Codex native installation on Windows fails to update when "codex update" is called

The useful diagnostic split here is whether Get-FileHash is missing from PowerShell itself or only from the environment created by codex update. It would help to capture $PSVersionTable, $env:PSModulePath, and Get-Command Get-FileHash in the same terminal before running the update. If the updater intentionally strips env vars, it may need to preserve enough PSModulePath for Microsoft.PowerShell.Utility, or call Microsoft.PowerShell.Utility\Get-FileHash with a fallback hash path on older/minimal Windows shells.

I prepared a focused branch for this:

• Branch: Nicolas0315:codex/windows-install-dotnet-hash
• Compare: https://github.com/openai/codex/compare/main...Nicolas0315:codex:codex/windows-install-dotnet-hash?expand=1
• Commit: 55babb969 fix(install): avoid Get-FileHash dependency

What changed:

• scripts/install/install.ps1 no longer depends on the Get-FileHash cmdlet.
• Archive SHA256 is computed with .NET System.Security.Cryptography.SHA256 instead.
• Existing checksum mismatch behavior is preserved.

Verification:

• Local Windows: PowerShell AST parse of scripts/install/install.ps1
• Local Windows: extracted Get-Sha256Digest returns the known SHA256 for abc
• Local Windows: extracted Test-ArchiveDigest accepts matching digest and rejects mismatched digest
• Local Windows: git diff --check
• SSH rtx4090: same PowerShell parser/helper test passed
• SSH nicolas2025: same PowerShell parser/helper test passed
• SSH rtx5060ti: same PowerShell parser/helper test passed

I attempted to open an upstream PR, but GitHub returned: Nicolas0315 does not have the correct permissions to execute CreatePullRequest.

SSH note: cyberagent-mac-m5max does not have pwsh installed, and install.ps1 is Windows-only.

It's reproduced on pwsh(PowerShell 7) only.
My powershell.exe(PowerShell 5) works.

It's reproduced on pwsh(PowerShell 7) only. My powershell.exe(PowerShell 5) works.

Just came there to share - yep the bug is reproducible only on pwsh

Updating Codex via `powershell -ExecutionPolicy Bypass -c '$env:CODEX_NON_INTERACTIVE=1; irm https://chatgpt.com/codex/install.ps1 | iex'`...
==> Updating Codex CLI from 0.142.4 to 0.142.5
==> Detected platform: Windows (ARM64)
==> Resolved version: 0.142.5
==> Downloading Codex CLI
iex : The term 'Get-FileHash' is not recognized as the name of a cmdlet, function, script file, or operable program. Ch
eck the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:75
+ ... EX_NON_INTERACTIVE=1; irm https://chatgpt.com/codex/install.ps1 | iex
+                                                                       ~~~
    + CategoryInfo          : ObjectNotFound: (Get-FileHash:String) [Invoke-Expression], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException,Microsoft.PowerShell.Commands.InvokeExpressionCommand

Error: `powershell -ExecutionPolicy Bypass -c '$env:CODEX_NON_INTERACTIVE=1; irm https://chatgpt.com/codex/install.ps1 | iex'` failed with status exit code: 1

vs

Updating Codex via `powershell -ExecutionPolicy Bypass -c '$env:CODEX_NON_INTERACTIVE=1; irm https://chatgpt.com/codex/install.ps1 | iex'`...
==> Updating Codex CLI from 0.142.4 to 0.142.5
==> Detected platform: Windows (ARM64)
==> Resolved version: 0.142.5
==> Downloading Codex CLI
==> C:\Users\nos1609\AppData\Local\Programs\OpenAI\Codex\bin is already on PATH.
==> Current PowerShell session: codex
==> Future PowerShell windows: open a new PowerShell window and run: codex
Codex CLI 0.142.5 installed successfully.

🎉 Update ran successfully! Please restart Codex.

looks like Pester is mandatory there to avoid such compatibility issues 😉

was there any updates on this? it's still broken for me in 0.144.3 when i updated to 0.144.4

also having this problem with 0.144.4, using powershell 5 gives me an error about OSArchitecture property not being found, using powershell 7 I get the error mentioned in this issue

same thing here; nothing new here, just wanted to mention that updating through npm is a workaround on my system. this obviously bypasses powershell Get-FileHash..

Environment:

• Windows 10 x64, build 19045
• PowerShell 7.6.1
• Updating Codex CLI 0.144.3 to 0.144.5
• Active binary:

%LOCALAPPDATA%\Programs\OpenAI\Codex\bin\codex.exe

This has the same root cause as #27117: when codex update runs from PowerShell 7, the powershell.exe child it spawns inherits pwsh's PSModulePath. Windows PowerShell 5.1 then discovers the Core-only Microsoft.PowerShell.Utility module (7.0) ahead of its own 3.1 copy, cannot load it, and does not fall back — so Get-FileHash stops resolving right at the checksum step. That also explains @luckyabsoluter's and @nos1609's observations that only pwsh parents are affected, and why cmd.exe and npm updates work. #27117 has the isolated reproductions and full root-cause analysis.

On the fix side, @Nicolas0315's branch above and mine reach the same conclusion independently: computing the archive SHA-256 via .NET removes the Get-FileHash dependency from install.ps1 entirely, regardless of what the child process environment looks like. I keep a patch-ready branch rebased against current main, with a regression test that passes under both Windows PowerShell 5.1 and PowerShell 7: main...snowyukitty:fix/windows-installer-dotnet-sha256, also viewable as a reviewable PR on my fork: snowyukitty/codex#2. A complementary CLI-side PSModulePath cleanup for the StandaloneWindows child has also been proposed in #27117.

Workarounds until it's fixed upstream:

• run codex update from cmd.exe or Windows PowerShell 5.1, or
• run the installer directly from your pwsh session: $env:CODEX_NON_INTERACTIVE=1; irm https://chatgpt.com/codex/install.ps1 | iex

Since these reports are spread across several issues, it may help triage to also add a 👍 on #27117 so the combined impact is visible in one place.

Still reproducible with Codex CLI 0.150.1 on Windows.

Running codex update from Codex CLI 0.149.1 attempts to launch:

powershell -ExecutionPolicy Bypass -c '$env:CODEX_NON_INTERACTIVE=1; irm https://chatgpt.com/codex/install.ps1 | iex'

and fails with:

==> Updating Codex CLI from 0.149.1 to 0.150.1
==> Detected platform: Windows (x64)
==> Resolved version: 0.150.1
==> Downloading Codex CLI
WARNING: Could not download or verify https://releases.openai.com/codex/releases/0.150.1/codex-package_SHA256SUMS;
retrying from GitHub Releases.

iex : The term 'Get-FileHash' is not recognized as the name of a cmdlet,
function, script file, or operable program.

CategoryInfo          : ObjectNotFound: (Get-FileHash:String) [Invoke-Expression], CommandNotFoundException
FullyQualifiedErrorId : CommandNotFoundException,Microsoft.PowerShell.Commands.InvokeExpressionCommand

So the issue appears to still be present in 0.150.1.

This also seems consistent with #27117, where powershell.exe inherits the PowerShell 7 PSModulePath, causing Windows PowerShell 5.1 to fail to resolve Get-FileHash.