diff --git a/Cargo.lock b/Cargo.lock
index aff3472a0..4e0c5a18b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -560,7 +560,7 @@ dependencies = [
 
 [[package]]
 name = "codex-update-manager"
-version = "0.9.7"
+version = "0.10.0"
 dependencies = [
  "anyhow",
  "chrono",
diff --git a/docs/launcher-performance.md b/docs/launcher-performance.md
index 0575c656d..8d93bd439 100644
--- a/docs/launcher-performance.md
+++ b/docs/launcher-performance.md
@@ -111,9 +111,16 @@ runs with stdout/stderr detached (`>/dev/null 2>&1`), which cut the
 caller pipe — an orphaned `sleep` holding an inherited fd blocks command
 substitution until it exits.
 
-The default preflight remains asynchronous; `CODEX_SYNC_CLI_PREFLIGHT=1` still
-opts into the existing synchronous check while preserving fail-soft behavior for
-a CLI that is not known broken. A detected npm-managed CLI missing
+The default update/version preflight remains asynchronous, but every generated
+launcher first runs its bundled synchronous, execution-free trust check. This
+applies to native packages with or without the updater, AppImage, Nix, and
+user-local installs, without depending on the version of any system updater. A
+managed standalone CLI that fails this check blocks startup before any CLI
+version probe; a successful check pins launch to the canonical verified release
+binary so replacement of its visible symlink cannot redirect execution.
+`CODEX_SYNC_CLI_PREFLIGHT=1` still opts into the full synchronous check while
+preserving fail-soft behavior for a CLI that is not known broken. A detected
+npm-managed CLI missing
 `@openai/codex-linux-x64` or `@openai/codex-linux-arm64` is the blocking
 exception: Electron cannot use that CLI, so the launcher waits for one repair
 attempt. The updater's initial and post-repair CLI version probes are each
diff --git a/docs/updater.md b/docs/updater.md
index f1a60e5fd..e35b6c3a7 100644
--- a/docs/updater.md
+++ b/docs/updater.md
@@ -20,6 +20,73 @@ installs continue to update through npm, while official standalone installs
 under `~/.codex/packages/standalone` are updated with the official standalone
 installer instead of being replaced through npm.
 
+The updater scopes permission hardening to the official standalone installer
+process. New managed releases use the caller's existing umask plus the
+group/world write restrictions from `0022`; stricter policies such as `0027`
+and `0077` remain intact, and the launcher, Electron, app-server, hooks, and
+unrelated child processes keep the caller's original mask.
+
+Before executing a managed standalone CLI, the updater verifies that its tree
+and canonical parent chain are owned by the current user or root and are not
+group/world-writable (apart from root-owned sticky directories such as
+`/tmp`). Every generated launcher performs the same trust-only check through a
+bundled helper before any CLI version probe, including AppImage and native
+packages built without the updater. The helper executes the returned canonical
+release binary rather than a replaceable visible symlink and does not depend on
+an installed updater version. An unsafe tree is rejected without
+executing it, changing its modes, or deleting it; updater state records a
+failed preflight with clean-reinstall guidance.
+
+To recover, stop any active updater or Codex installer, remove the rejected
+`~/.codex/packages/standalone` tree, and run:
+
+```bash
+codex-update-manager recover-standalone-cli --print-path
+```
+
+If the standalone installer link belongs in a non-default directory, add
+`--install-dir /absolute/path/to/bin`. If the recorded standalone home is not
+the default `~/.codex`, also add `--codex-home /absolute/path/to/codex-home`.
+Recovery refuses to overwrite any
+existing standalone tree. It downloads the official installer and runs only
+that child with the caller's umask plus the `0022` write restrictions, so the
+flow remains safe even when the desktop session uses `umask 0002`. Before the
+download, recovery removes group/world write access from existing
+current-user-owned directories below `$HOME` along both installer paths (for
+example `.codex`, `packages`, `.local`, and `bin`) and rejects symlinks,
+untrusted ownership, or unsafe ancestors it cannot safely narrow. Automatic
+standalone updates reject an unsafe visible-command directory before
+downloading or spawning the installer. Both update and recovery resolve the
+installer shell, downloader, and child commands only from root-controlled
+system tool directories; they never reuse programs already present in a
+formerly writable user directory. Do not run the official installer directly
+for this recovery: it would inherit the ambient mask. Removing write bits from
+the rejected standalone tree or its command directory is not sufficient because
+their contents may already have been modified.
+
+AppImage, Nix, and native packages built without the updater do not provide the
+recovery command. On those formats, either temporarily install an updater-enabled
+native package and use the command above, or remove the rejected standalone tree
+and reinstall the CLI from a verified package channel into a fresh path whose
+files and canonical ancestors are owned by the current user or root and are not
+group/world-writable. Do not reuse the rejected tree, and do not rerun the
+standalone installer under an ambient `0002` mask.
+
+An npm CLI whose canonical executable or ancestors are already group/world-
+writable is also rejected because its pathname cannot be pinned safely against
+replacement. Do not reinstall into that existing prefix. Remove the rejected
+Codex package tree, then use a fresh dedicated prefix such as
+`(umask 0022; npm i -g --include=optional --prefix ~/.codex-cli-npm
+@openai/codex)`; the launcher and updater both discover that prefix.
+
+After a managed standalone tree is first detected, launcher and updater trust
+checks record its home in `~/.codex-standalone-provenance`, outside the managed
+tree. That durable record keeps standalone provenance active even if the tree or
+visible command has already been replaced. To switch installation channels
+intentionally, remove both the standalone tree and this provenance file;
+otherwise an external replacement is rejected rather than silently reclassified
+as npm- or system-managed.
+
 System-package-managed CLI installs are reused but not mutated through npm or
 the standalone installer flow. On Arch-like hosts, when the resolved CLI lives
 under a system bin directory and `pacman -Qo` confirms package ownership, the
diff --git a/install.sh b/install.sh
index 03e8f20b2..b3bc1865d 100755
--- a/install.sh
+++ b/install.sh
@@ -225,6 +225,7 @@ SCRIPT
 
     chmod +x "$INSTALL_DIR/start.sh"
     mkdir -p "$INSTALL_DIR/.codex-linux"
+    cp "$SCRIPT_DIR/launcher/cli-launch-path.py" "$INSTALL_DIR/.codex-linux/cli-launch-path.py"
     cp "$SCRIPT_DIR/launcher/webview-server.py" "$INSTALL_DIR/.codex-linux/webview-server.py"
     local linux_icon_source="$LINUX_ICON_SOURCE"
     [ -f "$linux_icon_source" ] || linux_icon_source="$ICON_SOURCE"
diff --git a/launcher/cli-launch-path.py b/launcher/cli-launch-path.py
new file mode 100644
index 000000000..6bbd46ea6
--- /dev/null
+++ b/launcher/cli-launch-path.py
@@ -0,0 +1,297 @@
+#!/usr/bin/env python3
+"""Resolve a Codex CLI path without executing an untrusted standalone tree."""
+
+from __future__ import annotations
+
+import os
+import shutil
+import stat
+import sys
+import tempfile
+from pathlib import Path
+from typing import Optional
+
+
+class TrustError(RuntimeError):
+    pass
+
+
+PROVENANCE_FILE = ".codex-standalone-provenance"
+
+
+def standalone_home_from_path(path: Path) -> Optional[Path]:
+    parts = path.parts
+    for index in range(len(parts) - 2):
+        if parts[index : index + 2] != ("packages", "standalone"):
+            continue
+        if parts[index + 2] not in ("current", "releases"):
+            continue
+        if index == 0:
+            return None
+        return Path(*parts[:index])
+    return None
+
+
+def unresolved_symlink_target(path: Path) -> Optional[Path]:
+    try:
+        target = Path(os.readlink(path))
+    except OSError:
+        return None
+    if not target.is_absolute():
+        target = path.parent / target
+    return Path(os.path.abspath(target))
+
+
+def path_is_within(path: Path, root: Path) -> bool:
+    try:
+        path.relative_to(root)
+    except ValueError:
+        return False
+    return True
+
+
+def trusted_owner(uid: int) -> bool:
+    return uid in (os.geteuid(), 0)
+
+
+def validate_parent_chain(path: Path, subject: str) -> None:
+    parent = path.parent
+    while True:
+        metadata = parent.lstat()
+        if not stat.S_ISDIR(metadata.st_mode) or stat.S_ISLNK(metadata.st_mode):
+            raise TrustError(
+                f"{subject} ancestor {parent} is not a trusted directory"
+            )
+        if not trusted_owner(metadata.st_uid):
+            raise TrustError(
+                f"{subject} ancestor {parent} is owned by untrusted uid {metadata.st_uid}"
+            )
+        writable = metadata.st_mode & 0o022
+        root_owned_sticky = (
+            metadata.st_uid == 0
+            and metadata.st_mode & stat.S_ISVTX
+            and metadata.st_mode & 0o002
+        )
+        if writable and not root_owned_sticky:
+            raise TrustError(
+                f"{subject} ancestor {parent} is group/world-writable and therefore untrusted"
+            )
+        if parent.parent == parent:
+            break
+        parent = parent.parent
+
+
+def validate_cli_target(lexical_path: Path, canonical_path: Path) -> Path:
+    canonical_path = validate_cli_identity(lexical_path, canonical_path)
+    validate_parent_chain(lexical_path, "Selected Codex CLI")
+    return canonical_path
+
+
+def validate_cli_identity(lexical_path: Path, canonical_path: Path) -> Path:
+    entry_metadata = lexical_path.lstat()
+    if not trusted_owner(entry_metadata.st_uid):
+        raise TrustError(
+            f"Selected Codex CLI entry {lexical_path} is owned by untrusted uid {entry_metadata.st_uid}"
+        )
+    target_metadata = canonical_path.stat()
+    if not stat.S_ISREG(target_metadata.st_mode) or not os.access(canonical_path, os.X_OK):
+        raise TrustError(f"Selected Codex CLI target {canonical_path} is not an executable file")
+    if not trusted_owner(target_metadata.st_uid):
+        raise TrustError(
+            f"Selected Codex CLI target {canonical_path} is owned by untrusted uid {target_metadata.st_uid}"
+        )
+    if target_metadata.st_mode & 0o022:
+        raise TrustError(
+            f"Selected Codex CLI target {canonical_path} is group/world-writable and therefore untrusted"
+        )
+    validate_parent_chain(canonical_path, "Selected Codex CLI target")
+    return canonical_path
+
+
+def validate_standalone_tree(standalone_root: Path) -> Path:
+    root_metadata = standalone_root.lstat()
+    if not stat.S_ISDIR(root_metadata.st_mode) or stat.S_ISLNK(root_metadata.st_mode):
+        raise TrustError(
+            f"Managed standalone Codex CLI root {standalone_root} is not a trusted directory"
+        )
+
+    canonical_root = standalone_root.resolve(strict=True)
+    validate_parent_chain(canonical_root, "Managed standalone Codex CLI")
+
+    pending = [standalone_root]
+    while pending:
+        path = pending.pop()
+        metadata = path.lstat()
+        if stat.S_ISLNK(metadata.st_mode):
+            try:
+                target = path.resolve(strict=True)
+            except OSError as error:
+                raise TrustError(
+                    f"Managed standalone Codex CLI contains a broken symlink at {path}"
+                ) from error
+            if not path_is_within(target, canonical_root):
+                raise TrustError(
+                    f"Managed standalone Codex CLI contains an external symlink at {path}"
+                )
+            continue
+
+        if not (stat.S_ISDIR(metadata.st_mode) or stat.S_ISREG(metadata.st_mode)):
+            raise TrustError(
+                f"Managed standalone Codex CLI contains an unsupported file type at {path}"
+            )
+        if not trusted_owner(metadata.st_uid):
+            raise TrustError(
+                f"Managed standalone Codex CLI path {path} is owned by untrusted uid {metadata.st_uid}"
+            )
+        if metadata.st_mode & 0o022:
+            raise TrustError(
+                f"Managed standalone Codex CLI path {path} is group/world-writable and therefore untrusted"
+            )
+        if stat.S_ISDIR(metadata.st_mode):
+            pending.extend(path.iterdir())
+
+    return canonical_root
+
+
+def existing_default_standalone_home() -> Optional[Path]:
+    raw_codex_home = os.environ.get("CODEX_HOME")
+    if raw_codex_home:
+        codex_home = Path(raw_codex_home)
+    else:
+        raw_home = os.environ.get("HOME")
+        if not raw_home:
+            return None
+        codex_home = Path(raw_home) / ".codex"
+    try:
+        (codex_home / "packages" / "standalone").lstat()
+    except OSError:
+        return None
+    return codex_home
+
+
+def provenance_path() -> Optional[Path]:
+    raw_home = os.environ.get("HOME")
+    if not raw_home:
+        return None
+    try:
+        canonical_home = Path(raw_home).resolve(strict=True)
+    except OSError as error:
+        raise TrustError(f"Failed to resolve HOME for standalone CLI provenance: {error}") from error
+    return canonical_home / PROVENANCE_FILE
+
+
+def read_standalone_provenance() -> Optional[Path]:
+    path = provenance_path()
+    if path is None:
+        return None
+    try:
+        metadata = path.lstat()
+    except FileNotFoundError:
+        return None
+    if not stat.S_ISREG(metadata.st_mode) or stat.S_ISLNK(metadata.st_mode):
+        raise TrustError(f"Standalone Codex CLI provenance {path} is not a regular file")
+    if not trusted_owner(metadata.st_uid) or metadata.st_mode & 0o022:
+        raise TrustError(f"Standalone Codex CLI provenance {path} is not trusted")
+    validate_parent_chain(path, "Standalone Codex CLI provenance")
+    value = path.read_text(encoding="utf-8").strip()
+    codex_home = Path(value)
+    if not value or not codex_home.is_absolute():
+        raise TrustError(f"Standalone Codex CLI provenance {path} is invalid")
+    return codex_home
+
+
+def record_standalone_provenance(codex_home: Path, lexical_cli: Path) -> None:
+    path = provenance_path()
+    if path is None:
+        return
+    entry_metadata = lexical_cli.lstat()
+    if not trusted_owner(entry_metadata.st_uid):
+        raise TrustError(
+            f"Selected Codex CLI entry {lexical_cli} is owned by untrusted uid {entry_metadata.st_uid}"
+        )
+    validate_parent_chain(path, "Standalone Codex CLI provenance")
+    with tempfile.NamedTemporaryFile(
+        mode="w", encoding="utf-8", dir=path.parent, prefix=f".{PROVENANCE_FILE}.", delete=False
+    ) as handle:
+        temp_path = Path(handle.name)
+        os.chmod(temp_path, 0o600)
+        handle.write(f"{codex_home}\n")
+        handle.flush()
+        os.fsync(handle.fileno())
+    try:
+        os.replace(temp_path, path)
+        directory_fd = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
+        try:
+            os.fsync(directory_fd)
+        finally:
+            os.close(directory_fd)
+    finally:
+        try:
+            temp_path.unlink()
+        except FileNotFoundError:
+            pass
+
+
+def resolve_cli_launch_path(raw_path: str) -> Path:
+    if os.sep not in raw_path:
+        discovered = shutil.which(raw_path)
+        if discovered is None:
+            raise TrustError(f"Codex CLI command {raw_path!r} was not found in PATH")
+        selected_path = Path(discovered)
+    else:
+        selected_path = Path(raw_path)
+    lexical_path = Path(os.path.abspath(selected_path))
+    try:
+        canonical_cli = selected_path.resolve(strict=True)
+    except OSError as error:
+        raise TrustError(f"Failed to resolve Codex CLI path {selected_path}: {error}") from error
+    candidates = [canonical_cli, lexical_path]
+    raw_target = unresolved_symlink_target(lexical_path)
+    if raw_target is not None:
+        candidates.append(raw_target)
+
+    detected_home = next(
+        (home for candidate in candidates if (home := standalone_home_from_path(candidate))),
+        None,
+    )
+    if detected_home is None:
+        detected_home = existing_default_standalone_home()
+    codex_home = read_standalone_provenance()
+    if codex_home is None:
+        if detected_home is None:
+            return validate_cli_identity(lexical_path, canonical_cli)
+        codex_home = detected_home
+    elif detected_home is not None and detected_home != codex_home:
+        raise TrustError(
+            f"Selected Codex CLI provenance {detected_home} conflicts with recorded standalone home {codex_home}"
+        )
+
+    def validate_selection() -> Path:
+        canonical_root = validate_standalone_tree(codex_home / "packages" / "standalone")
+        if not path_is_within(canonical_cli, canonical_root):
+            raise TrustError(
+                f"Managed standalone Codex CLI path {selected_path} resolves outside its trusted root"
+            )
+        return validate_cli_target(lexical_path, canonical_cli)
+
+    launch_path = validate_selection()
+    if read_standalone_provenance() is None:
+        record_standalone_provenance(codex_home, lexical_path)
+        launch_path = validate_selection()
+    return launch_path
+
+
+def main() -> int:
+    if len(sys.argv) != 2 or not sys.argv[1]:
+        print(f"usage: {Path(sys.argv[0]).name} CLI_PATH", file=sys.stderr)
+        return 64
+    try:
+        print(resolve_cli_launch_path(sys.argv[1]))
+    except (OSError, TrustError) as error:
+        print(f"Codex CLI trust check failed: {error}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/launcher/start.sh.template b/launcher/start.sh.template
index 34ba98b4a..15c4761e2 100644
--- a/launcher/start.sh.template
+++ b/launcher/start.sh.template
@@ -1497,6 +1497,23 @@ run_cli_preflight_background() {
     ) &
 }
 
