fix: harden codex home boundaries

internal/app/config.go

@@ -11,6 +11,12 @@ type Config struct {
 }
 
 func DefaultConfig() Config {
+	if codexHome := os.Getenv("CODEX_HOME"); codexHome != "" {
+		return Config{
+			CodexHome: codexHome,
+			HTTPAddr:  "127.0.0.1:18083",
+		}
+	}
 	home, err := os.UserHomeDir()
 	if err != nil {
 		home = "."

internal/app/config_test.go

@@ -0,0 +1,33 @@
+package app
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestDefaultConfigUsesCODEXHomeOverride(t *testing.T) {
+	override := filepath.Join(t.TempDir(), "custom-codex")
+	t.Setenv("CODEX_HOME", override)
+
+	cfg := DefaultConfig()
+
+	if cfg.CodexHome != override {
+		t.Fatalf("CodexHome = %q, want %q", cfg.CodexHome, override)
+	}
+}
+
+func TestDefaultConfigFallsBackToUserCodexHome(t *testing.T) {
+	t.Setenv("CODEX_HOME", "")
+	home, err := os.UserHomeDir()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := DefaultConfig()
+
+	want := filepath.Join(home, ".codex")
+	if cfg.CodexHome != want {
+		t.Fatalf("CodexHome = %q, want %q", cfg.CodexHome, want)
+	}
+}