[Windows][Startup blocker] 26.820 cannot relocate Application Protected codex.exe (ERROR_ENCRYPTION_FAILED)

What version of the Codex App are you using (From “About Codex” dialog)?

26.820.7780.0 (Microsoft Store/MSIX)
Bundled CLI: codex-cli 0.150.0-alpha.8

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Windows 10 22H2 x64, OS Build 19045.6466
Microsoft Store / MSIX installation

What issue are you seeing?

Codex Desktop became completely unable to start after the Microsoft Store updated it from 26.818.8289.0 to 26.820.7780.0.

Without CODEX_CLI_PATH, startup fails with this dialog:

ChatGPT failed to start. Unable to locate the Codex CLI binary. Set CODEX_CLI_PATH or ensure the Electron resources include bin/codex.

This is a complete startup blocker and cost me approximately one working day.

The bundled files are not missing. All of these files exist:

app\resources\codex.exe
app\resources\codex-code-mode-host.exe
app\resources\codex-windows-sandbox-setup.exe
app\resources\codex-command-runner.exe

Technical root-cause evidence:

1. app.asar detects that codex.exe is under WindowsApps and attempts to relocate it and its three sibling executables into:

``text
%LOCALAPPDATA%\OpenAI\Codex\bin\<hash>
``

1. The relocation implementation uses Node.js fs.copyFileSync().

1. The source executables are marked Encrypted with:

``text
Compatibility Level: Application Protected
``

1. Copying them fails with:

``text
The specified file could not be encrypted.
``

This corresponds to ERROR_ENCRYPTION_FAILED / Win32 error 6000.

1. The destination cache contains only rg.exe. codex.exe and its three sibling executables are absent.

1. The resolver treats the relocation failure as if the CLI were missing and shows the misleading “Unable to locate the Codex CLI binary” dialog.

1. A byte-identical copy of the bundled codex.exe outside WindowsApps runs correctly. Setting CODEX_CLI_PATH to that external copy allows Desktop to start.

The package is stored on the secondary AppX volume D:\WindowsApps and exposed through the standard C:\Program Files\WindowsApps package junction. Previous Codex versions worked in this same configuration.

The MSIX manifest declares Windows.Desktop MinVersion="10.0.19041.0". This computer runs build 19045 and is therefore within the package's declared minimum version.

What steps can reproduce the bug?

1. Configure the Microsoft Store default app volume as a secondary NTFS drive.
2. Install or update Codex Desktop through Microsoft Store to 26.820.7780.0.
3. Confirm that the bundled resource is Application Protected:

``powershell
$pkg = Get-AppxPackage OpenAI.Codex
cipher /c "$($pkg.InstallLocation)\app\resources\codex.exe"
``

1. Ensure CODEX_CLI_PATH is not set.
2. Fully close and reopen Codex Desktop.
3. Observe “Unable to locate the Codex CLI binary.”
4. Inspect %LOCALAPPDATA%\OpenAI\Codex\bin and observe that the expected relocated codex.exe group was not created.
5. Copying the source manually with Copy-Item reproduces:

``text
The specified file could not be encrypted.
``

What is the expected behavior?

Codex Desktop should start normally using its bundled CLI.

When relocating Application Protected files from WindowsApps, the app should use a Windows copy method equivalent to COPY_FILE_ALLOW_DECRYPTED_DESTINATION or xcopy /G, then verify the copied files.

A relocation failure should expose the underlying ERROR_ENCRYPTION_FAILED instead of incorrectly reporting that the CLI is missing.

Additional information

This is the native-Windows startup-blocking variant of the protected-file relocation problem already reported in:

• #25220
• #25571
• #32403
• #34764
• #38696

First observed: 2026-08-26.

<img width="554" height="166" alt="Codex startup error: Unable to locate the Codex CLI binary" src="https://github.com/user-attachments/assets/dff99720-68e7-464f-aba6-4d95cc608071" />

Restarting Windows, reinstalling/rolling back the MSIX, and verifying the package signature did not provide a permanent fix.

Current workaround: CODEX_CLI_PATH points to an external copy of codex.exe. Restoring this variable immediately restores startup.

No WindowsApps ACLs, package files, or encryption settings were modified.