codex - 💡(How to fix) Fix Native Windows Codex app: workspace dependency repair fails; npx/tsx and esbuild hit EPERM in sandbox [3 comments, 2 participants]

What version of the Codex App are you using (From “About Codex” dialog)?

The installed Codex app build visible in this session is OpenAI.Codex_26.415.1938.0_x64, so the app version appears to be 26.415.1938.0.

What subscription do you have?

Business plan monthly

What platform is your computer?

Windows 10 x64

What issue are you seeing?

Feedback/session ID: d16ff2fe-4cf9-4bf2-8a8c-ebb4ecbad680

Additional context: this machine is on an out-of-support Windows 10 build and Windows Update reports it is missing important security and quality fixes, so this may be interacting with the native Windows sandbox/runtime.

I’m seeing what looks like a native Windows Codex app sandbox/runtime issue rather than a repo-specific failure.

Environment

• Codex app on Windows
• Sandbox mode: workspace-write
• Approval policy: never
• Network: enabled
• Working directory: C:\AspenMetrics2\receiptcheck-engine

What happened

• “Reset and install workspace” failed
• “Diagnose issues in Codex Workspace” says: “codex dependencies may need repair, send feedback if this keeps happening”
• Codex can run basic Node commands, but fails on npx/tsx and esbuild paths with EPERM

Repro These work:

• node -v
• node -e "console.log('ok')"
• node -e "require('child_process').spawnSync(process.execPath,['-e','console.log(123)'],{stdio:'inherit'})"

This fails before tsx starts:

• npx tsx --version
• Error: EPERM: operation not permitted, lstat 'C:\Users\andre'

These work:

• .\node_modules.bin\tsx.cmd --version
• node .\node_modules\tsx\dist\cli.mjs --version

esbuild repro:

• node -e "console.log(require('esbuild').version)" works
• node -e "require('esbuild').transformSync('const x: number = 1',{loader:'ts'})" fails with spawn EPERM

Direct binary execution from PowerShell works:

• .\node_modules@esbuild\win32-x64\esbuild.exe --version

But Node cannot spawn that same binary:

• spawnSync('.\node_modules\@esbuild\win32-x64\esbuild.exe',['--version'])
• result: EPERM

Additional signal

• fs.realpathSync('C:\Users\andre') returns EPERM
• This suggests the sandbox is blocking access to that path
• Node child-process spawning appears to fail in the mode esbuild relies on

Why this seems like a Codex/runtime issue

• Basic Node execution works
• Repo-local tsx works
• PowerShell can execute the esbuild binary directly
• The failure appears at sandboxed path access and child-process spawn behavior

Questions

1. Is this a known issue with the native Windows Codex app sandbox?
2. Is there a recommended fix or config change?
3. My app UI does not appear to show the documented Windows-native vs WSL agent switch. Is that expected for some builds?

What steps can reproduce the bug?

Session ID: d16ff2fe-4cf9-4bf2-8a8c-ebb4ecbad680

Bug summary: On the native Windows Codex app, the workspace dependency repair/install path appears broken, and Node-based toolchains that rely on certain sandboxed filesystem and child-process behavior fail with EPERM. Basic Node execution works, but npx tsx fails before startup with an lstat EPERM against C:\Users\andre, and esbuild fails with spawn EPERM when invoked through Node. Direct execution of the same local binaries from PowerShell works, which suggests this is a Codex native Windows sandbox/runtime issue rather than a repo-specific dependency failure.

Environment:

• Codex app on Windows
• Sandbox mode: workspace-write
• Approval policy: never
• Network: enabled
• Working directory: C:\AspenMetrics2\receiptcheck-engine

Observed behavior:

• “Reset and install workspace” failed
• “Diagnose issues in Codex Workspace” says: “codex dependencies may need repair, send feedback if this keeps happening”
• npx tsx --version fails with EPERM: operation not permitted, lstat 'C:\Users\andre'
• node -e "require('esbuild').transformSync('const x: number = 1',{loader:'ts'})" fails with spawn EPERM

Expected behavior:

• Workspace dependency repair/install should complete successfully
• npx tsx --version should run normally
• esbuild should be spawnable from Node inside the Codex environment

Minimal repro snippets:

1. Repro the blocked path access:

node -e "require('fs').realpathSync('C:\\Users\\andre')"

### What is the expected behavior?

_No response_

### Additional information

_No response_