[Bug]: History sync ignores CODEX_SQLITE_HOME in Windows Desktop + WSL split-home layout

[Ted151951]

Client or integration

Codex App

Area

Platform (Windows / Linux / WSL); Codex history integration

Summary

OpenCodex 2.11.1 ignores Codex's split SQLite location in the Windows Codex Desktop + WSL app-server layout.

Codex runs with a Windows-mounted main home while keeping SQLite-backed state on the WSL-native filesystem:

CODEX_HOME=/mnt/c/Users/<windows-user>/.codex
CODEX_SQLITE_HOME=/home/<wsl-user>/.codex/sqlite

The active state_5.sqlite is under CODEX_SQLITE_HOME, but OpenCodex history code derives it as $CODEX_HOME/state_5.sqlite. History sync/restore can therefore inspect or mutate an obsolete, empty, or unrelated database.

Expected: all state-database consumers should use one resolver with Codex-compatible precedence: sqlite_home config, then CODEX_SQLITE_HOME, then effective CODEX_HOME.

Reproduction

1. Run Windows Codex Desktop with the agent in WSL2 and this split layout:

   export CODEX_HOME=/mnt/c/Users/<windows-user>/.codex
   export CODEX_SQLITE_HOME=/home/<wsl-user>/.codex/sqlite

2. Confirm $CODEX_SQLITE_HOME/state_5.sqlite contains the current threads table.

3. Leave an empty or stale $HOME/.codex/state_5.sqlite or $CODEX_HOME/state_5.sqlite.

4. Run an OpenCodex history operation such as restore/uninstall while syncResumeHistory is enabled.

5. Observe that OpenCodex selects the stale database rather than the active database and fails on the missing schema.

Current code evidence:

const STATE_DB_PATH = join(CODEX_HOME, "state_5.sqlite");

A source search in 2.11.1 finds no handling for CODEX_SQLITE_HOME or the sqlite_home Codex option. The Linux service builder also does not propagate an explicitly supplied CODEX_SQLITE_HOME.

The public Codex environment reference documents the split state location and precedence:
https://learn.chatgpt.com/docs/config-file/environment-variables

Version

2.11.1

Operating system

Windows 11 with WSL2 / Ubuntu; Codex Desktop agent mode set to WSL

Logs or error output

no such table: threads

Observed paths:

/mnt/c/Users/<windows-user>/.codex/config.toml
/home/<wsl-user>/.codex/sqlite/state_5.sqlite   # active
/home/<wsl-user>/.codex/state_5.sqlite          # obsolete, 0 bytes

Redacted configuration

{
  "CODEX_HOME": "/mnt/c/Users/<windows-user>/.codex",
  "CODEX_SQLITE_HOME": "/home/<wsl-user>/.codex/sqlite",
  "syncResumeHistory": true
}

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.

Safety and relationship

syncResumeHistory: false avoids the unsafe history path until fixed, at the cost of disabling history remapping.

Follow-up to #63. Companion service ownership issue: #1400.

[github-actions]

Issue reopened

The report now contains the information required by the automated check. Thanks for updating it.

[Ingwannu]

Confirmed on current dev. History defaults still bind state_5.sqlite to CODEX_HOME, and the history job independently rebuilds the same path. Neither path honors sqlite_home or CODEX_SQLITE_HOME.

I will add one call-time SQLite-state resolver with Codex-compatible precedence:

1. root sqlite_home from the effective Codex config.toml;
2. CODEX_SQLITE_HOME;
3. the effective CODEX_HOME.

Relative SQLite homes will resolve from the current working directory, matching the documented Codex contract. The history provider/job, admission snapshot, and native-residue checks will share that resolver so the safety checks and the writer address the same database. Regression coverage will verify precedence, relative paths, call-time environment changes, and that history targets/backup identity follow the selected database. I will not broaden this patch into storage-retention policy for a second root; that needs a separate design because cleanup ownership is wider than history synchronization.

[Ingwannu]

Implemented in draft PR #1425: #1425

The fix centralizes Codex-compatible SQLite-home precedence and makes history, admission, native-residue checks, and durable service launchers address the same state database. Focused changed-path coverage passed; the PR records the CPU-limited full-suite timeout evidence and the unrelated codex-shim failure reproduced on clean origin/dev.

Leaving this issue open until the PR is independently reviewed and integrated into dev.