diff --git a/apps/ai-game-creator-shell/src-tauri/src/agent/codex_app_server.rs b/apps/ai-game-creator-shell/src-tauri/src/agent/codex_app_server.rs
index a512b98ed..f88cfe0d4 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/agent/codex_app_server.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/agent/codex_app_server.rs
@@ -596,15 +596,29 @@ fn direct_codex_project_path_detail(item: &serde_json::Value, pointer: &str) ->
     if value.is_empty() {
         return None;
     }
+    let trimmed = value.trim();
+    let has_windows_drive_prefix = trimmed.len() >= 2
+        && trimmed.as_bytes()[0].is_ascii_alphabetic()
+        && trimmed.as_bytes()[1] == b':';
+    let has_absolute_prefix = trimmed.starts_with('/')
+        || trimmed.starts_with('\\')
+        || trimmed.starts_with("//")
+        || trimmed.starts_with("\\\\");
+    let has_parent_segment = trimmed
+        .split(['/', '\\'])
+        .any(|component| component == "..");
     let path = std::path::Path::new(value);
     if path.is_absolute()
+        || has_windows_drive_prefix
+        || has_absolute_prefix
+        || has_parent_segment
         || path
             .components()
             .any(|component| matches!(component, std::path::Component::ParentDir))
     {
         return None;
     }
-    direct_codex_bounded_detail(value, 120)
+    direct_codex_bounded_detail(trimmed, 120)
 }
 
 fn direct_codex_mcp_tool_intermediate_text(item: &serde_json::Value) -> String {