[Windows] My Work refresh fails every 10 min: CLI resolver picks npm's extensionless `claude` sh shim, and the Codex refresh profile is unenforceable

## Summary On Windows, the scheduled **My Work** refresh fails every 10 minutes with: ``` Refresh failed: Claude Code: Claude Code stopped: Claude Code native binary at C:\Users\ \AppData\Roaming\npm\claude exists but failed to launch. This usually means the binary does not match this system's libc — e.g. spawning a musl-linked binary on a glibc Linux host fails ... · Codex: codex exec exited 1: ... ERROR codex_core::session: Failed to create session: failed to load AGENTS.md instructions for environment `local`: failed to prepare fs sandbox: failed to prepare windows sandbox wrapper: windows unelevated restricted-token sandbox cannot enforce split filesystem read restrictions directly; refusing to run unsandboxed ``` Both agents fail, for two unrelated reasons. ## Environment - Windows 11 Pro 10.0.26300 - claude-mem 15.4.0 (failing since the 15.3.0 update on 2026-10-26; Codex failures since 2026-10-25) - Claude Code 2.1.309, installed globally with npm (`npm install -g @anthropic-ai/claude-code`) - Codex CLI 0.154.0, `[windows] sandbox = "unelevated"` - `CLAUDE_CODE_PATH` unset in `~/.claude-mem/settings.json` ## Bug 1: Claude CLI resolution picks the npm `sh` shim With `CLAUDE_CODE_PATH` unset, the resolver behind `findClaudeExecutable` (`tl()`) settles on `%APPDATA%\npm\claude`. That is the extensionless POSIX `sh` shim npm generates next to `claude.cmd` / `claude.ps1`: ``` $ where claude C:\Users\ \AppData\Roaming\npm\claude C:\Users\ \AppData\Roaming\npm\claude.cmd ``` Log: `Using Claude CLI v2.1.309 (Claude Code) at C:\Users\ \AppData\Roaming\npm\claude {candidatesProbed=2, skippedTooOld=0}` The version probe passes, but the Agent SDK cannot spawn the shim as a native binary, so every run fails. The SDK error then points at musl/glibc, which hides the real cause on Windows. **Workaround (confirmed):** set `CLAUDE_CODE_PATH` to `%APPDATA%\npm\node_modules\@anthropic-ai\claude-code\bin\claude.exe`. The next refresh logged `Using configured CLAUDE_CODE_PATH ...` and `Work view refresh ok {agent=claude-code}`. The resolved path is cached for 15 min (`ILe`), so the setting only takes effect after the cache expires. **Suggested fix:** on win32, skip extensionless candidates, or prefer `.exe`. For the npm layout, resolve the shim to `node_modules/@anthropic-ai/claude-code/bin/claude.exe`, which is the target of the shim's `exec` line. ## Bug 2: Codex refresh profile cannot run on Windows' unelevated sandbox The Codex agent run passes `--ignore-user-config` plus a permission profile with split read restrictions: ``` -c default_permissions="claude-mem-refresh" -c permissions.claude-mem-refresh.filesystem={":root"="deny",":minimal"="read",":workspace_roots"={"."="read"},...} ``` Codex's unelevated restricted-token sandbox on Windows cannot enforce split filesystem read restrictions, so Codex refuses to start. `--ignore-user-config` also means the user cannot work around it in `config.toml`. On this machine, the Codex fallback for the refresh can never succeed. **Suggested fix:** on win32, detect this case and either use a profile the unelevated sandbox can enforce, or mark Codex as unavailable for agent runs with a clear setup message. That avoids a doomed `codex exec` every 10 minutes.