viber-channel 0.8.10 → 0.8.12

package/lib/codex_shell_path.ts

@@ -0,0 +1,119 @@
+/**
+ * codex_shell_path — #500: let codex spawn processes on Windows again.
+ *
+ * codex's Windows sandbox launches every command under a RESTRICTED TOKEN
+ * (`CreateProcessAsUserW`). Windows refuses to start an MSIX-PACKAGED binary
+ * that way, and the shell codex resolves on JP's machine is PowerShell 7 from
+ * the Microsoft Store — packaged under `C:\Program Files\WindowsApps\…`. So
+ * every command died with:
+ *
+ *   windows sandbox: runner failed during SpawnChild:
+ *   CreateProcessAsUserW failed: 5 (Access is denied.)
+ *
+ * Measured, 20 trials per case (success = absence of `CreateProcessAsUserW`),
+ * reproduced independently by a second agent:
+ *
+ *   | target                                  | spawn failures |
+ *   | pwsh MSIX (package dir OR alias dir)    | 20/20          |
+ *   | powershell 5.1 / cmd.exe / git bash     |  0/20          |
+ *
+ * FIX: drop the `WindowsApps` directories from the PATH of the `codex
+ * app-server` CHILD ONLY. codex then resolves `powershell.exe` 5.1 and spawns
+ * fine (measured end to end: `hello_from_shell`, exit 0, 722 ms).
+ *
+ * REJECTED — `-c windows.sandbox="unelevated"`. It also fixes the spawn (0/20
+ * failures on the MSIX target), but it switches the sandbox to the legacy
+ * backend, and that has two measured costs:
+ *   - PowerShell drops to **ConstrainedLanguage** (5/5, both agents): .NET
+ *     method calls, `Add-Type` and type casts fail in agent scripts;
+ *   - codex's own binary states that "Restricted read-only access requires the
+ *     elevated Windows sandbox backend" — our `read`/`chat` tiers rely on the
+ *     read-only sandbox, so they would be SILENTLY weakened, and any future
+ *     deny-read path (`.viber/auth.json`, `~/.ssh`) would be a no-op.
+ * Writes outside the workspace stay blocked in both modes, so the tradeoff is
+ * not about writes — it is about keeping the backend our tiers are built on.
+ */
+
+/**
+ * A PATH entry that resolves to Store/MSIX app-execution aliases.
+ *
+ * Anchored on a whole path SEGMENT: a substring match would also strip
+ * `C:\SDK\WindowsAppsSDK\bin` and nobody would understand why six months later.
+ * The two real cases stay covered — the package dir and
+ * `%LOCALAPPDATA%\Microsoft\WindowsApps`.
+ */
+function isWindowsAppsEntry(entry: string): boolean {
+	return /[\\/]windowsapps([\\/]|$)/i.test(entry.replace(/[\\/]+$/, ""));
+}
+
+export interface SanitizeResult {
+	/** The PATH to hand the child. Unchanged when no surgery was needed. */
+	path: string;
+	/** Entries removed, in their original order. Empty when nothing changed. */
+	stripped: string[];
+	/** Set when surgery was NEEDED but deliberately skipped — worth logging. */
+	skipped?: string;
+}
+
+/**
+ * Remove the MSIX alias directories from a PATH — but only on Windows, and only