+run_cli_launch_path_helper() {
+    python3 "$SCRIPT_DIR/.codex-linux/cli-launch-path.py" "$1"
+}
+
+verify_cli_launch_path() {
+    local verified_path=""
+    if ! verified_path="$(run_cli_launch_path_helper "$CODEX_CLI_PATH")"; then
+        return 1
+    fi
+    if [ -z "$verified_path" ]; then
+        return 1
+    fi
+
+    CODEX_CLI_PATH="$verified_path"
+    export CODEX_CLI_PATH
+}
+
 is_interactive_terminal() {
     [ "$LAUNCHER_INTERACTIVE_TERMINAL" -eq 1 ] && [ -r /dev/tty ] && [ -w /dev/tty ]
 }
@@ -1639,6 +1656,7 @@ find_codex_cli() {
     for candidate in \
         "$(cached_codex_cli_path || true)" \
         "$HOME/.bun/bin/codex" \
+        "$HOME/.codex-cli-npm/bin/codex" \
         "$HOME/.npm-global/bin/codex" \
         "${XDG_CONFIG_HOME:-$HOME/.config}/nvm/versions/node/current/bin/codex" \
         "${XDG_CONFIG_HOME:-$HOME/.config}/nvm/versions/node"/*/bin/codex \
@@ -4180,21 +4198,29 @@ if needs_cold_start && [ -z "$CODEX_CLI_PATH" ]; then
     if is_interactive_terminal; then
         if prompt_install_missing_cli; then
             if ! run_cli_preflight 1; then
-                notify_error "Codex CLI installation was attempted but did not succeed. Retry by reopening the app, or install it manually with: npm i -g --include=optional @openai/codex or npm i -g --include=optional --prefix ~/.local @openai/codex"
+                notify_error "Codex CLI installation was attempted but did not succeed. Retry by reopening the app, or install into a fresh safe prefix: (umask 0022; npm i -g --include=optional --prefix ~/.codex-cli-npm @openai/codex)"
                 exit 1
             fi
         fi
     elif ! run_gui_cli_prompt; then
-        notify_error "Codex CLI is required but is not installed. Reopen the app to retry the automatic install flow, or install it manually with: npm i -g --include=optional @openai/codex or npm i -g --include=optional --prefix ~/.local @openai/codex"
+        notify_error "Codex CLI is required but is not installed. Reopen the app to retry the automatic install flow, or install into a fresh safe prefix: (umask 0022; npm i -g --include=optional --prefix ~/.codex-cli-npm @openai/codex)"
         exit 1
     fi
 fi
 
 if needs_cold_start && [ -z "$CODEX_CLI_PATH" ]; then
-    notify_error "Codex CLI is required but is not installed. Reopen the app to retry the automatic install flow, or install it manually with: npm i -g --include=optional @openai/codex or npm i -g --include=optional --prefix ~/.local @openai/codex"
+    notify_error "Codex CLI is required but is not installed. Reopen the app to retry the automatic install flow, or install into a fresh safe prefix: (umask 0022; npm i -g --include=optional --prefix ~/.codex-cli-npm @openai/codex)"
     exit 1
 fi
 
+if [ -n "$CODEX_CLI_PATH" ]; then
+    if ! verify_cli_launch_path; then
+        notify_error "The selected Codex CLI failed its execution-free trust check and will not be executed. If it is a rejected managed standalone install, stop active Codex installers and remove its standalone tree. Updater-enabled native packages can then run: codex-update-manager recover-standalone-cli --print-path. With AppImage, Nix, or updaterless packages, reinstall from a verified package channel into a fresh path owned by you or root with no group/world-writable file or parent directory; do not reuse the rejected tree. To switch away from standalone intentionally, also remove ~/.codex-standalone-provenance."
+        exit 1
+    fi
+    log_phase "cli_launch_path_verified"
+fi
+
 if needs_cold_start; then
     cli_repair_required=0
     if codex_cli_missing_optional_dependency "$CODEX_CLI_PATH"; then
diff --git a/scripts/ci/container-entrypoint.sh b/scripts/ci/container-entrypoint.sh
index 0687ca5f7..d0b389f29 100755
--- a/scripts/ci/container-entrypoint.sh
+++ b/scripts/ci/container-entrypoint.sh
@@ -274,12 +274,14 @@ run_deb_job() {
     assert_contains_file /tmp/deb-contents.txt './usr/lib/systemd/user/codex-update-manager.service'
     assert_contains_file /tmp/deb-contents.txt './opt/codex-desktop/update-builder/install.sh'
     assert_contains_file /tmp/deb-contents.txt './opt/codex-desktop/update-builder/launcher/webview-server.py'
+    assert_contains_file /tmp/deb-contents.txt './opt/codex-desktop/update-builder/launcher/cli-launch-path.py'
     assert_contains_file /tmp/deb-contents.txt './opt/codex-desktop/update-builder/scripts/lib/upstream-dmg-intel.js'
     assert_contains_file /tmp/deb-contents.txt './opt/codex-desktop/update-builder/scripts/lib/patch-browser-client-iab-socket-scope.js'
     assert_contains_file /tmp/deb-contents.txt './opt/codex-desktop/update-builder/scripts/lib/upstream-dmg-acceptance.js'
     assert_contains_file /tmp/deb-contents.txt './opt/codex-desktop/update-builder/scripts/lib/candidate-promotion.py'
     assert_contains_file /tmp/deb-contents.txt './opt/codex-desktop/update-builder/scripts/validate-upstream-dmg.js'
     assert_contains_file /tmp/deb-contents.txt './opt/codex-desktop/.codex-linux/codex-packaged-runtime.sh'
+    assert_contains_file /tmp/deb-contents.txt './opt/codex-desktop/.codex-linux/cli-launch-path.py'
 
     rm -rf dist
     CARGO_TARGET_DIR="$target_dir" \
@@ -300,6 +302,7 @@ run_deb_job() {
     assert_not_contains_file /tmp/deb-no-updater-contents.txt './usr/share/polkit-1/actions/com.github.ilysenko.codex-desktop-linux.update.policy'
     assert_not_contains_file /tmp/deb-no-updater-contents.txt './opt/codex-desktop/update-builder/'
     assert_contains_file /tmp/deb-no-updater-contents.txt './opt/codex-desktop/.codex-linux/codex-packaged-runtime.sh'
+    assert_contains_file /tmp/deb-no-updater-contents.txt './opt/codex-desktop/.codex-linux/cli-launch-path.py'
     assert_contains_file /tmp/deb-no-updater-contents.txt './opt/codex-desktop/.codex-linux/codex-no-updater-transition-cleanup.sh'
     assert_contains_file /tmp/deb-no-updater-payload/opt/codex-desktop/.codex-linux/codex-no-updater-transition-cleanup.sh 'codex_no_updater_cleanup_user_enablement_links'
     assert_contains_file /tmp/deb-no-updater-payload/opt/codex-desktop/.codex-linux/codex-no-updater-transition-cleanup.sh 'default.target.wants'
@@ -334,12 +337,14 @@ run_rpm_job() {
     assert_contains_file /tmp/rpm-contents.txt '/usr/lib/systemd/user/codex-update-manager.service'
     assert_contains_file /tmp/rpm-contents.txt '/opt/codex-desktop/update-builder/install.sh'
     assert_contains_file /tmp/rpm-contents.txt '/opt/codex-desktop/update-builder/launcher/webview-server.py'
+    assert_contains_file /tmp/rpm-contents.txt '/opt/codex-desktop/update-builder/launcher/cli-launch-path.py'
     assert_contains_file /tmp/rpm-contents.txt '/opt/codex-desktop/update-builder/scripts/lib/upstream-dmg-intel.js'
     assert_contains_file /tmp/rpm-contents.txt '/opt/codex-desktop/update-builder/scripts/lib/patch-browser-client-iab-socket-scope.js'
     assert_contains_file /tmp/rpm-contents.txt '/opt/codex-desktop/update-builder/scripts/lib/upstream-dmg-acceptance.js'
     assert_contains_file /tmp/rpm-contents.txt '/opt/codex-desktop/update-builder/scripts/lib/candidate-promotion.py'
     assert_contains_file /tmp/rpm-contents.txt '/opt/codex-desktop/update-builder/scripts/validate-upstream-dmg.js'
     assert_contains_file /tmp/rpm-contents.txt '/opt/codex-desktop/.codex-linux/codex-packaged-runtime.sh'
+    assert_contains_file /tmp/rpm-contents.txt '/opt/codex-desktop/.codex-linux/cli-launch-path.py'
 
     rm -rf dist
     CARGO_TARGET_DIR="$target_dir" \
@@ -356,6 +361,7 @@ run_rpm_job() {
     assert_not_contains_file /tmp/rpm-no-updater-contents.txt '/usr/share/polkit-1/actions/com.github.ilysenko.codex-desktop-linux.update.policy'
     assert_not_contains_file /tmp/rpm-no-updater-contents.txt '/opt/codex-desktop/update-builder/'
     assert_contains_file /tmp/rpm-no-updater-contents.txt '/opt/codex-desktop/.codex-linux/codex-packaged-runtime.sh'
+    assert_contains_file /tmp/rpm-no-updater-contents.txt '/opt/codex-desktop/.codex-linux/cli-launch-path.py'
     assert_contains_file /tmp/rpm-no-updater-contents.txt '/opt/codex-desktop/.codex-linux/codex-no-updater-transition-cleanup.sh'
     assert_contains_file /tmp/rpm-no-updater-scripts.txt 'codex_no_updater_cleanup_update_manager_service'
     assert_not_contains_file /tmp/rpm-no-updater-scripts.txt 'update-builder'
@@ -388,12 +394,14 @@ run_pacman_job() {
     assert_contains_file /tmp/pacman-contents.txt 'usr/lib/systemd/user/codex-update-manager.service'
     assert_contains_file /tmp/pacman-contents.txt 'opt/codex-desktop/update-builder/install.sh'
     assert_contains_file /tmp/pacman-contents.txt 'opt/codex-desktop/update-builder/launcher/webview-server.py'
+    assert_contains_file /tmp/pacman-contents.txt 'opt/codex-desktop/update-builder/launcher/cli-launch-path.py'
     assert_contains_file /tmp/pacman-contents.txt 'opt/codex-desktop/update-builder/scripts/lib/upstream-dmg-intel.js'
     assert_contains_file /tmp/pacman-contents.txt 'opt/codex-desktop/update-builder/scripts/lib/patch-browser-client-iab-socket-scope.js'
     assert_contains_file /tmp/pacman-contents.txt 'opt/codex-desktop/update-builder/scripts/lib/upstream-dmg-acceptance.js'
     assert_contains_file /tmp/pacman-contents.txt 'opt/codex-desktop/update-builder/scripts/lib/candidate-promotion.py'
     assert_contains_file /tmp/pacman-contents.txt 'opt/codex-desktop/update-builder/scripts/validate-upstream-dmg.js'
     assert_contains_file /tmp/pacman-contents.txt 'opt/codex-desktop/.codex-linux/codex-packaged-runtime.sh'
+    assert_contains_file /tmp/pacman-contents.txt 'opt/codex-desktop/.codex-linux/cli-launch-path.py'
 
     rm -rf dist
     CARGO_TARGET_DIR="$target_dir" \
@@ -411,6 +419,7 @@ run_pacman_job() {
     assert_not_contains_file /tmp/pacman-no-updater-contents.txt 'usr/share/polkit-1/actions/com.github.ilysenko.codex-desktop-linux.update.policy'
     assert_not_contains_file /tmp/pacman-no-updater-contents.txt 'opt/codex-desktop/update-builder/'
     assert_contains_file /tmp/pacman-no-updater-contents.txt 'opt/codex-desktop/.codex-linux/codex-packaged-runtime.sh'
+    assert_contains_file /tmp/pacman-no-updater-contents.txt 'opt/codex-desktop/.codex-linux/cli-launch-path.py'
     assert_contains_file /tmp/pacman-no-updater-contents.txt 'opt/codex-desktop/.codex-linux/codex-no-updater-transition-cleanup.sh'
     assert_contains_file /tmp/pacman-no-updater-cleanup.txt 'codex_no_updater_cleanup_user_enablement_links'
     assert_contains_file /tmp/pacman-no-updater-cleanup.txt 'default.target.wants'
diff --git a/scripts/lib/package-common.sh b/scripts/lib/package-common.sh
index 471599efd..64f257e73 100755
--- a/scripts/lib/package-common.sh
+++ b/scripts/lib/package-common.sh
@@ -804,6 +804,7 @@ stage_update_builder_bundle() {
     cp "$REPO_DIR/install.sh" "$update_builder_root/install.sh"
     cp "$REPO_DIR/CHANGELOG.md" "$update_builder_root/CHANGELOG.md"
     cp "$REPO_DIR/launcher/start.sh.template" "$update_builder_root/launcher/start.sh.template"
+    cp "$REPO_DIR/launcher/cli-launch-path.py" "$update_builder_root/launcher/cli-launch-path.py"
     cp "$REPO_DIR/launcher/webview-server.py" "$update_builder_root/launcher/webview-server.py"
     cp "$REPO_DIR/Cargo.toml" "$update_builder_root/Cargo.toml"
     cp "$REPO_DIR/Cargo.lock" "$update_builder_root/Cargo.lock"
diff --git a/tests/fixtures/create-packaged-app-fixture.sh b/tests/fixtures/create-packaged-app-fixture.sh
index 43e1cb306..c35fb43a1 100755
--- a/tests/fixtures/create-packaged-app-fixture.sh
+++ b/tests/fixtures/create-packaged-app-fixture.sh
@@ -2,11 +2,13 @@
 set -Eeuo pipefail
 
 app_dir="${1:-codex-app}"
+repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 
-mkdir -p "$app_dir/content/webview" "$app_dir/resources/node-runtime/bin"
+mkdir -p "$app_dir/.codex-linux" "$app_dir/content/webview" "$app_dir/resources/node-runtime/bin"
 
 printf '%s\n' '#!/usr/bin/env bash' 'echo "codex desktop fixture"' > "$app_dir/start.sh"
 chmod +x "$app_dir/start.sh"
+cp "$repo_dir/launcher/cli-launch-path.py" "$app_dir/.codex-linux/cli-launch-path.py"
 
 printf '%s\n' '<!doctype html><title>Codex fixture</title>' > "$app_dir/content/webview/index.html"
 
diff --git a/tests/launcher_warm_start_recovery.sh b/tests/launcher_warm_start_recovery.sh
index b40a80a98..9cd3f05d5 100755
--- a/tests/launcher_warm_start_recovery.sh
+++ b/tests/launcher_warm_start_recovery.sh
@@ -121,6 +121,7 @@ PY
 } > "$APP_DIR/start.sh"
 chmod +x "$APP_DIR/start.sh"
 cp "$REPO_DIR/launcher/webview-server.py" "$APP_DIR/.codex-linux/webview-server.py"
+cp "$REPO_DIR/launcher/cli-launch-path.py" "$APP_DIR/.codex-linux/cli-launch-path.py"
 ln -s "$(command -v node)" "$APP_DIR/resources/node-runtime/bin/node"
 printf '%s\n' '<!doctype html><title>Codex</title><div id="startup-loader"></div>' \
     > "$APP_DIR/content/webview/index.html"
diff --git a/tests/scripts_smoke.sh b/tests/scripts_smoke.sh
index aab4d5683..5f489ed75 100755
--- a/tests/scripts_smoke.sh
+++ b/tests/scripts_smoke.sh
@@ -655,6 +655,7 @@ SCRIPT
     assert_file_exists "$pkg_root/opt/codex-desktop/update-builder/node-runtime/bin/node"
     assert_file_exists "$pkg_root/opt/codex-desktop/update-builder/Cargo.toml"
     assert_file_exists "$pkg_root/opt/codex-desktop/update-builder/CHANGELOG.md"
+    assert_file_exists "$pkg_root/opt/codex-desktop/update-builder/launcher/cli-launch-path.py"
     assert_file_exists "$pkg_root/opt/codex-desktop/update-builder/computer-use-linux/Cargo.toml"
     assert_file_exists "$pkg_root/opt/codex-desktop/update-builder/notification-actions-linux/Cargo.toml"
     assert_file_not_exists "$pkg_root/opt/codex-desktop/update-builder/global-dictation-linux/Cargo.toml"
@@ -667,6 +668,7 @@ SCRIPT
         >"$workspace/update-builder-patcher-help.txt"
     assert_contains "$workspace/update-builder-patcher-help.txt" "Usage: patch-linux-window-ui.js"
     assert_file_exists "$pkg_root/opt/codex-desktop/.codex-linux/codex-packaged-runtime.sh"
+    assert_file_exists "$pkg_root/opt/codex-desktop/.codex-linux/cli-launch-path.py"
     assert_contains "$pkg_root/opt/codex-desktop/.codex-linux/codex-packaged-runtime.sh" "is-enabled codex-update-manager.service"
     assert_not_contains "$pkg_root/opt/codex-desktop/.codex-linux/codex-packaged-runtime.sh" "enable --now codex-update-manager.service"
     assert_file_exists "$pkg_root/opt/codex-desktop/.codex-linux/codex-desktop-entry-doctor.sh"
@@ -1049,6 +1051,7 @@ SCRIPT
     assert_file_exists "$pkg_root/DEBIAN/postinst"
     assert_file_exists "$pkg_root/DEBIAN/prerm"
     assert_file_exists "$pkg_root/opt/codex-desktop/.codex-linux/codex-packaged-runtime.sh"
+    assert_file_exists "$pkg_root/opt/codex-desktop/.codex-linux/cli-launch-path.py"
     assert_file_exists "$pkg_root/opt/codex-desktop/.codex-linux/codex-no-updater-transition-cleanup.sh"
     assert_file_not_exists "$pkg_root/usr/bin/codex-update-manager"
     assert_file_not_exists "$pkg_root/usr/lib/systemd/user/codex-update-manager.service"
@@ -1461,6 +1464,7 @@ SCRIPT
     assert_file_exists "$capture_dir/AppDir/usr/share/icons/hicolor/256x256/apps/codex-desktop.png"
     assert_file_exists "$capture_dir/AppDir/opt/codex-desktop/start.sh"
     assert_file_exists "$capture_dir/AppDir/opt/codex-desktop/.codex-linux/codex-desktop.png"
+    assert_file_exists "$capture_dir/AppDir/opt/codex-desktop/.codex-linux/cli-launch-path.py"
     assert_file_exists "$capture_dir/AppDir/opt/codex-desktop/.codex-linux/codex-packaged-runtime.sh"
     assert_file_exists "$capture_dir/AppDir/opt/codex-desktop/resources/node-runtime/bin/node"
     assert_file_exists "$capture_dir/AppDir/opt/codex-desktop/resources/codex-cli/preserve.txt"
@@ -4923,6 +4927,7 @@ test_launcher_rejects_missing_webview_entrypoint() {
     } > "$app_dir/start.sh"
     chmod +x "$app_dir/start.sh"
     cp "$REPO_DIR/launcher/webview-server.py" "$app_dir/.codex-linux/webview-server.py"
+    cp "$REPO_DIR/launcher/cli-launch-path.py" "$app_dir/.codex-linux/cli-launch-path.py"
     ln -s "$(command -v node)" "$app_dir/resources/node-runtime/bin/node"
 
