Windows Desktop + WSL should have built-in arg0 health checks and rehydrate/rebind recovery

Summary

Windows Desktop + WSL needs built-in arg0/sidecar health diagnostics and a safe recovery path for the known pre-exec helper failure:

Io(Os { code: 2, kind: NotFound, message: "No such file or directory" })

The local workaround is now reliable enough to define a product recovery shape, but it should not remain a hand-maintained script outside the app.

Environment

Sanitized representative setup:

Product: Codex Desktop Windows Store app
Mode: app-server running in WSL
Desktop persistent home: %USERPROFILE%\.codex
WSL view: /mnt/c/Users/<user>/.codex

Known failure

Normal shell/tool calls fail before the requested shell starts. The failing workspace and /bin/bash are healthy; the problem is that the live app-server/thread can be pinned to a missing helper dir under:

%USERPROFILE%\.codex\tmp\arg0\codex-arg0<hash>

Windows-native sidecars can also create .bat helper dirs under the same shared tmp\arg0 root, colliding with WSL/Linux symlink helpers.

Local recovery that works

The local recovery flow:

1. Detect the exact stale helper dir referenced by the live environment/path.
2. Recreate that exact codex-arg0<hash> directory.
3. Preserve or recreate .lock safely.
4. Symlink Linux helpers to the current WSL app-server executable:

apply_patch
applypatch
codex-execve-wrapper
codex-linux-sandbox

1. Verify shared %USERPROFILE%\.codex\tmp\arg0 is WSL/Linux-only.
2. Detect unsafe bare/shared-home node_repl.exe -> codex.exe app-server --listen stdio:// sidecars.
3. Remove shared-root .bat helper dirs only when they are Windows-only unsafe dirs.

Product behavior requested

Desktop should have a built-in health/recovery path that:

• recognizes pre-shell Io(Os { code: 2 }) as a likely helper lifecycle failure before trying repo-path or /bin/bash debugging;
• reports the active helper dir, helper target, and whether it exists;
• classifies shared tmp\arg0 dirs by runtime family (wsl-linux, windows-bat-only, unknown);
• detects bare/shared-home native sidecars separately from isolated sidecars;
• rehydrates/rebinds once on helper ENOENT before surfacing failure to the user;
• avoids deleting foreign-runtime helper dirs;
• can be invoked from a "repair shell runner" or diagnostic button without requiring a full app restart.

Suggested acceptance test

In a Desktop Windows + WSL test:

1. Start WSL app-server with shared Desktop home.
2. Delete or hide the active codex-arg0<hash> helper dir while the app-server is live.
3. Run a shell command.
4. Product detects helper ENOENT, rehydrates/rebinds once, retries, and succeeds.
5. Windows .bat helpers under a Windows runtime home do not cause the shared WSL helper dir to be deleted.

Related issues

• #25317: main stale/deleted arg0 helper issue.
• #25370: independent report where WSL/repo/bubblewrap are healthy but exec fails before shell.
• #25799: independent workaround matching the live-helper rehydrate diagnosis.
• #26985: runtime cache/home split and arg0 namespacing direction.