+ * when no unpackaged `pwsh.exe` is REACHABLE, i.e. sits on a surviving PATH
+ * entry. An MSI PowerShell 7 that exists on disk but is not on the PATH does
+ * NOT count: codex resolves its shell through the PATH, so it would still land
+ * on the broken packaged one (raised in review — we do not have a measurement
+ * showing codex probes fixed locations, so we must not assume it does).
+ *
+ * Pure: platform, PATH and filesystem probing are all injected, so this never
+ * depends on the machine running the test.
+ */
+export function sanitizeCodexPath(
+	pathValue: string | undefined,
+	opts: { platform: string; exists: (p: string) => boolean; sep?: string },
+): SanitizeResult {
+	const sep = opts.sep ?? ";";
+	const original = pathValue ?? "";
+	if (opts.platform !== "win32") return { path: original, stripped: [] };
+
+	const entries = original.split(sep);
+	const kept = entries.filter((e) => !isWindowsAppsEntry(e));
+	const stripped = entries.filter((e) => isWindowsAppsEntry(e) && e.trim() !== "");
+	if (stripped.length === 0) return { path: original, stripped: [] };
+
+	// An unpackaged pwsh on a surviving entry means codex already has a shell it
+	// can spawn — leave the PATH intact so the child keeps its Store aliases
+	// (python stub, wt, …).
+	const onKeptPath = (exe: string): boolean =>
+		kept.some((dir) => dir.trim() !== "" && opts.exists(`${dir.replace(/[\\/]+$/, "")}\\${exe}`));
+	if (onKeptPath("pwsh.exe")) return { path: original, stripped: [] };
+
+	// Floor: if not even cmd.exe survives the surgery, codex would have no shell
+	// to fall back on — stripping would cost the Store aliases for nothing.
+	// PowerShell 5.1 IS removable as an optional feature on recent Windows 11,
+	// so this is not purely theoretical. Do nothing, and say so.
+	if (!onKeptPath("cmd.exe") && !onKeptPath("powershell.exe")) {
+		return { path: original, stripped: [], skipped: "no unpackaged shell would remain on PATH" };
+	}
+
+	return { path: kept.join(sep), stripped };
+}
+
+/**
+ * Apply {@link sanitizeCodexPath} to a child environment, in place.
+ *
+ * Windows env keys are case-INSENSITIVE, a JS object's are not: a parent may
+ * carry `Path`, `PATH` or even `PaTh`, and handing the child two spellings of
+ * the same variable is asking for the wrong one to win. So we read whichever
+ * variant exists, then collapse them all into one canonical `PATH`.
+ */
+export function applySanitizedPath(
+	env: Record<string, string | undefined>,
+	opts: { platform: string; exists: (p: string) => boolean; sep?: string },
+): SanitizeResult {
+	const keys = Object.keys(env).filter((k) => k.toLowerCase() === "path");
+	const current = keys.map((k) => env[k]).find((v) => v !== undefined);
+	const result = sanitizeCodexPath(current, opts);
+	if (result.stripped.length === 0) return result;
+	for (const k of keys) delete env[k];
+	env.PATH = result.path;
+	return result;
+}

