[codex] Restore setup helper UAC manifest

[iceweasel-oai]

Why

#23764 removed Windows resource stamping from codex-windows-sandbox, but it also removed the setup helper's UAC manifest. That manifest was doing more than cosmetic version metadata: Microsoft documents requestedExecutionLevel level="asInvoker" as the setting that makes an executable run at the same permission level as the process that started it: https://learn.microsoft.com/en-us/windows/win32/sbscs/application-manifests#trustinfo

In the reported session, codex-windows-sandbox-setup.exe was launched for a non-elevated setup refresh and CreateProcess failed with os error 740 (The requested operation requires elevation). Restoring an explicit asInvoker manifest records the helper's intended default launch contract: normal launches inherit the caller's token, and elevation only happens through the code paths that request it explicitly.

The setup helper has two launch modes:

• setup refresh uses a normal Command::new(...) spawn and should never trigger UAC
• full setup explicitly uses ShellExecuteExW with the runas verb when elevation is required

Restoring asInvoker keeps refresh non-elevated by default while preserving the explicit elevated path for full setup.

What changed

• Restored a minimal codex-windows-sandbox-setup.manifest containing only requestedExecutionLevel level="asInvoker".
• Added a small build script that passes setup-helper-scoped manifest linker args for MSVC and the Windows GNU/LLVM target used by Bazel.
• Wired the manifest into Bazel build-script data.

This does not restore winres, FileDescription, ProductName, or package-wide resource stamping, so other Codex binaries that link codex-windows-sandbox do not inherit metadata from this package.

Verification

• cargo fmt -p codex-windows-sandbox
• cargo build -p codex-windows-sandbox --bin codex-windows-sandbox-setup
• cargo build -p codex-windows-sandbox --bin codex-command-runner
• cargo build -p codex-windows-sandbox --lib
• Build-script output simulation for CARGO_CFG_TARGET_ENV=msvc emits /MANIFEST:EMBED and /MANIFESTINPUT:<manifest>.
• Build-script output simulation for CARGO_CFG_TARGET_ENV=gnu + CARGO_CFG_TARGET_ABI=llvm emits -Wl,-Xlink=/manifest:embed and -Wl,-Xlink=/manifestinput:<manifest>.
• Inspected the built binaries and confirmed:
  • codex-windows-sandbox-setup.exe contains requestedExecutionLevel / asInvoker
  • codex-command-runner.exe does not contain those manifest strings
  • Windows VersionInfo remains blank for FileDescription / ProductName
• just test -p codex-windows-sandbox ran through Nextest, with 114 passing, 2 skipped, and 1 existing Windows sandbox failure: unified_exec::tests::legacy_non_tty_cmd_emits_output fails with CreateRestrictedToken failed: 87.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fcb44d6320

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".