fix(codex): restore trust config permissions on rollback

src/main/codex/codex-trust-config-rollback.test.ts

@@ -51,4 +51,20 @@ describe('Codex trust config rollback', () => {
       expect(statSync(configPath).mode & 0o777).toBe(0o640)
     }
   })
+
+  it.skipIf(process.platform === 'win32')(
+    'restores the captured mode when the contents already match',
+    () => {
+      const configPath = tempConfigPath()
+      writeFileSync(configPath, '[hooks]\n')
+      chmodSync(configPath, 0o640)
+      const snapshot = captureCodexTrustConfig(configPath)
+      chmodSync(configPath, 0o600)
+
+      restoreCodexTrustConfig(configPath, snapshot)
+
+      expect(readFileSync(configPath, 'utf8')).toBe('[hooks]\n')
+      expect(statSync(configPath).mode & 0o777).toBe(0o640)
+    }
+  )
 })

src/main/codex/codex-trust-config-rollback.ts

@@ -1,4 +1,12 @@
-import { closeSync, fstatSync, openSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'
+import {
+  chmodSync,
+  closeSync,
+  fstatSync,
+  openSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync
+} from 'node:fs'
 import { randomUUID } from 'node:crypto'
 import { renameFileWithWindowsRetry } from '../codex-accounts/fs-utils'
 
@@ -45,6 +53,9 @@ export function restoreCodexTrustConfig(
   }
   try {
     if (readFileSync(tomlPath).equals(snapshot.contents)) {
+      // Why: the RPC may change permissions without changing bytes; rollback
+      // restores the complete captured file state, not only its contents.
+      chmodSync(tomlPath, snapshot.mode)
       return
     }
   } catch (error) {