Windows runner may select inaccessible WindowsApps Codex executable

[VGPlays4132]

Summary

On Windows 11 with desloppify 1.0, Codex batch review can select the packaged Codex Desktop executable under C:\Program Files\WindowsApps\...\codex.exe. Starting that executable with subprocess.Popen fails with [WinError 5] Access is denied, even though the npm Codex CLI is available and works.

Reproduction

1. Install Codex Desktop and desloppify 1.0.
2. Ensure the Windows app alias/package executable is the first codex candidate on PATH.
3. Run desloppify review --run-batches --runner codex --parallel.

The runner resolves the inaccessible packaged executable and each batch fails before launch.

Expected

Executable resolution should validate that the selected candidate can actually be launched, prefer a CLI shim (codex.cmd) over a WindowsApps packaged app binary, or fall through to the next PATH candidate after WinError 5. An explicit DESLOPPIFY_CODEX_EXECUTABLE override would also provide a reliable escape hatch.

Workaround

Installing @openai/codex globally and prepending its native CLI directory to PATH makes the review runner work.

Environment

• Windows 11
• Python 3.14.7
• desloppify 1.0
• Codex Desktop package OpenAI.Codex_26.818.5229.0_x64__2p2nqsd0c76g0