     cat > "$app_dir/electron" <<'SCRIPT'
@@ -5207,9 +5212,11 @@ test_launcher_template_sanity() {
     assert_contains "$REPO_DIR/scripts/lib/native-modules.sh" "CODEX_ELECTRON_CACHE_DIR"
     assert_contains "$REPO_DIR/scripts/lib/native-modules.sh" "--continue-at -"
     assert_file_exists "$REPO_DIR/launcher/webview-server.py"
+    assert_file_exists "$REPO_DIR/launcher/cli-launch-path.py"
     assert_contains "$REPO_DIR/launcher/webview-server.py" "Cache-Control"
     assert_contains "$REPO_DIR/launcher/webview-server.py" "If-Modified-Since"
     assert_contains "$REPO_DIR/install.sh" "webview-server.py"
+    assert_contains "$REPO_DIR/install.sh" "cli-launch-path.py"
     assert_contains "$REPO_DIR/launcher/start.sh.template" 'python3 "$SCRIPT_DIR/.codex-linux/webview-server.py" "$CODEX_LINUX_WEBVIEW_PORT" --bind 127.0.0.1'
     assert_contains "$REPO_DIR/launcher/start.sh.template" "WEBVIEW_PID_FILE"
     assert_contains "$REPO_DIR/launcher/start.sh.template" "owned_webview_server_pid"
@@ -6386,14 +6393,29 @@ esac
 preflight_match = re.search(r"^run_cli_preflight\(\) \{[\s\S]*?^\}\n", source, re.M)
 if preflight_match is None:
     raise SystemExit("missing run_cli_preflight")
-routing_start = source.index('if needs_cold_start; then\n    cli_repair_required=0')
+trust_match = re.search(r"^verify_cli_launch_path\(\) \{[\s\S]*?^\}\n", source, re.M)
+if trust_match is None:
+    raise SystemExit("missing verify_cli_launch_path")
+routing_start = source.index('if [ -n "$CODEX_CLI_PATH" ]; then\n    if ! verify_cli_launch_path')
 routing_end = source.index("\nexport_packaged_runtime_env", routing_start)
+final_version_log = source.index("\nlog_codex_cli_path\n", routing_end)
+electron_launch = source.index("\nlaunch_electron ", final_version_log)
+if not routing_start < routing_end < final_version_log < electron_launch:
+    raise SystemExit("CLI trust gate must precede the final version log and Electron launch")
 pathlib.Path(sys.argv[3]).write_text(
     "#!/usr/bin/env bash\n"
     "set -Eeuo pipefail\n\n"
     + r'''
 CODEX_CLI_PATH=/tmp/codex
 has_update_manager() { [ "${UPDATE_MANAGER_AVAILABLE:-0}" = "1" ]; }
+run_cli_launch_path_helper() {
+    printf 'trust=called\n' >> "$ROUTING_LOG"
+    if [ "${TRUST_RESULT:-success}" = "success" ]; then
+        printf '%s\n' /tmp/verified-codex
+        return 0
+    fi
+    return 1
+}
 run_update_manager() {
     if [ "${UPDATE_MANAGER_RESULT:-failure}" = "success" ]; then
         printf '%s\n' /tmp/repaired-codex
@@ -6403,14 +6425,20 @@ run_update_manager() {
 }
 notify_error() { printf 'notify=%s\n' "$1" >> "$ROUTING_LOG"; }
 log_phase() { printf 'phase=%s\n' "$1" >> "$ROUTING_LOG"; }
-needs_cold_start() { return 0; }
-codex_cli_missing_optional_dependency() { [ "${BROKEN_CLI:-0}" = "1" ]; }
+needs_cold_start() { [ "${COLD_START:-1}" = "1" ]; }
+codex_cli_missing_optional_dependency() {
+    printf 'probe=missing-optional\n' >> "$ROUTING_LOG"
+    [ "${BROKEN_CLI:-0}" = "1" ]
+}
 run_cli_preflight_background() { printf 'background=1\n' >> "$ROUTING_LOG"; }
+log_codex_cli_path() { printf 'version=final\n' >> "$ROUTING_LOG"; }
+launch_electron() { printf 'electron=launch\n' >> "$ROUTING_LOG"; }
 '''
     + preflight_match.group(0)
+    + trust_match.group(0)
     + "\n"
     + source[routing_start:routing_end]
-    + "\n",
+    + "\nlog_codex_cli_path\nlaunch_electron\n",
     encoding="utf-8",
 )
 PY
@@ -6560,6 +6588,28 @@ PY
     fi
 
     local routing_log="$workspace/preflight-routing.log"
+    if env -i PATH="$HOST_TOOL_PATH" ROUTING_LOG="$routing_log" \
+        UPDATE_MANAGER_AVAILABLE=0 TRUST_RESULT=failure BROKEN_CLI=1 \
+        "$routing_probe"; then
+        fail "standalone trust failure must abort launcher startup"
+    fi
+    grep -q '^notify=The selected Codex CLI failed its execution-free trust check' "$routing_log" || \
+        fail "standalone trust failure must show safe recovery guidance"
+    if grep -qE '^(probe=|background=|version=|electron=)' "$routing_log"; then
+        fail "standalone trust failure must block every CLI probe, final version log, and Electron startup"
+    fi
+
+    : > "$routing_log"
+    if env -i PATH="$HOST_TOOL_PATH" ROUTING_LOG="$routing_log" \
+        COLD_START=0 UPDATE_MANAGER_AVAILABLE=0 TRUST_RESULT=failure \
+        "$routing_probe"; then
+        fail "standalone trust failure must also abort second-instance handoff"
+    fi
+    if grep -qE '^(probe=|background=|version=|electron=)' "$routing_log"; then
+        fail "second-instance trust failure must not reach any CLI probe or Electron startup"
+    fi
+
+    : > "$routing_log"
     if env -i PATH="$HOST_TOOL_PATH" ROUTING_LOG="$routing_log" \
         CODEX_SYNC_CLI_PREFLIGHT=1 BROKEN_CLI=1 UPDATE_MANAGER_AVAILABLE=0 \
         "$routing_probe"; then
@@ -6595,6 +6645,102 @@ PY
         fail "healthy default preflight must stay asynchronous"
     grep -qx 'phase=cli_preflight_backgrounded' "$routing_log" || \
         fail "healthy default preflight must record the background path"
+
+    : > "$routing_log"
+    env -i PATH="$HOST_TOOL_PATH" ROUTING_LOG="$routing_log" \
+        BROKEN_CLI=0 UPDATE_MANAGER_AVAILABLE=1 TRUST_RESULT=success \
+        "$routing_probe"
+    grep -qx 'trust=called' "$routing_log" || \
+        fail "native launcher must synchronously validate the selected CLI"
+    grep -qx 'phase=cli_launch_path_verified' "$routing_log" || \
+        fail "successful trust validation must be recorded before normal preflight"
+    grep -qx 'probe=missing-optional' "$routing_log" || \
+        fail "healthy CLI must be probed only after trust validation succeeds"
+    grep -qx 'version=final' "$routing_log" || \
+        fail "successful trust validation must allow the final CLI version log"
+    grep -qx 'electron=launch' "$routing_log" || \
+        fail "successful trust validation must allow Electron startup"
+    [ "$(sed -n '/^trust=called$/=' "$routing_log")" -lt "$(sed -n '/^probe=missing-optional$/=' "$routing_log")" ] || \
+        fail "trust validation must precede every CLI version probe"
+
+    local trust_workspace="$workspace/standalone-trust"
+    local codex_home="$trust_workspace/home/.codex"
+    local release="$codex_home/packages/standalone/releases/0.42.0-test-target"
+    local visible_cli="$trust_workspace/home/.local/bin/codex"
+    local stable_path
+    mkdir -p "$release/bin" "$(dirname "$visible_cli")"
+    chmod go-w "$workspace"
+    find "$trust_workspace" -type d -exec chmod go-w {} +
+    cat > "$release/bin/codex" <<'SCRIPT'
+#!/usr/bin/env bash
+printf '%s\n' 'codex-cli 0.42.0'
+SCRIPT
+    chmod 0755 "$release/bin/codex"
+    ln -s "$release" "$codex_home/packages/standalone/current"
+    ln -s "$codex_home/packages/standalone/current/bin/codex" "$visible_cli"
+
+    stable_path="$(HOME="$trust_workspace/home" python3 "$REPO_DIR/launcher/cli-launch-path.py" "$visible_cli")"
+    [ "$stable_path" = "$(realpath "$release/bin/codex")" ] || \
+        fail "launcher trust helper must return the canonical standalone release target"
+
+    local replacement_marker="$trust_workspace/replacement-executed"
+    local replacement_cli="$trust_workspace/replacement-codex"
+    cat > "$replacement_cli" <<SCRIPT
+#!/usr/bin/env bash
+: > "$replacement_marker"
+printf '%s\n' 'codex-cli 9.9.9'
+SCRIPT
+    chmod 0755 "$replacement_cli"
+    rm "$visible_cli"
+    ln -s "$replacement_cli" "$visible_cli"
+    "$stable_path" --version >/dev/null
+    [ ! -e "$replacement_marker" ] || \
+        fail "replacing the visible CLI symlink must not redirect the verified launch target"
+
+    chmod 0775 "$(dirname "$visible_cli")"
+    chmod 0755 "$replacement_cli"
+    mv "$codex_home/packages/standalone" "$codex_home/packages/standalone-rejected"
+    if HOME="$trust_workspace/home" CODEX_HOME="$codex_home" \
+        python3 "$REPO_DIR/launcher/cli-launch-path.py" "$visible_cli" >/dev/null 2>&1; then
+        fail "launcher trust helper must reject an unsafe visible replacement before classification"
+    fi
+    [ ! -e "$replacement_marker" ] || \
+        fail "launcher trust helper must not execute an unsafe pre-validation replacement"
+    mv "$codex_home/packages/standalone-rejected" "$codex_home/packages/standalone"
+
+    python3 - "$REPO_DIR/launcher/cli-launch-path.py" <<'PY'
+import importlib.util
+import os
+import pathlib
+import sys
+
+spec = importlib.util.spec_from_file_location("cli_launch_path", pathlib.Path(sys.argv[1]))
+module = importlib.util.module_from_spec(spec)
+assert spec.loader is not None
+spec.loader.exec_module(module)
+euid = os.geteuid()
+untrusted_uid = 2 if euid == 1 else 1
+assert module.trusted_owner(euid)
+assert module.trusted_owner(0)
+assert not module.trusted_owner(untrusted_uid)
+PY
+
+    rm "$visible_cli"
+    ln -s "$codex_home/packages/standalone/current/bin/codex" "$visible_cli"
+    chmod 0775 "$release/bin/codex"
+    if HOME="$trust_workspace/home" python3 "$REPO_DIR/launcher/cli-launch-path.py" "$visible_cli" >/dev/null 2>&1; then
+        fail "launcher trust helper must reject a group-writable standalone binary"
+    fi
+    chmod 0755 "$release/bin/codex"
+
+    local external_root="$trust_workspace/external"
+    mkdir -p "$external_root/bin"
+    cp "$release/bin/codex" "$external_root/bin/codex"
+    rm "$codex_home/packages/standalone/current"
+    ln -s "$external_root" "$codex_home/packages/standalone/current"
+    if python3 "$REPO_DIR/launcher/cli-launch-path.py" "$visible_cli" >/dev/null 2>&1; then
+        fail "launcher trust helper must reject an external standalone current symlink"
+    fi
 }
 
 test_webview_server_cache_policy() {
@@ -6744,6 +6890,7 @@ test_side_by_side_launcher_identity() {
 
     assert_file_exists "$app_dir/start.sh"
     assert_file_exists "$app_dir/.codex-linux/webview-server.py"
+    assert_file_exists "$app_dir/.codex-linux/cli-launch-path.py"
     assert_file_exists "$app_dir/.codex-linux/codex-cua-lab.png"
     cmp -s "$linux_icon_source" "$app_dir/.codex-linux/codex-cua-lab.png" \
         || fail "Expected side-by-side launcher icon to use CODEX_LINUX_ICON_SOURCE"
diff --git a/updater/Cargo.toml b/updater/Cargo.toml
index 4b4032334..1cc0b3eb1 100644
--- a/updater/Cargo.toml
+++ b/updater/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "codex-update-manager"
-version = "0.9.7"
+version = "0.10.0"
 edition = "2021"
 
 [dependencies]
diff --git a/updater/src/app.rs b/updater/src/app.rs
index db8c11555..a0d54ff36 100644
--- a/updater/src/app.rs
+++ b/updater/src/app.rs
@@ -88,6 +88,11 @@ pub async fn run(cli: Cli) -> Result<()> {
             print_path,
             allow_install_missing,
         ),
+        Commands::RecoverStandaloneCli {
+            codex_home,
+            install_dir,
+            print_path,
+        } => run_recover_standalone_cli(codex_home, install_dir, print_path),
         Commands::PromptInstallCli {
             cli_path,
             print_path,
@@ -753,6 +758,18 @@ fn run_cli_preflight(
     Ok(())
 }
 
+fn run_recover_standalone_cli(
+    codex_home: Option<PathBuf>,
+    install_dir: Option<PathBuf>,
+    print_path: bool,
+) -> Result<()> {
+    let launch_path = codex_cli::recover_standalone_cli(codex_home, install_dir)?;
+    if print_path {
+        println!("{}", launch_path.display());
+    }
+    Ok(())
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 enum PromptInstallCliOutcome {
     Installed(PathBuf),
@@ -3160,6 +3177,7 @@ mod tests {
     fn prompt_install_cli_does_not_treat_non_executable_file_as_installed() -> Result<()> {
         let _env_guard = crate::test_util::env_lock();
         let temp = tempfile::tempdir()?;
+        fs::set_permissions(temp.path(), fs::Permissions::from_mode(0o755))?;
         let paths = RuntimePaths {
             config_file: temp.path().join("config/config.toml"),
             state_file: temp.path().join("state/state.json"),
@@ -3581,6 +3599,7 @@ mod tests {
     fn status_preserves_cli_reconciliation_failure() -> Result<()> {
         let _env_guard = crate::test_util::env_lock();
         let temp = tempfile::tempdir()?;
+        fs::set_permissions(temp.path(), fs::Permissions::from_mode(0o755))?;
         let paths = RuntimePaths {
             config_file: temp.path().join("config/config.toml"),
             state_file: temp.path().join("state/state.json"),
@@ -3593,6 +3612,7 @@ mod tests {
 
         let bin_dir = temp.path().join("bin");
         fs::create_dir_all(&bin_dir)?;
+        fs::set_permissions(&bin_dir, fs::Permissions::from_mode(0o755))?;
         let codex_path = bin_dir.join("codex");
         fs::write(
             &codex_path,
@@ -3610,6 +3630,9 @@ mod tests {
         let mut permissions = fs::metadata(&npm_path)?.permissions();
         permissions.set_mode(0o755);
         fs::set_permissions(&npm_path, permissions)?;
+        let node_path = bin_dir.join("node");
+        fs::write(&node_path, "#!/bin/sh\nexec /bin/sh \"$@\"\n")?;
+        fs::set_permissions(node_path, fs::Permissions::from_mode(0o755))?;
 
         let original_home = std::env::var_os("HOME");
         let original_path = std::env::var_os("PATH");
diff --git a/updater/src/cli.rs b/updater/src/cli.rs
index 06eca9d1f..7800541c7 100644
--- a/updater/src/cli.rs
+++ b/updater/src/cli.rs
@@ -42,6 +42,16 @@ pub enum Commands {
         #[arg(long, default_value_t = false)]
         allow_install_missing: bool,
     },
+    /// Reinstall a removed standalone CLI tree with a permission-safe installer
+    /// child. This command never overwrites an existing standalone tree.
+    RecoverStandaloneCli {
+        #[arg(long)]
+        codex_home: Option<PathBuf>,
+        #[arg(long)]
+        install_dir: Option<PathBuf>,
+        #[arg(long)]
+        print_path: bool,
+    },
     PromptInstallCli {
         #[arg(long)]
         cli_path: Option<PathBuf>,
diff --git a/updater/src/codex_cli.rs b/updater/src/codex_cli.rs
index 16d22376e..7b73cce57 100644
--- a/updater/src/codex_cli.rs
+++ b/updater/src/codex_cli.rs
@@ -14,13 +14,13 @@ use std::{
     ffi::{OsStr, OsString},
     fs,
     io::{Read, Write},
-    os::unix::fs::PermissionsExt,
+    os::unix::fs::{DirBuilderExt, MetadataExt, OpenOptionsExt, PermissionsExt},
     os::unix::process::CommandExt,
     path::{Path, PathBuf},
     process::{Command, ExitStatus, Output, Stdio},
     sync::mpsc::{self, Receiver, RecvTimeoutError},
     thread,
-    time::{Duration as StdDuration, Instant},
+    time::{Duration as StdDuration, Instant, SystemTime, UNIX_EPOCH},
 };
 use tracing::{info, warn};
 