package/lib/runner_exec.ts

@@ -18,6 +18,7 @@ import { randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { cfAccessHeaders } from "./cfAccess.js";
+import { messageForReason, parseSpawnResult, rosterNames, type SpawnReason } from "./spawn_reason.js";
 
 /** A validated role from the server snapshot (allowlisted shape). */
 export interface SnapshotRole {
@@ -148,7 +149,13 @@ export function validateAgainstPolicy(cmd: ClaimedCommand, policy: RunnerPolicy)
 
 export type TeamSpawnRunner = (
   args: string[],
-) => Promise<{ ok: boolean; recap: string }>;
+  /** #496: the nonce the child must echo on its outcome marker for it to be
+   *  believed. REQUIRED (Codex review): an optional nonce lets a future launcher
+   *  omit it and silently fall back to trusting any marker — the very hole the
+   *  explicit trust parameter closes. A mock may ignore the argument; it cannot
+   *  forget that it exists. */
+  nonce: string,
+) => Promise<{ ok: boolean; recap: string; reason?: SpawnReason; detail?: string }>;
 
 /**
  * Build a CURATED child environment (Codex review, blocking): `execFile` would
@@ -202,7 +209,7 @@ export function vibeMasterBaseCmd(source: NodeJS.ProcessEnv = process.env): stri
 /** Default launcher: shell vibe-master via execFile with an ARGV ARRAY (never a
  *  shell string), a CURATED env, bounded time + output, and process-tree kill on
  *  timeout. The binary is resolved via VIBE_MASTER_CMD (default `vibe-master`). */
-export const execFileTeamSpawn: TeamSpawnRunner = (args) => {
+export const execFileTeamSpawn: TeamSpawnRunner = (args, nonce) => {
   const base = vibeMasterBaseCmd();
   const bin = base[0] as string;
   return new Promise((resolve) => {
@@ -211,8 +218,19 @@ export const execFileTeamSpawn: TeamSpawnRunner = (args) => {
       [...base.slice(1), ...args],
       { timeout: 5 * 60 * 1000, killSignal: "SIGKILL", maxBuffer: 1024 * 1024, env: buildChildEnv() },
       (err, stdout, stderr) => {
+        // #496: read the outcome marker from RAW stderr, BEFORE redaction and
+        // before the 4 000-char cut. The marker is written last, so it is the
+        // first thing `.slice()` drops on a real (verbose) roster — parsing the
+        // recap would pass every test and fail every actual spawn. Redaction can
+        // also mangle the JSON. Both hazards disappear by reading first.
+        const parsed = parseSpawnResult(stderr ?? "", { nonce });
         const recap = redactSecrets(`${stdout}\n${stderr}`.trim()).slice(0, 4000);
-        resolve({ ok: !err, recap });
+        resolve({
+          ok: !err,
+          recap,
+          ...(parsed?.reason ? { reason: parsed.reason } : {}),
+          ...(parsed?.detail ? { detail: parsed.detail } : {}),
+        });
       },
     );
   });
@@ -290,6 +308,18 @@ export function writeRunnerLog(commandId: string, recap: string, cwd: string = p
   return path;
 }
 
+/** A `failed` report body carrying a structured reason (#496). The sentence is
+ *  derived from the REASON, so what the web shows is server/runner-authored copy,
+ *  never a raw client string; `error` keeps the operator-facing precision the
+ *  local log used to hold alone. */
+function refusalBody(
+  cmd: ClaimedCommand,
+  reason: SpawnReason,
+  error: string,
+): Record<string, unknown> {
+  return { fencing_token: cmd.fencing_token, status: "failed", reason, error };
+}
+
 async function report(
   auth: RunnerAuthLite,
   cmdId: string,
@@ -331,14 +361,24 @@ export async function executeClaim(
   try {
     policy = deps.policy ?? loadRunnerPolicy();
   } catch (err) {
-    const reason = err instanceof RunnerPolicyInvalidError ? err.message : "invalid local policy";
-    await report(auth, cmd.id, { fencing_token: cmd.fencing_token, status: "failed", error: `local policy invalid: ${reason}` }, fetchImpl);
+    const cause = err instanceof RunnerPolicyInvalidError ? err.message : "invalid local policy";
+    await report(
+      auth,
+      cmd.id,
+      refusalBody(cmd, "policy_invalid", `local policy invalid: ${cause}`),
+      fetchImpl,
+    );
     return "failed";
   }
 
   const refusal = validateAgainstPolicy(cmd, policy);
   if (refusal) {
-    await report(auth, cmd.id, { fencing_token: cmd.fencing_token, status: "failed", error: `local policy: ${refusal}` }, fetchImpl);
+    await report(
+      auth,
+      cmd.id,
+      refusalBody(cmd, "policy_refused", `local policy: ${refusal}`),
+      fetchImpl,
+    );
     return "failed";
   }
 
