Windows self-update reports success but npm cleanup fails with EPERM unlinking codex.exe

What version of Codex CLI is running?

codex-cli 0.130.0

What subscription do you have?

No relational

Which model were you using?

_No response_

What platform is your computer?

Microsoft Windows NT 10.0.26100.0 x64

What terminal emulator and version are you using (if applicable)?

PowerShell pwsh

What issue are you seeing?

On Windows, the built-in Codex update flow appears to complete successfully. The installed Codex version is updated, and Codex prints:

🎉 Update ran successfully! Please restart Codex.

However, during the update, the underlying npm install -g @openai/codex command emits an npm cleanup warning and leaves behind a temporary .codex-* directory under the npm global package directory.

The problem is not that the update failed. The problem is that the successful update leaves garbage files behind, including a staged copy of the Windows native codex.exe binary that npm could not remove.

What steps can reproduce the bug?

This was reproduced on a Windows GitHub Actions runner.

1. Install an older Codex version globally:

npm install -g @openai/codex@0.128.0

1. Run Codex and trigger the built-in update flow.
2. Codex runs:

npm install -g @openai/codex

1. Observe the update output.

Actual output

Updating Codex via npm install -g @openai/codex...
npm warn cleanup Failed to remove some directories [
npm warn cleanup [
npm warn cleanup 'C:\npm\prefix\node_modules\@openai\.codex-qgGaTSRE',
npm warn cleanup [Error: EPERM: operation not permitted, unlink 'C:\npm\prefix\node_modules\@openai\.codex-qgGaTSRE\node_modules\@openai\codex-win32-x64\vendor\x86_64-pc-windows-msvc\codex\codex.exe'] {
npm warn cleanup errno: -4048,
npm warn cleanup code: 'EPERM',
npm warn cleanup syscall: 'unlink',
npm warn cleanup path: 'C:\npm\prefix\node_modules\@openai\.codex-qgGaTSRE\node_modules\@openai\codex-win32-x64\vendor\x86_64-pc-windows-msvc\codex\codex.exe'
npm warn cleanup }
npm warn cleanup ]
npm warn cleanup ]
changed 2 packages in 5s
🎉 Update ran successfully! Please restart Codex.

What is the expected behavior?

Codex self-update should complete cleanly on Windows without leaving behind temporary .codex-* directories.

There should be no npm cleanup warning such as EPERM: operation not permitted, unlink ... codex.exe.

At minimum, the updater should report that the update completed but cleanup failed, and suggest closing running Codex processes or manually removing the leftover temporary .codex-* directory.

Additional information

name: Reproduce Codex self-update EPERM on Windows

on:
  push:
  workflow_dispatch:

jobs:
  repro:
    runs-on: windows-latest

    steps:
      - name: Show environment
        shell: pwsh
        run: |
          node --version
          npm --version
          whoami

      - name: Install Codex 0.128.0
        shell: pwsh
        run: |
          npm install -g @openai/codex@0.128.0
          codex --version
          npm root -g
          Get-Command codex | Format-List *

      - name: Run Codex self-update
        shell: pwsh
        continue-on-error: true
        run: |
          codex update

      - name: Print npm logs
        if: always()
        shell: pwsh
        run: |
          $dirs = @(
            "$env:LOCALAPPDATA\npm-cache\_logs",
            "$env:APPDATA\npm-cache\_logs"
          )

          foreach ($dir in $dirs) {
            Write-Host "Checking $dir"
            if (Test-Path $dir) {
              Get-ChildItem $dir -Filter "*.log" |
                Sort-Object LastWriteTime -Descending |
                Select-Object -First 10 |
                ForEach-Object {
                  Write-Host "`n===== $($_.FullName) ====="
                  Get-Content $_.FullName -Tail 300
                }
            }
          }

      - name: Verify final Codex version
        if: always()
        shell: pwsh
        run: |
          codex --version
          npm list -g @openai/codex