Windows: Codex provider startup failure hides underlying codex app-server stderr

[PohTeyToe]

Summary

On Windows, T3 Code showed the Codex provider as Not found. Sending a message failed with:

ProviderAdapterProcessError: Provider adapter process error (codex)
Codex App Server process exited with code 1

This was hard to diagnose because T3 Code did not surface the stderr from the underlying codex app-server process.

I do not have a minimal repro, but I wanted to share the diagnostic path in case it helps improve the provider error handling.

Environment

• OS: Windows
• T3 Code: 0.0.21
• Codex CLI: codex-cli 0.128.0-alpha.1
• Shell: PowerShell
• Codex install source: Codex desktop app / Windows app package

Diagnostics

codex --version worked, but starting the app server directly failed:

codex app-server --listen ws://127.0.0.1:0

Output:

Error: error loading default config after config error: Access is denied. (os error 5)

On my machine, I found unreadable Codex sandbox state under:

C:\Users\<me>\.codex\.sandbox-secrets*

I also found that codex was not resolving to the expected shim path:

%LOCALAPPDATA%\OpenAI\Codex\bin\codex.exe

Instead, it appeared to resolve to a packaged executable under:

C:\Program Files\WindowsApps\...

I am not sure whether T3 Code used the same resolution path internally, because the startup error did not include the executable path or stderr.

Workaround

I moved the unreadable .sandbox-secrets* entries out of ~\.codex, restored the Codex shim so that where.exe codex resolved to:

%LOCALAPPDATA%\OpenAI\Codex\bin\codex.exe

Then I verified:

where.exe codex
codex --version
codex app-server --listen ws://127.0.0.1:0

After fully restarting T3 Code, the Codex provider appeared and messaging worked.

Request

Please surface the underlying codex app-server stderr and the resolved codex executable path when provider startup fails.

In this case, the T3 UI only showed that the provider adapter exited. The actionable error was only visible after manually running codex app-server.

Possibly related

I found a few adjacent Windows/Codex provider issues, but none looked like an exact duplicate:

• [Bug]: Codex app-server provider probe failed: Invalid initialize payload: Missing key at ["codexHome"]. #2341: Codex app-server provider probe failed / Codex CLI detection issue. This seems closest on the "T3 cannot find/start the right Codex CLI" side.
• [Bug]: Codex provider fails after upgrade to 0.21 on Windows(protocol parse error) #2374: also Windows + Codex provider unavailable + ProviderAdapterProcessError, but likely a different failure mode: JSON parsing Initializing agent... rather than Access is denied.
• [Bug]: Windows - Codex CLI version check failed. "node" is not recognized as an internal or external command #1789 / Fix Windows PATH hydration and repair #1729: Windows PATH hydration/repair precedent where commands worked in a normal shell but failed inside T3.
• Settings UI 'Codex binary path' has no effect #486 / Fix codex binary path setting having no effect #493: older precedent around T3 using or honoring the configured Codex binary path.