Windows desktop: benign background preview command is rejected as blocked by policy before process creation

Summary

On Codex Desktop for Windows, a local background preview manager is rejected by the execution policy before its Node process is created. The same command fails from both:

• a task whose project is on a secondary drive; and
• a new projectless task stored on the system drive.

The command starts a localhost-only synthetic acceptance server. It does not delete files, modify system configuration, access production services, or use credentials.

Environment

• Codex Desktop: 26.901.6511.0
• Codex CLI: 0.145.0
• Windows: build 26200.9168, display version 25H2
• Shell invoked by Codex: bundled PowerShell (pwsh.exe)
• Approval policy shown to the task: never
• Filesystem permission profile shown to the task: unrestricted

Reproduction

The preview manager is a local Node script that starts a detached child process, records its PID and logs, probes the expected localhost URL, and returns after a bounded readiness timeout.

Run the following through the Codex execution tool:

node "C:\Users\<user>\.codex\skills\start-local-preview\scripts\preview-manager.cjs" start \
  --cwd "D:\<project>" \
  --name "library-session-qa" \
  --command "node scripts/library-session-preview.mjs" \
  --url "http://localhost:43146/demo-v2.html" \
  --timeout-ms 10000

The child command is an ordinary Node HTTP server bound to localhost and backed only by synthetic in-memory test data.

Actual behavior

The execution tool rejects the request before the preview manager starts:

exec_command failed: CreateProcess { message: "Rejected(\"... pwsh.exe -Command ... preview-manager.cjs start ...\" rejected: blocked by policy)" }

Observed consequences:

• no process is created;
• no PID is returned;
• no stdout or stderr log is created by the manager;
• the localhost port is never bound; and
• browser acceptance cannot begin.

The same sanitized command shape produced the same result in a fresh projectless task located on C:\Users\<user>\Documents\Codex\..., while keeping the target project as the --cwd value. Ordinary read-only shell commands work in both tasks.

Expected behavior

The safe local preview command should be allowed to start, or Codex should request approval if approval is applicable. The manager should then return a positive PID and the ready localhost URL.

If the command must remain blocked, the rejection should identify the policy rule and the specific command feature that triggered it so the command can be adjusted safely.

Additional context

This appears related to the policy-layer symptom reported in:

• https://github.com/openai/codex/issues/10827
• https://github.com/openai/codex/issues/5128

Those reports involve destructive Git or filesystem commands. This reproduction is different because it starts a bounded localhost development server and performs no destructive action.

This is also separate from the Windows Browser trusted-path error reported in:

• https://github.com/openai/codex/issues/42238
• https://github.com/openai/codex/issues/39136

In this reproduction, Browser initialization is not reached. The execution request is rejected first.

No registry, PATH, execution-policy, plugin-cache, project, or production-data changes were made while reproducing the issue.

Start by reproducing the sanitized preview-manager.cjs command through the Codex execution tool on Windows, then trace the policy handling for the bundled pwsh.exe invocation. Compare the behavior with ordinary read-only shell commands and the linked policy reports. Done means the safe localhost preview starts, or the rejection identifies the applicable policy rule and command feature.