codex doctor: latest version probe fails with HTTP 403 (cached latest version stays stale)

Summary

codex doctor reports update configuration is locally consistent, but its latest-version probe fails with HTTP 403. As a result cached latest version stays stale and the CLI cannot tell the user that a newer version exists.

Environment

• OS: Windows 11 (10.0.26200), x64
• Codex CLI: 0.152.1, standalone install (%LOCALAPPDATA%\Programs\OpenAI\Codex\bin\codex.exe)
• Auth: ChatGPT
• No proxy (proxy env vars: none, respect system proxy: disabled)

Steps to reproduce

codex doctor

Actual output (Updates section)

Updates
  ! updates      update configuration is locally consistent
      startup update check     true
      update action            standalone installer
      version cache            C:\Users\<user>\.codex\version.json
      cached latest version    0.152.0
      last checked at          2026-09-01 06:18 UTC
      latest version probe     curl: (22) The requested URL returned error: 403

Note that cached latest version shows 0.152.0 while the installed version is 0.152.1 — the cache was never refreshed because the probe fails.

Expected

Either the probe succeeds, or the failure is surfaced as a problem. Right now the wording ("update configuration is locally consistent") reads as healthy even though the update check is not working.

Impact

The startup update notification cannot be relied on. We currently work around this by querying gh api repos/openai/codex/releases/latest instead of trusting the CLI's own notification.

Notes

Other network checks in the same doctor run succeed, so general connectivity is fine:

• websocket: connected (HTTP 101 Switching Protocols)
• reachability: active provider endpoints are reachable over HTTP (ChatGPT inference URL, HTTP 405)

Observed on 2026-09-03 with 0.152.1.

Start by tracing the codex doctor Updates section and the latest-version probe, reproducing the HTTP 403 and inspecting how the version cache is handled. Done means the probe succeeds or its failure is clearly surfaced as a problem, with the stale cached version no longer presented as healthy.