@@ -33,6 +33,7 @@ const NPM_REPAIR_INSTALL_TIMEOUT: StdDuration = StdDuration::from_secs(90);
 const NPM_REPAIR_REGISTRY_TIMEOUT: StdDuration = StdDuration::from_secs(20);
 const CLI_PREFLIGHT_VERSION_TIMEOUT: StdDuration = StdDuration::from_secs(5);
 const BOUNDED_COMMAND_POLL_INTERVAL: StdDuration = StdDuration::from_millis(50);
+const STANDALONE_PROVENANCE_FILE: &str = ".codex-standalone-provenance";
 const BOUNDED_COMMAND_TERMINATION_GRACE: StdDuration = StdDuration::from_millis(500);
 const BOUNDED_COMMAND_OUTPUT_DRAIN_TIMEOUT: StdDuration = StdDuration::from_secs(1);
 const BOUNDED_COMMAND_OUTPUT_LIMIT: usize = 64 * 1024;
@@ -77,7 +78,7 @@ fn preflight_with_version_timeout(
     version_timeout: StdDuration,
 ) -> Result<PreflightOutcome> {
     let requested_path = explicit_cli_path.as_deref();
-    let (cli_path, installed_missing_cli) = match resolve_cli_path(requested_path) {
+    let (selected_cli_path, installed_missing_cli) = match resolve_cli_path(requested_path) {
         Some(path) => (path, false),
         None if allow_install_missing => match install_missing_cli(state, paths, requested_path) {
             Ok(path) => (path, true),
@@ -88,6 +89,14 @@ fn preflight_with_version_timeout(
         },
         None => anyhow::bail!("Codex CLI not found in PATH or known install locations"),
     };
+    let cli_path = match stable_cli_launch_path(&selected_cli_path) {
+        Ok(path) => path,
+        Err(trust_error) => {
+            let error = cli_trust_error(&selected_cli_path, trust_error);
+            persist_cli_failure(state, paths, &error)?;
+            return Err(error);
+        }
+    };
     let path_env = command_path_env();
     let managed_cli = cli_management::detect_system_package_managed_cli(&cli_path, &path_env);
     let mut repaired_npm_install = None;
@@ -281,7 +290,7 @@ fn preflight_with_version_timeout(
 
     state.cli_status = CliStatus::Updating;
     persist_state(paths, state)?;
-    if let Err(error) = update_existing_cli(&cli_path, &latest_version) {
+    if let Err(error) = update_existing_cli(&selected_cli_path, &latest_version) {
         persist_cli_failure(state, paths, &error)?;
         return Err(error);
     }
@@ -294,8 +303,9 @@ fn preflight_with_version_timeout(
         let fallback_path = resolve_cli_path(requested_path)
             .or_else(|| resolve_cli_path(None))
             .ok_or_else(|| anyhow!("Codex CLI disappeared after the automatic upgrade attempt"))?;
-        let fallback_version = read_installed_version(&fallback_path)?;
-        (fallback_path, fallback_version)
+        let fallback_launch_path = stable_cli_launch_path(&fallback_path)?;
+        let fallback_version = read_installed_version(&fallback_launch_path)?;
+        (fallback_launch_path, fallback_version)
     };
     state.cli_path = Some(refreshed_path.clone());
     state.cli_installed_version = Some(refreshed_version.clone());
@@ -534,11 +544,16 @@ fn resolve_cli_path_with_version(
     post_install_cli_path_candidates(explicit_path)
         .into_iter()
         .filter(|path| is_executable(path))
-        .find_map(|path| match read_installed_version(&path) {
-            Ok(version) if installed_cli_version_satisfies_latest(&version, expected_version) => {
-                Some((path, version))
+        .find_map(|path| {
+            let launch_path = stable_cli_launch_path(&path).ok()?;
+            match read_installed_version(&launch_path) {
+                Ok(version)
+                    if installed_cli_version_satisfies_latest(&version, expected_version) =>
+                {
+                    Some((launch_path, version))
+                }
+                _ => None,
             }
-            _ => None,
         })
 }
 
@@ -575,6 +590,7 @@ fn known_cli_locations() -> Vec<PathBuf> {
     if let Some(home) = home {
         append_nvm_cli_locations(&mut candidates, xdg_nvm_root(&home));
         append_nvm_cli_locations(&mut candidates, home.join(".nvm"));
+        candidates.push(home.join(".codex-cli-npm/bin/codex"));
         candidates.push(home.join(".npm-global/bin/codex"));
         candidates.push(home.join(".local/share/pnpm/codex"));
         candidates.push(home.join(".local/bin/codex"));
@@ -808,12 +824,13 @@ fn installed_cli_version_satisfies_latest(installed_version: &str, latest_versio
 }
 
 fn read_installed_version(cli_path: &Path) -> Result<String> {
-    let primary = run_command(cli_path, ["--version"])?;
+    let launch_path = stable_cli_launch_path(cli_path)?;
+    let primary = run_command(&launch_path, ["--version"])?;
     if let Some(version) = extract_version(&primary) {
         return Ok(version);
     }
 
-    let fallback = run_command(cli_path, ["version"])?;
+    let fallback = run_command(&launch_path, ["version"])?;
     extract_version(&fallback).ok_or_else(|| {
         anyhow!(
             "Codex CLI returned an unparseable version string: {}",
@@ -823,8 +840,9 @@ fn read_installed_version(cli_path: &Path) -> Result<String> {
 }
 
 fn read_installed_version_bounded(cli_path: &Path, timeout: StdDuration) -> Result<String> {
+    let launch_path = stable_cli_launch_path(cli_path)?;
     let primary = run_bounded_command(
-        cli_path,
+        &launch_path,
         &command_path_env(),
         &[OsString::from("--version")],
         timeout,
@@ -834,7 +852,7 @@ fn read_installed_version_bounded(cli_path: &Path, timeout: StdDuration) -> Resu
     }
 
     let fallback = run_bounded_command(
-        cli_path,
+        &launch_path,
         &command_path_env(),
         &[OsString::from("version")],
         timeout,
@@ -863,8 +881,8 @@ fn missing_platform_optional_dependency(error: &anyhow::Error) -> Option<String>
 }
 
 fn read_latest_version() -> Result<String> {
-    let npm = npm_program();
-    read_latest_version_with_npm(&npm, &command_path_env())
+    let (npm, path_env) = npm_program()?;
+    read_latest_version_with_npm(&npm, &path_env)
 }
 
 fn read_latest_version_with_npm(npm: &Path, path_env: &OsString) -> Result<String> {
@@ -887,7 +905,7 @@ fn read_latest_version_with_npm_bounded(
         OsString::from(CLI_PACKAGE_NAME),
         OsString::from("version"),
     ];
-    let output = run_bounded_command_output(npm, path_env, None, &args, timeout)?;
+    let output = run_bounded_command_output(npm, path_env, None, &args, timeout, false)?;
 
     parse_latest_version_output(npm, &output)
 }
@@ -921,15 +939,14 @@ fn parse_latest_version_output(npm: &Path, output: &Output) -> Result<String> {
 struct NpmCliInstall {
     package_root: PathBuf,
     npm_program: PathBuf,
+    toolchain_bin: PathBuf,
 }
 
 impl NpmCliInstall {
     fn command_path_env(&self) -> OsString {
         let fallback = command_path_env();
-        let Some(toolchain_bin) = self.npm_program.parent() else {
-            return fallback;
-        };
-        let mut entries = vec![toolchain_bin.to_path_buf()];
+        let toolchain_bin = &self.toolchain_bin;
+        let mut entries = vec![toolchain_bin.clone()];
         entries.extend(std::env::split_paths(&fallback).filter(|entry| entry != toolchain_bin));
         std::env::join_paths(entries).unwrap_or(fallback)
     }
@@ -949,15 +966,6 @@ struct CodexNpmPackageBins {
 }
 
 fn npm_cli_install(cli_path: &Path, missing_dependency: &str) -> Option<NpmCliInstall> {
-    if cli_path.file_name()? != OsStr::new("codex")
-        || !fs::symlink_metadata(cli_path)
-            .ok()?
-            .file_type()
-            .is_symlink()
-    {
-        return None;
-    }
-
     let entrypoint = fs::canonicalize(cli_path).ok()?;
     if entrypoint.file_name()? != OsStr::new("codex.js") {
         return None;
@@ -987,13 +995,21 @@ fn npm_cli_install(cli_path: &Path, missing_dependency: &str) -> Option<NpmCliIn
         return None;
     }
     let toolchain_bin = prefix.join("bin");
-    if fs::canonicalize(cli_path.parent()?).ok()? != fs::canonicalize(&toolchain_bin).ok()? {
+    let visible_symlink = cli_path.file_name()? == OsStr::new("codex")
+        && fs::symlink_metadata(cli_path)
+            .ok()?
+            .file_type()
+            .is_symlink();
+    if visible_symlink
+        && fs::canonicalize(cli_path.parent()?).ok()? != fs::canonicalize(&toolchain_bin).ok()?
+    {
         return None;
     }
-    let npm_program = toolchain_bin.join("npm");
-    if !is_executable(&npm_program) {
+    if !visible_symlink && cli_path != entrypoint {
         return None;
     }
+    let npm_program = validate_cli_target(&toolchain_bin.join("npm")).ok()?;
+    validate_cli_target(&toolchain_bin.join("node")).ok()?;
 
     let manifest = fs::read(package_root.join("package.json"))
         .ok()
@@ -1010,6 +1026,7 @@ fn npm_cli_install(cli_path: &Path, missing_dependency: &str) -> Option<NpmCliIn
     Some(NpmCliInstall {
         package_root: package_root.to_path_buf(),
         npm_program,
+        toolchain_bin,
     })
 }
 
@@ -1038,6 +1055,7 @@ fn repair_npm_optional_dependency_with_timeout(
         Some(&install.package_root),
         &args,
         timeout,
+        true,
     )?;
 
     anyhow::ensure!(
@@ -1058,7 +1076,7 @@ fn run_bounded_command(
     args: &[OsString],
     timeout: StdDuration,
 ) -> Result<String> {
-    let output = run_bounded_command_output(program, path_env, None, args, timeout)?;
+    let output = run_bounded_command_output(program, path_env, None, args, timeout, false)?;
     if !output.status.success() {
         anyhow::bail!(
             "{} exited with {}{}",
@@ -1076,6 +1094,7 @@ fn run_bounded_command_output(
     current_dir: Option<&Path>,
     args: &[OsString],
     timeout: StdDuration,
+    safe_umask: bool,
 ) -> Result<Output> {
     let mut command = Command::new(program);
     command
@@ -1087,6 +1106,9 @@ fn run_bounded_command_output(
     if let Some(current_dir) = current_dir {
         command.current_dir(current_dir);
     }
+    if safe_umask {
+        apply_safe_child_umask(&mut command);
+    }
     command.process_group(0);
 
     let mut child = command
@@ -1222,6 +1244,12 @@ struct StandaloneCliInstall {
     install_dir: Option<PathBuf>,
 }
 
+impl StandaloneCliInstall {
+    fn standalone_root(&self) -> PathBuf {
+        self.codex_home.join("packages/standalone")
+    }
+}
+
 fn update_existing_cli(cli_path: &Path, latest_version: &str) -> Result<()> {
     match classify_cli_install(cli_path) {
         CliInstallKind::Standalone(install) => update_standalone_cli(&install, latest_version),
@@ -1240,7 +1268,13 @@ fn standalone_cli_install(cli_path: &Path) -> Option<StandaloneCliInstall> {
     let codex_home = canonical_path
         .as_deref()
         .and_then(standalone_home_from_path)
-        .or_else(|| standalone_home_from_path(cli_path))?;
+        .or_else(|| standalone_home_from_path(cli_path))
+        .or_else(|| {
+            unresolved_symlink_target(cli_path)
+                .as_deref()
+                .and_then(standalone_home_from_path)
+        })
+        .or_else(existing_default_standalone_home)?;
     let cli_path_is_standalone = standalone_home_from_path(cli_path).is_some();
     let install_dir = if cli_path_is_standalone {
         None
@@ -1260,6 +1294,25 @@ fn standalone_cli_install(cli_path: &Path) -> Option<StandaloneCliInstall> {
     })
 }
 
+fn existing_default_standalone_home() -> Option<PathBuf> {
+    #[cfg(test)]
+    std::env::var_os("CODEX_UPDATE_MANAGER_TEST_STANDALONE_PROVENANCE")?;
+
+    let codex_home = default_codex_home().ok()?;
+    fs::symlink_metadata(codex_home.join("packages/standalone"))
+        .ok()
+        .map(|_| codex_home)
+}
+
+fn unresolved_symlink_target(path: &Path) -> Option<PathBuf> {
+    let target = fs::read_link(path).ok()?;
+    if target.is_absolute() {
+        Some(target)
+    } else {
+        Some(path.parent()?.join(target))
+    }
+}
+
 fn standalone_home_from_path(path: &Path) -> Option<PathBuf> {
     let components = path.components().collect::<Vec<_>>();
     for (index, window) in components.windows(3).enumerate() {
@@ -1287,22 +1340,686 @@ fn standalone_home_from_path(path: &Path) -> Option<PathBuf> {
     None
 }
 
