greg-asher · germanKoch · Jul 16, 2026
diff --git a/README.md b/README.md
@@ -63,6 +63,16 @@ This repository is the plugin root.
 
 The source of truth is the unpacked plugin content in this repository. There is no separate packaged copy.
 
+## macOS Zsh Path Override
+
+The Codex Desktop launcher uses `/usr/local/bin/zsh` by default for backward compatibility. If Zsh is installed elsewhere, set `CODEX_OBSIDIAN_ZSH_PATH` to an absolute path before starting Codex. For example:
+
+```bash
+export CODEX_OBSIDIAN_ZSH_PATH=/bin/zsh
+```
+
+The launcher quotes the resolved path and continues to use the existing sanitized `script + zsh -ilc` execution form.
+
 ## Local Install And Test Flow
 
 1. Clone this repository locally.

diff --git a/skills/obsidian-cli-bases-and-bookmarks/SKILL.md b/skills/obsidian-cli-bases-and-bookmarks/SKILL.md
@@ -35,9 +35,11 @@ Assume these must be true before relying on this skill:
 In Codex Desktop on macOS, prefer this wrapper:
 
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian ...'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian ...'
 ```
 
+Set `CODEX_OBSIDIAN_ZSH_PATH` to override the default `/usr/local/bin/zsh` path. The override must be an absolute path to a Zsh-compatible executable.
+
 Escalate the wrapped command only when required by sandbox boundaries.
 
 ## Core operating policy

diff --git a/...ian-cli-bases-and-bookmarks/references/obsidian-cli-bases-bookmarks-playbook.md b/...ian-cli-bases-and-bookmarks/references/obsidian-cli-bases-bookmarks-playbook.md
@@ -3,7 +3,7 @@
 Use the Codex-safe wrapper in Codex Desktop on macOS:
 
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian <command>'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian <command>'
 ```
 
 ## Read-only discovery

diff --git a/skills/obsidian-cli-devtools/SKILL.md b/skills/obsidian-cli-devtools/SKILL.md
@@ -34,9 +34,11 @@ Assume these must be true before relying on this skill:
 In Codex Desktop on macOS, prefer this wrapper:
 
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian ...'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian ...'
 ```
 
+Set `CODEX_OBSIDIAN_ZSH_PATH` to override the default `/usr/local/bin/zsh` path. The override must be an absolute path to a Zsh-compatible executable.
+
 Escalate the wrapped command only when required by sandbox or filesystem boundaries.
 
 ## Core operating policy

diff --git a/skills/obsidian-cli-devtools/references/obsidian-cli-devtools-playbook.md b/skills/obsidian-cli-devtools/references/obsidian-cli-devtools-playbook.md
@@ -3,7 +3,7 @@
 Use the Codex-safe wrapper in Codex Desktop on macOS:
 
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian <command>'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian <command>'
 ```
 
 ## Read-only diagnostics first

diff --git a/skills/obsidian-cli-runtime-admin/SKILL.md b/skills/obsidian-cli-runtime-admin/SKILL.md
@@ -35,9 +35,11 @@ Assume these must be true before relying on this skill:
 In Codex Desktop on macOS, prefer this wrapper:
 
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian ...'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian ...'
 ```
 
+Set `CODEX_OBSIDIAN_ZSH_PATH` to override the default `/usr/local/bin/zsh` path. The override must be an absolute path to a Zsh-compatible executable.
+
 Escalate the wrapped command only when required by sandbox boundaries.
 
 ## Core operating policy

diff --git a/...ls/obsidian-cli-runtime-admin/references/obsidian-cli-runtime-admin-playbook.md b/...ls/obsidian-cli-runtime-admin/references/obsidian-cli-runtime-admin-playbook.md
@@ -3,7 +3,7 @@
 Use the Codex-safe wrapper in Codex Desktop on macOS:
 
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian <command>'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian <command>'
 ```
 
 ## Read-only inventory first

diff --git a/skills/obsidian-cli-sync-and-publish/SKILL.md b/skills/obsidian-cli-sync-and-publish/SKILL.md
@@ -34,9 +34,11 @@ Assume these must be true before relying on this skill:
 In Codex Desktop on macOS, prefer this wrapper:
 
