Windows desktop bundles rg.exe in WindowsApps, but executing it returns 'Access is denied'

What version of Codex is running?

Codex desktop on Windows (bundled app install). I could not reliably extract the app version from the shell, but the bundled rg path resolves to:

C:\Program Files\WindowsApps\OpenAI.Codex_26.313.5234.0_x64__2p2nqsd0c76g0\app\resources\rg.exe

Which model were you using?

GPT-5 Codex in the desktop app.

What platform is your computer?

Microsoft Windows (PowerShell shell environment)

What steps can reproduce the bug?

1. Open Codex desktop on Windows.
2. Use the shell tool or an internal shell action that tries to run rg.
3. Even a minimal command like rg --version fails.

In my environment, Get-Command rg resolves to:

C:\Program Files\WindowsApps\OpenAI.Codex_26.313.5234.0_x64__2p2nqsd0c76g0\app\resources\rg.exe

Running rg --version returns:

Program 'rg.exe' failed to run: Access is denied

What is the expected behavior?

If Codex bundles rg.exe, shell actions that use rg should be able to execute it successfully on Windows, or Codex should avoid surfacing a non-runnable bundled binary in PATH.

What do you see instead?

rg.exe is discoverable in PATH, but attempts to execute it fail with Access is denied.

This appears related to the executable living under C:\Program Files\WindowsApps\..., where packaged app execution rules may differ from a normal user-installed binary.

Additional information

I checked the resolved path and ACLs locally. The file exists, but in this PowerShell execution context it is not runnable.

This breaks the usual fast search path for Codex on Windows and forces a fallback to slower PowerShell-native search commands.