+fn stable_cli_launch_path(cli_path: &Path) -> Result<PathBuf> {
+    let detected_install = standalone_cli_install(cli_path);
+    let recorded_home = read_standalone_provenance()?;
+    let should_record = recorded_home.is_none() && detected_install.is_some();
+    let install = match (detected_install, recorded_home) {
+        (None, None) => return validate_cli_identity(cli_path),
+        (Some(install), None) => install,
+        (detected, Some(codex_home)) => {
+            if let Some(ref detected) = detected {
+                anyhow::ensure!(
+                    detected.codex_home == codex_home,
+                    "Selected Codex CLI provenance {} conflicts with recorded standalone home {}",
+                    detected.codex_home.display(),
+                    codex_home.display()
+                );
+            }
+            StandaloneCliInstall {
+                codex_home,
+                install_dir: detected
+                    .and_then(|install| install.install_dir)
+                    .or_else(|| {
+                        cli_path
+                            .parent()
+                            .filter(|parent| !parent.as_os_str().is_empty())
+                            .map(Path::to_path_buf)
+                    }),
+            }
+        }
+    };
+
+    let validate_selection = || -> Result<PathBuf> {
+        let canonical_cli = fs::canonicalize(cli_path)
+            .with_context(|| format!("Failed to resolve Codex CLI path {}", cli_path.display()))?;
+        validate_standalone_cli_tree(&install)?;
+        let canonical_root = fs::canonicalize(install.standalone_root()).with_context(|| {
+            format!(
+                "Failed to resolve managed standalone Codex CLI root {}",
+                install.standalone_root().display()
+            )
+        })?;
+        anyhow::ensure!(
+            canonical_cli.starts_with(&canonical_root),
+            "Managed standalone Codex CLI path {} resolves outside its trusted root",
+            cli_path.display()
+        );
+        validate_cli_target(cli_path)
+    };
+    let mut launch_path = validate_selection()?;
+    if should_record {
+        record_standalone_provenance(&install.codex_home, cli_path)?;
+        launch_path = validate_selection()?;
+    }
+    Ok(launch_path)
+}
+
+fn trusted_owner(uid: u32, euid: u32) -> bool {
+    uid == euid || uid == 0
+}
+
+fn cli_trust_error(cli_path: &Path, trust_error: anyhow::Error) -> anyhow::Error {
+    trust_error.context(format!(
+        "Refusing to execute the untrusted Codex CLI at {}; for a rejected managed standalone install, stop active Codex installers, remove its standalone tree, then run the official Codex installer through codex-update-manager recover-standalone-cli",
+        cli_path.display()
+    ))
+}
+
+fn validate_standalone_cli_tree(install: &StandaloneCliInstall) -> Result<()> {
+    let standalone_root = install.standalone_root();
+    let root_metadata = fs::symlink_metadata(&standalone_root).with_context(|| {
+        format!(
+            "Managed standalone Codex CLI root {} is missing",
+            standalone_root.display()
+        )
+    })?;
+    anyhow::ensure!(
+        root_metadata.is_dir() && !root_metadata.file_type().is_symlink(),
+        "Managed standalone Codex CLI root {} is not a trusted directory",
+        standalone_root.display()
+    );
+    let canonical_root = fs::canonicalize(&standalone_root).with_context(|| {
+        format!(
+            "Failed to resolve managed standalone Codex CLI root {}",
+            standalone_root.display()
+        )
+    })?;
+    validate_standalone_parent_chain(&canonical_root)?;
+
+    let mut pending = vec![standalone_root];
+    while let Some(path) = pending.pop() {
+        let metadata = fs::symlink_metadata(&path).with_context(|| {
+            format!(
+                "Failed to inspect managed standalone Codex CLI path {}",
+                path.display()
+            )
+        })?;
+
+        if metadata.file_type().is_symlink() {
+            let target = fs::canonicalize(&path).with_context(|| {
+                format!(
+                    "Managed standalone Codex CLI contains a broken symlink at {}",
+                    path.display()
+                )
+            })?;
+            anyhow::ensure!(
+                target.starts_with(&canonical_root),
+                "Managed standalone Codex CLI contains an external symlink at {}",
+                path.display()
+            );
+            continue;
+        }
+
+        anyhow::ensure!(
+            metadata.is_dir() || metadata.is_file(),
+            "Managed standalone Codex CLI contains an unsupported file type at {}",
+            path.display()
+        );
+        let euid = unsafe { libc::geteuid() };
+        anyhow::ensure!(
+            trusted_owner(metadata.uid(), euid),
+            "Managed standalone Codex CLI path {} is owned by untrusted uid {}",
+            path.display(),
+            metadata.uid()
+        );
+        anyhow::ensure!(
+            metadata.permissions().mode() & 0o022 == 0,
+            "Managed standalone Codex CLI path {} is group/world-writable and therefore untrusted",
+            path.display()
+        );
+
+        if metadata.is_dir() {
+            let entries = fs::read_dir(&path).with_context(|| {
+                format!(
+                    "Failed to enumerate managed standalone Codex CLI directory {}",
+                    path.display()
+                )
+            })?;
+            for entry in entries {
+                pending.push(entry?.path());
+            }
+        }
+    }
+
+    Ok(())
+}
+
+fn validate_standalone_parent_chain(path: &Path) -> Result<()> {
+    validate_trusted_parent_chain(path, "Managed standalone Codex CLI")
+}
+
+fn standalone_provenance_path() -> Result<PathBuf> {
+    let home = std::env::var_os("HOME").context("HOME is not set")?;
+    let canonical_home = fs::canonicalize(&home).with_context(|| {
+        format!(
+            "Failed to resolve HOME for standalone CLI provenance: {}",
+            Path::new(&home).display()
+        )
+    })?;
+    Ok(canonical_home.join(STANDALONE_PROVENANCE_FILE))
+}
+
+fn read_standalone_provenance() -> Result<Option<PathBuf>> {
+    #[cfg(test)]
+    if std::env::var_os("CODEX_UPDATE_MANAGER_TEST_STANDALONE_PROVENANCE").is_none() {
+        return Ok(None);
+    }
+
+    let path = standalone_provenance_path()?;
+    let metadata = match fs::symlink_metadata(&path) {
+        Ok(metadata) => metadata,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+        Err(error) => return Err(error).context("Failed to inspect standalone CLI provenance"),
+    };
+    let euid = unsafe { libc::geteuid() };
+    anyhow::ensure!(
+        metadata.is_file() && !metadata.file_type().is_symlink(),
+        "Standalone Codex CLI provenance {} is not a regular file",
+        path.display()
+    );
+    anyhow::ensure!(
+        trusted_owner(metadata.uid(), euid) && metadata.permissions().mode() & 0o022 == 0,
+        "Standalone Codex CLI provenance {} is not trusted",
+        path.display()
+    );
+    validate_trusted_parent_chain(&path, "Standalone Codex CLI provenance")?;
+    let value = fs::read_to_string(&path)?;
+    let codex_home = PathBuf::from(value.trim());
+    anyhow::ensure!(
+        codex_home.is_absolute(),
+        "Standalone Codex CLI provenance {} is invalid",
+        path.display()
+    );
+    Ok(Some(codex_home))
+}
+
+fn record_standalone_provenance(codex_home: &Path, cli_path: &Path) -> Result<()> {
+    #[cfg(test)]
+    if std::env::var_os("CODEX_UPDATE_MANAGER_TEST_STANDALONE_PROVENANCE").is_none() {
+        return Ok(());
+    }
+
+    let path = standalone_provenance_path()?;
+    let entry_metadata = fs::symlink_metadata(cli_path)
+        .with_context(|| format!("Failed to inspect Codex CLI entry {}", cli_path.display()))?;
+    let euid = unsafe { libc::geteuid() };
+    anyhow::ensure!(
+        trusted_owner(entry_metadata.uid(), euid),
+        "Selected Codex CLI entry {} is owned by untrusted uid {}",
+        cli_path.display(),
+        entry_metadata.uid()
+    );
+    validate_trusted_parent_chain(&path, "Standalone Codex CLI provenance")?;
+    let temp_path = path.with_file_name(format!(
+        ".{STANDALONE_PROVENANCE_FILE}.{}-{}",
+        std::process::id(),
+        SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap_or_default()
+            .as_nanos()
+    ));
+    let mut file = fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(0o600)
+        .open(&temp_path)
+        .context("Failed to create standalone CLI provenance")?;
+    let write_result = (|| -> Result<()> {
+        writeln!(file, "{}", codex_home.display())?;
+        file.sync_all()?;
+        fs::rename(&temp_path, &path)?;
+        fs::File::open(path.parent().context("Provenance path has no parent")?)?.sync_all()?;
+        Ok(())
+    })();
+    if write_result.is_err() {
+        let _ = fs::remove_file(&temp_path);
+    }
+    write_result
+}
+
+fn validate_cli_target(cli_path: &Path) -> Result<PathBuf> {
+    let canonical_cli = validate_cli_identity(cli_path)?;
+    let lexical_cli = absolute_lexical_cli_path(cli_path)?;
+    validate_trusted_parent_chain(&lexical_cli, "Selected Codex CLI")?;
+    Ok(canonical_cli)
+}
+
+fn absolute_lexical_cli_path(cli_path: &Path) -> Result<PathBuf> {
+    if cli_path.is_absolute() {
+        return Ok(cli_path.to_path_buf());
+    }
+    Ok(std::env::current_dir()
+        .context("Failed to resolve the current directory for Codex CLI validation")?
+        .join(cli_path))
+}
+
+fn validate_cli_identity(cli_path: &Path) -> Result<PathBuf> {
+    let lexical_cli = absolute_lexical_cli_path(cli_path)?;
+    let entry_metadata = fs::symlink_metadata(&lexical_cli).with_context(|| {
+        format!(
+            "Failed to inspect Codex CLI entry {}",
+            lexical_cli.display()
+        )
+    })?;
+    let euid = unsafe { libc::geteuid() };
+    anyhow::ensure!(
+        trusted_owner(entry_metadata.uid(), euid),
+        "Selected Codex CLI entry {} is owned by untrusted uid {}",
+        lexical_cli.display(),
+        entry_metadata.uid()
+    );
+    let canonical_cli = fs::canonicalize(&lexical_cli)
+        .with_context(|| format!("Failed to resolve Codex CLI path {}", lexical_cli.display()))?;
+    let target_metadata = fs::metadata(&canonical_cli).with_context(|| {
+        format!(
+            "Failed to inspect Codex CLI target {}",
+            canonical_cli.display()
+        )
+    })?;
+    anyhow::ensure!(
+        target_metadata.is_file() && is_executable(&canonical_cli),
+        "Selected Codex CLI target {} is not an executable file",
+        canonical_cli.display()
+    );
+    anyhow::ensure!(
+        trusted_owner(target_metadata.uid(), euid),
+        "Selected Codex CLI target {} is owned by untrusted uid {}",
+        canonical_cli.display(),
+        target_metadata.uid()
+    );
+    anyhow::ensure!(
+        target_metadata.permissions().mode() & 0o022 == 0,
+        "Selected Codex CLI target {} is group/world-writable and therefore untrusted",
+        canonical_cli.display()
+    );
+    validate_trusted_parent_chain(&canonical_cli, "Selected Codex CLI target")?;
+    Ok(canonical_cli)
+}
+
+fn validate_trusted_parent_chain(path: &Path, subject: &str) -> Result<()> {
+    let euid = unsafe { libc::geteuid() };
+    for parent in path.ancestors().skip(1) {
+        let metadata = fs::symlink_metadata(parent).with_context(|| {
+            format!(
+                "Failed to inspect managed standalone Codex CLI ancestor {}",
+                parent.display()
+            )
+        })?;
+        anyhow::ensure!(
+            metadata.is_dir() && !metadata.file_type().is_symlink(),
+            "{subject} ancestor {} is not a trusted directory",
+            parent.display()
+        );
+        anyhow::ensure!(
+            trusted_owner(metadata.uid(), euid),
+            "{subject} ancestor {} is owned by untrusted uid {}",
+            parent.display(),
+            metadata.uid()
+        );
+
+        let mode = metadata.permissions().mode();
+        let root_owned_sticky_directory =
+            metadata.uid() == 0 && mode & libc::S_ISVTX != 0 && mode & 0o002 != 0;
+        anyhow::ensure!(
+            mode & 0o022 == 0 || root_owned_sticky_directory,
+            "{subject} ancestor {} is group/world-writable and therefore untrusted",
+            parent.display()
+        );
+    }
+
+    Ok(())
+}
+
 fn update_standalone_cli(install: &StandaloneCliInstall, latest_version: &str) -> Result<()> {
-    let downloader = standalone_installer_downloader()?;
-    let installer_script = downloader.download_installer()?;
-    let mut command = Command::new("sh");
+    let install = standalone_install_with_effective_dir(install)?;
+    validate_standalone_installer_directory(install.install_dir.as_deref().unwrap())?;
+    let tool_path = trusted_standalone_installer_path()?;
+    let downloader = standalone_installer_downloader(&tool_path)?;
+    let installer_script = downloader.download_installer(&tool_path)?;
+    run_standalone_cli_installer(
+        &install,
+        Some(latest_version),
+        &installer_script,
+        None,
+        &tool_path,
+    )?;
+    validate_standalone_cli_tree(&install)
+}
+
+#[cfg(test)]
+fn update_standalone_cli_with_umask_override(
+    install: &StandaloneCliInstall,
+    latest_version: &str,
+    inherited_umask: u32,
+) -> Result<()> {
+    let install = standalone_install_with_effective_dir(install)?;
+    validate_standalone_installer_directory(install.install_dir.as_deref().unwrap())?;
+    let tool_path = command_path_env();
+    let downloader = standalone_installer_downloader(&tool_path)?;
+    let installer_script = downloader.download_installer(&tool_path)?;
+    run_standalone_cli_installer(
+        &install,
+        Some(latest_version),
+        &installer_script,
+        Some(inherited_umask),
+        &tool_path,
+    )?;
+    validate_standalone_cli_tree(&install)
+}
+
+/// Reinstall a standalone CLI after the caller has removed a rejected tree.
+/// The official installer runs with a child-only safe umask and the result is
+/// validated before a stable launch target is returned.
+pub fn recover_standalone_cli(
+    codex_home: Option<PathBuf>,
+    install_dir: Option<PathBuf>,
+) -> Result<PathBuf> {
+    let tool_path = trusted_standalone_installer_path()?;
+    recover_standalone_cli_with_options(codex_home, install_dir, None, &tool_path)
+}
+
+#[cfg(test)]
+fn recover_standalone_cli_with_umask_override(
+    codex_home: Option<PathBuf>,
+    install_dir: Option<PathBuf>,
+    inherited_umask_override: Option<u32>,
+) -> Result<PathBuf> {
+    let tool_path = command_path_env();
+    recover_standalone_cli_with_options(
+        codex_home,
+        install_dir,
+        inherited_umask_override,
+        &tool_path,
+    )
+}
+
+fn recover_standalone_cli_with_options(
+    codex_home: Option<PathBuf>,
+    install_dir: Option<PathBuf>,
+    inherited_umask_override: Option<u32>,
+    tool_path: &OsStr,
+) -> Result<PathBuf> {
+    let codex_home = codex_home.map_or_else(default_codex_home, Ok)?;
+    validate_absolute_recovery_path(&codex_home, "Codex home")?;
+    if let Some(install_dir) = install_dir.as_deref() {
+        validate_absolute_recovery_path(install_dir, "standalone install directory")?;
+    }
+    let install = standalone_install_with_effective_dir(&StandaloneCliInstall {
+        codex_home,
+        install_dir,
+    })?;
+    let standalone_root = install.standalone_root();
+    match fs::symlink_metadata(&standalone_root) {
+        Ok(_) => anyhow::bail!(
+            "Refusing to overwrite existing standalone Codex CLI tree {}; stop active Codex installers and remove this rejected tree before retrying recovery",
+            standalone_root.display()
+        ),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+        Err(error) => {
+            return Err(error).with_context(|| {
+                format!(
+                    "Failed to inspect standalone Codex CLI recovery path {}",
+                    standalone_root.display()
+                )
+            });
+        }
+    }
+    prepare_standalone_recovery_parent(&install.codex_home)?;
+    secure_standalone_recovery_directory_chain(install.install_dir.as_deref().unwrap())?;
+    validate_standalone_installer_directory(install.install_dir.as_deref().unwrap())?;
+
+    let downloader = standalone_installer_downloader(tool_path)?;
+    let installer_script = downloader.download_installer(tool_path)?;
+    run_standalone_cli_installer(
+        &install,
+        None,
+        &installer_script,
+        inherited_umask_override,
+        tool_path,
+    )?;
+    validate_standalone_cli_tree(&install)?;
+
+    let visible_cli = install
+        .install_dir
+        .as_deref()
+        .map(|directory| directory.join("codex"))
+        .unwrap_or_else(|| standalone_root.join("current/bin/codex"));
+    stable_cli_launch_path(&visible_cli).with_context(|| {
+        format!(
+            "Standalone Codex CLI recovery completed but did not produce a trusted executable at {}",
+            visible_cli.display()
+        )
+    })
+}
+
+fn standalone_install_with_effective_dir(
+    install: &StandaloneCliInstall,
+) -> Result<StandaloneCliInstall> {
+    let install_dir = install
+        .install_dir
+        .clone()
+        .map_or_else(default_standalone_install_dir, Ok)?;
+    validate_absolute_recovery_path(&install.codex_home, "Codex home")?;
+    validate_absolute_recovery_path(&install_dir, "standalone install directory")?;
+    Ok(StandaloneCliInstall {
+        codex_home: install.codex_home.clone(),
+        install_dir: Some(install_dir),
+    })
+}
+
+fn default_standalone_install_dir() -> Result<PathBuf> {
+    let home = std::env::var_os("HOME")
+        .filter(|value| !value.is_empty())
+        .context("HOME is required to resolve the standalone Codex CLI install directory")?;
+    Ok(PathBuf::from(home).join(".local/bin"))
+}
+
+fn validate_absolute_recovery_path(path: &Path, label: &str) -> Result<()> {
+    anyhow::ensure!(path.is_absolute(), "{label} must be an absolute path");
+    anyhow::ensure!(
+        !path.components().any(|component| matches!(
+            component,
+            std::path::Component::CurDir | std::path::Component::ParentDir
+        )),
+        "{label} must not contain . or .. components"
+    );
+    Ok(())
+}
+
+fn prepare_standalone_recovery_parent(codex_home: &Path) -> Result<()> {
+    let packages_dir = codex_home.join("packages");
+    secure_standalone_recovery_directory_chain(&packages_dir)?;
+    let existing_parent = packages_dir
+        .ancestors()
+        .find(|candidate| fs::symlink_metadata(candidate).is_ok())
+        .context("Standalone Codex CLI recovery path has no existing parent")?;
+    let metadata = fs::symlink_metadata(existing_parent).with_context(|| {
+        format!(
+            "Failed to inspect standalone Codex CLI recovery ancestor {}",
+            existing_parent.display()
+        )
+    })?;
+    let euid = unsafe { libc::geteuid() };
+    anyhow::ensure!(
+        metadata.is_dir() && !metadata.file_type().is_symlink(),
+        "Standalone Codex CLI recovery ancestor {} is not a trusted directory",
+        existing_parent.display()
+    );
+    anyhow::ensure!(
+        metadata.uid() == euid || metadata.uid() == 0,
+        "Standalone Codex CLI recovery ancestor {} is owned by untrusted uid {}",
+        existing_parent.display(),
+        metadata.uid()
+    );
+    let mode = metadata.permissions().mode();
+    let root_owned_sticky_directory =
+        metadata.uid() == 0 && mode & libc::S_ISVTX != 0 && mode & 0o002 != 0;
+    anyhow::ensure!(
+        mode & 0o022 == 0 || root_owned_sticky_directory,
+        "Standalone Codex CLI recovery ancestor {} is group/world-writable; secure it before retrying recovery",
+        existing_parent.display()
+    );
+    let canonical_parent = fs::canonicalize(existing_parent).with_context(|| {
+        format!(
+            "Failed to resolve standalone Codex CLI recovery ancestor {}",
+            existing_parent.display()
+        )
+    })?;
+    validate_standalone_parent_chain(&canonical_parent)
+}
+
+fn secure_standalone_recovery_directory_chain(target: &Path) -> Result<()> {
+    validate_absolute_recovery_path(target, "standalone recovery directory")?;
+    let home = std::env::var_os("HOME")
+        .filter(|value| !value.is_empty())
+        .map(PathBuf::from);
+
+    if let Some(home) = home.as_deref().filter(|home| target.starts_with(home)) {
+        let relative = target.strip_prefix(home).unwrap();
+        let mut current = home.to_path_buf();
+        for component in relative.components() {
+            current.push(component.as_os_str());
+            match fs::symlink_metadata(&current) {
+                Ok(_) => secure_owned_recovery_directory(&current)?,
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => break,
+                Err(error) => {
+                    return Err(error).with_context(|| {
+                        format!(
+                            "Failed to inspect standalone recovery directory {}",
+                            current.display()
+                        )
+                    });
+                }
+            }
+        }
+    } else if fs::symlink_metadata(target).is_ok() {
+        secure_owned_recovery_directory(target)?;
+    }
+
+    Ok(())
+}
+
+fn secure_owned_recovery_directory(path: &Path) -> Result<()> {
+    let directory = fs::OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_CLOEXEC | libc::O_DIRECTORY | libc::O_NOFOLLOW)
+        .open(path)
+        .with_context(|| {
+            format!(
+                "Standalone recovery path {} is not a trusted directory",
+                path.display()
+            )
+        })?;
+    let metadata = directory.metadata()?;
+    let euid = unsafe { libc::geteuid() };
+    anyhow::ensure!(
+        metadata.uid() == euid,
+        "Standalone recovery directory {} is not owned by the current user",
+        path.display()
+    );
+    let mode = metadata.permissions().mode();
+    if mode & 0o022 != 0 {
+        directory
+            .set_permissions(fs::Permissions::from_mode(mode & !0o022))
+            .with_context(|| {
+                format!(
+                    "Failed to remove group/world write access from standalone recovery directory {}",
+                    path.display()
+                )
+            })?;
+    }
+    Ok(())
+}
+
+fn validate_standalone_installer_directory(path: &Path) -> Result<()> {
+    let existing_parent = path
+        .ancestors()
+        .find(|candidate| fs::symlink_metadata(candidate).is_ok())
+        .context("Standalone Codex CLI install directory has no existing parent")?;
+    let metadata = fs::symlink_metadata(existing_parent).with_context(|| {
+        format!(
+            "Failed to inspect standalone Codex CLI install ancestor {}",
+            existing_parent.display()
+        )
+    })?;
+    let euid = unsafe { libc::geteuid() };
+    anyhow::ensure!(
+        metadata.is_dir() && !metadata.file_type().is_symlink(),
+        "Standalone Codex CLI install ancestor {} is not a trusted directory",
+        existing_parent.display()
+    );
+    anyhow::ensure!(
+        metadata.uid() == euid || metadata.uid() == 0,
+        "Standalone Codex CLI install ancestor {} is owned by untrusted uid {}",
+        existing_parent.display(),
+        metadata.uid()
+    );
+    let mode = metadata.permissions().mode();
+    let root_owned_sticky_directory =
+        metadata.uid() == 0 && mode & libc::S_ISVTX != 0 && mode & 0o002 != 0;
+    anyhow::ensure!(
+        mode & 0o022 == 0 || root_owned_sticky_directory,
+        "Standalone Codex CLI install ancestor {} is group/world-writable and therefore untrusted",
+        existing_parent.display()
+    );
+    let canonical_parent = fs::canonicalize(existing_parent).with_context(|| {
+        format!(
+            "Failed to resolve standalone Codex CLI install ancestor {}",
+            existing_parent.display()
+        )
+    })?;
+    validate_standalone_parent_chain(&canonical_parent)
+}
+
+fn default_codex_home() -> Result<PathBuf> {
+    if let Some(codex_home) = std::env::var_os("CODEX_HOME").filter(|value| !value.is_empty()) {
+        return Ok(PathBuf::from(codex_home));
+    }
+    let home = std::env::var_os("HOME")
+        .filter(|value| !value.is_empty())
+        .context("HOME or CODEX_HOME is required to recover the standalone Codex CLI")?;
+    Ok(PathBuf::from(home).join(".codex"))
+}
+
+fn run_standalone_cli_installer(
+    install: &StandaloneCliInstall,
+    latest_version: Option<&str>,
+    installer_script: &[u8],
+    inherited_umask_override: Option<u32>,
+    tool_path: &OsStr,
+) -> Result<()> {
+    let shell = resolved_program_in_path("sh", tool_path)
+        .context("A trusted sh executable is required to run the standalone Codex CLI installer")?;
+    let mut command = Command::new(&shell);
     command
         .arg("-s")
-        .env("PATH", command_path_env())
-        .env("CODEX_RELEASE", latest_version)
+        .env("PATH", tool_path)
         .env("CODEX_NON_INTERACTIVE", "1")
         .env("CODEX_HOME", &install.codex_home)
         .stdin(Stdio::piped())
         .stdout(Stdio::piped())
         .stderr(Stdio::piped());
+    if let Some(latest_version) = latest_version {
+        command.env("CODEX_RELEASE", latest_version);
+    }
     if let Some(install_dir) = &install.install_dir {
         command.env("CODEX_INSTALL_DIR", install_dir);
     }
+    // SAFETY: `umask` is async-signal-safe and this hook only changes the
+    // installer child's mask. OR-ing write restrictions preserves stricter
+    // user policies while preventing new managed files from being created
+    // group/world-writable.
+    unsafe {
+        command.pre_exec(move || {
+            if let Some(mask) = inherited_umask_override {
+                libc::umask(mask as libc::mode_t);
+            }
+            let inherited = libc::umask(0);
+            libc::umask(inherited | 0o022);
+            Ok(())
+        });
+    }
 
