[Windows 26.901.2854.0] Desktop fails to start: bundled codex.exe exists but returns Access denied (Attributes: Archive only)

Codex App version

OpenAI.Codex 26.901.2854.0 (Microsoft Store / MSIX, x64)

Install location:

C:\Program Files\WindowsApps\OpenAI.Codex_26.901.2854.0_x64__2p2nqsd0c76g0

Platform

Windows x64, Microsoft Store/MSIX installation.

What issue are you seeing?

Codex Desktop fails to start with the dialog:

ChatGPT failed to start.
Unable to locate the Codex CLI binary.
Set CODEX_CLI_PATH or ensure the Electron resources include bin/codex.

However, the bundled CLI is present in the installed package.

PowerShell:

Get-AppxPackage OpenAI.Codex | Select-Object Name, Version, InstallLocation

$pkg = Get-AppxPackage OpenAI.Codex
Get-ChildItem $pkg.InstallLocation -Recurse -Filter "codex.exe" -ErrorAction SilentlyContinue |
    Select-Object FullName

Output confirms both binaries exist:

C:\Program Files\WindowsApps\OpenAI.Codex_26.901.2854.0_x64__2p2nqsd0c76g0\app\Codex.exe
C:\Program Files\WindowsApps\OpenAI.Codex_26.901.2854.0_x64__2p2nqsd0c76g0\app\resources\codex.exe

Trying to execute the bundled CLI directly:

$pkg = Get-AppxPackage OpenAI.Codex
& "$($pkg.InstallLocation)\app\resources\codex.exe" --version

returns:

程序“codex.exe”无法运行: 拒绝访问。
CategoryInfo          : ResourceUnavailable: (:) [], ApplicationFailedException
FullyQualifiedErrorId : NativeCommandFailed

("Access denied" / the executable cannot be run.)

Important difference from earlier reports

I also checked the file attributes:

Get-Item "$($pkg.InstallLocation)\app\resources\codex.exe" |
    Select-Object FullName, Attributes

Output:

Attributes: Archive

So on version 26.901.2854.0, the bundled codex.exe is not reported as Encrypted by Get-Item, yet direct execution still fails with Access denied, and Codex Desktop reports that it cannot locate the CLI.

This may be a newer/different variant of the Windows Store/MSIX startup problem previously reported in issues such as #40867 and #40762.

Steps to reproduce

1. Install/update Codex Desktop from Microsoft Store to 26.901.2854.0.
2. Launch Codex Desktop.
3. Observe: Unable to locate the Codex CLI binary.
4. Confirm app\resources\codex.exe exists with Get-ChildItem.
5. Run the bundled executable directly with --version.
6. PowerShell returns Access denied / NativeCommandFailed.
7. Check file attributes with Get-Item; they show Archive only, not Encrypted.

Expected behavior

Codex Desktop should start normally and use its bundled Windows CLI without requiring a separate standalone/npm CLI or a manually configured CODEX_CLI_PATH.

If Windows prevents execution or relocation of the bundled CLI, the app should surface the underlying Windows error instead of reporting that the CLI is missing.

Additional information

No WindowsApps permissions or ACLs were intentionally modified during this investigation.

The key diagnostic point is that the CLI file is present and currently reports only the Archive attribute, but it still cannot be executed directly from the package.

Start by reproducing the Microsoft Store/MSIX installation behavior and inspect app/resources/codex.exe, including its Archive-only attributes and direct --version execution. Trace how desktop startup resolves CODEX_CLI_PATH and the bundled CLI, then verify that the app launches with the bundled executable and reports an execution failure distinctly from a missing binary.