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian ...'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian ...'
 ```
 
+Set `CODEX_OBSIDIAN_ZSH_PATH` to override the default `/usr/local/bin/zsh` path. The override must be an absolute path to a Zsh-compatible executable.
+
 Escalate the wrapped command only when required by sandbox boundaries.
 
 ## Core operating policy

diff --git a/.../obsidian-cli-sync-and-publish/references/obsidian-cli-sync-publish-playbook.md b/.../obsidian-cli-sync-and-publish/references/obsidian-cli-sync-publish-playbook.md
@@ -3,7 +3,7 @@
 Use the Codex-safe wrapper in Codex Desktop on macOS:
 
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian <command>'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian <command>'
 ```
 
 ## Read-first release gate

diff --git a/skills/obsidian-cli-workspace-and-navigation/SKILL.md b/skills/obsidian-cli-workspace-and-navigation/SKILL.md
@@ -37,9 +37,11 @@ Assume these must be true before relying on this skill:
 In Codex Desktop on macOS, prefer this wrapper:
 
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian ...'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian ...'
 ```
 
+Set `CODEX_OBSIDIAN_ZSH_PATH` to override the default `/usr/local/bin/zsh` path. The override must be an absolute path to a Zsh-compatible executable.
+
 Escalate the wrapped command only when required by sandbox boundaries.
 
 ## Core operating policy

diff --git a/...rkspace-and-navigation/references/obsidian-cli-workspace-navigation-playbook.md b/...rkspace-and-navigation/references/obsidian-cli-workspace-navigation-playbook.md
@@ -3,7 +3,7 @@
 Use the Codex-safe wrapper in Codex Desktop on macOS:
 
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian <command>'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian <command>'
 ```
 
 ## Read-only inspection first

diff --git a/skills/obsidian-official-cli/SKILL.md b/skills/obsidian-official-cli/SKILL.md
@@ -36,9 +36,11 @@ Assume these must be true before relying on this skill:
 When this skill is used from Codex Desktop on macOS, do **not** invoke `obsidian` directly first. Prefer the Codex-safe wrapper form below:
 
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian ...'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian ...'
 ```
 
+Set `CODEX_OBSIDIAN_ZSH_PATH` when the login shell is installed somewhere other than `/usr/local/bin/zsh`. The default remains `/usr/local/bin/zsh` for backward compatibility. The override must be an absolute path to a Zsh-compatible executable.
+
 Why:
 - direct launches from the Codex app environment can crash before CLI handling begins
 - the crash is caused by inherited Cocoa / app identity state, not by vault permissions or note content
@@ -59,10 +61,9 @@ Enhanced wrapped execution form:
 
 ```text
 functions.exec_command(
-  cmd="script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault=<vault> <command>'",
+  cmd="script -q /dev/null \"${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}\" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault=<vault> <command>'",
   sandbox_permissions="require_escalated",
-  justification="<short user-facing reason>",
-  prefix_rule=["script","-q","/dev/null","/usr/local/bin/zsh","-ilc"]
+  justification="<short user-facing reason>"
 )
 ```
 

diff --git a/skills/obsidian-official-cli/references/obsidian-cli-command-playbook.md b/skills/obsidian-official-cli/references/obsidian-cli-command-playbook.md
@@ -8,14 +8,15 @@ Check that the CLI is visible:
 
 ```bash
 command -v obsidian
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian version'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian version'
 ```
 
 Remember:
 - `vault=<name>` or `vault=<id>` must come before the command.
 - `file=<name>` is for loose read-only note resolution only.
 - `path=<path>` is exact vault-relative targeting and should be preferred once resolved.
-- In Codex Desktop on macOS, prefer the sanitized `script -q /dev/null /usr/local/bin/zsh -ilc 'unset ...; export TERM=xterm-256color; obsidian ...'` wrapper instead of direct `obsidian ...` launches.
+- `CODEX_OBSIDIAN_ZSH_PATH` can override the default `/usr/local/bin/zsh` launcher path and must point to an absolute Zsh-compatible executable.
+- In Codex Desktop on macOS, prefer the sanitized `script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset ...; export TERM=xterm-256color; obsidian ...'` wrapper instead of direct `obsidian ...` launches.
 - The wrapper is the command form. Escalation is a separate decision.
 - Local filesystem support is acceptable when it helps the official CLI complete a safe vault workflow.
 
@@ -38,8 +39,8 @@ Use this sequence especially when the vault lives outside the current workspace.
 When running from Codex Desktop on macOS, use the raw wrapper form directly:
 
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian version'
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" read path="Projects/Kestrel.md"'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian version'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" read path="Projects/Kestrel.md"'
 ```
 
