[Windows] Codex 26.707 cannot stage Browser runtime from EFS-protected WindowsApps files

Summary

On Codex Desktop for Windows, the bundled Browser / Chrome / Computer Use runtime cannot be staged from the Microsoft Store package. As a result, the in-app browser settings page reports that the plugin is unavailable and cua_node remains empty after reinstalling.

This reproduces on a newer build than the related report #25220.

Environment

• OS: Windows 11
• Install method: Microsoft Store
• Codex package: OpenAI.Codex_26.707.8168.0_x64__2p2nqsd0c76g0
• Affected bundled capabilities: Browser, Chrome, Computer Use

Actual behavior

The app repeatedly logs:

bundled_executable_relocation_failed
operation=copy_directory
failedExecutableName=node_repl.exe
syscall=copyfile
source: ...\\app\\resources\\cua_node\\bin\\CHANGELOG.md
dest: ...\\AppData\\Local\\OpenAI\\Codex\\runtimes\\cua_node\\.staging-...

The runtime directory is left empty:

%LOCALAPPDATA%\\OpenAI\\Codex\\runtimes\\cua_node

Independent reproduction

The source file is EFS application-protected, while the destination is unencrypted:

cipher /c <WindowsApps>\\app\\resources\\cua_node\\bin\\CHANGELOG.md
E CHANGELOG.md
  Compatibility Level:
    Application Protected

cipher /c %LOCALAPPDATA%\\OpenAI\\Codex\\runtimes\\cua_node
U cua_node

Copying the same source file to a normal user workspace fails with:

System.IO.IOException: The specified file could not be encrypted.
HRESULT: -2147018896

This confirms the failure is not caused by a disabled plugin, a missing configuration entry, or an incomplete user-level cache.

Expected behavior

Codex should stage its bundled runtime successfully from a protected Windows Store package, or use a packaging/copy mechanism compatible with EFS application-protected files.

Notes

• Reinstalling Codex did not resolve the issue.
• Please do not treat a direct WindowsApps marketplace path as a workaround; that is version-dependent and does not restore the trusted native runtime bridge.
• Related issue: #25220