[Bug]: Fresh Codex install without config.toml blocks authless provider onboarding #5422

Client or integration

Codex App

Area

Installation or packaging

Summary

Fresh-install onboarding has a missing-config bootstrap gap: when Codex is installed but its user-level config.toml has not been created, OpenCodex refuses config injection with Codex config not found ... Is Codex installed?.

Our intended deployment uses Codex Desktop + OpenCodex + DeepSeek API, with OpenCodex's Desktop authless option. Users on a network where OpenAI sign-in is unavailable should be able to complete this third-party-provider setup without first signing into OpenAI. A missing optional configuration file should not be treated as evidence that Codex is absent.

Expected: during explicit Codex integration setup, offer/create a minimal config in the correctly resolved Codex home and continue normal injection, or at least provide actionable bootstrap instructions. Preserve existing files and distinguish an incorrect home/path from a genuinely uninitialized installation.

Reproduction

Reported onboarding scenario / steps for maintainer verification:

1. Use a fresh OS user or disposable environment with Codex Desktop installed but never signed into OpenAI. Do not delete an existing user's config/history.
2. Confirm that the actual Codex home has no config.toml (the directory itself may also be absent).
3. Configure OpenCodex with a third-party provider such as DeepSeek and enable Desktop authless mode (codexDesktopAuthless: true) on the local loopback proxy.
4. Trigger Codex integration/config injection through ocx start or ocx sync.
5. The injector's missing-file branch returns failure before it can write the provider configuration.

Validation scope: the missing-file guard was directly verified in the installed 2.56.0 source and in upstream main. We have not yet performed a clean-machine end-to-end reproduction or verified that creating an empty config resolves every subsequent onboarding step. The quoted error below is the exact source return value, not a captured fresh-machine log.

Suggested temporary workaround to verify: create the correctly resolved Codex home and an empty config.toml only if absent, then rerun sync with authless mode enabled and restart Codex. This should pass the specific missing-file guard; it is not presented as an end-to-end tested fix.

Version

Installed package inspected: @bitkyc08/opencodex@2.56.0.

The same guard is present in upstream main inspected on 2026-09-21, commit 7c625fc9755c9824653ab944190e243091a2c85c.

Operating system

Source inspection performed on macOS; affected fresh-install machine OS/build has not yet been collected. The guard itself is not platform-specific. Windows/WSL path resolution should be tested separately from the genuinely missing-file case.

Provider and model

DeepSeek API via OpenCodex; model ID is not material to this failure because injection returns before model requests. No provider inference failure is claimed.

Logs or error output

Exact source return value from src/codex/inject.ts, injectCodexConfigImpl:

if (!existsSync(CODEX_CONFIG_PATH)) {
  return {
    success: false,
    message: `Codex config not found at ${CODEX_CONFIG_PATH}. Is Codex installed?`,
  };
}

Screenshots and supporting files

Source permalink.

Related reports checked:

• Support Codex Desktop on Windows with WSL app-server mode #63: the same error caused by Windows/WSL home discovery; the real config already existed elsewhere. This report concerns a correctly resolved home with no config yet.
• ocx start auto-injects openai_base_url and overwrites provider config, breaking Codex Desktop on networks that cannot reach chatgpt.com #1054: provider configuration/login interaction on restricted networks; this report concerns failure before any configuration can be injected.

Suggested regression coverage: missing file in an existing home; absent default home during explicit setup; existing config preserved; invalid/unwritable paths reported accurately; read-only/validate-only operations do not create files; restore handles the originally-absent config state correctly.

Redacted configuration

Relevant setting only (not a complete provider configuration):

{
  "codexDesktopAuthless": true
}

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.