fix(runtime): validate private state paths before access

README.md

@@ -86,8 +86,9 @@ unset OPENAI_API_KEY CODEX_API_KEY
 ```
 
 Scan history is stored in the Codex Security workbench state directory. If that
-directory cannot be written, set `CODEX_SECURITY_STATE_DIR` to a writable
-directory outside the repository.
+directory cannot be written or has unsafe parent permissions, set
+`CODEX_SECURITY_STATE_DIR` to a private directory with trusted parents outside
+the repository. See [output and state directory permissions](sdk/typescript/README.md#output-and-state-directory-permissions).
 
 `findings list [repository]` shows open findings across a repository's scans
 and identifies findings not confirmed in its latest scan.

sdk/typescript/README.md

@@ -331,7 +331,9 @@ reduction and result delivery, including at the 96-hour maximum.
 `bulk-scan --workers` controls how many repositories are scanned concurrently.
 
 On macOS/Linux, an existing output directory must be private to the current
-user (`chmod 700`).
+user (`chmod 700`) and have trusted parent directories. See [output and state
+directory permissions](#output-and-state-directory-permissions) if a parent is
+group- or world-writable.
 
 If the output directory already contains results, add `--archive-existing`.
 The CLI moves them to `<output-dir>.previous-<timestamp>-<id>` and starts the
@@ -765,6 +767,50 @@ const directPublication = await publishScan("/path/to/completed-scan", {
 });
 ```
 
+### Output and state directory permissions
+
+On macOS and Linux, scan output must be private to the current user. Every
+parent directory must be owned by the current user or root. A group- or
+world-writable parent is accepted only when it has the sticky bit. The state
+directory itself must be private; the sticky-bit exception applies only to its
+parents. History, sign-in, and publication operations use the same private-state
+rule. State-directory aliases must have trusted link owners and trusted lexical
+and resolved parents. New state directories are created privately; existing
+directories are not automatically changed.
+
+On Windows, an existing state directory must use a protected access-control
+list that grants access only to the current user, `SYSTEM`, and local
+Administrators, and its parents must not let another identity replace it. New
+state directories receive that private access-control list. Existing access
+rules are inspected but not rewritten.
+
+An error that names a parent with mode `0775` refers to that parent, not just
+the final output directory. Creating a `0700` child beneath it does not stop
+another user from renaming or replacing that child. Choose a location with
+trusted parents, or remove group- and world-write access from the named parent
+only if you own it and it is safe to change. Do not change a shared home,
+workspace, mount, or system directory merely to suppress the error.
+
+Use the setting for the location that failed:
+
+- For explicitly selected scan results, choose another `--output-dir` (SDK
+  `outputDir`) outside the scanned repository.
+- For persistent history, default artifacts, and stored sign-in, choose a
+  private `CODEX_SECURITY_STATE_DIR` outside the repository. On macOS and Linux,
+  an existing state directory must be owned by you and private (`0700`). Change
+  its permissions only if it is your dedicated state directory and is safe to
+  change. On Windows, choose a directory with private access rules rather than
+  changing a shared parent. Selecting a new directory does not move existing
+  history, results, or credentials.
+- For temporary runtime files, choose a suitable `TMPDIR` (`TEMP` on Windows).
+  A fresh private child under a trusted, sticky system temporary directory is
+  suitable for temporary work; it is not a replacement for persistent history.
+
+The CLI does not automatically change parent permissions or move an explicitly
+selected directory. `scan --dry-run` checks the ancestry of an explicitly
+selected output directory and the configured state root without creating scan
+output or initializing the runtime.
+
 ### Scan history and reruns
 
 `scans` or `scans list` lists scans for the current repository. Pass a repository

sdk/typescript/_bundled_plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-security",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "Codex Security workflows for security scans, analysis, and investigation.",
   "author": {
     "name": "OpenAI"