[Windows Desktop] Composer/session Markdown-escapes underscores in paths as `\_`, then model misreads them as separators

Summary

On Codex Desktop for Windows, a Windows path containing an underscore can be persisted in the session transcript with the underscore Markdown-escaped as \_. The model may then interpret the inserted backslash as a Windows directory separator and incorrectly claim that the user supplied the wrong path.

This report is based on a local read-only inspection of the affected session transcript. Real project and file names are redacted below.

Environment

• Codex Desktop: 26.818.3698.0
• OS: Windows x64
• Surface: local Codex Desktop chat
• Session storage: default %USERPROFILE%\.codex\sessions

Reproduction

1. In the Codex Desktop composer, enter or paste a prompt containing a quoted Windows path with an underscore in a directory name, for example:

``text
Use "D:\Work\Example\Zoo_luban\Datas\file.xlsx"
``

1. Send the prompt.
2. Inspect the corresponding session JSONL under %USERPROFILE%\.codex\sessions.
3. Observe that the persisted user message may contain:

``text
D:\Work\Example\Zoo\_luban\Datas\file.xlsx
``

1. The model can treat that Markdown escape as a literal Windows separator and respond as if the user entered Zoo\_luban instead of Zoo_luban.

Actual behavior observed

The affected raw assistant message first identified the real file using the correct path segment:

D:\Work\Example\Zoo_luban\Datas\file.xlsx

It then incorrectly told the user that their supplied path used:

Zoo\_luban

The persisted raw user message did contain the inserted Markdown escape \_, even though the user reports entering the normal path with Zoo_luban.

Other user messages in the same session also contained literal   sequences, which may point to the same rich-text/Markdown serialization layer.

Expected behavior

Windows paths should preserve their literal characters end to end. In particular:

• Zoo_luban should remain Zoo_luban in the model-visible session content; or
• if the composer intentionally serializes it as Markdown Zoo\_luban, the model-facing layer must decode the Markdown escape before treating the value as a filesystem path.

The model should not interpret a Markdown escape inserted by the client as an additional Windows path separator.

Impact

This can cause Codex to:

• report that a valid user-supplied path is wrong;
• resolve a nonexistent directory such as Zoo\_luban;
• search for a fallback file and proceed against a different path;
• reduce trust in exact path handling for file-editing tasks.

Hooks/plugins ruled out

Local inspection found no configured PreToolUse hook capable of rewriting tool input. The only relevant installed hook was a Ponytail UserPromptSubmit handler that reads the prompt to detect /ponytail commands and does not rewrite path text. No occurrence of the affected path or underscore-rewrite logic was found in the hook files.

Privacy

No raw session file is attached because it contains unrelated user content. The excerpts above are minimized and sanitized. A narrowly redacted transcript excerpt can be provided if maintainers request it.