Windows Smart App Control blocks unsigned Codex node_repl.exe when using WSL

What version of the Codex App are you using (From “About Codex” dialog)?

26.727.6591.0

What subscription do you have?

Pro

What platform is your computer?

Win11Pro with WSL2

What issue are you seeing?

Codex Windows app installs an unsigned runtime executable that is blocked by Windows 11 Smart App Control.

Codex version:
26.727.6591.0

Configuration:
Windows 11
Codex configured to run agents through WSL2 / Ubuntu

Blocked executable:
C:\Users\dpipe\AppData\Local\OpenAI\Codex\runtimes\cua_node\fb8898c05a62885e\bin\node_repl.exe

SHA-256:
A2C23D5BBF49D8E04217AB37696844D50DFFEAD280E13C648C327BB80F23FB9F

Authenticode result:
Status: NotSigned
SignatureType: None
Signer: none

Windows Code Integrity event:
Event ID 3077
Process: C:\Program Files\WSL\wsl.exe
Policy ID: {0283ac0f-fff1-49ae-ada1-8a933130cad6}

Smart App Control reports that Codex's node_repl.exe does not meet signing requirements. Microsoft provides no per-app bypass and recommends that the developer sign the executable.

Please ship the bundled cua_node/node_repl.exe with a valid trusted code signature and add WSL migration validation for existing Codex chats.

What steps can reproduce the bug?

1. On Windows 11, enable Smart App Control.
2. Install and open the Codex Windows app, version 26.727.6591.0.
3. Configure Codex to use WSL2 with Ubuntu as the local agent environment.
4. Create or open a Codex project whose source folder is available through WSL, for example:

/mnt/d/Projects/PFOS

1. Start a new local Codex chat in that project.
2. Submit a simple prompt that causes the local agent runtime to start, for example:

"Report only the current working directory and shell. Do not modify files."

1. Windows displays a Smart App Control notification stating that part of the app was blocked.
2. In Event Viewer under:

Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational
Event ID 3077 shows that wsl.exe attempted to load:

C:\Users\dpipe\AppData\Local\OpenAI\Codex\runtimes\cua_node\fb8898c05a62885e\bin\node_repl.exe

1. PowerShell confirms that node_repl.exe is not digitally signed:

Status: NotSigned
SignatureType: None
Signer: <none>

SHA-256:
A2C23D5BBF49D8E04217AB37696844D50DFFEAD280E13C648C327BB80F23FB9F

What is the expected behavior?

Expected behavior is that OAI produces signed components that don't get blocked by windows security..

Additional information

_No response_