     let mut child = command
         .spawn()
@@ -1314,7 +2031,7 @@ fn update_standalone_cli(install: &StandaloneCliInstall, latest_version: &str) -
             .take()
             .context("Failed to open standalone Codex CLI installer stdin")?;
         stdin
-            .write_all(&installer_script)
+            .write_all(installer_script)
             .with_context(|| "Failed to write standalone Codex CLI installer script")?;
     }
 
@@ -1338,10 +2055,10 @@ enum StandaloneInstallerDownloader {
 }
 
 impl StandaloneInstallerDownloader {
-    fn download_installer(&self) -> Result<Vec<u8>> {
+    fn download_installer(&self, tool_path: &OsStr) -> Result<Vec<u8>> {
         let output = match self {
             Self::Curl(program) => Command::new(program)
-                .env("PATH", command_path_env())
+                .env("PATH", tool_path)
                 .args(["-fsSL", STANDALONE_INSTALLER_URL])
                 .output()
                 .with_context(|| {
@@ -1351,7 +2068,7 @@ impl StandaloneInstallerDownloader {
                     )
                 })?,
             Self::Wget(program) => Command::new(program)
-                .env("PATH", command_path_env())
+                .env("PATH", tool_path)
                 .args(["-q", "-O", "-", STANDALONE_INSTALLER_URL])
                 .output()
                 .with_context(|| {
@@ -1377,17 +2094,12 @@ impl StandaloneInstallerDownloader {
     }
 }
 
-fn standalone_installer_downloader() -> Result<StandaloneInstallerDownloader> {
-    let path_env = command_path_env();
-    if let Some(path) = find_in_path("curl", &path_env) {
-        return Ok(StandaloneInstallerDownloader::Curl(resolved_program_path(
-            path,
-        )));
+fn standalone_installer_downloader(path_env: &OsStr) -> Result<StandaloneInstallerDownloader> {
+    if let Some(path) = resolved_program_in_path("curl", path_env) {
+        return Ok(StandaloneInstallerDownloader::Curl(path));
     }
-    if let Some(path) = find_in_path("wget", &path_env) {
-        return Ok(StandaloneInstallerDownloader::Wget(resolved_program_path(
-            path,
-        )));
+    if let Some(path) = resolved_program_in_path("wget", path_env) {
+        return Ok(StandaloneInstallerDownloader::Wget(path));
     }
 
     anyhow::bail!(
@@ -1395,53 +2107,151 @@ fn standalone_installer_downloader() -> Result<StandaloneInstallerDownloader> {
     );
 }
 
-fn resolved_program_path(path: PathBuf) -> PathBuf {
-    fs::canonicalize(&path).unwrap_or(path)
+fn resolved_program_in_path(name: &str, path_env: &OsStr) -> Option<PathBuf> {
+    find_in_path(name, &path_env.to_os_string()).map(resolved_program_path)
 }
 
-fn install_latest_cli(latest_version: &str) -> Result<()> {
-    let npm = npm_program();
-    let package_spec = format!("{CLI_PACKAGE_NAME}@{latest_version}");
-    let global_args = vec![
-        OsString::from("install"),
-        OsString::from("-g"),
-        OsString::from("--include=optional"),
-        OsString::from(&package_spec),
-    ];
+fn trusted_standalone_installer_path() -> Result<OsString> {
+    #[cfg(test)]
+    if let Some(path) = std::env::var_os("CODEX_UPDATE_MANAGER_TEST_STANDALONE_TOOL_PATH")
+        .filter(|value| !value.is_empty())
+    {
+        return Ok(path);
+    }
 
-    match run_npm_command(&npm, &global_args) {
-        Ok(()) => Ok(()),
-        Err(global_error) => {
-            warn!(
-                ?global_error,
-                "global npm install failed; retrying Codex CLI upgrade with a user-local prefix"
-            );
+    const CANDIDATES: &[&str] = &[
+        "/usr/bin",
+        "/bin",
+        "/usr/sbin",
+        "/sbin",
+        "/run/current-system/sw/bin",
+    ];
 
-            let local_prefix = local_npm_prefix();
-            fs::create_dir_all(&local_prefix).with_context(|| {
-                format!(
-                    "Failed to create local npm prefix {}",
-                    local_prefix.display()
-                )
-            })?;
+    let mut directories = Vec::new();
+    for candidate in CANDIDATES {
+        let candidate = Path::new(candidate);
+        let canonical = match fs::canonicalize(candidate) {
+            Ok(path) => path,
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => continue,
+            Err(error) => {
+                return Err(error).with_context(|| {
+                    format!(
+                        "Failed to resolve trusted standalone installer tool directory {}",
+                        candidate.display()
+                    )
+                });
+            }
+        };
+        validate_trusted_system_directory(&canonical)?;
+        if !directories.iter().any(|existing| existing == &canonical) {
+            directories.push(canonical);
+        }
+    }
+
+    let path_env = std::env::join_paths(directories)
+        .context("Failed to construct trusted standalone installer tool PATH")?;
+    let shell = resolved_program_in_path("sh", &path_env)
+        .context("No trusted system sh executable is available for standalone CLI recovery")?;
+    validate_trusted_system_program(&shell)?;
+    let downloader = resolved_program_in_path("curl", &path_env)
+        .or_else(|| resolved_program_in_path("wget", &path_env))
+        .context(
+            "No trusted system curl or wget executable is available for standalone CLI recovery",
+        )?;
+    validate_trusted_system_program(&downloader)?;
+    Ok(path_env)
+}
 
-            let local_args = vec![
-                OsString::from("install"),
-                OsString::from("-g"),
-                OsString::from("--include=optional"),
-                OsString::from("--prefix"),
-                local_prefix.as_os_str().to_os_string(),
-                OsString::from(&package_spec),
-            ];
+fn validate_trusted_system_program(path: &Path) -> Result<()> {
+    let metadata = fs::metadata(path).with_context(|| {
+        format!(
+            "Failed to inspect trusted standalone installer tool {}",
+            path.display()
+        )
+    })?;
+    anyhow::ensure!(
+        metadata.is_file() && metadata.uid() == 0 && metadata.permissions().mode() & 0o022 == 0,
+        "Standalone installer tool {} is not a root-owned, non-writable regular file",
+        path.display()
+    );
+    anyhow::ensure!(
+        metadata.permissions().mode() & 0o111 != 0,
+        "Standalone installer tool {} is not executable",
+        path.display()
+    );
+    if let Some(parent) = path.parent() {
+        validate_trusted_system_directory(parent)?;
+    }
+    Ok(())
+}
 
-            run_npm_command(&npm, &local_args).with_context(|| {
-                format!(
-                    "npm install -g failed first ({global_error}); fallback install into {} also failed",
-                    local_prefix.display()
-                )
-            })
+fn validate_trusted_system_directory(path: &Path) -> Result<()> {
+    for directory in path.ancestors() {
+        let metadata = fs::symlink_metadata(directory).with_context(|| {
+            format!(
+                "Failed to inspect trusted standalone installer tool ancestor {}",
+                directory.display()
+            )
+        })?;
+        anyhow::ensure!(
+            metadata.is_dir() && !metadata.file_type().is_symlink() && metadata.uid() == 0,
+            "Standalone installer tool ancestor {} is not a root-owned directory",
+            directory.display()
+        );
+        let mode = metadata.permissions().mode();
+        let root_owned_sticky_directory = mode & libc::S_ISVTX != 0;
+        anyhow::ensure!(
+            mode & 0o022 == 0 || root_owned_sticky_directory,
+            "Standalone installer tool ancestor {} is group/world-writable and therefore untrusted",
+            directory.display()
+        );
+    }
+    Ok(())
+}
+
+fn resolved_program_path(path: PathBuf) -> PathBuf {
+    fs::canonicalize(&path).unwrap_or(path)
+}
+
+fn install_latest_cli(latest_version: &str) -> Result<()> {
+    let (npm, path_env) = npm_program()?;
+    let package_spec = format!("{CLI_PACKAGE_NAME}@{latest_version}");
+    let local_prefix = local_npm_prefix();
+    prepare_safe_npm_prefix(&local_prefix)?;
+    let local_args = vec![
+        OsString::from("install"),
+        OsString::from("-g"),
+        OsString::from("--include=optional"),
+        OsString::from("--prefix"),
+        local_prefix.as_os_str().to_os_string(),
+        OsString::from(&package_spec),
+    ];
+    run_npm_command(&npm, &path_env, &local_args)
+        .with_context(|| format!("npm install into {} failed", local_prefix.display()))
+}
+
+fn prepare_safe_npm_prefix(prefix: &Path) -> Result<()> {
+    match fs::symlink_metadata(prefix) {
+        Ok(_) => {}
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+            fs::DirBuilder::new()
+                .mode(0o700)
+                .create(prefix)
+                .with_context(|| format!("Failed to create npm prefix {}", prefix.display()))?;
         }
+        Err(error) => return Err(error).context("Failed to inspect dedicated npm prefix"),
     }
+    let metadata = fs::symlink_metadata(prefix)?;
+    let euid = unsafe { libc::geteuid() };
+    anyhow::ensure!(
+        metadata.is_dir()
+            && !metadata.file_type().is_symlink()
+            && trusted_owner(metadata.uid(), euid)
+            && metadata.permissions().mode() & 0o022 == 0,
+        "Dedicated npm prefix {} is not a trusted directory",
+        prefix.display()
+    );
+    validate_trusted_parent_chain(prefix, "Dedicated npm prefix")
 }
 
 fn install_missing_cli(
@@ -1527,21 +2337,33 @@ fn normalize_version_token(token: &str) -> Option<String> {
     Some(trimmed.to_string())
 }
 
-fn npm_program() -> PathBuf {
-    find_in_path("npm", &command_path_env()).unwrap_or_else(|| PathBuf::from("npm"))
+fn npm_program() -> Result<(PathBuf, OsString)> {
+    let npm = find_in_path("npm", &command_path_env()).context("npm was not found in PATH")?;
+    validate_cli_target(&npm).context("npm executable failed its trust check")?;
+    let toolchain_bin = npm
+        .parent()
+        .context("npm executable has no parent directory")?;
+    validate_cli_target(&toolchain_bin.join("node"))
+        .context("node executable beside npm failed its trust check")?;
+    let fallback = command_path_env();
+    let mut entries = vec![toolchain_bin.to_path_buf()];
+    entries.extend(std::env::split_paths(&fallback).filter(|entry| entry != toolchain_bin));
+    let path_env = std::env::join_paths(entries).unwrap_or(fallback);
+    Ok((npm, path_env))
 }
 
 fn local_npm_prefix() -> PathBuf {
     std::env::var_os("HOME")
         .map(PathBuf::from)
         .unwrap_or_else(|| PathBuf::from("."))
-        .join(".local")
+        .join(".codex-cli-npm")
 }
 
-fn run_npm_command(npm: &Path, args: &[OsString]) -> Result<()> {
-    let output = Command::new(npm)
-        .env("PATH", command_path_env())
-        .args(args)
+fn run_npm_command(npm: &Path, path_env: &OsString, args: &[OsString]) -> Result<()> {
+    let mut command = Command::new(npm);
+    command.env("PATH", path_env).args(args);
+    apply_safe_child_umask(&mut command);
+    let output = command
         .output()
         .with_context(|| format!("Failed to spawn {}", npm.display()))?;
 
@@ -1557,6 +2379,16 @@ fn run_npm_command(npm: &Path, args: &[OsString]) -> Result<()> {
     Ok(())
 }
 
+fn apply_safe_child_umask(command: &mut Command) {
+    unsafe {
+        command.pre_exec(|| {
+            let inherited = libc::umask(0);
+            libc::umask(inherited | 0o022);
+            Ok(())
+        });
+    }
+}
+
 fn format_command_args(args: &[OsString]) -> String {
     args.iter()
         .map(|arg| arg.to_string_lossy().into_owned())
@@ -1752,10 +2584,26 @@ mod tests {
     use tempfile::tempdir;
 
     fn write_executable_script(path: &Path, contents: &str) -> Result<()> {
+        let temp_root = std::env::temp_dir();
+        for directory in path.parent().into_iter().flat_map(Path::ancestors) {
+            if directory == temp_root || !directory.starts_with(&temp_root) {
+                break;
+            }
+            if directory.is_dir() {
+                fs::set_permissions(directory, fs::Permissions::from_mode(0o755))?;
+            }
+        }
         fs::write(path, contents)?;
         let mut permissions = fs::metadata(path)?.permissions();
         permissions.set_mode(0o755);
         fs::set_permissions(path, permissions)?;
+        if path.file_name() == Some(OsStr::new("npm")) {
+            let node = path.with_file_name("node");
+            if !node.exists() {
+                fs::write(&node, "#!/bin/sh\nexec /bin/sh \"$@\"\n")?;
+                fs::set_permissions(node, fs::Permissions::from_mode(0o755))?;
+            }
+        }
         Ok(())
     }
 
