bug: `codex-auth login` panics on Windows when `codex` is installed via npm

[devmc12]

Description

Running codex-auth login on Windows causes a Zig runtime panic (reached unreachable code) when the OpenAI codex CLI was installed via npm.

Environment

• OS: Windows 11 Pro (10.0.26200)
• Tested with:
  • Node.js v22.22.2 (npm 10.9.7)
  • Node.js v24.15.0 (npm 11.12.1)
• codex-auth: installed via npm (@loongphy/codex-auth)
• codex (OpenAI): installed via npm (@openai/codex)

Steps to Reproduce

1. Install @openai/codex globally via npm
2. Install @loongphy/codex-auth globally via npm
3. Run codex-auth login

Actual Behavior

PS> codex-auth login
thread 15596 panic: reached unreachable code
???:?:?: 0x7ff642cf45c3 in ??? (codex-auth.exe)
???:?:?: 0x7ff642cf5f6b in ??? (codex-auth.exe)
???:?:?: 0x7ff642cce837 in ??? (codex-auth.exe)
???:?:?: 0x7ff642cbe182 in ??? (codex-auth.exe)
???:?:?: 0x7ff642cc8702 in ??? (codex-auth.exe)
???:?:?: 0x7ff642d1a30c in ??? (codex-auth.exe)
???:?:?: 0x7ff642d1a37b in ??? (codex-auth.exe)
???:?:?: 0x7ffc4320e956 in ??? (KERNEL32.DLL)
???:?:?: 0x7ffc44387c1b in ??? (ntdll.dll)

Expected Behavior

The codex login flow should launch normally, or a human-readable error should be printed if codex cannot be found/executed.

Root Cause Analysis

codexLoginArgs() in src/cli/login.zig passes "codex" as the executable name to std.process.spawn:

pub fn codexLoginArgs(opts: types.LoginOptions) []const []const u8 {
  return if (opts.device_auth)
      &[_][]const u8{ "codex", "login", "--device-auth" }
  else
      &[_][]const u8{ "codex", "login" };
}


When codex is installed via npm on Windows, npm creates the following files in the PATH directory:

┌───────────┬──────────────────────────────────────────────────────┐
│   File    │                         Type                         │
├───────────┼──────────────────────────────────────────────────────┤
│ codex     │ Extensionless Unix shell script (for Git Bash / WSL) │
├───────────┼──────────────────────────────────────────────────────┤
│ codex.cmd │ Windows CMD batch wrapper                            │
├───────────┼──────────────────────────────────────────────────────┤
│ codex.ps1 │ PowerShell wrapper                                   │
└───────────┴──────────────────────────────────────────────────────┘

There is no codex.exe. Zig's std.process.spawn finds the extensionless codex file (a shell script) during PATH resolution, then attempts to execute it via CreateProcessW. Since a Unix shell script is not a valid Windows PE executable, this triggers an unhandled error code path in Zig's standard library, hitting unreachable and causing the panic.

Reproducibility

Not guaranteed on all Windows systems. Whether it reproduces depends on:

- Directory enumeration order on NTFS: if Zig's PATH search finds codex.cmd before the extensionless codex, the spawn succeeds
- npm version: some npm versions may not create the extensionless wrapper file on Windows
- Windows version: Win10 and Win11 may return different error codes from CreateProcessW when given a non-PE file; Zig may handle some codes but not others

┌─────────────────────────────┬──────────┬───────────┬─────────────┬────────────────┐
│             OS              │ Node.js  │    npm    │ nvm-windows │     Result     │
├─────────────────────────────┼──────────┼───────────┼─────────────┼────────────────┤
│ Windows 11 Pro (10.0.26200) │ v22.22.2 │ 10.9.7    │ 1.2.2       │ panic          │
├─────────────────────────────┼──────────┼───────────┼─────────────┼────────────────┤
│ Windows 11 Pro (10.0.26200) │ v24.15.0 │ (bundled) │ 1.2.2       │ panic          │
├─────────────────────────────┼──────────┼───────────┼─────────────┼────────────────┤
│ Windows 10                  │ v22.x    │ —         │ nvm-windows │ not reproduced │
└─────────────────────────────┴──────────┴───────────┴─────────────┴────────────────┘

All installations use nvm-windows for Node.js version management.