comment wording is fixed in 89456cd.

On the copy fallback: rules is a directory, so on Windows it goes through symlinkSync(..., 'junction'). Directory junctions do not need Developer Mode or admin rights, so the fallback copy is only taken when even a junction cannot be created (for example, a managed home on a volume that does not support junctions). In that case the same delete-and-recopy refresh already applies to the other mirrored directories, and Codex-saved "always allow" rules would be lost as you describe.

I kept this PR to the one-line fix for the common case, where the managed home links to ~/.codex/rules and saved rules land in the user's own file. If maintainers prefer, I can follow up by skipping the refresh of an owned rules copy when its contents differ from the source, so saved rules are not discarded.

CODEX_GLOBAL_INSTRUCTIONS_ENTRY
] as const

Expand Down
Loading