[Windows] Missing bundled codex.exe causes fatal startup despite valid relocated CLI

[Windows] Missing bundled codex.exe causes fatal startup despite a valid relocated CLI

Codex App version

• App telemetry release: codex@26.707.31428
• MSIX package: OpenAI.Codex_26.707.3748.0_x64__2p2nqsd0c76g0

Subscription

Not relevant to the local bootstrap failure.

Platform

Microsoft Windows NT 10.0.19045 x64

Issue

If antivirus quarantines only the bundled Windows CLI at
<WindowsApps package>\app\resources\codex.exe, Codex App aborts bootstrap even
when valid, signed Codex CLIs already exist in its writable per-user bin cache.

The triggering AV detection was Malwarebytes Trojan.Obfuscated. This report
does not ask OpenAI to trust the AV classification either way: the resilience
bug is that one missing packaged file makes startup fatal despite available
integrity-checkable recovery candidates.

Observed startup chain in %APPDATA%\Codex\web\Codex\sentry\scope_v3.json:

bundled_executable_relocation_failed
operation=stat_source
sourceKind=windowsapps
sourcePath=<WindowsApps package>\app\resources\codex.exe
destinationPath=%LOCALAPPDATA%\OpenAI\Codex\bin\codex.exe
originalError=ENOENT
errorName=BundledExecutableRelocationError

[AppServerConnection] app_server_connection.transport_connect_failed
errorMessage="Unable to locate the Codex CLI binary. Set CODEX_CLI_PATH or ensure the Electron resources include bin/codex."

[AppServerConnection] fatal_error_broadcasted initialized=false
Desktop bootstrap failed to start the main app phase=bootstrap-import-main

At the same time, this usable candidate already existed:

%LOCALAPPDATA%\OpenAI\Codex\bin\a7c12ebff69fb123\codex.exe
version: codex-cli 0.144.0-alpha.4
size: 341269296 bytes
Authenticode: Valid
signer: OpenAI OpCo, LLC
SHA-256: B88F944EF63556527CAAE2AD43F80B88B8BE174DC09B09D9B037FC94240A0E91

A second signed candidate was present at
%LOCALAPPDATA%\OpenAI\Codex\bin\codex.exe (codex-cli 0.130.0-alpha.5).

Reproduction

1. Install Codex App from the Windows MSIX package.
2. Launch it once so a CLI exists under %LOCALAPPDATA%\OpenAI\Codex\bin\<hash>\codex.exe.
3. Remove or quarantine only <WindowsApps package>\app\resources\codex.exe.
4. Launch Codex App without an OS-level CODEX_CLI_PATH.
5. Observe the fatal bootstrap error even though the signed per-user candidate remains available.

Malwarebytes could quarantine the file from WindowsApps but could not restore
it there (Access is denied). Windows Settings -> Repair reported success but
did not replace the missing payload.

Workaround and residual degradation

Setting the user environment variable to the already-staged CLI restores the
main app:

setx CODEX_CLI_PATH "$env:LOCALAPPDATA\OpenAI\Codex\bin\a7c12ebff69fb123\codex.exe"

Live verification after relaunch shows the app working and app-server stdio
traffic increasing. The packaged CLI is still absent, and telemetry continues
to emit bundled_executable_relocation_failed.

There is also a residual failure not covered by the initial bootstrap error:

[bundled-plugins] bundled_plugins_reconcile_failed
errorMessage="Missing bundled Electron Codex runtime required to sync Chrome plugin app server for com.openai.codexextension"
hasExternalPluginStateSync=true

So CODEX_CLI_PATH restores core app use but is not a complete repair.

Expected behavior

The app should resolve the first trusted, compatible CLI candidate rather than
making the packaged source a single point of failure. A reasonable order is:

1. Explicit CODEX_CLI_PATH.
2. Last-known-good signed/hash-verified %LOCALAPPDATA% hashed CLI.
3. Current %LOCALAPPDATA%\OpenAI\Codex\bin\codex.exe.
4. A freshly downloaded, integrity-verified CLI.
5. PATH, if product policy permits it.

Relocation should be idempotent and skippable when a valid destination already
exists. If no trusted candidate is usable, show an antivirus-aware repair UI
that can re-download the CLI into the writable per-user cache. Only abort after
all integrity-checked recovery paths fail.

Packaging notes

The Windows resources directory also contained a large extensionless codex
file with ELF magic bytes while codex.exe was the Windows PE used at runtime.
Shipping only the host-platform runtime would reduce scan surface and make
missing-file diagnostics less ambiguous.