Codex CLI broad rg search can traverse macOS CloudStorage paths and trigger OneDrive/iCloud/Google Drive hydration

What version of Codex CLI is running?

codex-cli 0.115.0

What subscription do you have?

ChatGPT pro

Which model were you using?

codex5.4

What platform is your computer?

Darwin 25.2.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

macOS shell environment

What issue are you seeing?

Codex CLI executed broad rg searches outside the intended project scope and those searches traversed paths under ~/Library/
CloudStorage/** on macOS.

On macOS, those paths are backed by File Provider (for example OneDrive / Google Drive / iCloud Drive). Recursive search and file
inspection in those trees can trigger hydration, causing cloud files to be downloaded locally even when I did not intend to
access those files.

In my case, old Codex sessions launched rg commands from very broad roots such as ~ or /Users/<user>. Those searches
touched cloud-backed paths and led to unwanted downloads from OneDrive. The problem is not just that the search was wide; on
macOS CloudStorage paths, broad content search itself can have side effects.

Observed examples from local logs included patterns like:

• searching from ~
• broad rg --files /Users/<user>
• broad rg -n ... ~ ...

Expected behavior:

• Codex should default to the current project root or user-provided path
• Codex should avoid ~/Library/CloudStorage/** by default
• ideally Codex CLI should have a built-in guardrail against broad scans over macOS cloud-backed directories

Actual behavior:

• broad rg commands were run
• CloudStorage paths were traversed
• OneDrive hydration/downloads were triggered

What steps can reproduce the bug?

1. Use Codex CLI on macOS with OneDrive / Google Drive / iCloud Drive enabled under ~/Library/CloudStorage/.
2. Start a session where Codex is asked to search for files or references, especially when the working directory is not a tightly

scoped project root.

1. Let Codex run a broad command such as:

```bash
rg -n "some-pattern" ~

or

rg --files /Users/<user>

1. If cloud-backed folders exist under ~/Library/CloudStorage/**, the search may traverse those paths.
2. macOS File Provider may then hydrate files, causing unintended cloud downloads.

Why I believe this is a Codex CLI bug:

• the CLI allows broad searches without protecting CloudStorage paths on macOS
• on this platform those searches are not read-only in practice; they can trigger file downloads
• a safer default would be to exclude ~/Library/CloudStorage/** unless the user explicitly authorizes that path

Relevant thread ids from my local sessions:

• 019d0215-47a2-7531-9772-53a2abd7c0af
• 019d041b-1c16-78b3-883a-b861b73125f4

What steps can reproduce the bug?

Uploaded thread: 019d04eb-e1ae-7f43-a24b-23149bdad948

What is the expected behavior?

_No response_

Additional information

_No response_