@@ -350,7 +390,7 @@ export async function executeClaim(
     const s = await report(
       auth,
       cmd.id,
-      { fencing_token: cmd.fencing_token, status: "failed", error: "prior partial run detected on this runner — not relaunched" },
+      refusalBody(cmd, "partial_run", "prior partial run detected on this runner — not relaunched"),
       fetchImpl,
     );
     if (s >= 200 && s < 300) inflight.clear(cmd.id);
@@ -360,7 +400,12 @@ export async function executeClaim(
   // template_name is the positional <name> in argv: positive allowlist (no
   // leading '-', no control char) — argv-flag-injection defense.
   if (!/^[A-Za-z0-9_.][A-Za-z0-9 _.-]{0,63}$/.test(cmd.template_name)) {
-    await report(auth, cmd.id, { fencing_token: cmd.fencing_token, status: "failed", error: "unsafe template_name" }, fetchImpl);
+    await report(
+      auth,
+      cmd.id,
+      refusalBody(cmd, "unsafe_template_name", "unsafe template_name"),
+      fetchImpl,
+    );
     return "failed";
   }
 
@@ -378,21 +423,43 @@ export async function executeClaim(
   const { path: specPath, cleanup } = (deps.writeSpec ?? fsWriteSpec())(spec);
   try {
     // Allowlisted argv (C3): fixed flags + validated values, no free string.
-    const args = ["team", "spawn", "--spec-file", specPath, "--prefix", cmd.prefix];
+    // #496: a fresh nonce per launch, echoed back on the outcome marker.
+    // Threat model, stated precisely (Codex review): this DE-CORRELATES an
+    // accidental look-alike — an agent that prints this contract in its own
+    // output on the shared, deliberately-inherited stderr — which is the case
+    // that actually happens here. It is NOT authentication: a same-user process
+    // can read the parent's command line on Windows and forge the value. Nothing
+    // on this path can defend against a hostile local process, which already runs
+    // as the user; what protects the RENDERED text is the roster intersection
+    // below, not this nonce.
+    const nonce = randomBytes(16).toString("hex");
+    const args = ["team", "spawn", "--spec-file", specPath, "--prefix", cmd.prefix, "--result-nonce", nonce];
     if (cmd.team_name) args.push("--team", cmd.team_name);
     if (cmd.env) args.push("--env", cmd.env);
 
     inflight.mark(cmd.id); // durable "started here" BEFORE launch (C4)
-    const { ok, recap } = await runTeamSpawn(args);
-
-    // Generic remote report; full recap to a 0600 LOCAL log only (no secret leak).
+    const { ok, recap, reason, detail } = await runTeamSpawn(args, nonce);
+
+    // #496: the failure now travels as a REASON plus a sentence built from it —
+    // whoever clicked Spawn in a browser can act on what they read. The full
+    // recap still goes ONLY to the 0600 local log (no secret leak); what changed
+    // is that the local log is no longer the sole place the cause exists. With no
+    // marker (older vibe-master, output lost to maxBuffer) we degrade to exactly
+    // the previous message rather than inventing a cause.
     const logPath = deps.writeLog ? deps.writeLog(cmd.id, recap) : writeRunnerLog(cmd.id, recap);
     const finalStatus = await report(
       auth,
       cmd.id,
       ok
         ? { fencing_token: cmd.fencing_token, status: "succeeded", result: { message: "team spawn completed", log: logPath } }
-        : { fencing_token: cmd.fencing_token, status: "failed", error: "team spawn failed — see local runner log" },
+        : {
+            fencing_token: cmd.fencing_token,
+            status: "failed",
+            error: reason
+              ? messageForReason(reason, detail, rosterNames(cmd.prefix, cmd.template_spec.roles))
+              : "team spawn failed — see local runner log",
+            ...(reason ? { reason } : {}),
+          },
       fetchImpl,
     );
     // Clear the inflight marker ONLY when the TERMINAL report is accepted (2xx)