@@ -1773,6 +2621,7 @@ mod tests {
         let toolchain_bin = prefix.join("bin");
         let visible_cli = toolchain_bin.join("codex");
         let npm_program = toolchain_bin.join("npm");
+        let node_program = toolchain_bin.join("node");
 
         fs::create_dir_all(
             entrypoint
@@ -1780,6 +2629,19 @@ mod tests {
                 .context("npm CLI entrypoint has no parent")?,
         )?;
         fs::create_dir_all(&toolchain_bin)?;
+        if let Some(test_root) = prefix.parent() {
+            fs::set_permissions(test_root, fs::Permissions::from_mode(0o755))?;
+        }
+        for directory in entrypoint
+            .parent()
+            .into_iter()
+            .flat_map(Path::ancestors)
+            .take_while(|directory| directory.starts_with(prefix))
+            .chain(std::iter::once(toolchain_bin.as_path()))
+        {
+            fs::set_permissions(directory, fs::Permissions::from_mode(0o755))?;
+        }
+        write_executable_script(&node_program, "#!/bin/sh\nexec /bin/sh \"$@\"\n")?;
         write_executable_script(&entrypoint, entrypoint_contents)?;
         fs::write(
             package_root.join("package.json"),
@@ -1855,6 +2717,19 @@ mod tests {
             .join(format!("{version}-{target}"));
         let release_bin = release_dir.join("bin");
         fs::create_dir_all(&release_bin)?;
+        for ancestor in codex_home.ancestors().skip(1).take(2) {
+            fs::set_permissions(ancestor, fs::Permissions::from_mode(0o755))?;
+        }
+        for directory in [
+            codex_home.to_path_buf(),
+            codex_home.join("packages"),
+            codex_home.join("packages/standalone"),
+            codex_home.join("packages/standalone/releases"),
+            release_dir.clone(),
+            release_bin.clone(),
+        ] {
+            fs::set_permissions(directory, fs::Permissions::from_mode(0o755))?;
+        }
         write_executable_script(
             &release_bin.join("codex"),
             &format!(
@@ -1872,6 +2747,15 @@ mod tests {
         let standalone_root = codex_home.join("packages/standalone");
         fs::create_dir_all(&standalone_root)?;
         fs::create_dir_all(install_dir)?;
+        let home = codex_home
+            .parent()
+            .context("test standalone Codex home has no parent")?;
+        for directory in install_dir
+            .ancestors()
+            .take_while(|directory| directory.starts_with(home))
+        {
+            fs::set_permissions(directory, fs::Permissions::from_mode(0o755))?;
+        }
 
         let current_link = standalone_root.join("current");
         let _ = fs::remove_file(&current_link);
@@ -1972,12 +2856,13 @@ if [ "$1" = "-fsSL" ]; then
   cat <<'SCRIPT'
 #!/bin/sh
 set -eu
-release_dir="$CODEX_HOME/packages/standalone/releases/$CODEX_RELEASE-test-target"
+release="${CODEX_RELEASE:-0.42.2}"
+release_dir="$CODEX_HOME/packages/standalone/releases/$release-test-target"
 mkdir -p "$release_dir/bin" "$CODEX_INSTALL_DIR"
 cat > "$release_dir/bin/codex" <<CODEX_BIN
 #!/bin/sh
 if [ "\$1" = "--version" ] || [ "\$1" = "version" ]; then
-  echo 'codex-cli v$CODEX_RELEASE'
+  echo 'codex-cli v$release'
   exit 0
 fi
 exit 1
@@ -1985,6 +2870,37 @@ CODEX_BIN
 chmod 0755 "$release_dir/bin/codex"
 ln -sfn "$release_dir" "$CODEX_HOME/packages/standalone/current"
 ln -sfn "$CODEX_HOME/packages/standalone/current/bin/codex" "$CODEX_INSTALL_DIR/codex"
+"$CODEX_INSTALL_DIR/codex" --version >/dev/null
+SCRIPT
+  exit 0
+fi
+exit 1
+"#,
+        )
+    }
+
+    fn write_umask_recording_standalone_installer_curl(tool_bin: &Path) -> Result<()> {
+        write_executable_script(
+            &tool_bin.join("curl"),
+            r#"#!/bin/sh
+if [ "$1" = "-fsSL" ]; then
+  cat <<'SCRIPT'
+#!/bin/sh
+set -eu
+release="${CODEX_RELEASE:-0.42.2}"
+release_dir="$CODEX_HOME/packages/standalone/releases/$release-test-target"
+mkdir -p "$release_dir/bin" "$CODEX_INSTALL_DIR"
+umask > "$INSTALLER_UMASK_LOG"
+: > "$release_dir/created-by-installer"
+sh -c 'umask > "$CHILD_UMASK_LOG"; : > "$CHILD_CREATED_FILE"'
+cat > "$release_dir/bin/codex" <<CODEX_BIN
+#!/bin/sh
+echo 'codex-cli v$release'
+CODEX_BIN
+chmod 0755 "$release_dir/bin/codex"
+ln -sfn "$release_dir" "$CODEX_HOME/packages/standalone/current"
+ln -sfn "$CODEX_HOME/packages/standalone/current/bin/codex" "$CODEX_INSTALL_DIR/codex"
+"$CODEX_INSTALL_DIR/codex" --version >/dev/null
 SCRIPT
   exit 0
 fi
@@ -2760,6 +3676,639 @@ exit 1
         Ok(())
     }
 
+    #[test]
+    fn untrusted_standalone_cli_is_rejected_before_execution() -> Result<()> {
+        let _env_guard = env_lock();
+        let temp = tempdir()?;
+        let paths = test_runtime_paths(temp.path());
+        paths.ensure_dirs()?;
+
+        let home = temp.path().join("home");
+        let install_dir = home.join(".local/bin");
+        let codex_home = home.join(".codex");
+
+        let initial_release =
+            write_standalone_codex_release(&codex_home, "0.42.0", "x86_64-unknown-linux-musl")?;
+        let tamper_marker = temp.path().join("tampered-cli-executed");
+        let tampered_cli = initial_release.join("bin/codex");
+        write_executable_script(
+            &tampered_cli,
+            &format!(
+                "#!/bin/sh\n: > '{}'\necho 'codex-cli v0.42.0'\n",
+                tamper_marker.display()
+            ),
+        )?;
+        let mut permissions = fs::metadata(&tampered_cli)?.permissions();
+        permissions.set_mode(0o775);
+        fs::set_permissions(&tampered_cli, permissions)?;
+
+        let visible_codex = link_standalone_cli(&codex_home, &install_dir, &initial_release)?;
+        let _restore_env = configure_cli_test_env(&home, [install_dir])?;
+
+        let mut state = PersistedState::new(true);
+        state.cli_path = Some(visible_codex.clone());
+        let error = preflight(&mut state, &paths, Some(visible_codex), false)
+            .expect_err("an untrusted managed CLI must be rejected");
+
+        assert!(error.to_string().contains("official Codex installer"));
+        assert_eq!(state.cli_status, CliStatus::Failed);
+        assert!(state
+            .cli_error_message
+            .as_deref()
+            .unwrap_or_default()
+            .contains("group/world-writable"));
+        assert!(
+            !tamper_marker.exists(),
+            "the untrusted managed CLI must not execute before rejection"
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn untrusted_standalone_cli_ancestor_is_rejected_before_execution() -> Result<()> {
+        let _env_guard = env_lock();
+        let temp = tempdir()?;
+        let paths = test_runtime_paths(temp.path());
+        paths.ensure_dirs()?;
+
+        let home = temp.path().join("home");
+        let install_dir = home.join(".local/bin");
+        let codex_home = home.join(".codex");
+        let initial_release =
+            write_standalone_codex_release(&codex_home, "0.42.0", "x86_64-unknown-linux-musl")?;
+        let execution_marker = temp.path().join("unsafe-ancestor-cli-executed");
+        write_executable_script(
+            &initial_release.join("bin/codex"),
+            &format!(
+                "#!/bin/sh\n: > '{}'\necho 'codex-cli v0.42.0'\n",
+                execution_marker.display()
+            ),
+        )?;
+        fs::set_permissions(
+            codex_home.join("packages"),
+            fs::Permissions::from_mode(0o775),
+        )?;
+        let visible_codex = link_standalone_cli(&codex_home, &install_dir, &initial_release)?;
+        let _restore_env = configure_cli_test_env(&home, [install_dir])?;
+
+        let mut state = PersistedState::new(true);
+        state.cli_path = Some(visible_codex.clone());
+        let error = preflight(&mut state, &paths, Some(visible_codex), false)
+            .expect_err("an unsafe managed CLI ancestor must be rejected");
+
+        assert!(error.to_string().contains("official Codex installer"));
+        assert_eq!(state.cli_status, CliStatus::Failed);
+        assert!(state
+            .cli_error_message
+            .as_deref()
+            .unwrap_or_default()
+            .contains("ancestor"));
+        assert!(!execution_marker.exists());
+        Ok(())
+    }
+
+    #[test]
+    fn standalone_launch_path_remains_stable_after_visible_symlink_replacement() -> Result<()> {
+        let _env_guard = env_lock();
+        let temp = tempdir()?;
+        fs::set_permissions(temp.path(), fs::Permissions::from_mode(0o755))?;
+        let home = temp.path().join("home");
+        let install_dir = home.join(".local/bin");
+        let codex_home = home.join(".codex");
+        let release = write_standalone_codex_release(&codex_home, "0.42.0", "test-target")?;
+        let visible_codex = link_standalone_cli(&codex_home, &install_dir, &release)?;
+
+        let _restore_env = EnvRestoreGuard::capture(&[
+            "HOME",
+            "CODEX_HOME",
+            "CODEX_UPDATE_MANAGER_TEST_STANDALONE_PROVENANCE",
+        ]);
+        std::env::set_var("HOME", &home);
+        std::env::remove_var("CODEX_HOME");
+        std::env::set_var("CODEX_UPDATE_MANAGER_TEST_STANDALONE_PROVENANCE", "1");
+        assert_eq!(
+            stable_cli_launch_path(&visible_codex)?,
+            release.join("bin/codex")
+        );
+
+        let launch_path = stable_cli_launch_path(&visible_codex)?;
+        assert_eq!(launch_path, fs::canonicalize(release.join("bin/codex"))?);
+
+        let replacement_marker = temp.path().join("replacement-executed");
+        let replacement = temp.path().join("replacement-codex");
+        write_executable_script(
+            &replacement,
+            &format!(
+                "#!/bin/sh\n: > '{}'\necho 'codex-cli v9.9.9'\n",
+                replacement_marker.display()
+            ),
+        )?;
+        fs::remove_file(&visible_codex)?;
+        std::os::unix::fs::symlink(&replacement, &visible_codex)?;
+
+        assert_eq!(read_installed_version(&launch_path)?, "0.42.0");
+        assert!(
+            !replacement_marker.exists(),
+            "replacing the visible symlink must not redirect the verified launch target"
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn cli_launch_path_rejects_unsafe_visible_replacement_before_validation() -> Result<()> {
+        let _env_guard = env_lock();
+        let temp = tempdir()?;
+        fs::set_permissions(temp.path(), fs::Permissions::from_mode(0o755))?;
+        let home = temp.path().join("home");
+        let install_dir = home.join(".local/bin");
+        let codex_home = home.join(".codex");
+        let release = write_standalone_codex_release(&codex_home, "0.42.0", "test-target")?;
+        let visible_codex = link_standalone_cli(&codex_home, &install_dir, &release)?;
+
+        let _restore_env = EnvRestoreGuard::capture(&[
+            "HOME",
+            "CODEX_HOME",
+            "CODEX_UPDATE_MANAGER_TEST_STANDALONE_PROVENANCE",
+        ]);
+        std::env::set_var("HOME", &home);
+        std::env::remove_var("CODEX_HOME");
+        std::env::set_var("CODEX_UPDATE_MANAGER_TEST_STANDALONE_PROVENANCE", "1");
+        assert_eq!(
+            stable_cli_launch_path(&visible_codex)?,
+            release.join("bin/codex")
+        );
+
+        let replacement_marker = temp.path().join("pre-validation-replacement-executed");
+        let replacement = temp.path().join("replacement-codex");
+        write_executable_script(
+            &replacement,
+            &format!(
+                "#!/bin/sh\n: > '{}'\necho 'codex-cli v9.9.9'\n",
+                replacement_marker.display()
+            ),
+        )?;
+        fs::set_permissions(&install_dir, fs::Permissions::from_mode(0o775))?;
+        fs::set_permissions(&replacement, fs::Permissions::from_mode(0o755))?;
+        fs::remove_file(&visible_codex)?;
+        std::os::unix::fs::symlink(&replacement, &visible_codex)?;
+        fs::rename(
+            codex_home.join("packages/standalone"),
+            codex_home.join("packages/standalone-rejected"),
+        )?;
+
+        let error = stable_cli_launch_path(&visible_codex)
+            .expect_err("an unsafe entry replacement must fail before execution");
+        assert!(error.to_string().contains("root") && error.to_string().contains("missing"));
+        assert!(!replacement_marker.exists());
+        Ok(())
+    }
+
+    #[test]
+    fn invalid_standalone_does_not_record_provenance() -> Result<()> {
+        let _env_guard = env_lock();
+        let temp = tempdir()?;
+        fs::set_permissions(temp.path(), fs::Permissions::from_mode(0o755))?;
+        let home = temp.path().join("home");
+        let install_dir = home.join("custom-bin");
+        let codex_home = home.join("custom-codex-home");
+        let release = write_standalone_codex_release(&codex_home, "0.42.0", "test-target")?;
+        let visible_codex = link_standalone_cli(&codex_home, &install_dir, &release)?;
+        fs::set_permissions(release.join("bin/codex"), fs::Permissions::from_mode(0o775))?;
+
+        let _restore_env = EnvRestoreGuard::capture(&[
+            "HOME",
+            "CODEX_HOME",
+            "CODEX_UPDATE_MANAGER_TEST_STANDALONE_PROVENANCE",
+        ]);
+        std::env::set_var("HOME", &home);
+        std::env::set_var("CODEX_HOME", &codex_home);
+        std::env::set_var("CODEX_UPDATE_MANAGER_TEST_STANDALONE_PROVENANCE", "1");
+
+        stable_cli_launch_path(&visible_codex)
+            .expect_err("an invalid standalone tree must be rejected");
+        assert!(!home.join(STANDALONE_PROVENANCE_FILE).exists());
+        Ok(())
+    }
+
+    #[test]
+    fn cli_trust_accepts_only_current_or_root_owner() {
+        let euid = unsafe { libc::geteuid() };
+        assert!(trusted_owner(euid, euid));
+        assert!(trusted_owner(0, euid));
+        let untrusted_uid = if euid == 1 { 2 } else { 1 };
+        assert!(!trusted_owner(untrusted_uid, euid));
+    }
+
+    #[test]
+    fn dedicated_npm_prefix_is_created_private() -> Result<()> {
+        let temp = tempdir()?;
+        fs::set_permissions(temp.path(), fs::Permissions::from_mode(0o755))?;
+        let prefix = temp.path().join(".codex-cli-npm");
+        prepare_safe_npm_prefix(&prefix)?;
+        assert_eq!(fs::metadata(prefix)?.permissions().mode() & 0o777, 0o700);
+        Ok(())
+    }
+
+    #[test]
+    fn standalone_launch_path_rejects_external_current_symlink_without_execution() -> Result<()> {
+        let _env_guard = env_lock();
+        let temp = tempdir()?;
+        fs::set_permissions(temp.path(), fs::Permissions::from_mode(0o755))?;
+        let home = temp.path().join("home");
+        let install_dir = home.join(".local/bin");
+        let codex_home = home.join(".codex");
+        let release = write_standalone_codex_release(&codex_home, "0.42.0", "test-target")?;
+        let visible_codex = link_standalone_cli(&codex_home, &install_dir, &release)?;
+
+        let external_marker = temp.path().join("external-executed");
+        let external_dir = temp.path().join("external/bin");
+        fs::create_dir_all(&external_dir)?;
+        write_executable_script(
+            &external_dir.join("codex"),
+            &format!(
+                "#!/bin/sh\n: > '{}'\necho 'codex-cli v9.9.9'\n",
+                external_marker.display()
+            ),
+        )?;
+        let current = codex_home.join("packages/standalone/current");
+        fs::remove_file(&current)?;
+        std::os::unix::fs::symlink(temp.path().join("external"), &current)?;
+
+        let error = stable_cli_launch_path(&visible_codex)
+            .expect_err("an external current symlink must be rejected");
+        assert!(error.to_string().contains("external symlink"));
+        assert!(!external_marker.exists());
+        Ok(())
+    }
+
+    #[test]
+    fn preflight_trust_failure_is_persisted_without_version_probe() -> Result<()> {
+        let _env_guard = env_lock();
+        let temp = tempdir()?;
+        let paths = test_runtime_paths(temp.path());
+        paths.ensure_dirs()?;
+        let home = temp.path().join("home");
+        let install_dir = home.join(".local/bin");
+        let codex_home = home.join(".codex");
+        let release = write_standalone_codex_release(&codex_home, "0.42.0", "test-target")?;
+        let probe_marker = temp.path().join("version-probed");
+        let cli = release.join("bin/codex");
+        write_executable_script(
+            &cli,
+            &format!(
+                "#!/bin/sh\n: > '{}'\necho 'codex-cli v0.42.0'\n",
+                probe_marker.display()
+            ),
+        )?;
+        fs::set_permissions(&cli, fs::Permissions::from_mode(0o775))?;
+        let visible_codex = link_standalone_cli(&codex_home, &install_dir, &release)?;
+        let _restore_env = configure_cli_test_env(&home, [install_dir])?;
+
+        let mut state = PersistedState::new(true);
+        let error = preflight(&mut state, &paths, Some(visible_codex.clone()), false)
+            .expect_err("the updater preflight trust gate must fail closed");
+        assert!(error.to_string().contains("recover-standalone-cli"));
+        assert_eq!(state.cli_status, CliStatus::Failed);
+        assert!(!probe_marker.exists());
+        Ok(())
+    }
+
+    #[test]
+    fn standalone_installer_scopes_umask_and_preserves_stricter_policies() -> Result<()> {
+        let _env_guard = env_lock();
+        let temp = tempdir()?;
+        fs::set_permissions(temp.path(), fs::Permissions::from_mode(0o755))?;
+        let tool_bin = temp.path().join("tool-bin");
+        fs::create_dir_all(&tool_bin)?;
+        write_umask_recording_standalone_installer_curl(&tool_bin)?;
+
+        let _restore_env = EnvRestoreGuard::capture(&[
+            "HOME",
+            "PATH",
+            "INSTALLER_UMASK_LOG",
+            "CHILD_UMASK_LOG",
+            "CHILD_CREATED_FILE",
+        ]);
+        std::env::set_var("HOME", temp.path().join("home"));
+        set_test_path_with_tool_bin(&tool_bin)?;
+        let read_unrelated_child_umask = || -> Result<String> {
+            let output = Command::new(tool_bin.join("sh"))
+                .arg("-c")
+                .arg("umask")
+                .output()?;
+            anyhow::ensure!(output.status.success(), "failed to read child umask");
+            Ok(String::from_utf8(output.stdout)?.trim().to_string())
+        };
+        let ambient_child_umask = read_unrelated_child_umask()?;
+
+        for (inherited_umask, expected_umask) in
+            [(0o002_u32, 0o022_u32), (0o027, 0o027), (0o077, 0o077)]
+        {
+            let case_root = temp.path().join(format!("mask-{inherited_umask:04o}"));
+            let codex_home = case_root.join(".codex");
+            let install_dir = case_root.join("bin");
+            let release_dir = codex_home
+                .join("packages/standalone/releases")
+                .join("0.42.1-test-target");
+            let installer_umask_log = case_root.join("installer-umask.log");
+            let child_umask_log = case_root.join("child-umask.log");
+            let child_created_file = release_dir.join("created-by-child");
+            fs::create_dir_all(&case_root)?;
+            fs::set_permissions(&case_root, fs::Permissions::from_mode(0o755))?;
+            std::env::set_var("INSTALLER_UMASK_LOG", &installer_umask_log);
+            std::env::set_var("CHILD_UMASK_LOG", &child_umask_log);
+            std::env::set_var("CHILD_CREATED_FILE", &child_created_file);
+
+            let install = StandaloneCliInstall {
+                codex_home,
+                install_dir: Some(install_dir),
+            };
+            update_standalone_cli_with_umask_override(&install, "0.42.1", inherited_umask)?;
+            assert_eq!(read_unrelated_child_umask()?, ambient_child_umask);
+
+            let parse_umask = |path: &Path| -> Result<u32> {
+                let raw = fs::read_to_string(path)?;
+                u32::from_str_radix(raw.trim(), 8)
+                    .with_context(|| format!("invalid umask recorded in {}", path.display()))
+            };
+            assert_eq!(parse_umask(&installer_umask_log)?, expected_umask);
+            assert_eq!(parse_umask(&child_umask_log)?, expected_umask);
+            assert_eq!(
+                fs::metadata(&release_dir)?.permissions().mode() & 0o777,
+                0o777 & !expected_umask
+            );
+            for created_file in [release_dir.join("created-by-installer"), child_created_file] {
+                assert_eq!(
+                    fs::metadata(created_file)?.permissions().mode() & 0o777,
+                    0o666 & !expected_umask
+                );
+            }
+        }
+
+        Ok(())
+    }
+
+    #[test]
+    fn standalone_recovery_under_umask_0002_produces_a_trusted_launch_target() -> Result<()> {
+        let _env_guard = env_lock();
+        let temp = tempdir()?;
+        fs::set_permissions(temp.path(), fs::Permissions::from_mode(0o755))?;
+        let tool_bin = temp.path().join("tool-bin");
+        let case_root = temp.path().join("recovery");
+        let home = case_root.join("home");
+        let codex_home = home.join(".codex");
+        let install_dir = home.join(".local/bin");
+        let release_dir = codex_home
+            .join("packages/standalone/releases")
+            .join("0.42.2-test-target");
+        let installer_umask_log = case_root.join("installer-umask.log");
+        let child_umask_log = case_root.join("child-umask.log");
+        let child_created_file = release_dir.join("created-by-child");
+        let malicious_curl_marker = case_root.join("malicious-curl-executed");
+        let malicious_shell_marker = case_root.join("malicious-shell-executed");
+        fs::create_dir_all(&tool_bin)?;
+        fs::create_dir_all(&install_dir)?;
+        fs::set_permissions(&case_root, fs::Permissions::from_mode(0o755))?;
+        fs::set_permissions(&home, fs::Permissions::from_mode(0o755))?;
+        fs::create_dir_all(codex_home.join("packages"))?;
+        for path in [
+            codex_home.clone(),
+            codex_home.join("packages"),
+            home.join(".local"),
+            install_dir.clone(),
+        ] {
+            fs::set_permissions(path, fs::Permissions::from_mode(0o775))?;
+        }
+        write_executable_script(
+            &install_dir.join("curl"),
+            &format!(
+                "#!/bin/sh\n: > '{}'\nexit 99\n",
+                malicious_curl_marker.display()
+            ),
+        )?;
+        write_executable_script(
+            &install_dir.join("sh"),
+            &format!(
+                "#!/bin/sh\n: > '{}'\nexit 99\n",
+                malicious_shell_marker.display()
+            ),
+        )?;
+        write_umask_recording_standalone_installer_curl(&tool_bin)?;
+
+        let _restore_env = EnvRestoreGuard::capture(&[
+            "HOME",
+            "PATH",
+            "INSTALLER_UMASK_LOG",
+            "CHILD_UMASK_LOG",
+            "CHILD_CREATED_FILE",
+        ]);
+        std::env::set_var("HOME", &home);
+        set_test_path_with_tool_bin(&tool_bin)?;
+        std::env::set_var(
+            "PATH",
+            std::env::join_paths([install_dir.clone(), tool_bin.clone()])?,
+        );
+        std::env::set_var("INSTALLER_UMASK_LOG", &installer_umask_log);
+        std::env::set_var("CHILD_UMASK_LOG", &child_umask_log);
+        std::env::set_var("CHILD_CREATED_FILE", &child_created_file);
+
+        let trusted_test_path = std::env::join_paths([tool_bin])?;
+        let launch_path = recover_standalone_cli_with_options(
+            Some(codex_home.clone()),
+            Some(install_dir.clone()),
+            Some(0o002),
+            &trusted_test_path,
+        )?;
+
+        assert_eq!(
+            launch_path,
+            fs::canonicalize(release_dir.join("bin/codex"))?
+        );
+        assert_eq!(fs::read_to_string(&installer_umask_log)?.trim(), "0022");
+        assert_eq!(fs::read_to_string(&child_umask_log)?.trim(), "0022");
+        for path in [
+            codex_home.clone(),
+            codex_home.join("packages"),
+            home.join(".local"),
+            install_dir.clone(),
+        ] {
+            assert_eq!(
+                fs::metadata(&path)?.permissions().mode() & 0o022,
+                0,
+                "recovery must secure installer-created directory {}",
+                path.display()
+            );
+        }
+        validate_standalone_cli_tree(&StandaloneCliInstall {
+            codex_home,
+            install_dir: Some(install_dir),
+        })?;
+        for path in [release_dir.join("created-by-installer"), child_created_file] {
+            assert_eq!(fs::metadata(path)?.permissions().mode() & 0o022, 0);
+        }
+        assert!(
+            !malicious_curl_marker.exists() && !malicious_shell_marker.exists(),
+            "recovery must not execute tools planted in a formerly writable install directory"
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn trusted_standalone_installer_path_ignores_inherited_user_tools() -> Result<()> {
+        let _env_guard = env_lock();
+        let temp = tempdir()?;
+        let user_bin = temp.path().join("home/.local/bin");
+        let marker = temp.path().join("user-tool-executed");
+        fs::create_dir_all(&user_bin)?;
+        for name in ["curl", "wget", "sh"] {
+            write_executable_script(
+                &user_bin.join(name),
+                &format!("#!/bin/sh\n: > '{}'\nexit 99\n", marker.display()),
+            )?;
+        }
+
+        let _restore_env =
+            EnvRestoreGuard::capture(&["PATH", "CODEX_UPDATE_MANAGER_TEST_STANDALONE_TOOL_PATH"]);
+        std::env::set_var("PATH", std::env::join_paths([user_bin.clone()])?);
+        std::env::remove_var("CODEX_UPDATE_MANAGER_TEST_STANDALONE_TOOL_PATH");
+        let trusted_path = trusted_standalone_installer_path()?;
+
+        assert!(
+            std::env::split_paths(&trusted_path).all(|entry| entry != user_bin),
+            "trusted recovery PATH must not inherit user-writable command directories"
+        );
+        for name in ["curl", "sh"] {
+            let selected = resolved_program_in_path(name, &trusted_path)
+                .with_context(|| format!("trusted recovery PATH is missing {name}"))?;
+            assert!(!selected.starts_with(temp.path()));
+        }
+        assert!(!marker.exists());
+        Ok(())
+    }
+
+    #[test]
+    fn standalone_update_rejects_unsafe_install_directory_before_download() -> Result<()> {
+        let _env_guard = env_lock();
+        let temp = tempdir()?;
+        fs::set_permissions(temp.path(), fs::Permissions::from_mode(0o755))?;
+        let home = temp.path().join("home");
+        let codex_home = home.join(".codex");
+        let install_dir = home.join(".local/bin");
+        let tool_bin = temp.path().join("tool-bin");
+        let curl_call_log = temp.path().join("curl-called.log");
+        fs::create_dir_all(&install_dir)?;
+        fs::create_dir_all(&tool_bin)?;
+        fs::set_permissions(&home, fs::Permissions::from_mode(0o755))?;
+        fs::set_permissions(home.join(".local"), fs::Permissions::from_mode(0o755))?;
+        fs::set_permissions(&install_dir, fs::Permissions::from_mode(0o775))?;
+        write_failing_standalone_installer_curl(&tool_bin, &curl_call_log)?;
+
+        let _restore_env = EnvRestoreGuard::capture(&["HOME", "PATH"]);
+        std::env::set_var("HOME", &home);
+        set_test_path_with_tool_bin(&tool_bin)?;
+
+        let error = update_standalone_cli_with_umask_override(
+            &StandaloneCliInstall {
+                codex_home,
+                install_dir: Some(install_dir),
+            },
+            "0.42.1",
+            0o002,
+        )
+        .expect_err("an unsafe install directory must be rejected before download");
+        assert!(error.to_string().contains("group/world-writable"));
+        assert!(
+            !curl_call_log.exists(),
+            "installer download must not start through an unsafe visible-command directory"
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn standalone_recovery_refuses_to_overwrite_an_existing_tree() -> Result<()> {
+        let _env_guard = env_lock();
+        let temp = tempdir()?;
+        fs::set_permissions(temp.path(), fs::Permissions::from_mode(0o755))?;
+        let codex_home = temp.path().join("home/.codex");
+        write_standalone_codex_release(&codex_home, "0.42.0", "test-target")?;
+
+        let error = recover_standalone_cli_with_umask_override(
+            Some(codex_home),
+            Some(temp.path().join("home/.local/bin")),
+            Some(0o002),
+        )
+        .expect_err("recovery must not mutate an existing standalone tree");
+        assert!(error.to_string().contains("Refusing to overwrite"));
+        assert!(error.to_string().contains("remove this rejected tree"));
+        Ok(())
+    }
+
+    #[test]
+    fn standalone_recovery_rejects_ambiguous_paths_before_downloading() -> Result<()> {
+        let _env_guard = env_lock();
+        let relative_error = recover_standalone_cli_with_umask_override(
+            Some(PathBuf::from("relative/.codex")),
+            None,
+            Some(0o002),
+        )
+        .expect_err("relative recovery paths must be rejected");
+        assert!(relative_error.to_string().contains("absolute path"));
+
+        let parent_error = recover_standalone_cli_with_umask_override(
+            Some(PathBuf::from("/tmp/safe/../unsafe/.codex")),
+            None,
+            Some(0o002),
+        )
+        .expect_err("parent traversal in recovery paths must be rejected");
+        assert!(parent_error.to_string().contains("must not contain"));
+        Ok(())
+    }
+
+    #[test]
+    fn refresh_status_rejects_untrusted_standalone_cli_without_executing_it() -> Result<()> {
+        let _env_guard = env_lock();
+        let temp = tempdir()?;
+        let paths = test_runtime_paths(temp.path());
+        paths.ensure_dirs()?;
+
+        let home = temp.path().join("home");
+        let install_dir = home.join(".local/bin");
+        let codex_home = home.join(".codex");
+        let initial_release =
+            write_standalone_codex_release(&codex_home, "0.42.0", "x86_64-unknown-linux-musl")?;
+        let tamper_marker = temp.path().join("refresh-executed-tampered-cli");
+        let tampered_cli = initial_release.join("bin/codex");
+        write_executable_script(
+            &tampered_cli,
+            &format!(
+                "#!/bin/sh\n: > '{}'\necho 'codex-cli v0.42.0'\n",
+                tamper_marker.display()
+            ),
+        )?;
+        let mut permissions = fs::metadata(&tampered_cli)?.permissions();
+        permissions.set_mode(0o775);
+        fs::set_permissions(&tampered_cli, permissions)?;
+        let visible_codex = link_standalone_cli(&codex_home, &install_dir, &initial_release)?;
+        let _restore_env = configure_cli_test_env(&home, [install_dir])?;
+
+        let mut state = PersistedState::new(true);
+        state.cli_path = Some(visible_codex);
+        refresh_status(&mut state, &paths)?;
+
+        assert_eq!(state.cli_status, CliStatus::Failed);
+        assert_eq!(state.cli_installed_version, None);
+        assert!(state
+            .cli_error_message
+            .as_deref()
+            .unwrap_or_default()
+            .contains("group/world-writable"));
+        assert!(
+            !tamper_marker.exists(),
+            "status refresh must reject the untrusted managed CLI before execution"
+        );
+        Ok(())
+    }
+
     #[test]
     fn standalone_cli_symlink_updates_with_standalone_installer() -> Result<()> {
         let _env_guard = env_lock();
@@ -2788,9 +4337,14 @@ exit 1
             "NVM_DIR",
             "CODEX_CLI_PATH",
             "CODEX_UPDATE_MANAGER_SKIP_SYSTEM_CLI_LOOKUP",
+            "CODEX_UPDATE_MANAGER_TEST_STANDALONE_TOOL_PATH",
         ]);
         std::env::set_var("HOME", &home);
         set_test_path_with_tool_bin(&tool_bin)?;
+        std::env::set_var(
+            "CODEX_UPDATE_MANAGER_TEST_STANDALONE_TOOL_PATH",
+            std::env::join_paths([tool_bin.clone()])?,
+        );
         std::env::remove_var("NVM_DIR");
         std::env::remove_var("XDG_DATA_HOME");
         std::env::remove_var("FNM_DIR");
@@ -2811,7 +4365,10 @@ exit 1
         let outcome = preflight(&mut state, &paths, Some(visible_codex.clone()), false)?;
 
