Remote SSH bootstrap prefers stale ~/.local/bin/codex over newer /usr/bin/codex and reports version mismatch without selected path

Summary

Codex Desktop Remote SSH failed because the remote bootstrap selected an old standalone Codex symlink from ~/.local/bin/codex even though a newer /usr/bin/codex existed and satisfied the required version.

The UI reported only a version mismatch:

Minimum required: 0.141.0
Currently installed: 0.130.0

But it did not show the selected path:

/home/jim/.local/bin/codex

or the newer candidate later in PATH:

/usr/bin/codex

This made the problem look like the remote host had not been updated, even though /usr/bin/codex had been updated correctly.

Environment

Client:

• Windows Codex Desktop
• Remote SSH target: Linux host clawprod

Remote host:

• hostname: clawprod
• user: jim
• shell: bash
• Codex involved in Remote SSH app-server bootstrap

What happened

The remote host had multiple Codex installs:

Old standalone Codex:
  /home/jim/.local/bin/codex
  -> /home/jim/.codex/packages/standalone/current/codex
  version: 0.130.0

New npm global Codex:
  /usr/bin/codex
  -> /usr/lib/node_modules/@openai/codex/bin/codex.js
  version: 0.141.0

After running:

sudo npm install -g @openai/codex@latest

the system Codex was updated successfully:

/usr/bin/codex -> ../lib/node_modules/@openai/codex/bin/codex.js
codex-cli 0.141.0

But Remote SSH still failed because the bootstrap path preferred the stale standalone symlink.

The running bootstrap process showed:

/bin/sh -c printf '%b' '...'; PATH="${CODEX_INSTALL_DIR:-$HOME/.local/bin}:$PATH"; export PATH; codex app-server proxy

That prepends ~/.local/bin to PATH, so the old standalone Codex won the PATH race.

Evidence from the remote host

Current resolution after removing the stale symlink:

codex-cli 0.141.0
/usr/bin/codex
/usr/bin/codex
/bin/codex
codex is /usr/bin/codex

System Codex symlink:

/usr/bin/codex -> ../lib/node_modules/@openai/codex/bin/codex.js
/bin/codex -> ../lib/node_modules/@openai/codex/bin/codex.js
Birth/Modify: 2026-06-18 21:46:04 -0700

Old standalone symlink that had been first in PATH:

/home/jim/.local/bin/codex
-> /home/jim/.codex/packages/standalone/current/codex
version: 0.130.0
Birth: 2026-05-18 14:39:36 -0700

The old symlink was moved aside to confirm the fix:

mkdir -p ~/.local/bin/old-codex
mv ~/.local/bin/codex ~/.local/bin/old-codex/codex-0.130.0
hash -r
codex --version

After that, codex --version resolved to 0.141.0 and Remote SSH worked.

Auth log confirms the system npm update was run by the user:

2026-06-18T21:45:22 clawprod sudo: jim : COMMAND=/usr/bin/npm install -g @openai/codex@latest
2026-06-18T21:46:02 clawprod sudo: jim : COMMAND=/usr/bin/npm install -g @openai/codex@latest

Root npm logs confirm the package installed was @openai/codex@0.141.0 and that /usr/bin/codex was updated:

verbose title npm install @openai/codex@latest
verbose argv "install" "--global" "@openai/codex@latest"
silly placeDep ROOT @openai/codex@0.141.0 OK
silly reify mark retired [ '/usr/lib/node_modules/@openai/codex', '/usr/bin/codex' ]

Why this is confusing

The Codex standalone installer itself defaults to:

BIN_DIR="${CODEX_INSTALL_DIR:-$HOME/.local/bin}"
BIN_PATH="$BIN_DIR/codex"
CODEX_HOME_DIR="${CODEX_HOME:-$HOME/.codex}"
STANDALONE_ROOT="$CODEX_HOME_DIR/packages/standalone"

and creates a visible command symlink at $BIN_DIR/codex.

The installer also warns that:

Multiple managed Codex installs can be ambiguous because PATH order decides which one runs.

That is exactly what happened here, but the Remote SSH UI did not show enough detail to diagnose it.

Expected behavior

When Codex Desktop Remote SSH rejects a remote CLI version, it should show:

Required version: >= 0.141.0
Selected codex path: /home/jim/.local/bin/codex
Selected codex version: 0.130.0
Other codex candidates:
  /usr/bin/codex = 0.141.0
  /bin/codex = 0.141.0

It should also offer a repair suggestion such as:

A stale standalone Codex was found first in PATH.
Update the standalone install, remove ~/.local/bin/codex, or set CODEX_INSTALL_DIR to the intended install directory.

Actual behavior

The UI showed only:

Minimum required: 0.141.0
Currently installed: 0.130.0

It did not show the selected binary path or the presence of a newer valid binary later in PATH.

Suggested fix

1. During Remote SSH bootstrap, run and display:

command -v codex
codex --version
type -a codex

1. If the selected Codex is too old but another candidate later in PATH satisfies the version requirement, report that clearly.

1. Consider not unconditionally prepending ${CODEX_INSTALL_DIR:-$HOME/.local/bin} ahead of PATH when a newer valid codex already exists.

1. At minimum, make the error actionable by showing exact path/version resolution.