fix(codex): stop 502ing empty CLI output, GET /file no longer mkdirs or leaks paths

server/openapi-extra/codex-config.js

@@ -370,7 +370,7 @@ const paths = {
       tags: ["CodexConfig"],
       summary: "Read a single file body",
       description:
-        "Read-only. Returns the body of one file. Strict path containment: the resolved absolute path must live under CODEX_HOME, the project .codex dir, or (only for a file literally named AGENTS.md) the project root.",
+        "Read-only, no filesystem side effect. Returns the body of one file. Strict path containment: the resolved absolute path must live under CODEX_HOME, the project .codex dir, or (only for a file literally named AGENTS.md) the project root, and must not escape that root through a symlink. Error messages never reveal what does or does not exist outside the root.",
       operationId: "codexConfigGetFile",
       parameters: [
         {
@@ -391,7 +391,8 @@ const paths = {
             },
           },
         },
-        400: errorResponse("READ_DENIED", "path is outside allowed roots"),
+        400: errorResponse("READ_DENIED", "path escapes the allowed root"),
+        404: errorResponse("NOT_FOUND", "file not found"),
       },
     },
     put: {