         assert!(outcome.updated);
-        assert_eq!(outcome.cli_path, visible_codex);
+        assert_eq!(
+            outcome.cli_path,
+            fs::canonicalize(codex_home.join("packages/standalone/current/bin/codex"))?
+        );
         assert_eq!(outcome.installed_version, "0.42.1");
         assert_eq!(state.cli_installed_version.as_deref(), Some("0.42.1"));
         assert_eq!(state.cli_official_latest_version.as_deref(), Some("0.42.1"));
@@ -2868,7 +4425,8 @@ exit 1
         let updated = reconcile_if_present(&mut state, &paths)?;
 
         assert!(!updated);
-        assert_eq!(state.cli_path.as_deref(), Some(visible_codex.as_path()));
+        let stable_cli = fs::canonicalize(initial_release.join("bin/codex"))?;
+        assert_eq!(state.cli_path.as_deref(), Some(stable_cli.as_path()));
         assert_eq!(state.cli_installed_version.as_deref(), Some("0.43.0"));
         assert_eq!(state.cli_official_latest_version.as_deref(), Some("0.42.1"));
         assert_eq!(state.cli_package_manager_latest_version, None);
@@ -2905,9 +4463,14 @@ exit 1
             "NVM_DIR",
             "CODEX_CLI_PATH",
             "CODEX_UPDATE_MANAGER_SKIP_SYSTEM_CLI_LOOKUP",
+            "CODEX_UPDATE_MANAGER_TEST_STANDALONE_TOOL_PATH",
         ]);
         std::env::set_var("HOME", &home);
         set_test_path_with_tool_bin(&tool_bin)?;
+        std::env::set_var(
+            "CODEX_UPDATE_MANAGER_TEST_STANDALONE_TOOL_PATH",
+            std::env::join_paths([tool_bin.clone()])?,
+        );
         std::env::remove_var("NVM_DIR");
         std::env::remove_var("CODEX_CLI_PATH");
         std::env::set_var("CODEX_UPDATE_MANAGER_SKIP_SYSTEM_CLI_LOOKUP", "1");
@@ -3005,7 +4568,7 @@ exit 1
         let outcome = preflight(&mut state, &paths, Some(fixture.visible_cli.clone()), false)?;
 
         assert!(outcome.updated);
-        assert_eq!(outcome.cli_path, fixture.visible_cli);
+        assert_eq!(outcome.cli_path, fixture.entrypoint);
         assert_eq!(outcome.installed_version, "0.42.1");
         assert_eq!(state.cli_status, CliStatus::UpToDate);
         assert_eq!(state.cli_error_message, None);
@@ -3142,6 +4705,7 @@ exit 1
         std::env::set_var("NPM_CHILD_PID", &child_pid);
         let install = NpmCliInstall {
             package_root: temp.path().to_path_buf(),
+            toolchain_bin: npm_program.parent().unwrap().to_path_buf(),
             npm_program,
         };
 
@@ -3238,7 +4802,7 @@ exit 1
         let codex_path = bin_dir.join("codex");
         write_executable_script(
             &bin_dir.join("npm"),
-            "#!/bin/sh\nif [ \"$1\" = \"view\" ]; then\n  echo '0.42.1'\n  exit 0\nfi\nif [ \"$1\" = \"install\" ]; then\n  printf '%s\\n' '#!/bin/sh' \"echo 'version probe failed' >&2\" 'exit 43' > \"$FAKE_CODEX_PATH\"\n  /bin/chmod +x \"$FAKE_CODEX_PATH\"\n  exit 0\nfi\nexit 1\n",
+            "#!/bin/sh\nif [ \"$1\" = \"view\" ]; then\n  echo '0.42.1'\n  exit 0\nfi\nif [ \"$1\" = \"install\" ]; then\n  printf '%s\\n' '#!/bin/sh' \"echo 'version probe failed' >&2\" 'exit 43' > \"$FAKE_CODEX_PATH\"\n  /bin/chmod 0755 \"$FAKE_CODEX_PATH\"\n  exit 0\nfi\nexit 1\n",
         )?;
 
         let _restore_env = configure_cli_test_env(temp.path(), [bin_dir])?;
@@ -3314,7 +4878,7 @@ exit 1
         std::env::remove_var("FNM_MULTISHELL_PATH");
         std::env::set_var("FAKE_CODEX_PATH", &codex_path);
 
-        assert_eq!(npm_program(), npm_path);
+        assert_eq!(npm_program()?.0, npm_path);
 
         let mut state = PersistedState::new(true);
         state.cli_path = Some(codex_path.clone());
@@ -3467,7 +5031,7 @@ exit 1
         std::env::remove_var("FNM_DIR");
         std::env::remove_var("FNM_MULTISHELL_PATH");
 
-        assert_eq!(npm_program(), npm_path);
+        assert_eq!(npm_program()?.0, npm_path);
 
         let mut state = PersistedState::new(true);
         state.cli_path = Some(codex_path.clone());