package/lib/spawn_reason.ts

@@ -0,0 +1,214 @@
+/**
+ * spawn_reason.ts — the runner's half of the spawn-outcome contract (#496).
+ *
+ * A spawn refused on this machine used to reach the web as one sentence,
+ * "team spawn failed — see local runner log". Whoever clicked Spawn from a
+ * browser has no terminal and no access to that log: they saw a red failure and
+ * had nowhere to go. The cause existed — it was on the runner's stderr — and was
+ * thrown away here.
+ *
+ * `vibe-master` now emits a machine line (`VIBEMASTER_RESULT {"reason":…}`,
+ * see vibe-master/lib/spawn_result.ts). This module extracts it and turns a
+ * reason into a sentence the web can show. The runner's OWN refusals (policy,
+ * unsafe input, a prior partial run) carry reasons from the same vocabulary, so
+ * the web never has to speak two languages.
+ */
+
+/** Reasons a spawn can be refused. Mirrors vibe-master's vocabulary plus the
+ *  four the runner produces itself. The API keeps its own allowlist: an unknown
+ *  reason is dropped there, never stored raw — it comes from a client machine. */
+export const SPAWN_REASONS = [
+  // Emitted by vibe-master
+  "already_running",
+  "partial_team",
+  "template_invalid",
+  "codex_unavailable",
+  "launch_failed",
+  // Emitted by the runner itself
+  "policy_invalid",
+  "policy_refused",
+  "unsafe_template_name",
+  "partial_run",
+] as const;
+
+export type SpawnReason = (typeof SPAWN_REASONS)[number];
+
+const MARKER = "VIBEMASTER_RESULT";
+
+/** Detail is diagnostic context, never shown raw to a user (the server bounds it
+ *  again and the web renders from the REASON). Bounded here too so a runaway
+ *  child cannot push a megabyte into a report. */
+const DETAIL_MAX = 300;
+
+export interface ParsedSpawnResult {
+  reason: SpawnReason;
+  detail?: string;
+}
+
+/**
+ * Keep only the names that belong to THIS command's roster.
+ *
+ * A charset check is not enough (Codex review): `session-expired, sign-in, now`
+ * satisfies any agent-id pattern and would be rendered as though it listed
+ * members. The only trustworthy authority on what a name may be is the roster the
+ * SERVER validated and sent — so `detail` is not sanitized, it is INTERSECTED
+ * with that roster. A name the server never asked to spawn cannot reach the
+ * screen, whatever the runner sent, and prose cannot survive at all.
+ */
+const MAX_NAMES = 10;
+
+export function keepRosterNames(
+  detail: string | undefined,
+  roster: readonly string[],
+): string | undefined {
+  if (!detail) return undefined;
+  const allowed = new Set(roster);
+  const names = detail
+    .split(",")
+    .map((t) => t.trim())
+    .filter((t) => allowed.has(t))
+    .slice(0, MAX_NAMES);
+  return names.length > 0 ? names.join(", ") : undefined;
+}
+
+/**
+ * The agent names a command may talk about: `{prefix}-{role}`, plus
+ * `{prefix}-{role}-{n}` for replicated roles. Mirrors vibe-master's naming in
+ * `resolveTeamSpawn` — the two must move together.
+ */
+export function rosterNames(
+  prefix: string,
+  roles: readonly { role: string; count?: number }[],
+): string[] {
+  const names: string[] = [];
+  for (const r of roles) {
+    const count = r.count && r.count > 1 ? r.count : 1;
+    if (count === 1) {
+      names.push(`${prefix}-${r.role}`);
+      continue;
+    }
+    for (let i = 1; i <= count; i++) names.push(`${prefix}-${r.role}-${i}`);
+  }
+  return names;
+}
+
+/**
+ * Extract the outcome marker from RAW child stderr.
+ *
+ * Read this before the recap is built, never after: the recap is redacted and
+ * then cut to 4 000 characters, and the marker is written LAST — exactly the end
+ * that the cut removes. A four-member roster overflows that budget easily, so
+ * parsing the recap would work in tests and fail on a real spawn.
+ *
+ * Scans for the LAST line that starts with the marker AND parses AND carries a
+ * known reason — not simply the last line. On `launch_failed` the marker is
+ * written after child processes have inherited this same stderr, so trailing
+ * child output can follow it; and a line quoting the marker inside other text is
+ * ignored because the prefix must start the line.
+ *
+ * Returns null when there is no marker (an older vibe-master, or output lost to
+ * a maxBuffer overflow) — the caller then behaves exactly as before.
+ */
+export type MarkerTrust =
+  /** Believe only a marker echoing this nonce (the runner path — the default). */
+  | { nonce: string }
+  /** No emitter check at all. Named so a caller cannot fall into it by omission
+   *  (Opus review): an optional nonce silently skipped would reopen "last valid
+   *  marker wins" with no test turning red. Only for reading output nobody
+   *  else could have written into — a human running the CLI, or a unit test. */
+  | { trustUnauthenticated: true };
+
+export function parseSpawnResult(
+  rawStderr: string,
+  trust: MarkerTrust,
+): ParsedSpawnResult | null {
+  const expectedNonce = "nonce" in trust ? trust.nonce : undefined;
+  if (expectedNonce !== undefined && expectedNonce.length === 0) {
