fix(codex): stop 502ing empty CLI output, GET /file no longer mkdirs or leaks paths

openapi.yaml

@@ -8981,7 +8981,7 @@ paths:
       tags:
         - CodexConfig
       summary: Read a single file body
-      description: 'Read-only. Returns the body of one file. Strict path containment: the resolved absolute path must live under CODEX_HOME, the project .codex dir, or (only for a file literally named AGENTS.md) the project root.'
+      description: 'Read-only, no filesystem side effect. Returns the body of one file. Strict path containment: the resolved absolute path must live under CODEX_HOME, the project .codex dir, or (only for a file literally named AGENTS.md) the project root, and must not escape that root through a symlink. Error messages never reveal what does or does not exist outside the root.'
       operationId: codexConfigGetFile
       parameters:
         - name: path
@@ -9012,7 +9012,16 @@ paths:
               example:
                 error:
                   code: READ_DENIED
-                  message: path is outside allowed roots
+                  message: path escapes the allowed root
+        '404':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+              example:
+                error:
+                  code: NOT_FOUND
+                  message: file not found
     put:
       tags:
         - CodexConfig