fix(codex): close symlink escape on GET /file, pin project writes to server cwd

server/openapi-extra/codex-config.js

@@ -398,9 +398,8 @@ const paths = {
       tags: ["CodexConfig"],
       summary: "Create or overwrite a text artifact",
       description:
-        "Writes skills/agents/rules/memory/config. `name` is required for skills/agents/rules and forbidden for memory/config (fixed filenames). Backs up any existing file first; broadcasts `codex_config_changed` on success.",
+        "Writes skills/agents/rules/memory/config. `name` is required for skills/agents/rules and forbidden for memory/config (fixed filenames). `project` scope always resolves against the dashboard server's own cwd — there is no `?cwd=` override on writes, unlike the read routes, so a caller cannot point a write at an arbitrary directory. Backs up any existing file first; broadcasts `codex_config_changed` on success.",
       operationId: "codexConfigPutFile",
-      parameters: [cwdParam],
       requestBody: {
         required: true,
         content: {
@@ -436,9 +435,8 @@ const paths = {
       tags: ["CodexConfig"],
       summary: "Delete a text artifact",
       description:
-        "Deletes skills/agents/rules/memory/config. Backup is mandatory and runs first. Broadcasts `codex_config_changed` on success.",
+        "Deletes skills/agents/rules/memory/config. `project` scope always resolves against the dashboard server's own cwd — no `?cwd=` override, same as PUT. Backup is mandatory and runs first. Broadcasts `codex_config_changed` on success.",
       operationId: "codexConfigDeleteFile",
-      parameters: [cwdParam],
       requestBody: {
         required: true,
         content: {
@@ -518,6 +516,7 @@ const paths = {
           content: { "application/json": { schema: { type: "object", properties: { mcp: {} } } } },
         },
         422: cliExitResponse,
+        502: errorResponse("ECLIBADOUTPUT", "could not parse `codex` JSON output"),
         503: errorResponse("ECLINOTFOUND", "the `codex` CLI was not found on PATH"),
       },
     },
@@ -537,6 +536,7 @@ const paths = {
           },
         },
         422: cliExitResponse,
+        502: errorResponse("ECLIBADOUTPUT", "could not parse `codex` JSON output"),
         503: errorResponse("ECLINOTFOUND", "the `codex` CLI was not found on PATH"),
       },
     },
@@ -556,6 +556,7 @@ const paths = {
           },
         },
         422: cliExitResponse,
+        502: errorResponse("ECLIBADOUTPUT", "could not parse `codex` JSON output"),
         503: errorResponse("ECLINOTFOUND", "the `codex` CLI was not found on PATH"),
       },
     },