Avoid WindowsApps helper read roots

codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs

@@ -348,6 +348,7 @@ fn gather_helper_read_roots(codex_home: &Path) -> Vec<PathBuf> {
     let mut roots = Vec::new();
     if let Ok(exe) = std::env::current_exe()
         && let Some(dir) = exe.parent()
+        && !is_windows_store_package_path(dir)
     {
         roots.push(dir.to_path_buf());
     }
@@ -357,6 +358,10 @@ fn gather_helper_read_roots(codex_home: &Path) -> Vec<PathBuf> {
     roots
 }
 
+fn is_windows_store_package_path(path: &Path) -> bool {
+    canonical_path_key(path).contains("/program files/windowsapps/")
+}
+
 fn gather_legacy_full_read_roots(
     command_cwd: &Path,
     policy: &SandboxPolicy,
@@ -1289,6 +1294,16 @@ mod tests {
         assert_eq!(vec![documents], roots);
     }
 
+    #[test]
+    fn windows_store_package_paths_are_excluded_from_helper_read_roots() {
+        assert!(super::is_windows_store_package_path(Path::new(
+            r"C:\Program Files\WindowsApps\OpenAI.Codex_1.0.0.0_x64__abc123\app\resources"
+        )));
+        assert!(!super::is_windows_store_package_path(Path::new(
+            r"C:\Users\example\.codex\.sandbox-bin"
+        )));
+    }
+
     #[test]
     fn gather_read_roots_includes_helper_bin_dir() {
         let tmp = TempDir::new().expect("tempdir");