Seed WSL Codex runtime config through the fresh-mirror preparation (#7343)

* Seed WSL Codex runtime config through the fresh-mirror preparation

The WSL runtime home seed copied config.toml verbatim, so relative
path-valued settings (model_instructions_file etc.) resolved against the
runtime home inside the distro and aborted Codex config load with
'os error 2' -- the same failure class #7157 fixed for host runtime and
managed account homes. Seed now applies the shared fresh-mirror
preparation (deprecated codex_hooks normalization + relative-path rewrite
anchored to the Linux-side source home + system hook-trust strip).

Also fixes CRLF configs skipping deprecated codex_hooks normalization:
the feature-section header regexes did not tolerate the trailing \r.

Co-authored-by: Orca <help@stably.ai>

* Extract prepareWslRuntimeSeedConfig and pin UNC->Linux anchor in tests

The e2e seed test's mocked WSL home is a plain local path, so the
parseWslUncPath linuxPath branch was never exercised. Extract the seed
preparation as a pure exported function and cover both UNC spellings
(wsl.localhost and wsl$) with hardcoded literals.

Co-authored-by: Orca <help@stably.ai>

---------

Co-authored-by: Orca <help@stably.ai>

src/main/codex/codex-config-mirror.test.ts

@@ -23,7 +23,10 @@ vi.mock('node:os', async () => {
   }
 })
 
-import { syncSystemConfigIntoManagedCodexHome } from './codex-config-mirror'
+import {
+  prepareSystemConfigForFreshRuntimeMirror,
+  syncSystemConfigIntoManagedCodexHome
+} from './codex-config-mirror'
 
 let fakeHomeDir: string
 let userDataDir: string
@@ -397,3 +400,32 @@ describe('syncSystemConfigIntoManagedCodexHome', () => {
     expect(existsSync(getRuntimeConfigPath())).toBe(false)
   })
 })
+
+describe('prepareSystemConfigForFreshRuntimeMirror', () => {
+  it('rewrites relative paths against a Linux-side home and strips hook trust', () => {
+    const prepared = prepareSystemConfigForFreshRuntimeMirror(
+      [
+        'model_instructions_file = "instructions.md"',
+        '',
+        '[features]',
+        'codex_hooks = true',
+        '',
+        '[hooks.state."system-hooks:stop:0:0"]',
+        'enabled = true',
+        '',
+        '[projects."/home/alice/repo"]',
+        'trust_level = "trusted"',
+        ''
+      ].join('\r\n'),
+      '/home/alice/.codex'
+    )
+
+    // Why: WSL configs are consumed inside the distro, so rewrites must use
+    // posix join semantics regardless of the host platform.
+    expect(prepared).toContain("model_instructions_file = '/home/alice/.codex/instructions.md'")
+    expect(prepared).toContain('hooks = true')
+    expect(prepared).not.toContain('codex_hooks')
+    expect(prepared).toContain('[projects."/home/alice/repo"]')
+    expect(prepared).not.toContain('[hooks.state."system-hooks:stop:0:0"]')
+  })
+})

src/main/codex/codex-config-mirror.ts

@@ -35,17 +35,19 @@ function syncSystemConfigIntoManagedCodexHomeUnsafe(): void {
     return
   }
 
-  const systemConfig = prepareSystemConfigForRuntimeMirror(
-    systemConfigExists ? readFileSync(systemConfigPath, 'utf-8') : '',
-    dirname(systemConfigPath)
-  )
+  const rawSystemConfig = systemConfigExists ? readFileSync(systemConfigPath, 'utf-8') : ''
   if (!runtimeConfigExists) {
-    // Why: trust blocks reference a hooks.json path, so system-home hook trust
-    // entries are not valid in Orca's runtime CODEX_HOME until install remaps them.
-    writeFileAtomically(runtimeConfigPath, stripRuntimeOwnedTomlSections(systemConfig))
+    writeFileAtomically(
+      runtimeConfigPath,
+      prepareSystemConfigForFreshRuntimeMirror(rawSystemConfig, dirname(systemConfigPath))
+    )
     return
   }
 
+  const systemConfig = prepareSystemConfigForRuntimeMirror(
+    rawSystemConfig,
+    dirname(systemConfigPath)
+  )
   const runtimeConfig = readFileSync(runtimeConfigPath, 'utf-8')
   const mergedConfig = mergeSystemCodexConfigIntoRuntime(runtimeConfig, systemConfig)
   if (mergedConfig !== runtimeConfig) {
@@ -60,6 +62,17 @@ function prepareSystemConfigForRuntimeMirror(config: string, systemConfigDir: st
   )
 }
 
+// Why: trust blocks reference a hooks.json path, so system-home hook trust
+// entries are not valid in a fresh runtime CODEX_HOME until install remaps
+// them. Also seeds WSL runtime homes, where systemConfigDir must be the
+// Linux-side ~/.codex the config resolves against inside the distro.
+export function prepareSystemConfigForFreshRuntimeMirror(
+  config: string,
+  systemConfigDir: string
+): string {
+  return stripRuntimeOwnedTomlSections(prepareSystemConfigForRuntimeMirror(config, systemConfigDir))
+}
+
 function normalizeDeprecatedCodexHookFeatureFlag(config: string): string {
   if (!config.includes('codex_hooks')) {
     return config
@@ -71,7 +84,9 @@ function normalizeDeprecatedCodexHookFeatureFlag(config: string): string {
 
   for (let index = 0; index <= lines.length; index += 1) {
     const line = lines[index]
-    const isHeader = line === undefined || /^[ \t]*\[[^\]]+\][ \t]*(?:#.*)?$/.test(line)
+    // Why: CRLF configs keep a trailing \r after the split, so header anchors
+    // must tolerate it or Windows-shaped configs skip normalization entirely.
+    const isHeader = line === undefined || /^[ \t]*\[[^\]]+\][ \t]*(?:#.*)?\r?$/.test(line)
     if (!isHeader) {
       continue
     }
@@ -80,7 +95,7 @@ function normalizeDeprecatedCodexHookFeatureFlag(config: string): string {
       featureSections.push({ start: featureStart, end: index })
       featureStart = null
     }
-    if (line !== undefined && /^[ \t]*\[features\][ \t]*(?:#.*)?$/.test(line)) {
+    if (line !== undefined && /^[ \t]*\[features\][ \t]*(?:#.*)?\r?$/.test(line)) {
       featureStart = index
     }
   }