Updater reports success after install script fails with curl 403

Open 💬 3 comments Opened Apr 24, 2026 by guluarte

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

codex-cli 0.122.0

What subscription do you have?

Not provided.

What platform is your computer?

Linux 6.6.87.2-microsoft-standard-WSL2 x86_64 x86_64

What issue are you seeing?

Running the in-product Codex update flow can fail to download the install script with curl: (22) The requested URL returned error: 403, but Codex still prints a success message saying the update succeeded.

Press enter to continue

Updating Codex via `sh -c 'curl -fsSL https://chatgpt.com/codex/install.sh | sh'`...
curl: (22) The requested URL returned error: 403

Update ran successfully! Please restart Codex.

What steps can reproduce the bug?

Trigger the Codex update flow.
Continue so Codex runs:

sh -c 'curl -fsSL https://chatgpt.com/codex/install.sh | sh'

Observe that curl returns HTTP 403.
Observe that Codex still prints Update ran successfully! Please restart Codex.

What is the expected behavior?

If the install script download fails, the update should fail clearly and should not report success.

Additional information

This looks consistent with curl ... | sh only checking the shell process result. If curl fails before producing script output, sh can still exit successfully on empty input unless the caller explicitly checks the curl exit status or uses pipefail.

View original on GitHub ↗

3 Comments

github-actions[bot] contributor · 4 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#16488

Powered by Codex Action

jiang1997 · 2 months ago

I can reproduce the root cause here. The standalone Unix update command currently pipes curl directly into sh:

curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_NON_INTERACTIVE=1 sh

On POSIX shells, a pipeline reports the status of the final command by default. That means curl can fail, while the trailing sh still exits successfully after receiving empty input, causing Codex to print Update ran successfully!.

A portable fix would be to avoid the pipeline and only run the installer after curl succeeds:

installer=$(mktemp) || exit 1; trap 'rm -f "$installer"' EXIT; curl -fsSL https://chatgpt.com/codex/install.sh -o "$installer" && CODEX_NON_INTERACTIVE=1 sh "$installer"

This should not add a new practical dependency for the standalone Unix path, since install.sh already requires mktemp.

ChihweiLHBird · 2 months ago

I worked out a suggested fix but can't open a PR...
https://github.com/openai/codex/compare/main...ChihweiLHBird:zhiwei/fix-update