Misleading Browser policy error when configured Codex CLI path does not exist

Summary

On Windows Codex Desktop, Browser Use can report a misleading enterprise policy error when the underlying failure is that the configured Codex CLI path points to a stale or missing codex.exe.

The user-facing error I saw was:

Browser Use cannot access http://127.0.0.1:<port> because enterprise network policy blocks it.

However, probing the Browser policy/config path showed the lower-level failure was:

failed to start codex app-server: The system cannot find the path specified. (os error 3)

In this repro, the missing path came from stale Codex CLI path configuration after an update.

Environment

• OS: Windows
• Codex Desktop/native host versions observed: 26.602.71036 / 26.609.x
• Codex CLI after repair: 0.140.0-alpha.2
• Codex home in this environment: D:\.codex

Note: this is a custom Codex home. Other users may see this under %USERPROFILE%\.codex or another CODEX_HOME.

Stale paths found

The stale codex.exe path appeared in both places:

<CODEX_HOME>\config.toml
<CODEX_HOME>\chrome-native-hosts-v2.json

Example stale path:

C:\Users\<USER>\AppData\Local\OpenAI\Codex\bin\fb2111b91430cb17\codex.exe

That hash directory no longer existed.

After updating both config locations to the existing codex.exe path, restarting Codex Desktop made the Browser policy/config path work again.

Failure chain

configured Codex CLI path points to a missing codex.exe
  -> Codex app-server startup fails with os error 3
  -> Browser policy/config read fails
  -> Browser client fails closed
  -> user sees enterprise network policy blocks it

The final message sends the user toward enterprise policy, localhost permissions, browser plugin injection, or network security. In this case, the actual fix was to correct stale local codex.exe paths.

Expected behavior

When the configured Codex CLI path does not exist, the error should say so directly, for example:

Failed to start Codex app-server because the configured Codex CLI path does not exist:
C:\Users\<USER>\AppData\Local\OpenAI\Codex\bin\fb2111b91430cb17\codex.exe

Please restart/reinstall Codex or update CODEX_CLI_PATH / paths.codexCliPath so the path points to an existing codex.exe.

The Browser policy layer should distinguish at least:

1. actual enterprise policy denial
2. config/policy service unavailable
3. configured Codex CLI path missing
4. app-server startup failure
5. permission/authentication failure

Only the first case should be surfaced as enterprise network policy blocks it.

Suggested minimal fix

Before starting Codex app-server from a configured CLI path, check whether the configured codex.exe path exists.

If not, return a specific error such as:

CodexCliPathNotFound

The error should include:

• the configured path
• which config source provided it, e.g. config.toml or chrome-native-hosts-v2.json
• a recovery hint, such as restarting/reinstalling Codex or regenerating the native host config

Related issues

This seems related to the existing Windows stale path / app-server issues, but the focus here is the misleading Browser policy error mapping:

• #26011: stale config.toml paths after auto-update
• #20206: Browser Use fails with failed to start codex app-server (os error 3)
• #26792: broader MS Store update stale config/plugin cascade

Those issues explain nearby root causes. This issue is specifically about surfacing the missing configured CLI path instead of reporting an enterprise policy denial.