fix(codex): stop 502ing empty CLI output, GET /file no longer mkdirs or leaks paths

server/__tests__/codex-config.test.js

@@ -247,6 +247,26 @@ describe("/api/codex-config", () => {
     }
   });
 
+  it("file endpoint 404s on a missing file inside an existing root", async () => {
+    const target = path.join(FAKE_HOME, "rules", "does-not-exist.rules");
+    const { status, body } = await fetchJson(
+      `/api/codex-config/file?cwd=${encodeURIComponent(FAKE_PROJECT)}&path=${encodeURIComponent(target)}`
+    );
+    assert.equal(status, 404);
+    assert.equal(body.error.code, "NOT_FOUND");
+  });
+
+  it("file endpoint 404s on a ?cwd= that doesn't exist yet, and creates nothing", async () => {
+    const missingCwd = path.join(TMP, `never-existed-${process.hrtime.bigint()}`);
+    const target = path.join(missingCwd, "AGENTS.md");
+    const { status, body } = await fetchJson(
+      `/api/codex-config/file?cwd=${encodeURIComponent(missingCwd)}&path=${encodeURIComponent(target)}`
+    );
+    assert.equal(status, 404);
+    assert.equal(body.error.code, "NOT_FOUND");
+    assert.equal(fs.existsSync(missingCwd), false, "GET /file must not create the missing root");
+  });
+
   it("file endpoint requires a path", async () => {
     const { status, body } = await fetchJson("/api/codex-config/file");
     assert.equal(status, 400);
@@ -450,6 +470,23 @@ describe("/api/codex-config", () => {
     }
   });
 
+  it("GET /mcp|/plugins|/marketplaces treat empty stdout as an empty list (fresh-install case), not a 502", async () => {
+    const restore = stubCodex(""); // exits 0, prints nothing — the normal fresh-install state
+    try {
+      for (const [route, key] of [
+        ["/api/codex-config/mcp", "mcp"],
+        ["/api/codex-config/plugins", "plugins"],
+        ["/api/codex-config/marketplaces", "marketplaces"],
+      ]) {
+        const { status, body } = await fetchJson(route);
+        assert.equal(status, 200, route);
+        assert.deepEqual(body[key], [], route);
+      }
+    } finally {
+      restore();
+    }
+  });
+
   it("GET /mcp reports unparseable CLI JSON as 502, not a type-confused 200", async () => {
     const restore = stubCodex('echo "not json"');
     try {