+    throw new Error("parseSpawnResult: empty nonce — pass {trustUnauthenticated:true} to skip the check deliberately");
+  }
+  const known = new Set<string>(SPAWN_REASONS);
+  for (const line of rawStderr.split(/\r?\n/).reverse()) {
+    if (!line.startsWith(`${MARKER} `)) continue;
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(line.slice(MARKER.length + 1));
+    } catch {
+      continue; // truncated or interleaved — keep looking further back
+    }
+    if (typeof parsed !== "object" || parsed === null) continue;
+    const { reason, detail, nonce } = parsed as {
+      reason?: unknown;
+      detail?: unknown;
+      nonce?: unknown;
+    };
+    // Emitter proof. Spawned agents inherit this stderr, and an agent working on
+    // THIS repo prints this very contract in its own output — "the last valid
+    // marker wins" would let such a line overrule the real outcome and turn a
+    // launch_failed into a neutral already_running. Only the process we handed
+    // the nonce to can echo it.
+    if (expectedNonce && nonce !== expectedNonce) continue;
+    if (typeof reason !== "string" || !known.has(reason)) continue;
+    return {
+      reason: reason as SpawnReason,
+      ...(typeof detail === "string" && detail.length > 0
+        ? { detail: detail.slice(0, DETAIL_MAX) }
+        : {}),
+    };
+  }
+  return null;
+}
+
+/**
+ * The sentence the web shows. Built from the REASON. Where agent names carry the
+ * actionable part ("which member is missing"), they go through
+ * {@link keepRosterNames} first, so what is interpolated is provably a subset of
+ * the roster the server itself validated — never a sentence a machine chose.
+ * The roster is REQUIRED (Opus review): defaulting it to `[]` would let a caller
+ * drop every name in silence — the same "bypass by omission" the explicit marker
+ * trust closes, failing safe but failing quietly. A caller with no roster passes
+ * `[]` deliberately, and that shows in the diff.
+ *
+ * `policy_refused` interpolates NOTHING: its detail is free-form policy text, not
+ * a name list, so it cannot be shape-checked. The precision stays in the
+ * operator-facing `error`, off the screen.
+ */
+export function messageForReason(
+  reason: SpawnReason,
+  detail?: string,
+  roster: readonly string[],
+): string {
+  const safe = keepRosterNames(detail, roster);
+  const names = safe ? ` (${safe})` : "";
+  switch (reason) {
+    case "already_running":
+      // ATTRIBUTED, not asserted (Opus review). Of the nine reasons this is the
+      // ONLY one that renders as reassuring — every other paints red. So it is
+      // the one a buggy or compromised runner could use to claim "nothing was
+      // launched" while agents are actually running: the exact false green this
+      // issue exists to remove, re-entering through the pipe we just built. The
+      // server cannot verify the claim, so the copy SOURCES it instead. A user
+      // whose screen disagrees with their machine then knows what to doubt.
+      return `the runner reports that a team with this prefix was already running on this machine${names} — so nothing was launched`;
+    case "partial_team":
+      return `the runner reports that a team with this prefix is only PARTLY running — these members are missing${names}. Stop the survivors or pick a fresh prefix`;
+    case "template_invalid":
+      // On the web path this is NOT a user mistake: the runner never passes a
+      // template NAME, it writes the server-validated snapshot to a file and
+      // passes --spec-file. So this means the server's own snapshot could not be
+      // read back — a defect. Telling the user to go read a log they cannot open,
+      // for a problem they did not cause, would repeat this issue in miniature.
+      return "the roster sent for this spawn could not be read back on the runner machine — this is likely a defect, not something you did wrong; the full error is in the machine's log";
+    case "codex_unavailable":
+      return "codex is not launchable on this machine, so no agent was started — install codex or set VIBER_CODEX_BIN";
+    case "launch_failed":
+      return `a member failed to start${names}; the rest of the roster was skipped — the team is incomplete`;
+    case "policy_invalid":
+      return "this machine's local runner policy is present but invalid, so the spawn was refused";
+    case "policy_refused":
+      return "this machine's local policy refuses this spawn";
+    case "unsafe_template_name":
+      return "the template name was rejected as unsafe by the runner";
+    case "partial_run":
+      return "a prior run of this command already started here and was not relaunched — check the machine before retrying";
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viber-channel",
-  "version": "0.8.10",
+  "version": "0.8.12",
   "description": "Voice + text MCP channel between a Claude Code session and the Viber UI (https://viber.dgypx.dev). Push transcripts to Claude; send_message tool delivers text back to the UI.",
   "type": "module",
   "bin": {

