Cross-project, cross-session state leak

Summary

Codex CLI session instructions leak approved command paths from one project into unrelated projects. This is a security issue — one project's configuration should not be visible to or executable from another project's session.

Environment

• codex-cli 0.118.0
• macOS (Darwin 22.6.0)
• Two unrelated projects in different directories

Repro

1. Project A (~/Documents/elite-fuel-labs/) has a Web XP install at ~/Documents/elite-fuel-labs/.web-xp/ with skill files that reference bin/pre-commit-check.sh
2. Project B (~/tmp/web-xp-test/) is a completely unrelated test project with no .web-xp directory
3. Open a fresh Codex session in Project B: cd ~/tmp/web-xp-test && codex
4. Ask Codex to run a pre-commit check (via an installed skill)

Observed

Codex ran bash /Users/.../Documents/elite-fuel-labs/.web-xp/bin/pre-commit-check.sh in Project B's session.

When asked why, Codex reported:

That path came from the hidden session instructions, not from your repo and not from the web-xp-check skill. Specifically, the developer prompt for this session included an 'approved command prefixes' list with this exact entry: \[\bash\, \/Users/.../Documents/elite-fuel-labs/.web-xp/bin/pre-commit-check.sh\\]

The skill file itself specified ~/.web-xp/bin/pre-commit-check.sh — Codex substituted the approved path from Project A instead.

Expected

Session instructions should only contain paths relevant to the current project/working directory. Approved command lists from other projects should not leak into unrelated sessions.

Impact

• Cross-project coupling: one project's scripts can execute in another project's context
• Wrong behavior: Project A's pre-commit rules applied to Project B's code
• Security: an attacker who controls one project's skill files could get their script executed in another project's Codex session via the approved command list leak