 When the wrapped command needs higher privilege in Codex, escalate this exact wrapped form rather than switching back to raw `obsidian ...`.
@@ -48,50 +49,49 @@ Example enhanced execution shape:
 
 ```text
 functions.exec_command(
-  cmd="script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault=\"My Vault\" append path=\"Projects/Kestrel.md\" content=\"\\n- [ ] Review\"'",
+  cmd="script -q /dev/null \"${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}\" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault=\"My Vault\" append path=\"Projects/Kestrel.md\" content=\"\\n- [ ] Review\"'",
   sandbox_permissions="require_escalated",
-  justification="Do you want to run the official Obsidian CLI to update this note in the external vault?",
-  prefix_rule=["script","-q","/dev/null","/usr/local/bin/zsh","-ilc"]
+  justification="Do you want to run the official Obsidian CLI to update this note in the external vault?"
 )
 ```
 
 ## Read and search
 
 ### Read the active file
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian read'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian read'
 ```
 
 ### Read a named file
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" read file=Recipe'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" read file=Recipe'
 ```
 
 ### Read an exact path
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" read path="Projects/Kestrel.md"'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" read path="Projects/Kestrel.md"'
 ```
 
 ### Search the vault
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" search query="meeting notes"'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" search query="meeting notes"'
 ```
 
 ### Search with line context
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" search:context query="agent loop"'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" search:context query="agent loop"'
 ```
 
 ## Create and edit
 
 ### Create a note
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" create name="Project Brief"'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" create name="Project Brief"'
 ```
 
 ### Create a note with content
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" create path="Projects/Brief.md" content="# Brief\n\nInitial notes"'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" create path="Projects/Brief.md" content="# Brief\n\nInitial notes"'
 ```
 
 Important:
@@ -106,12 +106,12 @@ obsidian vault="My Vault" create name="Trip to Paris" template=Travel
 
 ### Append content
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" append path="Projects/Brief.md" content="\n- [ ] Review outline"'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" append path="Projects/Brief.md" content="\n- [ ] Review outline"'
 ```
 
 ### Prepend content after frontmatter
 ```bash
-script -q /dev/null /usr/local/bin/zsh -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" prepend path="Projects/Brief.md" content="Summary line\n"'
+script -q /dev/null "${CODEX_OBSIDIAN_ZSH_PATH:-/usr/local/bin/zsh}" -ilc 'unset __CFBundleIdentifier LaunchInstanceID XPC_SERVICE_NAME CODEX_CI CODEX_SANDBOX CODEX_SHELL; export TERM=xterm-256color; obsidian vault="My Vault" prepend path="Projects/Brief.md" content="Summary line\n"'
 ```
 
 ### Rename a note

diff --git a/skills/obsidian-official-cli/references/validation.md b/skills/obsidian-official-cli/references/validation.md
@@ -23,9 +23,10 @@ Use this checklist when refining the plugin in this repository.
 9. Confirm `SKILL.md` tells Codex to request escalated execution when the target vault is outside writable roots.
 10. Confirm `SKILL.md` documents the Codex Desktop macOS launch wrapper and explains why direct `obsidian` child launches can crash.
 11. Confirm `SKILL.md` separates wrapped command form from escalation policy and tells Codex to escalate the wrapped command when needed.
-12. Confirm the playbook documents missing-parent-folder behavior as a local support step rather than a hard stop.
-13. Confirm `agents/openai.yaml` keeps implicit invocation disabled unless deliberately changed.
-14. Confirm `assets/eval-prompts.csv` still covers explicit positives, implicit probes, safety cases, and out-of-scope cases.
+12. Confirm `CODEX_OBSIDIAN_ZSH_PATH` overrides the launcher shell while the unset case still resolves to `/usr/local/bin/zsh`.
+13. Confirm the playbook documents missing-parent-folder behavior as a local support step rather than a hard stop.
+14. Confirm `agents/openai.yaml` keeps implicit invocation disabled unless deliberately changed.
+15. Confirm `assets/eval-prompts.csv` still covers explicit positives, implicit probes, safety cases, and out-of-scope cases.
 
 ## Prompt checks
 
@@ -66,6 +67,7 @@ During manual checks, verify:
 - daily-note mutations use the documented `daily:*` commands rather than implicit active-file writes
 - a read-only probe happens before the first mutation in a session
 - from Codex Desktop on macOS, the probe works with the sanitized `script + zsh -ilc` wrapper
+- the wrapper uses `/usr/local/bin/zsh` when `CODEX_OBSIDIAN_ZSH_PATH` is unset and the configured absolute path when it is set
 - a direct unwrapped launch is not required if the wrapped launch is the stable path in Codex
 - when escalation is needed, the wrapped command is what gets escalated
 - external vault mutations try the wrapped CLI path before escalation