Windows app 26.908.4834.0 fails to start: unable to locate Codex CLI or runtime components

The Windows desktop app fails to start, while the separately installed Codex CLI works.

Environment:

• Windows 11 x64.
• Installed package: OpenAI.Codex, version 26.908.4834.0.
• App installed under C:\Program Files\WindowsApps.
• Standalone CLI: codex-cli 0.154.0.

Steps to reproduce:

1. Open the desktop app from the Windows Start menu.
2. The app displays: “Unable to locate the Codex CLI binary or required runtime components. Check the installation or explicit runtime overrides.”
3. Clicking “Check for Updates” displays: net::ERR_BLOCKED_BY_CLIENT.

Expected behavior:
The desktop app opens normally.

Troubleshooting already performed:

• Uninstalled and reinstalled the app.
• Used Windows Repair and Reset, then restarted.
• Removed custom CODEX_HOME, CODEX_SQLITE_HOME and CODEX_INSTALL_DIR user variables and returned to default locations.
• Confirmed that “where.exe codex” finds the standalone CLI after restarting, and that its interactive interface opens.
• Confirmed that the app contains app\resources\codex.exe and app\resources\cua_node\bin\node.exe.
• Running either bundled executable directly from normal PowerShell with --version returns “Access denied.”
• The displayed file ACLs include execute permission for Users and show no explicit deny entries. This does not establish why execution is denied.
• No related CodeIntegrity or AppLocker events were found in the queried ten-minute interval.
• No .log files were found in the package data directory or the additional app-data locations checked.
• WinHTTP reports no proxy. Temporarily disabling antivirus and firewall did not resolve the issue.

The root cause is still unknown. Please advise how to obtain startup diagnostics when the desktop app cannot open.

Start by reproducing the startup failure from the Windows Start menu and inspect the bundled app\resources\codex.exe and app\resources\cua_node\bin\node.exe mentioned in the report. Compare their direct PowerShell --version behavior with the standalone CLI and investigate how startup diagnostics can be obtained when the app cannot open. Done means identifying the startup failure or providing a reliable diagnostics path.