Windows Desktop: shell_command can fail globally with 0xC0000142 due to helper materialization/fallback

Summary

On Windows Desktop App sessions, shell_command may suddenly fail immediately for all commands with exit code -1073741502 (0xC0000142).

Observed behavior

• Any simple command fails immediately (Get-Date, echo hi, etc.)
• Integrated terminal UI can still open and show PowerShell prompt
• Failure is in Desktop execution chain, not project code

Repro (Windows Desktop)

1. Start a Desktop session.
2. Run shell_command with Get-Date.
3. Observe immediate failure with 0xC0000142.
4. Repeat with other commands (echo hi), same immediate failure.

Root cause (code-level)

The issue is in Windows sandbox helper materialization/resolution reliability for packaged (WindowsApps) installs:

• In windows-sandbox-rs, helper freshness used size + mtime only, which can miss content drift.
• Fallback resolution could use package-adjacent sibling/legacy helper paths near current_exe.
• Under protected WindowsApps layouts, those helper paths are not a stable execution source.

Relevant files:

• codex-rs/windows-sandbox-rs/src/helper_materialization.rs
• codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs

Proposed fix (implemented in fork)

1. Add setup helper into materialization path (codex-windows-sandbox-setup.exe).
2. Harden freshness check from size+mtime to size+mtime+content comparison.
3. Avoid WindowsApps sibling fallback behavior.
4. Resolve setup helper from materialized .sandbox-bin copy.
5. Exclude WindowsApps exe parent from helper read roots.
6. Add regression tests for:

• same-size/same-mtime content drift
• WindowsApps helper fallback/read-root behavior

Validation performed

• cargo clippy --fix --tests --allow-dirty -p codex-windows-sandbox
• cargo fmt -- --config imports_granularity=Item
• cargo test -p codex-windows-sandbox (46 passed)

Branch / patch reference

• Commit: 707d8842f02f630b6c58b462558817e6bd953153
• Branch: jojonax:codex/windows-desktop-helper-materialization-fix
• Compare URL (PR-ready):

https://github.com/openai/codex/compare/main...jojonax:codex/windows-desktop-helper-materialization-fix?expand=1

Note on PR creation

Direct PR creation currently fails for this account with:
GraphQL: jojonax does not have the correct permissions to execute CreatePullRequest.
So I am filing this issue with the complete patch link attached.