[Windows][Codex App] Non-forced cleanup of verified empty worktree directory blocked by policy

Environment

• Codex Desktop Windows package: OpenAI.Codex 26.901.6511.0 (verified with Get-AppxPackage; About dialog not inspected).
• Windows build: 10.0.26200.0; PowerShell 7.6.
• Separately installed Codex CLI: 0.153.4; not assumed to be the app's bundled version.
• Session: full filesystem access (danger-full-access), approval policy never.
• Subscription: not included.

Issue

Automatic command review rejected explicitly requested post-merge cleanup with only blocked by policy. The rejected PowerShell commands used Remove-Item -LiteralPath ... -ErrorAction Stop without -Force.

Two observed cases:

1. Git worktree removal removed the checkout contents and deregistered the worktree, but Windows denied removal of the empty top-level directory. A separate read-only check confirmed that directory had zero entries. An exact-path, non-recursive, non-forced Remove-Item recovery command was then blocked by automatic review.
2. Cleanup of two individually enumerated HTML reports created by the agent in the user's temporary directory was separately blocked. The paths and file details had been checked. This command also used no force option.

The agent stopped after the policy denials. No alternative deletion API or force flag was used to bypass them. Ordinary branch deletion and Git pruning succeeded, and other authorized cleanup had succeeded earlier.

Steps / reproduction shape

Observed during one real cleanup session; a standalone deterministic reproduction has not been established. The following is a sanitized equivalent of the empty-directory operation, not an exact transcript:

$cleanupTarget = 'C:\example\retired-worktree'
$resolvedTarget = (Resolve-Path -LiteralPath $cleanupTarget -ErrorAction Stop).Path
if ($resolvedTarget -ne 'C:\example\retired-worktree') { throw 'Unexpected target' }
if (@(Get-ChildItem -LiteralPath $resolvedTarget -Force -ErrorAction Stop).Count -ne 0) { throw 'Directory is not empty' }
Remove-Item -LiteralPath $resolvedTarget -ErrorAction Stop

-Force above is only on the read-only directory listing so hidden entries are counted; it is not on deletion. The empty-directory operation does not need recursive deletion.

Expected behavior

Permit a narrowly scoped, user-authorized cleanup when policy allows it. Otherwise, explain which policy condition caused the denial and provide a supported resolution. A generic denial makes it impossible to distinguish a legitimate restriction from a false positive. Recovery should not require force, alternate deletion APIs, or weaker safety settings.

Related reports / scope

Related to #38886 and #34331. This report supplies evidence on app package 26.901.6511.0 that removal can be rejected even without a force flag, including an already empty, deregistered worktree directory. The example in #38886 uses forced deletion.

The observed denial is verified; the underlying policy rule and root cause are unknown. A custom no-force hook was installed only AFTER these failures, so that new hook did not cause them. No private repository identifiers, actual local paths, workbook contents, credentials, or raw session logs are included.

Start by reproducing the sanitized PowerShell cleanup shape in the Windows Codex App and inspect the automatic command review decision. Compare the behavior and policy explanation with related reports #38886 and #34331; done means authorized cleanup is either permitted or rejected with a specific supported resolution.