codex - 💡(How to fix) Fix Windows Codex Desktop regenerates node_repl MCP config that crashes with UAC ERROR_ELEVATION_REQUIRED when Computer Use is enabled

node_repl kernel exited unexpectedly

node_repl diagnostics:
{
  "kernel_status": "running",
  "kernel_stderr_tail": "windows sandbox failed: spawn setup refresh",
  "reason": "stdout_eof"
}

Sandbox log shows:
setup refresh: spawning %LOCALAPPDATA%\OpenAI\Codex\bin\fb2111b91430cb17\codex-windows-sandbox-setup.exe
setup refresh: failed to spawn %LOCALAPPDATA%\OpenAI\Codex\bin\fb2111b91430cb17\codex-windows-sandbox-setup.exe: The requested operation requires elevation. (os error 740)

## Expected behavior
A clean Codex Desktop install with bundled Computer Use enabled should generate a working node_repl MCP configuration. Computer Use bootstrap should reach sky.list_apps() without requiring manual edits to config.toml.

### Additional information

## Generated config after clean reinstall
After reinstall, Codex regenerated this node_repl section:
[mcp_servers.node_repl]
args = []
command = 'C:\Users\<user>\AppData\Local\OpenAI\Codex\bin\34ab3e1324cc55b5\node_repl.exe'
startup_timeout_sec = 120

[mcp_servers.node_repl.env]
NODE_REPL_NODE_PATH = 'C:\Users\<user>\AppData\Local\OpenAI\Codex\bin\5b9024f90663758b\node.exe'
CODEX_CLI_PATH = 'C:\Users\<user>\AppData\Local\OpenAI\Codex\bin\fb2111b91430cb17\codex.exe'

The important part is the combination of:
args = []
CODEX_CLI_PATH = '<AppData cached codex.exe>'

This causes node_repl to route through the AppData Codex CLI sandbox path, which then tries to spawn codex-windows-sandbox-setup.exe and fails with os error 740.

## Evidence checked
AppData-cached codex.exe, node.exe, node_repl.exe, and codex-windows-sandbox-setup.exe match the package resource binaries by SHA-256 in the earlier package version tested.
Authenticode signatures were valid.
No AppCompat Run as administrator compatibility layer was found for Codex.
Windows UAC settings appear normal:
EnableLUA = 1
EnableInstallerDetection = 1
The failure reproduces after clean reinstall/cache rebuild, with a newly generated AppData runtime path.

## Suspected cause
The regenerated node_repl MCP config appears to be unsafe for Windows when CODEX_CLI_PATH points to the AppData-cached Codex CLI and args = [].

Because the spawned helper is named codex-windows-sandbox-setup.exe, Windows UAC installer detection may classify the AppData helper as requiring elevation when launched from this path/context. The failure is then surfaced as ERROR_ELEVATION_REQUIRED / os error 740.

Potential fixes might include one or more of:

Generate node_repl config with --disable-sandbox when used inside Codex Desktop/plugin runtime.
Avoid setting CODEX_CLI_PATH for node_repl in this Desktop plugin path.
Launch the sandbox setup helper from the packaged WindowsApps resource context instead of the AppData cache.
Add an explicit UAC manifest such as requestedExecutionLevel level="asInvoker" to codex-windows-sandbox-setup.exe if appropriate.
Rename or otherwise prevent the helper from triggering installer detection, if the filename is part of the issue.
Workarounds tried
Manually setting args = ["--disable-sandbox"] allowed progress in one earlier session, but after reinstall/new generation the bad config returned.
Removing CODEX_CLI_PATH from the node_repl env may avoid this path, but this is not a stable product fix and can be overwritten/regenerated.
Full uninstall/reinstall did not resolve the root cause because the generated config reproduced the bad pattern.