[Bug][Linux] codex-shim install cannot migrate a legacy shim whose codex-shim.json was written group-writable (umask 002) #6668

Client or integration

Codex CLI

Area

CLI

Summary

ocx codex-shim install cannot migrate a legacy Unix shim when the legacy state file ~/.opencodex/codex-shim.json is group-writable. It refuses with a message that doesn't name the file or the cause, while ocx codex-shim status keeps telling the user to run that same command.

Cause:

• The legacy branch of writeState() in src/codex/shim-state-file.ts calls writeFileSync(path, ..., "utf8") with no mode, so the file's permissions depend on the umask. With umask 002 (the Ubuntu default for desktop users) it is created as 0664. Only the path-overlay branch writes with mode: 0o600.
• installUnixOverlay() in src/codex/shim-overlay.ts runs snapshot(statePath()) before migrateLegacyUnixShim(). snapshot() throws Private Codex artifact is not an owned regular file when mode & 0o022 is set.

So any legacy install written under umask 002 can never be migrated, and the user is stuck: status says "Run ocx codex-shim install", and install refuses.

Expected, any of the following:

• The legacy state file the old shim wrote can be migrated, for example by tightening it to 0600 when it is a regular file owned by the current user, or by validating it on the legacy path the way readStateResult already treats mode drift as readable for repair.
• At minimum, the refusal names the path and the reason (group/world writable) and suggests chmod 600 ~/.opencodex/codex-shim.json.

Workaround: running chmod 600 ~/.opencodex/codex-shim.json and then ocx codex-shim install migrated cleanly to the PATH overlay.

Reproduction

1. With umask 002, install the legacy in-place shim with an older ocx codex-shim install, so that ~/.local/bin/codex becomes the wrapper and the backup is codex.opencodex-real. ~/.opencodex/codex-shim.json ends up -rw-rw-r--.
2. Upgrade to 2.78.0.
3. ocx codex-shim status reports "Legacy Unix shim installed in place; automatic repair does not migrate it. Run ocx codex-shim install, …".
4. ocx codex-shim install exits 1 with "Private Codex artifact is not an owned regular file".

Version

2.78.0 (.deb); same code on dev at 2.79.0

Operating system

Ubuntu 26.04.1 LTS

Provider and model

No response

Logs or error output

$ ocx codex-shim install
⚠️  Private Codex artifact is not an owned regular file
Codex shim installation was refused: Codex autostart shim: wrapper shim present at ~/.local/bin/codex; original backup present at ~/.local/bin/codex.opencodex-real. Legacy Unix shim installed in place; automatic repair does not migrate it. Run ocx codex-shim install, then source the printed codex-shell-env.sh path and add that line after PATH setup in your shell startup file.

$ stat -c '%A %n' ~/.opencodex/codex-shim.json
-rw-rw-r-- ~/.opencodex/codex-shim.json
$ umask
002

$ chmod 600 ~/.opencodex/codex-shim.json && ocx codex-shim install
⚠️  Codex PATH shim installed at ~/.opencodex/bin/codex; native launcher ~/.local/bin/codex. ...

Screenshots and supporting files

No response

Redacted configuration

No response

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.