[Bug] codex exec via subagent runtime fails on Windows: 'apply deny-read ACLs' blocking unified exec process

Summary

Dispatching Codex through the codex:codex-rescue subagent runtime on Windows fails with apply deny-read ACLs before any command can run. The Codex CLI directly (codex exec) works fine in the same environment.

Environment

• OS: Windows 11 Pro 10.0.26200
• codex-cli: 0.145.0 (npm install -g @openai/codex)
• node: v26.4.0
• npm: 11.17.0
• Auth: ChatGPT login (active)
• Shared session runtime detected via codex-companion.mjs setup --json:
• mode: shared
• endpoint: pipe:\.\pipe\cxc-4e63O9-codex-app-server

Reproduction

Dispatch codex:codex-rescue subagent from a Claude Code session with any coding task. The subagent will report:

Codex cannot run any commands in this Windows sandbox — every shell call fails before process creation with an ACL error. No branch, commit, migration, gates, or PR was created.

The error string reported by the helper:

Reject("Failed to create unified exec process: helper_unknown_error: apply deny-read ACLs")

What works

codex exec "echo hello" --skip-git-repo-check from the same shell returns the expected output. The bug is specific to the subagent runtime, not the CLI.

Investigation notes

• The codex:codex-rescue subagent appears to spawn a unified exec process helper that fails ACL checks before any user command runs.
• All three shell types (PowerShell, cmd.exe, node) report the same apply deny-read ACLs error, suggesting the helper itself can't start, not the spawned child.
• The Codex CLI does not use this helper path — it spawns per-command, which works.
• No corporate group policy or AppLocker rule obviously blocking node.exe; standard user privileges.

Workaround

Use codex exec <prompt> directly from the host shell instead of dispatching through the subagent runtime. Slightly higher token cost (context must go inline in the prompt) but fully functional.

Suggested fix

The unified exec process helper should either:

1. Detect Windows ACL restrictions and fall back to per-command spawn (like the CLI), or
2. Self-elevate or request the necessary ACLs at startup, or
3. Emit a clearer error message pointing users to the codex exec workaround.

Severity

Medium — work exists, workaround is available, but the subagent dispatch path is currently broken on Windows for every user.