package/viber-codex-bridge.ts

@@ -12,6 +12,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { authFilePath, loadAuth } from "./lib/auth.ts";
 import { CONTRACT_STYLE_NEUTRAL, CONTRACT_STYLE_TOOLS } from "./lib/channel_instructions.ts";
+import { applySanitizedPath } from "./lib/codex_shell_path.ts";
 import {
   ConversationMintError,
   defaultLabel,
@@ -620,6 +621,32 @@ class CodexAppServer {
     const codexBin = process.env.VIBER_CODEX_BIN?.trim() || "codex";
     const args = ["app-server"];
     const childEnv = { ...process.env };
+    // #500: codex's Windows sandbox cannot spawn an MSIX-packaged shell (Store
+    // PowerShell 7) under a restricted token — every command died with
+    // CreateProcessAsUserW failed: 5. Drop the WindowsApps alias dirs from the
+    // CHILD's PATH so codex resolves powershell.exe 5.1 instead. The sandbox
+    // keeps its `elevated` backend, which our read-only tiers depend on.
+    // applySanitizedPath collapses every case-variant of the key into one
+    // canonical PATH — handing the child both `Path` and `PATH` would let the
+    // stale one win.
+    const sanitized = applySanitizedPath(childEnv, {
+      platform: process.platform,
+      exists: existsSync,
+    });
+    if (sanitized.stripped.length > 0) {
+      process.stderr.write(
+        `[viber-codex-bridge] #500: removed ${sanitized.stripped.length} MSIX alias dir(s) from the ` +
+          `codex child's PATH so it can spawn processes: ${sanitized.stripped.join(", ")}. ` +
+          "The child therefore loses the Store execution aliases — notably WINGET (and wt, ngrok, " +
+          "the WSL launchers); node/npm/bun/git/codex/python are unaffected. Installing PowerShell 7 " +
+          "from the MSI makes this surgery unnecessary.\n",
+      );
+    } else if (sanitized.skipped) {
+      process.stderr.write(
+        `[viber-codex-bridge] #500: MSIX alias dirs left on the codex child's PATH — ${sanitized.skipped}. ` +
+          "Commands may fail with CreateProcessAsUserW failed: 5; run scripts/repro-codex-spawn.ps1.\n",
+      );
+    }
     if (mcp) {
       args.push("-c", `mcp_servers.viber.url="${mcp.url}"`);
       args.push("-c", `mcp_servers.viber.bearer_token_env_var="${mcp.bearerEnvVar}"`);