Computer Use plugin: node_repl kernel crashes with error 740 spawning codex-windows-sandbox-setup.exe from user cache directory (missing AppContainer conditional ACE)

Bug: Computer Use plugin not available - node_repl kernel crashes with error 740

Description

After auto-update to version 26.601.2237.0, the Computer Use plugin stopped working.
The node_repl kernel crashes on startup:
"windows sandbox failed: spawn setup refresh"

Root Cause

kernel.js tries to spawn codex-windows-sandbox-setup.exe from the user cache:
%LOCALAPPDATA%\OpenAI\Codex\bin\716dda49c14d31a0\codex-windows-sandbox-setup.exe

The same binary in WindowsApps has a conditional ACE that allows AppContainer
processes to bypass the elevation requirement. The cached copy lacks this ACE,
so CreateProcess returns ERROR_ELEVATION_REQUIRED (740).

Cache spawn: ❌ 740
WindowsApps spawn: ✅ (but kernel.js already crashed)

Evidence

• File SHA256 (cache == WindowsApps): DD69225542713ED4FE7CB06AC4CB178E65E65C49FD0D63EA6F4679C7D25B2B40
• Files identical, only ACL differs
• WindowsApps has AppContainer conditional ACE; cache does not

Attempted Workarounds (all failed)

1. ✅ Add AppContainer ACE to cached binary → still 740
2. ❌ Hard link/junction to WindowsApps → access denied
3. ❌ Run Codex as admin → still 740 (AppContainer restriction)
4. ❌ Switch to unelevated sandbox → same result
5. ❌ Delete cache and let Codex re-extract → same result
6. ❌ Change [windows] sandbox to "unelevated" → same result

Environment

• OS: Windows 10 build 26200
• Codex: 26.601.2237.0 (Microsoft Store)
• Computer Use plugin: 26.601.21317
• Thread ID: 019e8c3e-78b3-7df1-99cd-8591daa11ca4

Expected Fix

codex.exe should either:

• Spawn codex-windows-sandbox-setup.exe from WindowsApps path directly
• Or set the conditional ACE when extracting to cache
• Or retry from WindowsApps when cache spawn fails