fix(codex): stop 502ing empty CLI output, GET /file no longer mkdirs or leaks paths

server/routes/codex-config.js

@@ -107,6 +107,8 @@ router.get("/file", (req, res) => {
     return res.status(400).json({ error: { code: "BAD_PATH", message: "path is required" } });
   }
   const result = codexDiscovery.readFileSafe(p, { cwd: cwdOf(req) });
+  if (result.notFound)
+    return res.status(404).json({ error: { code: "NOT_FOUND", message: "file not found" } });
   if (result.error)
     return res.status(400).json({ error: { code: "READ_DENIED", message: result.error } });
   res.json(result);
@@ -201,14 +203,16 @@ function cliFailure(res, result) {
 
 /**
  * Read-through result for a GET route backed by `codex … --json`. `result.data`
- * is only set when stdout parsed as JSON (see runCodex) — an ok:true result
- * with unparseable stdout means the CLI's output shape changed under us, so
- * this is a 502, not a 200 with a string where the OpenAPI fragment promises
- * an array/object.
+ * is only set when stdout parsed as JSON (see runCodex). A fresh install with
+ * zero MCP servers/plugins/marketplaces is the normal case and prints nothing
+ * — that's an empty list, not a parse failure. Only stdout that has content
+ * and still doesn't parse (the CLI's output shape changed under us) is a 502,
+ * never a 200 with a string where the OpenAPI fragment promises an array/object.
  */
 function cliRead(res, result, key) {
   if (!result.ok) return cliFailure(res, result);
   if (result.data === undefined) {
+    if (!result.stdout.trim()) return res.json({ [key]: [] });
     return res.status(502).json({
       error: {
         code: "ECLIBADOUTPUT",